06_境外及港澳台调查报告_part09.md

06_境外及港澳台调查报告 · 整合分片 part09

本片含 44 份报告。

FD07204 ｜ 1998_美国_NTSB_HZM9901_Fire_and_Explosion_of_Highway_Cargo_Tanks_Stock_Island.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB99-917005 NTSB/HZM-99/01 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HAZARDOUS MATERIALS ACCIDENT REPORT FIRE AND EXPLOSION OF HIGHWAY CARGO TANKS, STOCK ISLAND KEY WEST, FLORIDA JUNE 29, 1998 7141A

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov/. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB99-917005 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 National Transportation Safety Board. 1999. Fire and Explosion of Highway Cargo Tanks, Stock Island, Key West, Florida, June 29, 1998. Hazardous Materials Accident Report NTSB/HZM-99/01. Washington, DC. Abstract: About 5:14 a.m., eastern daylight time, on June 29, 1998, at Stock Island, Key West, Florida, a Dion Oil Company (Dion) driver was on top of a straight-truck cargo tank checking the contents of its compartments and preparing to transfer cargo from a semitrailer cargo tank when explosive vapors ignited within the straight-truck cargo tank. The ignition caused an explosion that threw the driver from the top of the truck. The fire and a series of at least three explosions injured the driver and destroyed the straight truck, a tractor, the front of the semitrailer, and a second nearby straight-truck cargo tank. Damage was estimated at more than $185,000. The safety issues discussed in this report are the adequacy of Dion’s product-transfer procedures and training, the adequacy of the Federal Highway Administration’s oversight of motor carriers’ procedures and training for loading and unloading hazardous materials, and the adequacy of Florida’s oversight of the fire safety of storage tanks. As a result of its investigation, the National Transportation Safety Board issued recommendations to the Federal Highway Administration, Dion, the Florida State Fire Marshal, the Florida Department of Transportation, the Florida Department of Agriculture, the Florida Department of Environmental Protection, the National Fire Prevention Association, the National Association of State Fire Marshals, and the International Association of Fire Chiefs0

Hazardous Materials Accident Report Fire and Explosion of Highway Cargo Tanks, Stock Island Key West, Florida June 29, 1998 NTSB/HZM-99/01 PB99-917005 National Transportation Safety Board Notation 7141A 490 L’Enfant Plaza, S.W. Adopted September 10, 1999 Washington, D.C. 20594 E # P L U R IB US#UN U M # # N A T I O N A L

T R A S P O R T A T I O N #

# # B O A R D S A F E T Y N

this page intentionally left blank

iii Hazardous Materials Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Vehicle Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Driver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Carrier Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Hazardous Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Sources of Ignition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Federal Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 State Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Federal/State Oversight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Propagation of Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Ignition Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Cargo Tank Loading and Unloading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Oversight of Intrastate Motor Carriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Oversight of Cargo Tanks Used to Store Flammable Liquids . . . . . . . . . . . . . . . 21 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Investigation and Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

this page intentionally left blank

v Hazardous Materials Accident Report Executive Summary About 5:14 a.m., eastern daylight time, on June 29, 1998, at Stock Island, Key West, Florida, a Dion Oil Company (Dion) driver was on top of a straight-truck cargo tank checking the contents of its compartments and preparing to transfer cargo from a semitrailer cargo tank when explosive vapors ignited within the straight-truck cargo tank. The ignition caused an explosion that threw the driver from the top of the truck. The fire and a series of at least three explosions injured the driver and destroyed the straight truck, a tractor, the front of the semitrailer, and a second nearby straight-truck cargo tank. Damage was estimated at more than $185,000. As a result of its investigation of the accident, the National Transportation Safety Board identified three major safety issues: The adequacy of Dion’s product-transfer procedures and training. The adequacy of the Federal Highway Administration’s oversight of motor carriers’ procedures and training for loading and unloading hazardous materials. The adequacy of Florida’s oversight of the fire safety of storage tanks. The Safety Board determines that the probable cause of the accident was Dion’s lack of adequate procedures and driver training, resulting in the driver’s pouring a mixture of gasoline and diesel fuel from a plastic bucket into a cargo-tank compartment that contained a mixture of explosive vapors. As a result of its investigation of this accident, the Safety Board makes recommendations to the Federal Highway Administration, Dion, the Florida State Fire Marshal, the Florida Department of Transportation, the Florida Department of Agriculture, the Florida Department of Environmental Protection, the National Fire Prevention Association, the National Association of State Fire Marshals, and the International Association of Fire Chiefs

this page intentionally left blank

1 Hazardous Materials Accident Report Factual Information Accident Narrative In January 1995, Dion Oil Company (Dion) began renting property at Robbie’s Marina in Stock Island, Florida, as parking space for Dion’s fuel trucks. Dion subsequently began keeping a semitrailer cargo tank on the site as a temporary storage tank for fuels (gasoline and diesel fuel). The fuel in the temporary storage tank was transferred to straight-truck cargo tanks as needed for delivery to clients. The driver injured during the accident had been on vacation from June 17 through June 27, 1998. Records indicate that he returned to work on June 28, the day before the accident, and delivered 400 and 280 gallons of premium unleaded gasoline to Sherman’s Waterfront and to the U.S. Coast Guard Group Key West, respectively. According to the driver, he arrived at Robbie’s Marina shortly before 5 a.m., eastern daylight time, on June 29. He intended to transfer a load of diesel fuel from the temporary storage tank to his cargo tank. He stated that he had just arrived and was carrying a plastic bucket of mixed fuels that he had retrieved from under the temporary storage tank. He indicated that he believed the bucket contained a mixture of gasoline and diesel fuel that had spilled from hoses or fittings during previous cargo transfers.1 He climbed to the top of his vehicle, carrying the bucket, and opened the three compartment lids on his vehicle to determine the type of fuel each compartment held. He indicated that because the two back compartments opened without releasing pressure, he believed they held diesel fuel and that because the front compartment released pressure when it opened, he believed it held gasoline. He stated that he may have been pouring the contents of the bucket into the front compartment when he saw flames coming from the compartment and was thrown from the top of the truck. Emergency Response About 5:14 a.m., two deputies from the Monroe County sheriff’s department were driving past Robbie’s Marina when one of the deputies heard a loud hissing sound coming from the area of the cargo tanks, followed shortly afterward by several explosions and a fire. (See figure 1.) The deputies immediately radioed their dispatcher and reported the accident. At the same time, the owner of the marina was awakened by an explosion and went to the scene. The owner saw the driver lying about 75 feet away from his truck and pulled him away from the fire toward the marina. The driver had second- and third-degree burns on his hands, arms, and legs and a broken left knee. 1The driver stated that he disposed of the spilled material in the buckets under the temporary storage tank as part of his daily routine.

Factual Information 2 Hazardous Materials Accident Report About 5:15 a.m., the Monroe County dispatcher notified the Stock Island Volunteer Fire Department Chief, the Key West International Airport Fire Department, the Big Coppitt Key Volunteer Fire Department, and the Monroe County Ambulance Service. The Stock Island fire chief had been at his residence, which was near the marina, and arrived within minutes. He became the incident commander, and by 5:20 a.m., he had established an incident command post on Shrimp Road, the road that ran past the marina. At 5:24 a.m., a Monroe County ambulance arrived but could not get to the injured driver because the road ran past the burning cargo tanks. The marina owner transported the driver in a private vehicle to the waiting ambulance. The ambulance took the driver to the Lower Florida Keys Health System hospital. (He was later transported by helicopter to Jackson Memorial Hospital Burn Center in Miami, Florida. He was in the hospital and unable to talk for almost 3 months. Once he was able to talk, he could not remember making deliveries the day before the accident and was not clear about all of the events on the morning of the accident.) At 5:30 a.m., the incident commander asked the Boca Chica Naval Air Station Fire Department for help, and it sent a crash truck, which arrived at 5:42 a.m. As soon as it arrived, it began suppressing the fire with foam. By 6:15 a.m., the fire was sufficiently extinguished to allow the fire departments to begin search operations. At 11:09 a.m., all emergency response operations were discontinued. Figure 1. Fire involving the cargo tanks (Photo by Scott Wallace.)

Factual Information 3 Hazardous Materials Accident Report Vehicle Information Three vehicles, all owned by Dion, were involved in the accident. Figure 2 shows where the vehicles were when the accident happened. Vehicle 1, the truck used by the injured driver, had a 5,000-gallon aluminum cargo tank attached to its frame. The cargo tank was a U.S. Department of Transportation (DOT) specification DOT-406 cargo tank, manufactured in 1996 by New Progress, Inc. (now known as AmeriTank-New Progress, Inc.). The cargo tank’s maximum allowable working pressure was 3.3 psig, and its test pressure was 5.0 psig. The cargo tank had three internal compartments. Its total capacity was 5,000 gallons, 3,000 gallons in the front compartment and 1,000 gallons in each of the other two compartments. Vehicle 2, the temporary storage tank, was a combination vehicle, including a tractor and a 9,200-gallon semitrailer cargo tank. The cargo tank was a DOT specification MC-306 aluminum cargo tank manufactured in 1987 by Fruehauf Trailer Corporation. The cargo tank had five internal compartments. Table 1 shows the capacity of each compartment. Figure 2. Accident Site (Vehicle 1 is the straight-truck cargo tank used by the driver. Vehicle 2 is the tractor semi-trailer cargo tank used as a storage tank. Vehicle 3 is the second straight truck.)

Factual Information 4 Hazardous Materials Accident Report Vehicle 3 was a straight truck with a 4,400-gallon aluminum cargo tank. The cargo tank had been manufactured by Eastern Tank Corp, Inc. (now known as AmeriTank-New Progress, Inc.). The date of manufacture is unknown. Dion had limited information about the cargo tank. Also, the tank specification plate was not found after the accident. The cargo tank had two compartments, a 2,000-gallon compartment in the front and a 2,400- gallon compartment in the rear. The cargo tank was neither used nor certified for the transportation of hazardous materials. It had last held a mixture of waste water and petroleum distillates that had been recovered from a customer’s boat. Although the mixture had been removed before the accident, some residue remained. Damage Vehicle 1 sustained extensive fire damage. The upper-shell casing, the baffles, and all four heads were melted down to the chassis level in many areas. The remaining aluminum portions of the tank shell were white, dull, and brittle. Only the aluminum walls between the three compartments and a few inches of the aluminum baffle in the first compartment remained. About a third of the rear tank head remained. (See figure 3.) The remaining aluminum walls at the rear of the tank showed some evidence of tearing and bulging. Parts of the lids and the integral relief valves (internal steel springs) for the front and middle compartments were within their respective compartments. The lid of the back compartment had been thrown about 25 feet from the vehicle. A postaccident metallurgical examination at the Safety Board’s laboratory revealed that the lid had been damaged by the impact but not by heat or fire. The examination also revealed that the weld material on the flange of the lid had failed from overstress and showed no evidence of a preexisting defect. Vehicle 2 sustained extensive damage in the front compartment of the tank and in the tractor. (See figure 4.) The head, wall, and first baffle of the front compartment were melted to about half of their original height. The second baffle was intact but had some bulging in the lower half. The remaining section of the compartment had a heavy layer of soot. The remainder of the cargo tank sustained minimal visible damage; the labels on the side of the tank facing Vehicle 1 showed some signs of soot and burning. Table 1. Capacity of Compartments Compartment Capacity (gallons) 1 (front)* 3,100 2 1,250 3 1,300 4 1,050 5 (back)* 2,500 Total 9,200

• Compartments 1 and 5 had internal baffles.

Factual Information 5 Hazardous Materials Accident Report Figure 3. Damage to Vehicle 1 Figure 4. Damage to Vehicle 2

Factual Information 6 Hazardous Materials Accident Report Vehicle 3 had melted extensively at the rear, which was facing Vehicle 1, and showed bulging and tearing in the forward part of the cargo tank. The left side of the front half of the cargo tank had been sheared from the bottom seam and pushed back onto its right side. (See figure 5.) The front baffle remained. Sections of the tank shell had multiple punctures. One of the manhole assemblies from the cargo tank was about 750 feet away, on the opposite side of the empty above-ground storage tanks, which are shown in figure

1. The assembly showed signs of having been damaged by the impact and was broken into

several pieces. The left side of the truck cab and the rear supports of the cab frame had been torn, and the cab was bowed forward. The concrete pads and confinement walls under and around Vehicles 1 and 2 were also damaged. Postaccident examination revealed spalling2 on both concrete pads and on areas of the confinement wall. The spalling was more pronounced on the pad under Vehicle 1. The concrete on the confinement wall was white and chalky. Driver Information The driver, a 36-year-old male, had a valid Florida commercial driver’s license (CDL) with a cargo-tank and hazardous-materials endorsement and an expiration date of 2According to the National Fire Protection Association, spalling is the chipping or pitting of concrete. Spalling of concrete can be caused by a number of things, including extended exposure to heat or fire. Figure 5. Damage to Vehicle 3

Factual Information 7 Hazardous Materials Accident Report November 12, 2000. He had obtained a Medical Examiner’s Certificate on March 18, 1997, and it was still valid. The driver had been driving cargo tanks and delivering gasoline and diesel fuel for about 11 years, nearly 3 years for Dion and about 8 years for Coen Oil Company in Pennsylvania. He said that he was a smoker and that he occasionally smoked while driving his truck. He also said that he never smoked while loading or unloading his vehicle and that he was not smoking when he checked the compartments on his truck on the morning of the accident. Carrier Information Dion is an intrastate private motor carrier that for over 50 years has hauled bulk liquid-petroleum products, primarily gasoline and diesel fuel, in cargo tanks for local deliveries. Its main customers are commercial fishing vessels. Dion also makes deliveries to Coast Guard vessels on a call-for-delivery basis. Dion owns three tractors, four semitrailer cargo tanks, and seven straight trucks; and eight of its employees are qualified drivers. Neither Dion nor its drivers kept records about which petroleum products were in which compartments of their trucks. The drivers controlled the loading of the cargo into their trucks and, depending on whether gasoline or one of the diesel fuels was to be delivered, were often required to switch load products in a compartment. (To switch load is to put a Class II or III liquid into a tank or compartment that has previously held a Class I liquid. How the classes of liquids are defined is explained table 2 below.) The driver of Vehicle 1 stated that on the morning of the accident he did not know what was in each compartment of his cargo tank. After the accident, Dion estimated that Vehicle 2, the temporary storage tank, had held 2,354 gallons of high sulfur diesel in the front compartment, a residue of high sulfur diesel in the second compartment, a residue of premium unleaded gasoline in the third Table 2. Classes of Flammable Liquids According to the National Fire Protection Association (NFPA)* Class Characteristics Other Information Class I a flash point below 100° F and a vapor pressure that does not exceed 40 psia at 100° F gasoline is in this classification Class II a flash point at or above 100° F and below 140° F most diesel fuels are in this classification Class III a flash point at or above 140° F and below 200° F

• Based on the NFPA’s book of standards, NFPA 385 Tank Vehicles for Flammable and Combustible Liquids

(the NFPA 385).

Factual Information 8 Hazardous Materials Accident Report compartment, 1,000 gallons of low sulfur diesel in the fourth compartment, and a residue of high sulfur diesel in the back compartment. According to Dion, both compartments of the cargo tank of Vehicle 3 had held an undetermined amount of residue of waste water and petroleum distillates. Operating Procedures—Dion had no written cargo-transfer procedures before the accident. However, after the accident the company summarized the procedures its drivers typically used as follows: Transfer from Dion Transport to Tank Wagon—Transport is positioned on concrete pad [cargo-transfer area] with bottom fills [bottom loading adapters] facing truck to be loaded. Truck to be loaded is positioned next to the transport in the same manner and engine is turned off. Dion driver checks transport manifest to determine amount and type of fuel in each compartment. Dion driver checks inventory on truck to be loaded to see which compartment(s) it will hold. Transport driver connects hoses from transport compartment [piping] to transfer pump. Dion driver connects output hose from transfer pump to appropriate compartment [piping] on Dion truck. All hose connections and valves are checked to make sure they are locked and in the right position. Dion driver stands between the trucks in view of the transport driver and all the connections. Transport driver starts transport and activates P.T.O. [transfer pump]. All connections are observed for leaks. While transfer is taking place, drivers are in view of all hoses and within reach of emergency shutoff. When transport compartment is empty, driver walks any remaining fuel from the hose. P.T.O is disengaged, all valves are closed, and hoses are moved to next compartment to be transferred. All compartments are off loaded in the same manner until transport is emptied. After completing transfer, all hoses are emptied and stowed and valves are rechecked. Dion driver checks site to make sure all equipment is stowed and site is clean. Dion did not have procedures that drivers had to follow in handling the buckets of mixed fuels under the storage tank and did not require the drivers to ground and bond the cargo tanks. (For explanations of grounding and bonding, see “Static and Static Protection” in this report.) Also, the cargo-transfer area did not have a grounding rod or other means of grounding the temporary storage tank. Further, neither Vehicle 1 nor the storage tank had a bonding strap. In addition, the driver stated that he did not bond his vehicle while transferring cargo. The hose he used to transfer the product had embedded electrical conducting wires. However, the 1996 Hose Handbook, published by the Rubber Manufactures Association, does not recommend using such wires for bonding because “an internal static wire could break or lose contact with the couplings and not be detected visually.” Training—Dion trained its drivers in handling hazardous materials with an American Trucking Association’s training program. The program includes a training video that states, “This information is for the most part basic and does not reflect the requirements particular to your company….” The program covers the following topics: classes of hazardous materials, shipping papers, labeling, loading and unloading hazardous materials (primarily small packages), placarding, and emergency preparedness

Factual Information 9 Hazardous Materials Accident Report and response. The program does not explain how to load and unload cargo tanks. Dion trained its drivers to load and unload cargo by having them work with an experienced operator. Hazardous Materials Gasoline—is a DOT hazard Class 3 (flammable liquid) with a flash point (closed cup) of -45° F, an auto ignition temperature of 500° F, and a flammable limit range of 1.4 percent to 7.6 percent in air. Gasoline has a very high volatility, corresponding to its low flash point. The NFPA considers gasoline a Class I flammable liquid. High sulfur diesel fuel—is a DOT hazard Class 3 (flammable liquid)3 with a flash point range of 110 to 180° F; its flammable limit range has not been determined. It has a low volatility, corresponding to its high flash point. The NFPA considers diesel fuel with this flash point range a Class II flammable liquid. Low sulfur diesel—is a DOT hazard Class 3 (flammable liquid) with a flash point of 125 to 185° F; its flammable limit range has not been determined. It has a low volatility, corresponding to its high flash point. The NFPA considers diesel fuel with this flash point range a Class II flammable liquid. Sources of Ignition Static and Static Protection—Static electricity is associated with the presence of an electrical charge on the surface of an insulated body and is generated through mechanical work (i.e., scraping or rubbing of two surfaces). The generation of static electrical charges is common during the transfer of such low-conductivity fluids as gasoline and diesel fuels. Further, static charges are generated when the liquid comes in contact with another material, for example, when the liquid flows through a pipe or is mixed, poured, pumped, or agitated. Static production is likely when a flammable or combustible liquid is transferred from a container that has insulating properties and the charge is not allowed to dissipate. Plastics and rubber are common insulators used in transferring flammable and combustible liquids. If sufficient charge is produced and there is no way to dissipate the charge, a static spark can become an ignition hazard. Static charge can be controlled so that it does not become a source of ignition. The first way is to control the flammable vapor mixture within the tank so that it does not reach the flammable range. If the mixture cannot be controlled, grounding and bonding can dissipate or “relax” the static charge. To ground a conductive object is to connect it to the ground so that any static charge is directed away from the object and into the ground. To bond a conductive object is to link it to another conductive object with a bonding wire or strap, thus reducing static sparking because both conductive bodies are brought to the same electrical potential. 3Flammable liquids (like diesel fuel) having a flash point of over 100° F can be reclassified as a combustible liquid (49 Code of Federal Regulations 173.120[b][2]).

Factual Information 10 Hazardous Materials Accident Report According to the NFPA, switch loading either Class II or III liquids into a container that held a Class I liquid presents an unacceptable hazard. The NFPA’s book of standards that applies is the NFPA 30 Flammable and Combustible Liquids Code (the NFPA 30). According to section A-5-6.3 of the NFPA 30: The term switch loading describes a situation that warrants special consideration. When a tank is emptied of a cargo of Class I liquid, there is left a mixture of vapor and air, which can be, and often is, within the flammable range. When such a tank is refilled with a Class I liquid, any charge that reaches the tank shell will be bled off by the required bond wire. Also, there will be no flammable mixture at the surface of the rising oil level because Class I liquid produces at its surface a mixture that is too rich to be ignitable. This is a situation commonly existing in tank vehicles in gasoline service. If, as occasionally happens, a static charge does accumulate on the surface sufficient to produce a spark, it occurs in a too-rich, nonignitable atmosphere and thus causes no harm. A very different situation arises if the liquid is “switch loaded,” that is, when a Class II or Class III liquid is loaded into a tank vehicle that previously contained a Class I liquid. Class II or Class III liquids are not necessarily more potent static generators than the Class I liquid previously loaded, but the atmosphere in contact with the rising oil surface is not enriched to bring it out of the flammable range. If circumstances are such that a spark should occur either across the oil surface or from the oil surface to some other object, the spark occurs in a mixture that can be within the flammable range, and an explosion can result. It is emphasized that bonding the tank to the fill stem is not sufficient; a majority of the recorded explosions have occurred when it was believed the tank had been adequately bonded. The electrostatic potential that is responsible for the spark exists inside the tank on the surface of the liquid and cannot be removed by bonding. Measures to reduce the change of such internal static ignition can be one or more of the following: (a) Avoid spark promoters.... (b) Reduce the static generation by one or more of the following:

1. Avoid splash filling and upward spraying of oil where bottom

filling is used.

1. Employ reduced fill rates at the start of filling through

downspouts until the end of the spout is submerged. Some consider 3 ft (0.914 m) per sec to be a suitable precaution.

1. Where filters are employed, provide relaxation time in the

piping downstream from the filters. A relaxation time of 30 sec is considered by some to be a suitable precaution.

Factual Information 11 Hazardous Materials Accident Report Eliminate the flammable mixture before switch loads by gas freeing or inerting.4 [Footnote added.] The American Petroleum Institute also recognizes the hazards of switch loading low vapor pressure products (NFPA Class II or Class III liquid) into a vessel containing a flammable vapor product (NFPA Class I liquid).5 Other Ignition Sources—According to Global Atmospherics, Inc., FaultFinder Lightning Report, lightning did not strike within 5 miles of the accident site. The closest strike was 59.5 miles away. According to the NFPA, the temperature of the tip of a free-burning cigarette is between 930 and 1,300° F; if the cigarette is being puffed, the temperature is between 1,520 and 1,670° F. Police video recordings of the accident revealed that the headlights of Vehicle 1 were on. The driver said that if the headlights were on, the truck’s engine was running. The exhaust stack for the engine was at the back of the cab on the passenger side, more than 5 feet from the lid of the front compartment. The exhaust temperature for the type of engine that Vehicle 1 had is, when the engine is idling, approximately 300 to 400° F.6 Federal Regulations The pertinent regulations are the “Hazardous Materials Regulations” (the HM regulations), 49 Code of Federal Regulations (CFR) Subchapter C. According to the HM regulations (49 CFR 172.702): A hazmat employer shall ensure that each of its hazmat employees is trained in accordance with the requirements prescribed in this subpart [“Training,”]...and tested.... Also according to the HM regulations (49 CFR 172.704[a][2]): Each hazmat employee shall be provided function-specific training concerning the requirements of this subchapter or exemptions issued under subchapter A [“Hazardous Materials and Oil Transportation”] of this chapter, which are specifically applicable to the functions the employee performs. 4Gas freeing is evacuating all flammable vapors from the container; inerting is displacing all flammable vapors from the container with an inert gas. 5American Petroleum Institute Recommended Practice 2003, Fifth Edition, Protection Against Ignitions Arising Out of Static, Lightning, and Stray Currents, Section 2.4.5, December 1991. 6The information comes from a representative of Alban Tractor (an authorized Caterpillar dealer) in Elkridge, Maryland.

Factual Information 12 Hazardous Materials Accident Report The HM regulations require that each hazmat employee receive recurrent training at least once every 3 years and that records be kept of the training each hazmat employee receives (49 CFR 172.704 [c] and [d], respectively). Under the HM regulations, each person who operates a cargo tank is to be trained in loading and unloading procedures (49 CFR 177.816[b]), but a CDL can be used to satisfy certain training requirements (49 CFR 177.816[c]). However, a January 1997 “On Guard” bulletin prepared by the Federal Highway Administration (FHWA) states: (4) A CDL endorsement merely indicates that the holder has passed a minimal knowledge test concerning the area covered by the endorsement. (5) It is incumbent upon the prospective employer of a commercial vehicle driver to ensure that driver is properly trained. ...Although the CDL Tank (T) and Hazmat (H) endorsements may satisfy part of the hazmat training requirements of Title 49 CFR Part 172 (subpart H), possession of these endorsements does not relieve the employer of the responsibility for providing Hazmat training. The HM regulations require that a cargo tank be bonded when it is being loaded through an open filling hole but not when it is being loaded through a vapor-tight top or bottom connection (49 CFR 177.837[c]). The HM regulations (49 CFR 177.834[c]) state, “Smoking on or about any motor vehicle while loading or unloading any...Class 3 (flammable liquid)...is forbidden.” State Regulations Florida had incorporated the HM regulations in a State statute before the accident and had, substantially, the same requirements for shipping papers, specification packaging, placarding, marking, labeling, training, emergency response, and emergency telephone numbers. Florida had not adopted the Federal regulation requiring CDLs, but had enacted its own State law, which the FHWA had accepted. Florida’s Commercial Driver License Manual for Truck and Bus Drivers provides information on driving a tractor and cargo tank. It provides very limited information about how to load and unload hazardous materials into and from cargo tanks. Section 7-5 of the manual states, “Ground a cargo tank correctly before filling it through an open filling hole.” Also, section 7-4 states, “No Smoking. When loading hazardous materials, keep fire away. Don’t let people smoke nearby. Never smoke around...FLAMMABLES.” Before the accident, Florida had incorporated the NFPA’s standards about fire prevention into its State law by reference. The NFPA 385 (chapter 6) explains the requirements for operating tank vehicles that carry flammable and combustible liquids:

Factual Information 13 Hazardous Materials Accident Report To prevent a hazard from a change in flash point of liquids, no cargo tank, or any compartment thereof, that has been utilized for Class I liquid shall be loaded with Class II or Class III liquid until such tank or compartment and all piping, pumps, meters, and hose connected thereto have been completely drained. A tank, compartment, piping, pump, meter, or hose that does not drain completely shall be flushed at the loading point with a quantity of Class II or Class III liquid equal to twice the capacity of piping, pump, meter, or hose, to clear any residue of Class I liquid from the system. For flammable and combustible liquid storage tanks, the NFPA 30 (chapter 2, section 2-5.8.2.4) requires bonding or grounding for all equipment, including tanks, machinery, and piping, in which ignitable mixtures may be present. About tank vehicles, the NFPA 30 (chapter 5, section 5-6.2) states: Bonding…shall not be required:

1. Where tank cars and tank vehicles are loaded exclusively with products that do

not have static accumulation properties, such as asphalts (including cutback asphalts), most crude oils, residual oils and water-soluble liquids;

1. Where no Class I liquids are handled at the loading facility and where the tank

cars and tank vehicles loaded are used exclusively for Class II or Class III liquids; and

1. Where tank cars and tank vehicles are loaded and unloaded through closed

connections.7 According to the NFPA, since vehicles used for switch loading do not meet the above requirements, bonding is required. Appendix A of the NFPA 385 also recommends bonding to the storage tank down spout, steel loading rack, or other piping for transfer vehicles that top load liquids. Bonding just to the fill stem is not sufficient. In addition, the appendix recommends the reduction of splashing and upward spraying of liquid for vehicles that bottom load. Conductive objects, such as temperature probes not approved for use in explosive environments, should be kept away from the surface of the liquid. Flammable vapor mixtures should be freed or inerted before switch loading. Federal/State Oversight At the time of the accident, the FHWA had some limited authority to inspect intrastate carriers for their compliance with the HM regulations, including the financial responsibility requirements, but did not have the authority to inspect the carriers for their compliance with the requirements about training drivers and about loading and unloading cargo tanks. 7The American Petroleum Institute defines a closed connection as a connection “in which contact is made before the flow starts and is broken after the flow is completed.”

Factual Information 14 Hazardous Materials Accident Report In October 1998 (4 months after the accident), an amendment to the HM regulations became effective;8 under the amendment, all intrastate shippers and carriers had to comply with the HM regulations. The Safety Board had commented on the notice of the proposed rulemaking in October 1993 and had supported the requiring of equivalent levels of safety for interstate and intrastate movements of hazardous materials by motor vehicles. The Board said it had addressed the need to improve safety requirements for intrastate motor-carrier cargo tanks in its report about a cargo tank that overturned in California in 1991, releasing gasoline and causing a fire.9 The investigation found that California had not adopted Federal regulations beyond those in effect on October 1, 1988. As a result, in California, intrastate shipments of hazardous materials could be transported in cargo tanks that failed to meet the amended and improved Federal performance standards. An FHWA inspection of Dion in 1994 covered only the company’s financial responsibility. Because Dion was an intrastate motor carrier, the FHWA did not have the authority to inspect Dion’s training of drivers in or procedures for unloading and loading cargo tanks. At the time of the accident, Florida’s motor-carrier oversight program focused on roadside inspections of vehicles and drivers. Florida inspected three of Dion’s trucks in June 1998 and found each to be in violation because of one or more problems with placards, medical certificates, windshields, lights, tires, or emergency equipment. Before the accident, Florida had also audited a limited number of motor-carrier facilities for compliance with the State’s hazardous-materials regulations, but it had not audited Dion. Florida has recently expanded its program and will audit more motor-carrier facilities. The program now has a senior officer and seven inspectors who will concentrate on inspecting motor-carrier facilities. The program is also attempting to use vehicle-registration data to identify all motor carriers in the State.10 In their investigation of the accident, Safety Board investigators reviewed the FHWA’s training programs for Federal and State inspectors who inspect the facilities of highway motor carriers. The investigators found that the inspectors are trained to evaluate the function-specific training received by hazardous-materials employees but are not specifically taught how to evaluate the training programs designed to train employees in how to load and unload cargo tanks. Fire Safety—The Florida State Fire Marshal establishes minimum fire safety standards for the State concerning storage tanks for flammable liquids, including the 8Amendment, Docket No. HM 200, Federal Register, Vol. 62, No. 1208, dated January 8, 1997. Docket HM-200 was developed in response to the Hazardous Materials Transportation Uniform Safety Act of 1990 (Public Law 101- 615—November 16, 1990), which required the Secretary of Transportation to “issue regulations for the safe transportation of hazardous materials in intrastate, interstate, and foreign commerce” (Section 105 [a][1]). 9Overturn of a Tractor-Semitrailer (Cargo Tank) with the Release of Automotive Gasoline and Fire, Carmichael, California, February 13, 1991 Hazardous Materials Accident Report NTSB/HZM-91/01. (Washington, D.C.: National Transportation Safety Board 1991) 10As a result of deregulation in 1980, motor carriers were no longer required to register in Florida, and old records were lost.

Factual Information 15 Hazardous Materials Accident Report requirement that a storage tank be grounded to dissipate static charges. Each of Florida’s 600 local jurisdictions is allowed to choose one of the four fire-safety standards approved by the State. In addition, each jurisdiction must use the NFPA 101 “Life Safety Code”11 as a minimum standard. Each jurisdiction is responsible for establishing fire safety standards that incorporate the State’s minimum standards. Each jurisdiction also has the authority to inspect storage tanks to ensure their safety. In general, the Florida State Fire Marshal will not inspect storage tanks within a local jurisdiction unless there is a complaint or other matter that cannot be resolved by the jurisdiction. The Florida State Fire Marshal also oversees the training and certification of each fire inspector, including those in the local jurisdictions. The Monroe County fire marshal’s office uses the NFPA “Life Safety Code,” 1994 edition, and the NFPA 30 as industry standards in evaluating the plans for storage tanks. The assistant county fire marshal stated that vehicles used as storage tanks for flammable liquids are required to meet the county’s standards for storage tanks. The county inspects a storage tank when a company applies for a building permit to construct, repair, or renovate the tank. The county fire marshal’s office was not aware that Vehicle 2 was being used as a temporary storage tank for flammable liquids; consequently, the tank had never been inspected. The county assistant fire marshal stated that Dion should have applied for a building permit to use Vehicle 2 as a storage tank for flammable liquids. Although Vehicle 2 was being used as a temporary storage tank, Dion’s management had not realized a building permit was necessary to use the vehicle this way and had not applied for a permit. The assistant fire marshal indicated that the Stock Island volunteer fire chief knew about the vehicles on the site and had not told the fire marshal’s office. The volunteer fire chief stated that he did not know Dion was filling the smaller trucks from the semitrailer. He thought the semitrailer was being used to transport fuel and not as a storage tank. The assistant fire marshal also indicated that his office has excellent communication with the each of the volunteer fire chiefs and will be notified if they identify anything suspicious. Department of Agriculture—The Florida Department of Agriculture checks the accuracy of fuel transfer pumps on vehicles and storage tanks and samples the quality of fuels sold. According to State law, each oil company and service station and each truck that delivers fuel to customers must be registered with the Department of Agriculture. However, there is no requirement that private storage tanks or vehicles that do not sell or deliver fuel be registered; consequently, Vehicle 2 did not have to be registered. Dion, its service stations, and its delivery trucks were registered with the Florida Department of Agriculture. Department of Environmental Protection—The Florida Department of Environmental Protection is charged with protecting the State’s groundwater. The department tries to prevent certain spilled materials getting into the groundwater. The department regulates above-ground storage tanks with capacities above 550 gallons and 111985 edition or subsequent edition.

Factual Information 16 Hazardous Materials Accident Report underground storage tanks with capacities above 110 gallons. A regulated storage tank is also defined as a tank that remains at a location more than 180 days; thus a highway cargo tank could fall within the definition. Such a highway cargo tank must meet the State’s environmental protection requirements for storage tanks, including the requirements about piping systems and spill containment. Facilities within Florida must register all of their regulated tanks with the Department of Environmental Protection. The inspections of the tanks are performed by local jurisdictions under State contract. According to the Consumer Protection Administrator of the Department of Environmental Protection, inspectors do not look for tank grounding attachments, but if an inspector spots an ungrounded tank he should report it to the local fire marshal. The Consumer Protection Administrator was aware of several calls from the State Department of Transportation about vehicles being used as storage tanks. If the Department of Environmental Protection finds that the vehicle is not registered as a storage tank, the department will have the local jurisdiction inspect it. Dion has registered several tanks with the Department of Environmental Protection. The size and quantity of the tanks indicate that they are service stations. The cargo tank used as a storage tank at Stock Island was not registered. Dion’s management indicated that the cargo tank had been moved within the past 30 days (therefore, the tank would not have to be registered). Statistics The Research and Special Programs Administration’s recent statistics (see table 3) indicate that of the reported unintentional releases of hazardous materials from cargo tanks, most releases and almost half of the injuries and fatalities associated with releases occur during loading and unloading operations. The cost of damages resulting from releases of hazardous materials is greater for incidents that occur while the cargo tanks are en route. Table 3. Reported Hazardous-Materials Incidents Involving Highway Cargo Tanksa 1993 to 1997 a These are incidents reported to the Research and Special Programs Administration under 49 CFR 171.16. There may be other unreported incidents. Incidents Fatalities Injuries Damages Loading and Unloading 6,381 7 290 $9,917,723 En Route 1,698 44 279 $69,408,595

Analysis 17 Hazardous Materials Accident Report Analysis Propagation of Fire The driver indicated that he was on top of his truck (Vehicle 1), that he had opened the lid to the front compartment, and that he may have been pouring the contents of a bucket filled with a mixture of gasoline and diesel fuel into the front compartment when the ignition occurred in that compartment. However, he was seriously injured and in the hospital for almost 3 months before he could be interviewed, and his memory of the events that occurred on the day of the accident was not clear. An examination of the accident site verified much of his account of the events that occurred just before the ignition. The damage to the three vehicles and to the concrete pads indicates that Vehicle 1 was the area where the fire started. Vehicle 1 was almost totally destroyed, while the other two vehicles had less severe damage. Also, the spalling of the concrete was most extensive on the pad under Vehicle 1, indicating that it had been exposed to high temperatures for a longer period. Further, the damage to the other two vehicles was greater on the ends that were closer to Vehicle 1. Therefore, the Safety Board concludes that the damage and fires on the other two vehicles resulted from exposure to heat from the fire on Vehicle 1. The kind of damage that Vehicle 1 sustained indicates that the fire started in the front or middle compartment. The walls of these compartments were melted down to the chassis level, whereas about a third of the rear wall of the tank was still intact. Also, an examination of the lid of the rear compartment, which was found about 25 feet from the truck, indicated that the lid was blown off the tank before the material in the compartment was involved in the fire. The metallurgical examination revealed that the weld material on the lid flange failed from overstress; nothing suggested a preexisting defect. The fact that the lid showed no evidence of fire indicates that it broke away from the compartment before the material within started to burn. Therefore, it is likely that the fire in the front and middle compartments heated the material in the back compartment, causing a rapid overpressurization and explosion in the back compartment, which broke the lid from the tank. After the accident, the driver was found in front of his truck, about 75 feet away from the spot on the cargo tank where, according to him, he was standing when the explosion occurred. Given the extent of his burns and his broken knee, it is unlikely that he had moved very far from where he originally fell. The explosion or pressure surge necessary to propel him such a distance from the truck would have had to come from the ignition and subsequent expansion of explosive vapors within one of the compartments. Had the vapors instead ignited outside of a compartment, they would have been unconfined and thus unable to create enough of a pressure surge to throw the driver so far. Also, because no fragments or other evidence of catastrophic failure of the front two compartments was discovered, it is likely that the pressure surge occurred through one of the compartment openings. Further, had the pressure surge occurred through one of the

Analysis 18 Hazardous Materials Accident Report compartment openings, the driver would have been thrown away from the center of the explosion. Therefore, given where the driver was found, it is likely that he was, as he remembered, standing on top of the vehicle in front of the opening for the compartment when the ignition occurred. The discovery of a manhole cover from Vehicle 3 about 750 feet away and the sheared metal on the front half of the tank shell indicate that a subsequent explosion occurred when the front compartment on this vehicle failed, which happened because the residue of the materials it contained was overpressured by the radiant heating from the fire on the nearby vehicles. Ignition Source Dion did not have records of the quantities and types of materials in each of the compartments of Vehicle 1. However, diesel fuel, which has a flash point between 110 and 180° F, will not readily ignite at ambient temperatures. Therefore, the fire was more likely to have been caused by the ignition of gasoline vapors, which have a -45° F flash point and will, as a result, readily ignite in almost any ambient temperature. However, according to the NFPA, gasoline will not ignite unless there is enough oxygen: If, as occasionally happens, a static charge does accumulate on the [liquid] surface [of a tank containing only gasoline] sufficient to produce a spark, it occurs in a too-rich, nonignitable atmosphere and thus causes no harm. Dion’s drivers switch loaded materials in the compartments of their trucks as needed to make deliveries. According to the NFPA and the American Petroleum Institute, the switch loading of gasoline and diesel fuel can create dangerous conditions within a compartment. When diesel fuel is loaded in a compartment that last contained gasoline or is contaminated with gasoline, according to the NFPA: ...the atmosphere in contact with the rising oil surface is not enriched to bring it [gasoline vapors] out of the flammable range. If circumstances are such that a spark should occur either across the oil surface or from the oil surface to some other object, the spark occurs in a mixture that can be within the flammable range, and explosion can result. Static electricity is a common ignition source. A static electrical charge can be generated when gasoline and diesel fuel are transferred from a container, such as a plastic bucket, that has insulating properties. Further, if the pouring causes the liquid to splash or become agitated, a static electrical charge is generated. In fact, the NFPA indicates that splash filling is a condition to be avoided when switch loading products. Therefore, the Safety Board concludes that the ignition and fire in the cargo tank were probably caused by a static discharge in a compartment on Vehicle 1 that resulted from the driver’s pouring a mixture of gasoline and diesel fuel from a plastic bucket into the compartment. Other possible ignition sources were examined: there was no lightning in the area of the explosion; the temperature of the nearby truck exhaust stack (300 to 400° F) was not sufficient to reach the auto ignition temperature of gasoline vapors (500° F); and while

Analysis 19 Hazardous Materials Accident Report smoking as a possible ignition source cannot be totally eliminated, there was no evidence that the driver was smoking, and he stated that he was not smoking when the ignition occurred. Given the circumstances of this accident, the Safety Board believes that the FHWA should issue an “On Guard” bulletin to emphasize the danger of splash filling materials into cargo compartments and of switch loading materials having flash points at or above 100° F (NFPA Class II and III liquids) into compartments that last contained materials having flash points below 100° F (NFPA Class I liquid). Cargo Tank Loading and Unloading Dion’s operating procedures and driver training were not adequate to ensure safe cargo transfers. Operating Procedures—Dion had no written procedures about loading and unloading cargo tanks. According to the driver, it was his normal practice to pour the contents of a bucket filled with a mixture of diesel fuel and gasoline into an open compartment on the top of his cargo tank, and that is what he was probably doing when the fire ignited. Because Dion did not have written procedures for safely handling the cargo, the driver’s unsafe practice was not prohibited by the company and, as stated earlier, probably produced a static electric charge that ignited the cargo. Therefore, Dion’s lack of written procedures about the hazards of pouring a mixture of gasoline and diesel fuel from a plastic bucket into an open compartment was a causal factor in this accident. In addition, Dion had no procedures about or equipment for grounding and bonding its vehicles to prevent the accidental ignition of flammable liquids during cargo transfer. (Because the driver had not begun transferring cargo when the accident happened, the lack of grounding and bonding procedures is not directly related to the cause of this accident.) Florida’s regulations and the NFPA’s standards referenced therein require that storage tanks for flammable and combustible liquids be grounded and that a vehicle be bonded when NFPA Class I and Class II flammable liquids are being switch loaded. Dion’s drivers frequently switch loaded gasoline (Class I liquid) and diesel fuel (Class II liquid) in various compartments of their cargo tanks. The Safety Board concludes that Dion did not have written procedures to ensure safe cargo handling, including procedures prohibiting the pouring of flammable liquids into its open cargo-tank compartments and procedures requiring the bonding of cargo tanks when flammable liquids are being switch loaded between them. Therefore, the Safety Board believes that Dion should establish written procedures for safely loading and unloading cargo tanks. Since the accident, Dion has discontinued its cargo-transfer operations on Stock Island. The company is loading and unloading its cargo tanks from a stationary tank in Homestead, Florida.12 12The procedures for loading and unloading cargo tanks at Homestead were requested; however, they were not provided.

Analysis 20 Hazardous Materials Accident Report Training—The HM regulations require employers to train and test any of their employees who handle hazardous materials; the training must include function-specific training for cargo loading and unloading. Dion did not train its drivers adequately in this area. Other than on-the-job training, the only training Dion provided consisted of an American Trucking Association’s training video and test that gave only a general overview of hazardous-materials transportation. The video did not specifically address the procedures for loading or unloading hazardous materials into and from cargo tanks. Each of Dion’s drivers had a Florida CDL with a “Tank” certification. According to Federal regulations, a CDL can be a substitute for general training; however, Florida’s Commercial Driver License Manual for Truck and Bus Drivers primarily focuses on driving a tractor and cargo tank rather than on procedures for loading or unloading hazardous materials into and from cargo tanks. Neither the Florida CDL nor the American Trucking Association’s video provided complete function-specific training on loading or unloading cargo tanks with hazardous materials. In summary, the Safety Board concludes that Dion did not adequately train its drivers to ensure safe cargo handling; in particular, the company did not teach its drivers about the danger of pouring flammable liquids into open compartments of a cargo tank or about the danger of switch loading flammable liquids between cargo tanks that are not bonded. Therefore, the Safety Board believes that Dion should give drivers function-specific training on the written procedures developed in conjunction with the recommendation that Dion establish written procedures for safely loading and unloading cargo tanks. The training should explain the danger of discharging static electricity when flammable liquids are poured into open cargo-tank compartments that contain explosive vapors, the danger of transferring flammable liquids between cargo tanks that are not bonded, and the danger of explosive vapors produced by switch loading gasoline and diesel fuels. Oversight of Intrastate Motor Carriers The HM regulations require the training and testing of drivers on the loading and unloading of cargo tanks. An employer must train his employees in handling hazardous materials safely, particularly when cargo is being loaded or unloaded. The employer must ensure that the employee has recurrent training at least every 3 years. Florida had incorporated the HM regulations in its State regulations. The records, however, indicate that Federal and State inspectors had never evaluated Dion’s training programs and procedures for loading and unloading cargo tanks. Before the accident, the FHWA had no authority to evaluate the training programs of intrastate motor carriers. Furthermore, while Florida had the authority to inspect Dion’s facilities, the State focused on roadside inspections of vehicles and not on facility inspections. Beginning in October 1998, all of the HM regulations became applicable to intrastate motor carriers, and the FHWA gained additional authority to inspect intrastate motor-carrier operations. The FHWA is working independently and in cooperation with the States to develop programs under which both the Federal and the State governments

Analysis 21 Hazardous Materials Accident Report will inspect intrastate hazardous-materials motor carriers. Also, since the accident, Florida has expanded its compliance program to increase the number of intrastate hazardous- materials motor-carrier audits. Thus far, however, the FHWA does not train Federal and State inspectors in evaluating function-specific training for employees who load and unload hazardous- materials cargo tanks. After reviewing the Research and Special Programs Administration’s statistics, Safety Board investigators found that the number of unintentional releases of hazardous materials and the number of injuries that occur during the loading and unloading of cargo tanks are significant when compared to the numbers associated with cargo tanks that are en route. The Safety Board concludes that the Federal training programs for Federal and State motor-carrier inspectors do not adequately address the need for inspectors to evaluate the training that motor carriers give their drivers on loading and unloading cargo tanks. Therefore, the Safety Board believes that the FHWA should add elements to training programs for Federal and State inspectors that include instruction on determining whether motor carriers have adequate written procedures for and driver training in loading and unloading cargo tanks. Also, given the circumstances of this accident--the fact that before October 1998 intrastate motor carriers were not subject to all of the HM regulations, the relative number of unintentional releases of hazardous materials from cargo tanks during loading and unloading, and the fact that the Federal training programs do not adequately address the need for inspectors to evaluate the training that motor carriers give their drivers about loading and unloading cargo tanks--the Safety Board concludes that there is a need to ensure that hazardous-materials motor carriers (both intrastate and interstate) have adequate procedures for and adequate driver training in loading and unloading cargo tanks. The Safety Board believes that the FHWA should evaluate the adequacy of cargo- tank loading and unloading procedures of and driver training for hazardous-materials motor carriers and require changes as appropriate. Oversight of Cargo Tanks Used to Store Flammable Liquids Although the Florida Departments of Agriculture and of Environmental Protection regulate and require the registration of storage tanks used to store flammable liquids, only the Florida State Fire Marshal has the authority to regulate the fire safety of these tanks, including the grounding requirements. However, while the Florida State Fire Marshal has minimum requirements for inspecting storage tanks for fire safety and ensures the training and qualification of State and local fire safety inspectors, the storage tanks are inspected by Florida’s 600 local jurisdictions. Vehicle 2 was being used as a temporary storage tank for fuel transfer; however, Dion was not aware that using the tank as a storage tank required a county building permit and, consequently, had not applied for a permit. Also, the Stock Island volunteer fire chief (who knew about the vehicles on the site) did not know that Vehicle 2 was being used as a storage tank and did not tell the fire marshal’s office about the vehicles. Therefore, the

Analysis 22 Hazardous Materials Accident Report Monroe County fire marshal’s office was not aware of this tank and had never inspected it for compliance with fire safety regulations. Because highway cargo tanks, like Vehicle 2, are not readily identifiable as storage tanks, the Safety Board concludes that local jurisdictions may not know that cargo tanks may be used to store flammable liquids and that such tanks need to be inspected to ensure that they are safe for the storage and transfer of these liquids. Although there is no list of the cargo tanks that are used as storage tanks, information could be gathered using the registration lists of the Florida Departments of Agriculture and of Environmental Protection, the list of motor carriers being developed by the Florida Department of Transportation, and information provided by inspectors for the various departments and the local fire departments. The Safety Board believes that the Florida State Fire Marshal should make all local jurisdictions aware of the circumstances of the fire and explosions that occurred on Stock Island. The Florida State Fire Marshal should also ensure that each local jurisdiction has a program to identify and inspect cargo tanks used as storage tanks for flammable liquids to be sure the tanks meet all the fire safety standards applicable to storage tanks. The Safety Board also believes that the Florida State Fire Marshal should coordinate the help that the Florida Departments of Transportation, of Agriculture, and of Environmental Protection give local jurisdictions in identifying cargo tanks used as storage tanks for the transfer of flammable liquids to be sure that the tanks meet all fire safety standards applicable to storage tanks. The Safety Board believes that the Florida Departments of Transportation, of Agriculture, and of Environmental Protection should assist the Florida State Fire Marshal in helping local jurisdictions identify cargo tanks being used as storage tanks so that the tanks can be inspected to ensure that they meet all fire safety standards applicable to storage tanks. Additionally, because the problem of identifying and inspecting for fire safety cargo tanks used as storage tanks may not be limited to Florida, the Safety Board believes that the NFPA, the National Association of State Fire Marshals, and the International Association of Fire Chiefs should notify their members about the circumstances of the fire and explosions that occurred on Stock Island and urge them to develop a program to identify and inspect cargo tanks used as storage tanks for the transfer of flammable liquids to be sure that the tanks meet all fire safety standards applicable to storage tanks.

23 Hazardous Materials Accident Report Conclusions Findings

1. The ignition and fire in the cargo tank were probably caused by a static discharge in a

compartment on Vehicle 1 that resulted from the driver’s pouring a mixture of gasoline and diesel fuel from a plastic bucket into the compartment.

1. The damage and fires on the other two vehicles resulted from exposure to heat from

the fire on Vehicle 1.

1. Dion Oil Company did not have written procedures to ensure safe cargo handling,

including procedures prohibiting the pouring of flammable liquids into its open cargo-tank compartments and procedures requiring the bonding of cargo tanks when flammable liquids are being switch loaded between them.

1. Dion Oil Company did not adequately train its drivers to ensure safe cargo handling;

in particular, the company did not teach its drivers about the danger of pouring flammable liquids into open compartments of a cargo tank or about the danger of switch loading flammable liquids between cargo tanks that are not bonded.

1. The Federal training programs for Federal and State motor-carrier inspectors do not

adequately address the need for inspectors to evaluate the training that motor carriers give their drivers on loading and unloading cargo tanks.

1. Given the circumstances of this accident, the fact that before October 1998, intrastate

motor carriers were not subject to all of the Federal “Hazardous Materials Regulations,” the relative number of unintentional releases of hazardous materials from cargo tanks during loading and unloading, and the fact that the Federal training programs do not adequately address the need for inspectors to evaluate the training that motor carriers give their drivers about loading and unloading cargo tanks, there is a need to ensure that hazardous-materials motor carriers (both intrastate and interstate) have adequate procedures for and adequate driver training in loading and unloading cargo tanks.

1. Because highway cargo tanks, like Vehicle 2, are not readily identifiable as storage

tanks, local jurisdictions may not know that cargo tanks may be used to store flammable liquids and that such tanks need to be inspected to ensure that they are safe for the storage and transfer of these liquids. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was Dion Oil Company’s lack of adequate procedures and driver training, resulting in the driver’s pouring a mixture of gasoline and diesel fuel from a plastic bucket into a cargo-tank compartment that contained a mixture of explosive vapors.

24 Hazardous Materials Accident Report Recommendations As a result of this accident, the National Transportation Safety Board makes the following safety recommendations: to the Federal Highway Administration: Add elements to training programs for Federal and State inspectors that include instruction on determining whether motor carriers have adequate written procedures for and driver training in loading and unloading cargo tanks. (H-99-30) Evaluate the adequacy of cargo-tank loading and unloading procedures of and driver training for hazardous-materials motor carriers and require changes as appropriate. (H-99-31) Issue an “On Guard” bulletin to emphasize the danger of splash filling materials into cargo compartments and of switch loading materials having flash points at or above 100° F (National Fire Protection Association Class II and III liquids) into compartments that last contained materials having flash points below 100° F (National Fire Protection Association Class I liquid). (H-99-32) to Dion Oil Company: Establish written procedures for safely loading and unloading cargo tanks. (H-99-33) Give drivers function-specific training on the written procedures developed in conjunction with Safety Recommendation H-99-33. The training should explain the danger of discharging static electricity when flammable liquids are poured into open cargo-tank compartments that contain explosive vapors, the danger of transferring flammable liquids between cargo tanks that are not bonded, and the danger of explosive vapors produced by switch loading gasoline and diesel fuels. (H-99-34) to the Florida State Fire Marshal: Make all local jurisdictions in Florida aware of the circumstances of the fire and explosions that occurred on Stock Island, Florida, on June 29,

1. In addition, ensure that each local jurisdiction has a program to

identify and inspect cargo tanks used as storage tanks for flammable liquids to be sure the tanks meet all the fire safety standards applicable to storage tanks. (H-99-35)

Recommendations 25 Hazardous Materials Accident Report Coordinate the help that the Florida Departments of Transportation, of Agriculture, and of Environmental Protection give local jurisdictions in identifying cargo tanks used as storage tanks for the transfer of flammable liquids to be sure that the tanks meet all fire safety standards applicable to storage tanks. (H-99-36) to the Florida Department of Transportation: Assist the Florida State Fire Marshal in helping local jurisdictions identify cargo tanks being used as storage tanks so that the tanks can be inspected to ensure that they meet all fire safety standards applicable to storage tanks. (H-99-37) to the Florida Department of Agriculture: Assist the Florida State Fire Marshal in helping local jurisdictions identify cargo tanks being used as storage tanks so that the tanks can be inspected to ensure that they meet all fire safety standards applicable to storage tanks. (H-99-38) to the Florida Department of Environmental Protection: Assist the Florida State Fire Marshal in helping local jurisdictions identify cargo tanks being used as storage tanks so that the tanks can be inspected to ensure that they meet all fire safety standards applicable to storage tanks. (H-99-39) to the National Fire Prevention Association: Make your members aware of the circumstances of the fire and explosions that occurred on Stock Island, Florida, on June 29, 1998, and urge them to develop a program to identify and inspect cargo tanks used as storage tanks for the transfer of flammable liquids to be sure that the tanks meet all fire safety standards applicable to storage tanks. (H-99-40) to the National Association of State Fire Marshals: Make your members aware of the circumstances of the fire and explosions that occurred on Stock Island, Florida, on June 29, 1998, and urge them to develop a program to identify and inspect cargo tanks used as storage tanks for the transfer of flammable liquids to be sure that the tanks meet all fire safety standards applicable to storage tanks. (H-99-41)

Recommendations 26 Hazardous Materials Accident Report to the International Association of Fire Chiefs: Make your members aware of the circumstances of the fire and explosions that occurred on Stock Island, Florida, on June 29, 1998, and urge them to develop a program to identify and inspect cargo tanks used as storage tanks for the transfer of flammable liquids to be sure that the tanks meet all fire safety standards applicable to storage tanks. (H-99-42) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member ROBERT T. FRANCIS II Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member September 10, 1999

27 Hazardous Materials Accident Report Appendix Investigation and Hearing The National Transportation Safety Board was notified of the accident about 11:00 a.m., eastern daylight time, on June 29, 1998. A full go-team was dispatched from Washington, D.C., to Stock Island, Florida. Member Hammerschmidt was the Board Member on scene. Investigative groups were established for hazardous materials, survival factors, fire investigation, and metallurgy. Parties to the investigation were the Federal Highway Administration, Dion Oil Company, Monroe County Sheriff and Fire Marshal Offices, and Sea Tow Service (an environmental response company). The Safety Board did not conduct a public hearing during this investigation.

28 Hazardous Materials Accident Report Abbreviations CDL commercial driver’s license CFR Code of Federal Regulations Dion Dion Oil Company DOT U.S. Department of Transportation FHWA Federal Highway Administration HM regulations “Hazardous Materials Regulations” (49 CFR Subchapter C) NFPA National Fire Protection Association NFPA 30 NFPA 30 Flammable and Combustible Liquids Code NFPA 385 NFPA 385 Tank Vehicles for Flammable and Combustible Liquids

FD07205 ｜ 1998_美国_NTSB_HZM9902_Overflow_of_Gasoline_and_Fire_at_a_Service_StationConvenienc.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB99-917007 NTSB/HZM-99/02 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HAZARDOUS MATERIALS ACCIDENT REPORT OVERFLOW OF GASOLINE AND FIRE AT A SERVICE STATION-CONVENIENCE STORE BILOXI, MISSISSIPPI AUGUST 9, 1998 7120A

National Transportation Safety Board. 1999. Overflow of Gasoline and Fire at a Service Station- Convenience Store, Biloxi, Mississippi, August 9, 1998. Hazardous Materials Accident Report NTSB/HZM-99/02. Washington, DC. Abstract: This report explains the gasoline overflow and resulting fire that occurred during a cargo transfer by Premium Tank Lines, Inc., to an underground storage tank at a Fast Lane gasoline station-convenience store in Biloxi, Mississippi, on August 9, 1998. The fire engulfed three vehicles at a nearby intersection, which ultimately resulted in the deaths of five occupants and the serious injury of one. Damages were estimated at $55,000. From its investigation of this accident, the Safety Board identified safety issues in the following areas: Premium Tank Line, Inc.’s management oversight; R.R. Morrison and Son, Inc.’s procedures for accepting petroleum product deliveries to underground storage tanks; and Federal requirements and oversight. Based on its findings, the Safety Board made recommendations to the Federal Highway Administration, the Research and Special Programs Administration, the Environmental Protection Agency, Premium Tank Lines, Inc., R.R. Morrison and Son, Inc., the American Petroleum Institute, the National Tank Truck Carriers Association, the National Association of Convenience Stores, the National Association of Truck Stop Operators, the Petroleum Marketers Association of America, the Service Station Dealers of America, and the Society of Independent Gasoline Marketers of America. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov/. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB99-917007 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

Hazardous Materials Accident Report Overflow of Gasoline and Fire at a Service Station-Convenience Store Biloxi, Mississippi August 9, 1998 NTSB/HZM-99/02 PB99-917007 National Transportation Safety Board Notation 7120A 490 L’Enfant Plaza, S.W. Adopted: September 21, 1999 Washington, D.C. 20594

this page intentionally left blank

iii Hazardous Materials Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Events at Fast Lane Station No. 741. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Police Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Fire Department Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Vehicle Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Hazardous Materials Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Facility Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Other Overfills at Station No. 741 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Driver’s Military Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Civilian Training and Work History. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Other Overfills by the Truckdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Operating Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Medical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Work-Rest Routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Toxicological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Carrier Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Hiring Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Safety Briefings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Dispatch Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Transfer Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Carrier Oversight by the Federal Highway Administration . . . . . . . . . . . . . . . . . 22 Red Jacket™ Monitoring System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Fast Lane Employee Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Contents iv Hazardous Materials Accident Report Environmental Protection Agency Requirements. . . . . . . . . . . . . . . . . . . . . . . . . 23 Safeguards Against Overfills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Regulations Pertaining to Monitoring Transfers . . . . . . . . . . . . . . . . . . . . . . 23 EPA State Program Approval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Regulatory Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Notification of Hazardous Materials Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Adequacy of Premium’s Management Oversight. . . . . . . . . . . . . . . . . . . . . . . . . 28 Hiring Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Employee Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Adherence to Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Dispatch Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Adequacy of Fast Lane Employee Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Adequacy of EPA Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Accident Notification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 B: Driver-Trainer’s Checksheet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Abbreviations and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

v Hazardous Materials Accident Report Executive Summary On August 9, 1998, about 12:53 a.m., a Premium Tank Lines, Inc., truckdriver was transferring gasoline from a cargo tank to underground storage tanks at a Fast Lane gasoline station-convenience store in Biloxi, Mississippi, when an underground storage tank containing gasoline overflowed. An estimated 550 gallons of gasoline flowed from the storage tank, across the station lot into the adjacent highway, through an intersection, and into a storm drain. The gasoline ignited, and fire engulfed three vehicles near the intersection, which ultimately resulted in the deaths of five occupants and the serious injury of one. Damages were estimated at $55,000. The National Transportation Safety Board determines that the probable cause of the accident was the failure of Premium Tank Line, Inc.’s officials to follow established company procedures in hiring and training new drivers, the company’s lack of adequate procedures for dispatching drivers and delivering cargo to customer facilities, and the failure of R.R. Morrison and Son, Inc., to have adequate safety procedures for accepting product offered for delivery at its Fast Lane stations. Contributing to the accident was the truckdriver’s various and numerous operating errors during the gasoline transfer process that led to the underground storage tank overfill. The following safety issues are discussed in this report: • Premium Tank Line, Inc.’s management oversight; • R.R. Morrison and Son, Inc.’s procedures for accepting petroleum product deliveries to underground storage tanks; and • Federal requirements and oversight. As a result of its investigation of this accident, the Safety Board makes recommendations to the Federal Highway Administration, the Research and Special Programs Administration, the Environmental Protection Agency, Premium Tank Lines, Inc., R.R. Morrison and Son, Inc., the American Petroleum Institute, the National Tank Truck Carriers Association, the National Association of Convenience Stores, the National Association of Truck Stop Operators, the Petroleum Marketers Association of America, the Service Station Dealers of America, and the Society of Independent Gasoline Marketers of America.

this page intentionally left blank

1 Hazardous Materials Accident Report Factual Information Accident Synopsis On August 9, 1998, about 12:53 a.m., a truckdriver for Premium Tank Lines, Inc., (Premium) was transferring gasoline from a cargo tank to underground storage tanks at a Fast Lane gas station-convenience store in Biloxi, Mississippi, when gasoline from one of the underground storage tanks began to overflow. An estimated 550 gallons of gasoline flowed from the storage tank, across the station lot into the adjacent highway, through the intersection, and into a storm drain. The gasoline ignited, and fire engulfed three vehicles near the intersection. Each of the three vehicles had two occupants. Of the six people, five sustained fatal injuries and one received serious injuries. Additionally, a firefighter dispatched to the accident site sustained minor injuries while attempting to suppress the fire. Damages were estimated at $55,000. Accident Narrative Preaccident Events Shortly after 5:30 p.m. on August 8, 1998, a Biloxi-based Premium truckdriver, in accordance with the company’s operating practices, telephoned the weekend dispatcher at Premium’s headquarters in Jackson, Mississippi, to obtain the assigned deliveries for his evening shift. The safety director, who was serving as dispatcher, told the truckdriver the delivery locations and the type and amount of gasoline to be delivered that evening. He said that he told the driver to make deliveries to the following Fast Lane stations: Nos. 742, 743, and 736. The driver’s notes indicated that he wrote down the following station numbers: 742, 743, and 741.1 The driver did not, nor was he required by written company procedures to, repeat or read back the information to the dispatcher to verify its accuracy during the telephone call.2 The Premium truckdriver departed Biloxi about 9:00 p.m. and drove his tractor- cargo tank trailer combination about 70 miles to the Shell Refinery in Saraland, Alabama, where he arrived about 10:08 p.m. He loaded one of the cargo tank’s four compartments with 2,473 gallons of premium unleaded gasoline and the other three compartments with a total of 5,891 gallons of regular unleaded gasoline. He left the refinery at 10:23 p.m. 1 The Premium dispatch records indicate that this same driver had made a delivery to Fast Lane station No. 741 on his shift that ended the morning of August 8; no delivery was scheduled to the station during his shift that ended on August 9. 2 Premium did not have a policy of providing its drivers with confirmation of assigned deliveries by means of a written letter, facsimile, or electronic mail. Information about company policies appears later in this report.

Factual Information 2 Hazardous Materials Accident Report Events at Fast Lane Station No. 741 Arriving at Fast Lane station No. 741 about midnight, the truckdriver parked the tractor cargo tank combination next to the remote fill ports (figure 1). Premium’s operating practices require its drivers to present the bill of lading to the station operator before making the gasoline transfer. The truckdriver, however, did not do this. Drivers are also required to determine and document the gasoline level in an underground storage tank by inserting a graduated measuring stick that they carry on the cargo tank truck into the direct fill ports before and after transferring gasoline. This procedure, which drivers refer to as “sticking the tank,” provides drivers with a product level reading in inches.3 Figure 1. Layout of accident site. The vehicles numbered 1, 2, and 3 are, respectively, a 1995 four-door Hyundai sedan, a 1997 four-door Mazda sedan, and a 1999 Ford pick-up truck. 3 Because the sizes of storage tanks differ, the inch level of gasoline does not directly correlate with the number of gallons in a tank. The method drivers use to determine the number of gallons in a storage tank is discussed later in this report. Fast Lane station No. 741 has three underground storage tanks, which are indicated by the dotted line figures to the right of the gasoline pumps. One tank is for premium unleaded gasoline, one is for regular unleaded gasoline, and one is for diesel. Each of the tanks may be filled through either of two ports: a direct fill port located on the east side of the gas station property in a parking area or a remote fill port located on the south side of the property near the gas pumps. The direct and the remote fill ports are about 90 feet apart. Truckdrivers most often use the remote fill ports to transfer gasoline at the station.

Factual Information 3 Hazardous Materials Accident Report According to the truckdriver, he was able to stick the premium unleaded tank, but access to the regular unleaded direct fill port initially was blocked by a parked vehicle. He therefore went into the convenience store to obtain an inventory printout from the on-site Red Jacket™ system terminal.4 He said that he did not know how to use the Red Jacket™ system so he asked for help from a Fast Lane employee. The store’s assistant manager then generated a printout for him. Although the Red Jacket™ printout showed the gallons of gasoline and ullage5 in each of the underground storage tanks, the driver later told Safety Board investigators that he did not fully understand the printout and that he had obtained it only for the inch reading that he was required to record on his paperwork.6 The truckdriver said that, upon exiting the store, he discovered that the vehicle blocking the direct fill port had moved. He was then able to stick the regular unleaded tank for his reading. He said that he did not use the inch readings to calculate the available space in the underground storage tanks. Instead, he relied solely on the information he had obtained earlier from the Premium dispatcher. After taking the inch readings, he did not replace the lids on the direct fill ports. The truckdriver told Safety Board investigators that he took the inch readings before he began transferring gasoline, that he hooked up the unloading hoses for both the premium and regular gasoline at the same time, and that he began unloading regular and premium simultaneously. The Red Jacket™ system printouts indicate the order of events listed in table 1. Station No. 741’s video surveillance system tape shows the truckdriver entering the station at 12:04:14 a.m., walking to and from the restroom corridor, and then leaving at 12:05:29 a.m.7 The video tape shows the truckdriver reentering the store at 12:11:20, walking past the checkout counter, and then leaving the store at 12:18:01.8 4 The Red Jacket™ system is an automatic computer-based system that monitors the product levels in the underground storage tanks. Data from the Red Jacket™ system is transmitted to Premium’s headquarters, which uses the information to determine the amount of product to be dispatched. Additional information about the Red Jacket™ system appears later in this report. 5 Ullage is the amount by which a container lacks being full; in this case, the space above the liquid in the tank. 6 On September 23, 1998, an independent contractor evaluated the Red Jacket™ system at station No. 741 and concluded that, although the Red Jacket™ system was a good indicator of liquid levels in underground storage tanks, sticking a tank with an accurate measuring device was a more precise measurement method. 7 The Red Jacket™ system and the video camera system were not synchronized. 8 After viewing the video tape, store employees stated that they thought the truckdriver went into the room behind the checkout area where the automatic tank monitoring system printer was located. The truckdriver was identified on the video tape by the two store employees and by the customer who had alerted the truckdriver to the overflow.

Factual Information 4 Hazardous Materials Accident Report The truckdriver transferred the cargo compartment of premium unleaded gas and two of the three compartments of regular unleaded gas into the underground storage tanks without incident. During the transfer from the cargo tank’s third compartment into the regular unleaded underground storage tank, a customer witnessed gasoline flowing from the direct fill port on the east side of the station property. (See figure 2.) The customer said that he saw the truckdriver standing near the cargo tank, seemingly unaware of the gasoline as it washed across the parking area in front of him. The customer described the gasoline stream as “several feet wide” and said that it “should have been visible to the truckdriver.” The customer said that the truckdriver appeared to be “gazing” beyond the overflow “toward the casinos on U.S. Highway 90 (US 90).” The customer said that he told the truckdriver that gasoline was overflowing. The truckdriver then responded, “Okay, thanks,” and closed a valve on the cargo tank to stop the flow. Table 1. Events recorded by Red Jacket™ computer-based monitoring system Time Event 11:58:18 Transfer of gasoline into premium gasoline tank begins 12:16:39 Inventory report generated [by Fast Lane assistant manager] 12:17:44 Transfer of gasoline into regular unleaded gasoline tank begins 12:17:57 Transfer of gasoline into premium gasoline tank ends 12:40:21 Transfer of gasoline into regular unleaded gasoline tank ends Figure 2. Dotted lines from the regular unleaded underground storage tank to the storm drain represent the flow of the gasoline overfill.

Factual Information 5 Hazardous Materials Accident Report The customer said that when he returned from the convenience store to his car, he saw the truckdriver looking down at the transfer hoses. The truckdriver then climbed the ladder on the rear of the cargo tank, walked forward along the top of the tank, opened the manhole cover, and looked down inside the tank. The driver stated that after he was approached by the customer, he shut off the flow of regular unleaded gasoline from the cargo tank, walked to the open direct fill port to make sure it was no longer overflowing, and then climbed on top of the tank to assess the amount of gasoline remaining inside the cargo tank. About 550 gallons9 of regular unleaded gasoline overfilled the underground storage tank. The excess gasoline flowed south from the open fill port through the gas station parking lot, then west along the north side of US 90 across the Brady Drive intersection, where it entered a storm drain under the highway. The drain emptied into an open concrete culvert, which ran southward toward the Gulf of Mexico. At the time of the overfill, three passenger vehicles, each of which had two occupants, were near the US 90-Brady Drive intersection. Two sedans were waiting in line to turn onto US 90, while an eastbound pickup truck was turning onto Brady Drive. Biloxi Police Department reports indicate that witnesses observed a fire ignite under one of the cars and engulf all three vehicles. (See figure 3.) The fire ultimately caused the fatal injuries of five occupants and the serious injury of one occupant. The fire, following the fuel flow, spread to the open fill port lid in the Fast Lane station and through the storm drain. 9 Investigators determined how many gallons the station’s underground tank and its associated piping would have held by identifying the pretransfer ullage. They next subtracted the gallons of regular unleaded gasoline left in the truck’s cargo tank from the amount that had been loaded on the cargo tank to determine how many gallons had been pumped. They compared these figures to determine the overfill amount. Figure 3. One of the sedans and the pickup after emergency responders extinguished the blaze. The Premium cargo tank truck is in the background.

Factual Information 6 Hazardous Materials Accident Report Emergency Response Police Response About 12:53 a.m., a Biloxi police officer on routine motor patrol on US 90 observed a large fire consume an automobile at the intersection of US 90 and Brady Drive. The police officer radioed for assistance, and additional officers arrived within the next 10 minutes. The police evacuated a total of 80 people from the area, including the customers and staff from a restaurant at 2200 Beach Boulevard (US 90), a hotel on Brady Drive, and Fast Lane station No. 741. Fire Department Response At 12:53 a.m., a caller notified the Biloxi 911 operator that a person was on fire at the Fast Lane gas station. At 12:54 a.m., a Biloxi fire engine company was dispatched to the accident site, where it arrived about 12:59 a.m. In response to a second alarm at 12:56 a.m., two engines, an aerial truck, and supervisory personnel were dispatched to the scene, arriving between 1:00 a.m. and 1:03 a.m. Responders established a command post on US 90, east of the fire scene. Fire units used about 50 gallons of foam and engaged in fire suppression and rescue operations until 1:40 a.m., when the fire was extinguished. Injuries Table 2 is based on the injury criteria of the International Civil Aviation Organization, which the Safety Board uses in accident reports for all transportation modes. Harrison County coroner records indicate that five of the six occupants of the vehicles died as a result of the fire. The Hyundai sedan operator, a 25-year-old male, sustained serious injuries and survived. The Mazda sedan passenger, a 20-year-old female, and the Ford pick-up truck passenger, a 56-year-old female, died at the accident scene. The Hyundai passenger, an 18-year-old male, the Mazda operator, a 43-year-old female, and the Ford operator, a 58-year-old male, died from their injuries after being admitted to Table 2. Injuries sustained in Biloxi, Mississippi, accident Drivers Passengers Others Total Fatal 2 3 0 5 Serious 1 0 0 1 Minor 0 0 1 1

None

-

- Total 3 3 1 7 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.”

Factual Information 7 Hazardous Materials Accident Report area hospitals. A firefighter who received minor injuries was treated and released from a local hospital. Damages The convenience store, adjacent landscaping, restaurant signs, and cargo tank truck sustained minor thermal damage. Estimated damages totaled about $55,000 and included the value of the three destroyed passenger vehicles and the costs of repairing the truck tractor, of repairing and testing the cargo tank, and of reopening Fast Lane station No. 741. Vehicle Information The tractor of the semitrailer combination vehicle was a 1992 Freightliner. It was coupled to an elliptically shaped aluminum MC 306 cargo tank, which had been manufactured to Federal specifications in 1978 by Pullman Trailmobile of Chicago. The cargo tank had four separate compartments. Table 3 shows the capacity of each of the compartments and the total capacity of the cargo tank. Premium company records and exterior markings on the front head of the cargo tank indicated that the cargo tank had been inspected and tested in accordance with Federal regulations. Following the accident, certified Mississippi Public Service Commission (MPSC) inspectors completed a CVSA10 (Commercial Vehicle Safety Alliance) inspection on the tractor and the cargo tank and noted no defects that would have rendered them out of service before the accident. Hazardous Materials Information The U.S. Department of Transportation (DOT) classifies gasoline as a hazard Class 3 (flammable liquid). Gasoline has a flash point of -40° Fahrenheit, an auto ignition temperature of 500° Fahrenheit, and a flammable range of 1.3 to 7.6 percent in air. Table 3. Capacity of cargo tank Compartment Capacity (gallons) 1 (Forward) 2,500 2 2,000 3 1,750 4 (Aft) 2,750 Total 9,000 10 The CVSA is a body composed of Federal, State, and industry representatives who meet regularly to formulate uniform inspection procedures for commercial motor vehicles involved in the transportation of hazardous and nonhazardous cargoes.

Factual Information 8 Hazardous Materials Accident Report Facility Information General At the time of the accident, Fast Lane station No. 741 was 1 of 55 gas station- convenience stores in Louisiana, Mississippi, and Tennessee owned by R.R. Morrison and Son, Inc., (Morrison) which is headquartered in Vicksburg, Mississippi. The station has three underground storage tanks, each with a capacity of 12,032 gallons. At most Fast Lane stations, each underground storage tank has one fill port through which gasoline is transferred. At four sites, however, each underground storage tank has two fill ports; one is a direct fill port, and the other is a remote fill port. Those sites are station No. 741 and stations in Bay St. Louis, Mississippi, Jackson, Tennessee, and Bastrop, Louisiana. Figure 4 illustrates a typical gas station that has both direct and remote fill ports. According to Premium officials and drivers, using the remote fill ports at station No. 741 for gasoline transfers affords drivers greater safety. Drivers said that they preferred to use the remote fill port at station No. 741 because doing so enabled them to drive forward to exit the site. If they use the direct fill port, they have to exit the station by backing onto US 90. Federal regulations contained in 40 CFR 280.20 require that underground storage tanks be equipped with safeguards to prevent spilling and overfilling during gasoline transfer. Morrison elected to install float valves (figure 4) in the tank vents of the Fast Lane station storage tanks. The float valve rises as gasoline fills the tanks, eventually seating against the end of the vent pipe and restricting the vapor flow through the vent pipe, which causes pressure to build. The pressure in the tank works against the head of the liquid in the cargo tank and the transfer hoses, causing a reduction in the flow of gasoline. Because the operation of a float valve is pressure controlled, at a station having both direct and remote fill ports, such as Fast Lane station No. 741, only one fill port should be open during a gasoline transfer. If a second fill port is open, the vapor can escape through it, rendering the float valve safety feature ineffective. Other Overfills at Station No. 741 On July 15, 1996, a different Premium truckdriver was involved in an overfill of about 50 to 60 gallons at Fast Lane station No. 741. That truckdriver told Safety Board investigators that he was transferring gasoline through the remote fill ports when it began to overfill through the direct fill ports, which he had left open after gauging the underground storage tanks. This truckdriver told Safety Board investigators that he was not aware of any Premium document explaining transfers at facilities with remote fill ports.

Factual Information 9 Hazardous Materials Accident Report Gasoline transferred through the remote fill ports does not flow directly into the underground storage tanks but though pipes that extend at an angle from the port openings. Because of the angle of the pipes, measurements to gauge the amount of gasoline in the tank cannot be taken through the remote fill ports but must be made through the direct fill ports. Figure 4. Top illustration is a cutaway of a typical service station having both direct and remote fill ports. Lower illustration shows a typical float valve, which was the type of safeguard against spills and overfills that the Morrison company had installed in many Fast Lane stations. At Fast Lane station No. 741, the Red Jacket™ monitoring system was designed to trigger an alarm whenever the gasoline level in a tank reached 90-percent capacity. The vent of the underground storage tank is equipped with a float valve, which is designed to rise as gasoline fills the tanks. At a predetermined level, the stainless steel ball float seats against the end of the vent pipe, restricting the vapor flow through the tank vent, which creates pressure in the underground tank that affects the flow of gas from the cargo tank. If the direct and the remote fill ports to an underground storage tank are both open during the gasoline transfer, the pressure will not build but will escape through the open fill port, which renders the float valve safety feature ineffective.

Factual Information 10 Hazardous Materials Accident Report Personnel Information Driver’s Military Background The truckdriver involved in the Biloxi accident was a 20-year veteran of the U.S. Navy who had retired from military service in 1997. He had graduated from high school before enlisting in the military. While in the Navy, he completed six college-level correspondence courses and, in 1994, military law enforcement school. His military skills list shows that, as of 1993, he had received training in operating or been awarded military licenses to operate the following vehicles: truck tractors and trailers, cranes and attachments, graders, crawlers, front-end loaders, forklifts, and buses. His military service history records show that, among other assignments, he had driven trucks and operated heavy equipment, including cargo cranes for unloading ships. His military records also indicate that he had been involved in a series of accidents that resulted in referrals for medical evaluation and, ultimately, his suspension from operating heavy equipment in 1989. He subsequently was transferred to maintenance duties. In 1991, his licenses were reinstated, and he served in northern Iraq during the Persian Gulf Conflict, making aircraft runway repairs and driving ambulances. From 1993 until his retirement in 1997, he worked in maintenance services and security. His records show that his security duties consisted primarily of investigating mishaps, giving examinations for equipment operating licenses, dispatching security vehicles, and scheduling vehicle maintenance. His military personnel evaluations were favorable. Many contained comments from various supervisors on his accuracy and excellent work, his dedication to the Navy, and his care in observing military dress standards. With occasional exceptions, he was recommended for retention and for promotion. Civilian Training and Work History On July 27, 1997, the truckdriver enrolled, in a 6-week semitractor-trailer driving training course at the Commercial Driver Institute, Inc., (CDI) in Gulfport, Mississippi. He received a passing overall score of 86.95 percent for the class work and, on August 22, 1997, was issued a Mississippi Commercial Drivers License (CDL) that included both a hazardous materials and cargo tank endorsement. While in training at the CDI, on August 4, 1997, the truckdriver applied for a job with Werner Enterprises, Inc., (Werner) of Omaha, Nebraska, an interstate freight carrier. Upon successful completion of his CDI training, Werner hired him. Company personnel records indicate that the driver’s employment was terminated on September 12, 1997, during his training period for “not progressing as a trainee.” His Werner personnel file contains two documents that deal directly with the cause for his dismissal. One document is a complaint and incident report stating that his driver-trainer found the truckdriver to be unsuitable and a “danger to himself and others.” The other document, a “Driver-Trainee

Factual Information 11 Hazardous Materials Accident Report Status Worksheet,” indicates the driver was not progressing as a trainee and contains the annotation, “Driver has grossly unsafe instincts and practice(s).”11 The truckdriver did not report his job with Werner on the applications for his next two jobs.12 After leaving Werner, the truckdriver was employed in September 1997 by John Fayard Fast Freight Trucking (Fayard) of Gulfport, Mississippi, as an over-the-road driver for van-type tractor-trailers. As required of all new Fayard drivers, he had a 1-week training class and an 8-week probationary period during which he was accompanied by a driver-trainer while on his routes. The driver-trainer observed that the truckdriver operated safely and characterized him overall as a “pretty good driver.” He described the truckdriver as being conscientious about watching over his rig when it was parked and keeping his log book current and accurate. The driver-trainer noted that the truckdriver had problems with company paperwork, paying attention during training, noticing roadway signs, and backing the truck. He said that sometimes the truckdriver was “hard to reason with.” On one occasion, the driver-trainer observed the truckdriver taking medication and asked him what it was. The truckdriver told him it was Ritalin.13 The driver-trainer reported the incident to the company. Personnel records indicate that the truckdriver worked for Fayard as a regular driver for 5 months, until he quit without notice in April 1998. The truckdriver was hired by Premium on April 20, 1998. He received 6 days of training, which began with 1 day of company orientation that included information and two video tapes on hazardous materials. He was required to take a written examination on hazardous materials, which he passed. During the next 5 days, he was in an on-the-job training (OJT) status, during which he was accompanied by a driver-trainer on deliveries. The driver-trainer said the OJT began with the trainer performing the delivery work on the first day so that the new employee could see how things were to be done. During the rest of the OJT period, the truckdriver was supposed to perform the tasks while the driver-trainer observed and provided explanations or instructions as necessary. The driver-trainer told Safety Board investigators that he explained to the truckdriver how to convert inch readings to gallon figures using a tank chart and asked the truckdriver to let 11 Safety Board investigators made numerous attempts to contact the Werner driver-trainer. He is no longer employed with the company and could not be located. Other Werner officials were unable to recall the specific details of the truckdriver’s employment with the company. 12 The truckdriver also did not disclose his employment with Werner during interviews with Safety Board investigators. The Safety Board obtained this and other information about the truckdriver from depositions taken later during civil proceedings. 13 Ritalin is the brand name for methylphenidate hydrochloride, a mild prescription stimulant commonly used to treat attention deficit disorders (typically characterized by a history of chronic short attention span, distractibility, emotional lability, impulsivity, and moderate-to-severe hyperactivity) and narcolepsy (typically characterized by excessive daytime sleepiness with involuntary daytime sleep episodes, disturbed nighttime sleep, and sudden weakness). The most common adverse reactions to Ritalin are nervousness and insomnia.

Factual Information 12 Hazardous Materials Accident Report him know if he wanted a copy of the tank charts. The driver-trainer said the truckdriver never asked for them. The truckdriver said that Premium never provided him with any charts or handbooks for determining whether the cargo tank load was greater than the available capacity of the receiving tanks. The driver-trainer told investigators that after he checked underground tank levels using the direct fill ports, he always ensured that he replaced the lids to the direct ports if he chose to use the remote fill ports for the gasoline transfer. He said that he had instructed the truckdriver to do the same. The driver-trainer said that, during the OJT period, the truckdriver sometimes took notes in a spiral notebook. Safety Board investigators found a spiral notebook in the cab of the accident truck. Most of the notebook’s pages contain personal rather than work information. One page contains the notes shown in figure 5. During the OJT period, the driver-trainer and the truckdriver made two deliveries to Fast Lane station No. 741. The truckdriver’s first visit to the station was on his second day of OJT, when, according to the training protocol, he was supposed to make the gasoline delivery while the driver-trainer oversaw his work. Instead, the driver went inside the convenience store for a sandwich while the driver-trainer made the transfer. The truckdriver made a delivery to station No. 741 on his last day of OJT. On this occasion, the driver-trainer noted no problems with the delivery. In his interview with Safety Board investigators, the driver-trainer described the truckdriver as “a nice guy” but said he was “hard to reason with” and “hard headed.” He said that the truckdriver frequently did not pay attention when things were explained to him. He said that the truckdriver consistently demonstrated two operating problems, backing the cargo tank and unloading the gasoline at the stations. The driver-trainer indicated that after working with the driver for 4 days, he was going to “turn him down”; however, when he informed the safety director of his determination, the safety director told him to “take him out again.” The driver-trainer said that, during the next day of OJT, he gave the truckdriver a “sharp lecture” about his lack of attentiveness before they began making deliveries, and the truckdriver performed well. When they returned to Premium’s Unloading Procedures

1. Stick tanks Get reading
2. Open tank valves
3. Remove caps
4. Hook up hose
5. Fill out bills/need manifest
6. Make sure [to] send in a Fax on all Morrison loads

On remote tank sick [sic] first The[n] use tank chart Customer gets green, yellow [and] blue Figure 5. Notes written in truckdriver’s spiral notebook.

Factual Information 13 Hazardous Materials Accident Report headquarters that evening, the driver-trainer told the safety director about the truckdriver’s improved performance. The next day was a Sunday. The truckdriver asked and was given permission to take off to attend church. The following day, Monday, the driver-trainer was off duty. When the truckdriver returned to work on Monday, the safety director told him that he could work alone. The driver-trainer told Safety Board investigators that he did not learn that the truckdriver had been allowed to work by himself until several days later. He said that he never approved the truckdriver’s working alone, and he thought that he (the trainer) should have spent 2 or 3 more days with him to “go over everything again” to “ensure that things were clear in the driver’s mind.” The driver-trainer said that the safety director told him to complete and backdate the truckdriver’s certificate and other materials showing that he had successfully completed the training so the truckdriver could be paid at the end of his second work week. The driver-trainer complied with the safety director’s instructions and backdated the items to show that the driver had successfully completed the driver training program. The safety director said he hired the truckdriver because he had “a soft spot for vets” and preferred hiring career veterans over other applicants. The safety director said that his reason for instructing the truckdriver to make his first solo trip was that he needed a driver and the trainer had told him that the truckdriver had shown improvement on his last day of training. The safety director said that the truckdriver was allowed to continue working alone because everything went smoothly on his delivery run. Other Overfills by the Truckdriver Several weeks before the fire, the truckdriver overfilled an underground storage tank at the Bay St. Louis Fast Lane station. On this occasion, the truckdriver made the delivery to the correct facility. Like station No. 741, the Bay St. Louis Fast Lane station has both direct and remote fill ports, although they are much closer together. The incident occurred during the day, and the driver noticed the overfill after a small amount of gasoline (about 5 to 10 gallons) overfilled. The truckdriver contacted Premium’s Jackson office; and the operations manager, who was not aware that the Bay St. Louis station had remote fill ports, instructed him to climb on top of the cargo tank and determine how much of the load remained by looking into the cargo tank compartment. The operations manager directed the truckdriver to gauge all the receiving tanks and unload the rest of the gasoline into the premium unleaded underground storage tank. Morrison, the owner of the facility, maintained no records of the overfill at the Bay St. Louis Fast Lane station. Operating Violations The truckdriver’s personnel file shows that, from May 5 to July 9, 1998, Premium officials noted 20 hours-of-service violations, including 15 70-hour violations, 3 10-hour

Factual Information 14 Hazardous Materials Accident Report violations, and 2 15-hour violations.14 According to Premium’s safety director, the company issued the truckdriver three letters of reprimand for his violations. The Premium Tank Lines Driver’s Manual (driver’s manual) lists the following consequences for failing to comply with Bureau of Motor Carrier Safety15 rules: First Offense - Letter of reprimand Second Offense - 3-day layoff Third Offense - 1-week layoff Premium’s records do not indicate that the company pursued any action other than issuing disciplinary letters to the truckdriver for his infractions. Medical Federal Requirements. Title 49 CFR 391.41 states that drivers of commercial motor vehicles must be physically qualified and provides instructions for individuals performing and recording physical examinations. The regulations stipulate that a person who has a “mental, nervous, organic, or functional disease or psychiatric disorder that is likely to interfere with his ability to drive safely” is not qualified to drive a commercial vehicle. Federal regulations further stipulate that “the examining physician is required to certify that the driver does not have any physical, mental, or organic defect of such a nature as to affect the driver’s ability to operate safely a commercial motor vehicle.” Federal regulations do not require that physicians verify the information given by drivers during the examination. Driver’s Medical Background. As noted earlier, while with the Navy, the truckdriver was referred for medical evaluation because he had been involved in a series of equipment operating accidents. Military physicians made a diagnosis of “attention deficit disorder” (ADD) and prescribed Ritalin for the condition. The medical records indicate that the truckdriver did well on the Ritalin. Nonetheless, as a result of a neurological evaluation in June 1989, Navy physicians made the following observation: It is recommended that this individual be cross-trained into some field where his attention deficits and visual-motor coordination problems will have less impact on his job safety and performance. Additionally, the truckdriver’s military medical records note that he was referred for evaluation because “Co-worker reports patient sits and stares sometimes up to 15 minutes.” The military medical files do not contain the results of a CT scan, an EEG (electroencephalogram), or an MRI (Magnetic Resonance Imaging test) or physicians’ comments indicating that the truckdriver had been the subject of such tests. 14 For a 70-hour violation, the driver had to exceed 70 hours of driving and being on duty in an 8-day period. For a 10-hour violation, he had to exceed 10 hours of driving without an 8-hour break. For a 15-hour violation, he had to exceed 15 hours of being on duty and driving without an 8-hour break. 15 The name of the Bureau of Motor Carrier Safety has been changed to the Office of Motor Carrier and Highway Safety (OMCHS).

Factual Information 15 Hazardous Materials Accident Report Records indicate that after retiring from the Navy, the truckdriver received two DOT physical examinations: the first for his acceptance into the CDI, the second for his employment with Premium. Neither examination form indicates any type of psychiatric disorder or any other nervous disorder. The physician who performed the truckdriver’s most recent medical examination said that he had no knowledge of the truckdriver’s neurological history. At the time of the Biloxi accident, the truckdriver had a current medical card, and the only medical restriction on his personal operator’s license and his CDL was for wearing corrective lenses while driving. His medical records indicate that he had myopia (nearsightedness) with astigmatism, which was corrected to 20/20 vision with glasses. Work-Rest Routine The truckdriver told Safety Board investigators that he was not fatigued on the morning of the fire. He had arranged with Premium to work the night shift. He said that he normally slept about 6 hours during the day, left for work about 9:00 p.m., and arrived back home between 8:00 and 9:00 a.m. His “Driver’s Daily Log” indicates that on August 5 to 7, he went on duty at 10:45 p.m., 11:00 p.m., and 7:15 p.m., respectively. On August 8, he said, he went to bed at 11:30 a.m. and awoke at 5:30 p.m., at which time he called the dispatcher. His shift that evening began at 9:00 p.m. Toxicological Testing Investigators found bottles of ginseng, aspirin, and “Bee Awake,” a bee pollen product, in the truck cab after the accident. The truckdriver said that the bee product was intended to boost his energy. He said that he had taken one ginseng tablet, one aspirin tablet, and no other medication on the night before the accident. Biloxi police officials stated that, in anticipation of a possible criminal case, their personnel collected postaccident blood samples from the truckdriver and sent the specimens to the Mississippi State Crime Laboratory in Jackson. When the Safety Board became involved in the investigation, it asked that samples be forwarded to the Civil Aeromedical Institute (CAMI) in Oklahoma City for alcohol and drug testing. The analysis included testing to determine whether the truckdriver had taken Ritalin at therapeutic levels. The test results for alcohol, drugs, and Ritalin were negative. Carrier Information General Premium is a for-hire16 motor carrier that primarily delivers petroleum products to storage tanks at service stations and other facilities. In addition to the drivers who work 16 The DOT defines for-hire as “a person engaged in the transportation of goods or passengers for compensation.”

Factual Information 16 Hazardous Materials Accident Report out of the Jackson headquarters, Premium has cargo tank truckdrivers based in the following Mississippi cities: Collins, McComb, Meridian, Vicksburg, and Biloxi. Premium was formed and incorporated in 1986. In 1992, the company expanded to include trash and waste hauling. It sold all but one trash route in 1996. In 1997, Premium was hired by Morrison to monitor and fill underground storage tanks with gasoline and diesel fuel at selected Fast Lane gas stations. At the time of the accident, Premium serviced 12 Fast Lane stations along the Mississippi Gulf Coast, including station No. 741. As of mid-1998, Premium’s petroleum distribution division employed 25 full-time drivers, 2 part-time drivers, and 7 office staff members; its fleet included 30 company- owned truck tractors, 13 owner-operator truck tractors, 54 company-owned cargo tanks, and 3 leased cargo tanks. Premium’s waste hauling division employed 3 full-time and 2 part-time drivers; its fleet had 6 truck tractors and 9 trailers, which were all company owned. Hiring Procedures Premium’s safety director, who is responsible for hiring drivers, stated that Premium usually hires truckdrivers with about 2 years of over-the-road experience. Although the driver involved in the accident did not have 2 years of over-the-road experience, the safety director hired him because of his military background. Federal regulations at 49 CFR 391.23 require motor carriers to investigate a driver applicant’s employment record during the preceding 3 years. Section 391.23(c) states: The investigation of the driver’s employment record….must be made within 30 days of the date his/her employment begins. The investigation may consist of personal interview, telephone interview, letters, or any other method of obtaining information that the carrier deems appropriate. Each motor carrier must make a written record with respect to each past employer contacted. The Premium safety director made the Federally required employment check with Fayard concerning the truckdriver. He said that he did not attempt to contact the military because he did not think it would be possible to obtain information. The safety director did not check with Werner because the truckdriver’s employment application did not show his work experience with Werner. The safety director said that the truckdriver had the necessary licenses and his State motor vehicle record (MVR) did not reveal any violations. Premium hired the truckdriver after he passed a physical examination and drug screening.

Factual Information 17 Hazardous Materials Accident Report Training Regulatory Requirements. Federal requirements contained in 49 CFR Subpart H, “Training,” Section 172, stipulate that a hazardous materials (hazmat) employer17 must ensure that (hazmat) employees18 receive training and are tested on subjects in the following categories: general awareness and familiarization, function-specific, and safety. Highway-specific training requirements at 49 CFR 177.816 (b) stipulate that each person who operates a cargo tank be trained in a number of areas, including attendance to a hazardous materials vehicle and loading and unloading procedures. Overview of Premium’s Program. Premium’s driver training program, which spanned 1 to 2 weeks, began with a 1-day orientation taught by company officials at the Jackson headquarters. New drivers were shown several videotape presentations, including two tapes about hazardous materials, and were given a test on the information presented. Most of the orientation information was general in nature and included such topics as pretrip equipment inspections; required documents, stickers, and shipping papers; customer service; defensive driving; and emergency procedures. The instruction did not include discussions about how to transfer gasoline at stations, how to use tank charts, or how to determine the ullage in a tank. According to Premium’s safety director, instruction directly related to gasoline transfers was handled by the driver-trainer who spent the remainder of the training period with the new employee and evaluated the trainee for suitability as a regular company driver. When a newly hired driver successfully concluded the training period, the new driver was issued a certificate of training completion signed by the driver-trainer that indicated the driver was prepared to work independently. The Premium Tank Lines’ Driver Trainer Manual (trainer’s manual) states that the driver-trainer is “the final decision- maker on whether or not the new hire will be a good, safe professional driver, capable of handling all the duties required….” Driver-Trainer Qualifications. Premium selected its driver-trainers based on their experience, knowledge of operations, and work record. The driver-trainer for the driver involved in the overfill had worked for petroleum companies since 1977 and Premium since 1987, when he joined the company as a lease operator. His background included several years as a dispatcher and extensive experience in tank operations. He had been a trainer of cargo tank truckdrivers for a previous employer; while at Premium, he had trained between 10 and 15 drivers. When not instructing new employees, the driver-trainer served as a full-time driver in Premium’s coastal region. 17 Section 171.8 states, in part, “a hazmat employer means a person who uses one or more employees in connection with: transporting hazardous materials in commerce.” 18 Section 171.8 states, “a hazmat employee means a person who is employed by a hazmat employer and in the course of employment directly affects hazardous materials transportation safety.” The definition includes an individual who “loads, unloads, or handles hazardous materials” and who “operates a vehicle used to transport hazardous materials.”

Factual Information 18 Hazardous Materials Accident Report Premium’s safety director said that, because of the driver-trainer’s thoroughness, he had intentionally teamed him with the truckdriver. The driver-trainer told Safety Board investigators that he was knowledgeable about the subjects listed in the trainer’s manual but that he did not have a complete understanding of the Red Jacket™ automatic tank gauging system. Training Materials. Premium’s 37-page driver’s manual, which is distributed to employees when they are hired, contains safety policies and general work procedures, including alcohol and drug policies and testing, emergency and accident procedures, defensive driving, and loading and unloading cargo. The driver’s manual contains some safety requirements regarding unloading gasoline, including stipulations that a driver must stay in attendance while the unit is being unloaded19 and must shut down the unloading process when away from the controlling valve. The driver’s manual cautions, “Be sure you are at the right plant or station.” The manual contains no guidance advising drivers how or when they should make this determination, but it does stipulate, “Before unloading, always get the consignee to check and sign your Bill of Lading.” The driver’s manual does not contain instructions for determining the ullage in underground storage tanks or a discussion of tank charts. The 17-page trainer’s manual contains information on company practices, daily training activities, and lists general subjects that should be explained to truckdrivers during the training period. The trainer’s manual does not state that the trainer should ensure that a new driver knows how to determine the ullage in underground storage tanks. Like the driver’s manual, the trainer’s manual states that drivers are to remain with the unit when gasoline is being unloaded. The driver-trainer told investigators that he had explained to the truckdriver the importance of staying with the unit when unloading. Neither manual contains specific instructions explaining safeguards against overfills or factors to consider when unloading gasoline at facilities with remote fill ports.20 In addition to the trainer’s manual, each driver-trainer had a 2-page checksheet (appendix B) that lists subjects to review and critique during a new hire’s OJT phase. Page one of the checksheet, at the top, has an area for remarks by the driver-trainer. The checksheet next has two blocks, one entitled “tractor” and the other “trailer,” listing items to be explained by the driver-trainer to the new hire. Item 2 in the trailer block is “Where calibration charts are and how to use them.” Premium officials stated that this reference is to the calibration charts that are used to determine the available space in the cargo tank. The remainder of the checksheet form contains 17 operating categories that the driver-trainer is to critique and check if the new hire does not perform the procedure satisfactorily. Most of the subjects deal with inspecting and operating the vehicle. 19 Title 49 CFR 177.834 stipulates that a truckdriver must stay within 25 feet of the cargo tank during unloading. 20 No Federal requirements stipulate that a hazmat employer or carrier have specific written procedures addressing loading and unloading gasoline.

Factual Information 19 Hazardous Materials Accident Report Category XVI, “Loading and Unloading,” has nine check items, including “Doesn’t unload before checking address of customer with address on bill of lading” [item A]; “Doesn’t break seals or unload until the customer has initialed bill of lading and inspected load” [item B]; and “Stays with unit; stands by product control valve (Driver controlled loading and unloading)” [item E]. Safety Briefings According to the company safety director, he travels to Premium’s five bases of operations quarterly to conduct safety briefings with the truckdrivers assigned to those locations. He plans his briefings based on the kind of problems the company is experiencing. He said that recent briefings conducted before the Biloxi accident had focused on DOT regulations, driving habits, and paperwork, among other subjects. Two of the five Biloxi-based truckdrivers had experienced overfills before the accident discussed in this report. None of the five drivers recalled station overfills or stations with remote fill ports being discussed at company safety briefings in Biloxi. Before the August 9 accident, the safety director’s last safety briefing in Biloxi had been on August 7. Dispatch Procedures Premium’s customers order gasoline to be delivered in a variety of ways. Some customers monitor their own storage tanks and, when a delivery is necessary, telephone or fax a request to Premium’s Jackson office. In the case of Morrison, it hired Premium not only to deliver gasoline but also to monitor the gasoline levels at selected Fast Lane service stations by means of a computer link between the Red Jacket™ system and Premium’s headquarters computer system.21 When data indicated that an underground storage tank needed to be filled, a Premium employee estimated the amount of gasoline to be sold to the station owner based on the present quantity of gasoline in the tank and the anticipated amount of gasoline that would probably be sold to the public before delivery could be made. As a safeguard against overfills, the Premium employee adjusted the amount of gasoline to be delivered to the underground tank based on 90 percent of its capacity. Headquarters personnel then prepared a master dispatch sheet assigning deliveries to the drivers, who obtained their assignments by telephone. According to the Premium operations manager, a miscalculation by Premium’s headquarters personnel, slow retail sales at the gas station, or a maintenance problem at a station could result in too much gasoline being dispatched for a particular underground storage tank. The dispatch sheet indicates that, on the day before the accident, the same driver was dispatched to deliver 6,600 gallons of regular unleaded gasoline and 1,900 gallons of premium unleaded gasoline to Fast Lane station No. 741. Delivery reports verify that the underground storage tanks were filled during the early morning hours of August 8. 21 Premium’s computers use Pathway™ software to convert data from the Red Jacket™ system.

Factual Information 20 Hazardous Materials Accident Report On the eve of the accident, the safety director was operating from his home and using a photocopy of the dispatch sheet to issue delivery assignments. He said that he directed the truckdriver to make the following deliveries to Fast Lane stations: No. 742 (6,000 gallons regular and 2,500 gallons premium gasoline); No. 743 (6,000 gallons regular and 2,500 gallons premium gasoline); and No. 736 (6,000 gallons regular and 2,500 gallons premium gasoline). He said that he did not learn that the truckdriver had gone to station No. 741 until he was contacted from the fire scene. The truckdriver stated that he wrote down what the safety director told him while they were still on the telephone. After the accident, in the truck cab, investigators found a small note on which was written the following: “742, 743, and 741; 31, 34, and 33,22 and 6000NL and 2500P.” The truckdriver told Safety Board investigators that, although he had previously made deliveries to the same station twice in one day, he had never made deliveries that frequently to station No. 741. Both the safety director and the operations director indicated that they had made dispatch errors in the past; the safety director stated, however, that he was sure that he did not make an error on the evening of August 8. Since this accident, Premium has sent its dispatchers a memorandum outlining the operating changes that are being incorporated into the company’s dispatch functions. Under “Procedures,” the revised operating manual will stipulate: A. Dispatcher will give drivers instructions concerning products, amounts, customer location, etc., in written form whenever possible. (via personal written or fax) B. When it is not possible to provide written instructions to the driver, the dispatcher will give the instructions to the driver no less than two (2) times, then will require the driver to repeat the instructions to be sure the instructions have been communicated clearly. Transfer Procedures The Safety Board interviewed all five Biloxi-based truckdrivers regarding gasoline transfer procedures, in particular, about determining the ullage in an underground tank and making deliveries at stations with remote fill ports. Calculating Existing Ullage. The Premium driver’s manual states, “Before unloading, always get the consignee to check and sign your Bill of Lading. By so doing, you are protecting yourself and your company.” Neither the driver’s manual nor the trainer’s manual lists a standard procedure for calculating the volume of the underground storage tanks. 22 The numbers 31, 34, and 33, which represent the line numbers on the dispatch sheet, show the scheduled deliveries for Gulfport Fast Lane station No. 742, Biloxi Fast Lane station No. 743, and Long Beach, Mississippi, Fast Lane station No. 736.

Factual Information 21 Hazardous Materials Accident Report Drivers convert the stick readings of underground storage tanks levels from inches to gallons by using the appropriate calibration chart, also called a tank chart.23 By subtracting the gallons of gasoline in the tank from its total storage capacity, drivers can determine the available space. They can then compare this gallon figure to that shown on their shipping papers to determine whether the total amount of gasoline loaded on the cargo tank will fit into the underground storage facility. According to a Morrison official, each Fast Lane station maintains tank charts specific for that facility. Four of the five Biloxi-based Premium drivers stated that, based on their experience, they could generally tell from the “stick readings” whether the tank would hold the gasoline to be delivered. Most said that they checked the tank charts only if the stick reading indicated that the delivery might nearly fill the tank to capacity. Two of the drivers had obtained charts for each of the different sized tanks to which they delivered. The third driver, who was the truckdriver’s driver-trainer, had most of the tank charts; the fourth driver did not carry any charts. The driver who did not carry tank charts said that if he had a question about the delivery, he either asked the service station personnel or called the dispatcher. The truckdriver involved in the accident (the fifth Biloxi-based driver) said that he never used a tank chart to figure the available space in the underground storage tank. He told investigators that he did not consider it his responsibility to know how much was in the tanks and that he thought he was required to stick the tanks to obtain a figure for billing purposes, not for assessing the space available in them. He said that, when making gasoline transfers, he relied solely on Premium’s telephonic dispatch to provide the correct amount of gasoline and the station location. Using Remote Fill Ports. Neither the driver’s manual nor the driver-trainer manual lists a standard procedure for transfer at facilities that have both direct and remote fill ports. The four other Biloxi-based truckdrivers told investigators that insect nests and other debris occasionally clogged the storage tank vents at station No. 741, making gasoline transfers difficult. The driver-trainer and another driver said that they always replaced the lids before a gasoline transfer. One driver said that he occasionally left the lids off if the transfer was slow.24 The fourth driver, who was the Premium employee involved in the July 15, 1996, overfill at station No. 741, stated that he had never been told a specific procedure for delivering to stations with remote fills. He said that dirt dauber25 nests occasionally plugged vents at station No. 741 and that leaving the lid off the direct fill port made the gasoline transfer easier. After his overfill at the station, however, he was 23 Tank charts differ depending on the volume of the tank and list both an inch reading and an equivalent gallon figure. 24 By opening the second port during the gasoline transfer, the pressure that slows the gasoline flow will not build but will escape through the open fill port. 25 Dirt daubers, also called mud daubers, are wasps that build nests of mud for their larvae.

Factual Information 22 Hazardous Materials Accident Report careful to replace the lids before every transfer. He said that if he found the vents to be clogged, he would contact the facility owner. Carrier Oversight by the Federal Highway Administration An OMCHS inspector last performed a complete review of Premium in June 1992. During the compliance review, the inspector took a sampling of 154 duty status records and identified 6 hours-of-service violations in the records reviewed. The agent recommended that Premium “Ensure all employees involved in handling hazardous materials shipments are properly trained and familiar with the regulations applicable to their jobs in the hazardous materials transportation system.”26 Premium received a satisfactory27 rating as a result of the review and has not been the subject of a complete OMCHS audit since 1992. Red Jacket™ Monitoring System According to product literature, the Red Jacket™ underground storage tank monitoring system is used for complete leak detection and inventory management of underground storage tanks containing petroleum-based gasolines. The Red Jacket™ system was linked to computers at Premium, which used the Pathway™ software to extrapolate data and to determine the deliveries at some Fast Lane stations, including station No. 741. Each station equipped with the Red Jacket™ system has a remote terminal that prints different types of reports, including inventory, delivery, tank leak detection, and alarms. Each of these reports includes the date, time, station information, report name, tank number, gasoline type, and tank capacity. Reports may be scheduled, event-driven, or initiated by the key pad. The Red Jacket™ system has a feature that sounds an alarm inside the convenience store for a number of reasons, including when an underground storage tank reaches 90- percent capacity. The monitoring system does not have the capability to shut down a gasoline transfer when the alarm activates. The station’s assistant manager described the alarm as a “mild beep” that lasts 2 to 3 seconds and then shuts off. She said that she typically heard the Red Jacket™ alarm about twice a month when deliveries were made. She indicated that, over the months, she had become accustomed to the alarm sound and usually did not respond to it any longer. Although the Red Jacket™ system printout indicates that an alarm sounded when the gasoline level in the underground tank reached 26 Safety Board investigators questioned the agent, who no longer works for the OMCHS, regarding Premium’s compliance review. Due to the passage of time, she could not remember many specifics of the audit but did remember the hours-of-service violations. Regarding her recommendation for hazardous materials training, she stated that she could not remember a problem with the training. She said that she often listed recommendations in review areas where she did not discover a violation, adding, “There is always room for motor carriers to evaluate areas of their program and make improvements.” 27 Motor carriers may receive a satisfactory, a conditional, or an unsatisfactory rating based on the OMCHS evaluation.

Factual Information 23 Hazardous Materials Accident Report 90-percent capacity on the day of the accident, neither of the two Fast Lane employees then on duty recalled hearing the beep. They said that they were busy stocking or were with customers in the convenience store. Following the accident, an independent contractor conducted an evaluation of the Red Jacket™ system and noted no significant problems with it.28 Fast Lane Employee Training The Fast Lane chain owner and the convenience store clerks working at the time of the accident stated that Fast Lane employees do not receive any specific training for monitoring or responding to the Red Jacket™ system for gasoline dispatch and transfer. Station employees are trained to use the Red Jacket™ system primarily to complete inventory and other paperwork requirements. Station employees are not trained to respond to the overfill alarm. The Fast Lane chain owners indicated that station employees usually signed the driver’s paperwork following a gasoline delivery. The station employees stated that sometimes they were not aware that a delivery had been made until the driver entered the store for signature. Environmental Protection Agency Requirements Safeguards Against Overfills Federal regulations enacted by the Environmental Protection Agency (EPA) in 1988 require that underground storage tanks be equipped with a means of preventing overfills and spills. As defined by 40 CFR 280.12, an overfill release occurs when a tank is filled beyond its capacity, resulting in a discharge of the regulated substance to the environment. Spilling is a release of hazardous materials that “results from improper dispensing practices such as disconnecting the delivery hose from the tank’s fill pipe before the hose has drained completely.”29 Federal regulations at 40 CFR 280.20 require that underground storage tanks be equipped with safeguards to prevent spilling and overfilling during gasoline transfer. The EPA regulations list several acceptable safeguard devices or methods that owners can use. The Morrison company elected to install float valves in the underground tanks at its Fast Lane stations. Regulations Pertaining to Monitoring Transfers Title 40 CFR 280.30 (a), “Spill and overfill control,” stipulates that 28 The contractor found that the amount recorded by the monitoring system was slightly greater than the actual amount of product in the underground tanks. 29 “Analysis of Today’s Rule,” Federal Register, Vol. 53, No. 185, p. 37133, published September 23, 1988.

Factual Information 24 Hazardous Materials Accident Report Owners and operators must ensure that releases due to spilling or overfilling do not occur. The owner and operator must ensure that the volume available in the [underground storage] tank is greater than the volume of product to be transferred to the tank before the transfer is made and that the transfer operation is monitored constantly to prevent overfilling and spilling. In response to the 1988 rulemaking, operators of certain facilities, such as tank farms, indicated that constant direct monitoring would be extremely difficult. The EPA, therefore, changed the final rule to allow monitoring with remote equipment. In its analysis of the rule, the EPA took the position that the owner of the underground storage system is responsible for any release. The analysis states: Although EPA agrees that responsible carriers are the primary agents in the field to prevent spills and overfills, for the purpose of complying with today’s requirements, the UST [underground storage tank] system owner and operator is responsible for preventing spills and overfills. The agency must take this approach because it has no legal authority to regulate transporters under Subtitle I. Thus, regardless of whether the owner and operator decides to share (by contract) responsibility for the monitoring of the transfer with the carrier, under today’s final regulations the owner and operator will continue to be responsible in the event that there is a release during delivery. EPA State Program Approval In discussing the challenges for compliance, the EPA stated that a regulatory program of underground storage systems can best be carried out by “those closest to the problem, who can respond quickly, and who can create a visible presence, that is, the State and local governments.” Toward this end, the EPA initiated a process of examination, called the State Program Approval, in which Federal EPA officials review State underground storage tank regulations to determine that they are “no less stringent” than Federal law. The criteria for the no-less-stringent determination include general operating requirements stipulating, in part, that all underground storage systems: prevent spills and overfills by ensuring that the space in the tank is sufficient to receive the volume to be transferred and that the transfer operation is monitored constantly. State or local agencies whose regulations meet Federal requirements are accorded the primary responsibility for implementing and, when necessary, enforcing underground storage tank regulations. To date, the District of Columbia, Puerto Rico, and 27 States, including Mississippi, have been granted enforcement authority under the EPA State Program Approval. In Mississippi, the Mississippi Department of Environmental Quality (DEQ) serves in this capacity. According to EPA and DEQ representatives, Mississippi adopted verbatim the Federal regulations related to underground tank storage safety, including the requirements for overfill protection.

Factual Information 25 Hazardous Materials Accident Report Regulatory Enforcement In States that have EPA State Program Approval, the EPA relies primarily upon State agencies to enforce regulations, although EPA inspectors may also enforce the regulations. According to the EPA’s Office of Underground Storage Tanks (UST), Federal and State inspectors enforce underground storage tank regulations by various means, including warnings or fines, depending upon the severity of the violation. EPA officials indicated that in the agency’s oversight of underground storage tanks, it has focused on equipment safeguards and preventing underground storage tank leaks. The Mississippi DEQ has four inspectors who regulate about 10,000 underground storage tanks, of which about 8,500 are currently in use and about 1,500 are temporarily out of use. Mississippi DEQ officials indicated that, based on available staff and funding, its inspectors visit a facility about every 4 years. Before the August 1998 accident, Mississippi DEQ representatives last inspected the underground storage tanks at station No. 741 in December 1997 and noted no significant violations at that time. After the accident, DEQ inspectors performed a visual inspection of the site to determine whether the top of the tank had loose fittings that may have caused or contributed to the release from the underground storage system. They found that all the fittings appeared to be tight. Interviews with Mississippi DEQ officials indicated that the State has not enforced requirements that facility owners in Mississippi determine available underground storage space or monitor product transfers. Moreover, the State has not cited any facility owners for violating 40 CFR 280.30 (a). For this investigation, the Safety Board contacted the acting director of the EPA’s Office of UST to determine the scope of enforcement of 40 CFR 280.30 (a) by EPA investigators. The UST official surveyed EPA regional directors, of whom none could cite any specific case of enforcement. Notification of Hazardous Materials Incidents Soon after the fire erupted, the truckdriver notified the Premium safety director, who immediately drove from Jackson to the accident scene, a distance of about 170 miles. The safety director later stated that he maintained a telephone list of agencies to contact in the event of an emergency and that he made several unsuccessful attempts to report the accident to the National Response Center (NRC) while he was at the accident scene throughout the day. He said that he then drove back to his home in Jackson, where he fell asleep. When he awoke about 9:00 p.m., he remembered that he had been unsuccessful in reporting the accident and again tried to telephone the NRC with no success. He said that he then left his residence and drove to the Premium headquarters to check the phone number. At the office, he discovered that the number he had been using was incorrect, whereupon he called the NRC, which recorded the notification at 12:22 a.m. eastern standard time,30 about 23 hours after the accident occurred. 30 11:22 p.m. central standard time in Jackson.

Factual Information 26 Hazardous Materials Accident Report Title 49 CFR 171.15, “Immediate notice of certain hazardous materials incidents,” requires that motor carriers who transport hazardous materials report by telephone incidents meeting specified criteria, including a fatality, to the NRC “at the earliest practicable moment.” In the October 1969 proposed rulemaking on accident reporting requirements, the Research and Special Programs Administration (RSPA) stated: The immediate report would cover the essential items of information necessary for the operating administrations of the Department and the National Transportation Safety Board to determine what immediate action should be taken by them, if any.31 In March 1999, RSPA published an Advance Notice of Proposed Rulemaking (ANPRM) to determine the need for regulatory changes to the reporting requirements of the hazardous materials contained in 49 CFR Part 171. In its June 1999 response to RSPA’s ANPRM, the Safety Board cited three accidents involving transportation-related unloading operations that demonstrated deficiencies in the existing telephonic notification and incident requirements contained in 49 CFR Part 171. The Safety Board included the August 9, 1998, Biloxi accident as an example, stating: Although the accident occurred about 1:00 a.m. on August 9, 1998, the motor carrier did not notify the NRC until nearly 24 hours after the accident. The delayed notification precluded the Safety Board and other Federal agencies…from responding promptly and initiating the accident investigation. The Safety Board further noted: Under reporting criteria at 49 CFR 171.15, a carrier who transports hazardous materials is required to provide telephonic notification ‘at the earliest practicable moment.’ However, during its investigation of the Biloxi accident, the Safety Board has noted that the term ‘the earliest practicable moment’ is not defined in the Hazardous Materials Regulations, nor has RSPA issued an interpretation that provides any time constraints on the reporting time frame. The Safety Board itself requires railroads under 49 CFR 840.3 to provide telephonic notification through the NRC not later than 2 hours after an accident resulting in a fatality, the release of hazardous materials, or evacuation of the public and not later than 4 hours after an accident resulting only in damages exceeding specified thresholds. The Safety Board believes that the effectiveness of the requirements for telephonic notification should be strengthened and a specific time frame given for providing telephonic notifications. In related matters, the Occupational Health and Safety Administration (OSHA), requires notification within 8 hours of the death or in-patient treatment of any employee following a work-related accident.32 31 Federal Register, Vol. 34, No. 208. Published October 29, 1969. Page 17450. 32 29 CFR 1904.8

27 Hazardous Materials Accident Report Analysis General This analysis is divided into three main sections. In the first part, the Safety Board identifies factors that can be readily excluded as causal or contributory to the accident. In the second section, the Board provides a synopsis of events directly leading to the accident. In the final section, the Board discusses deficiencies in three major areas that were identified as issues during this investigation: • Premium’s management oversight; • Morrison’s procedures for accepting petroleum product deliveries to underground storage tanks; and • Federal requirements and oversight. The issue of Federal requirements and oversight includes regulatory requirements relating to written procedures for loading and unloading cargo tanks transporting hazardous materials, the regulatory requirements for notifying Federal agencies of a hazardous materials incident, and the EPA’s enforcement of the regulatory requirements contained in 40 CFR 280.30 (a) for preventing overfills. Exclusions The toxicological test results of blood samples taken from the truckdriver were negative for alcohol and drugs. The driver’s work-rest schedule did not require alternate night and day sleeping, which probably neutralized the effect of his working early morning hours. In the 4 days before the accident, he reportedly obtained his normal amount of rest. Based on these findings, the Safety Board concludes that the Premium truckdriver was not impaired by drugs, alcohol, or fatigue on the morning of the Biloxi accident. Accident Analysis On the eve of the accident, the truckdriver telephoned the Premium dispatcher to obtain the assigned deliveries for his shift. The safety director, who was serving as dispatcher, orally provided the driver with a list of three delivery locations and the number of gallons to be delivered to each site. He said that he told the driver to make deliveries to Fast Lane station Nos. 742, 743, and 736. The driver said that he wrote down the delivery sites that the safety director had given him. His notes matched all of the dispatch line numbers and two of the station numbers (742 and 743). However, station number No. 741 is listed rather than station No. 736. The dispatcher did not ask the driver to read the list to him to verify that he had understood and correctly recorded the delivery assignments. The dispatcher also did not provide a fax or written dispatch record to the driver.

Analysis 28 Hazardous Materials Accident Report After picking up his load of gasoline, the truckdriver went to Fast Lane station No. 741, which was not scheduled to receive a delivery. When the cargo tank truck arrived at the station, the Fast Lane station employees did not compare the amount of gasoline scheduled for delivery to the amount that the Red Jacket™ monitoring system indicated was in the underground tanks. Morrison, the station owner-operator, did not train and require its employees to monitor the volume of gasoline in underground tanks or to confer with cargo tank drivers to ensure the accuracy of deliveries; such a comparison, in this case, would have shown that the driver was in error and could have prevented the overfill. Once at the station, the driver made a number of operating errors. He did not determine the quantity of gasoline in the underground storage tanks, and he did not calculate the amount of gasoline that could safely be transferred from the cargo tank to the station storage tanks. After sticking the underground storage tanks through the direct fill ports, he failed to use the measurement that he obtained to calculate the available space for gasoline in the storage tank. He then failed to close the lids of the direct fill ports before beginning the gasoline transfer through the remote fill ports. Having both the remote and the direct port fill lids open rendered the tank system’s pressure-controlled safety device ineffective and resulted in gas overflowing the direct fill port of the regular unleaded gasoline storage tank. Finally, the truckdriver did not properly monitor the gasoline transfer. The Red Jacket™ printout and the convenience store video tapes indicate that he left the cargo tank truck while gasoline was being transferred into the underground tanks, which was contrary to company procedures. When he was standing by the cargo tank, he did not notice the gasoline overflowing from the storage tank and streaming across the station lot. A customer at the station observed him gazing across the road, seemingly unaware of the gasoline near him. The stream of gasoline ran along the side of the road and across the intersection, which, at the time, was occupied by three passenger vehicles. A fire erupted under one of the vehicles and immediately engulfed all three. Five of the occupants in the vehicles sustained fatal injuries, and one occupant suffered serious injuries. Adequacy of Premium’s Management Oversight Hiring Practices The Safety Board examined the truckdriver’s performance in the context of information obtained from his past personnel and medical files and from observations by OJT personnel and noted some factors that should have prompted greater scrutiny during the hiring process. The Safety Board then looked at Premium’s screening process for new applicants and noted some deficiencies. Medical Condition of the Truckdriver. Navy records indicate that the truckdriver was referred for medical evaluation and that several of his military-issued equipment operating licenses had been suspended after he had a series of equipment-related accidents. His Navy medical records indicate that military physicians diagnosed him as

Analysis 29 Hazardous Materials Accident Report having ADD. His records show that after he was prescribed Ritalin, his condition improved and his licenses were restored. The truckdriver’s actions during his civilian jobs were consistent with a medical condition such as ADD. During his training at Fayard and Premium, his driver-trainers complained that he frequently seemed preoccupied, was inattentive during instruction, and was easily distracted. The neurological condition described in the truckdriver’s Navy medical records may explain his reaction to the Biloxi gasoline overfill. According to a witness, the overfill was in clear view of the truckdriver as he stood near his vehicle. However, the truckdriver was observed staring over the overfill and did not respond until the witness spoke to him. A more thorough assessment of the truckdriver’s behavior cannot be offered without current neurological tests of the subject. The truckdriver failed to report background information related to his neurological disorder to physicians who performed his DOT physicals. Two physicians, lacking pertinent information, found the truckdriver to be medically qualified. The Safety Board concludes that the physicians who performed the truckdriver’s DOT physical could not adequately evaluate the truckdriver’s medical fitness because he did not report background information related to his neurological condition. The Safety Board has addressed the issue of improperly reported medical information in earlier accident reports.33 Physicians cannot adequately evaluate the medical fitness of drivers unless truthful information about previous medical conditions is provided. Similarly, once information is given, physicians have no way to verify the truthfulness and completeness of answers. As part of the Safety Board’s truck and bus safety initiative, in January 1999, the Board approved a series of public hearings to be conducted by its Office of Highway Safety. The first hearing, which took place in April 1999, focused on commercial vehicle oversight and crash data. As a result of the April hearing, additional Congressional interest, and its investigation of the May 9, 1999, crash of a motorcoach in New Orleans, Louisiana, that fatally injured 22 passengers, the Safety Board identified a group of issues that warrant additional examination: 33 See, for example, the following reports: (Publisher and place of publication for all works cited is National Transportation Safety Board, Washington, D.C.) Greyhound Bus Collision with Concrete Overpass Support Column on I-880, San Juan Overpass, Sacramento, California, November 3, 1973, Highway Accident Report NTSB/HAR-74/05 (1974); Collision of Humbolt County Dump Truck and Klamath-Trinity Unified District Schoolbus, State Route 96 near Willow Creek, California, February 24, 1983, Highway Accident Report NTSB/HAR-83/05 (1983); Academy Lines, Inc., Intercity Bus Run-off Roadway and Overturn, Middletown, New Jersey, September 6, 1987, Highway Accident Report NTSB/HAR-88/03 (1988); Greyhound Bus Lines, Inc., Intercity Bus Loss of Control and Overturn, Interstate Highway 65 in Nashville, Tennessee, November 19, 1988, Highway Accident Report NTSB/HAR-89/03 (1989); Factors that Affect Fatigue in Heavy Truck Accidents, Safety Study NTSB/SS-95/01 (1995).

Analysis 30 Hazardous Materials Accident Report • The safety implications of the North America Free Trade Agreement; • The adequacy of the OMCHS’s oversight of medical fitness and drug issues as they relate to the commercial vehicle driver; • The adequacy of the CDL program; and • The lack of a national CDL database accessible to motor carriers for driver selection and hiring purposes. The April hearing revealed that although commercial vehicle drivers are required to possess a CDL and a medical certificate, often there is no verification program for the driver’s medical fitness and drivers submit falsified certifications or, as in the case of the Biloxi accident, fail to inform examining physicians or the motor carriers of significant medical issues. Additionally, Safety Board investigations have found that examining physicians frequently do not understand the nature of the activities they are certifying drivers to perform, and no program is available to educate physicians how to conduct their examinations. Furthermore, medication impairment appears to be increasing among commercial drivers, especially in connection with combinations of prescribed and over- the-counter medication. Based on these findings, the Safety Board’s Office of Highway Safety has proposed that a hearing addressing CDL and medical fitness issues be conducted in FY 2000. Applicant Screening. Despite the truckdriver’s failure to report pertinent information on his application to Premium, the carrier’s officials might have been able to determine his fitness for duty had they conducted the 3-year background check required by Federal regulations (49 CFR 391.23). The safety director verified the truckdriver’s employment only with Fayard. The safety director told the Safety Board that he did not think that he would be able to obtain background information from the Navy. What is disturbing to the Safety Board in this case is that Premium officials did not even attempt to obtain Navy records. Had Premium made the information request, it may have obtained documents showing the truckdriver’s medical history before the accident occurred, which may have alerted company officials that the truckdriver had a medical condition that could affect his skills and abilities. The Safety Board concludes that although a significant factor in Premium’s hiring the truckdriver was his military background, the safety director did not attempt to check or to request the driver’s military records, which contained useful information for determining his medical fitness and ability to operate heavy equipment. The driver also did not report his previous employment with Werner. Had he done so, Premium officials may have been able to question why the driver’s employment with Werner had been terminated. The Safety Board concludes that, because the truckdriver failed to report on his job application his employment with a carrier that had dismissed him, useful information from that carrier was not available to Premium to help company officials evaluate the truckdriver’s ability to perform his duties.

Analysis 31 Hazardous Materials Accident Report At the Safety Board’s April 1999 hearing, associations and motor carriers testified that one of their primary concerns is their ability to select competent drivers. They stated that drivers’ records often do not transfer with them from State to State, nor do their records reflect all traffic violations. Motor carriers must rely on driver self-reporting to review prior work experience; so carriers are often unable to obtain a true picture of the driver’s history. The Safety Board’s Office of Highway Safety has therefore recommended that the failure of applicants to accurately report prior work history be addressed in the Safety Board’s proposed FY 2000 public hearing. Employee Training Because of the dangers that hazardous materials pose, the drivers transporting them must be among the most skilled operators. In addition to having a high degree of general truck driving skill and experience, drivers transporting hazardous materials need specialized knowledge, which makes training related to specific job functions especially important. Drivers must not only be well-versed in the properties of their cargo and the rules of the road concerning the transportation of those materials but also in all proper handling procedures if they are to be responsible for loading and unloading. Premium’s training program had two main phases: a 1-day orientation that provided new hires with a general overview of the company, the products transported, employee benefits, and pertinent Federal regulations, and an OJT period that focused on operational procedures. The OJT phase varied from 1 to 2 weeks, depending on the proficiency demonstrated by the new hire. In addition to the preliminary training, the safety director conducted quarterly safety briefings on subjects that he determined needed additional emphasis. Interviews with experienced Premium drivers and the truckdriver involved in the Biloxi accident revealed that the employees’ knowledge of company policies and procedures concerning loading and unloading gasoline varied widely. The Safety Board therefore looked at the reference materials and instructions Premium provided to its new hires concerning gasoline transfers. The driver’s manual given to Premium’s new hires and the trainer’s manual and the checksheet used by its driver-trainers were very general in nature and addressed few safety topics other than those concerning over-the-road transport. The manuals contained minimal instructions addressing gasoline transfers; the checksheet lacked detailed items under the category “Loading and Unloading.” Although the driver-trainer said that he explained and demonstrated specific unloading procedures to the truckdriver, the truckdriver’s personal notes taken during training list only very general steps and contain few safety considerations. When addressing operational considerations with serious safety implications, oral instructions are not sufficient. Oral instructions can be misinterpreted. Even when driver- trainers follow up their oral instructions by watching the drivers perform a function, there is no guarantee that the drivers understand the safety implications of the procedures they are following. Further, over time many trainees will forget instructions on procedures that

Analysis 32 Hazardous Materials Accident Report they are not required to perform frequently. All drivers of cargo tank trucks therefore need specific written job procedures if they are to operate safely. In the case of new employees, in particular, well written loading and unloading procedures can establish desired work patterns before bad habits are learned. Because his operating manual lacked detailed operating instructions addressing cargo unloading, the truckdriver had no thorough written source to reference if he could not recall his driver-trainer’s instructions or could not make sense of his own cryptic and inaccurate notes. This deficiency of information and training negatively affected the truckdriver’s gasoline transfer activities in several ways. First, Premium’s delivery loads to the Fast Lane stations were based on conservative estimates of daily gasoline sales. Consequently, circumstances such as unusually slow sales, shutdowns for maintenance, and miscalculations could result in the driver arriving with too much gasoline for the underground storage tank. Both the employee manual and the driver-trainer manual indicated that the driver should present the bill of lading to the station operator before making a transfer, but neither manual explains why this should be done first or identifies any potential safety benefits arising from this sequence. The manuals could have shown that by first obtaining the operator’s approval of the bill of lading, the driver could determine whether he was delivering the gasoline to the correct location and, at facilities having tank-volume monitoring systems, could ascertain the actual amount of gasoline in the underground tanks before beginning the transfer. By failing to discuss the rationale for first obtaining the bill of lading signature, Premium lost an opportunity to emphasize to its truckdrivers the safety consequences of this action. Lacking this explanation, the truckdrivers apparently did not absorb the importance of the procedural sequence. Fast Lane personnel told the Safety Board that the cargo tank truckdrivers rarely, if ever, showed or discussed the bill of lading with them before initiating a gasoline transfer. Additionally, as the previous overfills at the Biloxi and the Bay St. Louis stations demonstrate, the gasoline cargo amounts dispatched by Premium to a location are sometimes greater than the available space in the underground tanks. Consequently, it is essential that cargo tank truckdrivers correctly determine the ullage in the underground storage tanks and whether the intended amount of gasoline will fit into the tank before beginning a gasoline transfer. Nevertheless, neither the driver nor trainer manual advised truckdrivers that this determination is vital to safety or provided an example showing how to calculate available underground storage tank space. Omission of such safety-significant information illustrates the inadequacy of Premium’s reference manuals. As a safeguard against overfills, it is incumbent upon Premium to ensure that all its truckdrivers know the specific steps for unloading gasoline, including the various methods for calculating ullage in underground tanks and how to use tank charts. The truckdriver who overfilled Fast Lane station No. 741 in 1996 stated that he was unaware of any specific procedures for dealing with tanks with remote fills. Although Premium’s management officials were aware of both this overfill and the overfill at the Bay St. Louis

Analysis 33 Hazardous Materials Accident Report Fast Lane station, they still did not develop specific written procedures stressing the importance of calculating available space and replacing fill caps before beginning the transfer. Moreover, the safety director did not discuss potential procedural problems at stations with remote fill ports during his quarterly safety meetings. How a carrier manages the training of its new employees has a tremendous impact on their attitude toward their work and their ability to do their job effectively and efficiently. Inadequate instruction can leave new hires confused and uncertain of how to do the jobs for which they were hired. Inadequate training materials and vague procedural directions concerning cargo unloading procedures permit drivers to pick up bad habits and follow incomplete and potentially dangerous practices. The Safety Board concludes that Premium’s operating manuals for its new employees and its driver-trainers lacked the specificity that employees need to ensure that they practice correct and safe cargo unloading procedures. The Safety Board believes that Premium should revise its driver and driver-trainer manuals to include specific written instructions on loading and unloading cargo and on the use of tools, such as storage tank capacity charts, necessary to deliver gasoline safely. But the Safety Board emphasizes that, while Premium did not provide sufficient training or adequate reference materials to its drivers concerning gasoline loading and unloading, Premium’s deficiencies are symptomatic of a much larger problem in this area—the nationwide lack of Federal regulations addressing these significant safety issues. Although Federal regulations currently require that drivers be trained in loading and unloading procedures, the regulations do not require that motor carriers of bulk hazardous materials maintain specific written loading and unloading procedures. The Safety Board concludes that, to help drivers follow safe loading and unloading procedures, Federal regulations should require carriers that transport hazardous materials in cargo tanks to have specific written procedures for loading and unloading. The Safety Board therefore believes that RSPA should promulgate regulations requiring motor carriers that transport hazardous materials in cargo tanks to develop and maintain specific written cargo loading and unloading procedures for their drivers. Once regulations are promulgated, the FHWA should ensure that the motor carriers are in compliance with the regulations. The Biloxi accident presents issues relevant to all carriers involved in the transport of gasoline and petroleum products. The Safety Board therefore believes that the National Tank Truck Carriers Association and the American Petroleum Institute should inform their members of the facts and circumstances of the Biloxi accident and urge them to review the adequacy of their procedures for hiring and training truckdrivers and their written procedures for loading and unloading hazardous materials. Adherence to Policy The Safety Board is also concerned by the failure of Premium management to adhere to its own clearly stated policies and procedures. The record of the truckdriver involved in the accident showed a regular pattern of Federal hours-of-service violations.

Analysis 34 Hazardous Materials Accident Report Although the Premium driver’s manual states that suspension is the consequence of failing to comply with these Federal regulations, company officials merely continued to issue the truckdriver written warnings as a disciplinary measure rather than suspending him. Additionally, carrier officials failed to follow their own written procedures when they retained the truckdriver after the driver-trainer recommended termination. According to the Premium driver-trainer manual, the driver-trainer with whom a new employee is teamed has the final determination on the length of the driver’s initial training and on whether the new hire should be advanced to the status of qualified driver or terminated. In this case, the truckdriver’s trainer had determined the truckdriver’s unsuitability by their fourth day of working together. Instead of terminating the truckdriver as recommended by the driver-trainer, the safety director told the driver-trainer to take the truckdriver out again. The driver-trainer spent one more day of training with the truckdriver but believed that the truckdriver was not ready to work by himself. The driver-trainer had anticipated having two or three additional days to work with the truckdriver; however, while the driver-trainer was off-duty, company officials allowed the ill-prepared driver to make a delivery alone. The Safety Board concludes that the Premium safety director failed to adhere to company procedures for hiring and training the truckdriver and for disciplining him when he failed to comply with the hours-of-service requirements. The Safety Board believes that Premium should establish procedures to ensure that company officials adhere to written policies relating to hiring, training, and disciplining of company truckdrivers. Dispatch Procedures On the evening of August 8, 1998, during the telephone conversation between the safety director, who was serving as dispatcher, and the truckdriver, a miscommunication occurred that resulted in the truckdriver erroneously making a delivery to station No. 741. A review of the dispatch sheet and of statements made by the safety director indicated that the delivery was intended for a station in Long Beach, Mississippi. The safety director claimed to have correctly dispatched the truckdriver, and the truckdriver claimed to have accurately recorded the dispatches he was given. The miscommunication demonstrated that Premium’s dispatching procedures lack safeguards against errors. Both the safety director and the operations manager stated that they and other dispatchers had sometimes made errors in relaying information to truckers. Despite the fact that all company dispatches were given over the telephone and truckdrivers never saw the written assignments before delivery, the company dispatch procedures lacked safeguards for ensuring that truckdrivers received the correct information about the type, amount, and destination of the gasoline to be delivered. The Safety Board concludes that Premium’s lack of adequate procedures for verifying the accuracy of dispatch orders resulted in the truckdriver delivering gasoline to the wrong location. The Safety Board is pleased to learn that, since this accident, Premium has revised its dispatch procedures to include methods by which the dispatcher may verify that the driver has received the correct delivery information.

Analysis 35 Hazardous Materials Accident Report Adequacy of Fast Lane Employee Training The Fast Lane employees at station No. 741 interviewed after the accident indicated that they were busy with various routine activities during their work shift on the night of the overfill. They also indicated that they had become accustomed to hearing the overfill alarm and no longer responded to it. The EPA not only requires facility owners and operators to verify before transfer operations begin that the amount of gasoline being delivered will fit into underground gasoline storage tanks, it also requires that owners and operators monitor the transfer. The EPA allows owners and operators the option of using monitoring equipment, such as the Red Jacket™ system, to satisfy this Federal requirement. According to Morrison, the owner of Fast Lane station No. 741, its employees are not trained to monitor the Red Jacket™ system during transfer nor are they trained to respond to the Red Jacket™ overfill alarm. Morrison officials stated that, because of their agreement with Premium, they considered the carrier responsible for determining that the volume of cargo being delivered would fit in the underground tanks. The Safety Board is concerned by this attitude. The EPA requires that station owners and operators ensure that underground storage tanks have available space for the gasoline being delivered and that the transfer operation is monitored. The safest and most effective way to accomplish this is for station employees to work with truckdrivers to ensure the safe execution of gasoline deliveries. The Safety Board concludes that Fast Lane employees lacked adequate procedures and training to prevent overfills of the underground storage tanks. Morrison did not require its Fast Lane employees either to determine whether the amount of gasoline intended for delivery would fit in the underground storage tanks or to monitor alarms warning that the tanks were nearing maximum fill levels during cargo transfers. The Safety Board believes that Morrison should establish procedures and provide training to ensure that its employees verify that underground storage tanks have sufficient capacity for the gasoline or other petroleum products offered for delivery and monitor such transfer so that overfills do not occur. The Safety Board doubts that the failure to require station employees to monitor the gasoline transfer process is limited to Morrison. Accordingly, other station owners need to be made aware of the potential problems of relying on the hazardous materials carrier to safely load and unload gasoline. The Safety Board is convinced that industry associations should promote improved safety at service stations by publicizing the problems identified in the Biloxi accident. The Safety Board therefore believes that the National Association of Convenience Stores, the National Association of Truck Stop Operators, the Petroleum Marketers of America, the Service Station Dealers of America, and the Society of Independent Gasoline Marketers of America should inform their members of the facts and circumstances of the Biloxi accident and urge them to review their procedures and, if necessary, to revise them to require that station employees verify that underground storage tanks have sufficient capacity for gasoline or other petroleum products offered for delivery and to monitor such transfers so that overfills do not occur.

Analysis 36 Hazardous Materials Accident Report Adequacy of EPA Enforcement The EPA has very clear requirements stipulating that facility owners and their operators should ensure that the amount of gasoline delivered will fit into underground storage tanks. In December 1997, the Mississippi DEQ conducted an inspection at Fast Lane station No. 741 and noted no significant violations at that time. However, the inspectors did not check to determine whether the facility owner had trained or was requiring his employees to monitor transfers to the underground storage tanks. Following the 1998 overfill and fire, DEQ inspectors visually inspected the site to determine whether the top of the tank had loose fittings that may have caused or contributed to the release from the underground storage system. They found that all the fittings appeared to be tight. From interviews with Federal EPA officials and Mississippi DEQ staff, the Safety Board determined that neither the Federal nor the State agency has enforced the requirement that facility owners or operators determine the available underground storage space and monitor transfer procedures as required by 40 CFR 280.30. The EPA’s programs have focused on equipment safeguards and preventing underground storage tank leaks. The Safety Board concludes that the EPA’s program for preventing underground storage tank releases has not adequately addressed the requirements in 40 CFR 280.30 for preventing overfills of the type that occurred in Biloxi. Had the owner of Fast Lane station No. 741 required his employees to determine whether the amount of gasoline intended for delivery would fit into the underground tanks, the Biloxi accident probably would not have occurred. The Safety Board believes that the EPA should take action to improve compliance with and enforcement of 40 CFR 280.30, which requires that owners and operators of underground storage tanks prevent their overfilling. Accident Notification Requirements Premium did not notify the NRC until nearly 24 hours after the accident. The delayed notification precluded the Safety Board and other Federal agencies from responding promptly and initiating the accident investigation. Under reporting criteria at 49 CFR 171.15, a carrier that transports hazardous materials is required to provide telephonic notification “at the earliest practical moment.” However, the phrase “the earliest practical moment” is not defined in the hazardous materials regulations, nor has RSPA issued an interpretation that provides any time constraints on the reporting time frame. The Safety Board itself requires railroads under 49 CFR 840.3 to provide telephonic notification through the NRC not later than 2 hours after an accident resulting in a fatality, the release of hazardous materials, or an evacuation of the public and not later than 4 hours after an accident resulting in damages exceeding specified thresholds. Similarly, OSHA requires notification within 8 hours of the death or in-patient treatment of any employee following a work-related accident. The Safety Board concludes that the effectiveness of requirements for telephonic notification of certain hazardous materials accidents would be strengthened if the requirements contained a

Analysis 37 Hazardous Materials Accident Report specified time frame. The Safety Board believes that RSPA should require that a hazardous materials incident meeting the immediate notification requirements in 49 CFR 171.15 be reported within a specified time period to Federal authorities.

38 Hazardous Materials Accident Report Conclusions Findings

1. The Premium Tank Lines, Inc., truckdriver was not impaired by drugs, alcohol, or

fatigue on the morning of the Biloxi, Mississippi, accident.

1. The physicians who performed the truckdriver’s U.S. Department of Transportation

physical could not adequately evaluate the truckdriver’s medical fitness because he did not report background information related to his neurological condition.

1. Although a significant factor in Premium Tank Lines, Inc.’s hiring the truckdriver was

his military background, the safety director did not attempt to check or to request the driver’s military records, which contained useful information for determining his medical fitness and ability to operate heavy equipment.

1. Because the truckdriver failed to report on his job application his employment with a

carrier that had dismissed him, useful information from that carrier was not available to Premium Tank Lines, Inc., to help company officials evaluate the truckdriver’s ability to perform his duties.

1. The Premium Tank Lines, Inc.’s safety director failed to adhere to company

procedures for hiring and training the truckdriver and for disciplining him when he failed to comply with the hours-of-service requirements.

1. The Premium Tank Lines, Inc.’s operating manuals for its new employees and its

driver-trainers lacked the specificity that employees need to ensure that they practice correct and safe cargo unloading procedures.

1. To help drivers follow safe loading and unloading procedures, Federal regulations

should require carriers that transport hazardous materials in cargo tanks to have specific written procedures for loading and unloading.

1. Premium Tank Lines, Inc.’s lack of adequate procedures for verifying the accuracy of

dispatch orders resulted in the truckdriver delivering gasoline to the wrong location.

1. Fast Lane employees lacked adequate procedures and training to prevent overfills of

the underground storage tanks. R. R. Morrison and Son, Inc., did not require its Fast Lane employees either to determine whether the amount of gasoline intended for delivery would fit in the underground storage tanks or to monitor alarms warning that the tanks were nearing maximum fill levels during cargo transfers.

Conclusions 39 Hazardous Materials Accident Report

1. The Environmental Protection Agency’s program for preventing underground storage

tank releases has not adequately addressed the requirements in 40 Code of Federal Regulations 280.30 for preventing overfills of the type that occurred in the August 9, 1998, accident in Biloxi, Mississippi.

1. The effectiveness of requirements for telephonic notification of certain hazardous

materials accidents would be strengthened if the requirements contained a specified time frame. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the failure of Premium Tank Line, Inc.’s officials to follow established company procedures in hiring and training new drivers, the company’s lack of adequate procedures for dispatching drivers and delivering cargo to customer facilities, and the failure of R.R. Morrison and Son, Inc., to have adequate safety procedures for accepting product offered for delivery at its Fast Lane stations. Contributing to the accident was the truckdriver’s various and numerous operating errors during the gasoline transfer process that led to the underground storage tank overfill.

40 Hazardous Materials Accident Report Recommendations As a result of its investigation, the Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Promulgate regulations requiring motor carriers that transport hazardous materials in cargo tanks to develop and maintain specific written cargo loading and unloading procedures for their drivers. (H-99-57) Require that a hazardous materials incident meeting the immediate notification requirements in 49 Code of Federal Regulations 171.15 be reported within a specified time period to Federal authorities. (H-99-58) To the Federal Highway Administration: Once the Federal regulations requiring motor carriers that transport hazardous materials in cargo tanks to provide written cargo loading and unloading procedures are promulgated, ensure that the motor carriers are in compliance with the regulations. (H-99-59) To the Environmental Protection Agency: Take action necessary to improve compliance with and enforcement of 40 Code of Federal Regulations 280.30, which requires that owners and operators of underground storage tanks prevent their overfilling. (H-99-60) To Premium Tank Lines, Inc.: Revise your driver and driver-trainer manuals to include specific written instructions on loading and unloading cargo and on the use of tools, such as storage tank capacity charts, necessary to deliver gasoline safely. (H-99-61) Establish procedures to ensure that company officials adhere to written policies relating to hiring, training, and discipline of company truckdrivers. (H-99-62) To R.R. Morrison and Son, Inc.: Establish procedures and provide training to ensure that your employees verify that underground storage tanks have sufficient capacity for the

Recommendations 41 Hazardous Materials Accident Report gasoline or other petroleum products offered for delivery and monitor such transfers so that overfills do not occur. (H-99-63) To the National Association of Convenience Stores, the National Association of Truck Stop Operators, the Petroleum Marketers of America, the Service Station Dealers of America, and the Society of Independent Gasoline Marketers of America: Inform your members of the facts and circumstances of the August 9, 1998, accident in Biloxi, Mississippi, and urge them to review their procedures and, if necessary, to revise them to require that station employees verify that underground storage tanks have sufficient capacity for gasoline or other petroleum products offered for delivery and to monitor such transfers so that overfills do not occur. (H-99-64 through -68) To the National Tank Truck Carriers Association: Inform your members of the facts and circumstances of the August 9, 1998, accident in Biloxi, Mississippi, and urge them to review the adequacy of their procedures for hiring and training truckdrivers and their written procedures for loading and unloading hazardous materials. (H-99-69) To the American Petroleum Institute: Inform your members having cargo tank motor carrier operations of the facts and circumstances of the August 9, 1998, accident in Biloxi, Mississippi, and urge them to review the adequacy of their procedures for hiring and training truckdrivers and their written procedures for loading and unloading hazardous materials. (H-99-70) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member ROBERT T. FRANCIS II Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: September 21, 1999

this page intentionally left blank

43 Hazardous Materials Accident Report Appendix A Investigation The National Transportation Safety Board was notified about 12:30 a.m. eastern daylight time on August 10, 1998, of an overfill and fire at a gasoline station-convenience store in Biloxi, Mississippi. The investigator-in-charge and other members of the Safety Board investigative team were dispatched from the Washington, D.C., headquarters office. Upon arriving on scene, the Board established investigative groups to study hazardous material factors, vehicle factors, carrier operations, human performance, emergency response, and survival factors. The Safety Board was assisted in the investigation by the Federal Highway Administration, the Mississippi Public Service Commission, the City of Biloxi, Premium Tank Lines, Inc., and R.R. Morrison and Son, Inc.

44 Hazardous Materials Accident Report Appendix B Driver-Trainer’s Checksheet The following pages show photocopies of the two-page checklist used by Premium’s driver-trainers during a new hire’s OJT.

Appendix B 45 Hazardous Materials Accident Report

Appendix B 46 Hazardous Materials Accident Report

47 Hazardous Materials Accident Report Abbreviations and Acronyms ADD attention deficit disorder ANPRM Advance Notice of Proposed Rulemaking API American Petroleum Institute CDI Commercial Driver Institute, Inc. CDL commercial drivers license CFR Code of Federal Regulations CVSA Commercial Vehicle Safety Alliance DOT U.S. Department of Transportation EPA Environmental Protection Agency FHWA Federal Highway Administration FRA Federal Railroad Administration hazmat hazardous materials MPSC Mississippi Public Service Commission MVR motor vehicle record OJT on-the-job training OMCHS Office of Motor Carrier and Highway Safety OSHA Occupational Health and Safety Administration NRC National Response Center RSPA Research and Special Programs Administration UST underground storage tank

FD07206 ｜ 1998_美国_NTSB_MAR0001_Ramming_of_the_Eads_Bridge_by_Barges_in_Tow_of_the_MV_Anne_H.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 MARINE ACCIDENT REPORT 7009B PB2000-916401 NTSB/MAR-00/01 Ramming of the Eads Bridge by Barges In Tow of the M/V Anne Holly With Subsequent Ramming and Near Breakaway of the President Casino on the Admiral St. Louis Harbor, Missouri April 4, 1998

this page intentionally left blank

Marine Accident Report Ramming of the Eads Bridge by Barges in Tow of the M/V Anne Holly With Subsequent Ramming and Near Breakaway of the President Casino on the Admiral St. Louis Harbor, Missouri April 4, 1998 NTSB/MAR-00/01 DCA98MM027 PB2000-916401 National Transportation Safety Board Notation 7009B 490 L’Enfant Plaza, S.W. Adopted September 8, 2000 Washington, D.C. 20594 E P L U R IB U S U N U M N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

National Transportation Safety Board. 2000. Ramming of the Eads Bridge by Barges in Tow of the M/V Anne Holly With Subsequent Ramming and Near Breakaway of the President Casino on the Admiral, St. Louis Harbor, Missouri, April 4, 1998. Marine Accident Report NTSB/MAR-00/01. Washington, DC. Abstract: On April 4, 1998, a tow of the M/V Anne Holly, which was traveling northbound on the Mississippi River through the St. Louis Harbor, struck the Missouri-side pier of the center span of the Eads Bridge. Eight barges broke away and drifted back through the Missouri span. Three of these barges drifted toward the President Casino on the Admiral (Admiral), a permanently moored gaming vessel below the bridge on the Missouri side of the river. The drifting barges struck the moored Admiral, causing most of its mooring lines to break. The Admiral then rotated away from the Missouri riverbank. The captain of the Anne Holly disengaged his vessel from the remaining barges in the tow and placed the Anne Holly’s bow against the Admiral’s bow to hold it against the bank. No deaths resulted from the accident; 50 people were examined for minor injuries. Of those examined, 16 were sent to local hospitals for further treatment. The safety issues discussed in the report are: the advisability of the Anne Holly captain’s decision to make the upriver transit and the effectiveness of safety management oversight on the part of American Milling, L.P.; the effectiveness of safety measures provided for the permanently moored vessel President Casino on the Admiral; and the adequacy of public safety for permanently moored vessels. As a result of this investigation, the National Transportation Safety Board made safety recommendations to the U.S. Coast Guard, the Research and Special Programs Administration, the States of Missouri and Illinois, the cities of St. Louis and East St. Louis, the National League of Cities, the American Association of Port Authorities, the American Gas Association, the American Public Gas Association, President Casinos, Inc., Laclede Gas Company, and American Milling, L.P. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2000-916401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 President Casinos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Police . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Fire Department . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Coast Guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Other Responders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Crew and Staff Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Anne Holly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 President Casino on the Admiral . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Anne Holly Tow and Barges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 President Casino on the Admiral . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Conditions, Traffic, and Accident History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Bridges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Upbound Transit of the Eads Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 St. Louis Harbor Tow Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 American Milling, L.P. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 President Casinos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Emergency Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 President Casinos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 MSO St. Louis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 St. Louis Harbor Emergency Response Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Patron Questionnaires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Safety Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Inspections and Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Permanently Moored Vessels and Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Boats in a Moat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Passenger Vessels in St. Louis Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Contents iv Marine Accident Report Responsible Carrier Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1994 New Orleans Search and Rescue Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Developments Since the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 President Casino on the Admiral . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Laclede . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 NFESC Mooring Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Striking of the Eads Bridge by the Anne Holly Tow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Captain’s Decision-making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Navigation Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Factors That Could Have Affected the Captain’s Performance . . . . . . . . . . . . . . . . . . 55 Striking and Near Breakaway of the President Casino on the Admiral . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Emergency Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Public Safety of Permanently Moored Vessels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Owner’s Safety Management of the President Casino on the Admiral . . . . . . . . . . . . 69 Local and State Oversight of Permanently Moored Vessels in St. Louis Harbor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Role of the Coast Guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Previously Issued Recommendations Classified in This Report . . . . . . . . . . . . . . . . . . . . . 85 Appendixes A: Investigation and Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 B: Damage to Anne Holly Barges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 C: Characteristics of Barges in Anne Holly Tow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 D: Mooring Wires for the President Casino on the Admiral . . . . . . . . . . . . . . . . . . . . . . . . 90 E: Coast Guard List of PMVs in the United States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 F: Coast Guard February 17, 2000, Letter to the Safety Board on PMVs . . . . . . . . . . . . . 94 G: Coast Guard PMV Initial Risk Assesment Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 H: Conclusions and Recommendations of the QAT for PMVs . . . . . . . . . . . . . . . . . . . . . 100 I: Draft Coast Guard Marine Safety Manual Change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

v Marine Accident Report Acronyms and Abbreviations ABS American Bureau of Shipping Admiral President Casino on the Admiral AM American Milling AWO American Waterways Operators BOCA Code Building Officials and Code Administrators Basic Fire Prevention Code CFR Code of Federal Regulations COTP Coast Guard Captain of the Port ERT Emergency Response Team hp horsepower LMR Lower Mississippi River MLK Martin Luther King MSM U.S. Coast Guard Marine Safety Manual MSO Coast Guard Marine Safety Office NFESC Naval Facilities Engineering Service Center NFPA National Fire Protection Association OCMI Officer in Charge of Marine Inspection PARI Port Activity Risk Index PMV permanently moored vessel PVA Passenger Vessel Association RCP Responsible Carrier Program RSPA Research and Special Programs Administration SLFD St. Louis Fire Department U.S.C. United States Code UMR Upper Mississippi River USACE U.S. Army Corps of Engineers

this page intentionally left blank

vii Marine Accident Report Executive Summary About 1950 on April 4, 1998, a tow of the M/V Anne Holly, comprising 12 loaded and 2 empty barges, which was traveling northbound on the Mississippi River through the St. Louis Harbor, struck the Missouri-side pier of the center span of the Eads Bridge. Eight barges broke away from the tow and drifted back through the Missouri span. Three of these barges drifted toward the President Casino on the Admiral (Admiral), a permanently moored gaming vessel below the bridge on the Missouri side of the river. The drifting barges struck the moored Admiral, causing 8 of its 10 mooring lines to break. The Admiral then rotated clockwise downriver, away from the Missouri riverbank. The captain of the Anne Holly disengaged his vessel from the six remaining barges in the tow and placed the Anne Holly’s bow against the Admiral’s bow to hold it against the bank. About the time the Anne Holly began pushing against the Admiral, the Admiral’s next-to-last mooring line parted. The Anne Holly and the single mooring wire that remained attached to the Admiral’s stern anchor held the Admiral near the Missouri bank. No deaths resulted from the accident; 50 people were examined for minor injuries. Of those examined, 16 were sent to local hospitals for further treatment. Damages were estimated at $11 million. The National Transportation Safety Board determines that the probable cause of the ramming of the Eads Bridge in St. Louis Harbor by barges in tow of the Anne Holly and the subsequent breakup of the tow was the poor decision-making of the captain of the Anne Holly in attempting to transit St. Louis Harbor with a large tow, in darkness, under high current and flood conditions, and the failure of the management of American Milling, L.P., to provide adequate policy and direction to ensure the safe operation of its towboats. The National Transportation Safety Board also determines that the probable cause of the near breakaway of the President Casino on the Admiral was the failure of the owner, the local and State authorities, and the U.S. Coast Guard to adequately protect the permanently moored vessel from waterborne and current-related risks. The Safety Board’s investigation identified the following major safety issues: • the advisability of the Anne Holly captain’s decision to make the upriver transit and the effectiveness of safety management oversight on the part of American Milling, L.P., • the effectiveness of safety measures provided for the permanently moored vessel President Casino on the Admiral, and • the adequacy of public safety for permanently moored vessels. As a result of this investigation, the Safety Board made safety recommendations to the U.S. Coast Guard, the Research and Special Programs Administration, the States of Missouri and Illinois, the cities of St. Louis and East St. Louis, the National League of

Executive Summary viii Marine Accident Report Cities, the American Association of Port Authorities, the American Gas Association, the American Public Gas Association, President Casinos, Inc., Laclede Gas Company, and American Milling, L.P.

1 Marine Accident Report Factual Information The Accident The towboat Anne Holly, owned by American Milling, L.P., (AM) began its 1998 operating season on the Upper Mississippi River (UMR)1 on March 9, 1998. According to its log, the Anne Holly transited southbound through St. Louis Harbor about 08502 on April 4 and arrived at the Eagle fleeting area3 at mile 177.6 UMR at 0930. (See figure 1.) About 1710 on April 4, the Anne Holly’s captain4 relieved the pilot on watch. At this time, the tow was being made up and the barges were being secured to each other with extra rigging because of the prevailing river conditions. About 1830, the Anne Holly got underway from the fleeting area, heading upstream for St. Paul, Minnesota, (mile 839.0) pushing 12 loaded and 2 empty barges. The tow was five barges long in the port side or string, five barges long in the center string, and four barges long in the starboard string.5 Except for the two empty barges on the forward end of the starboard string, all the barges contained dry cargo (mostly fertilizer) and carried 981 to 1,696 tons of cargo each. All 14 barges were 35 feet wide; 11 barges were 200 feet long, and the remaining 3 barges were 195 feet long. The complete tow, including the 154-foot-long towboat (secured at the after-center of the tow), was 1,149 feet long and 105 feet wide. (See figure 2.) The river current at St. Louis was running about 6 mph at a river gage of 31.6 feet. 1 For navigation purposes, the Mississippi River is divided into the Lower Mississippi River (LMR) and the UMR. The LMR extends from the Gulf of Mexico to the confluence of the Ohio and Mississippi Rivers, near Cairo, Illinois. The UMR extends north from the Ohio River to the head of navigation at Minneapolis, Minnesota. All river miles along the UMR are measured in statute miles northbound from mile 0 near Cairo to mile 857.6 at Minneapolis. 2 Unless otherwise noted, all times are central standard and are based on the 24-hour clock. Daylight savings time began at 0200 on April 5, 1998. 3 A fleeting area is where barges are kept until picked up by tows. Barges are dropped off and picked up by line-haul towboats at these locations. The areas consist of an anchor barge to which the other barges are moored. Small towboats, also known as harbor or fleet boats, shift the barges around to make them accessible for making up tows. 4 The terms captain and pilot are routinely used on river towboats, and here they are used to differentiate between the Anne Holly’s two operators. The captain was the senior licensed operator and was in charge of the vessel. Each operator had, and was required to have, a Coast Guard license as an operator of uninspected towing vessels. 5 Due to the size of locks (110 feet wide by 600 feet long) on the UMR, the sizes of dry cargo tows tend to be limited to a maximum of about 15 barges (5 barges long and 3 barges wide). Because barges are about 35 feet wide and 195 or 200 feet long, such a tow would measure about 1,000 feet long and 105 feet wide. Such a tow would have to make a double lockage to pass a lock. In this procedure, the tow is split at nine barges and locked through; then the remainder of the tow goes through the lock. After both segments lock through, the tow is reconnected to continue its trip.

Factual Information 2 Marine Accident Report The captain said that, after leaving the Eagle fleeting area, he radioed the fleet to request a helper boat6 to assist the Anne Holly through the four upcoming bridges. The only Eagle fleet boat working that evening was carrying out other activities, and the Anne Holly captain was told that a fleet helper boat was not available. Around 1900, the tow passed under the Douglas MacArthur and Poplar Street Bridges, miles 179.0 and 179.2 UMR, respectively. The captain said the passings were uneventful and the equipment on the vessel was operating satisfactorily. With respect to the transit of St. Louis Harbor, the captain told investigators, “Once I cleared Poplar Street [Bridge], I didn’t think I’d have no problem at all.” He also said, “If you can shove up these two bridges [MacArthur and Poplar] in high water like we Figure 1. Map showing accident area 6 A helper boat is a harbor or fleeting towboat that can either be secured to the forward or aft part of the tow, wait ahead of the tow, or follow alongside the tow to assist, if needed, in controlling the tow.

Factual Information 3 Marine Accident Report have now, the rest of the bridges are simple.” When investigators asked the captain whether he had thought he needed a helper boat in making this passage, he stated that he might have needed one for the MacArthur and Poplar Street Bridge transits but not after he had cleared the Poplar Street Bridge. The captain told investigators that he had maneuvered the tow northbound through St. Louis Harbor at full engine throttle (about 900 rpm on both engines), making about 3 mph against the river current. According to the chief engineer, the captain asked him to set the fuel rack to provide the maximum engine power before the Anne Holly got near the bridges. The engineer complied with the request, and the captain made no comments about inadequate engine power. The Anne Holly’s chief engineer testified that he was in the engineroom during the transit through St. Louis Harbor (including the passage under the Eads Bridge), and that the two propulsion engines, the electrical generators, the steering gear, and other engineroom equipment experienced no problems. The chief engineer testified that the readings shown on the engineroom log for April 4, 1998, which recorded engine rpms, fuel rack settings, and temperatures and pressures for engine cooling water and lubricating oil, were normal. He also stated that since he had come aboard the vessel on March 8, 1998, he had not experienced any problems with the propulsion engines; he had performed only routine maintenance. A little before 1950 on April 4, 1998, the tow approached the Eads Bridge, mile 180.0 UMR. The captain later recalled, “Everything was looking good. Everything was under control. The boat was doing well.” The captain said that he did not have any trouble seeing the dayboards7 and the fixed green light at the center of the Eads Bridge. He said he illuminated the dayboards with his searchlight. The captain told investigators that he directed the tow to the right of the center of the Eads Bridge center span.8 According to the Anne Holly’s first mate (non-navigating Figure 2. Schematic of the Anne Holly tow barges 7 A dayboard is an unlighted aid to navigation designed primarily for daytime use; dayboards are coated with retroreflective material for nighttime use (with searchlights). 8 The bridge’s three spans, facing north, are the Missouri (left side, 498 feet wide), the center (517 feet wide), and the Illinois (right side, 498 feet wide).

Factual Information 4 Marine Accident Report person in charge of the deck), the vessel’s steering light9 was not lit. The captain said that by using visual “marks” (the Eads and Martin Luther King Memorial Bridge lights and other visual points), he maneuvered the Anne Holly close to the middle of the arched center span because the arch apex could best accommodate the towboat’s height. He said he thought the vessel had about 8 feet of vertical clearance. The captain testified that when 300 to 400 feet of the tow had passed under the Eads Bridge, he could feel the tow begin to slow. He said he continued to use the vessel’s full power to move the tow through the bridge. The captain said that as the eight forward barges (three port, three center, and two starboard), which comprised about 600 feet of the tow, passed under the center span, the Anne Holly “stalled” (the tow’s forward movement was halted by the river current). When asked by investigators about the reason for the halt, the captain said that he believed a “pop rise”10 had occurred, which impeded the vessel’s forward progress. The captain said that the towboat was using its maximum engine power of 900 rpm, but it could not overcome the current in the bridge span. He said that, with the headway stopped, a current then caused the tow to drift sideways toward the Missouri shore. Within 30 seconds, the tow’s port side (between the third and fourth barge from the tow’s head) struck the Missouri-side pier of the Eads Bridge center span. About 1950, just after the tow struck the bridge, the forward eight barges broke away from the tow and drifted back down through the Missouri span. Three of these barges began drifting toward the 380-foot-long President Casino on the Admiral (Admiral), which is a gaming vessel and attached entry barge11 permanently moored by 10 mooring wires below the Eads Bridge on the Missouri side of the river.12 (See figure 3. See figure 4 for a schematic of the Admiral complex.) The captain of the Anne Holly immediately notified the Coast Guard Group UMR in Keokuk, Iowa, on VHF-FM radio of the accident. He also attempted to call the Admiral on VHF-FM radio to warn it of the loose barges, but he received no response. Across the river, the master on watch on the M/V Casino Queen (a passenger vessel that periodically gets underway for gaming) overheard the Anne Holly’s radio 9 A steering light is a small blue light installed on a pole placed on the centerline at the head of the tow facing aft. The operator may use the light to detect heading changes and to align the tow with respect to a bridge or other restricted navigation area during periods of darkness. 10 The Anne Holly captain said, “there are two types of rises, the slow rise [in river stage or level], you don’t have as much current. You have a more steady current. A pop rise is a rise [in river stage or level] that comes up a lot swifter…it brings gushes of water at time.” A pamphlet on the “Language of the Western Rivers,” published by the U.S. Coast Guard in the early 1970s, defines a pop rise as “a fast rise (usually not a great one) in the river generally caused by flash flood.” 11 The Admiral’s owner told the Safety Board that the entry barge was actually two custom-built barges connected end to end. For the purposes of this report, we refer to this unit as the entry barge. 12 The floating entry barge has three gangways to shore; the center gangway is for passengers, while the forward and aft ones are for services. The passengers move from shore over the gangways onto the entry barge and then onto the Admiral. The Admiral and the entry barge are physically secured to each other. For the purposes of this report, the whole complex, including entry barge and vessel, will be generally considered the Admiral.

Factual Information 5 Marine Accident Report Figure 3. Photo of the Admiral Figure 4. Schematic of the Admiral complex

Factual Information 6 Marine Accident Report attempts to contact the Admiral. He called the captain of the Anne Holly and advised him that the Admiral did not have a radio and that people were on the vessel. Shortly thereafter, the three barges from the Anne Holly drifted toward the Admiral and severed or severely damaged mooring line numbers 8, 9, and 10 at the Admiral’s bow, before colliding with the Admiral. At least two of the three barges struck the Admiral, and two barges drifted downriver. The third barge drifted toward shore and struck the sidewalk protection guards and the north gangway between the shore and the entry barge. The impact to the Admiral caused wire rope numbers 1, 2, 3, 4, and 5 to break. (Figure 5 details the mooring arrangement. Figure 6 shows two views of the complex.) Almost immediately, the Admiral began moving offshore and slowly rotated with the current clockwise downriver, away from the Missouri shoreline. The three gangways (which remained attached to the entry barge) were damaged, and the Admiral’s electrical, natural gas, telephone, and water service lines parted about 1954.13 The Casino Queen master on watch radioed the Anne Holly captain and told him that the Admiral was drifting. After receiving the radio call, the captain of the Anne Holly disengaged his vessel from the six remaining barges in the tow. He then moved his vessel downriver to the Admiral and, about 1959, placed the Anne Holly’s bow against the Admiral’s bow to keep it near the bank. According to the chief engineer on the Admiral, wire rope number 6 broke about the time the Anne Holly began pushing against the Admiral. After being notified of the emergency by President Casinos14 personnel, about 1957, a St. Louis Fire Department (SLFD) team arrived at the scene at 2005. The SLFD deputy chief assumed responsibility as the incident commander and found that the Admiral appeared to be “stable.” He ordered Admiral engineering personnel to inspect the hull; they subsequently told him that the Admiral was not taking on water. Once the Admiral was stabilized against the bank, patrons from the Admiral were evacuated to the Anne Holly. At first, the evacuation took place over a foot-wide plank between the two vessels. Later, the people evacuated to the towboat using a ramp provided by the SLFD. From the Anne Holly, the patrons transferred to two excursion vessels, the Becky Thatcher and the Tom Sawyer, and subsequently to shore. The evacuation process took about 3 1/2 hours. Upon hearing the radio transmissions from the Anne Holly, at least seven towboats from various fleeting areas south of the MacArthur Bridge responded to the scene to capture the loose barges drifting down the river. By 2050, all 14 barges had been retrieved and secured to fleeting areas. 13 Times for events occurring after the Admiral was struck were derived by investigators using President Casinos, Inc.’s onboard security videos and electric company records. Electrical power was partially restored within 5 seconds, when the Admiral’s emergency generators activated. 14 The Admiral is owned by President Riverboat Casino-Missouri, Inc., which is a subsidiary of President Casinos, Inc. For the purposes of this report, we will generally use the term “President Casinos” to refer to the ownership of the Admiral, unless a distinction between the two firms seems necessary.

Factual Information 7 Marine Accident Report Figure 5. Schematic of the Admiral mooring arrangement

Factual Information 8 Marine Accident Report Figure 6. Two views of the Admiral complex

Factual Information 9 Marine Accident Report Emergency Response President Casinos About 1951 on April 4, 1998, a night security officer assigned to President Casino, Inc.’s, main office on North 1st Street (a few blocks upriver of the Admiral) heard a towboat blowing its whistle. He went to a nearby office with a view of the harbor, from which he observed sparks caused by the Anne Holly’s barges striking against the concrete pier of the Eads Bridge. He immediately telephoned the Admiral’s security office. The Admiral’s senior shift manager received the warning telephone call from shore. He left the security office on the entry barge and went down one deck to the north (employee) gangway. Looking northward, he saw three barges about 50 yards upstream heading downriver and directly toward the Admiral. Realizing that impact was imminent, he sent a warning message by walkie-talkie to all Admiral security personnel, who were equipped with walkie-talkies, that loose barges were heading toward the Admiral and to prepare for impact. The senior shift manager stated that, after giving the warning, he ran down the north gangway onto some nearby scaffolding (which had been used during the high water as a temporary means of access to the entry barge gangway) and began ushering people toward shore.15 As soon as they were aware of the approach of the breakaway barges, center gangway security personnel16 began ushering patrons back down the gangway and up the temporary scaffolding along L.K. Sullivan Boulevard. Testimony indicated that at least two elderly individuals among the patrons near the center gangway were using walkers and required security officer assistance to get them off the gangway. At some time during this activity, the barges struck the Admiral. About 1957, the President Casinos shoreside office took action to notify the SLFD and the St. Louis City Police Department of the accident. As he ushered patrons up the scaffolding, the senior shift manager used his walkie- talkie to tell the Admiral’s security dispatch office (on the north gangway) to call 911. The dispatcher told the senior shift manager that the vessel’s telephone lines were dead. Following the barge strikes, vessel engineering personnel closed all watertight doors below deck, inspected all compartments below deck for leaks, and ensured that the emergency generators were operating properly. When the Anne Holly arrived and pushed against the Admiral to hold it in place near the riverbank about 1959, security personnel began moving patrons from the “B,” “C,” and “D” decks down to the “A” deck and toward the starboard forward doors. 15 Admiral security personnel estimated that about 100 people had been on the center gangway and nearby scaffolding before the initial impact. 16 Five security personnel were assigned to the center gangway. Their primary responsibilities were to check patron ages, prevent unruly people from boarding, and control the crowd.

Factual Information 10 Marine Accident Report When the Admiral began to break away from shore, the senior shift manager was on shore. He returned to the Admiral about 2145, transferring from the Becky Thatcher. Admiral security personnel told investigators that they carried out at least five deck-by-deck security sweeps of the Admiral in the hours following the accident, looking for stray, lost, or injured patrons. Police City. St. Louis police personnel arrived on the scene about 2000 and saw the Anne Holly holding the Admiral in place. About 30 additional St. Louis police officers were dispatched to the scene. State. When he saw the accident sequence begin, a Missouri State police gaming officer assigned to the Admiral,17 who was ashore at the time of the accident, ran to a parking garage about 1/4 mile away and asked the attendant to call 911. (The attendant was unable to complete the call.) The gaming officer then ran to the State Gaming Commission’s patrol car, which was parked on the upper level of the garage, to use his department’s cellular phone. He was unable to do so because he did not have the cellular phone password. He then drove another patrol car out of the garage (for better radio reception) and, at 2002, used the car’s radio to notify the Missouri State police dispatcher of the accident and of possible people in the water. The Missouri State police dispatcher notified the State Water Patrol, the Coast Guard, the SLFD, the St. Louis City Police Department, and local State police units. Shortly thereafter, the Missouri State police dispatched a police helicopter and six crowd management personnel to the scene. Fire Department An SLFD deputy chief and SLFD personnel and equipment (a marine task force, five quint firefighting apparatuses,18 one heavy rescue squad, and two battalion chiefs) arrived on the scene at 2005 and established an incident command post and a medical triage area. Rescue squads and 12 ambulances arrived shortly thereafter. More than 48 units (including 15 ambulances) and 65 people (including 35 medics and technicians and 1 medical physician) ultimately responded to the emergency. The fire department also provided a 32-foot-long fire and rescue boat. This boat was later used to transport SLFD personnel to the Admiral and to move patrons with medical complaints and injuries ashore. According to SLFD logs, responders examined 50 people who had medical complaints and transported 16 to area hospitals for further treatment of disorders including chest pains, dizziness, lumbar strain, and abdominal pain. Most were released shortly thereafter. (One person remained in the hospital because of a pre-existing heart condition.) 17 A State gaming officer is a Missouri State trooper on board the vessel to ensure that the State receives its proper tax revenues. The trooper can arrest patrons if they become unruly or a public nuisance. 18 A fire truck with multiple-feature firefighting capabilities.

Factual Information 11 Marine Accident Report SLFD personnel were told that people were trapped in elevators on the Admiral. They checked this report and found that no one was in the Admiral elevators. The SLFD also responded to two incidents involving people trapped in elevators at a nearby National Park Service parking garage.19 Regarding the first incident, one person had been released from an elevator before the SLFD arrived at the garage. At the second incident, the SLFD removed one person who had been trapped in an elevator. The safety coordinator for the National Park Service Gateway Arch facility reported that the elevator power failure at the parking lot was related to the Admiral accident. He said that when the Admiral broke its moorings, electrical power was lost to the Arch parking garage and caused the Arch garage elevators to shut down and the doors to remain closed. The elevators had no emergency power backup. (The safety coordinator told Safety Board investigators that a fail-safe system has since been installed and that if power is lost now, battery power will activate, the elevator cars will go to the lowest garage level, and the doors will open. The system was tested and found satisfactory on February 15, 2000.) Coast Guard At 2000, Group UMR notified the duty officer at the Coast Guard Marine Safety Office (MSO) St. Louis that the Anne Holly had lost power and collided with the Eads Bridge. At 2004, Group UMR issued an urgent marine information broadcast about the drifting barges.20 At 2014, the Coast Guard (at the request of the SLFD) closed the river between miles 178 and 180 UMR to all vessel traffic. The Eads, Poplar Street, and MacArthur Bridges were also closed until all barges could be recovered and the bridges inspected for damage. At 2030, a team of MSO St. Louis personnel, consisting of the Captain of the Port (COTP),21 the executive officer, a public affairs officer, an inspector, and an investigating officer, arrived at the scene to assist fire and police services. The COTP joined the SLFD deputy chief at the incident command post. State bridge inspectors reopened the Eads, Poplar Street, and MacArthur Bridges at 2216. At 2228, the Coast Guard buoy tender Cheyenne received reports that a person may have fallen into the water. The Coast Guard began a search using the Cheyenne, three Missouri water patrol boats, and a St. Louis police helicopter. They searched 8 miles downstream for anyone in the water. The Coast Guard issued an urgent marine information broadcast requesting all vessels in the vicinity of the Admiral to report any 19 The garage provides parking for the St. Louis Gateway Arch. 20 The broadcast was “PAN PAN, PAN PAN, PAN PAN. This is the United States Coast Guard Upper Mississippi River, Keokuk, Iowa. The Coast Guard has received a report of 14 barges adrift in vicinity of mile 180 Upper Mississippi River. All vessels in vicinity are requested to transit with caution and assist if possible. Signed, Commander Coast Guard Group, Upper Mississippi River.” 21 In St. Louis, the person in charge of the MSO has three titles; commanding officer (for carrying out military duties), officer-in-charge (for regulating the commercial marine industry by conducting inspections and investigations), and COTP (for conducting pollution control and port safety duties). In this report, we will refer to the highest official in the St. Louis MSO as the COTP.

Factual Information 12 Marine Accident Report sightings of people in the water and to assist, if possible. At 2310, the search ended, and no one had been found. A vessel in the area, the M/V Janie Charlie, continued to watch for anyone in the water. No reports of a missing person were received in the aftermath of the accident, and authorities received no other evidence indicating that anyone had fallen into the water. At 0148 on April 5, the Coast Guard reopened the river to light boat traffic (vessels with no tows). About 0930 on April 5, the river was reopened to all traffic. (See table 1 for notification sequence of initial emergency responders.) Other Responders Gateway Riverboat Cruises. Two nearby Gateway Riverboat Cruises excursion vessels, the Becky Thatcher and the Tom Sawyer, both of which had moorings at the Gateway barge, south of the Admiral, assisted in the emergency response. The master of the Becky Thatcher, hearing the danger signal from the Anne Holly and seeing the Admiral swing around, disembarked his vessel’s passengers and got underway to assist. According to the Becky Thatcher’s logbooks, the vessel got underway at 2040, arrived along the port side of the Anne Holly at 2045, and began boarding Admiral patrons from the Anne Holly. The first load of 302 patrons evacuated from the Anne Holly to the Becky Thatcher about Table 1. Approximate initial notification and response sequence Times (some estimated) Actions 1950 Barges break loose from the Anne Holly. Anne Holly captain makes emergency call to Coast Guard Group UMR. 1951 President Casinos, Inc., watchman notifies the Admiral senior shift manager of problem at Eads Bridge. 1952 to 1954 Barges strike the Admiral; moorings begin to break; the Admiral begins to swing away from shore; power fails and emergency power activates. 1957 to 1958 The SLFD and the St. Louis City Police are notified. 1959 The Anne Holly pushes against the Admiral’s bow. 2000 to 2001 Coast Guard Group UMR notifies MSO St. Louis that the Anne Holly has collided with Eads Bridge and lost tows. St. Louis City police personnel arrive on scene. 2002 Gaming officer notifies Missouri State police of accident. 2003 Missouri State police dispatcher notifies the State Water Patrol, the Coast Guard, the SLFD, the St. Louis City Police, and local State police units. 2004 Coast Guard Group UMR issues urgent marine information broadcast about breakaway barges. The Missouri State police dispatch a helicopter and personnel to the scene. 2005 SLFD team arrives on scene. 2014 Coast Guard closes river between miles 178 and 180 UMR to all vessel traffic. 2030 MSO St. Louis personnel arrive on scene.

Factual Information 13 Marine Accident Report

1. By 2355, the Becky Thatcher had offloaded 927 people from the Admiral to the

Gateway barge. Gateway Riverboat Cruises called in a crew for the Tom Sawyer, which had been moored at the Gateway barge. The vessel came alongside the Anne Holly and began offloading patrons at 2105. The first load of 288 patrons left the Anne Holly for the Tom Sawyer at 2130. The Tom Sawyer had offloaded 787 people from the Admiral by 0030 on April 5, 1998. Utilities. The electrical power and natural gas lines attached to the Admiral from shore parted when the vessel rotated after being struck by the barges. Shoreside electric power to the Admiral was lost when the power supply line shorted as it parted. Emergency generators on the Admiral restored emergency electrical power on the vessel within 5 seconds. When the Admiral lost power, the Arch parking garage and three other buildings in the area served by the same power line that served the Admiral also lost electric power. At 1954, the electric company received an alarm in its distribution dispatch office indicating that the power line was open to the waterfront area. The company sent personnel to the substation22 responsible for the power line and began checking circuits at 2037. The problem circuit was isolated at 2107. The technicians then had to go to each building to isolate the affected circuit and activate reserve circuits to carry the electric power. Between 2145 and 2200 on April 4, power was restored to the parking lot garage and downtown buildings. The line to the Admiral had to be repaired. Full power was restored to the Admiral at 1430 on April 30, 1998. After the lines parted following the accident, natural gas continued to leak from the natural gas line at 5 psi. Because natural gas is lighter than air, the natural gas rose and dispersed into the atmosphere. The wind hastened this process. Soon after arriving on scene, the SLFD incident commander had water sprayed on the escaping natural gas. No fire or explosion occurred. At 2028, the SLFD dispatcher requested assistance from the Laclede Gas Company, and a seven-person emergency repair team was on the scene by 2105. Laclede Gas responders located the regulator pit in the flooded sidewalk near the Admiral. The pit was under temporary scaffolding that had been erected for passengers to use when boarding the Admiral, so that they would not have to walk through the flood water in the street leading to the boarding ramp. The Laclede team removed the scaffolding so they could access the steel coverplate of the pit. Once they had removed the plate, the Laclede team could not locate the shut-off valves within the pit, which was filled with muddy river water. When they could not turn off the natural gas from the pit, the Laclede personnel made two unsuccessful attempts to close off the natural gas hose with clamps supplied by a fire truck. About 2300, the team put a heavy-duty Laclede clamp on the ruptured hose and tightened it until the natural gas flow stopped. 22 The substation, which supplied the electrical power to the Admiral, reduced the incoming voltage from 138 to 13.8 kilovolts.

Factual Information 14 Marine Accident Report Federal regulations (49 Code of Federal Regulations [CFR] 192.365 [b] and [c]) make the following requirements regarding the location of valves for service lines: (b) Outside valves. Each service line must have a shut-off valve in a readily accessible location that, if feasible, is outside of the building. (c) Underground valves. Each underground service-line valve must be located in a covered durable curb box or standpipe that allows ready operation of the valve and is supported independently of the service lines. Injuries

• Table is based on the injury criteria of the International Civil Aviation Organization (49 CFR 830.2), which the Safety Board

uses in accident reports for all transportation modes. The table contains injuries sustained by those persons involved in this accident who were treated at local hospitals within 24 hours of the accident. ** President Casinos estimated through ticket counts that the Admiral had about 2,100 people, including 250 staff members, on board at this time. Damage Anne Holly and barges $485,000 Admiral $10 to 11 million Total Approximately $11 million The Anne Holly and 9 of its 14 barges were undamaged. See appendix B for the details about the towing company’s damage estimate for the remaining five barges and the cargo. The Admiral’s bow received damage above the waterline. Also, two of the four universal-type joint connection devices (upriver and downriver ends) that connected the vessel and its entrance barge were damaged. The Admiral’s entrance barge was damaged when it was dragged from its shoreside position. All three gangways had to be replaced. Electrical, natural gas, and water lines that parted during the accident had to be replaced or repaired. The Admiral and its entry barge were repaired and back in full operation on April 30, 1998. Table 2. Injuries sustained in the Admiral accident* Injuries Anne Holly Admiral Total Fatal 0 0 0 Serious 0 1 1 Minor 0 15 15 None 10 2,084 2,094 Total 10 2,100** 2,110

Factual Information 15 Marine Accident Report Except for some scraping on the Missouri-side pier of its center navigation span, the Eads Bridge did not sustain any damage. Crew and Staff Information Anne Holly Crew. The Anne Holly had a crew of 10, including the captain, the pilot, two engineers, a mate, four deckhands, and a cook. Both the captain and pilot held valid Coast Guard licenses as operators of uninspected towing vessels. No other people on board were required to have Coast Guard licenses. Chief engineer. The chief engineer of the Anne Holly said that he had 23 years of experience on the river as a towboat engineer, had been employed with the company as chief engineer for 7 1/2 years, and had served as the chief engineer of the Anne Holly for about 4 1/2 years. Captain. The captain, 54, said that he had begun working on vessels as a deckhand when he was 15. He had obtained his first license as an operator of uninspected towing vessels upon the Great Lakes and inland waters in 1973. Since 1985, most of his experience had been operating towing vessels on the UMR through St. Louis Harbor. He said that he had made numerous trips through St. Louis Harbor at various river stages. He told investigators that he had had one other accident in 1986 or 1987, when he was pushing a tow downstream near Huntington Point, Mississippi; his towboat’s starboard engine failed, and the tow struck a dock. The Coast Guard told the Safety Board that it had no record of any actions taken against the captain before the April 4, 1998, accident at the Eads Bridge. Following the accident, the captain was charged with negligence; he entered a “no contest” plea. All the valid licenses and documents issued to the captain by the Coast Guard were suspended for 2 months, remitted on 6 months probation, effective July 27, 1998. Winterville Marine, of Greenville, Mississippi, a personnel agency that provides crews to operate towboats, employed the captain. He worked sporadically for Winterville Marine during the 1980s. The captain had worked the Anne Holly for Winterville Marine since March 1993. Winterville Marine paid his health care benefits and salary. AM paid Winterville Marine a monthly fee for towboat personnel services. Although the captain was paid by Winterville Marine, AM was responsible for all operational matters on the tow. The captain’s physical exam for renewal of his operator of uninspected towing vessels license took place in November 1993. His hearing, vision, and color acuity were normal, and his visual acuity was uncorrected 20/20. His blood pressure was 150/90. The physician certified the captain physically competent to perform duties aboard a U.S. merchant vessel.

Factual Information 16 Marine Accident Report The captain had a physical examination, including referral for an exercise stress test, administered by his private physician in February 1998. No problems were noted. In August 1998, the captain underwent a physical exam for renewal of his operator’s license, conducted by his private physician. The physician certified the captain physically competent to perform duties aboard a U.S. merchant vessel. The captain had been prescribed three medications at the time of the accident: nifedipine for high blood pressure; glyburide for noninsulin-dependent diabetes; and sertraline, an antidepressant (beginning in December 1997). The captain told Safety Board investigators that he had been taking the nifedipine and glyburide for years (the Board was able to document use since December 1996) and was not suffering from any side effects. The captain’s blood pressure in February 1998 was 150/90, and his estimated average blood glucose in August 1998 (after the accident) was 227. The captain did not mention use of sertraline, which was discovered by Safety Board investigators upon review of subpoenaed personal medical records. During postaccident interviews, the captain told Safety Board investigators that he was not a drinker. He told Coast Guard investigators under oath that he did not drink alcohol. As of April 4, 1998, the captain and the pilot had worked about 26 days of a 30-days-on, 30-days-off rotation that began on March 9, 1998. The captain and pilot shared navigation responsibilities for the Anne Holly on a 6-hour alternating watch schedule, which is commonly used in the UMR towboat industry. The captain’s watch times, by agreement with the pilot, were about 0500 to 1100 and 1700 to 2300. The captain said he generally slept 4 to 5 hours per off-duty period, when not in the pilothouse, and he felt that this sleep schedule was adequate for him. He chose to use some of his off-watch time to eat, see to his personal hygiene, and relax. The captain testified that on April 4 he was relieved at 1115 from his morning watch (which began that day at 0500). He then went below, ate lunch, and went to bed. He said that he slept 3 1/2 to 3 3/4 hours, got up, and took a shower. After showering, he went down to the galley, visited, drank coffee, and ate supper. The captain said that he relieved the watch in the pilothouse about 1705. When Safety Board investigators asked him what he thought would make transiting St. Louis Harbor safer under high-water conditions, the captain replied, “I’d like for them to put a restriction on these bridges northbound as well as southbound…. It would be a lot safer if everybody could run in the daylight.” He also stated: Daytime you can see up above. You can tell about how your set is. At nighttime, you can’t tell that. You go by feel, you go by experience, you know. You know what this stage of river was last year, 30 foot on the gage, you know. You held up this much from the bridge. But daytime, you can see all this as well as your experience, and that’s the same reason they have it, you know, southbound at night for 25 foot.

Factual Information 17 Marine Accident Report The captain testified: The biggest difference in daytime you can see your current, you can see your setting. At nighttime the only thing you have to rely on is your radar and your searchlight. Which the radar doesn’t pick up current. It doesn’t pick it up, and your searchlight you can’t see it… . But on the Eads Bridge in particular you have no way of, you know, other than common knowledge, of what the current is going to do. President Casino on the Admiral At the time of the accident, the Admiral had a staff of about 250 people on board, serving in the security, casino or gaming, food service, and maintenance departments. About 15 people were on the security staff. None of the Admiral staff members were required to have Coast Guard marine licenses. The Admiral normally employed about 900 people (three daily 8-hour shifts of about 250 to 300 people per shift). The Admiral was open to patrons 22 hours a day. The facility had a 10- to 20-percent turnover in personnel each month. Company management told the Safety Board that more than 250 of the Admiral’s staff members were original employees who had been with the casino since it began gaming operations in 1994. Vessel Information Anne Holly Tow and Barges The Anne Holly, O.N. 553021, was an uninspected, diesel-driven, push-type river towboat built on January 1, 1973, at the Mississippi Marine Corporation, Greenville, Mississippi. For the next 20 years, the vessel had various owners and was used as a towing vessel on the Mississippi River. On October 6, 1989, AM’s parent company (the American Milling Company) purchased the vessel from River Carriers, Inc. The Anne Holly was equipped with two 645 EMD–E7 propulsion diesel engines at 2,800 horsepower (hp) each, driving two propellers through reduction gear drives. The Anne Holly was equipped with navigation and communication devices, including radar, radiotelephone equipment, and searchlights. The vessel had pilothouse control of engines and rudders, and was equipped with twin propellers, twin rudders, and flanking or backing rudders.23 The Anne Holly’s operator directed the towboat by manipulating two parallel, horizontally arranged, 3-foot-long metal rudder control handles that were in the control console in the forward center of the pilothouse. The operator stood between the two handles and shifted them from side to side as needed to control the rudders. The radar 23 A set of rudders forward of the propellers, designed to assist in controlling the towboat’s movement at very low speeds, particularly when backing down.

Factual Information 18 Marine Accident Report console was to the operator’s right as he stood his watch at the control console. (See figure 7 for the Anne Holly pilothouse interior.) The Anne Holly’s principal characteristics were: Length 154 feet Beam 40 feet Depth 9.3 feet Draft 8.8 feet Gross tonnage 1,099 Hp 5,600 Air draft24 46 feet (approximate) The 14 barges in the Anne Holly’s tow were of double-hull construction. Their cargo areas were surrounded on both sides, on the bottom, and at each end by void spaces to protect the cargo and limit flooding in case of outer hull damage. Because these were dry cargo barges and operated solely on U.S. inland waters, they were not required to be inspected by the Coast Guard. (Appendix C shows the characteristics of each barge.) Figure 7. Anne Holly pilothouse interior 24 Distance from the vessel’s waterline to the highest point on the vessel.

Factual Information 19 Marine Accident Report President Casino on the Admiral History. The Admiral was built in 1907 as a side-paddlewheeled steam-driven railroad transfer and passenger ferry. At that time, it was called the Albatross. In 1926, the vessel was lengthened by 50 feet. About 1939, it was bought by Streckfus Steamers, Inc., which converted it into an excursion passenger vessel in St. Louis Harbor and renamed it the Admiral. About 1973, the steam-powered paddlewheels were replaced by three diesel engines with outboard propellers, one in place of each paddlewheel and one on the stern. The Admiral continued to operate as an excursion passenger vessel in St. Louis Harbor until 1978, when it was taken out of excursion passenger service and sold. Between 1978 and 1983, the vessel was moved from St. Louis and its engines were removed. The Admiral’s entry barge, however, remained permanently moored at mile 179.9 UMR throughout this period.25 In 1983, the Admiral returned to mile 179.9 UMR in St. Louis Harbor and became a permanently moored vessel (PMV) with its barge at that location. The Coast Guard classifies the Admiral as a permanently moored shoreside structure or floating building, not an inspected passenger vessel. As a building, it must meet the regulatory requirements of the local authority, in this case, the city of St. Louis. The Coast Guard no longer inspects the Admiral, issues it certificates of inspection, or requires drills of any kind to be conducted on it. A city of St. Louis occupancy permit allowed the Admiral to carry 5,625 people. Structure. At the time of the accident, the Admiral was secured26 to a boarding or entry barge that was also a permanently moored facility. The entry barge had three gangways that led to shore. The north and south gangways, each of which was 12 feet wide and 125 feet long, were used to embark and disembark casino employees and to load supplies. The center gangway, 20 feet wide and 135 feet long, was covered by an awning 9 feet, 6 inches, high. The center gangway was designed for two-way patron traffic on and off the vessel via the entry barge. Due to changing river levels, the center gangway sometimes became so steep that wheelchairs were kept at hand to assist elderly and disabled patrons on and off the vessel.27 (See figure 8 for a photograph of the center gangway of the Admiral.) At the time of the accident, the vessel and the entry barge were secured by 10 mooring wires (or combinations of wires and chains). The 10 lines comprised the bow and stern anchor wires (attached to the entry barge) and 8 lines secured to the shore. The 25 This was not the entry barge in place at the time of the April 4, 1998, accident. The barge had been replaced in the mid-1980s. 26 The Admiral was secured to the entry barge by four universal couplings in addition to wires that held the vessels together. Each coupling was welded to the hulls of both vessels and allowed for limited movement to accommodate differences in vessel drafts as patrons moved from the entry barge to the Admiral and vice versa, as well as other small differences in vessel movements. 27 According to Admiral management, many of the vessel’s patrons are elderly, rely on walkers, have breathing problems, have had recent surgery, or have some other physical condition hampering their ability to move up and down the gangway.

Factual Information 20 Marine Accident Report mooring wires for the Admiral and the entry barge were routinely adjusted as the facility was moved toward (during high water) and away from (during low water) shore. President Casinos informed the Safety Board through a January 25, 1999, letter that: The authorized mooring arrangement, including location and size of mooring wires, was designed by P.H. Weis and Associates, Professional Engineers. The moorings are designed using conventional design and analysis methods with loads determined using recognized codes, such as the Uniform Building Code and the American Association of State Highway and Transportation Officials. The mooring lines are sized for various combinations for all forces acting on the Admiral and Support Barges, such as wind and stream flow. (See appendix D for additional information about the mooring wires.) The Ameren-Union Electric Company and the Laclede Gas Company supplied electricity and natural gas, respectively, to the vessel through individual lines that came from shore along the gangways. The natural gas was transported from the 12-inch main line beneath L.K. Sullivan Boulevard to the Admiral via a 4-inch line leading to a concrete regulator pit on the boulevard’s eastern sidewalk. The opening to the pit, covered by steel plates, was at sidewalk level. A 2-inch service line that extended from the regulator pit to the Admiral was installed in April 1986. The service line, which ran from the regulator pit and emerged into a shallow concrete trough (about 12 inches wide and 6 inches deep) led to a quick-disconnect fitting. The quick-disconnect fitting was 35 to 50 feet from the Figure 8. Center (passenger) gangway to the Admiral

Factual Information 21 Marine Accident Report street. A steel grating also protected that portion of the concrete trough housing the service line in the street before the line emerged and was attached to the Admiral’s gangway. The Admiral’s principal characteristics were: Length 380.0 feet Beam 89.5 feet Depth 7.6 feet Draft 6.0 feet (estimated) Gross tonnage 1,599 Hp N/A Air draft 62.5 feet (estimated) The entry barge’s principal characteristics were: Length 265.0 feet Beam 60.5 feet Depth 6.6 feet (estimated) Draft 5.0 feet (estimated) Gross tonnage N/A Hp N/A Waterway Information Conditions, Traffic, and Accident History Conditions. According to the U.S. Army Corps of Engineers (USACE), St. Louis District, the river stage at mile 179.6 UMR on the Missouri side of the river was 31.6 feet on the St. Louis gage at 2000 on April 4, 1998. Flood stage is 30.0 feet in St. Louis. USACE does not designate an official “high-water” level for St. Louis Harbor, but the region’s operators generally consider high water to be about 20 feet or more on the St. Louis gage. From 1987 through 1997, St. Louis averaged 22.8 days per year (6.2 percent) with the river stage at 30 feet or more and 69 days (18.9 percent) at 20 feet or more. USACE estimated the current at the time of the Anne Holly’s allision28 with the Eads Bridge to be about 6 mph. USACE obtained river stage information from an automatic stage gage on the Eads Bridge (which records river stage every hour) and a flow gage on Poplar Street Bridge. The chief of the potamology29 section of the St. Louis District USACE indicated 28 An allision is the striking of an object that is stationary (such as a bridge or moored vessel) by a moving vessel. 29 Potamology is the study of rivers.

Factual Information 22 Marine Accident Report that from 0100 through 2400 on April 4, 1998, the river was rising and the river stage increased from 30.7 to 31.6 feet, while the flow increased from 515,000 to 538,000 cubic feet per second. Between 1900 and 2000, the river stage rose from 31.4 to 31.6 feet. During this same period, the flow increased from 533,000 to 536,000 cubic feet per second. During his testimony, the USACE chief of potamology stated that the river’s rise in St. Louis Harbor on April 4, 1998, could be characterized as “gradual.” When he was asked if there had been “any unusual precipitation or additions to the base flow rate upstream of the St. Louis Harbor that could have resulted in an unexpected ‘wall of water’ between the Martin Luther King, Jr., and the Eads Bridges,” the USACE representative’s reply was negative. He said that if there had been a “wall of water” coming down the river, it would have appeared in the data, and the data did not reveal such a phenomenon. According to records kept by USACE, from 1970 to mid-1997, minimum water temperatures in St. Louis Harbor occurred from December to February and ranged from 32° to 36° F. The average annual water temperature was about 56° F. On April 4, 1998, the water temperature was about 53° F. Traffic. According to an estimate made by the lock keeper at lock 27, mile 185.5 UMR, which is the first lock northbound above St. Louis, about 8,000 tows pass through the harbor each year, transporting 80,000 to 85,000 barges. The USACE records from lock 27 show that from April 6 to April 30, 1998, 27 tows of a size or tonnage similar to that of the Anne Holly successfully made upbound trips in darkness through St. Louis Harbor. Of the 27 upbound tow transits: • 9 were made at river stages between 32.0 and 30.8 feet; • 5 were made at river stages between 29.9 and 28.5 feet; and • 13 were made at river stages between 27.8 and 25.5 feet. On the morning of April 4, 1998, one tow of comparable size to the Anne Holly transited upbound through the harbor. (The tow had 16 barges, 16,500 short tons30 of cargo, and 4,300 hp.) No problems were reported with the transit. No other upbound transits of similar tows were recorded that day by USACE. After the Anne Holly accident, no other upbound tows transited the harbor in darkness on the night of April 4 through 5, 1998. The river was closed to traffic from about 2014 on April 4 until 0930 on April 5, 1998. According to USACE “Waterborne Commerce of the United States” statistics for 1998, the metropolitan St. Louis area (mile 138 to 208 UMR) had a 21.9 percent increase in total tonnage from 1989 through 1998. In 1998, the total tonnage was 31.758 million short tons, of which about 5.710 million short tons (18 percent) were petroleum or hazardous materials. 30 A short ton is 2,000 pounds.

Factual Information 23 Marine Accident Report Accident History. According to Coast Guard data, from January 1, 1989, through June 30, 1999, a total of 18 accidents (1.6 per year) classified as casualties31 took place in St. Louis Harbor. Twelve accidents occurred when the river was in high-water stage (20 feet or higher on the St. Louis gage). Of the 18 accidents, 12 were allisions and occurred in high water, 2 were collisions, 2 were of unknown cause, and 2 were groundings in low water when the gage read 2 feet. During this 11-year period, 29 breakaway accidents occurred (2.6 per year). Of the 29 breakaways, 4 took place above the location of the Admiral. Three of these four breakaways occurred at river stages between 10.2 and 13 feet on the gage. The fourth took place when a moored tow was dragged in ice at a river stage of -5 feet.32 The 25 breakaways occurring below the location of the Admiral affected fleeting areas but no publicly accessed PMVs. Of the 25 breakaways, 10 occurred in high-water river stages. Of the 10 high-water breakaways, 1 was considered a case of sabotage, and 1 was caused by vandalism. In 1993, four breakaways took place, three of which occurred during river stages of 35, 43, and 49 feet on the gage (respectively, 5, 8, and 19 feet above flood level in St. Louis Harbor). The breakaway that occurred at 49 feet on the gage occurred at mile 179.8, or 0.1 mile below the Admiral. Bridges Four fixed-span bridges are within the recreational and tourist area of the St. Louis waterfront. They are: Douglas MacArthur Highway and Railroad Bridge mile 179.0 UMR Poplar Street Highway Bridge mile 179.2 UMR Eads Highway and Railroad Bridge mile 180.0 UMR Martin Luther King, Jr., Memorial (MLK) Highway Bridge mile 180.2 UMR The Poplar Street Bridge is on the interstate highway system and is a principal vehicular roadway between St. Louis, Missouri, and East St. Louis, Illinois. On its lower level, the Eads Bridge supports a tramway that operates between St. Louis, Missouri, and East St. Louis, Illinois. The upper-level highway portion of the bridge is in disrepair and is not used for vehicular traffic. The Eads Bridge bears fixed markers that indicate to mariners the center of the arched span (a green square dayboard for daylight and a green light for darkness) and the two low points on either side of the span (red triangular dayboards) to be cleared. Between the Poplar Street and Eads Bridges on the Missouri side of the river are, in addition to the Admiral, the Gateway Riverboat Cruises permanent floating barge, the 31 The Coast Guard considers a marine casualty to be an accident that results in damage in excess of $25,000. (46 CFR 4.05-1) 32 According to the USACE in St. Louis, zero gage means that the river channel has about 12.5 feet of water in it. At -5 feet on the gage, St. Louis Harbor would have a water depth of about 7.5 feet.

Factual Information 24 Marine Accident Report permanently moored Robert E. Lee restaurant (not operating), and a permanently moored McDonald’s restaurant (permitted to hold 400 people). On the Illinois side between the two bridges are a permanent floating mooring for the Casino Queen (a casino vessel that gets underway periodically and is certified to carry 3,000 people) and, south of this vessel, fixed mooring cells for grain and coal facilities. Below the Poplar Street Bridge, on both sides of the river, are barge terminals, fleeting areas, and other industrial facilities. (See figure 9.) Except for the MLK Bridge, the main navigation spans for all four bridges are centered at mid-river.33 Information on the widths and vertical clearances of the various bridges appears in table 3. All the bridges except the Eads Bridge provided a vertical clearance under all spans of at least 61.1 feet at the time of the accident. The Eads Bridge’s symmetrical main navigation arch provided 57 feet of vertical clearance at the center; this clearance tapered Figure 9. Schematic view of the accident area 33 The left descending pier of the MLK Bridge center span is almost in line with the left descending pier of the Eads Bridge’s center span. The right descending pier of the MLK Bridge center span is near the Missouri shore, almost in line with the right descending pier of the Eads Bridge’s Missouri span.

Factual Information 25 Marine Accident Report down proportionately on each side of the arch. The bridge’s red day markers were each 150 feet from the center of the bridge, leaving a horizontal space of 300 feet between them. At the time of the accident, 42.2 feet was between each marker and the river surface. Given its air draft, the Anne Holly required a minimum of 46 feet of vertical clearance. The flood conditions reduced the vertical clearance under the side portions of the Eads Bridge main arch so that a center navigation area of about 270 feet had 46 feet or more of vertical clearance. (See figure 10.) Upbound Transit of the Eads Bridge For an operator conducting an upbound transit of the Eads Bridge, lighting sources in the area immediately preceding the bridge included rotating colored lights from the Table 3. Bridge widths (by span) and vertical clearances, in feet Bridge Missouri Span Center Span Illinois Span Vertical Clearance* MacArthur 645 647 645 71.9 Poplar Street 480 580 480** 61.1 Eads 498 517 498 57.0 MLK 450*** 940 450 64.8

• At 31.6 feet gage in St. Louis.

** Mooring cells riverside of the Illinois pier reduce this navigable width to about 420 feet. These cells were in place before the bridge was constructed. *** Not navigable. Figure 10. Schematic view of the Anne Holly tow under the Eads Bridge. (This figure is not representative of the actual path taken by the Anne Holly. The figure is used for illus- trative purposes only, to show the heights of the bridge and the Anne Holly.)

Factual Information 26 Marine Accident Report Casino Queen (moored on the Illinois shore opposite the Admiral), street lighting, and traffic headlights from cars on the St. Louis side of the river. The Admiral had a string of lights around its top deck and lighted letters spelling “Admiral” on the top deck. During the Safety Board’s public hearing on the Admiral accident, a towboat captain who testified as an expert in towing operations in St. Louis Harbor stated: Let’s take St. Louis Harbor here, for instance, at nighttime, when you are coming southbound through the bridges and the Casino Queen is lit up with all its high- intensity lights and different colors, it really distracts—first of all, it impedes your night vision… . North of the MLK Bridge, the current flows approximately parallel to the riverbanks. Between the MLK and Eads Bridges, the current flows toward the Illinois side at various angles. According to one experienced towboat operator, to complete a transit of the Eads Bridge, the operator of an upbound tow follows the procedure outlined below: • The operator may use radar to identify riverbanks and other objects in or near the waterway, such as bridges, other vessels, piers, etc., in darkness and in restricted visibility. Use of the radar can help the operator to orient the tow with respect to fixed objects and, if need be, to compare the radar image to river charts. • To begin the transit, the operator approaches the bridge with the tow to the left (Missouri side) of the river centerline and with the tow’s head aimed at the Illinois (right side) bridge pier of the center span. During the approach, the tow is held at a slight angle to the axis of the river, so that the stern of the tow is angled slightly toward the Missouri side of the river. In this position, the tow presents its port side to the current. • On nearing the Eads Bridge opening, the operator applies left rudder to turn the tow to the left so that it will head directly into the current and line up for passage through the center bridge opening. • Once the tow is aligned for passage and heading directly into the current, the operator pushes the tow into the bridge opening. • When the tow and towboat are almost through the Eads Bridge center span, the operator turns the tow slightly to the right for passage through the MLK Bridge. St. Louis Harbor Tow Restrictions The MSO St. Louis tow restrictions for the high-water river stage of 25 feet or more are based on a power and tonnage formula. The local marine industry, the Coast Guard, and USACE cooperatively developed the formula, using their experience in this area. Upbound (against the current) and downbound (with the current) towboats are

Factual Information 27 Marine Accident Report required to have a minimum of 250 hp per 1,500 tons of cargo. During high water of 25 feet or more, downbound tows longer than 600 feet are restricted to daylight operation. MSO St. Louis advised the Safety Board in June 2000 that, since late 1998, during flood stages of 30 feet or more, “All line boat traffic [is] limited to daylight transit only with the exception of northbound tows with helper boats.” (A line boat is a relatively large towboat that pushes large tows over long distances, as opposed to a harbor or fleet boat that moves one or two barges at a time in a local area.) Operations Information American Milling, L.P. AM is a small towboat business that operates nine towboats on the inland waterways. The company contracts for additional boats and operators as its workload requires. AM is not a member of the American Waterways Operators (AWO), the inland towing industry’s primary trade association. (The AWO is a national trade association for the inland and coastal barge and towing industry. About 375 companies are AWO members; of these, about 200 are tug/towboat companies. AWO members account for about 85 percent of the tonnage that moves on U.S. waterways.) AM policy is that the captain is responsible for crew welfare and all operational obligations associated with running the towboat. In addition, the captain is responsible for the tow configuration and the security and fastness of the tow’s barges. At fleet operations, the captain determines the arrangement of the barges in the tow and whether he can safely move the tow as configured. The captain is responsible for ensuring that logbooks are properly maintained and that associated paperwork is completed. (The captain can perform some or all of these duties while on watch.) The company provides no safety guidance to its operators concerning high-water operations, night operations, use of helper boats, required equipment, or halting operations when safety concerns may warrant such action. AM does not have written procedures on how to identify or respond to potential emergency shipboard situations, such as an allision and loss of tow. AM does not have written policies or procedures to ensure that its towboats and equipment are adequately maintained and appropriate for their assigned tasks. AM does not designate anyone on shore to assist the captain to make decisions concerning the safety of navigation. The company relies on its towboat operators to use their own skill and experience and maintains that the captain is responsible for all aspects of the towing operation. When investigators asked the Anne Holly captain whether the company responded unfavorably to a captain’s decision to make changes to the company-assigned schedule or load for safety reasons, the Anne Holly captain replied, “Only if you do it all the time… .” AM provides no training to its crewmembers, nor does Winterville Marine.

Factual Information 28 Marine Accident Report The following is a brief description of the duties of the captain and pilot during a routine day while working the Anne Holly for AM. The captain and pilot would each stand two watches a day. The watch times might be varied by the captain (with agreement by the pilot), but the schedule followed would be 6 hours off watch succeeded by 6 hours on watch. During the watch, any navigation or maneuvering of the vessel or tow would be the responsibility of the person on watch (the captain or the pilot). On watch, the pilot would handle all operational and administrative matters arising, in the same manner that the captain would. If a problem that the pilot could not or desired not to handle arose, he could call the captain. Generally, the captain would fulfill his administrative duties, such as ordering food, fuel, or other supplies, while on watch. The captain would typically take care of personnel administration or engineering matters while on-watch, but, if necessary, he could deal with them while off-watch. Such off-watch work, however, would not occur on a routine basis. The captain, after being relieved by the pilot about 2330, would go to bed and sleep for about 5 hours before being awakened to have breakfast before going on watch at about 0530. After being relieved about 6 hours later, the captain would, about 1130, eat lunch, watch TV, talk, read, do laundry, or carry out other personal tasks. He might also make a round of the boat or check the tow before going to bed. He generally would get 3 to 4 hours sleep before being called to prepare for the evening watch. He might take a shower and eat dinner before going on watch about 1730. The pilot would usually follow a similar routine on his off-watch periods. President Casinos The Admiral is owned by President Riverboat Casino-Missouri, Inc., which also owns and operates the Becky Thatcher and the Tom Sawyer excursion vessels, through Gateway Riverboat Cruises. President Riverboat Casino-Missouri, Inc., is owned by President Casinos, Inc., which is a Passenger Vessel Association (PVA)34 member. Admiral engineering personnel were responsible for vessel operations, including managing the mooring and utility lines between the vessel and shore and ensuring the hull’s integrity. Security personnel were responsible for safety on the vessel. They were not trained in crowd management techniques. None of the security or engineering personnel were required to be licensed or to have any other formal certification of competency. 34 The PVA is a trade organization that focuses on the U.S. domestic passenger vessel industry. PVA membership represents about 65 percent of the industry owner-operators nationwide, comprising more than 1,100 vessels, which carry approximately 85 million passengers annually.

Factual Information 29 Marine Accident Report Meteorological Information At the time of the accident, the weather was clear, with visibility of at least 2 miles in darkness. The wind was from the southwest at 5 mph. The air temperature was 42° F. Toxicological Information About 3 1/2 hours after the accident, when the evacuation of the Admiral was almost complete, the St. Louis Police Department, at the request of the Coast Guard, administered a breathalyzer alcohol test to the Anne Holly captain. (The Anne Holly captain was engaged in the emergency response for the Admiral until this time.) Test results were negative. Immediately following the breathalyzer test, the captain gave a videotaped sworn interview to the Coast Guard in which he stated that he did not drink alcohol. Safety Board investigators reviewed the videotape and found no apparent evidence of impairment, such as slurred speech, in the captain’s behavior. According to 46 CFR 4.06–1, “Responsibilities of the marine employer,” a marine employer must establish and maintain procedures to conduct drug and alcohol testing in the event that one of its crews is involved in an accident. According to 46 CFR 4.06–20, “Specimen collection requirements,” a marine employer must ensure that specimens required are collected “as soon as practicable” following the occurrence of a serious marine incident. AM defers all personnel matters to Winterville Marine. After being notified of the accident by AM, Winterville Marine arranged for medical technicians from West Kentucky Drug and Alcohol Screen Specialists of Paducah, Kentucky, to board the Anne Holly in St. Louis Harbor at 1620 on April 5, 1998, to conduct crew breath tests for alcohol. They also collected urine for drug testing. The specimens were tested at Lab One in Overland Park, Kansas. Negative results were reported by Medical Review Services, Inc., of Belle Chase, Louisiana, serving as the medical review officer for Winterville Marine. Emergency Preparedness President Casinos The company provided the Safety Board with a copy of its Emergency Evacuation Procedures for the Admiral, dated February 21, 1997. The procedures specified that Admiral security personnel are responsible for ensuring that patrons leave the facility in an emergency. The document essentially stated that staff should conduct the evacuation by directing patrons and employees to the nearest exit and assembling them at a prearranged staging area on shore. The procedures did not include specific duties for managing patrons and employees. Most of the staff members were instructed to assist patrons as they themselves were exiting the vessel. The procedures did not indicate how assistance was to be provided. All evacuation procedures presupposed that those on the vessel would

Factual Information 30 Marine Accident Report proceed to shore via the standard entry barge gangways. The Admiral staff members had not received crowd management training before the accident, and they were not required to take such training. The Admiral management considered its security force to have primary responsibility for patron safety during an emergency. President Casinos, Inc., had developed a St. Louis Emergency Plan, dated January 1994. The stated purpose of the plan was to: Minimize the effects of a major emergency or disaster by prompt treatment of injuries, prevention of additional injuries, reduction in property damage, and provision for continuity and expeditious resumption of operations. President Casinos, Inc., designed the plan to activate whenever a situation occurred that “threatens the well-being of more than a few people at any of the [company’s] St. Louis-based facilities.” (The plan’s scope included the corporate headquarters building, the Admiral, the two Gateway Riverboat Cruises vessels, and the Robert E. Lee floating restaurant.) The emergencies specifically cited in the plan were air or water pollution incident, civil disorder or riot, earthquake, explosion, fire, flood, tornado, and utility failure. Each company facility had a designated Emergency Response Team (ERT). The chain of command and responsibilities for the Admiral’s ERT were dependent on the time the event occurred and the availability of personnel. According to President Casinos, the assigned duties and responsibilities of the Admiral personnel were as follows: General manager: Responsible for directing emergency operations on site. Is also in charge of the ERT and other duties and responsibilities that include: contacting members of senior management and outside authorities as necessary, overseeing rescue operations, and directing the return of facilities to normal operations. Director of security: Responsible for alerting Federal, State, and local agencies for assistance; controlling the flow of foot and vehicle traffic to and from the Admiral; securing and policing the damaged areas and facilities; and controlling the evacuation and movement of patrons and employees to a safe area. When the director of security is not on board, the senior security supervisor assumes these duties. Director of casino operations: Responsible for coordinating casino operations and activities, including securing all gaming equipment, rendering aid to the injured, and assisting all other departments in dealing with patrons and employees on an as-needed basis. Director of surveillance: Responsible for monitoring and videotaping all areas of the casino. Director of marine operations: Responsible for all marine operations for the company’s vessels (Admiral, Robert E. Lee, Becky Thatcher, and Tom Sawyer).

Factual Information 31 Marine Accident Report MSO St. Louis According to its 1997 annual report, MSO St. Louis has a complement of about 30 people attached to it. The office has one small harbor patrol boat that can be used to assist in local search and rescue activities in St. Louis Harbor. The geographic area of responsibility for this office includes all or parts of 12 States and more than 2,000 miles of navigable waterways. In covering this area, MSO St. Louis is assisted by its Marine Safety Detachments in St. Paul, Minnesota, and Quad Cities, Illinois. Together, these two detachments have about 40 employees. St. Louis Harbor Emergency Response Plan MSO St. Louis had a St. Louis Harbor Emergency Response Plan, most recently issued in October 1996. The plan covered the area between miles 160.7 and 195.0 UMR. The St. Louis COTP developed the plan with the cooperation of St. Louis Harbor area fire departments, river industry representatives, and local law enforcement agencies. The plan stated that it was intended to facilitate: Effective marine emergency response operations through the establishment of mutually agreed upon operating guidelines and the compilation of pertinent reference materials needed during response operations. The St. Louis Harbor Emergency Response Plan specifically stated “the COTP does not have firefighting or search and rescue capabilities… .” [Emphasis appears in original.] The plan also stated that the St. Louis COTP would monitor all emergencies and dispatch a Coast Guard representative to the incident’s command post to coordinate Federal and local response activities. It made Coast Guard Group UMR, in Keokuk, Iowa, responsible for notifying the appropriate COTP and local fire department of a marine or shoreside emergency. The St. Louis Harbor Emergency Response Plan specified that firefighting and search and rescue operations fell under the jurisdiction of local and State fire and rescue services. The plan called for the senior fire department official on scene to become incident commander for riverfront emergencies within the department’s jurisdiction. A unified command system, consisting of the fire chief (incident commander), the owner of the facility involved, and the COTP representative, was to be established at the incident command post. The St. Louis Harbor Emergency Response Plan also identified the agencies that would participate in the response to marine emergencies in St. Louis Harbor and listed the names and telephone numbers of critical responders. The plan identified the interagency command and control responsibilities of the various agencies and designated the radio frequencies to be used during the response.

Factual Information 32 Marine Accident Report Survival Aspects Admiral patrons indicated that they experienced some panic and confusion during the emergency. Some stated that the initial impact of the barges caused them to fall against slot machines and to the floor. No patrons entered the water due to the barge strikes. Several patrons commented on minor injuries they had sustained because of the press of other patrons attempting to exit. They also recalled concerns about the smell of natural gas and the fact that patrons were allowed to continue smoking. They indicated that the large numbers of people attempting to push through the single exit leading to the Anne Holly caused some discomfort. Several also stated that some patrons were disorderly. Drills The Fire Prevention Code of the city of St. Louis required fire drills to be held at least every 90 days in accordance with evacuation plans. Fire drills were not required to be documented on the Admiral. According to an SLFD official, fire department personnel visited the Admiral annually to conduct fire code inspections and to familiarize firefighters with the Admiral’s layout. President Casinos made conducting fire drills aboard the Admiral the responsibility of the facility’s security staff. Security personnel were also responsible for securing cash and chips in the casino in an emergency. Fire drills on the Admiral were conducted similarly to fire drills from a building and included the sounding of on-board alarms and exiting of occupants. The Admiral had last conducted an on-board fire drill at 0700 on June 9, 1997. The fire drill involved those employees normally on the vessel at that time. According to the Admiral’s chief security supervisor, two power outages had taken place on the vessel between January 1994 and the day of the allision. The last outage had occurred in December 1996. To deal with these power problems, the Admiral established a power outage procedures review program. The purpose of the reviews was to establish means to stop casino operations and evacuate patrons from the vessel in an expeditious and organized manner. Vessel personnel conducted reviews (question and answer sessions) to ensure that employees understood their individual duties in a power outage. The Admiral’s security manual detailed the procedures and each employee’s duties and responsibilities. Each Admiral employee had to sign a statement verifying that he or she had read the security manual. Communications With Emergency Responders. Admiral security personnel had walkie-talkies by which they could communicate with each other. On the accident night, when the shore lines’ breaking interrupted the hard-wire telephone service, the Admiral staff did not establish direct communications with shoreside responders until SLFD personnel came on board.

Factual Information 33 Marine Accident Report With Patrons. Before the accident, no Admiral staff member issued any statement or warning to patrons of the impending allision. After the impact, some Admiral staff members gave patrons oral instructions. The instructions were not consistent or coordinated. The Admiral had a public address system capable of transmitting messages throughout the vessel. The company had no formal policies governing the use of the public address system in an emergency. Three telephones on the vessel could operate the public address system. One telephone was on either side of the center gangway. The third telephone was at the Captain’s Club, on the vessel’s “B” deck (port side) near the top of the escalators. Captain’s Club personnel carried out various administrative tasks (selling tickets, voiding passes, stamping parking vouchers, and handling food and beverage charges). They also made announcements concerning lost and found items. On the night of the accident, Admiral staff did not initially use the public address system because they believed it was inoperable. According to the Admiral’s senior shift manager, he used the public address system to make several announcements to patrons and staff after he had returned to the vessel via the Becky Thatcher (around 2145). He recalled that he told patrons that “the vessel was not taking on water… [it] was being held in place by a tugboat.” He said he also told them that everything was fine and that, because of the size of the Becky Thatcher and the Tom Sawyer, only 300 patrons could be disembarked at a time. He said he told them that fire and rescue personnel had arrived and that patrons with medical problems should go to the gift shop (on the “A” deck) for treatment. Patron Questionnaires Following the accident, the Safety Board sent 251 questionnaires to Admiral patrons.35 Among other inquiries, the questionnaires asked patrons to characterize the amount, type, and usefulness of information they received from the Admiral’s staff during the emergency. The Board received 74 responses. Asked whether they had received information about the nature of the emergency, 38 respondents stated that they received no useful information from the Admiral’s staff about the emergency’s nature. Four of the 74 respondents said that they first learned of the nature of the emergency more than an hour after the accident occurred. Forty-five respondents reported that the oral instructions they received from the staff about the need to evacuate and the procedures for doing so were either nonexistent or of little use. One respondent stated that the vessel staff made no effort to calm the crowd, and she observed that some staff members rushed to get off the vessel before patrons. Another stated that the staff “appeared to be just as confused as we were.” One respondent stated 35 President Casinos does not maintain patron lists. To obtain names and addresses of patrons on board the Admiral on the night of the accident, the Safety Board requested assistance from President Casinos. President Casinos provided the Safety Board with a list of patrons who had made claims concerning the accident against President Riverboat Casino-Missouri, Inc. The Safety Board sent its questionnaires to these patrons. The information from the questionnaires used in this report is not intended to represent a statistical sample of passengers’ experiences; instead, it served as a preliminary indicator of areas to be pursued in the investigation.

Factual Information 34 Marine Accident Report that, during the emergency, one of the vessel cashiers ran by yelling, “Get off this boat, it’s sinking.” Safety Equipment Coast Guard regulations at 46 CFR Parts 70 through 78 require inspected passenger vessels to carry life preservers and survival craft (lifeboats, life rafts, buoyant apparatus, life floats, etc.). The Coast Guard does not extend lifesaving equipment requirements to permanently moored public structures like the Admiral, and the Admiral carries no life preservers or survival craft. At the July 23, 1998, Safety Board hearing session on this accident, the former MSO St. Louis COTP stated that, during his 3 years in St. Louis, people who entered the river at St. Louis rarely survived, even if they were wearing lifejackets. He stated, “I would not do anything to encourage people to think that they could jump in the river with a lifejacket on and have a very good chance of surviving.” The Casino Queen, an inspected casino vessel that may carry 2,775 passengers and 225 crewmembers, is moored across from the Admiral along the Illinois bank. The vessel gets underway periodically for gaming and is required to have a life preserver for every person on board. The Coast Guard also requires the vessel to carry life floats or buoyant apparatus or both (for 10 percent of the people carried), ring buoys, and two rescue vessels (one forward and one aft). Inspections and Tests On April 8, 1998, Safety Board investigators rode the Anne Holly northbound from the Eagle fleeting area through St. Louis Harbor and past the Eads Bridge; the vessel had a 15-barge tow (5 barges comprising the port string, 5 the center string, 4 the starboard string, and 1 empty barge on the starboard side by the towboat). During the trip, the river stage was 30.2 feet on the St. Louis gage. The trip was uneventful, and no problems were noted. A Safety Board investigator examined the operation of the Anne Holly’s steering gear, its propulsion engines, and its other engineroom equipment during the test trip. He found no problems. According to the company, no repairs had been made to the steering gear or propulsion engines since the accident. Other Information Permanently Moored Vessels and Structures General. PMVs are used for a wide variety of purposes, including serving as casinos, museums (or other tourist attractions), entertainment facilities, restaurants, or

Factual Information 35 Marine Accident Report mooring barges. Because they frequently involve significant public use, PMVs often have relatively high patron occupancy levels. According to the Coast Guard, 162 PMVs were on U.S. waterways as of November 20, 1998. (See appendix E.) The Coast Guard estimated that about 30 of them were permanently moored gaming vessels in Mississippi and Missouri. In all, these 30 vessels had a carrying capacity of more than 50,000 people. St. Louis Harbor contained five PMVs, the Admiral vessel, the Admiral support barge, the McDonald’s restaurant barge, the Robert E. Lee restaurant barge (not operating), and the Gateway Riverboat Cruises support barge. Coast Guard Authority. The Coast Guard’s authority to regulate the design, construction, equipment, staffing, and inspection of vessels derives from its enabling statute, 46 United States Code (U.S.C.), Subtitle II. With respect to the definition of the term vessel, Section 2101[45] of Subtitle II refers to 1 U.S.C., Chapter 1, Section 3, which states that vessel “includes every description of watercraft or other artificial contrivance used, or capable of being used, as a means of transportation on water.” Section 3301(4) of 46 U.S.C., Subtitle II, states that passenger vessels are among the categories of craft that are subject to Coast Guard inspection. The U.S. Coast Guard Marine Safety Manual (MSM),36 Volume 2, Chapter 10, Section I, states that: a. Introduction. A floating fuel dock, showboat, theater, hotel, restaurant, museum, etc., is not a ‘vessel’ for inspection purposes if it is permanently moored and thus taken out of navigation. In this manner, the entity is ‘substantially a land structure’ and not subject to the [Coast Guard] inspection laws. However, it may be subject to other regulations, such as those promulgated under the Ports and Waterways Safety Act of 1972. The following criteria should be used in determining whether an entity is ‘substantially a land structure.’ (1) It must be securely and substantially moored as approved by the Officer in Charge of Marine Inspection [OCMI]. (2) The mooring must be so rigged that its lines cannot be inadvertently or accidentally cast off, it is unlikely to break away from its mooring, and it cannot be moved away from the mooring without special effort (i.e., the use of tools). (3) Permanent connection to shoreside facilities is evidence of being a ‘land structure.’ The nature and use of the entity may also be considered. The Coast Guard has other responsibilities concerning waterway safety that are not necessarily related to vessel inspection. The Coast Guard has extensive authority under the Ports and Waterways Safety Act of 1972 (PWSA) to act to safeguard navigation and protect waterfront facilities and the marine environment. Under the PWSA, as amended, the Coast Guard: 36 The MSM sets forth Coast Guard policy and guidelines for use by Coast Guard personnel and the marine industry. It explains the Coast Guard’s authority and rationale for various marine safety activities.

Factual Information 36 Marine Accident Report May take such action as is necessary to–(1) prevent damage to, or the destruction of, any bridge or other structure on or in the navigable waters of the United States, or any land structure or shore area immediately adjacent to such waters; and (2) protect the navigable waters and the resources therein from harm resulting from vessel or structure damage, destruction, or loss. Such action may include, but need not be limited to– (A) establishing procedures, measures, and standards for the handling, loading, unloading, storage, stowage, and movement on the structure (including the emergency removal, control, and disposition) of explosives or other dangerous articles and substances, including oil or hazardous material as those terms are defined in section 2101 of title 46; (B) prescribing minimum safety equipment requirements for the structure to assure adequate protection from fire, explosion, natural disaster, and other serious accidents or casualties; (C) establishing water or waterfront safety zones, or other measures for limited, controlled, or conditional access and activity when necessary for the protection of any vessel, structure, waters, or shore area; and (D) establishing procedures for examination to assure compliance with the requirements prescribed under this section. [33 U.S.C. 1225] With respect to the application of the PWSA as it may concern PMVs, the Coast Guard stated, in a February 17, 2000, letter to the Safety Board: The PWSA has generally not been interpreted and applied to expand the Coast Guard’s regulatory authority over construction, manning, equipment or operations on vessels other than tank vessels…. If the issue is how ingress and egress from the PMV is provided in an emergency, the authority is more likely the vessel inspection laws and regulations, as opposed to the PWSA, at least as it has been traditionally applied. This letter further stated that: [T]he broad language of the PWSA can provide additional regulatory authority to address new risks to port safety presented by vessels other than tank vessels, or to facilities in U.S. ports, or protection of the marine environment on the navigable waters of the United States. In fact, the language of the PWSA, authorizing the Secretary to regulate with respect to facilities and vessels in the ports of the U.S., is very broad. (See appendix F for the full text of the Coast Guard’s February 17, 2000, letter.) USACE Authority. USACE is authorized to regulate activities on the Nation’s waters according to 33 CFR Parts 320 through 330, which establish the Department of the Army permit process. USACE permits are required for dams or dikes in U.S. navigable waters and other structures or work, including excavation and dredging or disposal activities (or both), in U.S. navigable waters (33 CFR 320.1[b]). PMVs are considered structures under this definition and are required to have USACE permits. The USACE permit program is not concerned solely with safety; it involves “consideration of the full public interest by balancing the favorable impacts against the detrimental impacts” (33 CFR 320.1[a][1]). Permit review processes do not require that USACE assess the effect on vessel traffic or the risks to public safety posed by the structure. USACE often

Factual Information 37 Marine Accident Report consults with Federal (particularly Coast Guard), State, and local government agencies before issuing a permit; but USACE is not required to conduct such a consultation before it issues a permit. Federal Oversight of the Admiral. In July 1983, the S.S. Admiral Ltd. company applied for a USACE permit to permanently moor a floating showplace family entertainment and dining center at mile 179.9 UMR. In conjunction with the permit application, the company installed “deadmen”37 to secure the floating showplace structures to shore. USACE asked the Coast Guard to review the permit request. In an advisory capacity, the St. Louis COTP conducted the review. In a letter dated September 22, 1983, he stated that “I have no objection to this proposal; however, I would be interested in reviewing any major changes to the plan.” USACE issued the requested permit on October 5, 1983. The showplace operated from March 1987 until summer 1988, when it closed. In 1992, President Casinos purchased the floating showplace structures at mile 179.9 UMR. In 1992, President Casinos applied for a modification to the USACE permit for the Admiral because the entry barge facility was 25 feet wider than the barge cited in the 1983 permit. (The unit extended 25 feet further into the river.)38 USACE requested that the Coast Guard review the permit revision request. After reviewing the public notice of permit, the St. Louis COTP wrote a letter to USACE dated June 22, 1994. The letter included the following statements: A recent towboat casualty in St. Louis Harbor involving the ‘permanently moored’ gaming boat Admiral [39] indicates the vulnerability of that vessel to possible future casualties. The presence of large numbers of patrons raises similar considerations to those discussed during the review of the Casino Queen’s application. In that case, a protection cell was required to deflect and slow down a barge which might otherwise strike the vessel with high and destructive energy. Accordingly, I request a review of the Admiral’s permit to determine if additional conditions are necessary to assure public safety. I have verbally discussed this with [a named individual], the director of marine operations for the parent company, President Casinos. [40] I request that he be included in the review effort. On November 23, 1994, USACE advised President Casinos that it had modified the Admiral’s October 1983 permit to accommodate the existing mooring configuration. 37 Deadmen are mooring anchoring devices sunk into the riverbank from which anchor chains or mooring wires may be attached to a floating structure. 38 The wider entry barge was necessary to comply with shore-to-entry gangway slope boarding requirements in the Americans With Disabilities Act of 1990. 39 Coast Guard St. Louis case MC95005051, allision of the Admiral by the two-barge (empty) tow of the harbor towboat M/V Robert Y. Love on May 5, 1994. 40 The President Casinos representative to whom the Coast Guard officer spoke was actually the director of the subsidiary, President Riverboat Casino-Missouri, Inc., not the parent company, President Casinos, Inc.

Factual Information 38 Marine Accident Report USACE also stated that a USACE district engineer “deemed it necessary that the S.S. Admiral must emplace a protection cell to provide protection from ice flow, debris, and breakaway tows.” President Casinos hired a professional engineering consulting firm to conduct a risk assessment (completed March 9, 1995) concerning drifting vessels affecting the Admiral and the possible location of a protection cell. The consultant reported that breakaway upbound tows had struck the vessel three times while it had been moored in this location.41 The consultant’s report stated that placing a protection cell upstream and to the starboard of the Admiral could redirect loose barges toward the Admiral and was not in the best interests of public safety. President Casinos did not install a protection cell. On July 10, 1995, the St. Louis COTP42 sent a letter to the St. Louis District USACE. A portion of the letter read: This addresses a previous request filed by this office for consideration of a protection/deflection cell upstream of the Admiral Casino on the St. Louis waterfront. Since that request was filed I have had several meetings with representatives of the lease holder, your office, the River Industry Action Committee, and the St. Louis Harbor Association. Casualty scenarios were examined and assessed; protection cells and other measures were discussed; and future move from the site now under review by the port authority is considered likely. [43] I believe the allision risks associated with continued operations at the site are such that a deflection cell would not significantly improve the public’s safety. This conclusion is particularly valid given the probability of a change in the vessel’s location in the near future. Local Requirements. The city of St. Louis owns the waterfront area in St. Louis Harbor where the Admiral is moored; the city leases the area to President Casinos. The city of St. Louis has procedures that its Port Commission and the Board of Public Service must follow when the owners of a structure, like the Admiral, request a lease to moor the structure along city-owned land within the port district. These procedures involve review 41 Coast Guard records provided one instance of the Admiral being struck, by tows from the towboat Robert Y. Love in May 1994. On June 5, 2000, AM representatives provided the Safety Board evidence of other occasions on which the Admiral was struck by tows/barges. AM provided a copy of a February 13, 1995, memo from the Admiral’s (then) director of marine operations to the President Casinos, Inc., engineering consultant. The 1995 memo stated that the Admiral had been struck three times since 1988. The three incidents to which the memo referred were an April 23, 1991, incident involving the towboat Wendy Ann, during which the operator lost tow control while passing through the MLK Bridge and the tow struck the Admiral, a second for which no details were provided, and the Robert Y. Love accident. AM also gave Board staff a copy of a Coast Guard accident investigation report of the “M/V Crescent City allision with the Eads Bridge, Mile 180, Upper Mississippi River on 23 February 1985, with no personnel injuries or loss of life.” The report indicated that breakaway barges from the tow struck the Robert E. Lee, the Admiral, the Golden Rod Showboat, and the St. Louis Visitors Center. 42 The COTP in this case was the same individual who had sent the June 22, 1994, letter. 43 In 1995, interested parties had discussed the possibility of moving the Admiral upstream when it obtained the new permit. No action was taken until after the accident.

Factual Information 39 Marine Accident Report and approval by the Board of Public Service, the port administrator,44 the Department of Public Safety, and other city agencies. If the Board of Public Service ultimately approves the application, it recommends a lease ordinance to the Board of Aldermen. If the Board of Aldermen and the mayor approve the lease ordinance, they make it a lease agreement. President Casinos went through this approval procedure to obtain a lease for the Admiral on the St. Louis waterfront. As substantially land structures or floating buildings, PMVs are subject to local ordinances and building codes. The codes require that the “building” have adequate electrical, mechanical, and plumbing arrangements, as well as appropriate exits, lighting, emergency lighting, power ratings, sprinkler systems, etc., for a facility of its size. The city of St. Louis has adopted the Building Officials and Code Administrators Basic Fire Prevention Code (BOCA Code)45 for its buildings. Through a December 6, 1999, letter, the SLFD deputy chief informed the Safety Board that pertinent provisions of the code had been applied to the Admiral. The Department of Public Safety for the city of St. Louis reviewed the Admiral’s design plans to ensure that the PMV met the applicable building codes for fire safety (according to the BOCA Code), electrical, mechanical, and plumbing requirements. The department also approved the Admiral’s design and evacuation plan for compliance with requirements for emergency exits, emergency lighting, and fire sprinklers, as they would apply to buildings. According to a Department of Public Safety representative, the agency was not required to review the Admiral for marine safety aspects, nor did the city consider the need for lifesaving equipment because such factors are not considered during the approval processes for buildings. Missouri Gaming Commission Requirements. Permanently moored casinos in Missouri must have a license from the Missouri Gaming Commission. In a July 9, 1998, letter to the Safety Board, the Missouri Gaming Commission stated: The Commission’s rules mandate that the licensee meet the minimum standards for safety and environment established by the U.S. Coast Guard, the Army Corps of Engineers, and the Environmental Protection Agency. The Commission’s safety rules require that permanently moored vessels meet: (1) The fire safety standards of the Missouri Law and Rules; (2) The fire safety standards contained in the National Fire Protection Association (NFPA), NFPA Standard 307 Standard for the Construction and Fire Protection of Marine Terminals, Piers, and Wharfs; and (3) The NFPA Life Safety Code. 44 The port administrator is responsible for monitoring any lease and for requesting the assistance of appropriate city agencies when it is necessary to fulfill city ordinances or State or Federal regulations that might apply to the transaction or that might be needed to protect the life, health, or property of citizens or to further the city’s economic development. 45 The BOCA is one of three major national model building code groups that publish a building code. Each code group is a consensus body. There is some uniformity among the model codes, although the groups meet different regional and geographical needs.

Factual Information 40 Marine Accident Report The acting executive director of the Missouri Gaming Commission also informed the Safety Board in the July 1998 letter that: The Commission does not employ safety experts but instead relies on other government agencies with expertise in safety standards and inspections. The Commission required that, before it would license the Admiral, the vessel be inspected by American Bureau of Shipping (ABS) Marine Services, Inc.,46 for stability and integrity. Before it would relicense the Admiral in 1995 and 1997, the Commission required that ABS Marine Services reinspect the vessel to ensure that it continued to be fit to serve as a permanently moored casino in Missouri. Boats in a Moat “Boat in a moat” is a term used to describe a vessel that is restricted from leaving a waterway (lake, pond, or basin) by natural or man-made obstructions. Such a vessel cannot float into a river or be subject to collision or ramming by other vessels. If a boat in a moat breaks away from its mooring for any reason (such as weather), it will not be subject to the dangers of vessel traffic. The moat is generally shallow, so if the vessel should sink, people on board will not be endangered. The Eighth (Gulf Coast and Central Western Rivers District) and Ninth (Great Lakes District) Coast Guard Districts contain 9 and 11 boats in a moat, respectively. Thirteen of these vessels are inspected by the Coast Guard and issued certificates of inspection. State and local authorities regulate the other seven. Four of the 11 boats in a moat in the Ninth District are attempting to give up their Coast Guard certificate status and be regulated by State and local governments. Passenger Vessels in St. Louis Area The St. Louis Harbor area contains four vessels that are inspected by the Coast Guard for compliance with passenger vessel safety requirements. They are the Casino Queen (capacity 3,000), the Tom Sawyer (capacity 375), the Becky Thatcher (capacity 350), and the Alton Belle II (capacity 1,500). Risk Assessment General. “Risk” may be defined as a combination of the probability of an accident occurring together with its consequences.47 “Risk assessment” is an organized and systematic search for high-risk conditions in a system; through this process, the hazards in a system are identified and prioritized. Through risk assessment, risk management 46 ABS Marine Services, Inc., is a for-profit corporation that provides consulting, survey, engineering and training services. It is separate from ABS, Inc., a non-profit vessel classification society. 47 National Transportation Safety Board. Fire Aboard the Tug Scandia and the Subsequent Grounding of the Tug and the Tank Barge North Cape on Moonstone Beach, South Kingston, Rhode Island, January 19,

1. Marine Accident Report NTSB/MAR-98/03. (Washington, DC: National Transportation Safety

Board, 1998).

Factual Information 41 Marine Accident Report strategies can be developed. System stakeholders can then select certain risk management strategies over others, based on the level of risk they are willing to accept.48 The MSM defines the waterway elements to be considered during the risk assessment process as vessel properties, waterway properties, cargo properties, and environmental conditions. Port risk management is the responsibility of the Coast Guard’s Office of Marine Safety and Environmental Protection, which is charged with protecting the public, the environment, and U.S. economic interests by preventing or mitigating the effects of marine accidents and incidents. According to the “Program Principles” section of the Office of Marine Safety and Environmental Protection’s 1996 Performance Report,49 risk management is the “business” of the office. The report states: Preventing low probability-high consequence events, such as major loss of life on passenger vessels, and medium and major oil spills, is a cornerstone of our risk management approach. To improve our decision making, we need to strike a balance, allowing field commanders to employ existing risk analysis tools for routine risk management decisions, while establishing a formal program policy for high level risk analysis projects, such as comprehensive port risk models. According to the operations manager of the St. Louis City Port Authority, neither Federal, State, nor local authorities conducted a formal risk assessment of waterfront operations in St. Louis Harbor. The PVA maintains a Risk Management Manual for Passenger Vessels. The document addresses such topics as providing safety audits, meetings, and announcements; reducing various types of accidents; managing hazardous waste; maintaining logbooks; and conducting fire drills and contingency planning. In 1995, a President Casinos employee drafted the chapter “Emergency Drills and Contingency Planning” that appears in the PVA manual. Using St. Louis Harbor as its model, the chapter discusses developing passenger vessel marine risk contingency plans to address various types of emergencies involving collisions, taking on water, losing propulsion and requiring harbor tug assistance, moving injured people ashore, and transferring firefighters from shore to vessel. Risk Assessment Methods Used by the Coast Guard. Pursuant to the Coast Guard’s 1996 Performance Report objectives of employing risk-based tools for routine field use and port risk management, the Coast Guard contracted with George Washington University to develop a Port and Waterways Risk Assessment Guide.50 The guide was 48 For more information on risk assessment as it applies to marine vessel operations, see National Transportation Safety Board, Allision of the Liberian Freighter Bright Field with the Poydras Street Wharf, Riverwalk Marketplace, and New Orleans Hilton Hotel in New Orleans, Louisiana, December 14, 1996. Marine Accident Report NTSB/MAR-98/01. (Washington, DC: National Transportation Safety Board, 1998). 49 The Coast Guard’s 1996 report on the office’s progress toward goals listed in Commandant Instruction 16000.2 (series), Business Plan for Marine Safety and Environmental Protection. 50 George Washington University. Port and Waterways Risk Assessment Guide. (Washington, DC: George Washington University, 1996).

Factual Information 42 Marine Accident Report published for Coast Guard field personnel to use in evaluating and managing risk in U.S. ports and waterways. Appendix A of the guide contains a 12-step program that provides “a structured format for gathering and analyzing the necessary information and professional knowledge required to evaluate and manage risk in U.S. ports and waterways.” The Coast Guard Proceedings of the Marine Safety Council, July–September 1999, contains several articles about how the Coast Guard is applying risk management approaches similar to those described in the guide. The Proceedings outline how MSO Jacksonville, Florida, has developed vessel risk measures for the different types of vessels (deep-draft, fishing, towing, and passenger) operating in its port. MSO Jacksonville has also developed facility risk measures to manage the risk of oil spills at cargo oil transfer facilities in its port, as well as a port activity risk measure that gauges the relative risk levels for waterway segments according to each segment’s traffic density, geographic features, importance, other unique factors, and high-risk activities such as dredging, bridgework, etc. The risk profile for the port is updated and monitored weekly, allowing the COTP to target risk management resources optimally. The MSO at Los Angeles/Long Beach, California, refined and expanded MSO Jacksonville’s risk model by including as many as 16 parametric measures of risk to develop an overall Port Activity Risk Index (PARI). Examples of risk parameters include cruise ship activity, vessel movements, status of aids to navigation, weather, and special operations in the port. The PARI is updated daily and provides the COTP with an overall indicator of the relative port risk for that day, so the COTP can implement appropriate risk reduction measures. Following the December 1996 collision of the M/V Bright Field with a pier in the Port of New Orleans,51 the February 1998 breakaway of the casino barge Jubilee near Greenville, Mississippi,52 and the April 1998 near breakaway of the Admiral, the Coast Guard established a Quality Action Team (QAT) in April 1998 to identify risks to PMVs that carry passengers. The goals of the team were to establish Coast Guard involvement in the siting and mooring of PMVs and to develop measures for reducing the risk of accidents affecting PMVs. On December 7, 1999, the Coast Guard issued the final report of its QAT for PMVs.53 The report provided a simplified methodology by which Coast Guard field units might assess risks to PMVs. The risk assessment methodology is based on six parameters: PMV location, vessel traffic, adequacy of emergency maritime assistance to disabled vessels, anticipated environmental factors, unpredictable environmental factors, and exposure (presence) of PMV passengers. (See appendix G for the Coast Guard’s PMV 51 NTSB/MAR-98/01. 52 On February 10, 1998, the PMV Jubilee Casino, carrying nearly 1,000 people, broke loose from its moorings on an inlet of the Mississippi River near Greenville, Mississippi, during a severe thunderstorm with high winds. No injuries or damage resulted, and river vessels pushed the PMV back into place. 53 U.S. Coast Guard. Permanently Moored Vessel QAT: A Site Selection and Risk Mitigation Model: Final Report, December 7, 1999. (Washington, DC: U.S. Coast Guard, 1999).

Factual Information 43 Marine Accident Report initial risk assessment form.) The QAT developed the methodology using expert opinion, experience, and local knowledge from Coast Guard field units. The team developed the method by assigning risk scores between 1 and 5 to each risk parameter (1 being the greatest risk and 5 being the least risk). Next, the QAT examined accident data comprising 295 accidents (including groundings, collisions, allisions, and breakaways) that occurred between 1992 and 1997 within 1/2 mile upstream of PMVs. The QAT included data on 162 PMVs in the study. The QAT found that the accident data generally validated the methodology54 developed through field experience and expert opinions. The accident statistics were used to establish acceptable risk scores to be used with the method. (The published QAT report did not disclose the actual risk scores and rankings for individual PMVs, or determinations of whether the PMVs met acceptable risk criteria as defined by the report.) The QAT found that barge breakaways, collisions, and high water were the main causes of PMVs breaking their moorings.55 The team also found that accident statistics showed that most (68 percent) of the accidents occurred at high-risk locations, making location the single most important parameter in predicting risk to a PMV. The QAT report concluded that site selection was the most effective way of managing PMV risk. The report stated that, where site selection options are limited, the next option could be to modify the site by adopting measures such as the installation of protective cells. In addition, the QAT report stated that, although the methodology that the QAT constructed for assessing PMV risks was developed using only PMV data, this risk assessment system is applicable to other vessel types and mooring sites.56 The Coast Guard adopted the QAT report’s recommendations and used them as the bases for changes in Coast Guard policies applicable to PMVs. (See appendix H for a full list of the report’s conclusions and recommendations.) The policy changes are explained in the Coast Guard’s 1999 update to its MSM, which the Coast Guard issued for field use. (See appendix I, Draft U.S. Coast Guard Marine Safety Manual Change, MSM Vol. II: Material Inspection, Chapter 10.) The revised MSM makes a number of new requirements regarding PMVs. For example, before the Coast Guard will formally acknowledge a vessel as a PMV, the vessel must undergo a risk assessment based on the methodology described in the QAT report. If a PMV fails to meet the risk criteria, the COTP has “articulable grounds” for calling safety into question. In such a case, the COTP can require the vessel owner or operator to develop a formal risk assessment and mitigation plan. With respect to the USACE permit process, the new Coast Guard policy requires that the simplified risk assessment be an integral part of USACE permit reviews. The Safety Board understands that, as part of the Coast Guard’s involvement in the site 54 Permanently Moored Vessel QAT: Final Report, December 7, 1999, appendix C. 55 Permanently Moored Vessel QAT: Final Report, December 7, 1999, appendix F, p. 2. 56 Permanently Moored Vessel QAT: Final Report, December 7, 1999, p. 13, conclusion 6.

Factual Information 44 Marine Accident Report approval process, the COTP will advise USACE whether the PMV under consideration meets the acceptable risk criteria. On June 2, 2000, USACE and the Coast Guard signed a Memorandum of Agreement regarding the new process for evaluating risks to PMVs. According to the Coast Guard’s media advisory concerning this action, the agreement establishes “a formal process whereby the Coast Guard will provide input into [USACE’s] evaluation process for issuing permits related to these types of fixed or floating structures.” The release further stated: The new process elevates the attention given to port and waterway safety issues associated with a structure’s location during [USACE’s] public interest review process, and provides for periodic review of existing permits as a result of waterway changes. The Coast Guard continues to require that PMVs be immobilized and removed from navigation but, under the revised MSM, the local COTP must now require that a professional engineer evaluate each PMV’s mooring arrangements. Further, the standard to which the mooring is evaluated must be developed during the initial risk assessment process and take local conditions into account. Under the new procedures, once the COTP determines that the PMV meets the risk criteria and the USACE provides a site permit, the Coast Guard will transfer the responsibility for future safety regulation of the PMV to local authorities. The transfer will be designated in writing. Because some local authorities may not be well versed in marine issues, the COTP will meet with the local authorities to ensure that they have satisfactorily addressed hull integrity, mooring arrangements, emergency egress, lifesaving appliances, and navigation-related operational issues. The Coast Guard will continue to be involved in the PMV’s safety after its jurisdiction is transferred to local authorities. The COTP must re-evaluate the risks to the PMV at least every 2 years (and when pertinent local conditions change), using the QAT report’s risk method. (The Memorandum of Agreement being developed between the Coast Guard and USACE is to include a provision for periodic permit reassessments.) Further, if the PMV is moved to a site that already has a USACE permit, the Coast Guard is responsible for determining whether that vessel qualifies as a PMV at that location. The Coast Guard has initiated a review of all PMVs based on the new policy and expects to complete the assessment of risk for all 162 PMVs in 2000. (The results of this review are not yet available.) Responsible Carrier Program Through the AWO, the inland towing industry has developed and adopted a safety management system called the Responsible Carrier Program (RCP). The RCP is modeled after the International Maritime Organization’s International Safety Management Code.57 The RCP provides member companies with recommended policies and practices

Factual Information 45 Marine Accident Report concerning the management, administration, maintenance, inspection, and use of equipment and human factors affecting the safe and efficient operation of towing vessels under varying conditions (such as high water, low water, restricted visibility, and so forth). All AWO members are required to develop and implement the vessel operating policies and procedures outlined in the RCP to retain their AWO membership. The RCP system is intended to document and define the responsibilities of shoreside management and tow crews, to enhance safety and environmental protection for vessel operations. All AWO members were required to develop and implement the vessel operating policies and procedures outlined in the RCP by 2000 to retain their AWO membership. AWO has reported that 11 companies have been removed from AWO membership because they did not fully comply with the RCP requirements. 1994 New Orleans Search and Rescue Exercises On January 30, 1994, Coast Guard Group New Orleans, Louisiana, conducted a series of search and rescue exercises with local emergency groups on the LMR, between the Crescent City connection bridges and Algiers Point. The purpose of the exercises was to determine the capability of the Coast Guard, city, and commercial interests to locate and rescue large numbers of people in the river. The exercise simulated a collision between a passenger vessel with 1,400 people on board and a 700-foot freighter. In the staged incident, the passenger vessel sank quickly, causing 1,400 “people” to go in the water. Wooden blocks represented people in the water. In the response to the scenario, responders recovered less than 20 percent of the 1,400 wooden blocks. The Coast Guard found that the conditions of the Mississippi River in the vicinity of New Orleans severely limited the survivability of people in the water. These conditions included cold water temperatures (34° F) and swift and treacherous currents, eddies, and undertows. The Coast Guard determined that, under prevailing conditions, a large percentage of people entering the water would have soon succumbed to hypothermia. The Coast Guard on-scene commander concluded that, should such an accident actually occur, he could not guarantee the rescue of passengers forced into the Mississippi River. Developments Since the Accident President Casino on the Admiral The Admiral’s 10 mooring wires have been replaced with new wires. The stern anchor weight has been increased from 6,000 to 12,000 pounds. President Casinos has 57 The International Safety Management Code recognizes and codifies the responsibilities of shipping company management in ensuring adherence to marine safety guidelines and environmental protection standards. The Code provides member companies with recommended policies and practices concerning the management, administration, maintenance, inspection, and use of equipment and human factors affecting the safe and efficient operation of vessels under varying operating conditions.

Factual Information 46 Marine Accident Report added an auxiliary anchor and chain to the Admiral’s bow; they can be released should the other two anchors (bow and stern) or anchor mooring wires break or become dislodged. Since the accident, the company has purchased two cellular phones for the Admiral; one is kept in the security shift office and the other in the general manager’s office. President Casinos has also installed a marine radio scanner and a marine radio in the Admiral’s security shift office. The radio can be used to communicate with the Casino Queen and other navigating vessels in the area. The company has made provision for an Admiral employee to monitor the marine radio 24 hours a day, 7 days a week. On March 16, 1999, three Admiral security staffers participated in a 6-hour “Crowd Management for Passenger/Casino Vessels” training session conducted by a commercial training center. The course was designed to help participants develop the knowledge and skills to control and direct passengers in emergency situations. On May 24, 1999, at the request of President Casinos, USACE issued a permit to move the Admiral complex to mile 180.3 UMR, above the MLK Bridge, and to place four protection cells around it. President Casinos has until December 31, 2003, to complete the action and is expected to move the vessel by fall 2000. Laclede According to a December 9, 1999, letter from the Laclede Gas Company to the Safety Board, when the Admiral is moved to mile 180.3 UMR, Laclede will install a new service line and meter station to serve the vessel. The company stated that: The new meter station, with accessible shutoff valves, will be located at 802 N. First Street. This location was chosen by Laclede because it is remote from areas affected by flooding. This new service line will be approximately 750 feet in length and will terminate in a custody transfer vault located on the riverfront. Considering the Admiral’s new location, and its readily accessible valving which would be available in the event of an emergency, Laclede feels that an automatic shutoff device is not necessary for this installation. When the Safety Board expressed its concern about the other PMVs on the St. Louis waterfront to which Laclede supplies natural gas, the company stated, in a December 28, 1999, reply, that: Laclede has tested and found the Fisher 299H w/VSX module regulator to be an acceptable automatic shutoff device for the service to the St. Louis Concessions [58] and McDonald’s riverboats. Installation of a Fisher 299H w/VSX module regulator and necessary service line modifications for both of these customers is planned by Laclede [ ]… . Laclede subsequently informed the Safety Board that it will install these low- pressure shutoff devices in fall 2000. 58 Gateway Riverboat Cruises support barge.

Factual Information 47 Marine Accident Report In a January 7, 2000, letter to the Safety Board, Laclede stated that, with respect to “providing ready access, in the event of flooding, to the natural gas service shutoff valves for floating customers on the St. Louis riverfront,” the company was continuing its actions. Specifically, Laclede stated that: A [ ] guide is being designed for these service valves so that a valve key can be easily placed on a service valve from over head in the event of high water on the St. Louis riverfront. These guides will be installed on the remaining active customers [St. Louis Concessions, McDonald’s, and Robert E. Lee] during the Spring of 2000 when additional work is planned. Laclede has since informed the Safety Board that valve key guides have been installed on the St. Louis Concessions, McDonald’s, and Robert E. Lee PMVs, as well as the Admiral, in its current location. NFESC Mooring Study After the accident, the Safety Board contracted with the Naval Facilities Engineering Service Center (NFESC), East Coast Detachment, to conduct an engineering analysis of the mooring of the Admiral and its entry barge as it was at the time of April 1998 accident. The purpose of the analysis was to help determine what factors may have contributed to the mooring failure. The NFESC evaluated the effect on the mooring caused by impact on the Admiral’s bow from one and three loose barges, loaded as they were at the time of the accident. The mooring wire strengths, diameters, and arrangements used in the NFESC’s calculations were based on those used to moor the Admiral. In summary, the NFESC found that: • the Anne Holly’s runaway barges probably badly damaged or severed mooring wires 8, 9, and 10 by drifting into them before the barges struck the Admiral itself; • the impact of the runaway barges on the Admiral caused peak acceleration of the Admiral of approximately 0.1 g or less; • more than one runaway barge probably struck the Admiral and/or the wire ropes may not have had their full new-break strength at the time of the accident; • a runaway group of three barges would have broken the mooring wire rope numbers 1 through 6 at a speed as low as 4 feet per second (2.7 miles per hour); • the mooring wire rope numbers 1, 2, 3, 4, 5, and 6 likely failed because wire ropes are stiff (do not stretch much), and the wire rope winches were locked tight, so the wire rope could not “pay out” in case of overloading;

Factual Information 48 Marine Accident Report • after wire rope numbers 1 through 6 and 8 through 10 broke, the river current acted on the Admiral and the entry barge to make them swing slowly in a clockwise direction and end up near the riverbank downstream; and • the final remaining mooring wire, number 7, would likely have held even without the Anne Holly’s assistance.

49 Marine Accident Report Analysis Exclusions Based on the statements of the Anne Holly’s chief engineer, the Safety Board’s examination of the towboat’s machinery and steering, and the trial trip taken on the Anne Holly on April 8, 1998, the Safety Board found no evidence of loss of engine power, loss of steering, or of any other mechanical or electrical malfunction that could have caused or contributed to this accident. The Anne Holly had nearly twice the minimum horsepower required by the Coast Guard for upbound towboats during high-water conditions, and the vessel successfully navigated the area a few days after the accident with a similar tow under similar conditions. The Safety Board therefore concludes that the Anne Holly had sufficient horsepower to successfully navigate upbound through St. Louis Harbor on the night of the accident, and the vessel did not experience any propulsion or steering system failure. Nifedipine and glyburide do not typically impair performance, although some individuals may experience side effects, including dizziness and nausea. The Anne Holly captain had used both of these medications on a regular and continuing basis at least since December 1996, and he testified that he did not experience any side effects. In controlled medical studies, sertraline did not cause sedation and did not interfere with psychomotor performance,59 and may actually improve performance in patients with depression.60 The Safety Board reviewed the report of a medical examination of the captain performed several weeks before the accident (in late February 1998) and a medical examination for Coast Guard licensing done in August 1998, after the accident. The review of the two examinations indicated that the captain’s physician had found the captain physically fit for duty on board the Anne Holly. He was receiving appropriate treatment for his diabetes and elevated blood pressure, and no side effects were reported for any of his medications.61 The Anne Holly captain had more than 25 years of experience as a towing vessel operator, was properly licensed, and had routinely transited the river through St. Louis Harbor many times both upbound and downbound under many different circumstances, including high-water conditions. Moreover, he had operated tows through the St. Louis Harbor area without an accident for the previous 4 years. He was thus qualified and 59 See, for example, Doogan, D.P., and Caillard V. “Sertraline, A New Antidepressant.” J Clin Psychiatry. Aug: 49. Suppl: 46-51. 1988. 60 See, for example, Finkelstein, S.N., Berndt, E.R., Greenberg, P.E., Parsley, R.A., Russell, J.M., and Keller, M.B. “Improvement in Subjective Work Performance After Treatment of Chronic Depression: Some Preliminary Results.” Psychopharmacol Bull. 32(1): 33-40. 1996. 61 Postaccident drug and alcohol testing and fatigue, as they relate to the Anne Holly captain, will be addressed in a later section of the analysis.

Analysis 50 Marine Accident Report adequately experienced and skillful to serve as captain of the Anne Holly in St. Louis Harbor. Therefore, the Safety Board concludes that the captain of the Anne Holly was sufficiently qualified, experienced, and skillful to serve as captain on the night of the accident, and his prescription medication did not negatively affect his performance. Although it was dark when the Anne Holly’s transit began, the weather was clear, with good visibility (of at least 2 miles) in darkness. The wind was from the southwest at 5 miles per hour. The Safety Board therefore concludes that weather was not a factor in this accident. After the accident, the Anne Holly captain said that his tow’s forward movement was affected by a river phenomenon that he described as a “pop rise” between the MLK and Eads Bridges. A review of the USACE hourly river stage data, however, indicated a gradual rise of about 0.9 foot in 24 hours in the river stage in St. Louis Harbor. USACE data showed about 0.2-foot rise between 1900 and 2000 on April 4, 1998. Testimony from the chief of the potamology section of the St. Louis District USACE indicated that the rise in river level that day had been gradual. When he was asked if a condition “that could have resulted in an unexpected ‘wall of water’ between the MLK and the Eads Bridges” had been present on the day of the accident, the USACE official replied that it had not. The USACE findings suggest that the Anne Holly tow experienced no anomalous river conditions as it moved between the MLK and Eads Bridges. Consequently, the Safety Board concludes that no sudden rise in river level interfered with the forward movement of the Anne Holly tow. The major safety issues identified in this investigation and discussed below are: • the advisability of the Anne Holly captain’s decision to make the upriver transit and the effectiveness of safety management oversight on the part of AM, • the effectiveness of safety measures provided for the PMV Admiral, and • the adequacy of public safety for permanently moored vessels. This accident comprises two separate accident sequences: 1) the striking of the Eads Bridge, with the break up of the Anne Holly tow, and 2) the subsequent striking of the PMV Admiral by barges from the Anne Holly tow and the PMV’s near breakaway. The analysis that follows considers each sequence separately. Striking of the Eads Bridge by the Anne Holly Tow Captain’s Decision-making On the night of the accident, the principal task of the Anne Holly captain was to navigate the 14-barge tow upriver from the Eagle fleeting area past four bridges. Under normal river stage (less than 20 feet on the St. Louis gage) and in daylight, someone with

Analysis 51 Marine Accident Report experience and skills similar to the captain’s could routinely accomplish this task. Conditions, however, were unfavorable in that the river was in flood and it was dark. The captain’s decision to proceed with the transit under the prevailing conditions of darkness and flood (which resulted in minimal vertical clearance at the Eads Bridge and a swift current of 6 mph) is critical to understanding the probable cause of this accident. On the night of the accident, the Anne Holly captain was aware of the difficult navigation task that he was undertaking; once he left the fleeting area, he requested a helper boat to assist him in taking his tow through the St. Louis Harbor bridges. When he learned that no helper boat was immediately available, he chose to attempt the transit without one. Other options, however, were open to him. He could have: • returned to the fleet to await the availability of a helper boat; • returned to the fleet, dropped off part of his tow, and then proceeded with a partial tow through St. Louis Harbor62 (he would then have had to return to the fleet to retrieve the remainder of the tow and make a second trip through the harbor or had another towboat bring the remaining barges upriver for him); or • returned to the fleet and remained there until daylight so that he could make the transit through St. Louis Harbor in daytime. Despite these options, the captain decided to continue with the transit without a helper boat. The transit of this tow under the prevailing conditions was a difficult task and presented risks that increased the likelihood of an accident. The captain, although experienced and familiar with the navigational demands of the area, decided on the evening of April 4, 1998, to move the Anne Holly tow through the area under recognizably adverse conditions. The Safety Board concludes that, given the difficult navigation task, the darkness, the flood conditions (which resulted in a swift current and minimal vertical clearance at the Eads Bridge), and the lack of a helper boat, the captain should have chosen to pursue another option on the evening of April 4, 1998. Role of Company. Although the immediate cause of the accident was the Anne Holly captain’s operational error or errors (to be discussed in the next section), the underlying cause was the owner’s lack of effective safety management of its towing operations. The absence of corporate management input into the captain’s strategic decision-making process about whether to proceed with the transit of St. Louis Harbor that night placed an unreasonable burden on the captain and forced him to make unilateral safety-critical decisions from the narrow perspective of the pilothouse. As a small business, AM often contracts for boats and operators as its workload requires and does not maintain an extensive shoreside operations infrastructure. 62 By making the transit with a shorter tow, the captain would have made the navigation task less challenging because it would have reduced the tow’s tonnage, increased the Anne Holly’s control over the barges in the tow and the tow’s maneuverability, and lessened the effect that the current had on the tow by reducing the surface area of the tow that was exposed to the current.

Analysis 52 Marine Accident Report According to AM management, the company relies on the captain to make all decisions regarding the tow’s operation. The company does not have written policies that its captains should follow to consistently ensure safe towing operations or procedures to assist the captains in choosing the proper course of action in safety-critical situations. The company has not established policies that address high water, nighttime transit, and other conditions that might affect the safety of towing operations. In addition, AM has provided no written guidance to its captains describing situations in which they may be justified in recessing operations for safety reasons. Nor does the company provide basic guidance concerning the proper way to make up a tow or use the tow’s equipment when underway. Company officials told the Safety Board that they rely exclusively on the knowledge, experience, and discretion of the individual captain to decide what is safe and proper under the prevailing circumstances. In the Safety Board’s view, the company’s comparatively small size does not justify AM’s attempt to place sole responsibility for safe operation of its vessels on the captain. Regardless of corporate size, management retains responsibility and accountability for its vessels’ operations and accidents. The Safety Board realizes that the captain is on board the vessel and is making decisions and taking actions for which he, and only he, can be responsible. Nevertheless, shoreside management shares or owns the responsibility for many of the operational decisions and actions affecting vessel safety. AM, which is not an AWO member, did not participate in the RCP and did not have a similar safety management system. The absence of such a system meant that AM had no comprehensive method to provide effective management oversight of safety operations, a responsibility that the company should have proactively pursued. This responsibility is not one that can be delegated to the towboat captain. The lack of an effective safety management system that provided procedures governing the safe operation of the Anne Holly was substantially responsible for creating an environment that increased the likelihood that this accident would occur. Night operation increases the risk of accidents, and AM should have developed night operations procedures for its captains. Operations during high water also pose greater risks, and AM should have addressed them through management instruction and policy. Certain areas of operation, such as the transit through St. Louis Harbor, present unique risks that likewise should have been the subject of management policy and oversight. The procedures should have anticipated the need for a helper boat and should have delineated alternative actions that the captain might take under various foreseeable circumstances. Moreover, the risk of collision with other river traffic is always present. Had the Anne Holly’s tow struck and ruptured other barges loaded with petroleum products or hazardous materials, the resulting spill could have seriously harmed the environment. The captain should have been provided guidance concerning such an eventuality. By not providing guidance through a comprehensive safety management system, AM left the captain of the Anne Holly to his own devices to make safety-critical decisions, increasing the likelihood that the captain would make an inappropriate decision. Consequently, the Safety Board concludes that the captain of the Anne Holly would have

Analysis 53 Marine Accident Report been better able to make prudent decisions concerning the operation of his tow, and this accident might thereby have been prevented, had AM developed and implemented an effective safety management system. The Safety Board therefore believes that AM should develop and implement a safety management system similar to the RCP used by the AWO; the system should establish effective policies and procedures to enhance the safety of vessel operations. The Safety Board has previously addressed the need for safety management systems in the U.S. towing industry and has recommended that the Coast Guard require such systems. As a result of its investigation of the 1996 accident involving fire aboard the tug Scandia and the subsequent grounding of the tug and the tank barge North Cape,63 the Safety Board issued the following safety recommendation to the Coast Guard: M-98-104 In conjunction with the towing vessel industry, develop and implement an effective safety management code to ensure adequate management oversight of the maintenance and operation of vessels involved in oil transportation by barges. In its November 5, 1998, reply to the Safety Board, the Coast Guard stated that it concurred with the intent of the recommendation, that it believed use of safety management systems would result in significant benefits, and that it supported the development of such programs. However, the Coast Guard’s letter also stated that 46 U.S.C. 3202, which affirms that U.S. domestic vessels may voluntarily meet the requirements of the chapter, does not provide the Coast Guard with statutory authority to require safety management systems on domestic vessels. The Coast Guard further stated that it had issued Navigation and Vessel Inspection Circular 2–94, providing “Guidance Regarding Voluntary Compliance with the International Management Code for the Safe Operation of Ships and for Pollution Prevention,” and that it had worked with the AWO in developing the RCP. The Coast Guard considered that these actions fulfilled the intent of Safety Recommendation M-98-104 and requested that it be closed. In a September 22, 1999, reply, the Safety Board stated that because not all U.S. towing companies are AWO members, some may not use the RCP, so a safety management system remains necessary for the industry. Further, the Safety Board found the Coast Guard’s efforts insufficient to fulfill the recommended action. Consequently, the Safety Board classified the recommendation “Open–Unacceptable Response.” This accident demonstrated that the Safety Board’s concern regarding the lack of safety management systems for towing industry companies that are not AWO members was well founded. AM was not an AWO member and had no safety management system. Approximately 15 percent of the tonnage that is moved on U.S. waterways is transported by towing companies that are, like AM, not AWO members. These non-AWO members are not required to follow a safety management system similar to the RCP and therefore may not benefit from the organized safety procedures that such systems provide. The Safety Board concludes that the lack of a safety management system requirement for all 63 NTSB/MAR-98/03.

Analysis 54 Marine Accident Report U.S. towing industry companies represents a threat to waterway safety. Consequently, the Safety Board reclassifies Safety Recommendation M-98-104 “Closed–Unacceptable Action/Superseded” and believes that the Coast Guard should seek authority to require domestic towing companies to develop and implement an effective safety management system to ensure adequate management oversight of the maintenance and operation of all towing vessels. Navigation Task Once he was committed to transiting St. Louis Harbor on the evening of April 4, 1998, the captain faced the challenging task of navigating past the MacArthur, Poplar Street, Eads, and MLK Bridges. The captain successfully brought the Anne Holly tow through the MacArthur and Poplar Street Bridges. Then he faced the Eads Bridge transit. The passage of a tow through the Eads Bridge required the operator to approach the bridge with the tow positioned to the left of the river centerline and with the tow’s head aimed at the Illinois (right side) bridge pier of the center span. Operators of multi-barge tows must head their tows directly into the current to navigate the Eads Bridge successfully during high water. On nearing the Eads Bridge opening, the operator turns the tow to the left so that it will be aligned with the current for passage through the navigation span. Upon exiting the span, the operator moves the tow back to the right to align it for passage through the MLK Bridge. This steering task cannot be completed by the operator establishing the tow’s course while he is still some distance from the bridge and driving the tow straight through the opening. The maneuver requires that the operator begin the turns at the proper locations, at the proper times, and with the proper amounts of rudder. The operator also has to complete the turns appropriately by reducing the rudder angle or applying counter rudder in the opposite direction, at the correct locations and times. According to the testimony of the Anne Holly captain, which the Safety Board verified through discussions with other Mississippi River towing vessel operators, these types of maneuvers are made by sight and “feel,” based on years of experience in handling tows in a particular area. The center of the navigation span for the Eads Bridge was marked by a fixed green dayboard for daytime use and a fixed green light for nighttime use. The horizontal limits of the recommended 300-foot-wide navigable channel under the bridge were marked by two red dayboards. The Anne Holly’s captain stated that he clearly saw the center green light and that he illuminated the red dayboards on the bridge arch with his searchlights so that he could use them as visual cues. He also indicated that he used these visual aids, the lights on the MLK Bridge, and his radar to align the tow for passage under the Eads Bridge. The value of the radar information, however, would have diminished as the tow approached the bridge, especially once the radar return from the bridge began to degrade the radar screen picture. Despite the captain’s initial use of the radar, the execution of the transit under the bridge remained essentially a visual task.

Analysis 55 Marine Accident Report The Anne Holly captain was attempting to perform a critical visual task under less than ideal circumstances. To complete the task successfully, he had to be in peak physiological and mental condition. The task required that the captain remain attentive to the headway (speed and distance traveled), feel, and handling of the tow, as well as be ready to react quickly if he perceived that the tow was not in alignment to pass the Eads Bridge safely. Lacking daylight visual cues, the captain would have had to rely on his piloting skills, knowledge, experience, and memory of the currents around the Eads Bridge to make the transit successfully. His ability to predict headway, distances, current speed and direction, and other conditions, as well as his ability to make the most of degraded visual cues, would factor into the task. A momentary lapse in attention, a slight error in estimating speed or distance, or a minor misjudgment of the current speed or direction on the part of the captain could have caused the accident. The path available under the bridge with sufficient vertical clearance (of 46 feet or more) to accommodate the 105-foot-wide Anne Holly tow was only 270 feet wide. Thus, the captain had little margin for error. Most probably, he misjudged the alignment of his tow during the approach to the bridge and did not detect the misalignment in time to correct it before his tow struck the bridge. The Safety Board therefore concludes that the tow struck the Eads Bridge because of an error in judgment or a lapse of attention on the part of the Anne Holly captain, which resulted in the tow’s misalignment. Factors That Could Have Affected the Captain’s Performance Visibility. The maneuvering of inland river towboats relies heavily on the operator’s visual acuity and ability to make accurate visual estimates of speed and distance. The operator not only needs to judge the speed of the tow correctly, but also to assess the speed and effect of the currents that the tow encounters. Much of this proficiency is developed through experience and practice. However, the towboat operator’s ability to make accurate velocity and spatial estimations also depends on his ability to see visual cues, in particular, changes in the current direction and tow movement. Naturally, this ability is diminished when visibility is limited. The operator’s task on the night of the accident was made unusually difficult by the darkness, particularly given the high current speed and the tow’s length. To provide a reference point for nighttime operations, many inland towboat operators rig a steering light at the heads of their tows. According to the Anne Holly’s mate, a steering light had not been lit for the tow on the night of the accident. The Coast Guard or AM did not require use of a steering light, and use of such a light would not necessarily have prevented this accident. Nevertheless, a steering light would have provided an additional visual cue to help the captain judge the alignment and angular movement of the tow. The length of the Anne Holly tow also limited the visible cues available to the captain. On the night of the accident, the captain’s vantage point was more than 1,000 feet

Analysis 56 Marine Accident Report aft of the tow’s head, and the physical presence of the tow blocked his view of the water ahead of the tow. Such visibility-limiting factors also would have made it more difficult for the captain to determine the direction of the river’s current and negatively affected his ability to perceive the tow’s headway and to estimate distances. Although darkness alone did not cause the Anne Holly captain to strike the Eads Bridge, limited visibility of navigational cues due to darkness made the transit through St. Louis Harbor more difficult than it would have been in daylight. In maneuvering the tow through St. Louis Harbor, the captain would have experienced background illumination from shoreside lighting and shadows near bridge structures and a general lack of visual cues due to darkness. The Safety Board previously investigated an accident in St. Louis Harbor in which the glare from lighting was a safety issue.64 In that instance, the accident occurred in high water while the tow was downbound in St. Louis Harbor at night because the operator failed to identify the navigation span of Poplar Street Bridge in time to align the tow for safe transit. Through its investigation, the Safety Board surmised that the background lighting in St. Louis Harbor hampered the operator’s ability to distinguish the navigation lights on the bridge and resulted in the operator’s misaligning the tow. In its report on this accident, the Safety Board recommended that the Coast Guard: M-85-23 Conduct a comprehensive review of shore lighting in St. Louis Harbor to determine which lights adversely affect identification of bridge span navigation lights and take action to minimize the effect of the shore lights that interfere with bridge light identification. The Coast Guard concurred with Safety Recommendation M-85-23. It conducted a harbor survey and met with towboat operators to identify troublesome shore lighting so that these lights might be altered or screened to limit their interference with safe navigation. The Coast Guard made changes to the bridge navigation lights in St. Louis Harbor to make them easier to distinguish from the background lights. On December 23, 1993, the Safety Board classified Safety Recommendation M-85-23 “Closed–Acceptable Action.” In the years since the Coast Guard conducted its survey, both the Admiral and the Casino Queen, which are brightly lit at night, began operating in St. Louis Harbor. Given the combined effect of the city lights along the waterfront, the lights from area marine facilities, and the lights on the bridges, the ambient light level may be high enough to impair the night vision of towboat operators. During the Safety Board’s public hearing on the Admiral accident, a towboat captain who testified as an expert in St. Louis Harbor 64 National Transportation Safety Board. Ramming of the Poplar Street Bridge by the Towboat M/V Erin Marie and Its Twelve-Barge Tow, St. Louis, Missouri, April 26, 1984. Marine Accident Report NTSB/MAR-85/02. (Washington, DC: National Transportation Safety Board, 1985).

Analysis 57 Marine Accident Report towing operations stated that he thought the high-intensity lights in the harbor could be distracting and could impede night vision. The Anne Holly captain testified that he had no trouble seeing the navigation markers on the Eads Bridge. Nevertheless, the fact that the captain could see the navigation markers on the bridge does not necessarily mean that he had no night vision problems. The Safety Board, therefore, concludes that glare from shoreside lighting may have impaired the Anne Holly captain’s night vision and may have been a factor in his failure to align the tow properly for transit through the Eads Bridge. Consequently, the Safety Board believes that the Coast Guard should conduct a study of the lighting in St. Louis Harbor to determine whether the light level impairs nighttime navigation and take corrective action as necessary. Postaccident Drug and Alcohol Testing. Although the results of postaccident alcohol and drug testing for the Anne Holly captain were negative, the Safety Board is concerned about the timeliness of the postaccident collection of testing samples. Blood or breath and urine samples for postaccident testing must be collected before any impairing or suspected substances are metabolized and eliminated from the body. Alcohol metabolizes much faster than the drugs listed for postaccident testing in 46 CFR 16.350, “Specimen analysis”; thus, a lower time limit is required for alcohol testing. Failure to collect specimens promptly for testing will likely yield inconclusive results. In this instance, postaccident alcohol testing was not done sooner because the Anne Holly captain was engaged in the emergency response for the Admiral. Over a period of hours, the Anne Holly served as a platform to hold the Admiral against the shore and to off-load the Admiral’s patrons. Federal regulations (46 CFR 4.06–20) stipulate that postaccident testing is to be done as “soon as practicable.” Once all the Admiral’s patrons had been off-loaded, the Anne Holly captain was breath-tested for alcohol. Therefore, the Safety Board concludes that, because alcohol testing could not be accomplished until rescue operations were complete, the Safety Board is not able to eliminate the possibility that alcohol use may have contributed to the accident. Nevertheless, the Anne Holly captain stated under oath that he did not drink alcohol, and his videotaped interview with the Coast Guard, taken just after the breathalyzer test, showed no evidence of impairment. As a marine employer, Winterville Marine is responsible for having procedures in place for conducting drug and alcohol testing in the event that its marine employees are involved in an accident (46 CFR 4.06–1). Following the accident, AM contacted Winterville Marine. Winterville Marine, in turn, arranged for the dispatch of medical technicians to St. Louis Harbor on the day after the accident. In its May 1998 Special Investigation Report, Postaccident Testing for Alcohol and Other Drugs in the Marine Industry and the Ramming of the Portland-South Portland (Million Dollar) Bridge at Portland, Maine, by the Liberian Tankship Julie N on September 27, 1996, the Safety Board issued the following safety recommendation to the Coast Guard:

Analysis 58 Marine Accident Report M-98-79 Establish a requirement that postaccident testing for drugs begin within 4 hours of a serious marine incident and postaccident testing for alcohol begin within 2 hours of a serious marine incident, with attempts to test for alcohol ceasing after 8 hours, and establish a requirement that the marine employer document any testing delays or failures. The Coast Guard responded to this recommendation on November 4, 1998, and stated “the Coast Guard intends to initiate a regulatory project to review, and revise as necessary, the drug and alcohol testing regulations and will include this issue in that review.” In its July 28, 1999, reply to the Coast Guard, the Safety Board classified the recommendation “Open–Acceptable Response.” Safety Board staff has been informed that the Coast Guard is contemplating issuance of a notice of proposed rulemaking on this matter sometime in fall 2000. The Anne Holly captain’s urine sample for drug testing was collected the day after the accident, well beyond the 4-hour limit recommended by the Safety Board in the Julie N report. Therefore, the Safety Board concludes that, because postaccident testing for illicit drugs did not take place until the day following the accident, the Safety Board is not able to eliminate the possibility that illicit drug use may have contributed to the accident. Nonetheless, the captain’s medical records indicated no history of alcohol or illicit drug abuse, and his behavior following the accident did not indicate impairment. Therefore, the Safety Board concludes that, given the results of postaccident testing, together with the review of the captain’s videotaped interview, and the review of his medical records, the Safety Board found no evidence that the Anne Holly captain was impaired by drugs or alcohol at the time of the accident. Fatigue. Sleep loss can result in performance degradation or variability (or both), affecting decision-making ability, vigilance, reaction time, memory, psychomotor coordination, and information processing.65 If the Anne Holly captain was sleep-deprived at the time of the accident, he may have been less alert than he would have been had he fulfilled his normal sleep requirement. Reduced vigilance could have caused him to miss normal landmarks or other cues to navigation that he may have needed. The Safety Board considered whether sleep loss as a consequence of the captain’s watch schedule affected his performance. In particular, the Safety Board considered whether the captain had adequate opportunity to obtain about 8 hours of sleep in every 24-hour period. During interviews with both Coast Guard and Safety Board investigators, the captain stated that he had been operating on a standard watch schedule of 6 hours on, 65 A general description of classic research and findings on sleep deprivation and loss and human performance can be found in sections 10.801-806 and 10.809-811 of the Engineering Data Compendium, Human Perception and Performance, Volume III, edited by Kenneth R. Boff, Human Engineering Division, Armstrong Aerospace Medical Research Laboratory, and Janet E. Lincoln, University of Dayton Research Institute. Published by the Armstrong Aerospace Medical Research Laboratory, Wright-Patterson Air Force Base, Ohio, 1988.

Analysis 59 Marine Accident Report 6 hours off in the Anne Holly pilothouse. The captain’s watch schedule shows that before beginning the 0500 watch on April 4, 1998, he would have been off watch for 6 hours after completing his 2300 watch on April 3. On April 4, the captain was relieved from his 0500 morning watch at 1115. He then went below, ate lunch, and went to bed. He said that he slept 3 ½ to 3 ¾ hours. He got up, took a shower, went down to the galley, visited, drank coffee, ate supper, and relieved the pilothouse watch about 1705. While at the Eagle fleeting area, the captain had no collateral duties during his off-watch period. According to this schedule, in the best of circumstances, absent any emergencies or collateral activities when off watch, the captain had about 2 ¼ to 2 ½ hours in which to eat two meals, shower, dress, and so forth. This time allotment is reasonable if we allow 45 minutes for each meal (including socializing with crewmembers), 30 minutes for getting undressed and dressed, and 15 to 30 minutes for ancillary activities. Therefore, he had about 4 hours available per off-watch period for sleep. Consequently, in the 24 hours preceding the accident, the captain had the opportunity to obtain about 8 hours of sleep. Given that the captain had the opportunity to obtain about 8 hours of sleep each day of the 26 days that he had been aboard the Anne Holly, the Safety Board could find no clear evidence of sleep loss. However, because of the 6-on, 6-off watch schedule, the captain’s sleep would have been split into two periods. That is, the captain could not possibly have gotten 8 hours of continuous sleep, given the demands of his work schedule. Therefore, the Safety Board concludes that, although the Anne Holly captain had the opportunity to obtain about 8 hours of sleep in a 24-hour period, the sleep would necessarily have been obtained on a split schedule. In 1995, the Safety Board conducted a study on factors that affect fatigue in heavy truck accidents,66 which considered the effects of split-sleep patterns on the accident rates for truckdrivers. The study stated: The findings of this study show that truckdrivers with split sleep patterns were obtaining about 8 hours of sleep in a 24-hour time period; however, they obtained it in segments, on average of 4 hours at a time. While the research is not clear whether split sleep constitutes or contributes to sleep loss, research has shown that sleep accumulated in short time blocks is less refreshing than sleep accumulated in one long time period.67 [68] 66 National Transportation Safety Board. Factors That Affect Fatigue in Heavy Truck Accidents, Volume 1. Safety Study NTSB/SS-95/01. (Washington, DC: National Transportation Safety Board, 1995). 67 Dinges, D.F. “The Nature of Sleepiness: Cases, Contexts, and Consequences.” In: Stunkard, A.J.; Baum, A. Perspectives in Behavioral Medicine: Eating, Sleeping, and Sex. (Hillsdale, NJ: Lawrence Erblaum Associates, 1989) p. 147-179. 68 NTSB/SS-95/01. p. 46.

Analysis 60 Marine Accident Report The Safety Board’s 1995 study drew upon research69 that indicated “decrements in performance occur earlier for drivers using sleeper berths (or drivers with split-sleep patterns) than for other drivers.”70 The Safety Board’s truckdriver fatigue study showed a correlation between split-sleep schedules and fatigue-related accidents. The Safety Board is not aware of any similar studies correlating split-sleep schedules for towing vessel operators and the towing vessel accidents in which fatigue caused or contributed to the accident. Relatively little research exists to establish the physiological and performance implications of the 6-on, 6-off watch schedule widely used in the towing industry. Although the Safety Board’s 1995 study on factors affecting fatigue among drivers of heavy trucks correlated split-sleep schedules with accident occurrences, the precise nature of split sleep and its specific effects on performance need further research. Therefore, the Safety Board concludes that insufficient research is available on the effects of split-sleep schedules on the performance of inland towing industry operators for the Safety Board to determine whether the Anne Holly captain was appropriately rested. As a result of its 1999 evaluation of U.S. Department of Transportation efforts to address operator fatigue, the Safety Board made the following recommendation to the Coast Guard: M-99-1 Establish within 2 years scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements.71 The Coast Guard replied to the recommendation on October 8, 1999, stating that: While the complexities of the maritime transportation system preclude the Coast Guard from establishing scientifically based hours of service at this time, progress is being made on multiple levels, internationally as well as domestically, to rationally frame and address the fatigue issue on commercial vessels. The Coast Guard intends to continue sponsoring research domestically, and leading efforts internationally, with the aim of identifying and promoting the best practices and most effective countermeasures to control fatigue. The Safety Board classified Safety Recommendation M-99-1 “Open–Acceptable Response” on December 9, 1999. This classification anticipates that the Coast Guard will establish, in the course of completing compliance with Safety Recommendation M-99-1, the physiological and performance implications of various marine watchstanding schedules currently in use, including the 6-on, 6-off watch schedule, and examine the precise nature of split sleep and its specific effects on performance. 69 Hertz, R.P. “Tractor-Trailer Driver Fatality: The Role of Nonconsecutive Rest in a Sleeper Berth.” Accident Analysis and Prevention. 20(6): 431-439. 1988. 70 NTSB/SS-95/01. p. 46. 71 National Transportation Safety Board. Evaluation of U.S. Department of Transportation Efforts in the 1990s to Address Operator Fatigue. Safety Report NTSB/SR-99/01. (Washington, DC: National Transportation Safety Board, 1999).

Analysis 61 Marine Accident Report Striking and Near Breakaway of the President Casino on the Admiral When the Anne Holly struck the Eads Bridge, its eight lead barges broke free from the rest of the tow and were cast adrift in the river. When three of these barges drifted near the Admiral, they severed or severely damaged the three mooring lines at the Admiral’s bow. The force of the impact of the barges on the Admiral resulted in the rest of the remaining lines breaking, except for line number 7, which held. Two of the three barges continued downriver. The third barge headed toward shore and struck, in succession, the levee wall, the access walkway from shore, and the north (employee) gangway to the Admiral. The 1999 NFESC study of the Admiral’s mooring indicates that the final mooring line (number 7) probably would have kept the PMV from breaking away even if the Anne Holly had not assisted the Admiral. Given the range of conditions present when the accident occurred and the number of unknown factors that could have influenced the outcome of the event, however, the validity of the NFESC’s supposition cannot be guaranteed. The fact remains that only 1 of the 10 lines that moored the Admiral held when the PMV was struck by a few relatively small vessels. Had the allision been more severe, or had the drifting vessels been heavier or larger, a less favorable outcome could have occurred. The Admiral had more than 2,000 people on board and was unpowered and without a marine crew or emergency equipment. Had the Admiral broken free from its moorings without intervention, it would have entered a flood current and been forced downbound on the Mississippi. The swift current would have carried the Admiral downstream where it might have collided with the Poplar Street Bridge, which did not have sufficient vertical clearance for the Admiral to pass underneath it in the existing flood conditions. The Safety Board concludes that, had the Admiral broken free as a result of the allision, the consequences could have been catastrophic, because it could have resulted in the sinking or capsizing of the vessel, which would have placed more than 2,000 lives in jeopardy. Survival Aspects Drills. Although the Admiral security personnel were responsible for ensuring the safety of patrons in an emergency, they had no training in crowd management techniques. During the emergency response, the security personnel did not keep vessel patrons from becoming agitated and disorderly. Respondents to the Safety Board’s postaccident questionnaire reported that some minor injuries and considerable anxiety resulted from people shoving them and crowds attempting to push through the single exit leading to the Anne Holly. Had the accident been more severe, this unruly conduct might have increased to the point of causing serious injuries or even deaths. The fire drills held on the Admiral essentially addressed the procedures for securing the casino and evacuating a building-type structure, rather than for assembling and managing crowds to make an orderly evacuation. The drills did not provide alternative actions for personnel to take if the main avenues of egress were blocked or not available.

Analysis 62 Marine Accident Report Further, although the local fire prevention code required that fire drills be held every 90 days on the Admiral, the last such drill before the April 1998 accident was held in June 1997. Clearly, local authorities did not provide adequate oversight of the company’s responsibility to conduct periodic fire drills. Because the city of St. Louis did not require owners to keep records of drills that had been conducted, the city was unaware that the Admiral had gone almost 9 months between the last fire drill and the accident. In the Safety Board’s opinion, frequent drills would have helped prepare the Admiral’s staff to deal with a real emergency. The Safety Board concludes that President Casino’s failure to conduct fire drills and the city of St. Louis’s failure to enforce fire drill requirements for the Admiral contributed to a lack of casino staff preparedness to deal with emergency situations. Therefore, the Safety Board believes that the city of St. Louis should establish and implement oversight procedures to ensure that owners of operational PMVs accessible to the public in St. Louis Harbor conduct and document fire drills. Communication. Once the Admiral’s ship-to-shore telephone lines parted during the near breakaway, vessel personnel could not communicate with on-shore emergency personnel. None of the emergency rescue organizations were notified from the Admiral because the vessel had no means of communicating externally after it was struck and its phone lines parted. Since the accident, the Admiral has installed a marine radio scanner and a marine radio in the security office, and personnel now have access to cellular phones that are kept in the security shift and general managers’ offices. The Safety Board is pleased that President Casinos has installed this important communication equipment. Another element of a successful on-board emergency response is authoritative and helpful communication to vessel patrons and staff about the nature, scope, and status of the emergency. During the Admiral’s near breakaway, internal communication deficiencies were evident. President Casinos had no formal policies governing the use of the public address system in an emergency. On the night of the accident, use of the public address system was delayed because the staff mistakenly thought the system was inoperable until about 2145, when the security shift manager returned to the PMV from the shore. Thus, no use was made of the public address system until the emergency on the Admiral had gone on for about 1 hour and 45 minutes. In their responses to postaccident questionnaires, a significant proportion of the Admiral patrons who responded stated that, despite some public address announcements and instructions from staff, patrons generally found the staff’s communication of information not useful. They also reported that many people on board did not know what had happened or what they should do in the accident aftermath. Respondents said that panic and confusion may have been encouraged by the scarcity of information. Some respondents further claimed that they incurred minor injuries caused by other patrons’ panicked attempts to evacuate the Admiral following the barge strikes. Therefore, the Safety Board concludes that patrons on board the Admiral did not receive sufficient safety information in the aftermath of the barge allisions to help prevent panic and confusion. To resolve this problem, the Safety Board believes that President Casinos should develop

Analysis 63 Marine Accident Report guidelines for making periodic public address announcements during emergencies to provide direction and ensure patron safety. Crowd Management. The Admiral often accommodates thousands of patrons and hundreds of staff members at a time. All would have to be evacuated safely in an emergency. Such evacuations are best conducted by trained personnel who are assigned, and trained in carrying out, specific responsibilities during an evacuation. As a result of its investigation of a 1994 fire aboard the Argo Commodore,72 the Safety Board issued the following recommendation to the PVA: M-95-43 Develop and provide to your members crew drills for on-board crew emergency procedures/standards that include pre-incident planning for a variety of shipboard emergencies, including fires, and the deployment of crew resources for proper response to the emergency without compromising passenger safety. The PVA developed a section for its Training Manual for Passenger Vessel Safety entitled “Non-marine Crew Training” that outlines a comprehensive training program for nonoperating crewmembers. The introduction to this section states that specialized safety training for nonoperating employees “makes sense when management realizes that, more often than not, [these employees] will be the first person[s] on the scene in any kind of emergency.” Based on the PVA’s support for comprehensive training for nonoperating employees and the organization’s development of the training manual, the Safety Board classified Safety Recommendation M-95-43 “Closed–Acceptable Action” on July 21, 1997. As an operator of several passenger vessels on the Mississippi River, President Casinos, Inc., is a PVA member. Personnel on the PMV Admiral face many of the same emergency response challenges as crewmembers of other types of large passenger vessels. The Safety Board understands that, since the accident, President Casinos has had three Admiral security employees trained in crowd management techniques. The Board considers that this effort, if continued, will improve the vessel’s on-board emergency response capability. To ensure the development of crowd management capabilities throughout the organization, the training should include all Admiral personnel. Such broad provision of training is prudent because even those vessel employees who do not have safety-related duties in an emergency can affect the response either positively or negatively. The Safety Board noted as a result of the Bright Field investigation73 that nonoperating crewmembers on both the Queen of New Orleans and the Creole Queen had not received training covering the full range of emergency scenarios and were unprepared to properly carry out their responsibilities. 72 National Transportation Safety Board, Fire Aboard U.S. Small Passenger Vessel Argo Commodore in San Francisco Bay, California, December 3, 1994, Marine Accident Report NTSB/MAR-95/03. (Washington, DC: National Transportation Safety Board, 1995). 73 NTSB/MAR-98/01.

Analysis 64 Marine Accident Report According to a comment made by a patron after the Admiral allision and near breakaway, some Admiral staff members “appeared to be just as confused as we were.” One cashier even shouted that the vessel was sinking. Staff confusion and inflammatory remarks can only increase the level of panic on board a vessel or a permanently moored casino during an emergency. Training in crowd management would help staff understand the importance of maintaining calm and order. The Safety Board concludes that Admiral security personnel and other staff members were not adequately trained and drilled in crowd management techniques and therefore were not successful in ensuring that the vessel’s patrons and staff behaved in a calm and orderly fashion in the aftermath of the April 4, 1998, accident. Therefore, the Safety Board believes that President Casinos should require and document that all Admiral personnel receive formal training in crowd management techniques and conduct periodic drills to reinforce this training so that vessel staff can perform effectively in an emergency. Also, President Casinos should amend the Admiral’s Emergency Evacuation Procedures to reflect crowd management techniques. St. Louis Harbor contains three PMVs in addition to the Admiral and its support barge—the McDonald’s restaurant barge, the Robert E. Lee restaurant barge, and the Gateway Riverboat Cruises support barge. The Robert E. Lee is not operating, but the other two PMVs face some of the same safety challenges as the Admiral. Both are accessible to the public, so the personnel that staff them need the same type of crowd management training as Admiral personnel. The Safety Board concludes that formal training in crowd management techniques for staff on all operating PMVs that are accessible to the public would enhance safety on board PMVs. The city of St. Louis does not require crowd management training for the staff members of any PMVs within its jurisdiction. Because the city of St. Louis has primary enforcement responsibility for PMVs in St. Louis, it should ensure that all operating PMVs accessible to the public have staff trained in crowd management techniques. Therefore, the Safety Board believes that the city of St. Louis should take the following three actions: a) require that the owners of all operating PMVs that are accessible to the public in St. Louis Harbor provide and document formal training in crowd management techniques for all personnel on such vessels; b) require that periodic drills be conducted to reinforce the crowd management training; and c) require that the vessel owners amend their emergency plans to reflect crowd management techniques. In view of the need to ensure that such measures are applied to all PMVs and the fact that the Coast Guard is best positioned to establish uniform crowd control requirements, the Safety Board believes that the Coast Guard should take the following three actions under its PWSA authority: a) require that the owners of all operating PMVs that are accessible to the public provide and document formal training in crowd management techniques for all personnel on such vessels; b) require that periodic drills be conducted to reinforce the crowd management training; and c) require that the vessel owners amend their emergency plans to reflect crowd management techniques. Means of Egress. When the Anne Holly barges struck the Admiral, the standard gangways almost immediately dropped into the water. Together, the Admiral staff, the Anne Holly crew, and the Gateway Riverboat Cruises personnel improvised means to evacuate patrons and staff, but they were following no directions from President Casinos

Analysis 65 Marine Accident Report about how to do so. Also, the makeshift evacuation was a slow process, taking more than 3 hours to complete. Had the Admiral caught fire or begun to sink, such a lengthy evacuation would have placed patrons and staff at considerable risk. In addition to strikes by barges or vessels, other emergency situations, such as fires, floods, severe winds, etc., that might make the Admiral’s standard gangways dangerous or unavailable can easily be envisioned. Nevertheless, President Casinos did not have contingency plans for such events, and the company did not train or instruct its personnel in how to conduct an evacuation that would not involve use of the standard gangways. Therefore, the Safety Board concludes that the evacuation of the Admiral was jeopardized by the lack of contingency plans for an emergency egress when the standard gangways were not available. The Safety Board believes that President Casinos should develop and exercise contingency plans for emergency egress from the Admiral to ensure that occupants can exit the vessel in a timely and orderly manner when the standard means of egress become unusable and amend the Admiral’s Emergency Evacuation Procedures to reflect the new procedures. Emergency Response After the accident, the SLFD had personnel on the scene within 15 minutes. Coast Guard MSO St. Louis and other resources arrived shortly thereafter. The SLFD incident commander worked effectively with the Coast Guard to halt river traffic and close bridges during the emergency. The SLFD provided a rescue boat and medical personnel who examined patrons with medical complaints and transported some patrons to local hospitals. When the Admiral’s gangways collapsed, however, SLFD rescue personnel could not immediately board the Admiral. The lack of available means of boarding and leaving the vessel delayed the evacuation of the Admiral, which ultimately took more than 3 hours to complete. Therefore, the Safety Board concludes that, although local emergency response agencies arrived on the scene in a timely manner, they were not prepared to rescue patrons and staff from the Admiral after the standard gangways to the vessel became unusable, which delayed the evacuation and could have put patrons and staff in jeopardy. Consequently, the Safety Board believes that the city of St. Louis should ensure that harbor emergency responders develop, in conjunction with local PMV owners, including President Casinos and the McDonald’s Corporation, contingency plans for boarding and exiting the vessels when the standard means of egress become unusable and amend the St. Louis Harbor Emergency Response Plan to reflect the new procedures. Emergency Preparedness The Coast Guard coordinated the development of the St. Louis Harbor Emergency Response Plan in cooperation with State and local fire and rescue services and the local marine industry. The intent of the plan was to allow the emergency response agencies, the industry, and the Coast Guard to achieve coordinated and effective use of public and private response resources during an emergency. Although the Coast Guard has Federal responsibility for the overall safety of the port during an emergency, the responsibility for

Analysis 66 Marine Accident Report emergency response rests with local fire and rescue services and State response services. While, as a policy matter, the Coast Guard responds to emergencies to the extent that its resources allow, it does not have primary search and rescue responsibility in inland areas, such as St. Louis Harbor. The Coast Guard does not have firefighting or search and rescue capabilities in St. Louis Harbor, yet its personnel helped coordinate the plan, participated in drills, and provided information about marine risk mitigation measures to the incident commander. The COTP also assisted in crises by restricting vessel movements on the Mississippi River. The Safety Board evaluated the St. Louis Harbor Emergency Response Plan and found that it adequately identified the agencies that would participate in marine emergency responses in St. Louis Harbor and provided a comprehensive contact listing for critical responders. The plan further identified the interagency command and control responsibilities of the various agencies and designated the radio frequencies to be used during responses. The response plan, however, did not take into account the various types of accidents that might occur in the harbor. For instance, the plan did not anticipate an accident similar to that involving the Admiral on April 4, 1998—the breakaway or near breakaway of a high-capacity PMV. The possibility of such an accident, especially during a period of high water, was reasonably foreseeable. The St. Louis Harbor Emergency Response Plan did not identify all foreseeable emergencies or create strategies to deal with them. Without identifying the types and magnitudes of the possible emergencies for which St. Louis Harbor authorities would have to be prepared, response planners could not determine the amounts, types, and sources of emergency equipment and other resources that would be needed to conduct a successful response. The 1994 exercise sponsored by the Coast Guard in New Orleans, Louisiana, revealed that local contingency plans and responses for the New Orleans area were inadequate for rescuing large numbers of people from the Mississippi River. The exercise illustrated that responding to emergencies requiring the rescue of large numbers of people from the Mississippi River can overwhelm local resources, even in municipalities that may have greater marine resources than St. Louis. It is conceivable that, had the Anne Holly not held the Admiral against the riverbank on April 4, 1998, the Admiral might have broken free of its last mooring wire and floated downriver, possibly causing collisions and sinking or capsizing under one of the lower bridges. The risk to the Admiral and its more than 2,000 occupants would have been high in such a scenario because the Admiral did not have means of propulsion or navigational control, marine lifesaving equipment (such as life floats or personal flotation devices), or an experienced marine crew. Therefore, the Safety Board concludes that the St. Louis Harbor Emergency Response Plan did not sufficiently prepare emergency response agencies to deal with an emergency involving the rescue of a large number of people on or in the Mississippi River. Consequently, the Safety Board believes that the Coast Guard should take the lead, in cooperation with appropriate port and waterways stakeholders, to develop contingency

Analysis 67 Marine Accident Report plans to assist in marine-related incidents, such as search and rescue operations, fires, capsizings, or sinkings involving passenger vessels or permanently moored public facilities within St. Louis Harbor. Also, the Coast Guard should amend the St. Louis Harbor Emergency Response Plan to reflect these changes. The Safety Board also believes that the Coast Guard should conduct, in cooperation with the States of Missouri and Illinois and the cities of St. Louis and East St. Louis, regular drills to exercise the contingency plans for a variety of different marine scenarios, such as stopping breakaway vessels or rescuing large numbers of people from the Mississippi River. Laclede Gas Company. The severing of the natural gas supply line to the Admiral resulted in a natural gas leak. When the line broke, natural gas began escaping. Although the escaping gas did not ignite, one of the first priorities in any situation during which natural gas is released should be to curtail the escape of product. An emergency repair team was summoned from the Laclede Gas Company to deal with the situation. The Laclede team could not shut off the natural gas from the regulator pit because, due to high water, the pit had filled with muddy water that prevented them from reaching the shutoff valves. The team was able to clamp off the ruptured natural gas hose, but by then, the leak had continued for about 3 hours. High water is not particularly unusual in this area; on the average, the river stage at St. Louis is 30 feet or higher more than 20 days a year. The river stage is 20 feet or higher nearly 70 days a year, on the average. Given this environment, the designers of this system should have considered that a facility set so close to the river might be difficult to access, depending on the river level. Laclede should have been aware of this design weakness and of the need to prepare its personnel to respond to emergencies affecting this regulator pit (and others on the waterfront) under all river conditions. But the Laclede response team had received no special preparation for responding to an emergency during high water and had to take a trial-and-error approach to shutting off the broken line. Therefore, the Safety Board concludes that Laclede Gas Company’s emergency responders had not been adequately prepared to stop the uncontrolled flow of natural gas resulting from this accident. To enable Laclede personnel to become more familiar with the special challenges associated with riverside emergency responses, the Safety Board believes that Laclede Gas Company should require that its emergency response teams participate in port contingency plan drill exercises involving PMVs that are supplied with natural gas. Because inadequate emergency response preparation may be a concern for natural gas providers to PMVs in other jurisdictions, the Safety Board believes that the American Gas Association and the American Public Gas Association should advise their members of the natural gas leak that resulted from the April 4, 1998, accident affecting the Admiral in St. Louis Harbor, and recommend that they participate in port contingency plan drill exercises involving PMVs that are supplied with natural gas. Federal regulations (49 CFR 192.365) require that natural gas service line valves be placed in “a readily accessible location.” Based on the Laclede responders’ inability to

Analysis 68 Marine Accident Report reach the valve, the Safety Board concludes that, at the time of the accident, the Admiral’s natural gas shutoff service valve was not readily accessible. Laclede has taken actions to provide the Admiral and its other floating facility customers in St. Louis Harbor with improved means of stopping the flow of gas in emergencies. In the case of the Admiral, Laclede intends to provide a new service line and meter station with accessible shutoff valves when the Admiral relocates to a position north of the MLK Bridge in 2000. Laclede informed the Safety Board that it selected the new meter station location specifically because it is removed from areas affected by flooding. Laclede has also informed the Safety Board that it has installed valve key guides that allow service valves to be readily accessed and operated, even during periods of high- water conditions, for the Admiral (in its current location) and the other floating facilities in St. Louis Harbor. Natural gas lines serve other PMVs in U.S. ports, so inaccessible shutoff valves may be a safety hazard common to pipelines that supply natural gas to PMVs during high- water conditions. In the case of the Admiral, it took about 3 hours to stop the escape of gas from the service line. The delay in this instance did not have serious consequences, but a future incident involving release of gas could have far more unfortunate results. The Safety Board concludes that the flow from the Admiral’s ruptured natural gas supply line was not secured in a timely manner, and such a delay could be hazardous should such an incident recur. The Research and Special Programs Administration (RSPA) is the Federal agency with the responsibility for ensuring that local gas companies comply with the requirements of 49 CFR 192.365. The Safety Board believes that RSPA should require corrective action as appropriate to ensure that pipeline operators have the means to shut off the flow of natural gas to PMVs in a timely manner, even during periods of high-water conditions. In the interim, the Safety Board believes that the American Gas Association and the American Public Gas Association should urge their members to take corrective action as appropriate to ensure that they can shut off the flow of natural gas to PMVs in a timely manner, even during periods of high-water conditions. Public Safety of Permanently Moored Vessels PMV safety falls under the purview of many entities, from the owner and local jurisdictions, such as the fire department and the city building commissioner, to State and Federal authorities, including the Coast Guard and USACE. The overlapping of these authorities’ responsibilities can result in confusion or worse. In some instances, gaps in safety have resulted because authorities have assumed that another entity is administering PMV safety oversight. Under this assumption, these authorities have then allocated their own limited resources to other priorities rather than using them to provide PMV oversight. The Coast Guard has traditionally described the system for providing marine safety as a series of “safety nets.” The primary safety net is provided by the owner as the entity responsible for ensuring that a safe environment is provided to its customer, the public. The next two in the series of safety nets are provided by the owner’s flag State

Analysis 69 Marine Accident Report (or its representative when the vessel is foreign) and by the public safety representative(s), such as the Coast Guard. In the case of the Admiral, the Safety Board reviewed the safety net system in a similar fashion, considering that the primary safety responsibility lies with the owner, that the next levels of safety are provided by the local jurisdiction and the State, and that the remaining safety assurances are provided by the Federal authorities (the Coast Guard and USACE). This investigation looked at the safety of these vessels in a hierarchical format, starting with the responsibilities of the owner and ending with an assessment of the Coast Guard’s policy on PMVs from a national perspective. Owner’s Safety Management of the President Casino on the Admiral President Casinos, as the owner of the Admiral, had the fundamental responsibility to ensure the safety of the PMV and all people on board it. President Casinos also had the corporate control, knowledge, and resources to provide an effective safety management system but failed to do so, unnecessarily exposing the Admiral and people on board to waterborne and current-related risks that none of the stakeholders were prepared to meet. President Casinos was the entity most knowledgeable about its business and the unique aspects of operating a casino on a floating platform in the Mississippi River and was, therefore, best placed to provide the primary safety net for the PMV and its occupants. President Casinos, Inc., operated other passenger vessels in St. Louis under the same environment and river conditions and was knowledgeable about and experienced with Coast Guard inspection and certification requirements for passenger vessels, including the provisions concerning such safety features as lifesaving equipment, staffing requirements, marine crew qualifications, and vessel operational requirements. President Casinos was more knowledgeable than any other organization about the operation of the Admiral, including its history of accidents and near misses while located in St. Louis Harbor. President Casinos was also familiar with the local and State jurisdictional authorities and the local codes and standards with which the Admiral had to comply. President Casinos, Inc., had the corporate responsibility to establish risk reduction measures to provide a safe operation. President Casinos, Inc., was in the best position to understand the risks associated with marine operations because the company operated several passenger vessels and was involved with the daily operation of the Admiral. President Casinos, Inc., also had access to the appropriate resources (such as capital, personnel, PVA membership, and so forth) to help mitigate the risks, and the company controlled the corporate decision-making process. President Casinos, Inc., however, did not take any safety action beyond complying with the regulatory requirements. An effective safety management system is essential for the safe operation of a high-capacity passenger vessel (regardless of whether it is in permanently moored status). Such a system should, at a minimum: • Describe the functions of the staff during an emergency, • Require staff training in their respective emergency functions, • Provide adequate fire and lifesaving equipment for passengers and staff,

Analysis 70 Marine Accident Report • Provide appropriate shore notification, • Provide internal communication with staff and passengers, • Provide the capacity for communication with emergency responders, • Provide for the safe evacuation of occupants or an adequate area of safe refuge aboard the vessel, • Include regular drills, and • Provide management oversight of the process to ensure compliance and system viability. President Casinos did not have a safety management system to ensure that company responsibilities and authority were defined, risks were identified, contingency plans were prepared, staff emergency training was provided, proper safety and response equipment was available, and local responders were involved. A safety management system would have also provided for a designated individual to oversee and coordinate emergency training drills and for an audit to be conducted to ensure compliance with company safety policies and procedures. The company did not have an effective safety management system in place before it put the Admiral in service, nor did it implement one once the PMV was in operation. Risk assessment is an essential part of any effective safety management system. President Casinos, however, did not conduct a comprehensive risk assessment before placing the vessel in service. The owner conducted only a limited risk assessment to evaluate the possibility of locating a protective cell upstream of the Admiral. USACE, urged by the Coast Guard, had required during the site permit review process that such a protective cell be installed because of concern that the Admiral had previously been struck by tows while at that location. The professional engineering firm hired by President Casinos determined that a protective cell placed at the bow of the Admiral on the outboard side would present a safety problem; that is, the firm’s report stated that, under such a cell arrangement, loose barges would be directed into the vessel rather than away from it. Neither the owner nor the engineering firm (which had cited three previous allisions of the Admiral by upbound tows) then considered what type of protection would be necessary to keep loose barges from striking the Admiral. Instead, President Casinos simply decided that because the engineer’s report found that the proposed solution of using a single protective cell had negative safety implications, the requirement should be rescinded. Therefore, despite its knowledge of previous allisions, President Casinos made no effort to mitigate the risk to the Admiral from breakaway tows or even from debris or ice flows. Had President Casinos employed risk reduction measures, the Admiral’s ability to survive waterborne and current-related risks would have increased. Possible risk reduction methods included:

Analysis 71 Marine Accident Report • Relocating the vessel to an area that eliminates the chance of collisions, • Installing barriers, such as fendering or crush zones, to absorb the dynamic loading from collisions with other vessels or floating debris, • Restricting vessel operations during high-risk conditions, • Developing alternate escape routes for use in emergencies, and • Training the staff in crowd management, as is done on large cruise liners. The operation of a high-capacity floating casino like the Admiral shares many operational elements and safety concerns with high-capacity passenger vessels that operate in the same area. President Casinos, Inc., was a member of the PVA and had access to the PVA’s experience and support in the safe operation of high-capacity passenger vessels. A President Casinos employee, in fact, drafted the chapter on “Emergency Drills and Contingency Planning” for the PVA’s Risk Management Manual for Passenger Vessels. The chapter cites specific examples of conditions in St. Louis Harbor for use in developing passenger vessel marine risk contingency plans covering events such as collisions, taking on water, losing propulsion and requiring harbor tug assistance, moving injured people ashore, and transferring firefighters from shore to a vessel. The Admiral is subject to the same types of risks. President Casinos developed a contingency plan for the PMV (the Admiral’s Emergency Evacuation Procedures). However, the risks identified in the plan did not include all the waterborne and current- related risks and factors cited in the PVA Risk Management Manual for Passenger Vessels. The Safety Board concludes that President Casinos had the responsibility, knowledge, and experience with passenger vessel operations, previous accident history, and contingency planning, as well as the necessary management control and opportunity, to provide an effective safety management system for the Admiral but failed to do so. Therefore, the Safety Board believes that President Casinos should develop and implement a safety management system for the Admiral that anticipates and provides appropriate means of responding to all foreseeable emergencies. The Safety Board also believes that President Casinos should site the Admiral in a location in which it is protected from waterborne and current-related risk events, including breakaways, allisions, sinking, capsizing, etc. Local and State Oversight of Permanently Moored Vessels in St. Louis Harbor The local and State jurisdictional authorities for St. Louis Harbor did not provide adequate marine safety oversight of the owners’ responsibility to assess and mitigate waterborne and current-related risks to the local PMVs and all people on board them. At the time of the Admiral accident, local jurisdictional authorities, such as the city’s public safety and fire departments, had immediate oversight responsibility for the PMVs in St. Louis Harbor. The local authorities provided the first level of regulatory oversight for PMV owners and the first safety net under PMV operations. The St. Louis

Analysis 72 Marine Accident Report Department of Public Safety believed that it had met its obligation to ensure public safety by reviewing the Admiral’s design plans to ensure that the PMV met the applicable building codes for certain aspects of building structures, such as fire safety (according to the requirements of the BOCA Code), electrical, mechanical, and plumbing requirements. The St. Louis Department of Public Safety also approved the Admiral’s design and evacuation plan for compliance with requirements for emergency exits, emergency lighting, and fire sprinklers, as they would apply to buildings. However, the department did not require the equivalent of below-ground structural elements, such as would be required of a land-based structure, or any additional structural elements to protect the Admiral from the risk of collision. Buildings, when they are designed for public occupancy, are required to have fixed fire exits with clear access to areas of safety. The city required no added features to ensure the long-term integrity of the Admiral’s fire exits. According to its representative, the St. Louis Department of Public Safety was not required to address the siting of the Admiral or marine safety aspects, such as the possibility of the PMV’s breaking away or sinking or whether it might require flooding alarms or emergency pumps and generators. Nor did the city consider the need for lifesaving equipment, because such aspects are not considered during the approval processes for buildings. After the Coast Guard designated the Admiral as a PMV, the city of St. Louis assumed responsibility for its safety. In the absence of Coast Guard involvement, the city had general oversight responsibility for public safety for the entire operation. Yet city authorities did not have a mechanism for regulating the marine safety aspects of the operation of PMVs located in St. Louis Harbor. Local building and safety codes did not address the waterborne and current-related risks and risk reduction measures associated with PMVs in the harbor. The Safety Board therefore concludes that the city of St. Louis did not exercise effective marine safety oversight for the Admiral because the city treated the Admiral as a commercial building on land. The State of Missouri Gaming Commission also placed safety requirements on the operation of the Admiral. In a July 9, 1998, letter to the Safety Board, the Commission stated that it requires its licensees to meet the minimum standards for safety and environment established by the Coast Guard, the USACE, and the Environmental Protection Agency. It also requires that licensed casino PMVs meet Missouri’s fire safety standards, the NFPA’s fire safety standards for the construction and fire protection of marine structures, and the NFPA Life Safety Code. In addition, the Commission requires that the vessel comply with all local fire and safety codes. However, because the Coast Guard did not impose any safety requirements beyond “secure and substantial mooring” of the vessel and because none of the other authorities or standards addressed all the waterborne and current-related risks to which the Admiral was exposed, the Commission’s actions fell short of its intended purpose. The Commission also said in the July 1998 letter that it does not employ safety experts but relies on government agencies with safety standard and inspection expertise.

Analysis 73 Marine Accident Report The Commission recognized that it does not possess the requisite expertise to establish safety standards or to provide safety oversight of the Admiral’s operations. Although the State Gaming Commission required the owner to contract with ABS Marine Services to assess the stability of the Admiral and to periodically inspect its hull and watertight closures to ensure their integrity, ABS Marine Services did not, nor was it requested to, assess the adequacy of the mooring design, fire safety, lifesaving, or any other marine safety systems related to the Admiral’s operation. The Safety Board therefore concludes that the oversight provided by the State of Missouri, as represented by the State Gaming Commission, did not address marine safety systems, such as the PMV’s mooring design, fire safety, and lifesaving capabilities, and did not protect the safety of people on board the Admiral. In the Safety Board’s opinion, city and State authorities should recognize their limitations in marine safety expertise. The Coast Guard is the primary recognized marine safety regulatory authority and should regulate the operation of floating casinos exposed to waterborne and current-related risks. The Safety Board therefore believes that the Coast Guard, the city of St. Louis, and the State of Missouri should either require owners of PMVs to protect their vessels from waterborne and current-related risks so that their PMVs are, in fact, equivalent to buildings or require that the owners obtain Coast Guard certificates of inspection for their PMVs. Also, to ensure that other jurisdictions benefit from information gained during this investigation, the Safety Board believes that the National League of Cities and the American Association of Port Authorities should inform their members of the April 4, 1998, near breakaway of the permanently moored Admiral in St. Louis Harbor and of the waterborne and current-related risks associated with similarly located PMVs. Role of the Coast Guard Tows regularly pass the Admiral’s site on the Mississippi River. In an average year, about 8,000 tows pass through St. Louis Harbor, transporting 80,000 to 85,000 barges. Between January 1989 and April 1999, about 30 barge breakaways took place in St. Louis Harbor. The Admiral, sited below the Eads Bridge, had been struck three times by upriver tows before it was struck by barges from the Anne Holly tow. Thus, based on experience, a future strike was a predictable event. In fact, during the USACE site permit process, the Coast Guard correctly predicted that the Admiral would be struck again. As previously stated, however, when President Casinos subsequently argued that a protective cell was unnecessary, the Coast Guard agreed. Neither the Coast Guard nor President Casinos took any further action to assess and mitigate the risk to the Admiral from a future allision. The fact that the Admiral was hit on April 4, 1998, by barges from the Anne Holly was merely a function of circumstance; any number of breakaway or wayward vessels or objects traveling with the river current could have struck it. The overriding consideration is that the Admiral, as it is currently sited below the Eads Bridge, is vulnerable to allision from breakaway tows and other vessels or objects due to its location.

Analysis 74 Marine Accident Report At the time of the April 1998 accident, Coast Guard policy did not provide local Coast Guard representatives with adequate practical guidance for determining whether a PMV was safely sited. Guidance on PMV siting could provide information on the relative risks of various types of site locations. Such risks might include those associated with the outside and inside bends of rivers, obstructions such as bridge piers, the water depth, and the natural and artificial protective barriers in the vicinity. At its location directly below the Eads Bridge in the busy Mississippi River, the Admiral was at risk from an allision and the potential consequences of that event. Therefore, the Safety Board concludes that the Admiral should not have been sited in a location where it was subject to waterborne and current-related risk events, including breakaways, which could have put more than 2,000 lives in jeopardy. PMVs, as they are treated in existing Coast Guard policy, are unique in that they possess certain characteristics of both vessels and buildings, so their risks do not fall entirely into either category. A vessel, as the term is used in the Coast Guard’s enabling statute, 46 U.S.C. Subtitle II, is defined as a craft “used or capable of being used as a means of transportation on the water” (46 U.S.C. 2101[45], citing 1 U.S.C. 3). The Coast Guard’s authority to regulate design, construction, equipment, staffing, and inspection of vessels derives from Subtitle II. Most vessels, because they are subject to waterborne and current-related risks, require Coast Guard inspection and certification under 46 U.S.C. Subtitle II. Thus, according to the Coast Guard, if a craft is no longer “used or capable of being used as a means of transportation on the water,” it is not subject to this Coast Guard inspection authority. Under such a flexible, fact-bound test, and given the wide disparity of judicial precedent on the subject, the Coast Guard had considerable discretion in its categorization of PMVs. The Coast Guard chose to treat all PMVs, including the Admiral, as “substantially land structures,” which, once sited, were the regulatory responsibility of the land jurisdiction to which they were moored. And, although the Coast Guard has extensive and broad authority under the PWSA to act to safeguard navigation and protect waterfront facilities and the marine environment, the Coast Guard did not exercise its authority to protect PMV occupants. Therefore, the Safety Board concludes that the Coast Guard has extensive discretionary authority over PMVs in navigable waters, such as the Admiral, but has chosen not to fully exercise it. It is noteworthy that several large casino boats have been placed in moats in shallow water, where they are in no danger of sinking or capsizing, and are surrounded by enclosures so that other vessels could never allide with them. These “vessels” are not used in transportation but are nonetheless considered “vessels” under the Coast Guard’s inspection authority and are required to meet Coast Guard safety standards, including the carriage of life preservers for all people on board. It is completely incongruous that these PMVs, which are not vulnerable to waterborne and current-related risks, are under Coast Guard safety oversight while the Admiral, which is vulnerable to such risks, is not. The policy issued by Coast Guard headquarters regarding PMVs—the Coast Guard’s PMV safety net—not only failed to recognize the risk to the Admiral from breakaways, it failed to recognize that the Admiral and similar vessels would be exposed

Analysis 75 Marine Accident Report to other serious waterborne and current-related risks. Because the Admiral was exposed to many of the same risks as vessels in navigation, it was also vulnerable to being struck by passing marine traffic, to sinking, and to capsizing. The Admiral, in effect, fell through the safety nets on April 4, 1998. A major disaster may have been narrowly averted by the Admiral’s last mooring line holding and the Anne Holly captain acting to help stabilize the Admiral against the riverbank. The Safety Board considers that the Coast Guard PMV policies, and the decisions that were made based on those policies, failed to adequately protect the Admiral from the risk of a marine accident. In essence, the Coast Guard PMV policy stated that removing the vessel from active navigation and attaching it to land by mooring lines changed the basic character of the Admiral so that it was no longer a vessel and ceased to be subject to Coast Guard inspection jurisdiction. The Safety Board questions the wisdom of this policy and of its application to the Admiral in particular. The Coast Guard was the only public safety organization in St. Louis Harbor with the knowledge and experience to regulate the public safety of PMVs at risk from waterborne and current-related events. Although the Admiral was moored in a stationary position, it was still exposed to many of the same hazards to which it would have been exposed were it a vessel in active navigation. Hundreds of towboats and thousands of barges passed close by the Admiral every year. These passings were made in all weathers and at all times of the day and night. Further, when changing conditions made navigation riskier, as when the river reached flood stage, the risks to the Admiral likewise increased. The Admiral was vulnerable to being struck by a passing vessel, and, if holed as a result, it could have flooded, sunk, capsized, or broken away. An accident involving the Admiral caused by a waterborne or current-related risk could easily endanger 2,000 or more lives. Yet the Coast Guard PMV policy at the time of the Admiral accident did not consider anything other than the mooring system in determining whether the vessel would be granted PMV status. Instead of protecting PMVs from waterborne and current-related risk events, the Coast Guard’s policy focused on the adequacy of the mooring arrangement. However, a mooring system, no matter how well engineered, cannot compensate for the consequences of locating a PMV at a risky site. As the accident demonstrated and the NFESC mooring study confirmed, the Admiral’s mooring system, which was designed by a professional engineer, was, as a consequence of the allision with the Anne Holly’s barges, unable to keep the Admiral and its entry barge secure in position against the riverbank. After the allision, without the gangways in place, emergency egress from the PMV was jeopardized. Had the circumstances of this accident been different and had the Admiral been set adrift in the river during flood stage, the risk to the Admiral and the people on board could have been extreme. As the Coast Guard determined in its review of PMV safety, 68 percent of waterway accidents occurred at high-risk locations, making location the single most important factor in PMV waterborne and current-related risk. Nevertheless, the Coast Guard PMV policy failed to account for and remedy the Admiral’s risky location through

Analysis 76 Marine Accident Report site selection or other means. The Safety Board therefore concludes that the Coast Guard PMV policy, as it existed at the time of the accident, did not adequately provide for the safety of the Admiral or its patrons. As a result of the Bright Field, Admiral, and less prominent accidents involving PMVs, the Coast Guard reviewed its PMV policy. In 1999, the Coast Guard revised the policy to improve and standardize the way the Coast Guard treats PMVs. The new policy requires all local Coast Guard OCMIs to re-evaluate the safety of all existing PMV designations within their zones, using the risk assessment and reduction methodology developed by the Coast Guard’s QAT for PMVs. The Safety Board reviewed the new Coast Guard policy on PMVs and found it to be an improvement over the policy used at the time of the Admiral accident. The Safety Board is pleased with this Coast Guard action but considers it does not go far enough to ensure the safety of PMV operations in U.S. navigable waters. The new policy does not change the basic premise of the Coast Guard’s treatment of PMVs at risk from waterborne and current-related events—that local and State authorities will eventually have safety and enforcement responsibility over these vessels. Expecting local and State authorities to adequately oversee and regulate PMV safety regarding waterborne and current-related risks is unrealistic because building safety considerations do not address issues such as collision potential, mooring requirements, or waterway safety factors. Therefore, the Safety Board concludes that the Coast Guard’s new policy on PMVs is inadequate because it still fails to provide for the safety of people on PMVs subject to waterborne and current- related risk events, including breakaways, allisions, sinking, and capsizing. Consequently, the Safety Board believes that the Coast Guard should not allow PMVs to be sited in locations in which they are not protected from waterborne and current-related risk events, including breakaways, allisions, sinking, capsizing, etc.

77 Marine Accident Report Conclusions Findings

1. The Anne Holly had sufficient horsepower to successfully navigate upbound through

St. Louis Harbor on the night of the accident, and the vessel did not experience any propulsion or steering system failure.

1. The captain of the Anne Holly was sufficiently qualified, experienced, and skillful to

serve as captain on the night of the accident, and his prescription medication did not negatively affect his performance.

1. Weather was not a factor in this accident.
2. No sudden rise in river level interfered with the forward movement of the Anne Holly

tow.

1. Given the difficult navigation task, the darkness, the flood conditions (which resulted

in a swift current and minimal vertical clearance at the Eads Bridge), and the lack of a helper boat, the captain should have chosen to pursue another option on the evening of April 4, 1998.

1. The captain of the Anne Holly would have been better able to make prudent decisions

concerning the operation of his tow, and this accident might thereby have been prevented, had American Milling, L.P., developed and implemented an effective safety management system.

1. The lack of a safety management system requirement for all U.S. towing industry

companies represents a threat to waterway safety.

1. The tow struck the Eads Bridge because of an error in judgment or a lapse of

attention on the part of the Anne Holly captain, which resulted in the tow’s misalignment.

1. Glare from shoreside lighting may have impaired the Anne Holly captain’s night

vision and may have been a factor in his failure to align the tow properly for transit through the Eads Bridge.

1. Because alcohol testing could not be accomplished until rescue operations were

complete, the Safety Board is not able to eliminate the possibility that alcohol use may have contributed to the accident.

1. Because postaccident testing for illicit drugs did not take place until the day

following the accident, the Safety Board is not able to eliminate the possibility that illicit drug use may have contributed to the accident.

Conclusions 78 Marine Accident Report

1. Given the results of postaccident testing, together with the review of the captain’s

videotaped interview, and the review of his medical records, the Safety Board found no evidence that the Anne Holly captain was impaired by drugs or alcohol at the time of the accident.

1. Although the Anne Holly captain had the opportunity to obtain about 8 hours of sleep

in a 24-hour period, the sleep would necessarily have been obtained on a split schedule.

1. Insufficient research is available on the effects of split-sleep schedules on the

performance of inland towing industry operators for the National Transportation Safety Board to determine whether the Anne Holly captain was appropriately rested.

1. Had the President Casino on the Admiral broken free as a result of the allision, the

consequences could have been catastrophic, because it could have resulted in the sinking or capsizing of the vessel, which would have placed more than 2,000 lives in jeopardy.

1. President Casinos’s failure to conduct fire drills and the city of St. Louis’s failure to

enforce fire drill requirements for the President Casino on the Admiral contributed to a lack of casino staff preparedness to deal with emergency situations.

1. Patrons on board the President Casino on the Admiral did not receive sufficient

safety information in the aftermath of the barge allisions to help prevent panic and confusion.

1. President Casino on the Admiral security personnel and other staff members were

not adequately trained and drilled in crowd management techniques and therefore were not successful in ensuring that the vessel’s patrons and staff behaved in a calm and orderly fashion in the aftermath of the April 4, 1998, accident.

1. Formal training in crowd management techniques for staff on all operating

permanently moored vessels that are accessible to the public would enhance safety on board permanently moored vessels.

1. The evacuation of the President Casino on the Admiral was jeopardized by the lack

of contingency plans for an emergency egress when the standard gangways were not available.

1. Although local emergency response agencies arrived on the scene in a timely manner,

they were not prepared to rescue patrons and staff from the President Casino on the Admiral after the standard gangways to the vessel became unusable, which delayed the evacuation and could have put patrons and staff in jeopardy.

1. The St. Louis Harbor Emergency Response Plan did not sufficiently prepare

emergency response agencies to deal with an emergency involving the rescue of a large number of people on or in the Mississippi River.

Conclusions 79 Marine Accident Report

1. Laclede Gas Company’s emergency responders had not been adequately prepared to

stop the uncontrolled flow of natural gas resulting from this accident.

1. At the time of the accident, the President on the Admiral’s natural gas shutoff service

valve was not readily accessible.

1. The flow from the President Casino on the Admiral’s ruptured natural gas supply line

was not secured in a timely manner, and such a delay could be hazardous should such an incident recur.

1. The President Casino on the Admiral should not have been sited in a location where

it was subject to waterborne and current-related risks, including breakaways, which could have put more than 2,000 lives in jeopardy.

1. President Casinos had the responsibility, knowledge, and experience with passenger

vessel operations, previous accident history, and contingency planning, as well as the necessary management control and opportunity, to provide an effective safety management system for the President Casino on the Admiral but failed to do so.

1. The city of St. Louis did not exercise effective marine safety oversight for the

President Casino on the Admiral because the city treated the President Casino on the Admiral as a commercial building on land.

1. The oversight provided by the State of Missouri, as represented by the State Gaming

Commission, did not address marine safety systems, such as the permanently moored vessel’s mooring design, fire safety, and lifesaving capabilities, and did not protect the safety of people on board the President Casino on the Admiral.

1. The U.S. Coast Guard has extensive discretionary authority over permanently

moored vessels in navigable waters, such as the President Casino on the Admiral, but has chosen not to fully exercise it.

1. The U.S. Coast Guard permanently moored vessel policy, as it existed at the time of

the accident, did not adequately provide for the safety of the President Casino on the Admiral or its patrons.

1. The U.S. Coast Guard’s new policy on permanently moored vessels is inadequate

because it still fails to provide for the safety of people on permanently moored vessels subject to waterborne and current-related risk events, including breakaways, allisions, sinking, and capsizing. Probable Cause The National Transportation Safety Board determines that the probable cause of the ramming of the Eads Bridge in St. Louis Harbor by barges in tow of the Anne Holly and the subsequent breakup of the tow was the poor decision-making of the captain of the

Conclusions 80 Marine Accident Report Anne Holly in attempting to transit St. Louis Harbor with a large tow, in darkness, under high current and flood conditions, and the failure of the management of American Milling, L.P., to provide adequate policy and direction to ensure the safe operation of its towboats. The National Transportation Safety Board also determines that the probable cause of the near breakaway of the President Casino on the Admiral was the failure of the owner, the local and State authorities, and the U.S. Coast Guard to adequately protect the permanently moored vessel from waterborne and current-related risks.

81 Marine Accident Report Recommendations New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the U.S. Coast Guard: Seek authority to require domestic towing companies to develop and implement an effective safety management system to ensure adequate management oversight of the maintenance and operation of all towing vessels. (M-00-10) Conduct a study of the lighting in St. Louis Harbor to determine whether the light level impairs nighttime navigation and take corrective action as necessary. (M-00-11) Take the following three actions under your Ports and Waterways Safety Act authority: a) require that the owners of all operating permanently moored vessels that are accessible to the public provide and document formal training in crowd management techniques for all personnel on such vessels; b) require that periodic drills be conducted to reinforce the crowd management training; and c) require that the vessel owners amend their emergency plans to reflect crowd management techniques. (M-00-12) Take the lead, in cooperation with appropriate port and waterways stakeholders, to develop contingency plans to assist in marine-related incidents, such as search and rescue operations, fires, capsizings, or sinkings involving passenger vessels or permanently moored public facilities within St. Louis Harbor. Also, amend the St. Louis Harbor Emergency Response Plan to reflect these changes. (M-00-13) Conduct, in cooperation with the States of Missouri and Illinois and the cities of St. Louis and East St. Louis, regular drills to exercise the contingency plans for a variety of different marine scenarios, such as stopping breakaway vessels or rescuing large numbers of people from the Mississippi River. (M-00-14) Either require owners of permanently moored vessels to protect their vessels from waterborne and current-related risks so that their permanently moored vessels are, in fact, equivalent to buildings or require that the owners obtain U.S. Coast Guard certificates of inspection for their permanently moored vessels. (M-00-15)

Recommendations 82 Marine Accident Report Do not allow permanently moored vessels to be sited in locations in which they are not protected from waterborne and current-related risk events, including breakaways, allisions, sinking, capsizing, etc. (M-00-16) To the Research and Special Programs Administration: Require corrective action as appropriate to ensure that pipeline operators have the means to shut off the flow of natural gas to permanently moored vessels in a timely manner, even during periods of high-water conditions. (P-00-14) To the State of Missouri: Conduct, in cooperation with the U.S. Coast Guard, the State of Illinois, and the cities of St. Louis and East St. Louis, regular drills to exercise the contingency plans for a variety of different marine scenarios, such as stopping breakaway vessels or rescuing large numbers of people from the Mississippi River. (M-00-17) Either require owners of permanently moored vessels to protect their vessels from waterborne and current-related risks so that their permanently moored vessels are, in fact, equivalent to buildings or require that the owners obtain U.S. Coast Guard certificates of inspection for their permanently moored vessels. (M-00-18) To the State of Illinois: Conduct, in cooperation with the U.S. Coast Guard, the State of Missouri, and the cities of St. Louis and East St. Louis, regular drills to exercise the contingency plans for a variety of different marine scenarios, such as stopping breakaway vessels or rescuing large numbers of people from the Mississippi River. (M-00-19) To the City of St. Louis: Establish and implement oversight procedures to ensure that owners of operational permanently moored vessels that are accessible to the public in St. Louis Harbor conduct and document fire drills. (M-00-20) Take the following three actions: a) require that the owners of all operating permanently moored vessels that are accessible to the public in St. Louis Harbor provide and document formal training in crowd management techniques for all personnel on such vessels; b) require that periodic drills be conducted to reinforce the crowd management training; and c) require that the vessel owners amend their emergency plans to reflect crowd management techniques. (M-00-21)

Recommendations 83 Marine Accident Report Ensure that harbor emergency responders develop, in conjunction with local permanently moored vessel owners, including President Casinos, Inc., and the McDonald’s Corporation, contingency plans for boarding and exiting the vessels when the standard means of egress become unusable and amend the St. Louis Harbor Emergency Response Plan to reflect the new procedures. (M-00-22) Conduct, in cooperation with the U.S. Coast Guard, the States of Missouri and Illinois, and the city of East St. Louis, regular drills to exercise the contingency plans for a variety of different marine scenarios, such as stopping breakaway vessels or rescuing large numbers of people from the Mississippi River. (M-00-23) Either require owners of permanently moored vessels to protect their vessels from waterborne and current-related risks so that their permanently moored vessels are, in fact, equivalent to buildings or require that the owners obtain U.S. Coast Guard certificates of inspection for their permanently moored vessels. (M-00-24) To the City of East St. Louis: Conduct, in cooperation with the U.S. Coast Guard, the States of Missouri and Illinois, and the city of St. Louis, regular drills to exercise the contingency plans for a variety of different marine scenarios, such as stopping breakaway vessels or rescuing large numbers of people from the Mississippi River. (M-00-25) To the National League of Cities (M-00-26): To the American Association of Port Authorities (M-00-27): Inform your members of the April 4, 1998, near breakaway of the permanently moored President Casino on the Admiral in St. Louis Harbor and of the waterborne and current-related risks associated with similarly located permanently moored vessels. To the American Gas Association (P-00-15 and P-00-16): To the American Public Gas Association (P-00-17 and P-00-18): Advise your members of the natural gas leak that resulted from the April 4, 1998, accident affecting the President Casino on the Admiral in St. Louis Harbor and recommend that they participate in port contingency plan drill exercises involving permanently moored vessels that are supplied with natural gas. Urge your members to take corrective action as appropriate to ensure that they can shut off the flow of natural gas to permanently moored vessels in a timely manner, even during periods of high-water conditions.

Recommendations 84 Marine Accident Report To President Casinos, Inc.: Develop guidelines for making periodic public address announcements during emergencies to provide direction and ensure patron safety. (M-00-28) Require and document that all President Casino on the Admiral personnel receive formal training in crowd management techniques, and conduct periodic drills to reinforce this training so that vessel staff can perform effectively in an emergency. Also, amend the President Casino on the Admiral’s Emergency Evacuation Procedures to reflect crowd management techniques. (M-00-29) Develop and exercise contingency plans for emergency egress from the President Casino on the Admiral to ensure that occupants can exit the vessel in a timely and orderly manner when the standard means of egress become unusable and amend the President Casino on the Admiral’s Emergency Evacuation Procedures to reflect the new procedures. (M-00-30) Develop and implement a safety management system for the President Casino on the Admiral that anticipates and provides appropriate means of responding to all foreseeable emergencies. (M-00-31) Site the President Casino on the Admiral in a location in which it is protected from waterborne and current-related risk events, including breakaways, allisions, sinking, capsizing, etc. (M-00-32) To the Laclede Gas Company: Require that your emergency response teams participate in port contingency plan drill exercises involving permanently moored vessels that are supplied with natural gas. (P-00-19) To American Milling, L.P.: Develop and implement a safety management system similar to the Responsible Carrier Program used by the American Waterways Operators; the system should establish effective policies and procedures to enhance the safety of vessel operations. (M-00-33)

Recommendations 85 Marine Accident Report Previously Issued Recommendations Classified in This Report To the U.S. Coast Guard: In conjunction with the towing vessel industry, develop and implement an effective safety management code to ensure adequate management oversight of the maintenance and operation of vessels involved in oil transportation by barges. (M-98-104) Safety Recommendation M-98-104 (previously classified “Open–Unacceptable Response”) is classified “Closed–Unacceptable Action/Superseded” in the “Captain’s Decision-making” section of this report. It is superseded by Safety Recommendation M-00-10, issued in this report. BY THE NATIONAL TRANSPORTATION SAFETY BOARD James E. Hall Chairman John A. Hammerschmidt Member John J. Goglia Member George W. Black, Jr. Member Carol J. Carmody Member Adopted: September 8, 2000

87 Marine Accident Report Appendix A Investigation and Hearing The National Transportation Safety Board was notified of this accident early in the morning of April 5, 1998, and launched a four-person investigative team that arrived in St. Louis, Missouri, in late afternoon. The team consisted of an investigator-in-charge and survival factors, human performance, and engineering factors investigators. That evening, the Captain of the Port of the U.S. Coast Guard Marine Safety Office in St. Louis briefed the team. A Board Member arrived on scene on April 7. The Safety Board investigated the accident under the authority of the Independent Safety Board Act of 1997, according to Safety Board rules. Team members conducted interviews from April 7 through 10, and on April 15. The team viewed the damage on the President Casino on the Admiral and interviewed crewmembers of the towing vessel Anne Holly, including the captain, pilot, mate, deckhands, and chief engineer. The team interviewed representatives from the U.S. Army Corps of Engineers and the Coast Guard, the master on watch of the Casino Queen, St. Louis emergency response personnel, and an American Bureau of Shipping surveyor. Safety Board investigators also spoke with personnel from the President Casino on the Admiral, including the Missouri State gaming officer, the senior shift manager who had been on duty when the accident took place, the vessel’s former marine manager, and the casino manager. The designated parties to the Safety Board’s on-scene investigation were the Coast Guard; President Casinos, owner of the Admiral; and American Milling, L.P., owner of the Anne Holly. A public hearing on this accident was held in St. Louis, Missouri, on July 23 and 24, 1998. The parties to the public hearing were the Coast Guard; President Casinos; the city of St. Louis, Missouri; and the U.S. Army Corps of Engineers.

88 Marine Accident Report Appendix B Damage to Anne Holly Barges Barge Hull Damage Cargo Damage SB 15B $35,000 $30,000 CGB 219B $20,000 -0- PIN 348 $100,000 $125,000 ABC 767 $150,000 $15,000 MWO 211 $10,000 -0- Total $315,000 $170,000

89 Marine Accident Report Appendix C Characteristics of Barges in Anne Holly Tow In order, forward to aft. NAME LENGTH (feet) BEAM (feet) DRAFT (estimated) CARGO TONNAGE CARGO TYPE Port Position ABC 767 195 35 6 ft., 6 1/2 in. 981 Cottonseed PIN 348 200 35 9 ft., 5 in. 1,638 Fertilizer SUN 363 200 35 9 ft., 3 in. 1,638 Fertilizer SB 15B 200 35 9 ft., 5 in. 1,643 Clay RM 41 200 35 9 ft., 8 1/2 in. 1,696 Fertilizer Center Position MWO 211 195 35 6 ft., 9 1/2 in. 1,037 Cottonseed CGB 277 200 35 9 ft. 1,553 Fertilizer CSV 9605 200 35 9 ft., 1 1/2 in. 1,575 Fertilizer CMM 2 200 35 9 ft., 4 in. 1,626 Fertilizer PMC 8101 200 35 9 ft., 7 1/2 in. 1,682 Fertilizer Starboard Position ITEL 206 200 35 1 ft., 9 in. empty N/A CGB 219B 200 35 1 ft., 9 in. empty N/A FIC 526 195 35 8 ft., 11 in. 1,476 Fertilizer TCKM 1 200 35 9 ft., 1/2 in. 1,563 Fertilizer Total Total Cargo 18,108

90 Marine Accident Report Appendix D Mooring Wires for the President Casino on the Admiral The President Casino on the Admiral (Admiral) was moored with 10 mooring wires: • Number 1 wire: (1½ inch diameter) Attached to the facility’s entry barge and to the anchor upstream of the structure. This wire was put into service 23 months before the accident. • Number 2 wire: (1¼ inch diameter) Attached to a deadman upstream from the entry barge. This wire was put into service 55 months before the accident. • Number 3 wire: (11/8 inch diameter) Attached to a deadman at the forward end of the entry barge, forward of the employee gangway. This wire was put into service 22 months before the accident. • Numbers 4 and 5 wires: (11/8 inch diameter) Attached to a deadman on the levee parallel to the center gangway with one wire on each side. These wires were put into service 26 and 2 months, respectively, before the accident. • Number 6 wire: (11/8 inch diameter) Attached to the entry barge and a deadman downstream of the entry barge. This wire was put into service 55 months before the accident. • Number 7 wire: (1½ inch diameter) Attached to the entry barge and the anchor downstream of the structure. This wire was put into service 14 months before the accident. • Numbers 8 and 9 wires: (11/8 inch diameter) Attached to the Admiral bow and deadmen upstream of the Eads Bridge. These wires were put into service 12 and 24 months, respectively, before the accident. • Number 10 wire: (11/8 inch diameter) This was a breast wire attached to the Admiral’s bow and to a deadman upstream of the Eads Bridge. This wire was put into service 48 months before the accident. Before the “Great Flood of 1993,” the Admiral had eight mooring wires. During the first rise of the 1993 flood waters, the chief engineer on the Admiral and the Chief of Marine Operations decided to add the head and bow wires to the Admiral mooring. The St. Louis gage reached 49.5 feet on August 1, 1993. From the beginning of April through early October 1993, St. Louis experienced flood waters (over 30 feet on the gage) except for a period from the end of May to the end of June when the river stage was at high water. A permanently moored heliport, the permanently moored Burger King barge, and a minesweeper were damaged and broke away from their moorings in 1993. The Admiral, the Gateway Riverboat Cruises barge (and the two small passenger vessels moored to it), the Robert E. Lee, and the McDonald’s riverboat remained secure to their moorings.

91 Marine Accident Report Appendix E Coast Guard List of PMVs in the United States List of Permanently Moored Vessels as of November 20, 1998 PORT VNAME MAX PAS LATITUDE LONGITUDE RIVER MILE 1 BALTIMORE EX USCGC TANEY NA PATAPSCO RIVER 2 BALTIMORE TORSK NA PATAPSCO RIVER 3 BALTIMORE CHESAPEAKE NA PATAPSCO RIVER 4 BALTIMORE CONSTELLATION NA PATAPSCO RIVER 5 BOSTON MAYFLOWER II (FRAZIER PIER) 75 PLYMOUTH, MA 6 BOSTON DISCOVERY (LONG WHARF) 1500 BOSTON, MA 7 BOSTON MERRIMAC QUEEN (BURROUGH’S) 150 BOSTON, MA 8 BOSTON FORT WARREN (LONG WHARF) 342 BOSTON, MA 9 BUFFALO USS CROAKER 40 BUFFALO RIVER 0.9 10 BUFFALO USS SULLIVANS 150 BUFFALO RIVER 0.9 11 BUFFALO USS LITTLE ROCK 600 BUFFALO RIVER 0.9 12 CHICAGO COLUMBIA YACHT CLUB 500 N415303 W0873635 13 CHICAGO USS SILVERSIDES 40 N431348 W0862000 14 CHICAGO IDLER 150 N422418 W0861626 15 CLEVELAND USS COD 72 N413038 W814130 16 CLEVELAND S/S/WILLIAM G MATHER 125 N413040 W814147 17 CLEVELAND HORNBLOWERS 225 N413038 W814129 18 CORPUS CHRISTI LANDRY’S RESTAURANT 200 N27477 W097235 19 DULUTH S/S WILLIAM A IRVING 100 20 DULUTH M/V LAKE SUPERIOR 40 21 DULUTH S/S EDNA G 40 22 GUAM ASHORE RESTAURANT SAIPAN 23 GUAM REEF WALKER GUAM 24 HAMPTON ROADS DISCOVERY 25 N37125 W76468 JAMESTOWN ISLAND 25 HAMPTON ROADS JAMES RIVER RESERVE FLEET UNK N3768 W76389 JAMES RIVER 26 HAMPTON ROADS HUNTINGTON 10 N36506 W76176 ELIZABETH RIVER 27 HONOLULU FALLS OF CLYDE 300 HONOLULU, HI 28 HONOLULU USS BOWFIN 70 PEARL HARBOR 29 HONOLULU BRIG CARTHAGINIAN 50 LAHAINA, MAUI, HI 30 HUNTINGTON W.P. SNYDER

MUSKINGUM RIVER 0.5 31 HUNTINGTON BECKY THATCHER

MUSKINGUM RIVER 0.3 32 HUNTINGTON SHOWBOAT MARINA

N38241 W082333 OHIO RIVER 305 33 JACKSONVILLE LLOYD’S RESTAURANT 30 CAPE CANAVERAL 34 JACKSONVILLE PROFESSIONAL OFFICE COMPLEX 50 TAVARES, FL 35 LA/LB NAUTICAL HERITAGE MUSEUM 150 NEWPORT HARBOR 36 LA/LB SCORPION (RUSSIAN SUB) 100 37 LA/LB QUEEN MARY 1000 SAN PEDRO BAY 38 LONG ISLAND REGINA MARS 50 GREENPORT, NY 39 LONG ISLAND NANTUCKET 40 BRIDGEPORT, CT 40 LONG ISLAND CHARLES MORGAN 100 MYSTIC, CT 41 LONG ISLAND JOSEPH CONRAD 50 MYSTIC, CT 42 LONG ISLAND L.A. DUNTON 50 MYSTIC, CT 43 LONG ISLAND GOV BRYANT (INACTIVE) 30 N4139 W070165 44 LOUISVILLE SHOWBOAT MAJESTIC 233 OHIO RIVER 470 45 LOUISVILLE TOW BOAT ANNIES 400 OHIO RIVER 603.8 46 LOUISVILLE HARVEY’S ON THE RIVER 150 OHIO RIVER 589.9 47 LOUISVILLE FORE & AFT RESTAURANT 300 OHIO RIVER 484 48 LOUISVILLE STAR OF LOUISVILLE LANDING 350 OHIO RIVER 603.7 49 LOUISVILLE THE WHARF 130 OHIO RIVER 558 50 LOUISVILLE MIKE FINK’S 450 OHIO RIVER 470.5 51 LOUISVILLE SLOPPY JOES 233 OHIO RIVER 470 52 LOUISVILLE HOOTER’S 354 OHIO RIVER 470 53 LOUISVILLE REMINGTON’S 350 OHIO RIVER 469.5 54 LOUISVILLE RIVERSIDE 4 60 OHIO RIVER 469 55 LOUISVILLE FOUR SEASONS 250 OHIO RIVER 464 56 LOUISVILLE ANCHOR INN 250 OHIO RIVER 465.5 57 LOUISVILLE BARLEYCORN’S 784 OHIO RIVER 470 60 LOUISVILLE WATERFRONT RESTAURANT 1700 OHIO RIVER 471 61 LOUISVILLE COVINGTON’S LANDING (CLOSED) OHIO RIVER 62 MEMPHIS LAS VEGAS CASINO 1132 N33250 W091040 UMR 63 MEMPHIS JUBILLEE CASINO 1500 N33251 W091040 UMR 64 MEMPHIS LIGHTHOUSE POINT CASINO 1800 N33252 W091040 UMR 65 MIAMI WATERWAY CLIPPER 53 N26500 W080044 66 MIAMI LOBSTER WALK (INACTIVE) 40 N24517 W0804365 67 MIAMI CAPTAIN RUNAGROUND 50 N24335 W0814715 68 MILWAUKEE USS COBIA 35 MANITOWOC RIVER 0.2

Appendix E 92 Marine Accident Report 69 NEW ORLEANS CASINO MAGIC BAY 5000 N30170 W089260 BAY ST LOUIS 70 NEW ORLEANS SHREVE STAR 1925 RED RIVER 277 71 NEW ORLEANS LADY OF THE ISLE 1925 RED RIVER 276 72 NEW ORLEANS QUEEN OF THE RED (INACTIVE) 1850 RED RIVER 276 73 NEW ORLEANS LADY LUCK CASINO 2000 N41322 W090310 UMR 485.5 74 NEW ORLEANS ISLE OF CAPRI 2000 N32200 W090550 LMR 436 75 NEW ORLEANS KING OF THE RED 2930 RED RIVER 276 76 NEW ORLEANS MARY’S PRIZE 1925 RED RIVER 275 77 NEW ORLEANS AMERISTAR CASINO 2000 N32200 W090550 LMR 436 78 NEW ORLEANS RAINBOW CASINO 2000 N32150 W090533 YAZOO RIVER 1 79 NEW ORLEANS HARRAH’S CASINO 2000 N32300 W090124 80 NEW YORK LEHIGH VALLEY RR BRGE79 100 N40403 W074011 81 NEW YORK USS SLATER 0 N42383 W073450 82 NEW YORK BARGE MUSIC 140 N40421 W0730595 83 NEW YORK USS GROWLER 15 N40456 W074001 84 NEW YORK USS INTREPID 3500 N40456 W074001 85 NEW YORK USS EDSON 250 N40456 W074001 86 NEW YORK 3 UNNAMED BARGES 150 N40456 W074001 87 NEW YORK PEKING 200 N40222 W074001 88 NEW YORK AMBROSE LIGHT SHIP 125 N40222 W074001 89 PADUCAH QUEEN OF CLARKSVILLE BRD BRG CUMBERLAND RIVER 125.5 90 PADUCAH CHATTANOOGA STAR BRD PLAT TENNESSEE RIVER 464.5 91 PADUCAH THE STAR BRD PLAT TENNESSEE RIVER 648.3 92 PADUCAH SOUTHERN BELLE BRD BRG TENNESSEE RIVER 464 93 PADUCAH PLAYER’S ISLAND CASINO OHIO RIVER 943.7 94 PADUCAH OPRYLAND RIVER TAXIS BRD BRGE CUMBERLAND RIVER 191 95 PHILADELPHIA OLYMPIA 350 N39565 W075085 DELAWARE RIVER 96 PHILADELPHIA BECUNA 100 N39565 W075085 DELAWARE RIVER 97 PHILADELPHIA HOOTER’S 500 N39575 W075082 DELAWARE RIVER 98 PHILADELPHIA MOSHULU 490 N39564 W075085 DELAWARE RIVER 99 PHILADELPHIA AMERICANA 110 N38570 W074546 CAPE MAY 100 PITTSBURGH REGATTA BEER BARGE 400 OHIO RIVER 0 101 PITTSBURGH SCIENCE CENTER SUB 300 OHIO RIVER 0.5 102 PITTSBURGH GATEWAY CLIPPER 810 MONONGHELA RIVER 0.5 103 PITTSBURGH CAPT ED’S DOCK 650 OHIO RIVER 0.93 104 PITTSBURGH CREWSER’S DOCK 3000 ALLEGHENY RIVER 1.5 105 PORTLAND USS BLUEBACK 100 WILLIAMETT RIVER 13.5 106 PORTLAND DIMILLO’S FLOATING RESTAURANT 700 PORTLAND, ME 107 PORTLAND JOHN WANNAMAKER 200 PORTSMOUTH HARBOR, NH 108 PORTLAND PORTLAND 100 WILLIAMETT RIVER 12.5 109 PORTLAND COLUMBIA 25 WILLIAMETTE RIVER 15 110 PROVIDENCE BIG BOB’S BARGE 111 PROVIDENCE NEW BEDFORD 112 PROVIDENCE LION FISH 113 PROVIDENCE JOE KENNEDY 114 PROVIDENCE HIDDEN SEA 115 PROVIDENCE GOV BRANT (INACTIVE) N4139 W070165 116 PROVIDENCE USS MASSACHUSETTS (INACTIVE) 30 N4139 W070165 117 PUGET SOUND WAWONA 100 N47376 W122202 118 PUGET SOUND COEUR D’ALENE FLOATING GREEN 15 N4741 W11645 119 PUGET SOUND CHALLENGER 12 N47389 W122198 120 PUGET SOUND SKANSONIA 150 N47389 W122198 121 PUGET SOUND USS TURNER JOY 300 N4733 W12239 122 PUGET SOUND EMERALD QUEEN 400 N47158 W122233 123 SAN FRANCISCO CGC RELIEF PORT OF OAKLAND 124 SAN FRANCISCO TELCO HYDE ST PIER 125 SAN DIEGO STAR OF INDIA 450 N32432 W117105 126 SAN DIEGO BERKLEY 1400 N32433 W117105 127 SAN DIEGO CHARLEY BROWN’S 640 N32435 W117113 128 SAN FRANCISCO USS HORNET ALEMADA 129 SAN FRANCISCO ALAMAR SACRAMENTO RIVER 130 SAN FRANCISCO FRESNO PORT OF RICHMOND 131 SAN FRANCISCO RED OAK VICTORY PORT OF RICHMOND 132 SAN FRANCISCO VIRGIN TURGEON SACRAMENTO RIVER 133 SAN FRANCISCO SAN JOAQUIN YACHT CLUB 184 N380100 W1213850 134 SAN FRANCISCO S/V BALCLUTHA 100 N374836 W1222523 135 SAN FRANCISCO M/V EPPLETON HALL 5 N374845 W1222520 136 SAN FRANCISCO S/V C.A. THAYER 50 N374834 W1222518 137 SAN FRANCISCO S/V ALMA 40 N374838 W1222524 138 SAN FRANCISCO M/V HERCULES 20 N374836 W1222522 139 SAN FRANCISCO M/V EUREKA 100 N374833 W1222519 140 SAN FRANCISCO USS PAMPANITO (SS383) 70 N374830 W1222506 141 SAN FRANCISCO M/V DELTA KING 1250 N383430 W1213030 142 SLT ST MARIE MAPLE 23 N45 52 W084 43 143 ST LOUIS RIVERPORT PLAYER’S ISLAND MISSOURI RIVER 32 List of Permanently Moored Vessels as of November 20, 1998 (cont.) PORT VNAME MAX PAS LATITUDE LONGITUDE RIVER MILE

Appendix E 93 Marine Accident Report 144 ST LOUIS GOLDENROD THEATRE BOAT MISSOURI RIVER 29 145 ST LOUIS ST CHARLES CASINO SPT BRGE N37032 W089231 UMR 29.5 146 ST LOUIS PRESIDENT CASINO SPT BRGE N41308 W090332 UMR 482.5 147 ST LOUIS LACROSSE QUEEN PASS BRGE UMR 888 148 ST LOUIS LONGNECKER RESTAURANT N40235 W091225 UMR 364 149 ST LOUIS CADIE HOOPER RESTAURANT N40380 W089400 ILR 162.5 150 ST LOUIS MISSISSIPPI BELLE SPT BRGE N41501 W090110 UMR 518 151 ST LOUIS ARGOSY V SPT BRGE MISSOURI RIVER 731.8 152 ST LOUIS CATFISH BEND SPT BRGE N40363 W091161 UMR 383 153 ST LOUIS PADDLEFORD OFFICE N44560 W093050 UMR 840 154 ST LOUIS NO WAKE CAFE N44560 W093050 UMR 839.8 155 ST LOUIS ROBERT E LEE RESTAURANT N38374 W090106 UMR 179.6 156 ST LOUIS CASINO VESSEL ADMIRAL N38366 W090110 UMR 179.9 157 ST LOUIS ADMIRAL SUPPORT BARGE N38366 W090110 UMR 179.9 158 ST LOUIS GATEWAY SUPPORT BARGE N38374 W090106 UMR 179.6 159 ST LOUIS MACDONALD’S RESTAURANT N38366 W090110 UMR 179.3 160 ST LOUIS CASINO ROCK ISL SPT BRGE N41308 W090332 UMR 482.5 161 TAMPA BAY “SUBMARINE” 60 ST PETE PIER, ST PETE 162 TOLEDO SS WILLIS BOYER 1000 MAUMEE RIVER 5.16 List of Permanently Moored Vessels as of November 20, 1998 (cont.) PORT VNAME MAX PAS LATITUDE LONGITUDE RIVER MILE

94 Marine Accident Report Appendix F Coast Guard February 17, 2000, Letter to the Safety Board on PMVs

Appendix F 95 Marine Accident Report

Appendix F 96 Marine Accident Report

Appendix F 97 Marine Accident Report

Appendix F 98 Marine Accident Report

99 Marine Accident Report Appendix G Coast Guard PMV Initial Risk Assesment Form

100 Marine Accident Report Appendix H Conclusions and Recommendations of the QAT for PMVs

Appendix H 101 Marine Accident Report

Appendix H 102 Marine Accident Report

Appendix H 103 Marine Accident Report

104 Marine Accident Report Appendix I Draft Coast Guard Marine Safety Manual Change

Appendix I 105 Marine Accident Report

Appendix I 106 Marine Accident Report

Appendix I 107 Marine Accident Report

Appendix I 108 Marine Accident Report

FD07207 ｜ 1998_美国_NTSB_MAR0101_Fire_On_Board_Liberian_Passenger_Ship_Ecstasy.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 MARINE ACCIDENT REPORT PB2001-916401 NTSB/MAR-01/01 FIRE ON BOARD THE LIBERIAN PASSENGER SHIP ECSTASY MIAMI, FLORIDA JULY 20, 1998 7357

this page intentionally left blank

Marine Accident Report Fire On Board the Liberian Passenger Ship Ecstasy Miami, Florida July 20, 1998 NTSB/MAR-01/01 PB2001-916401 National Transportation Safety Board Notation 7357 490 L’Enfant Plaza, S.W. Adopted May 1, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Fire On Board the Liberian Passenger Ship Ecstasy, Miami, Florida, July 20, 1998. Marine Accident Report NTSB/MAR-01/01. Washington, DC. Abstract: On the afternoon of July 20, 1998, the Liberian passenger ship Ecstasy had departed the Port of Miami, Florida, en route to Key West, Florida, with 2,565 passengers and 916 crewmembers on board when a fire started in the main laundry shortly after 1700. The fire migrated through the ventilation system to the aft mooring deck where mooring lines ignited, creating intense heat and large amounts of smoke. As the Ecstasy was attempting to reach an anchorage north of the Miami sea buoy, the vessel lost propulsion power and steering and began to drift. The master then radioed the U.S. Coast Guard for assistance. A total of six tugboats responded to help fight the fire and to tow the Ecstasy. The fire was brought under control by onboard firefighters and was officially declared extinguished about

1. Fourteen crewmembers and eight passengers suffered minor injuries. One passenger who required medical

treatment as a result of a pre-existing condition was categorized as a serious injury victim because of the length of her hospital stay. Carnival Corporation, Inc., the owner of the Ecstasy, estimated that losses from the fire and associated damages exceeded $17 million. The National Transportation Safety Board determines that the probable cause of fire aboard the Ecstasy was the unauthorized welding by crewmembers in the main laundry that ignited a large accumulation of lint in the ventilation system and the failure of Carnival Cruise Lines to maintain the laundry exhaust ducts in a fire-safe condition. Contributing to the extensive fire damage on the ship was the lack of an automatic fire suppression system on the aft mooring deck and the lack of an automatic means of mitigating the spread of smoke and fire through the ventilation ducts. The major safety issues discussed in this report are as follows: adequacy of management safety oversight, adequacy of the fire protection systems, adequacy of passenger and crew safety, and adequacy of engineering system design. As result of its investigation of this accident, the Safety Board makes recommendations to the U.S. Coast Guard, American Classic Voyages, Carnival Corporation, Inc., Carnival Cruise Lines, Crystal Cruises, Disney Cruise Line, Norwegian Cruise Line, Orient Lines, P&O Princess Cruises International, Ltd., Radisson Seven Seas Cruises, Regal Cruises, Renaissance Cruises, Inc., Royal Olympic Cruises, Royal Caribbean Cruises, Ltd., and Silversea Cruises, Ltd., ABB, Inc., and the International Association of Classification Societies. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Activities on the Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Fire and Rescue Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Staff Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Safety Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 First Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Chief Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Galley Fitters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Pilot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Certification and Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 General Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Main Laundry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Aft Mooring Deck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Low-location Lighting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Fire Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Ventilation Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Vessel Certification and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 International Safety Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Carnival Cruise Lines’ Safety Management System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Additional Oversight Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Medical and Pathological . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Medical Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Toxicological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Other Damaged Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Contents iv Marine Accident Report Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Regulatory Requirements: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Emergency Procedures and Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Trapped Crewmen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Emergency Preparedness Drills and Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Metallurgical Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Debris Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Mooring Line Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Lint Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Examination of the Imagination and the Fantasy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Carnival Cruise Lines’ Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Related Safety Board Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Related Coast Guard Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Qualitative Failure Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Fire Ignition and Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Adequacy Of Management Safety Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Adequacy Of Fire Protection Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Sprinkler System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Ventilation System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Fire Detection System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Adequacy of Passenger and Crew Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Passenger Drill . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Accountability Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Lifejacket Distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Locally Sounding Smoke Alarms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Means of Communication in Cabins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Adequacy Of Engineering Systems Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Previously Issued Recommendations Resulting from this Accident Investigation . . . . . . 80 Previously Issued Recommendations Classified in this Report . . . . . . . . . . . . . . . . . . . . . . 80 Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 B: STCW Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 C: Ecstasy Emergency Procedures Placard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Contents v Marine Accident Report D: Number And Arrangement Of Lifejackets On the Ecstasy . . . . . . . . . . . . . . . . . . . . . . 89 E: Metallurgical Tests - Heat Release Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 F: Safety Recommendations on Call Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

vi Marine Accident Report Acronyms and Abbreviations ATF Alcohol, Tobacco, and Firearms Bureau Btu British thermal unit CFR Code of Federal Regulations CO Carbon monoxide COTP Captain of the Port CVE Control Verification Examination FMEA Failure Mode and Effects Analysis FSD fire screen door HSO Health and Safety Officer ICCL International Council of Cruise Lines IMO International Maritime Organization ISM Code International Safety Management Code LED light emitting diode LR Lloyd’s Register of Shipping m2 square meters MSC Maritime Safety Committee MSO Marine Safety Office MVZ Main Vertical Zone RFSA Retroactive Fire Safety Amendment Ro-ro roll on-roll off SMS Safety Management System SOLAS International Convention for the Safety of Life at Sea STCW International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers

Acronyms and Abbreviations vii Marine Accident Report UHF Ultra High Frequency (radio) UTB utility boat WTD watertight door

viii Marine Accident Report Executive Summary On the afternoon of July 20, 1998, the Liberian passenger ship Ecstasy had departed the Port of Miami, Florida, en route to Key West, Florida, with 2,565 passengers and 916 crewmembers on board when a fire started in the main laundry shortly after 1700. The fire migrated through the ventilation system to the aft mooring deck where mooring lines ignited, creating intense heat and large amounts of smoke. As the Ecstasy was attempting to reach an anchorage north of the Miami sea buoy, the vessel lost propulsion power and steering and began to drift. The master then radioed the U.S. Coast Guard for assistance. A total of six tugboats responded to help fight the fire and to tow the Ecstasy. The fire was brought under control by onboard firefighters and was officially declared extinguished about 2109. Fourteen crewmembers and eight passengers suffered minor injuries. One passenger who required medical treatment as a result of a pre-existing condition was categorized as a serious injury victim because of the length of her hospital stay. Carnival Corporation, Inc., the owner of the Ecstasy, estimated that losses from the fire and associated damages exceeded $17 million. The National Transportation Safety Board determines that the probable cause of fire aboard the Ecstasy was the unauthorized welding by crewmembers in the main laundry that ignited a large accumulation of lint in the ventilation system and the failure of Carnival Cruise Lines to maintain the laundry exhaust ducts in a fire-safe condition. Contributing to the extensive fire damage on the ship was the lack of an automatic fire suppression system on the aft mooring deck and the lack of an automatic means of mitigating the spread of smoke and fire through the ventilation ducts. The major safety issues discussed in this report are as follows: • Adequacy of management safety oversight; • Adequacy of the fire protection systems; • Adequacy of passenger and crew safety; and • Adequacy of engineering system design. As result of its investigation of this accident, the Safety Board makes recommendations to the U.S. Coast Guard, American Classic Voyages, Carnival Corporation, Inc., Carnival Cruise Lines, Crystal Cruises, Disney Cruise Line, Norwegian Cruise Line, Orient Lines, P&O Princess Cruises International, Ltd., Radisson Seven Seas Cruises, Regal Cruises, Renaissance Cruises, Inc., Royal Olympic Cruises, Royal Caribbean Cruises, Ltd., and Silversea Cruises, Ltd., ABB, Inc., and the International Association of Classification Societies.

1 Marine Accident Report Factual Information Accident Synopsis On July 20, the Liberian passenger ship Ecstasy had departed Miami, Florida, and was en route to Key West, Florida, with 3,481 people aboard when the bridge began receiving a series of fire alarms. The first fire alarm, at 1710, indicated the ship’s main laundry on deck No. 2. Within a matter of minutes, the fire alarm panel indicated heat and smoke detector activations in the stern thruster room, air conditioning plenums, an electrical room, and the two steering gear rooms. (See figure 1.) The bridge also began receiving telephone calls from crewmembers reporting smoke in various aft areas of the ship. Shortly thereafter, various sources, including a U.S. Coast Guard (Coast Guard) watchstander who was monitoring marine traffic in the channel, observed a large amount of smoke issuing from the stern of the Ecstasy. In compliance with Coast Guard instructions, the vessel’s master ordered the ship to proceed to an anchorage area; however, before reaching the anchorage, the Ecstasy lost propulsion power and steering and began to drift. The master then radioed for assistance. A total of six tugboats responded to help fight the fire and to tow the Ecstasy. The fire was brought under control by onboard firefighters and was officially declared extinguished about 2109. Fourteen crewmembers and 8 passengers suffered minor injuries. Accident Narrative Preaccident Events On July 20, 1998, the Ecstasy was moored alongside Pier 8, Port of Miami, preparing to depart on a round-trip 4-day cruise with stops at Key West and Cozumel, Mexico. Records indicate that, at 1500, the officer of the watch tested the navigation, communication, and vessel control equipment, and that all equipment operated properly. About 1550, a member of the Biscayne Bay Pilots Association arrived on board and went to the pilothouse. The pilot stated that while waiting for passenger baggage to be loaded, he read a completed “pilot card,” a checklist form indicating that all of the equipment had been tested and was in good order. He also observed a muster drill.1 He said that he discussed the weather conditions with the master because he (the pilot) was concerned about reaching the sea buoy, where he would disembark, before approaching heavy rains moved into the area. In response to the master’s question of whether the ship should delay sailing until after the rain passed, the pilot responded that if they left immediately, the ship could complete the transit to the pilot debarkation station before 1 Regulations contained in the International Convention for the Safety of Life at Sea (SOLAS) require that a cruise ship conduct a passenger and crew muster drill within 24 hours of departure.

Factual Information 2 Marine Accident Report inclement weather arrived. After the muster drill was completed, the Ecstasy departed the Port of Miami with 2,565 passengers and 916 crewmembers on board. After the Ecstasy departed its berth, crewmembers brought in and stowed the synthetic mooring lines on the aft mooring station, which was on deck No. 4. A bosun did a final inspection of the area and secured the two weather-tight doors leading from the mooring station to the passenger stateroom area on deck No. 4. He then exited the area using the center crew stairway. According to the bosun, the weather door to this crew stairway was always left open. The mooring station log indicates that the mooring deck was “all clear” and secured at 1650, meaning no machinery was in operation and no people were in the area. The bosun stated that he noted nothing unusual on the deck when he left. The photograph above shows the Ecstasy after the fire. The ship area indicated by the dotted line is illustrated in the cutaway below. Figure 1. On the day of the accident, the fire alarm panel on the bridge indicated that the first alarm activated in the main laundry on deck No. 2. The ventilation system for the laundry penetrated a main vertical zone (MVZ) and exhausted onto the mooring deck. Other early fire alarms indicated that detectors activated in the stern thruster room, the air conditioning plenum between decks No. 4 and 6, an electrical room above the mooring deck, and both steering gear rooms below the mooring deck. AFT POOL CONTROL ROOM AIR CONDITIONER MOORING DECK DRY TANK PROPULSION MOTOR ROOM AFT ENGINE ROOM FORWARD ENGINE RM. APPARATUS ROOM MARSHALING AREA LINEN STEERING GEAR ROOMS AIR COND. DECK 11 DECK 12 AIR CONDITIONER AIR COND. DECK 10 AFT DINING ROOM CABIN CABIN CARGO LIFT ENGINE CASING AIR CONDITIONER GALLEY GALLEY DUCTS LIFT MACH. POOL MACH. AIR CONDITIONING FAN ROOM & PLENUMS STORES MAIN LAUNDRY DECK 9 DECK 8 DECK 5 DECK 4 DECK 3 DECK 2 DECK 1 DECK 0 DECK 7 DECK 6 PASS. STAIRS & LIFTS ELEC. EQUIP. ROOM SUPPLY EXHAUST FAN FAN FRESH WATER SUPPLY SUPPLY SUPPLY Main Vertical Zone Fire Barrier Main Vertical Zone Fire Barrier Smokestack STERN THRUSTERS

Factual Information 3 Marine Accident Report Once the master directed the maneuver of the ship from the pier to mid-channel, the pilot began directing the passage out of the Port of Miami. The pilot stated that the onset of the voyage was routine. He further stated that no equipment malfunctions occurred, and the members of the bridge team performed their duties in a competent and professional manner. The Accident2 About 1630, a mangle3 in the Ecstasy’s main laundry (figure 2) malfunctioned. The laundry manager telephoned a repair request to the hotel engineer, who, in turn, paged the on-call galley fitter (first fitter). The first fitter said that he was in the fitters’ workshop on deck No. 3, preparing to go off duty at 1730, when he was paged and told to go to the main laundry. He said that the laundry manager told him that the mangle was not working properly, and that its roller needed to be adjusted. The first fitter said that when he arrived in the main laundry, the crew was still working and the dryers were running. He said that he tightened a bolt on the mangle’s bridge, which directs the linen from the first roller to the second roller. He then started the mangle to determine whether the adjustment fixed the problem. When the mangle still would not work properly, he continued the process of tightening the bolt and starting the machine until the bolt broke at its weld to the mangle. 2 The Safety Board interviewed the laundry manager and the two galley fitters to determine what occurred in the laundry room before the fire. This accident narrative is compiled using information obtained from those interviews. Because the fitters have the same job title, this report refers to the fitter who first arrived in the laundry as the “first fitter” and the fitter who joined him as the “second fitter.” 3 The mangle is a machine for ironing fabrics, such as table clothes and bed linen. Figure 2. Layout of deck No. 2, aft of the smokestack. In the main laundry, the washers and dryers were on the port side of the ship, and the mangle was on the starboard side. Main Laundry Crew Mess Dry Linen Reception Propellor Motor Room Forward Engine Room Engine Control Room Mangle Stern Electrical Workshop and Store

Factual Information 4 Marine Accident Report In the meantime, another galley fitter (second fitter) had finished checking a pump on one of the ship’s Jacuzzis and was preparing to go off duty at 1730 when the galley engineer told him to help the first fitter in the main laundry. The second fitter said that when he arrived in the main laundry, the first fitter was adjusting a bolt on the mangle. The second fitter said that the first fitter tightened a bolt on the mangle so much that the bolt broke off. Both fitters testified that the first fitter decided to weld the bolt back in place. They said that the first fitter went to the fitters’ workshop to get the necessary equipment, which included a portable welding machine, welding rods, helmets, gloves, and tools. The second fitter said that he went to get an asbestos (fire) blanket from the machine shop area. Both fitters testified that, at this time, they did not obtain a “hot work permit,” as required by Carnival Cruise Lines’ Safety Management System (SMS) procedures,4 because “it was standard procedure” to set up the equipment before calling the staff chief engineer to get a permit and to arrange for a fire watch. The first fitter said that the location of the bolt, between the roller bed and the end plate on the mangle cabinet, was difficult to reach for welding. The second fitter stated that when he returned to the main laundry, the first fitter was lying on top of the mangle, aligning the broken bolt. The welding machine was on a table next to the mangle. (See figure 3.) The second fitter said, “I saw the welding unit on the table and the welding rod [cable] and ground cable were sitting on top of the panel to the mangle….” He stated that the ground cable was not connected to anything. The first fitter said that he had plugged the welding unit into an electrical outlet and had inserted a welding rod (electrode) into the rod holder.5 The second fitter climbed on top of the table next to the mangle. He said that, because the welding rod was hanging near the deck, he pulled the cable toward him. He then saw the welding rod come in contact with either the grounding clamp or the mangle, causing a spark. The second fitter testified that dryer lint was on the floor. The first fitter said that while he was looking down through the rollers of the mangle, he saw “a very small fire” on the floor and “yelled out” about a fire on the deck. Both fitters said that they jumped to the deck, went to the nearby sink, and got a glass of water, which they used to put out the fire underneath the mangle. The second fitter testified that he saw fire “in the middle of the mangle” and retrieved a fire extinguisher, which he directed on the mangle. The first fitter testified that he saw “big flames” in the ventilation duct immediately above the mangle and that he took a CO2 fire extinguisher and directed its spray into the overhead vent. He estimated that he battled the fire for about 5 minutes but had to abandon the firefighting effort because the laundry room was filled with smoke. Both fitters testified that when the fire alarms began to sound, they left the laundry and went to their emergency stations. 4 For further information about Carnival Cruise Lines’ SMS and the required procedures for company personnel, see “Operations,” later in this report. 5 The welding machine used by the fitters, a Unitor Miniweld model, did not have an on-off switch. The unit was energized when it was plugged in. The specifications for the Miniweld states that it “conforms to the Norwegian Maritime Directorate’s rules for welding apparatus on board ships.” Unitor has since discontinued manufacturing this model.

Factual Information 5 Marine Accident Report Figure 3. (Top) The mangle in the main laundry after Carnival made postaccident repairs to the area. The tables shown are in about the same location as the table on which the fitters placed the welding machine on the day of the fire. (Bottom left) The large uncovered opening in the overhead was one of three vents above the mangle that exhausted air and lint into the ventilation system. (Bottom right) Two fan units drew heat and lint from the pressing rollers into vertical ducts that were connected to the overhead ducts of the main laundry ventilation system. Overhead exhaust vent Vertical exhaust vent Table Filter covers were installed on the overhead exhaust vents after the fire

Factual Information 6 Marine Accident Report A cabin steward who had gone to retrieve towels from a linen closet near the main laundry provided a different account of events. He said that he was at the linen closet door when he observed smoke in the main laundry. He said that when he went to investigate, he saw the two fitters working on the inboard side of the mangle. He then saw flames on the outboard side of the mangle, near the exhaust vents. He said that he retrieved a fire extinguisher to fight the fire; however, when one of the fitters dumped a jug of water on the side of the mangle where they were working, flames “appeared to jump up” to an overhead vent. The steward said that the smoke and flames became too great for him to fight with an extinguisher, so he activated the local fire alarm at the laundry room door. About the same time, the laundry crew was preparing to eat when the laundry manager noticed smoke coming from the overhead vents in the crew galley.6 He said that he and the assistant laundry manager went to investigate and saw smoke upon entering the laundry. The laundry manager stated that he did not see the fitters through the smoke. The manager and assistant manager left the laundry. The assistant laundry manager said that he pulled the manual fire alarm in the passageway forward of the laundry and closed the watertight door (WTD) at the laundry entrance. The manager closed the fire screen door (FSD) next to the WTD. The two men then reported to their emergency stations. Activities on the Bridge At the time that the Ecstasy departed Miami, the bridge team comprised the master, the pilot, the staff captain, a first officer, a second officer, a third officer (observer- trainee), and two quartermasters. As the Ecstasy entered the Bar Cut Channel, the pilot requested more speed so that the ship could arrive at the pilot debarkation station7 before encountering the rainsquall, which was approaching from the northeast. At the pilot’s request, the master increased the ship’s throttle setting to full ahead maneuvering speed (110 rpm), or approximately 13 knots. At 1710, an alarm sounded on the fire control panel on the bridge. The first officer said that he immediately went to the alarm panel to investigate the source of the alarm and observed that a light on the panel indicated that the alarm was in the main laundry on deck No. 2. He said that the first alarm was followed rapidly by alarms in the stern thruster room, the air conditioning room, and the steering gear room. The first officer said that when he informed the master about the alarms, the master ordered him to send the staff captain and the safety officer to investigate the source of the alarms and to report their findings. The first officer also sent the second officer and two roving fire patrolmen to investigate. A timeline of events beginning with the first fire alarm appears in Table 1. 6 The laundry crew galley is located on the same deck and immediately forward of the ship’s laundry. 7 The master said that he normally disembarked pilots between buoys number 2 and 3 and the Miami sea buoy. On this night, he went past the sea buoy because he feared that if he stopped near it, the strong northerly current in the area of the sea buoy would cause the ship to drift into an anchorage north of the sea buoy where two ships were anchored. The pilot said he also wanted to put the Ecstasy in a clear area because he had traffic behind him, including an outbound passenger ship.

Factual Information 7 Marine Accident Report Table 1. Timeline of Events Onboard the Ecstasy TIME EVENT 1710 Fire alarm indicating the main laundry sounds on the fire control panel on the bridge. Master instructs first officer to send the staff captain and the safety officer to the scene to investigate the source of the alarm and to report their findings. The first officer also orders the second officer and two roving fire patrolmen to investigate. +/- 2 min. All alarms on the fire alarm panel and the sprinkler panel activate. First officer resets all alarms and activates low-level lighting throughout the vessel. During this time, the first officer begins to receive telephone calls from various crewmen reporting smoke. +/- 5 min. Alarm on the low-level lighting panel begins to sound. 1720 Master orders ventilation shut down in the two aftermost MVZs. 1724 Master assumes the conn from the pilot after the Ecstasy passes the sea buoy. 1725 Master orders first officer to make the “Alpha Team” code announcement alerting the ship’s Quick Response Team. Master orders the cruise director and the hotel manager to the bridge to handle emergency communications.* 1728 Master instructs hotel manager to report fire to the Coast Guard. Before call can be made, Coast Guard Group-Miami radios the ship asking if assistance is needed. Hotel manager asks Coast Guard to stand by while situation is assessed. 1730 Master orders the closure, in the three aftermost MVZs, of the WTDs on decks no. 1, 2, and 3 and the FSDs on all decks. Upon receiving reports of a large quantity of smoke in aft areas, the master orders all fire teams to marshal. 1740 Master orders security officer to clear passengers and crew from the aft part of the ship and chief steward to verify that cabins in smoke affected areas are empty. Fire teams are marshaled and prepared to attack the fire on the stern. 1754 Master is turning vessel to go the anchorage in compliance with the COTP order when the Ecstasy loses propulsion and steering and begins to drift. Chief engineer advises master that the computer controlling the propulsion systems is not working and his staff cannot determine the reason why because of the fire. Master radios the Coast Guard for assistance. 1800 Master orders general alarm sounded; passengers and crew begin to muster. Cruise director begins making status announcements to passengers about the fire. 1815 Coast Guard boarding team arrives onboard and is briefed by the master about the fire. Team advises master that he must obtain permission from the Port Authority to return to the Port of Miami. Team then proceeds aft to evaluate fire scene.

Factual Information 8 Marine Accident Report *The cruise director provided status announcements to passengers, and the hotel manager maintained telephone communications with shoreside Carnival Cruise Lines officials. The first officer stated that about 2 minutes later, all of the alarms on the fire panel seemed to light up at the same time. In response to this, he reset the panel display. The first officer also began to receive telephone calls from crewmembers reporting smoke in various aft areas. Shortly thereafter, a fault alarm began to sound on the bridge for the low- location lighting, that is, the lighting system that illuminates the emergency escape routes on the vessel. According to the master, the noise from this alarm, which could not be silenced on the bridge, interfered with bridge communications. The chief electrician was sent to check the main unit of the low-location lighting system. The electrician stated that when he could not immediately identify what triggered the fault alarm, rather than return to the bridge and disconnect the alarm mechanism, he shut down power to the system, which turned off all low-location lighting throughout the ship. Meanwhile, the safety officer descended to the marshalling area on deck No. 3, where he observed smoke in the aft end of the passageway. He said that he immediately radioed the bridge asking that the master make the “Alpha Team”8 code announcement. The staff captain stated that when he arrived at the marshalling area, he saw no flames but observed smoke spreading upward to deck No. 4. The staff captain radioed his observations to the master and asked that all five fire teams be alerted and that the entire aft MVZ be secured. 1913 All responding tugs are at the scene. Coastal Miami is made fast to the Ecstasy’s bow. Other tugs direct streams of water from their fire monitors at the stern of the Ecstasy. 1950 Shoreside firefighters board Ecstasy to assess fire scene. 1955 Crewmembers are released from their emergency stations 2109 Miami-Dade FD declares fire under control. 2130 Coast Guard COTP order grants permission for the Ecstasy to enter port. 0118 Ecstasy arrives at Pier 8, Port of Miami 8 An announcement of “Alpha Team” was the signal for the quick response team to assemble in the marshalling area. The quick response team, comprising the fire patrol chief and a 5-person environmental team, was the onboard unit required to respond first to a fire emergency and to take action to suppress a fire until the ship’s fire teams could arrive. Table 1. Timeline of Events Onboard the Ecstasy TIME EVENT

Factual Information 9 Marine Accident Report About 1718, a pilot on an outbound vessel behind the Ecstasy observed smoke issuing from its stern as the Ecstasy approached buoys 2 and 3. (See figure 4.) The pilot called the Ecstasy’s pilot informing him of the smoke. The Ecstasy’s pilot replied that he and the master were aware of a fire on board the ship. At 1720, the master instructed the first officer to shut down all power to the ventilation systems on the aft part of the ship, specifically MVZs 1 and 2. The first officer also called the officer on watch in the engine control room to shut down the ventilation in all areas aft of the engine room. Shortly thereafter, in response to an alarm indicating that

Figure 4. Route of the Ecstasy on the day of the accident. Buoys mark the channel to the Miami sea buoy, where State piloting requirements end and near the area where the pilot on the outbound vessel debarked. ATLANTIC OCEAN BISCAYNE BAY MIAMI BEACH MIAMI 1654 Ecstasy Outbound Main Channel PORT OF MIAMI No. 2 No. 3 0 1 2 3 Nautical Miles 2109 Ecstasy Begins Return To Miami Under Tow 1710 First Alarm Sounds 1754 Ecstasy Loses Propulsion, Starts Drifting North ANCHORAGE AREA MIAMI SEA BUOY FLORIDA 1723 Pilot Debarks Ecstasy Outbound

Factual Information 10 Marine Accident Report the No. 2 stern thruster was overheating, the engine room watch requested that the bridge discontinue using the stern thrusters to prevent damaging them. The Ecstasy was on a heading of 040° when it passed the sea buoy at 1723. The master said that he then relieved the pilot of his navigational duties, and the pilot left the bridge to disembark. At 1725, the master authorized the first officer to make the “Alpha Team” code announcement alerting the ship’s fire teams to report to their emergency stations and to don equipment in preparation for firefighting. At 1726, the pilot disembarked the Ecstasy onto a pilot boat. The Ecstasy master said that he then ordered the vessel on a southeast course at 6 knots while the staff captain and safety officer assessed the situation. The master said that he maintained the Ecstasy on a heading that carried smoke away from the ship and that avoided other marine traffic. The master called the cruise director and the hotel manager to the bridge to handle communications. The master directed the cruise director to provide status announcements to the passengers and the hotel manager to contact shoreside authorities, including Carnival officials, emergency responders, and the Coast Guard. Before the hotel manager could report the fire to the Coast Guard, about 1728, a watchstander at Coast Guard Group–Miami who had been monitoring vessel traffic in the channel radioed to ask about the smoke streaming from the Ecstasy’s stern and whether the ship needed assistance. The watchstander stated that the hotel manager responded that the ship had a fire in the laundry room but that they did not need help at that time. The hotel manager said that he asked the Coast Guard to stand by, as the situation was being assessed. The Ecstasy’s hotel manager maintained telephone contact with Carnival Cruise Lines’ director of operations throughout the emergency. The company implemented its crisis management plan, which included specific shore management assignments for responding to a shipboard fire. At 1730, the master issued a series of orders to secure the aft area of the Ecstasy. He authorized the first officer to close all of the WTDs on deck Nos. 1, 2, and 3 in the aft portion of the ship and to close all FSDs on all decks in the three after-most MVZs. He ordered the ship’s security officer to clear passengers and crewmembers from these MVZs and the casino manager to block the area so that no one could return to it after it had been cleared. The master then ordered the chief steward to verify that all cabins in the smoke- affected area were empty. Shortly after 1750, the Coast Guard Group–Miami radio watchstander relayed a Captain of the Port (COTP)9 order to the Ecstasy to proceed to the anchorage north of the sea buoy and anchor. At 1754, as the master turned the vessel to head for the anchorage area, the Ecstasy suddenly lost propulsion power and steering capability and began to drift. When the ship lost propulsion, the master requested that the Coast Guard send tugs to assist the vessel. 9 The COTP is an officer within a district command designated by the Commandant to direct Coast Guard law enforcement activities within an assigned area.

Factual Information 11 Marine Accident Report The master said that when he contacted the chief engineer about the power loss, the chief engineer responded that his engineering staff could not determine the reason for the problem because of the fire. At 1800, the master ordered the general alarm sounded alerting passengers and crewmembers to assemble at their muster stations. At the master’s direction, the cruise director announced over the loudspeaker that there was a fire but that it was under control. He told Safety Board investigators that he provided status announcements to passengers about every 5-10 minutes. Upon receiving reports from crewmembers at an outside muster station that passengers were having problems hearing the loudspeaker announcements because news helicopters were flying close to the vessel, the cruise director radioed muster station personnel with status information to relay to passengers. At the master’s direction, the cruise director instructed mustered passengers not to return to their cabins for their lifejackets if they were berthed in the aft part of the ship. The cruise director announced that lifejackets would be provided to them at their muster stations. At the Safety Board’s public hearing, the master testified that he did not order the crew to hand out lifejackets when passengers were mustered because efforts to contain the fire were successful and no one was in danger. He said that he wanted to maintain a calm environment by conveying the impression that the situation was under control and did not warrant the distribution of lifejackets. He therefore ordered the crew to stop distributing lifejackets to avoid panic among the passengers. When smoke entered some muster areas, passengers were moved to other stations. Fire and Rescue Response Bridge logs indicate that the “Alpha Team” announcement, which alerted the quick response team to respond and other fire teams to prepare to marshal, was made at 1725. The quick response team narrowed the location of the main fire and smoke source to the aft mooring area on deck No. 4. At 1730, upon receiving reports of a large amount of smoke, the bridge ordered all fire teams to assemble. According to the safety officer, by 1740, the fire teams had assembled at the marshalling area on deck No. 3, had donned their gear, and had prepared for firefighting. He and the staff captain then led the teams aft toward the stern of the vessel. The fire teams inspected several decks in the aft part of the ship for sources of heat and smoke but initially were unable to enter the mooring deck area because of the intense heat from the fire. Shipboard firefighters then attempted to cool the perimeters of the aft mooring deck by spraying water on the overhead of deck No. 3, the bulkhead forward of the aft mooring deck (deck No. 4), and the surface of deck No. 5. Some firefighters began boundary cooling by spraying water on the ship’s exterior shell plating. In the meantime, the tug Coastal Key West was tied up at Fisher Island (Miami Harbor) when its master overheard a radio call from the Biscayne Pilots Association to Coastal Tug and Barge, Inc., of Miami (Coastal Tug) advising of a fire on the Ecstasy. The Coastal Tug dispatcher radioed the Coastal Key West to assist. The tug got underway

Factual Information 12 Marine Accident Report about 1800 and arrived on scene at 1827. The Coastal Key West began directing a stream of water from a high-pressure fire monitor at the fire on the Ecstasy’s stern. The Coastal Tug dispatcher dispatched three other tugs, the Coastal Florida, the Coastal Biscayne, and the Coastal Miami, from the Port of Miami. They arrived within a half hour of the Coastal Key West. While the Coastal Florida and Coastal Biscayne joined the Coastal Key West in fighting the fire on the stern of the Ecstasy with their fire monitors, the Coastal Miami went to the Ecstasy’s bow to prepare for towing the ship. The Coastal Miami’s master also handled the radio communications between the Ecstasy and the tugs on scene. A short time later, the tug Dorothy Moran joined the other tugs in the firefighting efforts at the stern of the Ecstasy. At 1835, a Coast Guard vessel carrying two representatives from the Marine Safety Office (MSO) Miami arrived alongside the Ecstasy. The Ecstasy master said that when the Coast Guard representatives came aboard, he gave them a status report on the fire and the conditions on the cruise ship. The Coast Guard representatives then proceeded aft to meet the Ecstasy’s safety officer. The safety officer said that he told the MSO officials that the fire was limited to the aft mooring deck on deck No. 4, but the fire teams had not been able to enter the area because of the intense heat and dense smoke. At 1913, the tug Coastal Miami placed a towline on the Ecstasy’s bow to keep the ship heading into the wind so that smoke moved away from the stern. The Ecstasy and Coastal Miami drifted north due to the effects of the Gulf Stream.10 Some Ecstasy fire teams entered the aft mooring deck from the starboard side weather door and began cooling the area and extinguishing flames. Another fire team entered the mooring deck from the port weather door. Shortly thereafter, the fire teams notified the master that the fire had been extinguished. The Ecstasy fire teams continued to survey the aft decks in MVZs 1 and 2 for any residual signs of fire. About 1950, four members of the Miami Beach Fire Department (Miami Beach FD), including a medical doctor, arrived aboard the Ecstasy and assisted onboard medical personnel in tending to the ship’s firefighters and passengers. Shortly thereafter, Miami- Dade Fire Rescue Department (Miami-Dade FD) personnel and Carnival’s director of firefighting training boarded the Ecstasy. After meeting with the master and Coast Guard personnel on the bridge, a command post was set up at the deck No. 3 marshalling area. At 1955, the crew was released from their emergency stations. The crew firefighters led a team of Miami-Dade FD and Coast Guard personnel through the affected areas, including the aft mooring deck. After completing its assessment, at 2109, the team declared the fire under control. At 2130, the Coast Guard COTP, the Miami-Dade FD, and the Port of Miami granted permission to the Ecstasy to enter port. The cruise ship, under tow by six tugs, proceeded en route to the Port of Miami. At 0118, July 21, the Ecstasy arrived at Pier 8. Once the vessel was secured at its berth and the gangway was rigged, passengers began to disembark about 0220. 10 The Gulf Stream current off the Straits of Florida flows northerly at a velocity between 2.5 to 3.5 knots.

Factual Information 13 Marine Accident Report Injuries Table 2 is based on the International Civil Aviation Organization’s injury criteria, which the Safety Board uses in accident reports for all transportation modes. Additional information about the injuries sustained by passengers and crewmembers appears under “Medical and Pathological.” Damages Officials for Carnival Corporation, Inc., the Ecstasy’s owner, estimated fire and associated damages to be $17 million. The Ecstasy was out of service for repairs until September 1998. Additional information about the damage to the ship appears under “Wreckage.” Personnel Information General According to company officials, Carnival hired only Italian deck and engineering officers. Its petty officers, including bosuns, carpenters, joiners, firemen, electricians, and plumbers, typically were either Filipino or Central American. Table 2. Injuries Sustained in the Ecstasy Accident Passengers Crew Total Fatal 0 0 0 Serious 1* 0 1 Minor 8 14 22 None 2,556 902 3,458 Total 2,565 916 3,481 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as: any injury that results in death within 30 days of the accident. A serious injury as: an injury that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns, or any burn affecting more than 5 percent of the body surface. *As a result of this accident, one woman with chest pains and a pre-existing illness was admitted to the hospital for more than 48 hours, which met the definition of a serious injury.

Factual Information 14 Marine Accident Report Master The master, age 72, had been going to sea professionally for 52 years. He held unlimited master’s licenses from Italy and from Liberia. He had sailed for Carnival Cruise Lines since 1985; he had been a master on company ships for all but the first 3 months of his time with the company. Four years before the July 20, 1998, fire, he had served as master on the Ecstasy for 8 months. He had been on the vessel for 1 month at the time of the fire. Staff Captain The staff captain, age 52, had been going to sea professionally since 1965. He held unlimited master’s licenses from Italy and from Liberia. He had sailed for Carnival Cruise Lines since 1991 and had served in all officer positions from third officer to staff captain. The staff captain also served as the ship’s Health and Safety Officer (HSO). Safety Officer The safety officer, age 35, had been going to sea professionally since he was 17 years old. He held unlimited master’s licenses from Italy, from Liberia, from Panama, and from the United Kingdom. He acted as the on-scene commander of the ship’s firefighting organization. He was also responsible for maintaining safety and firefighting equipment and for providing onboard emergency training for the crew. First Officer The on-duty first officer, age 42, was one of three first officers on board the Ecstasy. He held unlimited master’s licenses from Italy, from Liberia, and from Panama. He had sailed on passenger ships for 6 years, exclusively with Carnival Cruise Lines. Chief Engineer The chief engineer, age 51, held unlimited chief engineer’s licenses from Italy and from Liberia. He was responsible for the operation, maintenance, and repair of all shipboard engineering systems, including propulsion, electrical, plumbing, and air conditioning. He joined Carnival Cruise Lines in 1978 as a first engineer. He was promoted to staff chief engineer in 1981 and to chief engineer in 1986. Galley Fitters The “first” galley fitter, age 35, was on his second contract11 with Carnival Cruise Lines. He had obtained welding certification in the Philippines and training from Unitor. He had been recently promoted to fitter from assistant fitter. The “second” galley fitter, age 25, went to a 3-year trade school in Peru, where he received welding training and certification. He was hired by Carnival Cruise Lines in December 1996 as assistant fitter and later promoted to fitter. 11 Each contract lasts 7 months.

Factual Information 15 Marine Accident Report Pilot The pilot, age 38, held an unlimited master license with a Federal First Class Pilot’s endorsement (for the Port of Miami to the sea buoy), issued by the Coast Guard, and a State Pilot Commission (pilot’s license), issued by Florida. He was a member of the Biscayne Bay Pilots Association and had been a Miami ship pilot since August 1989. Certification and Training Requirements Preaccident requirements. In 1978, the International Maritime Organization12 (IMO) and its member governments, or parties, established basic requirements for international seafarers. The International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers (STCW), 1978, which was adopted by the International Conference on Training and Certification of Seafarers on July 7, 1978, became effective on April 28, 1984. Since then, amendments to the STCW were adopted in 1991, 1994, and 1995. In preparation for STCW 95 requirements that became effective January 1, 1999, representatives from the Coast Guard and five transportation organizations13 cooperated in developing the curriculum offered at the RTM Simulation Training and Assessment Research (STAR) Center, which is a maritime training academy located in Dania, Florida. The coursework included training in the areas of crowd management, safety, and crisis management and human behavior. Carnival’s preaccident training and requirements. According to Carnival Cruise Lines’ officials, the company sent its officers to the RTM STAR Center to meet the requirements of STCW 95. Company documents, including personnel files, indicate that, before the fire, the Ecstasy’s deck officers had taken bridge team resource management training in the classroom and on a bridge simulator; the senior deck officers had taken command shiphandling. Although not required by STCW 95, Carnival Cruise Lines also sent its quartermasters (helmsmen) to bridge team resource management training. In 1995, Carnival Cruise Lines established a policy requiring that all new hires speak English. Firefighting training is the responsibility of Carnival Cruise Lines’ Director of Firefighting Training. He stated that all firefighters, fire patrolmen, and officers receive basic and advanced firefighting training, which includes using simulators and hands-on firefighting techniques. The Ecstasy’s “flag State,”14 that is, the country in which the vessel was registered, had approved the company’s basic and advanced courses as being in compliance with the STCW 95 Code. 12 The IMO, a United Nations organization comprising 137 member states, establishes international maritime standards for the ships of the nations that are signatories to its conventions. 13 Organizations that helped develop the STCW courses included Carnival Cruise Lines, Royal Caribbean Cruise Lines, American Airlines, Det Norske Veritas, and Lloyd’s Register of Shipping. 14 Another term for flag state is flag administration.

Factual Information 16 Marine Accident Report Carnival Cruise Lines had no written specific qualifications for fitters and no formal recurrent training program for ensuring that fitters were current in their welding skills. Each chief engineer or staff chief engineer was responsible for ensuring that the crewmembers in the engine department had the requisite skills and abilities to accomplish their jobs. All fitters, including the two welders involved in this accident, received on- board job-specific safety training, which included a review of proper practices when welding and procedures for obtaining a hot work permit. Postaccident requirements. STCW 95 Section A-V/3, effective January 1, 1999, contains minimum requirements for the training and qualifications of masters, officers, and other crewmembers on passenger ships other than roll on-roll off (ro-ro) passenger ships. The STCW Code requires that seafarers receive currency training at intervals not to exceed 5 years. The following excerpts from the STCW manual are selected training requirements in the areas of crowd management, safety, and crisis management and human behavior. Crowd management training 1 The crowd management training required by regulation V/3, paragraph 4, for personnel designated on muster lists to assist passengers in emergency situations shall include, but not necessarily be limited to: .1 awareness of life-saving appliance and control plans, including: .1.1 knowledge of muster lists and emergency instructions, .1.2 knowledge of the emergency exits; and .2.1 the ability to give clear reassuring orders, .2.2 the control of passengers in corridors, staircases and passageways, .2.3 maintaining escape routes clear of obstructions, .2.4 methods available for evacuation of disabled persons and persons needing special assistance, and .2.5 search of accommodation spaces; .3 mustering procedures, including: .3.1 the importance of keeping order .3.2 the ability to use procedures for reducing and avoiding panic, .3.3 the ability to use, where appropriate, passenger lists for evacuation counts, and .3.4 the ability to ensure that the passengers are suitably clothed and have donned their lifejackets correctly.

Factual Information 17 Marine Accident Report Safety training for personnel providing direct service to passengers in passenger spaces 3 The additional safety training required by regulation V/3, paragraph 6, shall at least ensure attainment of the abilities as follows: Communication .1 Ability to communicate with passengers during an emergency, taking into account: .1.1 the language or languages appropriate to the principal nationalities of the passengers carried .1.3 the possible need to communicate during an emergency by some other means such as by demonstration, or hand signals, or calling attention to the location of instructions, muster stations, life-saving devices or evacuation routes, when oral communication is impractical; Crisis management and human behaviour training 5 Masters, chief mates, chief engineer officers, second engineer officers and any person having responsibility for the safety of passengers in emergency situations shall: .1 have successfully completed the approved crisis management and human behaviour training required by regulation V/3, paragraph 8, in accordance with their capacity, duties and responsibilities as set out in table A-V/2;15 and .2 be required to provide evidence that the required standard of competence has been achieved in accordance with the methods and the criteria for evaluating competence tabulated in columns 3 and 4 of table A-V/2. The RTM STAR Center manuals used to train seafarers on STCW requirements contain the information or instructions as noted below. The crowd management manual, under “Maintaining Order at Muster Stations,” states: Accounting Accurate accounting for passengers is extremely important. Searching for missing persons may be initiated based on roll call at Muster Stations. Passenger lists should be used for taking attendance; there should be a list of passengers assigned to each Muster Station. The crisis management and human behavior manual, under “Shipboard Emergency Procedures,” states: 15 Excerpts from this table appear in appendix B of this report.

Factual Information 18 Marine Accident Report Emergency Scenarios Formalized emergency procedures should be in place to meet the particular demands of a variety of situations. Depending on routes, passengers, ports of call, terminal security measures, and so forth, some such scenarios might include: • Fire (in port/at sea) • Grounding • Collision (in port/at sea) • Bomb threat • Terrorist activities • Extreme weather • Epidemic • Pollution • Emergency assistance to other ships The crisis management and human behavior manual advises that detailed requirements for emergency preparedness drills will be included in the company’s SMS, and that drilling is an ideal means for determining whether in-place emergency procedures match up with available resources. Carnival’s postaccident requirements. According to Carnival Cruise Lines’ officials, in fall 1998, the company began requiring its senior deck, engineering, and other officers to attend courses in crisis management and human behavior and crowd management. Crewmembers in safety-related positions were required to attend crowd management training. Vessel Information The Ecstasy was built in 1991 by Kvaerner Masa Shipyard (Kvaerner Masa) of Helsinki, Finland, for Carnival Corporation. The vessel was the second of Carnival Corporation’s “Fantasy Class” ships, a series of eight cruise liners having the same basic design. The Fantasy class ships are typical of modern passenger cruise liners that are designed for unrestricted international voyages. At the time of its construction, the Ecstasy was required to comply with SOLAS 74 and its 1981 and 1983 amendments. The cruise ship was designed, built, and maintained under the rules of the Lloyd’s Register of Shipping (LR) classification society. The Ecstasy held the highest vessel classification for construction. Additional information about vessel certification and inspections appears later in this section.

Factual Information 19 Marine Accident Report General Construction The diesel-electric-propelled Ecstasy is 859.4 feet long, 103.4 feet wide, and admeasures 70,367 gross tons. The vessel has 13 decks and seven MVZs, which are separated by A-60 Class divisions. 16 (See figure 5.) Main Laundry The main laundry was on deck No. 2, within MVZ 2. The mangle (figure 3) was on the starboard side of the laundry space. When operating the mangle, laundry workers placed damp linens on the loading side of the machine. The mangle had strings coated with wax that directed the linen through the ironing machine’s felt-covered rollers. The steam produced by the ironing action was removed by blowers and exhausted into two vertical ducts on the starboard side of the mangle. When workers turned off the mangle, its rollers automatically raised, preventing damage to the roller bed. The vertical ducts that interfaced with the mangle were attached to a main exhaust duct for the machine. Two ventilation duct systems exhausted the air in the laundry space: one duct system exhausted the air over the mangle and the other duct system exhausted the air near the six dryers. The duct system dedicated to the mangle had three circular intake openings that were set flush with the stainless steel panels of the overhead and that were not covered by a grill or filter. The forwardmost intake opening was above the folding machine attached to the mangle, the second intake opening was directly above the mangle’s rollers, and the third intake opening was at the end of the mangle where the linen was loaded. The two exhaust systems (figure 1) were separate from each other until the ducts exited into the aft mooring deck plenum. The blowers for each of the systems were in the double-deck air conditioning room that extended upward from deck No. 4. According to Carnival Cruise Lines’ records, the mangle exhaust blower had a calculated linear flow velocity of 7.3 meters per second (m/s).17 Aft Mooring Deck The mooring station on deck No. 4 is aft of the MVZ No. 1 forward bulkhead. The station is a covered space that is open to the weather on the port, starboard, and aft sides. (See figures 6a and 6b.) The station is used only when docking or undocking. The area has three electrically controlled winches that spool the large diameter polypropylene line (rope) that is used to moor the vessel. One winch is on the port side, one is on the starboard side, and one is in the center of the deck. Additional coils of mooring line are stored on wooden pallets on the mooring deck. 16 SOLAS Regulation II-2/3.3 stipulates that A-60 class bulkheads and decks must be constructed of steel or other equivalent materials; suitably stiffened; capable of preventing the passage of smoke and flame for 1 hour; and insulated with approved, noncombustible materials that limit temperature increases. 17 For a duct cross section measuring 1.03 meters, the fan capacity of the mangle blower was 7.5 cubic meters per second; the fan capacity of the dryer blower was 6.4 cubic meters per second.

Factual Information 20 Marine Accident Report Figure 5. Plan views of decks 1-5. Mooring deck Electrical equipment room (housed distribution panel MS-21) Air conditioning/fan room Air conditioning/fan room (open to Deck No.5) Ventilation plenum Steering gear room Steering gear room Main laundry Toilet (where crewmen were trapped) Stern thruster room Deck No. 4 Deck No. 5 Deck No. 3 Deck No. 2 Deck No. 4

Factual Information 21 Marine Accident Report Figure 6a. The ventilation system for the main laundry exhausted onto the mooring deck (shown above), where the synthetic mooring line was spooled on winches or stored on pallets. Figure 6b. The Ecstasy’s mooring station is a covered deck area that is open to the weather on the side and rear of the ship. Door to crew stairway Laundry exhaust ducts

Factual Information 22 Marine Accident Report At the time of the fire, the mooring deck had 11 lengths of line, each measuring 220-meters and weighing about 900 pounds. The lines included three lengths of polypropylene line that were on the winch drums, seven pallets of polypropylene line, and one pallet of nylon line. Several air handling systems vented to the mooring deck. A discussion and an illustration of the ventilation system appear later in this section. Operating Systems Steering. The steering system consisted of two rudder systems that were mechanically, electrically, and hydraulically independent of each other. The hydraulic equipment for each rudder system was housed in separate compartments on deck No. 3; one steering gear room was on the port side and the other steering gear room was on the starboard side. The steering gear rooms were directly below the mooring station on deck No. 4. The steering system was controlled from the bridge during normal operations, or, in an emergency, locally from the steering gear room. Propulsion. SOLAS Chapter II-1, Part C, states, in part: Administrations shall give special consideration to the reliability of single essential propulsion components and may require a separate source of propulsion power sufficient to give the ship navigable speed, especially in the case of unconventional arrangements. Means shall be provided whereby normal operation of the propulsion machinery can be sustained or restored even though one of the essential auxiliaries becomes inoperative. The Ecstasy’s main power plant comprised six diesel generators that supplied all electric power for the vessel, including propulsion. The generators produced electricity at 6,600 volts and at a constant frequency of 60 hertz. Transformers and cycloconverters modified the voltage and frequency for use in driving the motors of the vessel’s two propellers. (See figure 7.) Output from the cycloconverters ran through electrical circuit breakers (called high-speed breakers) that were designed to prevent damage to the propulsion motors in the event of a power overload. The breakers generated a signal indicating their status, that is, whether they were open or closed, to the propulsion system computer. If the propulsion system computer did not receive a status indication from either of the breakers, the computer would shut down the system power at the cycloconverters. The signals indicating the circuit breakers’ positions passed through a distribution panel (MS-21) in an electric equipment room on deck No. 5, above the area where the fire occurred. Power cables from transformers supplying the distribution panel were in the ventilation intake plenum that was forward of the aft mooring station.

Factual Information 23 Marine Accident Report Figure 7. Schematic of the propulsion system’s wiring. M M G G G G G G G G 230 V Distribution Panel MS 21 Cables damaged by heat from fire T-21 (Primary) T-25 (Alternate Supply) 450V/230V Transformers 450 V Clean Power Switchboard MS 2 Auxiliary Voltage to High Speed Breakers Motor-Generator Sets NO Port Cycloconverter Propulsion Computer Stbd Cycloconverter High-Speed Breakers Propulsion Motors 6.6KV / 450V Transformers NC 450 V Swbd MS 1 450 V Swbd MS 1 Diesel Generators 6.6 KV Main Swbd PS 1 6.6 KV Main Swbd PS 1

Factual Information 24 Marine Accident Report The propulsion system had many redundant features and isolated components designed to provide reliability. Each propeller had an independent double-wound motor and each propulsion motor had two cycloconverters. In the event of power failure, the propulsion system computer had a battery backup, and each motor could use an emergency exciter. Each of the six independent diesel generators supplied isolated main distribution switchboards. The propulsion system was designed and manufactured by ABB, a subcontractor to Kvaerner Masa, the shipbuilder. The integration of the propulsion system into the ship’s other systems, notably the electrical distribution system, was the responsibility of Kvaerner Masa’s designers. The specifications to the shipbuilder from ABB list the required voltage and current supplying the propulsion system. The specifications do not indicate that the voltage supply should be provided by independent sources. Kvaerner Masa routed the auxiliary voltage for both high-speed breakers through a single external interface (MS-21). Officials for ABB, the propulsion system design company, stated that they did not do a qualitative failure analysis18 of the propulsion system for the Fantasy class ships, including the Ecstasy, because SOLAS, LR, and Carnival did not require that a system performance analysis be conducted. Low-location Lighting SOLAS Chapter II-2, Regulation 41 requires that passenger ships constructed after January 1, 1994, have a low-location lighting system in all accommodation area interior passageways and stairways to assist passengers in identifying emergency escape routes when smoke impedes visibility.19 The low-location lighting system on board the Ecstasy consisted of a series of low- voltage, light-emitting diodes (LED) and photoluminescent signs marking exits, doors, and stairways. The electrical power supply for the system was in the emergency diesel generator room. In the event of a power loss from the emergency switchboard, a battery- powered DC/AC inverter provided a power backup for at least 60 minutes. The lighting system was designed such that the loss of a single light, lighting strip, or power supply would not result in a system failure. The system was arranged in a series of independent zones. Each zone had two electrical loops that were powered by independent power transformers; the loss of a one transformer would not cause the failure of a loop. If a condition affecting the performance of the low-location lighting system did occur, a fault alarm would sound on the system’s control panel, which was located on the navigation bridge. The system was designed such that the bridge watch could not silence the audible alarm at the control panel. 18 Information about qualitative failure analysis appears in the “Other” section of this report. 19 See IMO Resolution A.752 (18).

Factual Information 25 Marine Accident Report Fire Protection Fire detection. SOLAS Chapter II-2, Regulations 12 and 13 specify the minimum design and installation requirements for a passenger vessel’s fire detection system, including power elements, audible and visual alarms, control panels, and detectors.20 Documents indicate that LR issued an approval certificate for the Ecstasy’s fire detection system. Consilium Marine AB of Sweden (Consilium) supplied most of the components in the Ecstasy’s fire detection system. According to Consilium’s technical data sheets, the Salwico C300 that was installed on the Ecstasy is a conventional fire detection system with a single central control unit. Group units, each containing loops of eight detectors, can be added to extend the system’s capability. In the case of the Ecstasy, the vessel had 176 separate detector loops, each of which covered 20 to 30 cabins. Two models of Consilium smoke detectors were installed on the Ecstasy; one type of detector was installed in cabins and staterooms, and a second type was installed in stairways and service spaces, including the main laundry. Manual pull alarms installed throughout the vessel supplemented the automatic smoke and heat detectors. An independent module, called the Detector Identification, controlled the zone or detector address function of the system. The vessel’s fire alarm panel, sprinkler fire suppression panel, and various emergency shutdown and closure controls, including the controls for the FSDs and WTDs, were mounted on a bulkhead immediately aft of the pilothouse. The fire detection panel had alarms that sounded and lights that illuminated to identify the loop in which an automatic detector activated or a person pulled a manual alarm station. The control unit for the fire detection system was on the bridge, aft of the pilothouse. Once an operator identified the loop on the detection panel, he could activate the computerized video surveillance display at the control unit, which showed the area of the activated detectors. The control unit also had the capability of indicating individual smoke detector and circuit failure. The fire detection system included a printer that generated a paper log of all activated detectors and manual pull alarms. On the day of the accident, the system logged 45 detector “events” within 2 minutes of the first alarm, between 1710 and 1712.21 The detection system printer registered alarm locations that did not exist, indicating the system panel had malfunctioned because of an electrical overload. Following this accident, Carnival upgraded the fire detection system on the Ecstasy to correct this problem. 20 See SOLAS Chapter II-2, Regulation 13. 21 The time resolution for the detector log printout was to the nearest minute.

Factual Information 26 Marine Accident Report Automatic sprinkler protection. SOLAS amendments adopted in 1992 require that all passenger cruise vessels constructed after October 1, 1994, and carrying more than 36 passengers be protected with an automatic sprinkler system or an approved equivalent fire suppression system for all accommodation and service spaces, stairway enclosures, and corridors. Ships built before 1994 must be retrofitted with automatic sprinklers within 15 years of construction or 2005, whichever is later. Because the Ecstasy was constructed in 1991, Carnival Corporation had until 2006 to comply with the SOLAS requirements for automatic sprinklers but voluntarily installed sprinkler protection in the Ecstasy’s cabins and staterooms at the time the ship was built. According to LR, the sprinkler protection met SOLAS requirements. Documents indicate that the flag administration interpreted the mooring deck design to be a category 5, “Open Deck Space,” as defined in SOLAS regulations,22 because the space was partially enclosed and directly open to the weather. SOLAS regulations do not require that fire detection or fire suppression equipment be installed in an open deck space, and no such equipment was installed on the Ecstasy’s mooring deck before the 1998 fire. SOLAS regulations specify the minimum sprinkler coverage and application rate for a ship’s sprinkler system. The designs of the Ecstasy’s pump and piling system indicate that, as stipulated in SOLAS Chapter II-2, Regulation 12, the vessel’s sprinkler system provided coverage for a minimum area of 280 square meters (m2) at a rate of 5 liters of water per m2 per minute (5 l/m2/min). The system was designed to supply water for about 30 sprinklers at a time, based on a coverage rate of slightly more than 10 m2 for each sprinkler head. Postaccident examination of the ship indicated that more than 60 sprinklers activated on the Ecstasy. (See table 3.) The first officer who was monitoring the sprinkler alarm panel, stated that he remembered that fire zones 20 (deck No. 5, aft) and 32 (deck No. 7, aft) were the first zones that activated on the sprinkler panel and that several other flow alarms sounded shortly thereafter.23 Investigators observed that sprinkler zones 20 and 35 indicated a “Sprinkler Released” status, meaning the system had a pressure drop. Fire zones 6, 14, 15, 21, 22, 26, 32 and 33 indicated a “Master Valve Closed” status, meaning the water to these zones had been shut off. The remainder of the system was operational at about 5 bar pressure according to the gauge on the bridge. 22 See SOLAS Chapter II-2 Regulation 26-2.2 (5). 23 A flow alarm is an audible alarm that sounds on the bridge when a sprinkler head starts to flow water. The system does not record the flow alarm sequence.

Factual Information 27 Marine Accident Report As the temperature near the sprinkler head increases, liquid in the glass bulb expands and overstresses the glass, ultimately causing the bulb to break at the sprinkler head’s rated temperature, in this case, 93ºC. When the glass bulb breaks, the sprinkler head opens, allowing water to flow. Ventilation Systems SOLAS regulation II-2/16.3.1.3 requires that ducts ventilating category A machinery spaces, galleys, car deck spaces, ro-ro cargo spaces, or special category spaces be fitted with automatic fire dampers at the boundary penetrations of passages through accommodation spaces, service spaces, or control stations. Further, most ventilation ducts with cross-sectional areas exceeding 0.075 m2 must be fitted with automatic fire dampers Table 3. Location of activated sprinklers. Deck Location Activated Sprinklers Observations and Comments 1 Stern thruster room None Area was protected by a carbon dioxide system. 2 Main laundry None Because the laundry had higher operating temperatures, it was equipped with sprinklers having a glass-bulb actuating device. 3 Port-side corridor 2 Refrigerated dry stores 2 4 Mooring station None Area was not equipped with sprinklers. Port-side corridor 3 Sprinklers were immediately forward of the WTD leading to the mooring station. Aft-most outboard cabin 1 Aft-most inboard cabins 2 Central crew stairs Several 5 Cabins and adjacent corridors 40 Affected areas were above the mooring deck. 6 Port-side storage locker 2 Mattresses showed no evidence of dampness. 7 Aft-most cabin – port 2 Carpet was scorched. Closet in port cabin 1 Aft-most cabin - starboard 2 Carpet was scorched. Closet in starboard cabin 1 Starboard corridor 2

Factual Information 28 Marine Accident Report that are capable of manual operation from both sides of the bulkhead or deck.24 Only dampers that pass through spaces surrounded by A-class divisions without serving those spaces and that have the same fire integrity as the divisions that they pierce are excluded from this requirement. SOLAS regulations do not include main laundries as a space in which the ventilation ducts must be equipped with automatic fire dampers. On the Ecstasy, the fire dampers in the main laundry ducts were manually operated under normal conditions. If the ventilation system suffered an electrical loss, the dampers would pneumatically shut. All ventilation systems on the Ecstasy are equipped with fire dampers that close when ventilation is secured. During postaccident repairs, technicians verified that all fire dampers had functioned and closed when ventilation was secured from the bridge during the fire. As mentioned earlier, air exhaust from the laundry ventilation system exited on the mooring deck. Intake vents on the port side of the mooring deck supplied fresh air to the stern thruster room, which was on deck No. 1, immediately below the main laundry. A vertical vent duct inside the plenum penetrated decks No. 4 and 3 and then ran forward/outboard above the potable water tanks. Once on deck No. 2, the duct ran forward and inboard to supply the thruster room. The supply intakes for the ship’s air conditioning system are on the ship’s transom (stern), two decks above the aft mooring deck. These ducts run forward between decks No. 6 and 7, and pass down through deck No. 5 and along the exposed overhead of the mooring deck before entering the air handling room on deck No. 4. Vessel Certification and Inspections General. The certification of a ship and its associated safety equipment and machinery is the responsibility of the “flag state,” or the country in which the vessel is registered. Liberia, the Ecstasy’s “flag state” at the time of the accident, is a signatory nation to SOLAS 74. Like most signatory nations, Liberia has incorporated SOLAS requirements into its national regulations. SOLAS requires that vessels meet the requirements of a recognized classification society or equivalent.25 Liberia delegated certification inspection authority to LR to ensure that the Ecstasy met its national statutory requirements. SOLAS regulations and classification society rules are intended to be complementary and nonduplicative. SOLAS provides detailed guidance on marine environment protection items, safety items such as structural fire protection, subdivision, 24 SOLAS Regulation II-2/32.1 refers to the application of Regulation II-2/16; Regulation II-2/32 applies to ships carrying more than 36 passengers and Regulation 16 in its entirety does not. 25 Regulation 3-1, Part A-1, Chapter II-1 of SOLAS 74, which entered into force in July 1998, states that, in addition to meeting applicable SOLAS requirements, ships shall be designed, constructed, and maintained in compliance with a classification society’s structural, mechanical, and electrical requirements.

Factual Information 29 Marine Accident Report and damage stability, and general guidance on ship construction and essential shipboard engineering systems. A classification society provides detailed rules pertaining to ship structural design and essential shipboard engineering systems. Classification. The Ecstasy was built and maintained under LR rules and held the highest vessel classification for construction (+100 A1). LR is a United Kingdom nongovernmental, nonprofit corporation founded in 1760 for the primary purpose of evaluating the structural and mechanical fitness of ships and other marine structures for their intended purpose. LR’s classification of a vessel involves establishing and administering its standards, known as Rules and Regulations (rules), for the design, construction, and operational maintenance of marine vessels and structures. The Ecstasy was designed under 1987 LR rules. Part 6, Chapter 2-1, “Electrical Installations–Equipment and Systems Design,” of the 1987 LR rules states that the wiring for “essential services,” that is, those services necessary for the propulsion and safety of the ship, should be duplicated. The following excerpts from the 1987 LR rules further define the electrical system design: Essential services that are duplicated are to be served by individual circuits separated throughout their length as widely as is practicable and without the use of common feeders, protective devices or control circuits. Where a duplicate supply is required, the two cables are to follow different routes which are to be as far apart as possible. Cables for essential and emergency services are to be arranged, so far as is practicable, to avoid galleys, machinery spaces, and other enclosed spaces of high fire risk except as necessary for the service being supplied. The general design guidance section states, “The distribution system is to be such that essential services, which are duplicated, are supplied from separate sections of the switchboard.”26 As part of this investigation, the Safety Board wrote LR asking the classification society to provide its interpretation of the rules cited above and the extent of their applicability to the electrical arrangement for the auxiliary voltage supply to the propulsion system’s high-speed breakers. In its letter, the Safety Board states: Recognizing that there may be some differences between the approved as designed drawings and the as built drawings, please comment on the applicability of the rules to both sets of drawings, if the differences between them are significant. If the electrical arrangement for the auxiliary voltage to the high- speed breakers complied with these rules, please discuss how the rules are actually intended to be applied. And finally, please comment on any Lloyd’s Register rule changes (if any) that have been made to the 1987 rules that may 26 Lloyd’s Register of Shipping Rules and Regulations for the Classification of Ships, Part 6, Control, Electrical, Refrigeration and Fire, January 1987, Chapter 2-1 Electrical Installations – Equipment and Systems Design, Section 2 System design – General, Subsection 2.1.6 Systems of supply and distribution.

Factual Information 30 Marine Accident Report address the reliability problems with the high-speed breaker auxiliary voltage supply arrangement that was installed aboard Ecstasy. In its response, LR states: The high speed circuit breakers to which you refer are those on the motor side of the cycloconverters through which the motors receive their power. The voltage(s) supplied from MS 21 appear, from the manufacturer’s data, to be primarily for the electrical closure of the circuit breakers. …after this fire, we were informed that the voltage supply from MS 21 is also used, internally within the cycloconverter, to provide a “circuit breaker closed” signal in order to “enable” the drives to start and to continue operating. The details of these internal connections were not provided to LR during LR’s plan approval, and LR’s surveys of the vessel’s construction. Therefore, LR was not aware, prior to this casualty, that if these cables were burnt through propulsion would be lost. LR receives “design” plans for consideration at or before the time of construction of the vessel. It is these plans that our surveyors review and stamp “approved” against applicable classification requirements. Upon completion of construction “as built” plans are forwarded to LR for record purposes. We have checked the Ecstasy design plans approved by LR at the time of construction and the “as built” plans forwarded to us for record purposes. Neither show the detailed matters referred to in your letter. There have been no rule changes made since 1987 which address specifically high speed breaker auxiliary voltage supply arrangements similar to those installed aboard Ecstasy. However, based on the experience gained over the years of what was in 1987 an innovative design, the Rules have been changed to take into consideration commonality of electrical supplies. U.S. Coast Guard Examinations. The United States requires that ships that embark passengers from U.S. ports be examined by the Coast Guard for “substantial compliance” with the construction, equipment, and safety requirements of SOLAS. The Coast Guard examinations are referred to as Control Verification Examinations (CVEs). These examination procedures are contained in the Coast Guard’s Navigation and Vessel Inspection Circular (NVIC) No. 1-93, which provides guidance regarding examinations for foreign cruise ship operators. The examination process involves three phases: an initial CVE, which is a plan review of new or existing vessels; an annual CVE, which is a review of the vessel’s firefighting, lifesaving and emergency systems; and a quarterly CVE, which is a safety review of the vessel’s operations. As of July 1,1998, the Coast Guard’s examination for passenger vessels included International Safety Management (ISM) Code provisions, which are discussed later in this report, under “International Safety Requirements.”

Factual Information 31 Marine Accident Report Before the July 1998 fire, the Ecstasy had undergone its last annual CVE on May 1, 1998. Coast Guard documents indicate no discrepancies were found during the CVE. Waterway Information The Port of Miami is the largest embarkation port for cruise ships in the United States, handling more than 3.1 million passengers annually. It is home port to 18 cruise ships. Carnival, Cunard, Norwegian Cruise Line, and Royal Caribbean International regularly operate cruise vessels from the Port of Miami. From Pier 8, the Ecstasy’s point of departure, to the harbor entrance, the channels and their respective dredged depths are as follows: Main Channel, 36 feet; Inner Bar Cut, 44 feet; Outer Bar Cut, 44 feet; and Government Cut, 42 feet. The widths of the channels vary from 400 to 600 feet. At Government Cut, two unmarked jetties protect the harbor entrance. Strong tidal currents run between the jetties. A northerly wind in the area causes a considerable southerly set27 across the ends of the jetties. The mean range of the tide at the harbor entrance is 2.5 feet. Shoals extend about a mile offshore northward of the harbor entrance. Pilotage is compulsory for all foreign-registered vessels and is supplied by Biscayne Bay Pilots. Meteorological Information At the time of the accident, the weather was cloudy with rainsqualls. Winds were variable and out of the East/Northeast at 15-20 knots, producing waves of 1 to 2 feet. Visibility in the rainsqualls was limited to 1-2 miles; otherwise, visibility was unlimited. No thunderstorms were in the vicinity. Operations General Carnival Cruise Lines’ parent company, Carnival Corporation, owns or has interest in seven cruise brands that operate as separate companies. The corporation has full ownership in Carnival Cruise Lines, Holland-America Line, Windstar Cruises, Cunard Line, Seabourne Cruise Line, and Costa Crocierw S.p.A and minority ownership in Airtours’ Sun Cruises. Combined, these lines operate 48 cruise ships. Carnival Corporation is scheduled to add 13 ships to its fleet by the end of 2005. 27 Set is the direction in which the current flows.

Factual Information 32 Marine Accident Report Carnival Cruise Lines presently runs 16 passenger vessels on pleasure cruises that last 3 to 16 days and that include itineraries to the Bahamas, Caribbean, Panama, Mexico, Hawaii, and Alaska. At the time of the accident, the operating company regularly ran the Ecstasy on 3- and 4-day round-trip cruises from the Port of Miami. The 4-day cruises departed on Monday and had stopovers at Key West and Cozumel, Mexico. The 3-day cruises left on Friday and sailed to Nassau, Bahamas, where it docked for 1 day before returning. International Safety Requirements At the 1994 SOLAS Conference, the IMO General Assembly adopted a resolution entitled “The International Management Code for the Safe Operation of Ships and for Pollution Prevention,” known, in brief, as the ISM Code, to encourage the continuous improvement of safety management skills in the maritime industry. The ISM Code became effective on July 1, 1998, for all passenger ships and for the following vessel types of 500 gross tonnage and over: oil tankers, chemical tankers, gas carriers, bulk carriers, and high speed cargo ships.28 The ISM Code requires a company29 to establish and maintain a documented SMS that, among other things, meets the following safety management objectives:

1. Provides for safe practices in ship operation and a safe working environment;
2. Establishes safeguards against all identifiable risks; and
3. Continuously improves safety management skills of personnel ashore and

aboard vessels, including preparing for emergencies related both to safety and environmental protection. The ISM Code establishes six functional requirements for an SMS: • Policies for ensuring safety and protecting the environment; • Instructions and procedures for ensuring safe vessel operation and environmental protection in compliance with international and domestic laws; • Defined levels of authority and lines of communications between and among shipboard and shoreside personnel;30 • Procedures for reporting accidents and nonconformities; • Procedures for preparing for and responding to emergency situations; and 28 The rules for all other cargo ships and MODUs of 500 gross tonnage and over enter into effect on July 1, 2002. 29 The ISM Code defines company, in part, as “the owner of the ship or any other organization or person…who has assumed responsibility for operation of the ship from the shipowner and who, on assuming such responsibility, has agreed to take over all the duties and responsibility imposed by the Code.” 30 The ISM code stipulates that a company’s SMS clearly define and document the master’s responsibilities and emphasize his authority in its SMS.

Factual Information 33 Marine Accident Report • Internal audits and management reviews. The procedures required by the ISM Code must be documented and compiled in a Safety Management Manual (SMM), which must be maintained on board a company’s ships. The ISM Code requires that a company provide necessary resources and shore- based support to achieve SMS objectives that includes appointing a designated person or persons ashore having direct access to the highest level of management. The flag state government is responsible for enforcing the ISM Code and for issuing documentation attesting that companies are in compliance with it. A company complying with the ISM Code is issued a Document of Compliance, a copy of which must be kept on board the ship. Ships in compliance with the ISM Code are issued a SMS document. Carnival Cruise Lines’ Safety Management System LR certified that Carnival Cruise Lines’ SMS and its vessels, including the Ecstasy, were compliant with the ISM Code in December 1997, or 6 months ahead of the IMO deadline. Investigators reviewed the SMM maintained by Carnival Cruise Lines on board the Ecstasy. The SMM defines the organization of the company’s SMS, states its policies, and lists the various operating manuals that cover key shipboard operations. Manual 00 of the company’s SMM, entitled “Master Safety Management System,” contains a policy statement, which says, in part: The main objectives of the SMS are to ensure the motivation of all CCL personnel through effective education and training, and to outline specific responsibilities for safety and environmental protection throughout all CCL operations. The SMS emphasizes a pro-active attitude toward the elimination of operational problems, such that require forward planning and prevention procedures, on the part of all Carnival Cruise Lines personnel, will eliminate the occurrence of problems detrimental to the standard of passenger service offered by Carnival Cruise Lines and ensure safety at sea, personnel safety, and avoidance of damage to the environment. The individual manuals, in turn, identify operations that are considered special or critical, establish safe procedures for conducting those operations, and assign qualified individuals to perform the tasks necessary for the operations. For example, Manual 03, “Health and Safety,” indicates that the goal of the company is to “eliminate work-related accidents, injuries, incidents and hazardous occurrences.” Manual 03 states that management responsibilities include providing the information, instruction, training, and supervision necessary for compliance with health and safety requirements. The manual lists the staff captain as the designated HSO for the vessel and states that, as such, he is responsible for ensuring compliance with “all health and safety instructions, rules,

Factual Information 34 Marine Accident Report procedures, and guidance.” The manual further states that crewmembers are responsible for taking all reasonable care for their own health and safety and for that of all others on board the ship and that they must cooperate with the company, master, chief engineer, and all others who are responsible for health and safety aboard ship. SMS Manual 03, Section 5, “Safety Procedures,” contains subsections on permit- to-work systems (5.7) and welding and flame cutting operations (5.13). According to the SMS manual, a permit-to-work system covers “operations on board ship where the routine actions of one man may inadvertently endanger another.” The system identifies foreseeable hazards posed by various tasks and operating environments and lists precautions and sequential actions to take when performing such tasks. The SMS manual states, “In all instances it is necessary, before the work is done, to identify the hazards31 and then to ensure that they are eliminated or effectively controlled.” The manual further advises that the first and most important step in eliminating or effectively controlling hazards is a situational assessment by the ship’s officer who is experienced in the work and thoroughly familiar with relevant hazards. The subsection specific to hot or cold work stipulates that permits that grant permission for such work must be countersigned by the chief engineer, staff chief engineer, master, or staff captain. The subsection on welding and flame cutting operations states, “No welding or flame cutting work should be undertaken unless the requirements of the ‘Hot Work Permit’ are fully satisfied.” The manual stipulates that welding operations should be properly supervised and kept under regular observation and that a person with a suitable extinguisher should be stationed to keep watch on areas not visible to the welder. Manual 07, “Safety of Operations—Engineering Department,” states that the staff chief engineer or engineering officer team leader must ensure that all measures and precautions that are necessary for the safety of those concerned are taken before any repair or maintenance work begins. Investigators reviewed the Ecstasy records of hot work permits issued for various maintenance tasks outside the ship’s machine shop and workshop. The log and copies of approved permits do not include an application or an approval for a welding project in the ship’s main laundry on July 20, 1998. After the fire onboard the Ecstasy, Carnival Cruise Lines revised its SMS to include safeguards against unauthorized welding. See “Other Information,” later in this report. Manual 08, “Safety of Operations—Hotel Services,” states that the laundry manager is responsible for, among other tasks, ensuring the safe operation of all laundry equipment and the proper cleanliness of the laundry room, laundry equipment, and the laundry crew galley. The manual lists 17 required safety procedures for the laundry area. The procedures specify the required operating temperatures for washers, dryers, and the mangle, proper handling of chemicals, and measures for handling linens, clothes, and uniforms. The laundry safety procedures also include prohibiting smoking in the laundry room and performing a fire risk assessment at regular intervals. 31 At the time of the Ecstasy accident, Manual 03 did not include a section on job hazard analysis. Since the accident, Carnival Cruise Lines has developed and added a chapter “Safe Systems of Work - Job Hazard Analysis.”

Factual Information 35 Marine Accident Report According to Carnival Cruise Lines’ officials, at the time of the Ecstasy accident, all officers and crewmembers assigned to ships in the company’s fleet had received a general overview training of the SMS. Employees had been given specific training in those areas of the SMS pertaining to their duties. The company had established a schedule of weekly reviews of the SMS, which included departmental meetings during which supervisors reviewed provisions of the SMS with crewmembers. Additional Oversight Practices According to Carnival Cruise Lines’ officials, to complement its SMS, the company retained some management oversight practices that it had in place before it developed its SMS. Management representatives, typically a shoreside ship supervisor or a port engineer or port captain, visited each ship in the company’s fleet at least once monthly to ensure that shipboard personnel were following and practicing corporate safety management policies. In addition, Carnival Cruise Lines had a quality control committee, headed by the company president, that visited each ship yearly to meet with the master, department heads, and the entire crew to answer any questions on corporate policy and vessel operations. Medical and Pathological Medical Findings Medical responders examined at least 70 passengers and crewmembers to determine whether they were injured and required additional medical treatment. Six passengers were treated by medical personnel and local hospitals for pre-existing conditions; three passengers were treated for smoke inhalation. Fourteen crewmembers were treated for minor injuries, including smoke inhalation, chest pain, lower back pain, cervical strain, knee pain, and a knee contusion. Toxicological Testing Carnival’s requirements. At the time of the Ecstasy accident, Carnival Cruise Lines’ health and safety manual contained the following requirements pertaining to drug testing (italics added for emphasis):

1. All testing for drugs will be by the analysis of urine.
2. Prospective Company seafarers may be required to undergo drug testing prior

to an offer of employment being made.

1. Company seafarers may be required to undergo periodic drug testing.
2. Unannounced testing may be carried out at intervals, initiated by Company. All

unannounced drug testing, including urine sampling, will be carried out by shore personnel only.

Factual Information 36 Marine Accident Report

1. Should circumstances permit, post casualty testing for drugs must also be

carried out immediately after any safety or pollution accident or incident. The post casualty testing must be carried out on the Master and Chief Engineer and those other Officers and crewmembers who were performing any duty at the time of the incident or casualty. About 0030, July 21, 1998, while the Ecstasy was under tow from the sea buoy to the Port of Miami, the Coast Guard notified Carnival Cruise Lines to conduct postaccident toxicological screening for drugs and alcohol. About 0430, or about 12 hours after the fire was detected aboard ship, technicians from Toxicology Testing Service, Inc., of Miami began taking blood specimens for alcohol testing and collecting urine specimens for drug screening. By 1100, the technicians had tested 79 crewmembers, including the officers and fitters discussed earlier in this report. The first officer who was on bridge watch at the time of the fire and a junior electrician who was not on watch tested positive for cannabinoids. They were subsequently dismissed by Carnival. An oiler who was on watch in the engine room tested positive for alcohol. He stated, however, that he had consumed alcohol after the fire emergency had subsided. According to Carnival Cruise Lines’ officials, the company had not been conducting random drug tests of its shipboard crews before the Ecstasy fire. Following this accident, the company revised its hiring policies to require drug testing as a condition for employment. The company instituted a program of random drug testing and adopted a “zero tolerance” policy, meaning it will dismiss any employee who tests positive for illegal drugs. Wreckage Operating Systems Propulsion system. Investigators noted that electrical cables in the ventilation exhaust plenum near the mooring deck were burned and melted. Some of these cables supplied voltage from an electrical distribution panel in an equipment room near the aft mooring station to the high-speed breakers for the port and starboard propulsion systems. Following this accident, Carnival Corporation modified the voltage supply arrangement to the high-speed breakers aboard the Ecstasy by providing selectable redundant voltage supplies to each set of high-speed breakers from independent power sources. According to Carnival officials, the company also planned to modify the arrangement aboard other vessels in the Fantasy class. Steering gear systems. During the accident, the port steering system completely failed, but the starboard hydraulic system continued to operate even though the monitoring system failed. The port and starboard steering gear rooms were on deck No. 3, directly

Factual Information 37 Marine Accident Report below the fire on the aft mooring deck. The electrical power and control cables for the steering systems were routed in cableways near the overheads of the steering gear rooms on deck No. 3. Investigators observed that the control cables and control system components in the steering gear control cabinet were burned and melted. The port steering gear room showed evidence of greater damage to a greater extent than the starboard steering gear room. Stern thruster system. The temperature-sensitive equipment in the stern thruster room, including the power supply cables to the stern thruster electric motors, were burned and melted. Two of the three stern thruster electric drive motors were damaged by heat. Low-location lighting. The wiring insulation on a portion of one low-location lighting loop was melted. The system was designed to sound an alarm on the bridge in the event of a power failure. Air conditioning system. Investigators observed signs of heating-flame impingement on the transom next to the intake supply ventilators. This air conditioning duct ran beneath cabins and storage lockers on deck No. 7, where the carpet and furnishing sustained heat damage. Other Damaged Areas Table 4 summarizes the conditions and damage that investigators observed in various areas of the vessel during their postaccident examination of the Ecstasy. Table 4. Damage by Deck Area Deck Location Observed Conditions and Damage 2 Laundry room Laundry space sustained no fire damage. Several areas within the space sustained heat and smoke damage. The mangle had smoke and soot on its underside. A light fixture near the mangle had melted. Mangle had melted and burned insulation in the electrical control cables of the control panel (under the loading end of mangle) and in the mangle’s exhaust system. The housings of the two mangle exhaust blowers that removed steam from the rollers were caked inside with partially burned lint and wax.* Impeller blades on the aft exhaust blower fan were not attached to the fan motor shaft. All that was left of the fan impeller blades were rust colored metal flakes that were imbedded in the lint and wax. Impeller on the forward fan was caked with lint and wax but was otherwise intact. The ducts attached to the two mangle blowers sustained heat damage. The paint on the aft exhaust duct was blistered and charred; the forward exhaust duct had less heat damage. Both ducts contained burned debris. Felt on the loading end roller was burned on the edge nearest the aft blower. Ventilation duct above the mangle contained 2-3 inches of burned debris.

Factual Information 38 Marine Accident Report

• The strings that directed the linens through the mangle were coated with wax.

Survival Factors This section contains the regulatory requirements, Carnival Cruise Lines’ provisions and procedures related to shipboard emergency training and drills, passenger feedback obtained from interviews and a survey that the Safety Board mailed to a sample of passengers,32 and a detailed description of the actions by the emergency responders to the incident. Regulatory Requirements: The following are excerpts from the SOLAS Regulations: Regulation 18: 3.1, “Emergency Training and Drills”: Each member of the crew shall participate in at least one abandon drill and one fire drill every month. The drills of the crew shall take place within 24 hours of the ship leaving port if more than 25 percent of the crew have not participated in abandon ship and fire drills on board that particular ship in the previous month. The Administration may accept other arrangements that are at least equivalent for those classes of ship for which this is impracticable. 3.2 On a ship engaged on an international voyage which is not a short international voyage, musters of passengers shall take place within 24 hours after their embarkation. Passengers shall be instructed in the use of the life-jacket and the actions to take in a emergency. Regulation 25, “Drills”: On passenger ships, an abandon ship drill and a fire drill shall take place weekly. 2 Laundry crew galley (pantry) The galley and its contents were heavily covered with soot. Area showed no evidence of flame exposure. 3 Refrigerators and dry provision stores Vent in the overhead above a sink contained soot. Port side: The overhead ventilation duct showed signs of intense heat. Near this vent, the steel deck was buckled and its paint was charred and cracked. The stainless steel sheathing of the cool storage space was warped, discolored blue, and had pulled away from joints. Starboard side: No visible damage. Vent covers had soot deposits. 4 Passenger cabins and corridors Fire damage, which included scorched carpeting and furnishings, was limited to passenger cabins and corridor area nearest the WTDs. 32 See “Postaccident Survey,” which appears later in this report. Table 4. Damage by Deck Area Deck Location Observed Conditions and Damage

Factual Information 39 Marine Accident Report Regulation 53, “Muster List and Emergency Instructions”: The muster list shall show the duties assigned to members of the crew in relation to passengers in case of emergency. These duties shall include: warning the passengers; seeing that they are suitably clad and have donned their lifejackets correctly; assembling passengers at muster stations; keeping order in the passageways and on the stairways and generally controlling the movements of the passengers; ensuring that a supply of blankets is taken to the survival craft. Emergency Procedures and Drills Crew training. The Ecstasy safety officer stated that all crewmembers on board had participated in a “vessel familiarization program,” as required by STCW. Investigators reviewed the program curriculum and a sampling of personnel training files. The courses provided by the safety officer included Safety Communication, Signs and Alarms; Crew Muster Stations, How to Locate and Don Lifejackets; Man Overboard Initial Action; Fire Emergency Initial Action; Medical Emergency Initial Action; Close and Open Weathertight, Watertight, and Fire Screen Doors; and Vessel Familiarization Assessment. A station bill on board the Ecstasy specified the responsibilities and emergency stations for each crewmember in the event of an emergency. According to the safety officer, fire drills were held weekly and were conducted as if an actual emergency existed. Crewmembers were required to report to fire stations with firefighting equipment and simulate a response to a fire. At the time of the accident, Carnival Cruise Lines had not developed a crowd management plan, including crowd control training for crewmembers. According to the Ecstasy’s safety officer, he and the staff captain provided instruction on proper crowd control procedures to crewmembers who were assigned to direct passenger evacuation, muster station leaders, lifeboat commanders, and other supervisory personnel during the weekly emergency drills and other routine training. The safety officer stated that the Coast Guard tested the crewmembers’ knowledge of crowd management procedures during annual and quarterly CVEs. He indicated that, during emergencies when routine procedures did not apply, the master or other officers provided instructions specific to the situation. Passenger drill. Before the Ecstasy departed Miami, passengers were required to participate in an abandon ship, or muster, drill. According to the cruise director, he followed a script during the drill, which contained the following instructions: • Crewmembers will guide passengers to their muster stations and instruct them how to wear the lifejackets. • If passengers must abandon ship, lifeboats would be lowered to the embarkation deck to allow them to board the boats. • If passengers do not have enough lifejackets in their cabin for the number of occupants including children, a cabin steward will provide extra lifejackets.

Factual Information 40 Marine Accident Report • A placard in each passenger cabin provides emergency instructions. (See appendix C.) According to passengers and shipboard personnel, passengers were not told during the drill how to determine which crewmembers would assist them. They said that, during the drill and the actual emergency, the crewmembers having primary responsibility for assisting passengers and distributing lifejackets did not wear any type of identification. Passenger accountability. According to Carnival Cruise Lines’ officials, shoreside personnel prepared a manifest, which was provided to shipboard personnel, of all passengers who booked a cruise on the Ecstasy. As passengers boarded the vessel, they were asked to sign for a computerized “sign and sail” card that was used to make purchases. Shipboard personnel used the computer data to confirm which booked passengers actually boarded the Ecstasy. Throughout the cruise, the crew used the computerized cards to determine which passengers debarked and boarded the vessel at travel stops. The lifejackets provided in each stateroom were imprinted with the letter of the muster station to which the occupants of that stateroom were to report during a drill or an emergency. Crewmembers in charge of the muster stations determined whether or not passengers had reported to the correct station by the lettered lifejackets that they wore. A list of the passengers who were supposed to report to a given muster station was not maintained at the muster station or provided to the muster station leader. During an emergency, crewmembers were assigned to search each stateroom to make sure that it was vacant and were required to place a towel around the exterior doorknob indicating that the stateroom had been searched. Lifesaving equipment. An LR “Record of Equipment for the Passenger Ship Safety Certificate,” issued May 2, 1997, indicates the Ecstasy’s lifesaving equipment met the requirements of SOLAS 74, as amended in 1998. The SOLAS 98 amendments stipulate the following requirements for personal lifesaving appliances under regulation 7.2, “Lifejackets”: 2.1 A lifejacket complying with the requirements of paragraph 2.2.1 or 2.2.2 of the Code shall be provided for every person on board the ship and, in addition: .1 a number of lifejackets suitable for children equal to at least 10 percent of the number of passengers on board shall be provided or such greater number as may be required to provide a lifejacket for each child; and .2 a sufficient number of lifejackets shall be carried for persons on watch and for use at remotely located survival craft stations. The lifejackets carried for persons on watch should be stowed on the bridge, in the engine control room and at any other manned watch station.

Factual Information 41 Marine Accident Report 2.2 Lifejackets shall be so placed as to be readily accessible and their position shall be plainly indicated. Where, due to the particular arrangements of the ship, the lifejackets provided in compliance with the requirements of paragraph 2.1 may become inaccessible, alternative provisions shall be made to the satisfaction of the Administration which may include an increase in the number of lifejackets to be carried. The SOLAS 98 amendments contain additional requirements for personal life- saving appliances at regulation 22, which states, in part: 2.1 In addition to the lifejackets required by regulation 7.2, every passenger ship shall carry lifejackets for not less than 5 percent of the total number of persons on board. These lifejackets shall be stowed in conspicuous places on deck or at muster stations. 2.2 Where lifejackets for passengers are stowed in staterooms which are located remotely from direct routes between public spaces and muster stations, the additional lifejackets for these passengers required under 7.2.2 shall be stowed either in the public spaces, the muster stations, or on direct routes between them…. The LR certification attachment indicates that the Ecstasy carried the following life-saving appliances: 10 immersion suits; 270 thermal protection aids; 18 lifeboats; 2 rescue boats, and 36 life rafts. The LR form indicates that the Ecstasy had 3,738 adult lifejackets and 356 child lifejackets, or a total of 4,094 lifejackets, to accommodate a maximum load of 3,560 people. Carnival Cruise Lines’ records indicate that, on the day of the accident, the Ecstasy carried 4,368 adult-size lifejackets and 578 child-size lifejackets, or a total of 4,946 lifejackets. (Appendix D shows the location of the lifejackets.) As indicated earlier in this report, the ship did not sail with a maximum load. The passenger manifest listed 2,342 adults and 223 children, and the crew manifest showed 916 crewmembers. Postaccident survey. The Safety Board mailed questionnaires to 300 passengers who had been on the Ecstasy asking about the muster drill and whether they encountered any problems during the actual emergency. The Board received 126 responses, which are summarized below. All 126 responders indicated that they participated in the drill. Most passengers stated that the drill proved valuable during the actual emergency in that they were able to identify the general emergency alarm, don their lifejackets, and find their muster and lifeboat stations. They indicated that they appreciated being told that the ship had a fire squad and extra lifejackets on board. Seventy-nine passengers indicated that, during the actual emergency, the ship’s crewmembers seemed well trained and organized and did a good job. All responders said that they heard the cruise director announce “a minor fire situation,” which was under control, and that they were to report to their muster stations. Passengers described the crewmembers as calm and helpful in directing passengers and addressing their questions. Responders stated that the cruise director made frequent announcements, both in English and in Spanish, throughout the emergency. Some

Factual Information 42 Marine Accident Report responders who initially reported to an outside muster station said that, because of helicopters flying nearby, they occasionally had problems hearing announcements broadcast over the loudspeaker system. They said that when they advised the crewmembers of the problem, they notified “officials” [the cruise director], who then relayed status accounts to muster personnel, who, in turn, provided the information to the passengers. Fifty-three survey responses identified various problems or situations that were not addressed during the drill. Several people indicated that the drill did not include specific information about fire emergencies, including what to do if they encountered smoke or fire. A number of respondents said that they could not report to their station because of smoke, and the drill did not provide information about what to do if a muster station was not available. Some passengers indicated that they had problems recognizing crewmembers to direct or assist them during the emergency. Several of the responders expressed dissatisfaction about the lack of consistency in the crew’s provision of lifejackets to the mustered passengers. During the drill, the passengers were advised that, in the event of an emergency, if they could not retrieve the lifejackets from their staterooms, they would be provided lifejackets after reporting to their muster stations. Seventy-nine survey responders said that they either obtained lifejackets from their cabin or were provided lifejackets by crewmembers. Forty-seven passengers said that they never received lifejackets. Two passengers stated that when they asked for lifejackets, a crewmember started to pass them out and then reportedly was ordered to stop doing so by his superiors because they were concerned that distributing lifejackets might cause panic. One passenger stated that one crewmember told her not to retrieve her lifejacket from her stateroom and later another crewmember told her to get her lifejacket from her cabin; however, when she attempted to do so, she could not reach her stateroom because of the smoke. Seventy-two responders, primarily those who had been in the aft section of the Ecstasy, indicated that the emergency alarm and the announcements to muster did not occur until after they saw or smelled smoke in their cabins and the passageways. Several passengers estimated that the time between the first evidence of smoke and the emergency alarm was 30 minutes or more. Other responders indicated that they first learned about the ship’s fire from television news reports. Trapped Crewmen A cabin steward whose cabin was on deck No. 2, close to the main laundry, described to Safety Board investigators how he and another crewmember became trapped by heavy smoke during the fire. About 1805-1810, he was in the passageway when he heard some of the laundry crewmembers talking in Chinese. He returned to his cabin where he smelled smoke. When he went back out into the passageway, the laundry workers were talking, “maybe arguing.” One of the laundry workers told him to close his door, whereupon he returned to his cabin. He then saw a small amount of smoke coming from his vent. He returned to the passageway and saw that the laundry crew had left. He went back into his cabin to grab a lifejacket and saw heavy gray smoke coming from the

Factual Information 43 Marine Accident Report vent. He then realized that a fire might have broken out so he left his cabin and started knocking on cabin doors to alert others. The steward found one other crewmember. The steward said that the two of them attempted to escape from deck No. 2; however, heavy smoke filled the passageways, severely limiting their visibility. The steward said that, based on survival techniques that he learned from the safety officer and the safety information booklet, he started to take refuge in a common area toilet facility. He then realized that the other crewmember had not followed him but had continued down the passageway. Holding a towel to his face, the steward felt his way along the bulkhead in the direction of the crewman, who was coughing and calling for help. The steward told the crewmember to calm down and follow him. They went into the toilet facility, where the steward turned on the water in the shower, and they soaked their hair and clothes. The steward told the crewmember to stay low. Smoke started to enter the shower area, whereupon the crewmember panicked and tried to open the door. The steward put his nose toward the shower drain to get air and directed the other crewman do the same. The steward said that, when he next opened the door to the corridor, the passageway was totally black. He began to pound on the bulkhead to attract attention. The crewmember went into the passageway. The steward put a towel over his nose and followed the crewmember into the passageway, where they heard the sounds of the firefighting teams checking the area and called out to them. The shipboard firefighters then led the two crewmembers above deck. Emergency Response The local agencies responding to the Ecstasy fire included the Coast Guard, Miami Beach FD, Miami-Dade FD, Coastal Tug, and Moran Towing, Inc. The response agencies were notified or learned of the Ecstasy fire from various sources within about a half hour of each other. The MSO-Miami watchstander, after seeing the Ecstasy with smoke streaming from its stern, telephoned and verified the presence of a fire with the ship’s master about 1728. About the same time, vessel pilots reported the fire to the Biscayne Pilots Association, which notified Coastal Tug. Shortly thereafter, about 1745, Miami area residents reported a fire on board a ship in the channel to Miami Beach FD, which contacted Miami-Dade FD.33 The COTP implemented a unified command system employing two operating bases. Initially, the Coast Guard and Miami Beach FD operated from the MSO-Miami Operations Center, and Miami-Dade FD, Carnival, port officials, and area police operated from a post established at the Port of Miami. Miami-Dade FD subsequently sent an additional representative to the MSO-Miami location. The parties remained in telephone communications with each other and officers on board the Ecstasy to coordinate activities throughout the incident. The specific actions of the various response agencies are summarized below. 33 Miami-Dade FD had jurisdiction when the ship was at the Port of Miami and Miami Beach FD had jurisdiction while the ship was in Government Cut Channel and offshore.

Factual Information 44 Marine Accident Report Coast Guard. Upon learning of the fire on board the Ecstasy, MSO-Miami paged the COTP, who was off duty, and radioed Coast Guard vessels to respond. The COPT said that he immediately returned to the operations center, arriving about 1800. When the COTP arrived at the operations center, the executive officer briefed him and advised him that a safety zone had been established around the Ecstasy.34 The COTP said that he radioed the Ecstasy’s master, who told him that the fire was contained to the aft mooring deck by the ship’s MVZ boundaries and that the crew and waterside tugs were actively fighting the fire. The COPT said that when Miami Beach FD and Miami-Dade FD representatives arrived, he implemented a unified command system at the operations center. Based on information that the Ecstasy’s fire was contained and that no one on board had sustained a serious injury, the COTP stated that the unified command members agreed that the first objective was to get the fire under control and then return the ship to port to disembark the passengers. The COTP stated that transferring the passengers to another vessel would have “presented unwarranted danger” to them. In the meantime, a Coast Guard 41-foot utility boat (UTB) had arrived on scene at the Ecstasy and was assisting a Coastal tug in spraying water on the fire. A Coast Guard vessel carrying two MSO personnel arrived shortly thereafter. The MSO personnel boarded the Ecstasy about 1835 and went to the bridge where the master gave them a status report on the fire and shipboard activities. One of the MSO personnel, a chief warrant officer, radioed the information to the MSO duty officer and then went to meet with the ship’s safety officer in the aft section of the Ecstasy. The warrant officer said that as he proceeded aft, he checked conditions on the ship. He said that the passengers were at the muster stations and that they had either donned their lifejackets or had them nearby. He noted that the low-level lighting was not illuminated. While the warrant officer was examining conditions below deck, the other MSO employee remained on the bridge, relaying information to the unified command center. At 2100, upon receiving a report from Coast Guard personnel on the Ecstasy that the fire was under control, the COTP and the Miami-Dade FD made a unified decision to bring the ship back to the Port of Miami. Pilots who had been sent to the Ecstasy to assess the piloting requirements for the cruise ship directed the positioning of tugs at the bow, stern, and both sides of the vessel. The ship was then turned and maneuvered back toward the entrance channel to Miami. By 2400, the Ecstasy had been towed back to the sea buoy area. Upon being advised by the pilot that the ship was handling well, the COPT granted permission for the Ecstasy to berth, which was accomplished about 0130 July 21, 1998, at Pier 8, Port of Miami. After discussions with Carnival Cruise Lines officials and Miami Dade FD, the COTP ordered that all passengers be disembarked as soon as possible. Local fire departments. Upon receiving several 911 calls from area residents reporting a possible ship fire, the Miami Beach FD contacted the fire dispatch office and 34 33 CFR 165.20: A Safety Zone is a water area, shore area, or water and shore area to which, for safety or environmental purposes, access is limited to authorized persons, vehicles, or vessels. It may be stationary and described by fixed limits or it may be described as a zone around a vessel in motion.

Factual Information 45 Marine Accident Report was told that the Coast Guard was in radio communication with the Ecstasy and that the fire was reportedly under control. Based on area television coverage of the fire, an FD division chief later telephoned the Coast Guard to report that the fire did not appear to be controlled and then went to the Coast Guard operations center to participate in the unified command operations. Once there, he contacted the Miami-Dade FD to join the unified command structure and to request shipboard firefighting resources. By 1930, the two fire departments had assembled and dispatched two strike teams on Coast Guard cutters to the Ecstasy. Strike team No. 1 consisted of Miami-Dade FD firefighters35 who were to assess the fire conditions and advise the unified command whether the Ecstasy should be allowed into port. Strike team No. 2 consisted of Miami Beach FD firefighters and medical personnel who were to triage and treat the injured. Once on the Ecstasy, the strike team No. 1 leader conferred with the Coast Guard representatives, the master, and Carnival Cruise Lines’ firefighting safety training director about the heat and smoke conditions, and all agreed that the ship could not return to port until the fire was confirmed out. They established a fire operations center in the marshaling area near the stern on deck No. 3 and developed an action plan to systematically assess the fire area by searching all 10 decks in the aft section of the ship. While the strike team No. 1 leader remained at the marshaling area, the strike team members attempted to enact the plan to confirm the status of the fire but could not do so because of the heat and smoke conditions. The fire team members were then stationed at the fire doors to monitor the affected areas and check for developing fires while the passageways were ventilated, thereby dissipating some of the heat and smoke. After strike team No. 1 completed its assessment, the strike team leader briefed the COTP, Carnival Cruise Lines representatives, and other personnel about the status of the fire. At his recommendation, the firefighters continued to ventilate the affected areas and selected teams continued to monitor conditions on decks No. 5, 6, and 8. The Miami-Dade hazardous materials team monitored the entire ship for transfer of carbon monoxide from the fire area. About 2109, the fire was declared extinguished. While the fire was being assessed, strike team No. 2 examined and treated at least 70 patients and arranged transport for those requiring further medical treatment at area hospitals. Strike team No. 2 also established a rehabilitation area to examine the Ecstasy crew firefighters as they completed their firefighting operations.36 Emergency Preparedness Drills and Exercises On October 3, 1997, representatives from Carnival Cruise Lines, the Port of Miami, the Biscayne Pilots, area emergency response agencies, and the Coast Guard participated in a marine firefighting table-top exercise that simulated a fire on board the Ecstasy. 35 Strike team No. 1 was a firefighting suppression team. 36 The strike teams did not participate in any active firefighting. All shipboard firefighting efforts were undertaken by Ecstasy crewmembers.

Factual Information 46 Marine Accident Report On December 16, 1997, Carnival Cruise Lines held a Crisis Management Team exercise to practice the company’s Crisis Management Plan for responding to emergencies on its cruise ships. The exercise was a simulation of a crisis aboard a Carnival Cruise Lines’ vessel that focused on the assembly of the Crisis Management Team. Carnival Cruise Lines conducted notifications according to the Crisis Management Plan. The exercise scenario involved a fire in the ship’s laundry spaces. Carnival Cruise Lines representatives attended a High Capacity Passenger Vessel Incident Response, Planning and Risk Management Workshop on September 20-21, 1995, sponsored by the Coast Guard and Massachusetts Maritime Academy. Tests and Research Metallurgical Testing After the accident, Safety Board investigators examined the welding unit because of the second fitter’s statement about witnessing an arc. Three beads of weld-like material were found on the ground clamp. The Safety Board performed metallurgical tests on the beads found on the ground clamp, on welding rods from the vessel’s shop, and on the rod found in the welding machine after the fire. The material in the beads was found to be consistent with the material found in the welding rod in the electrode. Debris Testing Safety Board investigators collected mooring line remnants and debris samples from the surface of the mooring deck to send for testing at the Bureau of Alcohol, Tobacco, and Firearms (ATF) laboratory in Atlanta, Georgia. No accelerant material was found in any of the samples. Mooring Line Testing The Safety Board contracted testing to determine the combustibility of the polypropylene line used on the mooring deck. The line material had heat applied to it at a constant rate (three different heat fluxes/amounts were tested). The amount of heat given off was measured. The testing determined that the average heat of combustion37 for the line was 18,217 Btu (British thermal units) per pound (Btu/lb). The average heat of combustion for gasoline is about 19,000 Btu/lb. The minimum amount of applied heat required to ignite the line in 14 seconds was 80 kW/m2. A table in appendix E lists the heat release rate information in more detail. Lint Testing Because fire consumed the lint on the Ecstasy, Safety Board investigators collected lint samples for combustibility testing from the laundry exhaust system of a sister ship, the Fantasy. (The examination of sister ships is discussed in the next section.) Tests conducted 37 The heat of combustion is the amount of heat that the material gives off when it burns.

Factual Information 47 Marine Accident Report by ATF fire specialists showed that the lint was ignited easily by a spark and burned for several seconds, leaving little residual material behind. The minimum heat flux for an ignition was equal to 11.5 kW/m2. Other Information Examination of the Imagination and the Fantasy After the Ecstasy fire, Safety Board investigators examined the Imagination and the Fantasy, two Fantasy line ships having the same basic arrangement as the Ecstasy. The mangles on the Imagination and the Fantasy differed from the mangle on the Ecstasy. The Imagination’s mangle was built by the same company; however, the machine was a later model, and its exhaust system was configured differently. The mangle in the Fantasy’s main laundry was manufactured by a different company The main laundry ventilation system on the Imagination varies slightly from that on the Ecstasy and the Fantasy. The plenum is divided into two sections: lower section for accommodation exhaust and upper section for laundry exhaust. In addition, the dryers on the Imagination had been fitted with a “centrifugal” filter. The air from the dryers is vented into this filter and then sent out the exhaust vent. According to the laundry manager, the filter removes a large amount of lint and is cleaned about every 3 hours, or about four times a day, during laundry operation. He stated that the filter does not completely remove lint from the air exhausted out on to the mooring deck. On the mooring deck, investigators removed the louvers on the exhaust plenum and observed lint accumulated in the plenum as well as the intake filters for the thruster room. They also noted that lint had collected on stored rope on the deck and on the spindled rope on the winches. Further examination revealed that the lint was forced down into the fibers of the rope. According to shipboard officials, the mooring crew washed down the deck about once a week. During inspections of the Fantasy, investigators noted that the centrifugal filter used on the Imagination was not yet in place on the Fantasy or on the Ecstasy. The mangle and the dryer had separate duct systems similar to the Ecstasy. The Fantasy had a large amount of accumulated lint. According to the Fantasy’s chief engineer, the accessible areas of the exhaust ducts and plenum are cleaned about every 20 days, and the ducts and plenum had been cleaned about 4 or 5 days before this inspection. Investigators observed several inches of accumulated lint in the dryer ducts and plenum. The mangle duct contained about ½ of an inch of lint that was coated with a waxy or oily substance. On the mooring deck, the stored rope had accumulated large piles of lint. Investigators noted that the lint had become embedded into the rope fibers.

Factual Information 48 Marine Accident Report Carnival Cruise Lines’ Postaccident Actions On August 10, 1998, Carnival Cruise Lines, as part of its SMS program, issued to its fleet Operations Safety Bulletin (OSB) No 04-98, which states, in part: DESCRIPTION: Lint and other fibrous material might collect in the ship’s exhaust system and can pose a serious fire hazard. Even with our filtering system, a certain amount can get past the present filters. This OSB is being provided to alert the vessels to this potential fire risk. ACTION REQUIRED: Immediately conduct an extensive examination of all ducts that are part of the exhaust system which originates from or near the laundry. You are to remove all panels that are necessary to enable personnel to determine the amount of lint in the duct system. Any lint found is to be removed by all available means including but not limited to, vacuuming, sweeping, hand cleaning, washing, etc. You are to take photos prior to cleaning as well as after the cleaning to establish the status before and after. As the SMS requires, all dryer filters are to be inspected, cleaned and logged. The filter cleaning schedule is to be posted with records for signatures as per previous instructions. A thorough fire risk and cleanliness inspection of all areas of the laundry and adjacent spaces are to be completed on a regular basis and logged. Ensure that any outstanding work order for laundry equipment repairs be completed, especially any dryer thermostats. ATTENTION ENGINEERING: Effective immediately, locate a suitable space to lock up all portable welding machines to prevent unauthorized use. Continue to use the Hot Work Permit as required by the SMS. COMPLETION REPORT REQUIRED: When finished with your examination, forward a report of your findings, including photos to the attention of Director of Fleet Safety. The time for completion is 15 September 1998. Carnival Cruise Lines made procedural changes to facilitate the ready identification of crewmembers whose primary emergency duties involved crowd management. According to the ship’s safety officer, before the Ecstasy accident, he had procured bright green hats, imprinted with the word “crew,” to issue to employees who were in charge at muster stations. He had not had the opportunity, however, to distribute the hats before the Ecstasy sailed on July 20. At the suggestion of Safety Board investigators, Carnival Cruise Lines revised the information presented at its emergency drills to include an announcement advising passengers that crewmembers wearing the green hats were proficient in English and were specifically assigned to assist passengers during an emergency. Carnival Cruise Lines installed equipment and made system modifications to reduce the amount of lint buildup in the ventilation ducts. The company added lint screens to all exhaust louvers in the main laundry and installed turbo-filters on the laundry dryers to reduce the amount of lint entering the exhaust ducts. The company also modified the exhaust plenums and fire dampers on the Ecstasy as well as other Fantasy Class ships in its fleet.

Factual Information 49 Marine Accident Report After the Ecstasy fire, Carnival Cruise Lines modified to the design of the MV Paradise, a ship that was under construction, to include the addition of sprinklers on the vessel’s covered mooring decks. The company also began a program of retrofitting the mooring decks of its existing cruise ships with deluge sprinkler systems. According to Carnival Cruise Lines’ senior officials, the aim of the company is to install sprinkler protection on the mooring decks of all its ships by the end of 2001. Related Safety Board Actions Locally sounding smoke alarms. As a result of fires on board the cruise ships Universe Explorer in 1996 and Vistafjord in 1997,38 the Safety Board, in April 1997, issued the following safety recommendations to the International Council of Cruise Lines (ICCL39): M-97-37 Without delay advise members to install automatic smoke alarms that sound locally in crew accommodation areas so that crews will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. M-97-38 Without delay advise members to install automatic smoke alarms that sound locally in passenger accommodation areas so that passengers will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. Concurrently, the Safety Board issued the following safety recommendations to the Coast Guard: M-97-39 Propose that the IMO require all passenger vessels to have automatic smoke alarms that sound locally in the crew berthing areas so that crews will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. M-97-40 Propose that the IMO require all passenger vessels to have automatic smoke alarms that sound locally in the passenger accommodation areas so that passengers will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. 38 (a) National Transportation Safety Board, Fire on Board the Panamanian Passenger Ship Universe Explorer in the Lynn Canal Near Juneau, Alaska, July 27, 1996, Marine Accident Report NTSB/MAR-98/02 (Washington, DC:NTSB, 1998). (b) National Transportation Safety Board, Fire Aboard the Passenger Ship Vistafjord, near Grand Bahama Island, Bahamas, April 6, 1997, Marine Accident Report NTSB-MAB-98/01 (Washington, DC:NTSB, 1998). 39 ICCL is an industry association comprising the 16 largest cruise lines that call on major ports in the United States and abroad. Each year ICCL’s cruise vessel operators carry more than 5 million U.S. passengers on 93 ships.

Factual Information 50 Marine Accident Report On May 5, 1997, the ICCL responded that it had distributed Safety Recommendations M-97-37 and -38 to its members for review and consideration and that the recommendations would be an agenda item at the next meeting of its technical committee. Based on these actions, the Safety Board classified Safety Recommendations M-97-37 and -38 “Open—Acceptable Response,” pending further action by the ICCL on the issue. On July 25, 1997, the Coast Guard responded that it concurred with Safety Recommendations M-97-39 and -40. The agency subsequently made a proposal in May 1998 to the IMO asking that the fire safety amendments to SOLAS 74 be revised to require automatic locally sounding smoke alarms on passenger ships. The IMO, in May 2000, referred the action for consideration to a subcommittee of its Maritime Safety Committee (MSC). Based on the Coast Guard’s actions, the Safety Board classified Safety Recommendations M-97-39 and -40 “Open—Acceptable Response.” In October 1999, the ICCL wrote the Safety Board asking that Safety Recommendations M-97-37 and -38 remain in an open status pending final action by the IMO’s MSC on the Coast Guard proposal. The ICCL subsequently presented to the MSC on December 17, 1999, an issue paper opposing the Coast Guard’s proposal that focused on two propositions: false alarms and crowd management. The ICCL stated that on a daily basis as many as 20 or more false alarms occur as a result of normal sensitivity of smoke detectors. With regard to the issue of crowd management, the ICCL maintained that automatic local-sounding smoke alarms would increase the risk of mass panic by passengers and impair effective crowd control by ship crews. In April 2001, a Coast Guard official advised the Safety Board that, as a result of concerns from some Administrations and the technical questions raised by the ICCL, the proposal for locally sounding alarms was removed from the MSC agenda and not considered. The Coast Guard is presently evaluating whether to again introduce the proposal as an agenda item at the next meeting of the MSC, which is spring 2002. In the 25 months following the Safety Board’s issuance of Safety Recommendations M-97-37 and -38, the Board investigated three cruise ship fires, including the 1998 accident on the Ecstasy. The other accidents are summarized below. On September 19, 1999, a fire broke out in the engineroom of the Liberian cruise ship Tropicale in the Gulf of Mexico. The fire was restricted to the engineroom and smoke did not enter the accommodation spaces; therefore, no one sustained smoke inhalation injuries. However, 1,096 passengers and 605 crewmembers were put at risk. On May 20, 2000, a fire broke out in a crew cabin on the Netherlands cruise ship Nieuw Amsterdam in Glacier Bay, Alaska. While the fire was restricted to one deck, smoke from the fire progressed upwards through nine decks. A passenger was forced to crawl on his hands and knees along the passageway outside his cabin due to the heavy smoke. The cruise ship was carrying 1,201 passengers and 566 crewmembers.

Factual Information 51 Marine Accident Report Following the Nieuw Amsterdam accident investigation, the Safety Board elected to classify Safety Recommendations M-97-37 and -38 “Closed—Reconsidered” and issued the following safety recommendations to 18 individual cruise ship owners and their operating companies on July 11, 2000: M-00-6 Without delay, install automatic local-sounding smoke alarms in crew accommodation areas on company passenger ships so that crews will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. M-00-7 Without delay, install automatic local-sounding smoke alarms in passenger accommodation areas on company passenger ships so that passengers will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. As of March 2001, 12 companies, representing about 86 percent of the North American trade,40 had responded to the Safety Board regarding the installation of locally sounding alarms in both crew and passenger accommodation areas. One company, Celebrity Cruises, indicated that it had installed locally sounding alarms in accommodation areas as requested. The Safety Board, therefore, classified M-00-6 and -7 “Closed—Acceptable Action” for Celebrity Cruises. Eleven companies, including Carnival Cruise Lines, responded that they supported the recommendations and intended to install locally sounding smoke alarms on their cruise ships. As a result, the Safety Board classified M-00-6 and -7 “Open—Acceptable Response” for the following companies: American Classic Voyages, Carnival Cruise Lines, Crystal Cruises, Disney Cruise Line, Holland-America Line, Westour, Inc., Norwegian Cruise Line, Princess Cruises, Radisson Seven Seas Cruises, Renaissance Cruises, Royal Caribbean International, and Seabourne Cruise Line (Cunard Cruise Lines). The Safety Board classified M-00-6 and -7 “Closed—No Longer Applicable” for Premier Cruises because the company is no longer in operation. In July 2000, at the same time that the Safety Board made recommendations for locally sounding alarms directly to the cruise ship companies, the Board issued the following recommendations to the ICCL: M-00-8 Withdraw your opposition to the amendment of the Safety of Life at Sea Convention chapter II-2 to require automatic local-sounding smoke alarms in crew accommodation spaces on board passenger ships and support a full discussion of the technical issues and any further U.S. Coast Guard actions on this matter before the IMO. 40 At the time of the accident, about 99 cruise ships operated out of North America. The 12 responding companies owned 85 of the 99 vessels.

Factual Information 52 Marine Accident Report M-00-9 Withdraw your opposition to the amendment of the Safety of Life at Sea Convention chapter II-2 to require automatic local-sounding smoke alarms in passenger accommodation spaces on board passenger ships and support a full discussion of the technical issues involved and any further U.S. Coast Guard actions on this matter before the IMO. On October 13, 2000, the ICCL responded that it did not oppose the technical discussion of audible smoke alarms in its paper to the IMO and was concerned by the interpretation of the paper. The ICCL letter further stated that member operators had agreed to install in new and existing ships audibly sounding smoke detectors that would “immediately alert persons to the presence of smoke in their cabin or stateroom or in the corridor outside.” In a follow-up letter on November 7, 2000, the ICCL President enclosed a standard for locally sounding smoke detectors that had been adopted by the ICCL Board of Directors, which represented all 16 member operators. The ICCL President indicated that the adopted policy was ICCL’s response to safety recommendations M-00-8 and -9. In a February 7, 2001, press release announcing the adoption of the mandatory industry standards, the ICCL stated that member lines would integrate the industry standards into their SMS to ensure compliance through internal and external audits. On April 19, 2001, the Safety Board responded to the ICCL: The Safety Board is pleased that on November 1, 2000, the ICCL adopted a policy to member cruise line companies to install audibly sounding smoke alarms in both crew and passenger spaces. The Board is further pleased that the ICCL will continue to support full and open discussion of technical and operational issues associated with any proposal directed toward the enhancement of safety on board passenger ships…. The Safety Board’s November 1, 2000, advisory acknowledged four of your member organizations (Disney, Radisson, Crystal, and Holland-America) for taking the initiative to install smoke alarms on their vessels, and the ICCL for developing its policy for smoke alarms on member cruise vessels. However, the ICCL has not complied with the recommended action because the ICCL is on record at the IMO objecting to locally sounding alarms per its issue paper dated December 17, 1999. Until this paper is superceded, ICCL has not formally withdrawn its opposition at IMO, which is the subject of the M-00-8 and M-00-9. The Safety Board suggests that ICCL submit to IMO its new policy in support of locally sounding alarms. Accordingly, until the ICCL has superceded its December 17, 1999, issue paper, Safety Recommendations M-00-8 and -9 are classified ‘Open—Acceptable Response.’ Inspection and maintenance of ventilation ducts. As a result of the Ecstasy fire, on October 20, 1998, the Safety Board issued the following safety recommendations to cruise vessel owners and operators embarking passengers from United States ports:

Factual Information 53 Marine Accident Report M-98-125 Immediately inspect, within your fleet of ships, the laundry ventilation systems, including ducts, plenums, and exhaust terminuses, for any combustible material, such as lint, and clean the systems, as necessary, to reduce the risk of fire. (Urgent) M-98-126 Institute a program to verify on a continuing basis that the laundry ventilation systems, including ducts and plenums, remain clean and clear of any combustible material that poses a fire hazard on your vessels. Of the 22 recipients, all but one responded that they had taken measures and had initiated on-going inspection programs to comply with the recommended actions.41 As a result, the Safety Board classified Safety Recommendations M-98-125 and -126 “Closed—Acceptable Action.” Related Coast Guard Actions Regulatory changes. Based on findings in the Ecstasy accident investigation, the Coast Guard, on May 21, 2000, amended its Marine Safety Manual, Volume II, adding the following information on laundry room exhaust ducts and requiring inspectors to examine those ducts for potential safety problems (amendments italicized). Galley and Laundry Room Exhaust Ducts: A number of shipboard fires have originated in the exhaust ducts of galley ranges and fryers, and recently in laundry room ventilation systems. These fires have resulted in serious damage, injury, and loss of life aboard the vessels involved. Unmaintained exhaust duct work will become saturated with cooking grease and pose a fire hazard. Unfortunately, such areas have been overlooked during vessel inspections. The following procedures shall be followed during biennial and mid-period inspections of U.S. vessels and during SOLAS verification examinations of foreign vessels: All vessels: a. (6) Examine laundry room vents, ask if the company has a cleaning and maintenance program (check records–part of ISM/SMS responsibility).42 Postaccident findings. According to Coast Guard officials, MSO-Miami began inspecting laundry room ventilation systems as part of regular CVEs in November 1998. Since that time, Coast Guard inspectors reportedly have found that, in every case, the ventilation ducts on the inspected cruise ships have had no unsafe lint buildup and that the 41 The cruise lines that responded favorably include the following: American Hawaii Cruises and Delta Queen Steamboat Company, Carnival Cruise Lines, Commodore Cruise Lines, Crystal Cruises, Celebrity Cruises, Inc., Costa Cruise Lines, Cunard Lines, Ltd., Disney Cruise Line, Holland-America Line, Norwegian Cruise Line, Premier Cruises, Radisson Seven Seas Cruises, First European Cruises, Mediterranean Shipping Company, Orient Lines, Inc., Princess Cruises, Regal Cruises, Inc., Renaissance Cruises, Inc., Royal Olympic Cruises, Royal Caribbean International, and Silver Sea Cruises, Ltd. The cruise line that has yet to respond is Bergen Line Services. 42 USCG Marine Safety Manual, Vol. II: Material Inspection, Section B: Domestic Inspection Program, Chapter 1: Inspection of Vessels for Certification (21 May 2000): B1-79.

Factual Information 54 Marine Accident Report companies have revised their SMS to include procedures for maintaining the ventilation ducts in a fire-safe condition. Qualitative Failure Analysis Regulatory requirements. In 1988, the Coast Guard issued regulations (46 CFR 62, “Vital System Automation”43) requiring the use of a qualitative failure analysis of certain automated systems, including propulsion control systems. In proposing the regulatory requirement that designers, manufacturers, and/or shipyards perform and submit system failure analysis, the Coast Guard stated that the use of advanced automation technologies such as electronics and microprocessors made it increasingly difficult, “at times impossible, for the Coast Guard, ship owners/operators, and classification societies to evaluate safety.” The Coast Guard further stated: The Coast Guard has chosen to propose safety performance standards that, to the greatest extent practicable, state the desired operation or function without addressing detailed design criteria…As an alternative to detail evaluation, the Coast Guard proposes (to require) a failure analysis of the design and a self- certification of design compliance to certain…standards. [This process] emphasizes the responsibility of the parties most familiar with any automation system, i.e., the designer and manufacturer, to evaluate and certify the safety of the system. It also provides an evaluation means that is suited to technological changes. In most cases, the failure analysis will identify a preferred fail-safe state. Systems that would be required to be independent, that is, have arrangements that provide a level of safety and reliability equivalent to complete duplication, include: • Controls systems • Alarms and instrumentation (monitoring systems) The IMO subsequently adopted regulations requiring that a failure modes and effects analysis (FMEA)44 be performed for the machinery and control systems of high- speed vessels.45 The IMO and classification societies presently do not require the use of FMEA for passenger vessel propulsion system designs.46 43 Subpart 62.10 defines system as an arrangement of elements that interact to perform a specific function and vital system as that which is essential to the safety of the vessel, its passengers, and its crew. 44 An FMEA is an inductive approach to identifying engineering design deficiencies by examining each individual component or process in a system to determine how its failure or deviation from intended performance might affect the entire system. By conducting a FMEA, engineers can modify the design of a system before it is built to avoid catastrophic or significant system failures. 45 The International Code of Safety for High Speed Craft, adopted in 1994, mandated the use of FMEA because these craft employed new technologies. 46 LR’s Propulsion and Steering Machinery Redundancy contains provisional rules that are in addition to the classification society’s Rules and Regulations for the Classification of Ships. LR’s provisional rules, which are optional for vessel owners, stipulate the use of FMEA in designing propulsion systems, electrical power supplies, essential services, control systems, and steering arrangements. According to LR’s provisional rules, the FMEA report must show that a single failure in the propulsion and related auxiliary systems will not cause loss of all propulsion or steering capability.

55 Marine Accident Report Analysis General This analysis first identifies factors that can be readily eliminated as causal or contributory to the fire and determines where and how the fire started and how it spread. The report then discusses the following major safety issues, which were identified during the investigation: • Adequacy of management safety oversight; • Adequacy of fire protection systems; • Adequacy of passenger and crew safety; and • Adequacy of engineering systems design. This report also discusses the effectiveness of the emergency response effort. Exclusions The weather was not a factor in this accident. The vessel’s navigation, propulsion, and steering systems had no bearing on the cause of the fire. No engineering difficulties occurred before the outbreak of the fire. From documents and statements, the Safety Board determined that all officers were properly licensed and certified by the Liberian government and were qualified to serve in their positions. Postaccident drug and alcohol screenings of 79 crewmembers were negative for 76 individuals. The first officer tested positive for marijuana, indicating that he had used the drug sometime in the weeks before the fire occurred. However, based on witnesses’ descriptions of the first officer’s actions on the bridge during the emergency, no behavioral evidence indicated that he was impaired by drugs at the time of the fire. Because the personnel who tested positive for drugs have been dismissed from service and because of the improvements that Carnival Cruise Lines has made to its drug-testing program since this accident, the use of drugs and postaccident testing will not be discussed further in this report. Accident Analysis The Ecstasy experienced a major fire at the aft end of the ship that affected two MVZs. A combination of fire, heat, and smoke damaged the main laundry room, the stern thruster room, an air conditioning room, an electrical equipment room, the aft mooring deck, and the steering gear room. In addition, some passenger staterooms and crew cabins on deck Nos. 2, 4, 5, and 6 sustained heat and smoke damage. The cruise ship

Analysis 56 Marine Accident Report subsequently lost propulsive power and most steering and had to be towed back to Miami. During the onboard emergency, all passengers evacuated safely from the affected areas; however, two crewmembers became trapped on deck No. 2, and firefighting teams had to rescue them. Nine passengers were treated for injuries resulting from pre-existing conditions or smoke inhalation, and 14 crewmembers sustained minor injuries from firefighting activities and/or smoke inhalation. Fire Ignition and Propagation Although Safety Board investigators found evidence of fire damage, smoke damage, or both in several aft areas of the Ecstasy, they readily narrowed the potential origin of the fire to either the aft mooring deck or the main laundry. The Safety Board examined the mooring deck because of the extensive fire damage to the area. Investigators considered various sources of ignition, including electrical malfunctions, discarded smoking materials, and accelerants. Electrical malfunctions could have occurred in the three control boxes for the winches. The wiring in the control boxes had been exposed to intense heat and the insulation on the wires in the boxes burned away. Investigators found no evidence of arcing or failure, however, in any of the wiring. Examination of the motor controller panels for the winches, located in the steering gear room on deck No. 3, also revealed no failures. Investigators found no evidence that smoking materials had been discarded or any inflammable liquids had been stored on the deck. Moreover, ATF testing of the debris samples collected after the fire showed no evidence of any accelerant used to intentionally set the fire (arson). The prolonged fire on the mooring deck might have destroyed any evidence of ignition caused by smoking material or accelerants. Other evidence, however, indicates that the fire did not originate on the mooring deck. Support for this contention is based on the dynamics of air flow in the ventilation systems connecting the mooring deck to the laundry room, the condition of the ventilation systems, and the events that took place in the main laundry room before the sounding of the first fire alarm. A pathway was necessary for fire to have spread from the mooring deck to the main laundry. Conditions existed, however, that would have prevented the fire from spreading in this manner. Before the master ordered the shut down of the power ventilation system in MVZs 1 and 2, two ventilation duct systems from the main laundry, separately servicing the dryers and the mangle, exhausted air into the mooring deck at a rate of roughly 7 meters per second. If the fire had originated in the mooring deck and spread to the main laundry, the flames would have had to travel through one or both of the duct systems in the opposite direction of the exhaust airflow. Based on Safety Board calculations and in accord with current research on flame movement, the flames could not have traveled against an airflow of such velocity.47 47 A.C. Fernandez-Pello and T. Hirano, “Controlling Mechanisms of Flame Spread,” Combustion Science and Technology, Vol. 32, (1983): 1-31.

Analysis 57 Marine Accident Report The condition of the ventilation duct systems also supports the contention that the fire did not spread from the mooring deck to the main laundry. Had such spreading occurred, fire damage would have been evident in both the dryer and the mangle ventilation duct systems, since at their terminus on the mooring deck they come together; therefore, both vent systems would have been equally subject to any source of fire on the mooring deck and equally susceptible to fire damage. This was not the case. Although the mangle’s ventilation system exhibited extensive fire damage, the dryer’s ventilation system was virtually unscathed. Using fiber optic scope technology, the investigators detected unburned lint inside of the dryer ventilation system and no evidence of fire or fire-related damage. The Safety Board concludes that although the Ecstasy’s mooring deck sustained the heaviest fire damage, it was not the point of origin for the fire. Events occurring in the main laundry room further support the finding that the fire did not originate on the mooring deck but, instead, began in the laundry room. The second fitter testified that he and the first fitter were setting up welding equipment to repair the mangle in the laundry room when a welding rod that was dangling near the deck came in contact with either the grounding clamp or the mangle, causing a spark. The second fitter also stated that, at the time the spark occurred, dryer lint covered the deck. Both fitters testified that a “small” fire started on the deck and that a fire on the mangle and a fire in the overhead duct subsequently occurred. A cabin steward who was retrieving towels from a nearby linen closet observed smoke in the main laundry. He said that when he went to investigate, he saw the two fitters working on the inboard side of the mangle and observed flames on the outboard side of the mangle, near the exhaust vents. He said that he retrieved a fire extinguisher to fight the fire; however, when one of the fitters dumped a jug of water on the side of the mangle where they were working, flames “appeared to jump up” to the overhead vent. The smoke and flames became too great for him to fight with an extinguisher, so he activated the local fire alarm at the laundry room door. The first officer confirmed that the first fire alarm, which sounded on the fire control panel at 1710, indicated the main laundry. Alarm printouts show, however, that the first fire alarm was automatically activated. The Safety Board found that the fire and smoke damage supported all or portions of the witnesses’ testimonies. The evidence of fire in the main laundry was limited to the area of the mangle. Metallurgical analysis showed that the welding deposits on the grounding clamp were similar to the material in the electrode’s welding rod, which confirmed that the welding rod had struck the ground clamp. Examination of other electrical appliances in the laundry revealed no evidence of arcing. Moreover, investigators found no evidence of discarded smoking materials or accelerants that might have served as an ignition source in the laundry. The Safety Board concludes that the fire on board the Ecstasy started in the main laundry and was ignited by an arc from a welding machine. Fire damage to the mangle power cables and soot deposits on the loading end of the mangle showed that the fire spread across the floor up onto the mangle. Damage to the aft roller and melted wax from the mangle strings showed that the fire spread onto the roller. The fitters had turned off the mangle to work on it. As a result, the rollers were in a

Analysis 58 Marine Accident Report raised position, which left a gap between the rollers and the entry housing to the adjacent exhaust ducts. This gap allowed the fire to spread into the roller exhaust ducts, which was evidenced by heat damage to the paint on the exhaust ducts. In addition, the roller exhaust ducts contained several inches of burned debris. Postaccident examination of the mangle blowers revealed that they were caked with partially burned lint and wax. The impeller on the aft fan had disintegrated, leaving rust-colored metal flakes imbedded in the lint and wax. The absence of an operational fan in this duct allowed more lint to accumulate in it than in the forward duct, which resulted in the aft duct sustaining far greater heat damage. In addition to the damage in the mangle’s vertical exhaust ducts, investigators found 2-3 inches of burned debris in the main ventilation duct above the machine. Fire damage was present throughout the mangle exhaust duct system of the Ecstasy, indicating the fire probably proceeded through this system into the air conditioning room where it spread through the plenum exhaust ducts onto the mooring deck. The fire then ignited lint that had been exhausted to the mooring deck and that had become imbedded in the mooring line. The burning lint, in turn, ignited the mooring lines, which fueled a large, intense fire that raged for more than 2 hours, damaging deck areas above, forward, and below the mooring deck. Hot gases and smoke transferred from the mooring deck to other areas of the vessel through the air conditioning ventilation system before bridge personnel secured the system. The ventilation supply intakes for the stern thruster room, which are next to the laundry room’s exhaust plenum on the mooring deck, transferred smoke and heat from the fully developed fire through the vent ducts into the stern thruster room, causing extensive damage there. Hot gases and smoke traveling through the ventilation ducts also caused extensive heat damage and sooting in the steering gear rooms, several passenger cabins on decks Nos. 4, 5, 6 and 7, and the laundry crew galley. The injection of smoke and fire gases from the mooring deck fire into the intake systems caused the almost simultaneous activation of smoke detectors on four different decks. Based on the amount of burned lint debris on the Ecstasy, investigators examined the main laundries of other Fantasy vessels and found large lint accumulations in their laundry exhaust systems, particularly the mangle exhaust ducts next to and above the machine. On one such ship, the Fantasy, the chief engineer stated that he had initiated a program of cleaning the exhaust ducts and plenum about every 20 days after he had experienced a problem closing a damper and had found the ducts clogged with lint. Although crew personnel had cleaned the ducts 4-5 days before the Safety Board’s inspection, investigators found several inches of lint buildup in the dryer ducts and the plenum. They also found that the mangle duct contained about ½ of an inch of lint and was coated with a waxy/oily substance. On the mooring deck, investigators found that lint exhausted through the ventilation system had settled on and become imbedded in the mooring lines. Flammability tests of lint collected from the sister ships showed that the material was ignited easily by a spark and burned for several seconds, leaving little residual material behind. Therefore, the large lint buildup in the exhaust vents and the ventilation system represented such a hazard that a fire might have occurred even if the fitters had

Analysis 59 Marine Accident Report followed the required welding permit procedures and had arranged to have a vessel safety officer present. Upon observing the laundry area, a safety officer probably would have required the fitters to eliminate the obvious lint that was on the deck and, possibly, the lint on the mangle. At the time of the accident, Carnival Cruise Lines’ SMS did not contain procedures for inspecting or maintaining the laundry exhaust vents. The safety officer probably would not have examined the vents in the overhead and identified the greatest fire risk. Thus, when the fitters began to work, the sparks shooting upward from their welding might still have ignited a blaze that crewmembers could not put out with the available fire extinguishers. The Safety Board concludes that the lint that accumulated in the ventilation duct of the main laundry created a serious fire hazard on the Ecstasy. As a result of the Ecstasy fire, on October 20, 1998, the Safety Board issued the following safety recommendations to cruise vessel owners and operators embarking passengers from United States ports: M-98-125 Immediately inspect, within your fleet of ships, the laundry ventilation systems, including ducts, plenums, and exhaust terminuses, for any combustible material, such as lint, and clean the systems, as necessary, to reduce the risk of fire. (Urgent) M-98-126 Institute a program to verify on a continuing basis that the laundry ventilation systems, including ducts and plenums, remain clean and clear of any combustible material that poses a fire hazard on your vessels. Of the 22 recipients, all but Bergen Line Services responded that they had taken measures and had initiated on-going inspection programs to comply with the recommended actions. As a result, the Safety Board classified Safety Recommendations M-98-125 and -126 “Closed—Acceptable Action.” The Safety Board’s investigation of the Ecstasy fire, specifically its focus on lint buildup problems, and its Safety Recommendations M-98-125 and -126 also prompted a beneficial change to the Coast Guard’s vessel inspection guidelines. On May 21, 2000, the Coast Guard amended Marine Safety Manual, Volume II to require that, as part of a regular CVE, its inspectors examine a vessel’s laundry exhaust ducts for potential safety problems. In addition, the Coast Guard inspectors must review the cruise ship company’s SMS to ensure that it contains procedures for routine cleaning and maintenance of the laundry room vents. The Coast Guard began inspecting laundry room ventilation systems in November 1998. According to Coast Guard officials, since the cruise ship companies have established procedures for inspecting and maintaining the laundry room ventilation systems on their vessels, Coast Guard CVE inspectors reportedly have found that, in every case, the ventilation ducts on cruise ships have had no unsafe buildup of lint.

Analysis 60 Marine Accident Report The Safety Board concludes that the procedures and standards for inspecting and maintaining laundry ventilation systems adopted by the marine industry and government agencies following the Ecstasy fire will improve safety on cruise ships. Adequacy Of Management Safety Oversight The presence of lint in the main laundry and the mooring deck, specifically the buildup in the mangle exhaust ducts and the particles imbedded in the mooring line, represented a fire hazard that could have been ignited by any number of sources. However, the decision of the fitters to weld before arranging for a shipboard safety official to assess the area for risks raised questions about the adequacy of Carnival Cruise Lines’ SMS. When the first galley fitter broke the mangle bolt, he decided to weld it back in place. He returned to the fitter workshop to obtain a portable welding machine and related equipment while the second fitter obtained a fire blanket. After setting up the welding equipment, the fitters energized the welding machine and inserted an electrode into the electrode holder. For safe operations, a welding machine should not be energized until immediately before welding. Carnival Cruise Lines’ SMS manual contains numerous safety procedures for workers performing welding operations, including a prohibition against undertaking welding “unless the requirements of the ‘Hot Work Permit’ are satisfied.” The permit requirements for welding include applying in writing to the duty engineering officer, who, before approving the application, must assess the intended work area for hazards and either eliminate them or take precautions to control the risk, such as posting a fire guard. Neither fitter followed the hot work permit procedures. They both testified that they were aware of the requirement to obtain a hot work permit and that they intended to apply for one after setting up the welding equipment. They also admitted that, when they energized the welding machine, they were not following proper welding procedures that they learned in welding school or during their service on Carnival’s vessels. The Safety Board concludes that the fitters’ (welders’) lack of full compliance with the hot work permit procedures in Carnival Cruise Lines’ SMS manual increased the risks of fire in the main laundry. Following this accident, Carnival Cruise Lines revised its SMS to require that engineering supervisors secure all portable welding machines to prevent employees from circumventing required safety procedures. Now, the welding machines are not released to fitters until a hot work permit is issued. Although Carnival Cruise Lines’ SMS manual contained extensive procedural safeguards for welding, it did not prevent unauthorized welding. Carnival Cruise Lines is one of several subsidiaries of Carnival Corporation. The Safety Board is concerned that the SMS procedures and manuals for the other vessels in Carnival Corporation’s fleet may not contain processes to prevent employees from performing unauthorized hot work. The Safety Board believes, therefore, that, for the ships in its fleet, Carnival Corporation

Analysis 61 Marine Accident Report should revise the SMS to include processes for preventing unauthorized flame cutting, grinding, or other activities that might ignite a fire. Adequacy Of Fire Protection Systems Sprinkler System Sprinkler systems are designed to provide an appropriate level of protection for the space that they occupy and the amount of combustibles that are present. On the Ecstasy, a passenger cruise ship, sprinklers were installed mainly in accommodation areas, including staterooms and cabins. The sprinkler system, therefore, was designed for spaces that contained furniture, carpeting, paneling, and so forth. In the Ecstasy accident, however, conditions occurred that put unusual demands on the sprinkler system. In the main laundry on deck No. 2, the fire’s area of origin, the ignition of the comparatively small amount of lint across the floor released insufficient heat to trigger the heat-activated sprinklers in the overhead. The small flames spread first to the mangle’s vertical exhaust ducts and then its overhead exhaust ducts where the high lint buildup fueled a larger fire. The mangle’s overhead exhaust duct, constructed of noncombustible metal, contained the fire, and the air flow within the duct carried the fire from the laundry to the exhaust plenum on the mooring deck. The fire exited onto the mooring deck, which lacked fire protection, and ignited the lint debris that, in turn, led to the development of the major conflagration. Before the ventilation system in MVZs 1 and 2 was shut down, ventilation fans drew intense heat from the large fire on the mooring deck to various ship areas that were protected by sprinklers, which caused them to activate. In addition, the heat from the mooring deck fire was so great that it triggered sprinklers in deck areas immediately above and forward of the mooring deck. Although the sprinkler discharge in areas that were remote from the mooring station had no effect on the fire and heat source, the discharges prevented the spread of fire further into the vessel. The discharge area, that is, the number of sprinklers discharging water, was twice as great as the design capabilities of the ship’s water delivery system. Even though the number of sprinklers that opened created a demand for water that taxed the water supply, the sprinkler system provided proper protection in this accident. The Safety Board concludes that the vessel’s automatic sprinkler system limited the spread of fire from the mooring station to adjoining decks, thereby preventing a significantly worse fire that would have caused greater damage and perhaps additional injuries. When the Ecstasy was built in 1991, Carnival Cruise Lines had until 2006 to comply with SOLAS requirements for automatic sprinklers. Nevertheless, the company elected to install sprinkler protection in the Ecstasy’s cabins and staterooms at the time of construction. After the fire on board the Ecstasy, Carnival Cruise Lines modified the fire suppression system of the MV Paradise, one of its ships under construction, to include

Analysis 62 Marine Accident Report sprinkler coverage of the vessel’s mooring decks. The company also began a program of retrofitting the mooring decks of its existing cruise ships with deluge sprinkler systems. According to Carnival Cruise Lines’ senior officials, the aim of the company is to install sprinkler protection on the mooring decks of all its ships by the end of 2001. The Safety Board applauds Carnival Cruise Line’s past and continuing efforts to improve fire safety on the ships in its fleet. The flag administration for the Ecstasy before the accident had categorized the vessel’s mooring station as an open deck, which meant that the area was not required to have smoke detectors or sprinklers. If the mooring station had been equipped with detectors, the bridge would have received earlier notification of a fire site. In addition, if sprinklers had been installed and had activated on the mooring deck, the water may have extinguished the ignited lint before the mooring line caught fire. At the least, water from activated sprinklers would have knocked down the flames of the mooring deck fire, which probably would have enabled shipboard firefighters to enter the mooring station and combat the fire. The Safety Board concludes that if an automatic fire suppression system had been installed on the mooring deck, the fire on the Ecstasy would have been located and extinguished much sooner, thereby minimizing the extent of fire damage on the vessel and aft mooring deck. As it was, the high fuel load on the mooring deck caused extensive damage. The mooring station had 11 mooring lines, each measuring 220-meters and weighing about 900 pounds. The line itself is not easy to ignite. Inspection of a sister vessel showed that large amounts of easily ignitable lint had accumulated on the mooring deck and had become imbedded in the stored mooring lines. Assuming that the Ecstasy had a similar accumulation of lint, the fire venting from the mangle exhaust plenum probably ignited the lint, which, in turn, ignited the polypropylene mooring line. The Safety Board contracted independent tests by Omega Point Laboratories, which determined that the polypropylene line had an average heat of combustion of about 18,217 Btu per pound. Thus, the consumption of the polypropylene line on this deck could have yielded as much as 150 million Btu of heat. Once ignited, the amount of heat released from polypropylene rope per pound is equivalent to that of a comparable amount of gasoline. The investigation showed that the fire consumed most of the fuel (polypropylene line) on the mooring deck before firefighters were able to reach the deck and extinguish it. A pallet of nylon line survived the fire but was melted. Two lengths of polypropylene rope were partially consumed and the others were completely destroyed. In the past, cruise ships typically were designed with mooring decks having either no overhead or an overhead and large permanent openings in the vessel’s side shell. Because the mooring deck area was open to the weather elements, the risk of fire was low; therefore, SOLAS did not require mooring decks to have fire protection. Modern cruise ship design, such as that of the Fantasy Class vessels, typically incorporates the mooring station into the superstructure, often below accommodation and service spaces. Many mooring stations have openings that can be closed with hatches or covers. Despite this loss of openness, SOLAS still categorizes these mooring stations as open decks that are not required to have fire protection systems. Some newer ship designs also place ventilation

Analysis 63 Marine Accident Report inlets and outlets on the mooring decks. The Coast Guard, recognizing the safety issues inherent in the design arrangement, has proposed that the IMO clarify the category for mooring decks such as the type on the Ecstasy. The Coast Guard recommended that, for all new construction, a partially covered mooring deck be categorized as an auxiliary machinery space. This categorization would not only require fire protection systems (detection and suppression) but also prohibit using the space as a ventilation terminus. The status of the Coast Guard’s proposal at IMO is pending. Regardless of whether the IMO does or does not agree to categorize mooring decks as recommended by the Coast Guard, any action taken by the IMO will not take effect immediately and may affect only certain cruise ships. The Safety Board is convinced that all efforts should be made without delay to minimize the potential for fire on mooring decks that are incorporated into the vessel structure, such as the mooring decks on the Fantasy Class cruise ships. The Board recognizes that some mooring decks are used to store only anchors or small combustibles or both and, thus, might not warrant fire protection. To optimize safety, cruise ship companies need to examine their mooring stations for fire risk and determine the need for detection and suppression systems. The Safety Board believes, therefore, that the cruise ship companies should, for existing vessels having mooring deck arrangements similar to Carnival Cruise Lines’ Fantasy Class ships, install automatic fire suppression systems on mooring decks that contain high fire loads and presently have no automatic fire protection. Ventilation System SOLAS II-2 Regulation 16 requires that the ventilation systems for high-risk areas such as category A machinery spaces and galleys have an automatic fire damper where a duct crosses an A-class boundary to mitigate the spread of smoke and fire. SOLAS does not include laundries in the category of high-risk areas, despite the fact that laundry ventilation systems can accumulate appreciable amounts of ignitable lint. Fires in laundry facilities, including associated storerooms, can generate significant amounts of heat and smoke, frequently with lethal consequences, as the Safety Board discovered during its investigation of fires on board the Universe Explorer and the Vistafjord. Based on its findings in these two accidents, which killed 6 people and injured 72 others, the Safety Board determined that timely isolation of a fire is crucial to mitigating the effects of heat and smoke. The ventilation ducts in the Ecstasy’s main laundry had fail-safe fire dampers; however, if the ventilation system did not lose power, the dampers had to be shut by someone present in the area or by someone on the bridge. In this accident, if the fire in the overhead had triggered the closure of the laundry fire dampers, the shutdown would have occurred several minutes before the bridge personnel secured the ventilation system, which would have resulted in appreciably less heat, smoke, and flame escaping from the main laundry and spreading to the mooring deck.

Analysis 64 Marine Accident Report A passive means for actuating the closure of fire dampers in certain areas is required by various interpretations of SOLAS, including Coast Guard regulations.48 The most commonly required passive closure mechanism is a weight- or spring-activated fusible link that melts at a given temperature, allowing the fire damper to close. A fusible link can be designed to actuate at various temperatures, depending on the metal used in the mechanism. It potentially offers a more fail-proof method of closure and, consequently, a greater margin of fire safety because an external power source is not needed to drive the damper. The Safety Board concludes that if the main laundry’s fire dampers had been equipped with a passive means of closure, such as a fusible link, the heat from the fire would have caused the dampers to shut sooner, which, in turn, might have prevented the spread of fire beyond the laundry area. While automatic fire dampers with passive actuating mechanisms are one way to effectively stem the spread of smoke and fire through ventilation systems in high-risk areas, such dampers are not the only method of mitigating the danger. The Board considers the individual cruise ship companies best qualified to analyze their vessels’ design and engineering arrangements and to devise measures for dealing with the problem. The Safety Board, therefore, believes that Carnival Cruise Lines should, for the vessels in its fleet, engineer, design, and implement system modifications to mitigate the spread of smoke and fire from the laundry rooms through the ventilation ducts to other areas of the vessel. Further, cruise ship companies should, for existing vessels with ventilation system arrangements similar to Carnival Cruise Lines’ Fantasy Class ships, install an automatic method or system to mitigate the spread of smoke and fire from laundry spaces through the ventilation ducts to other vessel areas. Fire Detection System During the Ecstasy fire, many smoke detectors activated within a few minutes. The time and sequence of the first five recorded smoke detector alarms are consistent with reports of where the fire started and how the fire and smoke spread through the ventilation system. The first smoke alarm indicated the main laundry room. The next alarms indicated the stern thruster room, the air conditioner room, and the portside steering gear room. According to the first officer, about 2 minutes after the first alarm, all the detector alarms on the fire panel appeared to activate at the same time, and, as a result, he reset the system. The activation of all alarms on the fire panel resulted from an electrical overload of the system. Despite the overload, the fire detection system provided an early warning of a fire, correctly identifying not only the fire zone but also the time and location of the first detectors. The Safety Board concludes that the fire detection system performed properly by providing an early indicator of a fire. 48 NVIC No. 09-97.

Analysis 65 Marine Accident Report Adequacy of Passenger and Crew Safety Although no one was seriously hurt in the Ecstasy accident, the Safety Board identified several areas in which improvements could be made to the safety practices on the ship. Passenger Drill SOLAS requirements stipulate “musters of passengers shall take place within 24 hours after their embarkation.” Carnival Cruise Lines conducted an emergency drill for the Ecstasy’s passengers before the vessel sailed, which, in this case, was beneficial, given that the fire broke out within a half hour of the ship’s departure from port. Passengers received instructions in English and Spanish to prepare them for an evacuation, including information on how to don their lifejackets and on where to assemble in the event of an emergency. During the drill, the bridge sounded the general alarm signal, and passengers had to practice the route to their assigned muster stations as if they were participating in a real emergency. Of the 300 passengers surveyed by the Safety Board about the emergency, 126 responded. More than half of the respondents, or 79 passengers, indicated that the drill was valuable in preparing them for the actual emergency. The remaining survey respondents identified various problems or situations that were not addressed during the drill. Several people indicated that the drill did not include specific information about fire emergencies, including what to do if they encountered smoke or fire. A number of respondents who had to move to a different muster station because of smoke said that the drill did not provide information about what to do if a muster station was not available. One person stated that she did not hear any instructions from the crewmembers at her muster station but followed the crowd when everyone started leaving the station. Several passengers commented that they could not readily distinguish those crewmembers who were trained to assist them because vessel personnel all wore the same uniforms. For an emergency drill involving several thousand people to be effective, the information disseminated must be concise and essential for survival. The Safety Board notes that, in addition to the practice drill, Carnival Cruise Lines provides passengers with emergency information in a variety of ways. The company broadcasts general cruise information, including emergency procedures, on television monitors at the embarkation point where passengers line up to board the ship. In the staterooms, Carnival Cruise Lines posts evacuation procedures on placards and broadcasts emergency procedures on a television channel devoted to cruise information. The company has television monitors at the bars in passenger lounges to disseminate announcements and other information. Safety Board investigators reviewed the drill script used by the Ecstasy’s cruise director as a reference for necessary subjects to cover in the drill. The script makes no mention of actions that passengers should take if they see smoke or if their muster station is not available.

Analysis 66 Marine Accident Report The Safety Board concludes that although most survey respondents indicated that the Ecstasy practice drill adequately prepared them for the actual fire emergency, the drill content lacked information about actions to take if you see smoke or fire or if your muster station is unavailable that might have better prepared some passengers who encountered such conditions. Before the Ecstasy fire, the vessel safety officer had purchased bright green hats for crewmembers in safety sensitive positions to wear to distinguish them from other crewmembers. He had not had the opportunity to distribute the hats before the ship sailed. At the suggestion of Safety Board investigators, Carnival Cruise Lines revised its vessel emergency drill procedures to advise passengers that crewmembers wearing the green hats are specifically assigned to assist them during an emergency. Based on the survey responses from Ecstasy passengers, the company needs to provide passengers with additional safety information. The Safety Board, therefore, believes that Carnival Cruise Lines should revise the safety information disseminated to passengers to include actions to take if they encounter smoke or fire and/or if their muster station is not available. Immediately following the accident, a party to the investigation questioned whether the noise generated by local news helicopters created communications problems between the crew and passengers during the emergency. All survey respondents indicated that they heard frequent announcements. Some respondents who were assigned to the outside muster station stated that when they advised crewmembers that the helicopter noise made it difficult to hear the loudspeakers announcements, the crewmembers quickly notified the bridge, and the cruise director then relayed necessary information and status accounts by having his assistants go to the muster station. The smoke from the fire subsequently necessitated moving the passengers at the outside muster station, which eliminated the problem. The Safety Board concludes that although the noise from the news helicopters may have interfered somewhat with the communications with passengers on the outside deck, crewmembers were able to effectively communicate with the mustered people and manage the emergency. Accountability Procedures Shipboard personnel used two methods to account for passengers during the fire emergency. At the muster stations, the crewmembers noted the letters imprinted on the lifejackets worn by passengers to ensure that they had reported to the correct station. The muster station crews did not have a list, by name, of passengers assigned to the respective stations. In the passenger accommodation areas, crewmembers checked each stateroom to determine whether it was empty. They then wrapped a towel around the doorknob to show other searchers that the stateroom had been checked. Neither of these procedures provides assurance that the vessel has accounted for all passengers. Depending upon the time and location of a fire or emergency condition, passengers might not be able to report to their muster station. In this accident, three MVZs were closed as a result of the fire and passengers had to go to other MVZs to find a muster station. Identifying which people are missing by searching the staterooms and cabins assumes that an occupant will remain in his or her quarters and not go to another location.

Analysis 67 Marine Accident Report Further, this method of accounting for individuals can be dangerous, depending on the emergency conditions. In this accident, two crewmen who were unable to exit their deck because of heavy smoke initially sought refuge in a crew cabin. They were following survival techniques in a shower when one of the men panicked because of worsening smoke conditions. He left the toilet facility and began feeling his way along the bulkhead of the smoke-filled passageway. The other crewman followed the first man to try and convince him to return to the safety of the shower. The severity of the smoke-inhalation injuries that they sustained was limited only because fire team members searching the area happened upon the crewmembers. (Additional analysis of the trapped crewmen’s situation appears later in this report.) The Safety Board concludes that the procedures used by the Ecstasy’s shipboard personnel did not adequately account for passengers and crewmembers during the emergency. SOLAS leaves the method of devising procedures to account for passengers and crew during an emergency up to the companies. The ISM Code presently stipulates the need for cruise ship companies to account for passengers and crewmembers. Courses developed by the Coast Guard and the marine industry to meet the emergency preparedness requirements contained in amendments to the STCW stipulate that the preferred method of accounting for people at muster stations is by name so that rescue crews can employ more systematic methods of searching for missing persons. The Safety Board is aware that the Ecstasy maintained an electronic manifest of all passengers on the ship. When passengers boarded the ship, their names were entered into a computer and they were issued magnetic cards that tracked their purchases and their debarkations and embarkations at travel stops. Given the advancements in computer technology, magnetic cards or other computer-based devices and equipment could be used to quickly determine who has not mustered during an emergency. Because even short delays in identifying missing people can have fatal consequences, it is essential for companies to have systematic procedures to account for people by name. Further, the Ecstasy accident demonstrates that accounting procedures must address different emergency scenarios. As mentioned previously, the location and movement of the fire forced the closure of three MVZs, and, as a result, some Ecstasy passengers had to be moved to other muster stations. Depending on the time of the alarm and the location of passengers and crewmembers, several hundred people might be forced to report to an alternate muster station. The Safety Board is aware that Holland-America, another subsidiary of Carnival Corporation, accounts for its passengers by taking roll at muster stations. Despite its experiences in the Ecstasy accident, however, Carnival Cruise Lines has not indicated that it intends to change its accountability procedures. The Safety Board is convinced that, during a fire emergency, an accurate accounting by name is essential for passenger and crew safety. The accounting methods used on a ship should be incorporated into the SMS procedures presently required by SOLAS. The Safety Board believes, therefore, that, for the ships in its fleet, Carnival Corporation should develop plans to account for all passengers in common emergency scenarios, in particular, a situation involving the inaccessibility of one or more MVZs and/or muster stations.

Analysis 68 Marine Accident Report Lifejacket Distribution In 1997, LR certified that the number, type, and arrangement of lifesaving equipment on board the Ecstasy met the requirements of SOLAS 74, as amended in 1998. At that time, the ship carried 4,094 lifejackets to outfit a full crew and passenger complement of 3,560 people. The Board is pleased to note that Carnival Cruise Lines subsequently elected to exceed the minimum SOLAS requirement for extra lifejackets, increasing the number by more than 20 percent, to a total of 4,946. On the day of the fire, the ship was carrying 3,481 people, meaning that the ship had 1,465 extra lifejackets. Despite having more than enough lifejackets on board the vessel, some passengers perceived a lack of available lifejackets when the actions of the crewmembers were not consistent with information provided at the practice drill and posted on stateroom placards. Before the emergency, passengers were told to obtain lifejackets from their staterooms when the general alarm sounded and to proceed immediately to their muster stations. They were also told that if they were unable to obtain their lifejackets from their staterooms at the time of the alarm, they should proceed immediately to their muster station and lifejackets would be issued to them. During the emergency, the cruise director reinforced these instructions when he announced that passengers who could not obtain their lifejackets from their staterooms should proceed immediately to muster stations. The responses from the passengers who answered the Safety Board survey showed that 79 of 126 people either obtained lifejackets from their cabin or were provided lifejackets by crewmembers. Forty-seven passengers said that they never received lifejackets. Two passengers stated that they became concerned when they asked for lifejackets and a crewmember started to pass them out and then reportedly was ordered to stop doing so. One passenger stated that one crewmember told her not to retrieve her lifejacket from her stateroom and later another crewmember told her to get her lifejacket from her cabin; however, when she attempted to do so, she could not reach her stateroom because of the smoke. At the public hearing on the Ecstasy accident, the master testified that he wanted to maintain a calm environment and avoid panic among the passengers by conveying the impression that the situation was under control and did not warrant the distribution of lifejackets. While the lack of uniformity in distributing the lifejackets did not cause a mass panic, it did cause several passengers to become uneasy. Moreover, when a concerned passenger attempted to return to her stateroom to retrieve her lifejacket, she was put at risk of potential injury. The Safety Board concludes that the lack of consistency between the information about lifejacket distribution provided at the practice drill and the actual provision of lifejackets at the muster stations created unnecessary confusion among some passengers on the Ecstasy. After the Ecstasy fire, in fall 1998, Carnival Cruise Lines began requiring its senior deck, engineering, and other officers to attend courses in crisis management and human behavior and crowd management so that they met the STCW training standards that became effective in January 1999. The company also required crewmembers in safety-related positions to attend crowd management training.

Analysis 69 Marine Accident Report As part of its mandate, the Coast Guard conducts quarterly CVEs of a vessel’s operations to determine if they comply with SOLAS safety requirements. In this capacity, the Coast Guard could assist cruise ship companies in determining the effectiveness of muster drills addressing various contingencies. The Safety Board, therefore, believes that, as part of its quarterly CVEs, the Coast Guard should review a drill scenario in which one or more MVZs are inaccessible and evaluate the procedural effectiveness of the crew in crowd control, crisis management, lifejacket distribution, and passenger accountability. Locally Sounding Smoke Alarms When the first fire alarm sounded on the bridge, the master ordered two bridge officers to investigate the source of the alarm and report their findings. About 20 minutes elapsed before he ordered the aft three MVZs secured and the cruise director to announce that passengers who were quartered in the aft areas should either leave or not return to the areas, depending upon their present location. The master did not order the general alarm until 50 minutes after the first fire alarm sounded on the bridge. Of 126 passengers who answered the Safety Board survey, 72 responders, or more than half, said that they smelled or saw smoke in the staterooms and passageways before hearing the general alarm. A few passengers indicated that they saw a television report on the fire before receiving any emergency notification. One passenger said that, upon seeing smoke, she returned to her stateroom to awaken a sleeping relative. A crewman became aware of emergency conditions when smoke entered his room through a vent. Sounding the general alarm after a fire team verifies the location of the fire does not necessarily provide enough time to escape from a smoke-filled environment. The Vistafjord and Universe Explorer accidents demonstrated how quickly smoke could spread during a fire and that passengers and crewmembers needed to be warned immediately if smoke was in the area. As a result of its investigation of these two accidents, the Safety Board issued Safety Recommendations M-97-39 and -40 asking the Coast Guard to propose that the IMO require locally sounding alarms in passenger and crew accommodation areas. The Coast Guard subsequently made the proposal to the IMO, which referred the action for consideration to an MSC subcommittee. In Spring 2000, because of the concerns of some Administrations and the technical concerns of the ICCL, the MSC did not consider the locally sounding alarm proposal. It was removed from the agenda and no further action was taken on it. The next available time that the proposal can be introduced as an agenda item is Spring 2002. The Coast Guard is evaluating what actions it might take on the proposal. The Safety Board also issued Safety Recommendations M-97-37 and -38 asking that the ICCL advise its members to install locally sounding smoke alarms in passenger and crew accommodation areas. The ICCL at first advised the Safety Board that the recommendations would be an agenda item at the next meeting of its technical committee and then later asked that the recommendations remain in an open status pending action by the IMO.

Analysis 70 Marine Accident Report The Safety Board subsequently investigated the May 20, 2000, fire on board the Netherlands cruise ship Nieuw Amsterdam in which a passenger was forced to crawl on his hands and knees along the passageway outside his cabin due to the heavy smoke. As a result of this and previous accident investigations, on July 11, 2000, the Safety Board elected to classify Safety Recommendations M-97-37 and -38 “Closed—Reconsidered” and issue safety recommendations directly to the individual cruise ship companies serving North America. Safety Recommendations M-00-6 and -7 asked that cruise companies, without delay, install locally sounding alarms in accommodations areas to afford people the maximum available escape time during a fire. The Safety Board has been very pleased by the response of the cruise ship industry. As of April 2001, 12 companies, representing about 85 percent of the North American trade,49 had responded to the Safety Board regarding the installation of locally sounding alarms in both crew and passenger accommodation areas. One company, Celebrity Cruises, indicated that it had installed locally sounding alarms in accommodation areas as requested. The Safety Board, therefore, classified M-00-6 and -7 “Closed—Acceptable Action” for Celebrity Cruises. Eleven companies responded that they supported the recommendations and intended to install locally sounding smoke alarms on their cruise ships. The eleven companies included American Classic Voyages, Carnival Cruise Lines, Crystal Cruises, Disney Cruise Line, Holland-America Line/Westour, Inc., Norwegian Cruise Line, Princess Cruises, Radisson Seven Seas Cruises, Renaissance Cruises, Royal Caribbean International, and Seabourne Cruise Line (Cunard Cruise Lines). One respondent, Disney Cruise Line, indicated that, pending identification of the technology needed to modify its existing smoke detector systems, it had equipped its vessels with a system that triggers a special ring on the telephone in guest and crew cabins when smoke is detected. As a result, the Safety Board classified M-00-6 and -7 “Open—Acceptable Response” for these companies. The Safety Board classified M-00-6 and -7 “Closed—No Longer Applicable” for Premier Cruises because it is no longer in operation. On January 22, 2001, the Safety Board requested information about the status of M-00-6 and -7 to the following companies: Costa Cruise Lines, Orient Lines, Regal Cruises, Royal Olympic Cruises, and Silver Sea Cruises. To date, the Board has yet to receive a response. The Safety Board has, therefore, classifies M-00-6 and -7 “Open— Unacceptable Response” for these five companies. On February 7, 2001, the ICCL issued a press release indicating that its member lines had unanimously agreed to establish mandatory industry standards stipulating, among other requirements, that the vessels of each ICCL member have “smoke alarms that sound in all passenger and crew staterooms and adjacent corridors as well as on the bridge.” The ICCL release further stated that, for most guidelines, member lines would integrate the industry standards into their SMS to ensure compliance through internal and external audits. 49 At the time of the accident, about 99 cruise ships operated out of North America. The 11 responding companies owned 83 of the 99 vessels.

Analysis 71 Marine Accident Report Means of Communication in Cabins A cabin steward was in his cabin when he smelled smoke and saw smoke coming from a vent. He left his quarters and was knocking on other cabin doors to alert other crewmembers when he heard the general alarm. Another crewmember joined the cabin steward and the two men attempted to leave the deck only to be blocked by dense smoke. The crewmembers made their way into a cabin shower where they stayed until one of the men became alarmed by the smoke buildup. He tried to escape by leaving the cabin and feeling his way along the passageway bulkhead. The cabin steward went after the first man and tried to convince him to return to the safety of the shower. About this time, a firefighting team responding to the fire in the main laundry happened upon the men and directed them to safety. The cabin steward later stated they were only able to avoid serious injuries because they followed emergency survivability procedures, such as soaking themselves in a shower and breathing air from the shower drain. The crewmembers’ accommodation areas had no call system by which the men could signal for help. The Safety Board concludes that the lack of a means to call for help from the crew cabins delayed the rescue of two crewmembers and contributed to the severity of their smoke inhalation injuries. The Safety Board had addressed the need for passenger and crew cabins to be equipped with a means of signaling for emergency assistance for more than 8 years. (A summary of the safety recommendations issued and actions taken appears in appendix F.) Following its investigation of the fire on the Universe Explorer, the Safety Board asked that both the Coast Guard and the ICCL take actions regarding emergency call systems on cruise ships. The Safety Board issued Safety Recommendation M-98-32. On October 16, 1998, the Coast Guard responded that it would discuss the available options for any necessary improvements with the SOLAS working group on fire protection and would propose changes to the IMO, if appropriate. Based on this action, the Safety Board classified Safety Recommendation M-98-32 “Open—Acceptable Response.” The Safety Board issued Safety Recommendation M-98-59 to the ICCL asking that it recommend that member passenger ship companies install emergency call systems. The Safety Board subsequently advised the ICCL that the Board was disappointed that the association had not taken the recommended action and, on February 18, 1999, classified Safety Recommendation M-98-59 “Closed—Unacceptable Action.” The crewmembers’ inability to signal for help in the Ecstasy fire demonstrates again that existing SOLAS requirements for emergency communication are not adequate. Even though the Ecstasy’s passageways had telephones, their accessibility depended upon a person being able to reach a telephone. In this accident, the cabin steward who first smelled and saw smoke tried to alert crewmembers in nearby cabins of the fire. Conditions worsened considerably during the brief time that he knocked on cabins doors, and dense, suffocating smoke prevented his and another crewmember’s escape. The men did not have the option to walk to or spend time on a corridor telephone. A similar situation occurred in the Universe Explorer accident, but with fatal consequences. Rescuers found three dead crewmembers in the passageway and two dead

Analysis 72 Marine Accident Report crewmembers in their cabins. If they did not have the time and opportunity to reach an emergency exit, it is unlikely that they had time and opportunity to locate a corridor telephone to let someone know they needed immediate help. In its report on the Universe Explorer accident, the Safety Board discussed the simple call button system used to summon flight attendants on commercial airlines. Hospitals and nursing facilities employ a similar system to enable patients to signal for nursing assistance. The Safety Board believes that cruise ship companies should install emergency call systems in passenger staterooms and crew cabins so that people trapped during a fire emergency will have a means of signaling their location. Emergency Response Despite some setbacks, including an overload of the smoke alarm system and an unusually large and intense blaze, the Ecstasy personnel conducted the onboard response to the fire efficiently and in accordance with Carnival Cruise Lines’ procedures. The master effectively managed and monitored the incident by having the safety officer oversee the fire teams, by having the hotel manager maintain communications with shoreside management and the COTP, and by having the cruise director annotate times and events on a emergency action checklist. The ship’s firefighters demonstrated the effectiveness of their previous drills and firefighting training by quickly mustering equipped teams and containing the fire to the mooring station. With help of the tugs cooling the exterior of the Ecstasy’s stern, shipboard firefighters extinguished the fire as the fuel load was consumed. The safety officer had fire teams search the quarters in the area affected by the fire; the teams rescued two crewmembers who were trapped in a cabin near the laundry. The shoreside response was effective because the unified command system employing two operating bases allowed several agencies to jointly manage the emergency response. The Coast Guard and Miami Beach FD initially operated from the MSO-Miami Operations Center, and Miami-Dade FD, Carnival, port officials, and area police operated from a post established at the Port of Miami. Miami-Dade FD subsequently sent an additional representative to the MSO-Miami location. The parties remained in telephone communications with each other and officers on board the Ecstasy to coordinate activities throughout the incident. Shoreside officials indicated that the participation of Carnival, the Coast Guard, and local agencies in joint planning sessions and practice drills simulating accident scenarios attributed to the good response coordination. In addition, Carnival’s crisis management plan, which included specific personnel assignments for managing a fire condition on the Ecstasy and for handling the safety and comfort of passengers and crewmembers, was adequately implemented. The Safety Board concludes that the emergency response by shipboard and shoreside firefighters to the fire was timely and appropriate, resulting in the fire being properly contained and extinguished.

Analysis 73 Marine Accident Report Adequacy Of Engineering Systems Design The fire on the Ecstasy caused the partial or complete failure of three systems: low-location lighting, steering, and propulsion. Although the loss of engineering and emergency systems did not ultimately endanger the ship and its passengers in this accident, the potential threat to vessel safety from the failure of vital systems, especially propulsive power, is significant. The low-location lighting system was designed to sound an alarm on the bridge in the event of a power failure to the system. In this accident, the heat from the fire melted the wiring insulation on a portion of one lighting loop, triggering an alarm that the ship’s officers considered intrusive during the emergency operations. When the nature and location of the failure was not readily detectable at the lighting system’s main unit, the chief electrician elected to shut down power to the system. After this accident, Carnival Cruise Lines redesigned the low-location lighting system to permit the audible alarm to be silenced without the need to shutdown the entire system. The steering system components were designed to be redundant. The system had two rudder systems that were mechanically, electrically, and hydraulically independent of each other. The systems were housed in separate rooms on opposite sides of deck No. 3. The power and control cables for both rudder systems were routed along the overheads of their respective steering gear rooms. Thus, when the conflagration on the mooring deck went unchecked and raged for more than an hour, the intense heat that was conducted through the overheads of the steering gear rooms melted the cables, causing the steering system to fail. Despite the failure of the steering system, the crippled Ecstasy could have maneuvered at low speeds by using the bow thrusters if the ship had not lost propulsion. The most critical system failure in this accident was, therefore, the loss of the propulsion system. The port and starboard propulsion systems were supposed to be redundant and isolated. The Ecstasy had been built to LR regulations, which clearly stipulate the need to provide independent and isolated power supplies to essential components of the vessels engineering systems, such as propulsion. The auxiliary voltage to the high-speed breakers for both propulsion systems, however, was routed through the same distribution panel. When this panel sustained heat damage, both propulsion systems failed. The Safety Board, therefore, concludes that the failure to separate the power circuitry in the design arrangement of the auxiliary voltage supply to the high-speed breakers of the propulsion systems resulted in inadequate isolation of essential system components, which, in turn, resulted in the shutdown of both propulsion systems when a single distribution panel was damaged. Hazardous situations that may result from a ship losing propulsive power include vessel grounding, inability to avoid severe weather conditions, and passenger evacuation at sea. Thus, it is essential that all propulsion system components be redundant and isolated. Following the Ecstasy accident, Carnival Cruise Lines advised the Safety Board that it had modified the vessel’s electrical system by adding a backup circuit breaker and wiring to provide an alternate source of electrical power for the high-speed breakers.

Analysis 74 Marine Accident Report Carnival Cruise Lines owns seven other Fantasy Class ships that may have similar propulsion system arrangements as the Ecstasy. In correspondence to Safety Board investigators, the cruise ship company did not indicate whether it had examined or intended to examine its other vessels to identify design problems in their propulsion systems. The Safety Board, therefore, believes that Carnival should examine the propulsion systems on the ships in its fleet and, if necessary to provide redundancy, modify the arrangement of the auxiliary voltage circuitry to the high-speed breakers where a single source supplies both port and starboard propulsion systems. The company that designed the Ecstasy’s propulsion system, ABB, is a major supplier of cycloconverter propulsion systems to marine customers. Consequently, other vessels might be operating with an ABB propulsion system similar in design to that on the Ecstasy. The Safety Board, therefore, believes that ABB should advise its customers with ships having the same propulsion system design arrangements as the Ecstasy of the potential for system failure from the loss of auxiliary voltage to the high-speed breakers and recommend design changes to the propulsion system that would minimize these effects. Even though the Ecstasy’s propulsion system had a number of design features that were intended to reduce the likelihood that both port and starboard systems would fail as a result of single fault, the importance of isolating the auxiliary voltage source to the high- speed breakers was not identified before or during the vessel construction. ABB officials stated that they did not do a formal failure analysis, such as an FMEA, of the propulsion system design because SOLAS, LR, and Carnival did not require them to perform one. A qualitative failure analysis, such as the FMEA method, can identify potential failures and rank them according to the probability of occurrence, the severity of effects, and the probability of detection. System failure analyses are widely used in many other industries as part of the overall movement toward quality improvement in processes and products. In addition, IMO now requires that a failure analysis be performed during the design of navigation equipment and bridge systems. The Coast Guard has required the use qualitative failure analysis techniques in evaluating the reliability and safety of vital system automation on U.S. flag vessels since 1988. In proposing the regulatory requirement that designers, manufacturers, and/or shipyards perform and submit system failure analysis, the Coast Guard stated that the use of advanced automation technologies such as electronics and microprocessors made it increasingly difficult, “at times impossible, for the Coast Guard, ship owners/operators, and classification societies to evaluate safety.” Classification societies, however, have not seen the need to require failure analyses on vital automation systems in spite of the fact that these systems are becoming even more complex and difficult to evaluate. The LR stated that during its plan approval and surveys of the Ecstasy’s construction, it was not provided details of the propulsion system’s internal connections. Therefore, LR was not aware, prior to the casualty, that the propulsion would be lost if the cables to the high-speed breakers were burned through.

Analysis 75 Marine Accident Report If a qualitative failure analysis of the Ecstasy’s propulsion system had been performed during its design phase, the failure probability of the single power source may have been rated low. However, the high severity of the failure effect, that is, the total loss of the propulsion system, should have led the designers to implement design modifications. The Safety Board is aware that qualitative failure analysis typically is not applied to existing systems because analyzing and changing system arrangements after construction is often difficult and costly. However, a qualitative failure analysis can be an important technique to maximize the reliability and safety of a system before it is built, when changes can be easily made. The Safety Board concludes that, to ensure the highest levels of safety and reliability, ship owners should use qualitative failure analysis techniques in the design and construction of their vessels. The Safety Board, therefore, believes that, in the construction of new passenger ships, owners should use qualitative failure analysis techniques to identify system components whose failure might cause a complete loss of propulsive power and take action to mitigate identified problems. The Safety Board also believes that the International Association of Classification Societies (IACS) should recommend that its members require systems designers, manufacturers, and/or shipyards to perform and submit qualitative failure analyses to ensure the fail-safe operation of propulsion systems on new passenger ships.

76 Marine Accident Report Conclusions Findings 1. Although the Ecstasy’s mooring deck sustained the heaviest fire damage, it was not the point of origin for the fire. 2. The fire on board the Ecstasy started in the main laundry and was ignited by an arc from a welding machine. 3. The fitters’ (welders’) lack of full compliance with the “hot work” permit procedures in Carnival Cruise Lines’ safety management system manual increased the risks of fire in the main laundry. 4. The lint that accumulated in the ventilation duct of the main laundry created a serious fire hazard on the Ecstasy. 5. The procedures and standards for inspecting and maintaining laundry ventilation systems adopted by the marine industry and government agencies following the Ecstasy fire will improve safety on cruise ships. 6. If an automatic fire suppression system had been installed on the mooring deck, the fire on the Ecstasy would have been located and extinguished much sooner, thereby minimizing the extent of fire damage on the vessel and aft mooring deck. 7. The vessel’s automatic fire sprinkler system effectively limited the spread of fire from the mooring station to adjoining decks, thereby preventing a significantly worse fire that would have caused greater damage and perhaps additional injuries. 8. If the main laundry’s fire dampers had been equipped with a passive means of closure, such as a fusible link, the heat from the fire would have caused the dampers to shut sooner, which, in turn, might have prevented the spread of fire beyond the laundry area. 9. The fire detection system performed properly by providing an early indicator of a fire.

1. Although most survey respondents indicated that the Ecstasy practice drill adequately

prepared them for the actual fire emergency, the drill lacked information about actions to take if you see smoke or if your muster station is unavailable that might have assisted passengers who encountered conditions or situations contrary to those during the drill.

1. Although the noise from the news helicopters may have interfered somewhat with the

communications with passengers on the outside deck, crewmembers were able to effectively communicate with the mustered people and manage the emergency.

Conclusions 77 Marine Accident Report

1. The procedures used by the Ecstasy’s shipboard personnel did not adequately account

for passengers and crewmembers during the emergency.

1. The lack of consistency between the information provided at the practice drill about

the provision of lifejackets and the procedures that crewmembers followed in distributing lifejackets during the actual emergency created unnecessary confusion among some passengers on the Ecstasy.

1. The lack of a means to call for help from the crew cabins delayed the rescue of two

crewmembers and contributed to the severity of their smoke inhalation injuries.

1. The emergency response by shipboard and shoreside firefighters to the fire was

timely and appropriate, resulting in the fire being properly contained and extinguished.

1. The failure to separate the power circuitry in the design arrangement of the auxiliary

voltage supply to the high-speed breakers of the propulsion systems resulted in inadequate isolation of essential system components, which, in turn, resulted in the shutdown of both propulsion systems when a single distribution panel was damaged.

1. To ensure the highest levels of safety and reliability, ship owners should require the

use of qualitative failure analysis techniques in the design and construction of their vessels. Probable Cause The National Transportation Safety Board determines that the probable cause of fire aboard the Ecstasy was the unauthorized welding by crewmembers in the main laundry that ignited a large accumulation of lint in the ventilation system and the failure of Carnival Cruise Lines to maintain the laundry exhaust ducts in a fire-safe condition. Contributing to the extensive fire damage on the ship was the lack of an automatic fire suppression system on the aft mooring deck and the lack of an automatic means of mitigating the spread of smoke and fire through the ventilation ducts.

78 Marine Accident Report Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following recommendations: New Recommendations To the U.S. Coast Guard: During control verification examinations, review a drill scenario in which one or more main vertical zones are inaccessible and evaluate the procedural effectiveness of the crew in crowd control, crisis management, lifejacket distribution, and passenger accountability. (M-01-1) To Carnival Corporation: For the ships in your fleets, revise the safety management system to include processes for preventing unauthorized flame cutting, grinding, or other activities that might ignite a fire. (M-01-2) For the ships in your fleets, develop plans to account for passengers and crewmembers in common emergency scenarios, in particular, a situation involving the inaccessibility of one or more main vertical zones and/or muster stations. (M-01-3) To Carnival Cruise Lines: For the ships in your fleet, engineer, design, and implement system modifications to mitigate the spread of fire and smoke from the laundry rooms through ventilation ducts to other areas of the vessel. (M-01-4) Examine the propulsion systems on the ships in your fleet and, if necessary to ensure redundancy, modify the arrangement of the auxiliary voltage circuitry to the high-speed breakers where a single source supplies both port and starboard propulsion systems. (M-01-5) Revise the safety information disseminated to passengers to include actions to take if they encounter smoke or fire and/or if their muster station is not available. (M-01-6)

Recommendations 79 Marine Accident Report To American Classic Voyages, Carnival Corporation, Inc., Crystal Cruises, Disney Cruise Line, Norwegian Cruise Line, Orient Lines, P&O Princess Cruises International, Ltd., Radisson Seven Seas Cruises, Regal Cruises, Renaissance Cruises, Inc., Royal Olympic Cruises, Royal Caribbean Cruise Lines, and Silversea Cruises, Ltd.: For existing vessels with ventilation system arrangements similar to Carnival Cruise Lines’ Fantasy Class ships, install an automatic method or system to mitigate the spread of smoke and fire from laundry spaces through the ventilation ducts to other vessel areas. (M-01-7) For existing vessels with mooring deck design arrangements similar to Carnival Cruise Lines’ Fantasy Class ships, install fire detection and suppression systems on mooring decks that carry high fire loads and presently have no automatic fire protection. (M-01-8) In the construction of new passenger ships, use qualitative failure analysis techniques to identify system components whose failure might cause a complete loss of propulsive power and take action to mitigate identified problems. (M-01-9) Install emergency call systems in passenger staterooms and crew cabins so that people trapped during a fire emergency will have a means of signaling their location. (M-01-10) To ABB, Inc.: Advise your customers owning ships with the same propulsion system design arrangements as the Ecstasy of the potential for system failure from the loss of auxiliary voltage to the high-speed breakers and recommend design changes to the propulsion system that would minimize these effects. (M-01-11) To the International Association of Classification Societies: Recommend that your members require systems designers, manufacturers, and/or shipyards to perform and submit qualitative failure analyses to ensure the fail-safe operation of propulsion systems on new passenger ships. (M-01-12)

Recommendations 80 Marine Accident Report Previously Issued Recommendations Resulting from this Accident Investigation M-98-125 Immediately inspect, within your fleet of ships, the laundry ventilation systems, including ducts, plenums, and exhaust terminuses, for any combustible material, such as lint, and clean the systems, as necessary, to reduce the risk of fire. (Urgent) M-98-126 Institute a program to verify on a continuing basis that the laundry ventilation systems, including ducts and plenums, remain clean and clear of any combustible material that poses a fire hazard on your vessels. Previously Issued Recommendations Classified in this Report The following Safety Recommendations were issued to 18 cruise line companies on July 11, 1990: M-00-6 Without delay, install automatic local-sounding smoke alarms in crew accommodation areas on company passenger ships so that crews will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. M-00-7 Without delay, install automatic local-sounding smoke alarms in passenger accommodation areas on company passenger ships so that passengers will receive immediate warning of the presence of smoke and will have the maximum available escape time during a fire. Based on no response from five cruise line companies, the Safety Board, therefore, classifies, in this report, the safety recommendations as indicated: M-00-6 (previously classified “Open—Acceptable Response”) is classified “Open—Unacceptable Response” for Costa Cruise Lines, Orient Lines, Regal Cruises, Royal Olympic Cruises, and Silver Sea Cruises in the section of this report entitled “Locally Sounding Alarms.” M-00-7 (previously classified “Open—Acceptable Response”) is classified “Open—Unacceptable Response” for Costa Cruise Lines, Orient Lines, Regal Cruises, Royal Olympic Cruises, and Silver Sea Cruises in the section of this report entitled “Locally Sounding Alarms.”

Recommendations 81 Marine Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: May 1, 2001

this page intentionally left blank

83 Marine Accident Report Appendixes Appendix A Investigation The Safety Board first became aware of the accident through national media coverage on the evening of July 20, 1998. Later that evening, the Safety Board dispatched a 12-person team from Washington, D.C. The team arrived in Miami shortly after midnight and boarded the Ecstasy when it docked. Safety Board investigators met with Carnival representatives, the Coast Guard, and local emergency response agencies. Later in the morning of July 21, investigators began examining the fire scene and interviewing witnesses. The initial on-scene investigation lasted from July 21-26; investigators returned to the Ecstasy on three occasions while it underwent repairs. The on-scene investigation ended on August 24, 1998. The following organizations were parties in the investigation: Carnival Cruise Lines, the Republic of Liberia, the U.S. Coast Guard, the Miami-Dade Fire Rescue Department, and the Florida Division of State Fire Marshall. The Safety Board held a public hearing in regard to the accident in Miami on February 17-18, 1999.

84 Marine Accident Report Appendix B STCW Code Specification of minimum standard of competence in crisis management and human behavior Competence Knowledge, understanding and proficiency Methods for demonstrating competence Criteria for evaluating competence Organize shipboard emergency procedures Knowledge of: .1 the general design and layout of the ship .2 safety regulations .3 emergency plans and procedures The importance of the principles for the development of ship- specific emergency procedures, including: .1 the need for pre-planning and drills of shipboard emergency procedures .2 the need for all personnel to be aware of and adhere to pre-planned emergency procedures as carefully as possible in the event of an emergency situation. Assessment of evidence obtained from approved training, exercises with one or more prepared emergency plans and practical demonstration The shipboard emergency procedures ensure a state of readiness to respond to emergency situations Optimize the use of resources Ability to optimize the use of resources, taking in account: .1 the possibility that resources available in an emergency may be limited .2 the need to make full use of personnel and equipment immediately available and, if necessary, to improvise Ability to organize realistic drills to maintain a state of readiness, taking into account lessons learnt from previous accidents involving passenger ships; debriefing after drills. Assessment of evidence obtained from approved training, practical demonstration and shipboard training and drills of emergency procedures Contingency plans optimize the use of available resources Allocation of tasks and responsibilities reflects the known competence of individuals Roles and responsibilities of teams and individuals are clearly defined

Appendix B 85 Marine Accident Report Control response to emergencies Ability to make an initial assessment and provide an effective response to emergency situations in accordance with established emergency procedures Leadership skills Ability to lead and direct others in emergency situations, including the need: .1 to set an example during emergency situations .2 to focus decision making, given the need to act quickly in an emergency .3 to motivate, encourage and reassure passengers and other personnel Stress handling Ability to identify the development of symptoms of excessive personal stress and those of other members of the ship’s emergency team Understanding that stress generated by emergency situations can affect the performance of individuals and their ability to act on instructions and follow procedures Assessment of evidence obtained from approved training, practical demonstration and shipboard training and drills of emergency procedures Procedures and actions are in accordance with established principles and plans for crises management on board Objectives and strategy are appropriate to the nature of the emergency, take account of contingencies and make optimum use of available resources Actions of crewmembers contribute to maintaining order and control Competence Knowledge, understanding and proficiency Methods for demonstrating competence Criteria for evaluating competence

Appendix B 86 Marine Accident Report Control passengers and other personnel during emergency situations Human behaviour and responses Ability to control passengers and other personnel in emergency situations, including: .1 awareness of the general reaction patterns of passengers and other personnel in emergency situations, including the possibility that: .1.1 generally it takes some time before people accept the fact that there is an emergency situation .1.2 some people may panic and not behave with a normal level of rationality, that their ability to comprehend may be impaired and they may not be as responsive to instructions as in non- emergency situations .2 awareness that passengers and other personnel may, inter alia: .2.1 start looking for relatives, friends, and/or their belongings as a first reaction when something goes wrong .2.2 seek safety in their cabins or in other places on board where they think that they can escape danger .2.3 tend to move to the upper side when the ship is listing .3 appreciation of the possible problem of panic resulting from separating families Assessment of evidence obtained from approved training, practical demonstration and shipboard training and drills of emergency procedures Actions of crewmembers contribute to maintaining order and control Establish and maintain effective communications Ability to establish and maintain effective communications, including: .1 The importance of clear and concise instructions and reports .2 The need to encourage an exchange of information with, and feedback from, passengers and other personnel Assessment of evidence obtained from approved training, exercises and practical demonstration Information from all available sources is obtained, evaluated and confirmed as quickly as possible and reviewed throughout the emergency Competence Knowledge, understanding and proficiency Methods for demonstrating competence Criteria for evaluating competence

87 Marine Accident Report Appendix C Ecstasy Emergency Procedures Placard Emergency Procedures Emergency Drills are held on board according to international maritime laws and are compulsory: All passengers must participate. The purpose of the drills is to acquaint all passengers with the correct procedure to be followed in the unlikely event of an emergency during the voyage. There are six muster stations which are identified and located as follows: Muster Station [A] Blue Sapphire Lounge (Atlantic Deck Forward) Muster Station [B] City Lights Blvd. (Promenade Deck Forward) Muster Station [C] City Lights Blvd. (Promenade Deck Midship) Muster Station [D] Stripes Discotheque (Promenade Deck Midship) Muster Station [E] Starlight Lounge (Promenade Deck Midship) Muster Station [F] Patio Pool Area (Lido Deck Midship) The purpose of assembling all passengers at the muster station is to clear the decks of all people enabling the crew to prepare the boats and at the same time, passengers are comfortably standing by near the embarkation stations to which they will be led according to the orders given by the master and his officers in charge. No suitcases, bags, parcels or articles of any kind, except blankets, can be taken to muster stations and into the lifeboats. DO NOT PANIC! Don’t use the elevators Avoid Useless Confusion and/or Noise. Emergency Signals Fire on board Two long blasts of the ship’s whistle supplemented by a continuous two-tone alarm signal over the loudspeakers. Abandon ship Seven or more short blasts followed by one long blast of the ship’s whistle supplemented by the same signal over the loudspeakers.

Appendix C 88 Marine Accident Report Whenever either of the above alarms is given, passengers shall go to their cabins, put on their lifejackets and then proceed calmly to their muster station, using whenever possible, the most direct route following the coloured muster station arrows via the main exits. Otherwise a secondary escape route via emergency exits may be used. The room steward will provide lifejackets for children at the start of each voyage. How to put on your lifejacket:

1. Place lifejacket overhead
2. Bring strap around body and fasten closure
3. Adjust to a snug fit by pulling free end of strap
4. Cross arms across chest and enter water feet first

In darkness, pull orange plastic ring to start light. Your muster station is [example] Muster F Station

89 Marine Accident Report Appendix D Number And Arrangement Of Lifejackets On the Ecstasy Checklist for Lifejackets Section C 8 # Location Total Type Remarks 1 Lido Deck-Locker Near L/Boat # 4 89 Adult To Be Used for Distribution During Pax Boat Drill 2 Lido Deck-Locker Near L/Boat # 4 92 Child To Be Used for Distribution During Pax Boat Drill 3 Lido Deck-Locker Near L/Boat # 4 7 Infants To Be Used for Distribution During Pax Boat Drill 4 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 5 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 6 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 7 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 8 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 9 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 10 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 11 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 12 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 13 Lido Deck-Bench By L/Boat # 4 18 Adult Spare Requested by SOLAS 14 Lido Deck-Bench By L/Boat # 4 14 Child Spare Requested by SOLAS 15 Lido Deck-Bench By L/Boat # 4 14 Child Spare Requested by SOLAS 16 Lido Deck-Bench By L/Boat # 4 14 Child Spare Requested by SOLAS 17 Lido Deck-Bench By L/Boat # 4 14 Child Spare Requested by SOLAS 18 In Front of Cab. R-53 37 Child Spare Requested by SOLAS 19 In Front of Cab. R-187 38 Child Spare Requested by SOLAS 20 In Front of Cab. M-83 37 Child Spare Requested by SOLAS 21 In Front of Cab. M-205 38 Child Spare Requested by SOLAS 22 In Front of Cab. U-45 37 Child Spare Requested by SOLAS

Appendix D 90 Marine Accident Report Column adds up to 4,936. Total Adult Spares Requested by SOLAS = 5% of 3,560 = 178 (See Lines # 3 - 4 - 5 - 6 - 7 - 8 - 9 - 10 - 11 - 12) Total Children Spares Requested by SOLAS = 10% of 2,634 = 264 (See Lines # 13 - 14 - 15 - 16 - 17 - 18 - 19 - 20 - 21 - 22 - 23 - 24) 23 In Front of Cab. U-179 38 Child Spare Requested by SOLAS 24 In Front of Cab. E-64 37 Child Spare Requested by SOLAS 25 In Front of Cab. C-153 38 Adult Spare Requested by SOLAS 26 Verandah Deck 68 Adult Pax Cabins 27 Lido Deck 67 Adult Crew Cabins 28 Lido Deck (Bridge) 4 Adult For Personnel on Watch 29 Empress Deck 618 Adult Pax Cabins 30 Upper Deck 532 Adult Pax Cabins 31 Main Deck 686 Adult Pax Cabins 32 Riviera Deck 640 Adult Pax Cabins 33 Deck #3 175 Adult Crew Cabins 34 Deck #2 484 Adult Crew Cabins 35 Deck # 1 301 Adult Crew Cabins 36 Tender # 7 – 8 - 14 - 15 - 16 - 17 480 Adult For Tender Service 37 Tender # 7 – 8 - 14 - 15 - 16 - 17 48 Child For Tender Service 38 Deck #2 – Bosun Store 48 Adult Spare 39 Deck #2 – Bosun Store 50 Child Spare 40 Atlantic Deck – By Children Playroom 11 Child Spare Total Lifejackets On Board = 4,946 Checklist for Lifejackets Section C 8 # Location Total Type Remarks

91 Marine Accident Report Appendix E Metallurgical Tests - Heat Release Table HRR: Heat release rate Average HRR (kW/m2) Heat Flux Applied in the Following Times 25 kW/m2 50 kW/m2 75 kW/m2 60 seconds 104.4 142.2 234.3 180 seconds 177.8 241.8 403.7 300 seconds 266.6 319.3 598.7

92 Marine Accident Report Appendix F Safety Recommendations on Call Systems In a 1993 special investigation report concerning passenger ship accidents,50 the Board made the following safety recommendation to the Coast Guard: M-93-39 Analyze the desirability and feasibility of equipping passenger staterooms with an emergency call system by which trapped passengers can signal their plight. The Coast Guard ultimately advised the Safety Board that it had discussed the desirability and feasibility of installing emergency call systems in passenger staterooms with the SOLAS Working Group on Fire Protection and, based upon that discussion, determined that “an additional emergency call system would not improve passenger-to- crew communications and would require additional maintenance.” The Safety Board disagreed with the Coast Guard’s actions and, on May 21, 1997, classified Safety Recommendation M-93-39 “Closed—Unacceptable Action,” based, in part, on the Coast Guard’s failure to perform the analysis requested. Following its investigation of the fire on the Universe Explorer, the Safety Board asked that both the Coast Guard and the ICCL take actions regarding emergency call systems on cruise ships. The Safety Board issued the following recommendation to the Coast Guard: M-98-32 Recommend to the IMO that passenger and crew cabins on cruise ships be required to be equipped with an emergency call system so that people trapped during a fire emergency have a means of signaling their location. On October 16, 1998, the Coast Guard responded that it would discuss the available options for any necessary improvements with the SOLAS working group on fire protection and will propose changes to the IMO, if appropriate. The Safety Board followed up by advising the Coast Guard that the current regulations were not sufficient in the event of a fire with heavy smoke. Based on the Coast Guard’s indicating that it would work with the SOLAS working group, the Safety Board classified M-98-32 “Open— Acceptable Response.” The Safety Board issued the following recommendation to the ICCL: 50 For additional information, read Special Investigation Report—Accidents Involving Foreign Passenger Ships Operating from U.S. Ports 1990-1991 (NTSB/SIR-93/01).

Appendix F 93 Marine Accident Report M-98-59 Recommend that member passenger ship companies install emergency call systems in passenger staterooms and crew cabins so that people trapped during a fire emergency will have a means of signaling their location. The ICCL responded that it had distributed the recommendation to its members for review and consideration. The Safety Board followed up by urging specific action to encourage the installation of emergency call systems as requested in the recommendation. The ICCL subsequently advised that SOLAS requirements and recent amendments stipulated a number of fire safety improvements addressing, among other measures, means of escape, low-location lighting, and smoke alarms. Moreover, SOLAS required cruise ship companies to train and designate crewmembers to search the ship for people who might be in their cabins or in non safety-designated locations. On February 18, 1999, the Safety Board responded that it was disappointed that the ICCL had not recommended that member companies install emergency call systems. The Board stated: A telephone system might not be able to handle the number of calls that might be made in an emergency. An emergency call system could identify the stateroom in which a passenger or crewman is trapped. Because the ICCL has only discussed this recommendation with its technical committee and has not recommended that member companies install emergency call systems, M-98-59 has been classified ‘Closed—Unacceptable Action.’

FD07208 ｜ 1998_美国_NTSB_PAR0001_Natural_Gas_Pipeline_Rupture_and_Subsequent_Explosion.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD Washington, D.C. 20594 PIPELINE ACCIDENT REPORT Natural Gas Pipeline Rupture and Subsequent Explosion St. Cloud, Minnesota December 11, 1998 7178A PB2000-916501 NTSB/PAR-00/01

this page intentionally left blank

Pipeline Accident Report Natural Gas Pipeline Rupture and Subsequent Explosion St. Cloud, Minnesota December 11, 1998 NTSB/PAR-00/01 PB2000-916501 National Transportation Safety Board Notation 7178A 490 L’Enfant Plaza, S.W. Adopted July 11, 2000 Washington, D.C. 20594 E P L U R IB U S U N U M N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

National Transportation Safety Board. Natural Gas Pipeline Rupture and Subsequent Explosion, St. Cloud, Minnesota, December 11, 1998. Pipeline Accident Report NTSB/PAR-00/01. Washington, DC: NTSB, 2000. Abstract: About 10:50 a.m. on December 11, 1998, while attempting to install a utility pole support anchor in a city sidewalk in St. Cloud, Minnesota, a communications network installation crew struck and ruptured an underground, 1-inch-diameter, high-pressure plastic gas service pipeline, thereby precipitating a natural gas leak. About 39 minutes later, while utility workers and emergency response personnel were taking preliminary precautions and assessing the situation, an explosion occurred. As a result of the explosion, 4 persons were fatally injured; 1 person was seriously injured; and 10 persons, including 2 firefighters and 1 police officer, received minor injuries. Six buildings were destroyed. Damage assessments estimated property losses at $399,000. The major safety issues identified in this investigation are the adequacy of the safety and emergency procedures used by Cable Constructors, Inc., crews when working in the vicinity of underground facilities and the adequacy of St. Cloud Fire Department procedures and training for responding to natural gas leaks. As a result of its investigation of this accident, the Safety Board makes safety recommendations to the Research and Special Programs Administration, the Occupational Safety and Health Administration, the Associated General Contractors of America, the National Utility Contractors Association, the Power and Communications Contractors Association, the National Cable Television Association, the American Public Works Association, and the International Association of Fire Chiefs. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2000-916501 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

iii Pipeline Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Personnel and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 CCI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Sirti . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 NSP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Pipeline Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Background of Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Emergency Response After the Explosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Disaster Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Fire Department Procedures and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 NSP Public Awareness Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Site Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Gas Monitor Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Previous Underground Facility Strikes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Events Following the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Contractor Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Fire Department Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Excavation Damage Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Excess Flow Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Previously Issued Recommendations Classified in this Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

iv Pipeline Accident Report Executive Summary About 10:50 a.m. on December 11, 1998, while attempting to install a utility pole support anchor in a city sidewalk in St. Cloud, Minnesota, a communications network installation crew struck and ruptured an underground, 1-inch-diameter, high-pressure plastic gas service pipeline, thereby precipitating a natural gas leak. About 39 minutes later, while utility workers and emergency response personnel were taking preliminary precautions and assessing the situation, an explosion occurred. As a result of the explosion, 4 persons were fatally injured; 1 person was seriously injured; and 10 persons, including 2 firefighters and 1 police officer, received minor injuries. Six buildings were destroyed. Damage assessments estimated property losses at $399,000. The National Transportation Safety Board determines that the probable cause of this accident was the lack of adequate procedures by Cable Constructors, Inc., to prevent damage to nearby utilities when its anchor installation crews encountered unusual conditions such as striking an underground obstacle. Contributing to the severity of the accident was the delay by Cable Constructors, Inc., in notifying the proper authorities. The major safety issues identified in this investigation are the adequacy of the safety and emergency procedures used by Cable Constructors, Inc., crews when working in the vicinity of underground facilities and the adequacy of St. Cloud Fire Department procedures and training for responding to natural gas leaks. As a result of its investigation of this accident, the Safety Board made safety recommendations to the Research and Special Programs Administration, the Occupational Safety and Health Administration, the Associated General Contractors of America, the National Utility Contractors Association, the Power and Communications Contractors Association, the National Cable Television Association, the American Public Works Association, and the International Association of Fire Chiefs.

1 Pipeline Accident Report Factual Information The Accident On December 11, 1998, a crew of four Cable Constructors, Inc., (CCI) workers was tasked with installing a utility pole support anchor1 vertically through a concrete sidewalk in the city of St. Cloud, Minnesota. (See figure 1.) The anchor (figure 2) was being installed as part of a project by Seren Innovations, Inc., (Seren) to construct a fiber- optic communication system in the St. Cloud area. Sirti Ltd. (Sirti) had been hired to provide all engineering, design, drafting, mapping, licensing, permitting and specification development, and program management for the construction of the system, and CCI had been hired to perform the actual construction work. 1 The anchor was a steel rod, 5 feet 6 inches long and 3/4 inch in diameter, with a closed-loop eye at the top and a spoon-like helix, cut at an angle, at the bottom. The helix acts as a bit during installation. Figure 1. Accident Area

Factual Information 2 Pipeline Accident Report Before installation was begun, the crew foreman measured the distance from the planned anchor site to the marked location of a gas pipeline owned by Northern States Power Company (NSP) and used to provide gas service to Book Em’s Bar. Because the distance from the marked location of the pipeline to the drill site was more than 2 feet, he determined that the installation of the anchor could proceed.2 The workers used a jackhammer to break about a 9-inch-diameter hole in the concrete sidewalk. They then placed an auger known as an “anchor cranker” (a gasoline- powered earth auger that had been specially modified to install anchors) on top of the anchor, and the crew began using the machine to auger the anchor into the ground. (See figure 3.) According to the workers, when the anchor had bored to a depth of 1 1/2 to 2 feet, it hit something hard. The object impeding the anchor’s travel was later determined to be a large granite slab about 18 inches wide, 90 inches long, and 8 inches thick. The crew removed the auger and struck the top of the anchor with a sledgehammer in an attempt to break up what crewmembers thought was a rock or rocks in the anchor’s path. The crew then reattached the auger to the anchor, and all four men recommenced the attempt to screw the anchor into the ground. They stated that the anchor then appeared to proceed normally, with no further unusual resistance, and they believed the anchor had broken through the obstacle or been deflected to the side of it. They said that “everything went fine, just as normal” until the top of the anchor was about 12 to 18 inches from the surface. At that point, they noticed dirt blowing out of the anchor hole and immediately Figure 2. Unused anchor (top) and accident anchor after removal from accident site 2 The distance from the marked location and the anchor site was later determined to be 38 inches. Had the distance been less than 2 feet, CCI policy and Minnesota State law would have required that the crew expose the utility line before beginning installation of the anchor.

Factual Information 3 Pipeline Accident Report began to smell gas. They then stopped the auger and released it. At that point, according to the foreman, “it [the auger] just laid over towards the [utility] pole.” (See figure 4.) After telling other crewmembers to keep people off the street and away from the leaking gas, the crew foreman went into Book Em’s Bar with a crewmember to telephone his supervisor. The foreman reached the CCI site project manager about 10:51 a.m.3 and told him that his crew had struck a gas pipeline while installing an anchor. The foreman later estimated that “no more than a minute” elapsed from the time he smelled gas to the time he made the phone call to his supervisor. The CCI site project manager told the foreman to follow the company’s utility strike procedures, and he went over the procedures with the foreman. The procedures were described in an August 19, 1998, memorandum from Sirti to all CCI supervisors. These procedures were not written into a CCI workplace accident and injury reduction program as required by Minnesota State law. In regard to notification, the procedures stated: Any utility strike will require immediate notification of the utility. If gas, immediately extinguish all ignition sources in the immediate vicinity such as motors, smoking, divert all traffic in the area, notify the utility. Isolate the area by barricading to restrict access. It may also be necessary to evacuate the area.... The procedure did not advise supervisors to call 911. The foreman said that after completing the call, he told the four people in the bar of the gas leak outside and informed them that they should not smoke, nor should they exit the building using the doorway near the escaping gas. Figure 3. The “anchor cranker” auger used to install the anchor that ruptured the pipeline 3 Unless otherwise noted, times used in this report are based on telephone records or witness statements.

Factual Information 4 Pipeline Accident Report The CCI site project manager, as required by Seren’s utility damage reporting procedures, then telephoned the Sirti safety coordinator and told him that a gas line had been hit. According to phone records, this call was made about 10:52 a.m. The CCI site project manager said he did not know all of the people to call in St. Cloud. The CCI site project manager said the Sirti safety coordinator told him to call NSP and to let NSP employees make the emergency response calls. The Sirti safety coordinator told the CCI site project manager that he (the safety coordinator) would immediately leave for the accident site, which he did. On the way, he placed a cell phone call to Seren management, informing them that a gas line had been hit and he was on his way. Some time thereafter, the CCI site project manager departed his office for the accident site. Along the way, he placed a cell phone call to NSP’s customer service 800 number to report the leak. According to cell phone records, this call was placed at 11:21 a.m. Meanwhile, the CCI foreman had gone back to the site to make sure his crewmembers had blocked off the area. He directed that cones and orange tape be used to help keep out vehicular traffic. Minnesota State Law, Chapter 216D.06, required an excavator who damages an underground facility to notify the operator and “take immediate action to protect the public and property and to minimize the hazard until the operator’s personnel or emergency responders have arrived.” While gas was exiting the Figure 4. Anchor installation site as revealed by postaccident excavation

Factual Information 5 Pipeline Accident Report ground, a CCI crewmember moved the crew’s aerial truck4 into Courthouse Square and to the north of First Street North. He parked the truck so as to help prevent southbound Courthouse Square traffic from entering First Street North. After the CCI crew had placed cones and strung orange tape across First Street North where it adjoined Ninth Avenue North, the crew waited for the emergency responders (who, in fact, had not yet been called) and tried to keep people away from the taped off, secured area. The CCI foreman later said, For about the first 10 minutes, we had people coming and going, and then people were slowly dissipating. There weren’t people coming and going anymore. So basically the street was shut off. By this time, a receptionist in the Stearns County Administration Building was receiving complaints by telephone and from walk-ins of a strong smell of gas outside. The receptionist relayed the reports downstairs to the office of the Stearns County building facilities director. Upon learning of the reports, the facilities director left by the west entrance of the administration building to investigate. Once outside, he called to have an air handler turned off in the Administration Building. Knowing of construction on Second Street North, the facilities director approached the site and asked the excavators if they had hit a gas line. The excavators said they had not and pointed him toward the CCI workers. After walking past the police department building and smelling gas, he asked the CCI workers if they had damaged a gas line. The crew foreman told him they had. The director asked if the crew had called the fire department, and the crew foreman reported that they had not. The director then, about 11:05 a.m., placed a cell phone call to the Stearns County chief deputy sheriff and reported the leak. The deputy sheriff then called the sheriff’s department dispatcher, who immediately called the St. Cloud Fire Department. At 11:06 a.m., Engine Company 21, based at Fire Station 1, about 2 blocks from the leak site, was dispatched to the scene. According to telephone records, at 11:07 a.m., the fire department dispatcher notified the NSP dispatcher of the leak. Also about 11:06 a.m., St. Cloud police units 41 and 42 were assigned for traffic control in front of Book Em’s Bar because of the gas leak. About the same time, unit 40, a police sergeant, reported that the area had already been barricaded and that police assistance was available to the fire department through the dispatcher. The firefighters arrived on the scene about 11:08 a.m. According to interviews, a CCI employee moved the tape to allow the engine company into the secured area. The first responders in the engine company included a lieutenant and three firefighters. The lieutenant said he immediately took notice of the wind direction when he arrived at the site. He later said that he planned to use the information to decide which buildings needed to be evacuated first if evacuation became necessary. 4 This truck is known as an aerial truck because it had a lift to allow workers to connect cables to utility poles.

Factual Information 6 Pipeline Accident Report One of the firefighters, accompanied by another firefighter, began testing the area using a hazardous and combustible gas monitor.5 After radio approval from his lieutenant, and within a minute of arrival, the other firefighter moved the fire truck to the east end of First Street North to eliminate a possible ignition source. The Sirti safety coordinator said he arrived at the scene about 11:15 a.m. He said he parked across the street from the police station and walked to the accident site. He took several photographs of the anchor location and the general area around the scene. Four vehicles were parked on First Street North next to Book Em’s Bar. The St. Cloud Fire Department lieutenant told the firefighters that NSP would need to bring heavy equipment into the area to repair the leak and that the vehicles would have to be moved. The lieutenant then walked to the police department building and asked that the license numbers for the parked vehicles be researched and their owners contacted. None of the owners were contacted, but they all eventually came out of nearby buildings and moved their vehicles. With another firefighter at his side, the firefighter with the gas monitor first tested the concentration of natural gas above the leak site. He then performed the same test alongside the buildings housing Book Em’s Bar and Bellantti’s Pizza and Deli. The firefighter who carried the gas monitor said the area “smelled really bad.” He said he essentially got no reading when he placed the monitor directly adjacent to the hole in the ground made by the anchor. He said that the monitor’s lower explosive limit (LEL) reading went from -2 to 0.6 A firefighter stated that they had not had time to do a fresh-air calibration7 of the monitor because of the short distance between Fire Station 1 and the accident site. After the fire truck moved to the east end of First Street North, the CCI site project manager arrived on Courthouse Square. He parked his truck on Courthouse Square so as to prevent traffic from entering the east end of First Street North. With the CCI project manager’s truck on one side of Courthouse Square and the crewmember’s aerial truck on the other side, traffic could not travel from Courthouse Square toward the east end of First Street North. About 11:16 a.m., two NSP trucks arrived. As was done earlier for the fire department, a CCI lineman moved the tape to permit entry for both NSP trucks. An NSP gas technician specialist arrived in one truck, which he parked on the street alongside the damage area. He then went to the location of the damage to assess its extent and to talk to the CCI foreman. An NSP locator technician (the individual who finds and marks the 5 The hazardous and combustible gas monitor used by the St. Cloud Fire Department was similar to a combustible gas indicator except that it had sensors for both combustible and toxic gases. 6 Lower explosive limit refers to the lowest concentration of a flammable gas that can be ignited. NSP standards state that the LEL of its natural gas is about 4.8 percent. Gas monitors typically indicate the percentage of LEL, meaning that an NSP gas monitor reading of 100 percent would indicate a natural gas concentration of about 4.8 percent. 7 To ensure accurate readings, the monitor is to be turned on in fresh air, after which it automatically completes a 20-second self-test and start-up sequence.

Factual Information 7 Pipeline Accident Report locations of buried utilities) was in the other truck, which was parked behind the gas technician specialist’s truck. With NSP personnel on scene, two of the fire department responders joined the third already at the fire truck, while the lieutenant remained in the vicinity of the leak. At the anchor leak site, the NSP gas technician specialist asked the CCI foreman to fill out a damage report detailing how the gas line was damaged and providing the address of the responsible contractor. While this report was being filled out, the NSP gas technician specialist was readying his equipment. Witnesses stated that after the form was completed, the NSP gas technician specialist entered Book Em’s Bar at street level (the building did not have a basement). Inside the bar, he took readings on a combustible gas indicator and was overheard stating he obtained a reading of 7 percent.8 Bar patrons said the gas technician specialist then left the bar to look for an entrance to the basement of the adjacent building, which housed Bellanti’s Pizza and Deli. The four persons who were in the bar during this time later told police that no one at any time asked them to evacuate the building. While the gas technician specialist was taking his readings, according to witness statements, the NSP locator technician was determining if the service line had been properly marked. He was also seen assisting with the movement of a vehicle from the secured area. According to radio and cell phone records, about 11:29 a.m., an explosion occurred in the basement of the building where Bellanti’s Pizza was located. Three firefighters were in their truck at the time of the explosion. They reported that they saw no fire but that they could see little because their vehicle was immediately enveloped in a cloud of dust. Two of the firefighters exited the fire truck while the third used the radio to report the explosion and request ambulance service. He said he “knew that there were injuries.” A police officer patrolling nearby also radioed a report of the explosion. After making the report, one of the firefighters then moved the truck to the northeast, putting the county facilities building between the fire truck and the explosion site. According to NSP, when the NSP gas technician specialist received the call of the leak, about 11:09 a.m., he immediately called for a company construction crew, which was equipped to shut down the damaged portion of the line. At the time of the explosion, this three-person crew was 2 blocks away from the accident site. About 11:30 a.m., the NSP construction crew foreman radioed the NSP dispatcher to report the explosion. The NSP dispatcher directed 26 gas technicians to the explosion site. An NSP manager stated that the technicians were sent to help close off the damaged line and to enter and check all adjacent buildings in the surrounding area for potential gas-related problems. NSP workers stopped the flow of gas to the damaged gas line at 12:25 p.m. and shut off electrical power at 12:31 p.m. 8 Although the gas technician specialist was killed in the explosion and the gas monitor was not recovered, because NSP employees were trained to use their monitors to measure LEL, the 7 percent probably referred to the LEL rather than to the concentration of gas in the air.

Factual Information 8 Pipeline Accident Report According to the report of the Minnesota State fire marshal, the explosion occurred in the basement of the building where Bellanti’s Pizza was located. The basement walls were made of stacked stones and crumbling mortar. According to the fire marshal’s report, gas collected in the basement of the building and was ignited by an unknown source. In the basement of the building were several potential sources of ignition, including gas water heaters. Injuries Damage In addition to the building containing Bellantti’s Pizza and Deli, the explosion destroyed the buildings containing Book Em’s Bar, Tom’s Bar, and Bartsh Bail Bonds, and the two buildings containing the Hall Law Offices. The law office buildings were joined with a fire door. The blast also damaged the Stearns County court facilities building and the buildings housing Taco John’s and Howies Bar. According to the St. Cloud city assessor, the damage assessment for the buildings destroyed by the natural gas explosion was $399,000. (See figure 5.) Personnel and Training CCI The CCI crew foreman had a total of 14 nonconsecutive years’ experience with the company, about half of it as a foreman. He had taken 3 years off the job for personal business and had returned to CCI as a lineman about 3 months before the accident. He said he had received no formal refresher training upon his return. He had been promoted back to foreman about 2 weeks before the accident. Table 1. Injuries Type of Injurya a49 Code of Federal Regulations 830.2 defines fatal injury as “any injury which results in death within 30 days of an accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second or third-degree burns, or any affecting more than 5 percent of the body surface.” NSP Employees Emergency Responders Building Occupants Other Total Fatal 2 0 1 1 4 Serious 0 0 1 0 1 Minor 0 3 2 5 10 Total 2 3 4 6 15

Factual Information 9 Pipeline Accident Report One lineman on the crew had been with CCI for 5 1/2 months. Another CCI lineman had about 3 months’ experience before the accident. This lineman was a machinist before coming to CCI, and he had no previous communications or cable installation experience. The third lineman on the crew said that he had been working for CCI for only about 2 weeks but that he had 19 months’ experience as a lineman before joining CCI. The CCI site project manager had been working for CCI for 3 years. Before this, he had worked for a cable installation company and as a self-employed cable installer. CCI conducted initial training for new employees. Much of the initial training was task-related and was focused toward reviewing the work that they would be performing. The initial training also entailed working in the field with experienced individuals who would show new employees the proper way to complete tasks such as pole-climbing and running and overlashing cable. The initial training covered equipment related to worker safety (hard hats, vests, and cones), but it did not cover what an employee should do in the event of a natural gas pipeline strike. According to meeting records, pipeline strikes were addressed at a special October 23, 1998, meeting held among Seren, NSP, Heath Consultants (utility locating),9 and CCI. Participants at the meeting included Seren’s director of network construction and Figure 5. Postaccident aerial view of affected area 9 Utility companies sometimes use utility-locating services rather than their own employees.

Factual Information 10 Pipeline Accident Report operations, CCI’s site project manager, and NSP’s district operations manager and damage prevention coordinator. Although Sirti was the safety project coordinator, no one from Sirti is listed as attending this meeting. The meeting covered related subjects such as locating underground facilities. According to the meeting minutes, the meeting was held because “NSP and Seren together decided that we needed a meeting to better control the situation we have with safety as it related to locating gas and electric services, particularly given recent incidents that have occurred.” According to officials, a number of incidents had occurred in which yellow-paint locate marks had not been placed directly above the underground facility. Before the meeting, NSP had been contracting out its utility locating to Heath Consultants. As a result of the meeting, NSP assigned two full-time utility locators to the Seren project and put the contract locator under the direct supervision of an NSP locator. To help ensure that locate marks were located directly above underground facilities, the idea of pre- construction “walkouts” was discussed, along with the need for daily meetings at excavation sites between the locator and Seren excavators to pinpoint utility locations. It was determined that improved mapping and map reading would also help ensure that locate marks would be placed directly above underground facilities. During the meeting, the CCI site project manager specified the need for a 24-inch distance between the excavation and the locate marks. Emergency procedures for Seren contractors were also discussed at the October 23 meeting. The topic discussion started when Seren’s director of network construction and operations asked “Once we do have a strike, what is the procedure?” NSP officials then said they would send out a person immediately and that police and fire departments would be needed to keep the crowds away. Later in the meeting, NSP provided attendees with a “tip sheet” containing a step-by-step process in the event an underground natural gas line should be struck during excavation or other construction. The tip sheet advised workers first to shut down all equipment in the immediate area, then “Call 911 and/or radio dispatcher and request that they call 911 to alert the Fire and Police Departments.” No tip sheet or written emergency procedures were available at the site of the accident. CCI construction crews were required to attend “construction” meetings every Wednesday at 10 a.m. According to CCI, at these meetings, workers would discuss incidents that occurred during the previous week. These Sirti-run meetings were also called “safety meetings” because Sirti maintained a log of utility strikes, and the workers would analyze how an incident occurred and how a similar incident could be prevented in the future. Sirti The Sirti safety coordinator who responded to the accident had completed a Minnesota Safety Council course entitled “An Introduction to Occupational Safety” in June 1998.

Factual Information 11 Pipeline Accident Report NSP The NSP gas technician specialist initially sent to check the leak was killed in the explosion. Company records show that the technician had completed the company’s “Gas Emergency Training” course in February 1998 and had completed the final course test with no errors. The locator technician who responded to the leak was also killed. He had taken the gas emergency training course in February 1995 and had passed the final test. He had also taken a course entitled “Recognizing Emergency Conditions” in August 1995. He was not required to take the training course annually because he was not a gas operations employee and therefore would not respond to a gas leak in the same capacity as a gas technician. Because NSP is also the provider of electric power for St. Cloud, the locator technician would locate both electric and gas underground facilities. He had been the individual who had marked the location of the pipeline before the anchor installation was begun, and he went to the site to verify that he had properly marked the pipeline’s location. According to NSP officials, the company offered a number of courses designed to prepare NSP employees to respond to gas emergencies. The officials stated that the training has a special section on outside leak emergencies and that a considerable part of this section is about leak classification guidelines. Leak classifications involve the volume, location, area, system pressure, concentration, duration, and spread rate of a leak. Company representatives said employees were taught that a leak classification involves the possible migration of the gas and the proximity of a leak to a building foundation. The gas emergency training course lesson plans state that experience is imperative in evaluating a leak and assigning repair priority and that experience is needed to recognize where gas may be migrating. In addition to the above training, NSP’s St. Cloud office gas operations employees were required to attend a half-day fire school during the summer and 90-minute safety meetings each month. These meetings covered 17 planned subjects such as carbon monoxide safety, heat stress, and winter safety. An NSP training officer stated that the safety meetings were less structured or planned than the company’s training courses. None of the safety meetings specifically covered the procedures needed in the event of an underground gas leak next to a building. The NSP Gas Safety Training Department required that new gas operations employees go through a formal apprenticeship program. On an ongoing basis, all gas operations employees are required to take a first-aid course every 3 years and 11 different courses annually. Required courses included confined space work, excavation and shoring, and gas emergency training.

Factual Information 12 Pipeline Accident Report Pipeline Operations NSP completed the original installation of the gas service line serving Book Em’s Bar on October 29, 1982. The polyethylene main and service pipelines were installed for use at 7 inches water column pressure (approximately 1/4 psig). According to the company, NSP planned to possibly upgrade the system later to high pressure, and the pipelines were tested to 100 psig after installation. An excess flow valve (EFV) was not required by regulation and was not installed. Records show that the service pipeline and meter set to Book Em’s Bar were “uprated” to high pressure on August 19, 1998. No excavation was done to uprate the pipeline. The service pipeline meter set was changed to fit a high-pressure, 60 psig system, and the service pipeline was again tested to 100 psig. After August 19, 1998, and at the time of the accident, the pipeline operating pressure at the outlet of the regulator station was about 60 psig. Background of Accident On March 10, 1998, a contract was completed between Seren, a fully owned subsidiary of NSP, and Sirti. The contract stipulated that Sirti would provide all engineering, design, drafting, mapping, licensing, permitting, and specification development for the construction of a two-way fiber-optic telecommunications system throughout the St. Cloud area. On July 15, 1998, Seren authorized Sirti to provide the construction project management services for the St. Cloud telecommunications system. As project manager, Sirti would coordinate all construction and testing activities and administer all contractor’s documents. Contract correspondence between Seren and Sirti indicated that Sirti would hire a safety manager who would prepare a safety manual and be responsible for enforcing all Federal and State regulations. On August 5, 1998, Seren signed a contract with CCI to construct the telecommunications system throughout the St. Cloud area. Although Sirti was already chosen to be the project and safety manager, the contract between Seren and CCI had no mention of Sirti. CCI officials were aware that Sirti was the project manager, and CCI subleased office and warehouse space from Sirti. CCI started field construction under this contract on August 10, 1998. On December 8, 1998, after using the Gopher State One-Call system, CCI’s aerial construction manager met with eight underground facility operators,10 including NSP, and informed them of the locations where CCI planned to install utility-pole support anchors. 10 The underground facility operators included the city of St. Cloud, the city of Waite Park, TCI Cablevision, the State of Minnesota Department of Transportation, Norstan Communications, NSP, Seren, and U.S. West (telephone).

Factual Information 13 Pipeline Accident Report The facility operators marked their facilities in these areas. CCI planned to do the work at these sites between December 8 and December 11. The One-Call ticket was for 21 locations. Meteorological Information According to weather data recorded at the St. Cloud airport, at the time of the accident, the skies were clear and the wind was blowing out of the southwest at 8 mph. Climatological data for the city of St. Cloud indicate that the weather for a month before the accident was unseasonably mild, with the average temperature being 10.7° F warmer than normally recorded for that time of year. Had it not been for the unseasonably warm weather, CCI would have had to postpone the anchor installations because of frozen ground. Medical and Pathological Information Four people were fatally injured in the accident, including the NSP gas technician and the NSP locator. Also killed were a pedestrian walking outside the taped-off area and a tenant of one of the rented rooms above Bellantti’s Pizza. The tenant was found in the basement of the collapsed building with debris beneath and over his body. Cause of death in each case was multiple traumatic injuries due to natural gas explosion. Eleven people, including two firefighters and one police officer, were injured. An employee of the law offices, one of four trapped persons extricated from the rear of the law offices building, sustained serious injuries from falling debris. The remaining 10 people received minor injuries, including abrasions, lacerations, and inhalation injuries. They were treated at St. Cloud Hospital and released. U.S. Department of Transportation (DOT) rules for postaccident alcohol and drug testing (49 Code of Federal Regulations (CFR) 199.3 and 11(b)) do not cover workers such as CCI employees at the scene of the gas explosion or those involved in the excavation activities that preceded the accident. Covered employees are those persons who perform operating, maintenance, or emergency response functions regulated by 49 CFR Parts 192, 193, or 195. After discussions with NSP and Seren, CCI, about 10 hours after the accident, directed five involved employees to St. Cloud Hospital for the collection of specimens. The five employees included the crew, the crew foreman, and the project manager, who was the first member of management to be notified of the leak. Arrangements were made for MedTox Laboratories, Inc., in St. Paul, Minnesota,11 to collect the specimens and 11 MedTox Laboratories, Inc., was on a U.S. Department of Health and Human Services list of laboratories meeting minimum standards to perform urine drug testing.

Factual Information 14 Pipeline Accident Report perform the tests. According to the times indicated on the MedTox laboratory sheets for the blood and urine test reports, the earliest specimen collection was 9:35 a.m. on the day of the accident, and the last collection was 10 a.m. the next day.12 The other collections were recorded as taking place between 10:30 p.m. and 11:20 p.m. on December 11. The MedTox test results for alcohol in blood were positive at or above 0.02 g/dl for one employee. For another employee, marijuana metabolite was present in urine at or above the 15 ng/ml level. The Safety Board asked the crewmembers about their activities between the time of the accident and the time their specimens were collected. They said they returned to the shop for their paychecks. On the way home, they went together to a bar and had “several” drinks. The foreman said that he drank a “couple” more beers when he got home. Everyone on the crew said that they had not consumed alcohol or used drugs within 8 hours of reporting for work on the morning of the accident. The specimens remaining after the MedTox tests were shipped to the Civil Aeromedical Institute (CAMI) for additional testing at the request of the Safety Board. The CAMI tests revealed the presence of alcohol and marijuana in the specimens of two of those tested. According to CCI officials, after the accident, the company began requiring preemployment drug screening and conducting random drug testing of its employees. Survival Aspects Emergency Response After the Explosion Immediately after the explosion, one engine company each responded from St. Cloud Fire Department’s Fire Stations 2 and 3, and a ladder truck responded from Fire Station 1. Fire department personnel notified Gold Cross Ambulance Service to respond and requested heavy excavation equipment. Crewmembers of Engine Company 21, already on scene, began search and rescue operations immediately. Four people were trapped inside the rear portion of the Hall law offices, which was between the Bellantti’s building and Tom’s Bar. Three of those trapped were extricated by firefighters within 20 minutes. Some 30 minutes after that, the fourth person was freed and taken to the hospital. None of these individuals reported seeing any NSP or fire department personnel before the explosion. At 11:30 a.m., St. Cloud Police Department Unit 43 advised the Stearns County Sheriff’s Department dispatcher of the explosion. All available ambulances were asked to 12 MedTox forms for one employee show the time of urine collection as 9:35 a.m. on December 11, which was about 2 hours before the explosion. The time shown for collection of a blood specimen for the same employee was 10 a.m. on December 12, the day following the accident. The Safety Board asked for but did not receive information from MedTox that would explain these discrepancies.

Factual Information 15 Pipeline Accident Report respond to the scene, as were all available law enforcement personnel. A request was also made for construction equipment. About the same time, the St. Cloud fire chief and the assistant fire chief, who was the incident commander, arrived on scene. At 11:31 a.m., the St. Cloud Police Department began evacuating the immediate area, including Courthouse Square and the north side of the courthouse building. At this time, all of the St. Cloud off-duty firefighters and volunteer division firefighters were called to report to duty. At 11:32 a.m., a command post was established 100 feet west of the intersection of Ninth Avenue North and First Street North and a staging area was established at the rear of Fire Station 1. Also about 11:32 a.m., Engine 21 firefighters notified the incident commander that they were going to begin evacuation of the Stearns County courts facilities building. At 11:33 a.m., the incident commander requested additional NSP personnel because of the gas leak and downed electrical wires. The first ambulance arrived at 11:34 a.m. At 11:37 a.m., the fire chief activated the St. Cloud Emergency Action Plan. At 11:38 a.m., the fire chief asked for help from the Waite Park and Sauk Rapids fire departments. At 11:42 a.m., the St. Cloud police established an evacuation perimeter. This perimeter included the Law Enforcement Center, the courthouse, and the Stearns County Administration Building. At 11:44 a.m., Gold Cross Ambulance Service called the St. Cloud Hospital and informed the emergency trauma center charge nurse of the gas explosion and advised her that approximately 20 patients possibly could be transported to the hospital. Subsequently, the hospital evaluated its resources and determined that three air ambulances were available to transport patients to burn centers if necessary. By 11:47 a.m., all injured survivors, with the exception of the seriously injured and trapped victim, had been removed from the immediate area surrounding the explosion. The evacuation perimeter was further secured using police line tape and road barricades with security checkpoints established. At 11:50 a.m., the owner of the building housing Bellantti’s Pizza informed a police supervisor that two rooms on the second floor of the Bellantti’s building were rented. At 12:07 p.m., the incident commander called for the Anoka County Search and Rescue Canine unit. At 12:09 p.m., St. Cloud Hospital initiated its disaster plan and notified 50 medical professionals to respond to an upper floor staging area. The emergency trauma center monitored the activities of the ambulance crews on site and was kept informed on the conditions of patients and their transportation to the hospital. A total of 11 people were either transported by ambulance or arrived by private vehicle at the hospital. At 1:30 p.m., the hospital’s disaster plan was discontinued.

Factual Information 16 Pipeline Accident Report At 1:51 p.m., the Anoka County Search and Rescue Canine Unit arrived on scene. At 2:24 p.m., St. Cloud police received reports that two individuals had been in a rented room above Bellantti’s at the time of the explosion. At 3 p.m., the police department confirmed that all four people who had been inside Book Em’s Bar at the time of the explosion had been accounted for. At 3:05 p.m., police officers were assigned to start door-to-door checks within the affected area. At the same time, Red Cross workers were on site at a nearby home for senior citizens to assist with a possible evacuation. Search and rescue operations continued with the use of manual and heavy equipment until approximately 10 p.m., in the event that more victims were buried in the debris; however, none were found. At 10 p.m., the St. Cloud Police Department and the 34th Military Police Company of the Minnesota National Guard secured the area for the night. NSP continued operations in the area, restoring power and gas service to the senior citizens home and to other buildings in the area. Disaster Preparedness The city of St. Cloud implemented its disaster plan for the accident. The purpose of the basic plan was to ensure the effective, coordinated use of the resources available to the city so as to: (1) maximize the protection of life and property; (2) ensure the continuity of government; (3) sustain survivors; and (4) repair essential facilities and utilities. Prior to the accident, the most recent certification of the plan by local authorities was September 9, 1998. The last full-scale disaster drill conducted by the city of St. Cloud before the accident was on May 21, 1998. The drill simulated an airplane accident at St. Cloud airport. According to hospital officials, St. Cloud Hospital routinely performs two internal disaster drills annually. Fire Department Procedures and Training Although all of the fire department responders were trained on the basic characteristics of natural gas, at the time of the accident, the St. Cloud Fire Department had no written procedures in place providing detailed guidance on responding to natural gas leaks. The firefighters were instructed during in-house training, State-sponsored training, and training sponsored by NSP to be aware of wind direction as well as the general characteristics of natural gas. The American Gas Association’s (AGA’s) pamphlet A Guide to Controlling Natural Gas in Emergencies was also reviewed and distributed by NSP. Prepared by the AGA as a guide to firefighters, the pamphlet provides a brief overview of natural gas and its characteristics. In a section dealing with steps to take when gas is escaping outside a building, the pamphlet recommends: If unignited gas is escaping from the ground, from an excavation or from an open pipe outside a building - NOTIFY THE GAS COMPANY IMMEDIATELY. A safe area surrounding the location should be cleared, roped or barricaded. Extinguish all open flames. Prohibit smoking. Check surrounding buildings, cellars in particular, for any presence of gas odors. Restrict or reroute all traffic until gas company personnel can bring the gas flow under control.

Factual Information 17 Pipeline Accident Report This pamphlet outlined the actions to take in the event of an underground gas leak next to a building. NSP trains its employees that gas can migrate underground. As a part of its public awareness program (see next section), NSP provides information and instructional classes to fire departments on the hazards of natural gas. Before the accident, the most recent training class regarding natural gas had been provided to the St. Cloud Fire Department in October 1995. NSP Public Awareness Program According to company officials, NSP has a public awareness plan for the safety of the public and contractors working in and around natural gas. The plan covers excavation safety, and the information is communicated through radio, television, and newspaper ads, in addition to billing inserts. All forms of communication emphasize the need to call Gopher State One-Call before excavating. Some forms of communication, especially newspaper ads and billing inserts, include whom to call for carbon monoxide problems, gas leaks, or incidents when the odor of natural gas is detected. The ads and inserts state that in the case of a suspected gas leak, a person should evacuate a building, should not turn on any light switches, and should call NSP from outside the building. Excavation safety includes working with various groups such as the Gopher State One-Call, the Metropolitan Utility Coordinating Committee, the Minnesota Utility Contractors Association, and other groups to prevent excavation damage. Investigation Site Description Postaccident Safety Board investigation revealed a yellow paint mark on the sidewalk in direct line with two other yellow paint marks, one over and perpendicular to the curb and another on the sidewalk closer to Book Em’s. The paint marks ran in a straight line toward a gas riser located inches from the Book Em’s building wall. Each of the paint marks was about 2 feet long and was directly over the gas service pipeline. Gas Monitor Testing Four days after the accident, with fire department and Safety Board personnel present, the gas monitor readings that were obtained by firefighters at the accident scene before the accident were downloaded from the memory device within the monitor, and the monitor was calibrated. The calibration of the monitor was tested by exposing the unit to a calibration gas with a concentration that was 50 percent of LEL. When tested against this gas, the monitor registered 34 percent of LEL. Also, the timing mechanism on the monitor was in error by about 4 minutes.

Factual Information 18 Pipeline Accident Report Previous Underground Facility Strikes Although the gas line location in this accident was accurately marked, during the investigation, the Sirti safety manager stated that an NSP locating contractor had done a poor locating job in the past. Sirti submitted to the Safety Board a list of 37 previous underground facility strikes, with several attributed to improperly located or unmarked underground facilities. NSP records showed that as a result of excavator error, CCI and its subcontractor had previously damaged NSP natural gas pipelines, including incidents on October 7 and 30, 1998. CCI had also damaged NSP’s underground electrical facilities and the underground facilities of others. About 1 year before this accident, CCI had struck a telephone cable and was cited and fined by the Minnesota Office of Pipeline Safety. According to NSP, while Seren contractors had been installing telecommunications in the St. Cloud geographic area, they had damaged underground natural gas facilities in 15 locations (including the accident location) over a 4-month period. In about half of the incidents listed, damage was attributed to improper locating. Seren subcontractors other than CCI had also damaged NSP natural gas pipelines. On December 2, 1998, a Seren contractor damaged a gas main. The St. Cloud Fire Department responded and NSP had to bypass the leak to avoid disrupting service to about 100 customers. Other Information Events Following the Accident After the accident, the Minnesota Occupational Safety and Health Administration (MNOSHA) cited CCI for not having a written plan to avoid damage to the underground gas lines in and near the construction area and for not having a complete workplace accident and injury reduction (AWAIR) program. The CCI program did not list methods to identify, analyze, and control existing hazards. MNOSHA also cited Sirti and Seren for not having a complete AWAIR program. Following the accident, Seren replaced CCI as a contractor for the project. The new contractor was removed after it too was involved in damaging underground facilities. To prevent further incidents, the companies involved and local authorities jointly decided that all future Seren contractors would be required to undergo training with NSP. Additionally, NSP would have a safety inspector at each site when anchors were being installed. As part of its postaccident activities, the St. Cloud Fire Department developed, in conjunction with NSP, standard operating guidelines for responding to natural gas emergencies. The guidelines state that gas can migrate underground into buildings, that gas monitors should be used both outside and inside buildings to check for the

Factual Information 19 Pipeline Accident Report concentration of gas, that ignition sources should be eliminated and buildings ventilated, and that people in the vicinity should be evacuated to a safe area. The department has also revised its standard operating procedures to direct that firefighters (1) not rely exclusively on gas monitors to detect gas concentrations, (2) eliminate possible sources of ignition until the leak is stopped, (3) evacuate people and maintain site security, and (4) detect possible underground migration by checking buildings, manholes, and confined spaces in the affected area. The procedures note that “it can take several hours for the Gas Company to shut off gas in a large high-pressure pipeline.” In a June 5, 2000, letter to the Safety Board, the St. Cloud Fire Department outlined steps it had taken to ensure the proper calibration of its gas monitors and noted that NSP had provided the department with three gas monitors that NSP calibrates and maintains. Since the accident, the city of St. Cloud has adopted a right-of-way management ordinance and hired a specialist to manage the ordinance. The ordinance requires people working in an area designated as having critical facilities (high-risk areas) to submit a gas safety plan with all their permit applications. The ordinance imposes certain requirements for work in these areas depending on the nature of the work and the risks involved. The city, in conjunction with industry representatives, has mapped all the critical facility areas. After the accident, CCI established a new safety and health program patterned after the Minnesota State AWAIR program. The company hired a full-time safety manager. CCI had all company project managers attend a 10-hour construction awareness class. CCI also reported to the Safety Board that it has enhanced its employee training. CCI now has procedures in place that require 911 to be called immediately in the event a gas line is ruptured. Effective August 1, 1999, the State of Minnesota revised Minnesota Statute 216D to require any excavator who breaches a pipeline containing hazardous gas or liquid to immediately notify 911. The law states, in part: If any damage occurs to an underground facility or its protective covering, the excavator shall notify the operator promptly. When the operator receives a damage notice, the operator shall promptly dispatch personnel to the damage area to investigate. If the damage results in the escape of any flammable, toxic, or corrosive gas or liquid or endangers life, health, or property, the excavator responsible shall immediately notify the operator and the 911 public safety answering point...and take immediate action to protect the public and property. The director of the Minnesota Division of Emergency Management told Safety Board investigators that State 911 emergency call centers had recorded no noticeable increase in calls to 911 since enactment of the law and that, in the opinion of the official, the law has ensured more timely notification of authorities after excavation damage.

20 Pipeline Accident Report Analysis The explosion in the St. Cloud accident occurred in the building housing Bellanti’s Pizza and Deli. The escaping natural gas from the damaged pipeline apparently migrated underground, through the crumbling foundation of the building, and into the basement. There, exposed to several potential sources of ignition, it exploded. Because of the delay in notifying the gas company and emergency response personnel, about 18 minutes elapsed from the time the pipeline was ruptured until the first firefighters arrived (about 21 minutes before the explosion). About 26 minutes after the rupture (about 13 minutes before the explosion), gas company personnel arrived. An NSP gas technician specialist was assessing the hazard when the explosion occurred. The major safety issues identified in this investigation are the adequacy of the safety and emergency procedures used by CCI crews when working in the vicinity of underground facilities and the adequacy of St. Cloud Fire Department procedures and training for responding to natural gas leaks. The remainder of this analysis addresses factors that were eliminated as causal or contributory to this accident, followed by a discussion of the major safety issues. Exclusions NSP marked the location of a nearby gas service line before the CCI construction crew began installing the utility pole anchor through the sidewalk next to the building housing Book-Em’s Bar and Bellanti’s Pizza. Postaccident excavations confirmed the accuracy of the paint marks that indicated the location of the natural gas line. The Safety Board concludes that the marked location of the ruptured gas line was accurate and was therefore not a factor in this accident. The CCI crew knew immediately that they had struck and ruptured a gas line when they saw dirt blowing back around the anchor and smelled gas, and they took actions consistent with procedures established by the company. The foreman promptly notified CCI management of the leak, and the crew began restricting public vehicle access to the area. Toxicological testing of blood and urine specimens revealed that alcohol or marijuana, or both, was present in some of the involved employees; however, the specimens were collected after the employees had returned to their homes for the evening, and the testing could not determine how much alcohol was ingested or when the alcohol and marijuana had been used.

Analysis 21 Pipeline Accident Report No one reported observing any actions that could be construed as indicating impairment on the part of individuals in the crew who tested positive for alcohol or marijuana while those employees were working on the morning of the accident. Moreover, the crew’s collective actions after the leak showed prompt and full compliance with CCI procedures, as well as with the instructions given to the foreman on the telephone by the project manager. The Safety Board therefore concludes that while toxicological testing performed after this accident was not useful for determining whether alcohol or drugs had any influence on the performance of the CCI crewmembers while they were installing the anchor, the crewmembers’ actions before and after the rupture indicate that they were likely not impaired by alcohol or drugs at the time of the accident. The Accident Installation of the anchor was begun some 38 inches from the marked location of the underground gas line. This distance was 14 inches beyond the 2-foot margin provided for in CCI procedures and Minnesota State law to allow for a possible error in the marking of the location of the gas line. But while this 38-inch distance appeared to be adequate to ensure a safe installation, the length of the anchor was about 66 inches. At this length, the anchor could easily span the distance from the entry point to the pipeline if it were installed at an angle rather than vertically. The CCI crew stated that they intended to install the anchor vertically, and no evidence was found to indicate that the anchor did not enter the ground vertically. But when the anchor struck the buried granite slab, the crewmembers followed their customary practice and struck the top of the anchor with a hammer until they perceived that the anchor had broken through the obstacle or had deflected off to its side. As the investigation later determined, the anchor had not broken through but had bent and deflected. The anchor apparently continued to bend as the four men applied pressure to the anchor cranker in their attempt to complete the installation. The investigation determined and postaccident excavation revealed that the anchor bent and followed along the upper surface of the buried granite slab until the cutting helix on the anchor tip dropped off the end of the slab, thus striking and rupturing the pipeline. CCI procedures for protecting underground utilities did not address the risks associated with abnormal conditions underground that could render normal precautions inadequate. The Safety Board found no evidence that anchor installation crews were made aware that even if installation is begun at a safe distance from a buried utility, safety can be compromised if the anchor is allowed to assume an angled path underground. Such a deflection could endanger an underground utility and present a risk to the public. The Safety Board concludes that CCI’s anchor installation procedures were inadequate in that they did not address steps to take under unusual circumstances (such as striking a significant underground obstacle) to ensure that buried utilities were protected during the entire installation process, including the underground portion.

Analysis 22 Pipeline Accident Report In its investigation of a July 21, 1997, accident in Indianapolis, Indiana,13 the Safety Board found that adequate controls were not in place to prevent an underground pipeline from being damaged during directional drilling, even though indications above ground were that an adequate safety margin was being observed. In the view of the Safety Board, excavation procedures are inadequate if they do not account for the possibility that unusual conditions could negate otherwise effective attempts to protect buried utilities. The Safety Board therefore believes that the Associated General Contractors of America, the National Utility Contractors Association, the Power and Communications Contractors Association, the National Cable Television Association, and the American Public Works Association should advise their memberships to review and revise their anchor installation procedures as necessary to ensure that safety margins around buried utilities are absolutely observed not only above ground but throughout the installation process. Contractor Response Within 1 minute of striking the gas line, the CCI crew foreman, following the procedures his company had established for such an emergency, informed his supervisor of the incident. But the supervisor did not immediately notify emergency response agencies. Instead, he called the Sirti safety coordinator, telling him that he did not know whom to call. The safety coordinator told him to call NSP and let NSP employees notify emergency response agencies. The Sirti safety coordinator then departed for the scene. Along the way, he called Seren management to inform them of the leak. By this time, then, several operational and management levels of the involved companies knew of the leak, yet no one had notified emergency response agencies. In fact, about 15 minutes elapsed before another individual, not associated with the construction project, notified emergency responders. The CCI supervisor did eventually call the owner of the gas line but not until about 30 minutes after the line was struck. By this time, two NSP employees were already on the scene, the company having been notified by the fire department dispatcher. Had either the crew foreman or his supervisor immediately called 911, responders could have been on the scene within minutes. For example, a fire department vehicle and four firefighters were on the scene within about 2 minutes of being notified, but because of the delayed notification, they arrived some 18 minutes after the rupture and about 21 minutes before the explosion. Once on scene, the gas technician specialist determined by meter reading that the gas concentration in Book-Em’s Bar, at 7 percent of LEL, was some 93 percent below the minimum concentration necessary for an explosion to occur. Because of the proximity of the leak to the bar, this level could have been the result of gas entry through the door of the building. According to witness statements, the gas technician specialist left the bar to find 13 National Transportation Safety Board. 1999. Excavation Damage to 20-inch-diameter Buried Steel Transmission Pipeline, Indianapolis, Indiana, July 21, 1997. Pipeline Accident Brief. Washington, D.C.

Analysis 23 Pipeline Accident Report the entrance to the basement of the building next door. Before he arrived there, however, the explosion occurred, and he was killed. With an earlier start to evaluating the risk of the situation, the gas technician specialist may have been able to determine that gas was, in fact, accumulating in the basement of the Bellanti’s building. The gas company and emergency responders may then have decided to evacuate everyone from nearby buildings and out of the area. Additional steps may have been taken to eliminate ignition sources and ventilate the basement. In such an event, the explosion may have been prevented or, at a minimum, some of the people at risk could have been removed from the area. The Safety Board concludes that had the crew foreman or his supervisor called 911 or the utility owner immediately after the rupture, emergency responders and NSP personnel may have had time to fully assess the risk and to take actions that could have helped either to prevent the explosion or to avoid the resulting loss of life. In 1997, the Safety Board published a safety study that discussed industry and government actions to prevent excavation damage.14 The study formalized recommendations aimed at further advancing improvements in excavation damage prevention programs. One area given prominence was emergency procedures applicable when a utility is damaged during excavation. The safety study noted that while Federal regulations require pipeline operators to establish written emergency procedures, the regulations do not apply to excavators, even though “these are the very people that often have responsibility for first response at an excavation disaster.” The study concluded that, at a minimum, “excavators should formulate an emergency response plan appropriate for the specific construction site and ensure that employees working at that site know the correct action to take if a buried facility is damaged.” The Safety Board therefore made the following safety recommendation to the American Public Works Association (APWA): P-97-30 Develop guidelines and materials that address initial emergency actions by excavators when buried facilities are damaged and then distribute this information to all one-call notification centers. The APWA responded on January 26, 1998, stating that the organization would like to meet with the Safety Board to discuss the APWA’s ability to implement the safety recommendations in the package that contained P-97-30. The Board replied on March 12, 1998, placing the recommendations in an “Open—Await Response” status pending the outcome of a meeting. A meeting was held on March 12, 1998, and the APWA agreed to look at the package of recommendations and advise the Board regarding which of the actions the APWA could accomplish. The APWA failed to respond further, and the Safety Board, in a June 7, 2000, letter, asked the APWA to provide information about its efforts to implement the safety recommendations. Safety Recommendation P-97-30 remains classified “Open—Await Response.” 14 National Transportation Safety Board. 1997. Protecting Public Safety Through Excavation Damage Prevention. Safety Study NTSB/SS-97/01. Washington, DC.

Analysis 24 Pipeline Accident Report The safety study also referenced Safety Recommendation P-95-25, issued to the APWA as a result of the Safety Board’s investigation of a 1993 accident in St. Paul, Minnesota: P-95-25 Urge your members to call 911 immediately, in addition to calling the gas company, if a natural gas line has been severed. Safety Recommendation P-95-25 has been classified “Closed—Acceptable Action” based on the fact that the APWA revised its Public Works Practices Manual to include a chapter on utility coordination that addresses this recommendation. Common Ground: The Study of One–Call Systems and Damage Prevention,15 published in August 1999, provides guidance for saving valuable time in emergency notification should a natural gas line be damaged during excavation. The “best practice” regarding contact names and numbers states that The excavator’s designated competent person at each job site has access to the names and phone numbers of all facility owner/operator contacts and the one-call center. In the St. Cloud accident, no one at the site had contact names and numbers. Not even the CCI site project manager had such a list; he told the Sirti safety coordinator that he did not know whom to call to report the leak. The “best practice” statement for notification of emergency personnel is as follows: If the protective coating of an electrical line is penetrated or gases or liquids are escaping from a broken line which endangers life, health or property, the excavator immediately contacts local emergency personnel or calls ‘911’ to report the damage location. The National Utility Locating Contractors Association (NULCA) has developed guidelines for excavation practices and procedures for damage prevention. The NULCA guidelines, which were revised in September 1997, include a suggested procedure whereby excavators call 911 if excavation damage “involves a potential risk to life, health or significant property damage.” Both the Common Ground best practice and the NULCA guidelines suggest that a call to 911 be made only after an excavator determines that excavation damage has occurred that presents a hazard. Minnesota State law, on the other hand, requires that 15 The Common Ground report was prepared by more than 160 individuals representing a wide range of interests, organizations, and viewpoints on preventing damage to underground facilities. The project was initiated by the DOT’s Office of Pipeline Safety, an element of the Research and Special Programs Administration, in response to the Transportation Equity Act for the 21st Century, Public Law 105-78, signed into law June 9, 1998. The purpose of the year-long study was to identify and validate existing best practices performed in connection with preventing damage to underground facilities.

Analysis 25 Pipeline Accident Report contractors notify 911 in the event of damage to buried utilities if the damage results in the escape of any flammable, toxic, or corrosive gas or liquid or endangers life, health, or property. The wording of the Minnesota law relieves excavators of the responsibility of determining whether damage represents a hazard before they call 911 and the utility owner. The Safety Board prefers this approach to that of the Common Ground best practice or the NULCA guidelines. In the view of the Safety Board, the utility owner and 911 or other appropriate emergency notification number should be called any time a hazardous substance is released from a pipeline through construction damage, regardless of whether those on the scene perceive an immediate danger to public safety. Excavators are not all knowledgeable about what constitutes a hazardous situation. For example, they may not be familiar with the hazards of gas migrating underground, or they may not realize that a pulled pipeline could be broken in more than one place. Emergency responders can usually arrive at the scene quickly and are often trained and equipped to assess such hazards and take appropriate safety measures. Strengthened requirements to notify utility owners immediately in the event of any damage to a pipeline can also increase safety. The sooner the experts from the operator are notified, the sooner they can apply their knowledge to reduce the public safety risks. Whereas some contractors may previously have waited until the end of the day to report damage to pipelines that did not appear to present an obvious threat, requiring immediate notification of operators could possibly help them prevent a minor problem from developing into a major hazard. Some damage may not result in an immediate leak but may represent a hazard in the future. The pipeline operator can determine if corrective measures are needed to prevent a future failure. If an immediate pipeline leak does occur, the utility owner is in the best position to be aware of the hazards associated with the product in its pipelines and the appropriate safety countermeasures, and to be able to shorten the time until a leak can be stopped. Additionally, in the Safety Board’s view, strengthening the notification requirement will increase awareness on the part of contractors and other excavators of the importance of taking care not to damage utilities, and a reduction in the number of such incidents may be expected. To help ensure that this issue is addressed on a nationwide basis, the Safety Board believes that the Occupational Safety and Health Administration (OSHA) at the Federal level should require excavators to notify the pipeline operator immediately if their work damages a pipeline and to call 911 or other local emergency response number immediately if the damage results in a release of natural gas or other hazardous substance or potentially endangers life, health, or property. In the meantime, until OSHA can act on this recommendation, the Safety Board believes that the Path Forward initiative (discussed below in the “Excavation Damage Prevention” section) should promote the immediate notification of the utility owner and emergency agencies whenever excavation damage to a utility results in a release of natural gas or other hazardous substance or otherwise presents a threat to public safety. Because

Analysis 26 Pipeline Accident Report the DOT’s Research and Special Programs Administration (RSPA) was instrumental in the creation of the Path Forward initiative, that agency should, through the mechanism of Path Forward initiative, take the lead in promulgating an industry “best practice” that advises excavators to notify the pipeline operator immediately if their work damages a pipeline and to call 911 or other local emergency response number immediately if the damage results in a release of natural gas or other hazardous substance or potentially endangers life, health, or property. To further raise awareness of the early notification issue, the Safety Board believes the Association of General Contractors, the National Utility Contractors Association, the Power and Communications Contractors Association, and the National Cable Television Association should publicize the circumstances of this accident to their memberships to make them aware of the dangers of damage to an underground utility and the need to immediately call 911 or other appropriate local emergency response number when a natural gas leak or other hazardous condition occurs and to immediately notify utility companies when an underground facility has been damaged. Fire Department Response An engine company with a lieutenant and three firefighters arrived within minutes of fire department notification. Firefighters attempted to take gas concentration readings with a gas monitor, but the monitor had not been calibrated in fresh air and gave invalid or unreliable readings. Firefighters continued to attempt readings with the improperly calibrated instrument, all the while working in an environment in which they described the gas smell as “pretty bad.” At no point did firefighters check buildings near the leak site to determine if natural gas was accumulating or to help assess the need for a possible evacuation, even though the gas line was continuing to release gas that could migrate through the ground and into nearby buildings, where it could present a danger of explosion. Two of the firefighters near the leak site returned to their truck as soon as two gas company employees arrived. It should have been obvious to the firefighters that a threat continued to exist and that the situation could worsen. The Safety Board therefore concludes that firefighters of the St. Cloud Fire Department responded quickly to the scene of the leak; however, once on the scene, the firefighters’ actions did not fully address the risk to people and property posed by the leak or reduce the consequences of a possible fire or explosion. As part of its postaccident activities, the St. Cloud Fire Department developed guidelines for natural gas emergency response that address the issues identified in this accident. According to fire department officials, revisions to procedures have been developed that should help prevent a similar accident in the future in the St. Cloud Fire Department’s response area. In the view of the Safety Board, all first responders should be prepared to respond effectively to a gas leak hazard.

Analysis 27 Pipeline Accident Report Timely, effective response to a natural gas emergency can save lives. In an October 30, 1998, accident in Chicago, Illinois, excavation work damaged a 24-inch- diameter natural gas main.16 The natural gas ignited about 40 minutes later, causing major fire and heat damage to a nearby 15-story high-rise apartment building. Responding fire and police personnel completely evacuated the high-rise building before the gas ignited, with the result that no one was injured in the accident. The Safety Board believes that the International Association of Fire Chiefs should publicize the circumstances of the St. Cloud, Minnesota, accident to their membership to make them aware of the potential dangers of gas migrating into buildings from damaged underground gas lines. The Safety Board further believes that the association should advise its membership of the need to determine the hazards posed by natural gas leaks and the value of having an evacuation plan in place to be used when the situation warrants. Excavation Damage Prevention The Safety Board has long been concerned about the numbers of accidents attributable to excavation damage. In May 1997, the Safety Board added excavation damage prevention to its “Most Wanted” list of safety improvements.17 Data maintained by RSPA indicate that damage from outside force is the leading cause of leaks and ruptures to pipeline systems, accounting for more than 40 percent of reported failures. Investigation of the St. Cloud accident alone revealed a high incidence of excavation damage to utilities, by different contractors, both before and after the accident. A 1994 workshop sponsored jointly by the Safety Board and RSPA brought together about 400 people representing pipeline operators, excavators, trade associations, and local, State, and Federal government agencies to identify and recommend ways to improve prevention programs. The Safety Board’s 1997 safety study was initiated to analyze the findings of the 1994 workshop, to discuss industry and government actions undertaken since the workshop, and to make recommendations to further reduce excavation damage accidents. The safety study addressed employee qualifications and training, which has been an issue in a number of excavation-caused pipeline accidents. To address training and qualifications of those not covered by Federal regulations, the Safety Board, on January 6, 1998, issued the following safety recommendation to the APWA: 16 Illinois Commerce Commission, September 1999, Report of the ICC Staff: Incident at 1507 North Claybourn Avenue, Chicago, Illinois, October 30, 1998. 17 In October 1990, the Safety Board developed the “Most Wanted” list, drawn up from previously issued safety recommendations, to bring special emphasis to the safety issues the Board deems most critical. The Most Wanted list is updated as needed.

Analysis 28 Pipeline Accident Report P-97-29 Review existing training programs and materials related to excavation damage prevention and develop guidelines and materials for distribution to one-call notification centers. This recommendation has the same history as Safety Recommendation P-97-30, discussed earlier, and is classified “Open—Await Response.” The safety study noted the progress that had been made since 1994 by RSPA and the industry in the area of improving excavation damage prevention programs. But the study concluded that despite improvements in State excavation damage prevention programs, additional efforts were needed to uniformly develop and implement programs that are most effective. On January 6, 1998, the Safety Board therefore addressed Safety Recommendation P-97-15 to RSPA and P-97-25 to APWA asking that the two organizations work in conjunction to: P-97-15 and -25 Initiate and periodically conduct...detailed and comprehensive reviews and evaluations of existing State excavation damage prevention programs and recommend changes and improvements, where warranted, such as full participation, administrative enforcement of the program, pre-marking requirements, and training requirements for all personnel involved in excavation activity. Based on an October 30, 1998, RSPA response to Safety Recommendation P-97-15 and on a meeting of representatives from RSPA and the Safety Board to discuss ongoing actions to address the intent of the recommendation, Safety Recommendation P-97-15 was classified “Open—Acceptable Response” on June 29, 1999. In an April 24, 2000, letter to the Safety Board, RSPA responded in general terms to 29 Safety Board recommendations, including P-97-15. The letter outlined the agency’s efforts to create a “self-sustaining private sector non-profit organization” that would “provide an effective forum for information sharing among all stakeholders in damage prevention.” These efforts, known as the “Damage Prevention: Path Forward” initiative,18 are intended to continue the efforts begun with the Common Ground study and to address the issues involved in preventing outside force damage to the underground infrastructure. Working committees having been established to direct the formal establishment of the Path Forward program. The Safety Board is encouraged by the promise of the Path Forward program and will follow the development of the program with interest. The classification for P-97-15 will remain “Open—Acceptable Response” pending further action by RSPA. The Board is also disappointed by the lack of response from the APWA to Safety Recommendation P-97-25. That recommendation has followed the same history as Safety 18 A new nonprofit organization, the Common Ground Alliance, is being formed to continue the Path Forward initiative.

Analysis 29 Pipeline Accident Report Recommendations P-97-29 and -30, discussed earlier, and remains classified “Open— Await Response.” Excess Flow Valves Excess flow valves (EFVs) are available that respond to an excessive flow of gas by automatically closing and restricting the gas flow. EFVs therefore can greatly reduce the consequences of service line ruptures. The Safety Board initially advocated using EFVs on service lines to schools and other buildings in which large numbers of people gather. Later, because EFVs became cheaper and more available, the Safety Board began advocating the installation of EFVs on new or renewed residential service lines. During the 1980s, RSPA, which has oversight responsibilities over the pipeline industry, failed to require EFVs. Consequently, the Safety Board included the use of EFVs on its 1990 list of Most Wanted safety improvements. On September 26, 1990, as a result of its investigation of five natural gas accidents in the Kansas City-Topeka area, the Safety Board recommended that RSPA: P-90-12 Require the installation of excess flow valves on new and renewed single-family, residential high pressure service lines which have operating conditions compatible with the rated performance parameters of at least one model of commercially available excess flow valve. On April 4, 1995, RSPA notified Congress by letter that it had decided not to require universal installation of EFVs and instead would issue performance standards and customer-notification requirements for EFVs. In a September 28, 1995, letter to RSPA, the Safety Board expressed its disappointment with this decision. The Board noted the continued strong evidence that a way was needed to quickly restrict the flow of gas to a failed pipe segment. On September 28, 1995, as a result of RSPA’s failure to issue EFV requirements, the Safety Board classified Safety Recommendation P-90-12 “Closed— Unacceptable Action.” On March 6, 1996, as a result of its investigation of a June 9, 1994, natural gas explosion in Allentown, Pennsylvania, the Safety Board wrote to the governors of all 50 States and to the mayor of the District of Columbia asking that they require gas distribution operators to install EFVs in all new or replaced gas service lines when operating conditions are compatible with commercially available valves (Safety Recommendation P-96-3). Of the States that replied, most advised that they intended to follow the lead of RSPA and had no plans to require the installation of EFVs. The State of Minnesota did not respond to Safety Recommendation P-96-3.

Analysis 30 Pipeline Accident Report Also on March 6, 1996, the Safety Board recommended that RSPA: P-96-2 Require gas distribution operators to notify all customers of the availability of excess flow valves; any customer to be served by a new or renewed service line with operating parameters that are compatible with any commercially available excess flow valve should be notified; an operator should not refuse to notify a customer because of the customer’s classification or the diameter or operating pressure of the service line. On February 3, 1998, RSPA issued its final rule regarding EFVs. The rule requires gas distribution operators either to install EFVs on new or replaced single-residence service lines expected to operate continuously at not less than 10 psig or to inform customers of the availability and benefits of EFVs and install them if the customer agrees to pay for their installation and maintenance. On October 6, 1998, the Safety Board classified this recommendation “Closed— Unacceptable Action,” in part because the RSPA rule limits required notifications by gas operators to residential customers. As in the case in the St. Cloud accident, many commercial service lines have operating characteristics compatible with the same EFVs that will be installed in residential service lines. According to an American Gas Association survey, since the issuance of the RSPA final rule on EFVs, approximately one-half of the operators of gas distribution systems have elected to install EFVs, and one-half have developed procedures to inform customers of their availability. NSP’s current policy, put in place after the St. Cloud accident, is to install EFVs on all new or replaced service lines that fit the operating requirements of its approved EFVs, regardless of whether the customer is residential or commercial. Because no further action can reasonably be expected to be taken either by RSPA or the States, the Safety Board, on May 3, 2000, removed the recommendations regarding EFVs from its Most Wanted list. In a July 5, 2000, letter to the Governor of Minnesota, the Safety Board asked for information about Minnesota’s intentions with respect to Safety Recommendation P-96-3. Until Minnesota responds to the Safety Board’s latest request for information, Safety Recommendation P-96-3 to the State of Minnesota will be classified “Open—Unacceptable Action.” When NSP converted the gas service line from low pressure to high pressure, the line itself was not replaced; therefore, the most recent Safety Board recommendations regarding EFVs would not have applied to this service line. Nonetheless, the Safety Board is convinced of the usefulness of EFVs in preventing pipeline accidents and concludes that had the gas line in this accident been equipped with an EFV, the valve may have closed after the pipeline ruptured and the explosion may not have occurred.

31 Pipeline Accident Report Findings Conclusions

1. The marked location of the ruptured gas line was accurate and was therefore not a

factor in this accident.

1. While the toxicological testing performed after this accident was not useful for

determining whether alcohol or drugs had any influence on the performance of the Cable Constructors, Inc., crewmembers while they were installing the anchor, the crewmembers’ actions before and after the rupture indicate that they were likely not impaired by alcohol or drugs at the time of the accident.

1. Cable Constructors, Inc.’s anchor installation procedures were inadequate in that they

did not address steps to take under unusual circumstances (such as striking a significant underground obstacle) to ensure that buried utilities were protected during the entire installation process, including the underground portion.

1. Had the crew foreman or his supervisor called 911 or the utility owner immediately

after the rupture, emergency responders and Northern States Power personnel may have had time to fully assess the risk and to take actions that could have helped either to prevent the explosion or to avoid the resulting loss of life.

1. Firefighters of the St. Cloud Fire Department responded quickly to the scene of the

leak; however, once on the scene, the firefighters’ actions did not fully address the risk to people and property posed by the leak or reduce the consequences of a possible fire or explosion.

1. Had the gas line in this accident been equipped with an excess flow valve, the valve

may have closed after the pipeline ruptured and the explosion may not have occurred. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the lack of adequate procedures by Cable Constructors, Inc., to prevent damage to nearby utilities when its anchor installation crews encountered unusual conditions such as striking an underground obstacle. Contributing to the severity of the accident was the delay by Cable Constructors, Inc., in notifying the proper authorities.

32 Pipeline Accident Report Recommendations New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Through the mechanism of the Path Forward initiative, take the lead in promulgating an industry “best practice” that advises excavators to notify the pipeline operator immediately if their work damages a pipeline and to call 911 or other local emergency response number immediately if the damage results in a release of natural gas or other hazardous substance or potentially endangers life, health, or property. (P-00-1) To the Occupational Safety and Health Administration: Require excavators to notify the pipeline operator immediately if their work damages a pipeline and to call 911 or other local emergency response number immediately if the damage results in a release of natural gas or other hazardous substance or potentially endangers life, health, or property. (P-00-2) To the Associated General Contractors of America: (P-00-3 and -4) To the National Utility Contractors Association: (P-00-5 and -6) To the Power and Communications Contractors Association: (P-00-7 and -8) To the American Public Works Association: (P-00-9 and -10) To the National Cable Television Association: (P-00-11 and -12) Inform your membership of the circumstances surrounding the December 11, 1998, accident in St. Cloud, Minnesota, to make them aware of the dangers of damage to an underground utility and the need to immediately call 911 or other appropriate local emergency response number when a natural gas leak or other hazardous condition occurs and to immediately notify utility companies when an underground facility has been damaged.

Recommendations 33 Pipeline Accident Report Advise your membership to review and revise their anchor installation procedures as necessary to ensure that safety margins around buried utilities are absolutely observed not only above ground but throughout the installation process. To the International Association of Fire Chiefs: Inform your membership of the circumstances surrounding the December 11, 1998, accident in St. Cloud, Minnesota, to make them aware of the potential dangers of gas migrating into buildings from damaged underground gas lines. Advise your membership of the need to determine the hazards posed by natural gas leaks and the value of having an evacuation plan in place to be used when the situation warrants. (P-00-13) Previously Issued Recommendations Classified in this Report The following previously issued safety recommendations are classified in this report: To the Research and Special Programs Administration: Initiate and periodically conduct, in conjunction with the American Public Works Association, detailed and comprehensive reviews and evaluations of existing State excavation damage prevention programs and recommend changes and improvements, where warranted, such as full participation, administrative enforcement of the program, pre-marking requirements, and training requirements for all personnel involved in excavation activity. (P-97-15) Safety Recommendation P-97-15 (previously classified “Open—Acceptable Response”) is again classified “Open—Acceptable Response” in the “Excavation Damage Prevention” section of this report. To the State of Minnesota: Require gas distribution operators to install excess flow valves in all new or renewed gas service lines, when operating conditions are compatible with commercially available valves, including service lines supplying schools, churches, and other places of public assembly. (P-96-3) Safety Recommendation P-96-3 (previously classified “Open—Await Response”) is classified “Open—Unacceptable Action” in the “Excess Flow Valves” section of this report.

Recommendations 34 Pipeline Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member CAROL J. CARMODY Member Adopted: July 11, 2000

FD07209 ｜ 1998_美国_NTSB_PAR0101_Natural_Gas_Explosion_and_Fire.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 PIPELINE ACCIDENT REPORT PB2001-916501 NTSB/PAR-01/01 NATURAL GAS EXPLOSION AND FIRE IN SOUTH RIDING, VIRGINIA JULY 7, 1998 7366

this page intentionally left blank

PIPELINE ACCIDENT REPORT NTSB/PAR-01/01 (PB2001-916501)

PIPELINE ACCIDENT REPORT: NATURAL GAS EXPLOSION AND FIRE SOUTH RIDING, VIRGINIA JULY 7, 1998

• Page 17, the 3rd sentence of the second paragraph has been corrected to read

“Evidence indicates that in this accident, the corrosion that occurred on and/or within one side of the splice connection increased the contact resistance between the cable end and the crimp connector.”

The original sentence used the word “reduced”.

THESE CORRECTIONS ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT:

this page intentionally left blank

Pipeline Accident Report Natural Gas Explosion and Fire in South Riding, Virginia July 7, 1998 NTSB/PAR-01/01 PB2001-916501 National Transportation Safety Board Notation 7366 490 L’Enfant Plaza, S.W. Adopted June 12, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Natural Gas Explosion and Fire in South Riding, Virginia, July 7, 1998. Pipeline Accident Report NTSB/PAR-01/01. Washington, DC. Abstract: About 12:25 a.m. on July 7, 1998, a natural gas explosion and fire destroyed a newly constructed residence in the South Riding community in Loudoun County, Virginia. A family consisting of a husband and wife and their two children were spending their first night in their new home at the time of the explosion. As a result of the accident, the wife was killed, the husband was seriously injured, and the two children received minor injuries. Five other homes and two vehicles were damaged. The safety issues identified during this investigation were (1) the adequacy of standards for minimum separation distances between gas service lines and electrical service lines and (2) the lack of a requirement for the installation of excess flow valves. As a result of this investigation, the Safety Board made two recommendations to the Research and Special Programs Administration (RSPA) and one recommendation each to the Edison Electric Institute, the National Rural Electric Cooperative Association, the American Power Association, and the U.S. Department of Agriculture’s Rural Utilities Service. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916501 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Pipeline Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Residence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Postaccident Inspection and Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Testing and Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Soil Sampling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 NOVEC Accident Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Pipeline and Electric Company Utility Separation Policies . . . . . . . . . . . . . . . . . . . . . . . . . 10 Regulatory Standards and Guidance Regarding Facility Separation . . . . . . . . . . . . . . . . . . 10 Gas Pipeline Separation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Electrical Facility Installation Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Pipeline Accidents Involving Electric Line Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Electrical Service Line Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Soil Permeation With Gas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Adequacy of Standards for Minimum Utility Separation Distances . . . . . . . . . . . . . . . . . . 19 Excess Flow Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

iv Pipeline Accident Report Executive Summary About 12:25 a.m. on July 7, 1998, a natural gas explosion and fire destroyed a newly constructed residence in the South Riding community in Loudoun County, Virginia. A family consisting of a husband and wife and their two children were spending their first night in their new home at the time of the explosion. As a result of the accident, the wife was killed, the husband was seriously injured, and the two children received minor injuries. Five other homes and two vehicles were damaged. The National Transportation Safety Board determines that the probable cause of the accident in South Riding, Virginia, was the corrosion and subsequent overheating and arcing at a splice in one of the conductors of the triplex electrical service line, which, because of inadequate separation between the electrical conductors and the gas service line, led to the failure of the gas service line and the subsequent uncontrolled release of natural gas that accumulated in the basement and was subsequently ignited. Precipitating the electrical service line failure was damage done to the electrical service line during installation of the gas service line and/or during subsequent excavation of the electrical line. The safety issues identified during this investigation were (1) the adequacy of standards for minimum separation distances between gas service lines and electrical service lines and (2) the lack of a requirement for the installation of excess flow valves. As a result of this investigation, the Safety Board issues two recommendations to the Research and Special Programs Administration (RSPA) and one recommendation each to the Edison Electric Institute, the National Rural Electric Cooperative Association, the American Power Association, and the U.S. Department of Agriculture’s Rural Utilities Service.

1 Pipeline Accident Report Factual Information Accident Synopsis About 12:25 a.m. on July 7, 1998, a natural gas explosion and fire destroyed a newly constructed residence in the South Riding community in Loudoun County, Virginia. A family consisting of a husband and wife and their two children were spending their first night in their new home at the time of the explosion. As a result of the accident, the wife was killed, the husband was seriously injured, and the two children received minor injuries. Five other homes and two vehicles were damaged. The Accident At the time of the accident, South Riding, Virginia, was a growing planned community in Loudoun County, Virginia, near Washington, D.C., and new homes were in various stages of construction. On April 22, 1998, a Northern Virginia Electric Cooperative (NOVEC) crew dug a trench and installed electrical service to a new home on Rickmansworth Lane, the home that would later be involved in the accident. Underground three-wire electrical service triplex1 had previously been “stubbed in,” that is, installed (buried in a trench) to within a short distance of the home site so that the service line to the house could be spliced onto it when the structure was ready for electrical service. The NOVEC crew spliced onto this stubbed-in triplex an additional 23-foot section of triplex that they then attached to the house’s electric meter. (See figure 1.) During the first week in May, a Washington Gas Light Company contractor, Northern Pipeline Company, installed a 3/4-inch-diameter polyethylene gas service line in a trench to the house. The one-call system was used before the excavation, and the location of the electrical lines had been marked. The contractor foreman said that during excavation for the gas service line, a portion of the electric service line to the house was exposed. He stated that he understood that gas pipelines needed to be separated at least 12 inches from electrical service lines, so at the point where the electrical line had been exposed, he moved the gas service line to maintain 12 inches of horizontal separation. Bluestone rock dust was used as a backfill material around the gas pipelines and electric service installed in trenches and buried within the South Riding neighborhood to protect the utilities from damage from rocks and other materials in the local soil. Native soil was then placed atop the imported backfill to bring the surface back to its original grade. 1 The electrical service triplex consisted of three twined cables: two 4/0 American Wire Gauge (AWG) current-carrying conductors (each approximately 5/8 inch in diameter) and one 2/0 AWG neutral. All three cables were constructed of compressed, 19-strand aluminum wire covered with high-density polyethylene insulation.

Factual Information 2 Pipeline Accident Report Figure 1. Accident area. The gas meter was installed on June 9, 1998, and the gas piping was inspected, pressure-tested, and approved by the Loudoun County Department of Building and Development by June 11. The gas meter reading at the time of installation was 1645.2 Washington Gas Light Company had verified the accuracy of the gas meter on January 14, 1997.3 An excess flow valve (EFV)4 was not installed in the gas service line supplying the residence. On June 15, about 6 weeks after the gas service line was installed, a contractor working inside the house found that the house was not receiving full electrical service. He 2 Gas meter readings are in hundreds of cubic feet. Meters are not reset when installed; the initial reading is used as a baseline for the subsequent monitoring of gas usage. 3 On August 12, 1998, Safety Board investigators witnessed Washington Gas Light Company representatives verifying the accuracy of the meter that had been removed from the residence after the explosion. 4 EFVs are designed to automatically close and stop the flow of natural gas through a service line if the flow exceeds a specified rate. Chorley Wood Street Rickmansworth Lane 2-inch Gas Mains 25901 25905 ¾-inch Gas Service Line Electric Service Triplex Leak Site Not to Scale N Approximate Location Where Neighbor Initially Detected Natural Gas Odor Sewer and Water

Factual Information 3 Pipeline Accident Report found a NOVEC supervisor working nearby and told him of the problem. The supervisor arranged for a NOVEC crew to go to the site when their current job was completed. Near the end of the day, according to the foreman of the NOVEC crew, the crew came to the site and exposed the electrical service line by hand-digging. He said they were unable to locate the fault before the end of their shift and, because the house was unoccupied, they left the repairs for the next day. The next morning, June 16, another NOVEC crew was sent to make the permanent repairs. The one-call system was not used, but the crew said they recalled seeing utility markings on the ground near the site of the excavation. After excavating the site with mechanized equipment, the crew located a fault near a point at which the electrical service triplex crossed underneath the gas service line. This was also the area along the triplex where, before the gas pipeline was installed, the electrical service to the residence had been spliced to the preexisting triplex stub. The crew said they observed that the gas service line crossed about 6 inches above the electrical service line. They stated that they found that one conductor of the triplex had been damaged. They said they repaired the fault by cutting out the damaged section, which included the original splice connection, and splicing in a short section of new cable. They said they also examined the gas service line to ensure that their repairs had not damaged it. After their repair, the crew stated, they maintained or increased the 6-inch separation between the electric line and the gas service line while they backfilled the area. The house was purchased on June 23, 1998. Construction of the house had just been completed, and a walk-through inspection was conducted a few days before settlement. The inspection noted no problems with any of the appliances. Shortly after settlement, the gas meter for the property was read so that the service could be transferred to the new owners. At the time of the transfer, on June 24, 1998, the gas meter reading was 1,654. After purchase, the family began moving furniture into the residence. The husband stated that they experienced no problems with any of the appliances after they took possession and that they did not move or modify the gas appliances, nor had they installed new ones. The night of July 6, 1998, was to be the first night the family was to spend together in their new home. The husband said that on the evening of July 6, the air conditioner was working and the house was cool. He also stated that he had not smelled gas. He said the family retired between 10:00 and 10:30 p.m. Because not all the furniture had arrived, the parents were sleeping in the study on the main level of the three-level house; the children were sleeping on the upper level. Shortly before the accident on July 7, a South Riding resident standing near his home at the corner of Chorley Wood Street and Rickmansworth Lane, about 150 feet from the accident house, noticed what he described as a “strong” odor of natural gas. He said that after attempting unsuccessfully to identify the source of the odor, he called Washington Gas Light Company at about 12:19 a.m. to report it. A few minutes later, the house at Rickmansworth Lane exploded and was engulfed in flames. (See figure 2.)

Factual Information 4 Pipeline Accident Report Figure 2. Postaccident debris. The children were thrown out of the house and onto the lawn, suffering minor injuries. The husband and wife fell into the basement as the first floor collapsed. The husband was able to crawl to safety, but the wife did not escape. The husband was burned severely; the wife died as a result of her injuries. The adjacent, unoccupied house was damaged by the accident and had to be demolished. Four other houses and two vehicles were also damaged. As a result of the explosion, the piping inside the house broke, and natural gas that was being metered escaped through the broken piping. Firefighters partially shut the valve to the meter upon their arrival. Natural gas continued to escape until shortly after the first Washington Gas Light Company personnel arrived at the scene shortly after 1:00 a.m. and closed the valve that stopped the flow of natural gas through the meter. At that time, the gas meter reading was 1,665. About 1:20 a.m., the fire was extinguished. The Loudoun County Fire Marshal’s Office inspected the destroyed house and concluded that the explosion resulted when natural gas from a hole in the gas service pipeline to the house entered and accumulated in the basement of the residence, where it was ignited by the pilot light on the water heater. Remains of Accident Residence Remains of Adjacent House

Factual Information 5 Pipeline Accident Report The Residence The house was a three-level detached home consisting of an unfinished walk-out concrete basement with wood frame construction above. The basement was “L” shaped: the back portion of the basement, or bottom of the “L,” was 41.7 feet long by 13.8 feet wide, and the front portion, or top of the “L,” was 22.2 by 22.3 feet. The height of the basement was 8.75 feet from the concrete slab floor to the subfloor of the main level. The calculated volume of the basement was about 9,370 cubic feet. Three gas appliances were located in the residence: a water heater, a furnace, and a gas-burning fireplace. The water heater and furnace were installed in the basement. The water heater was rated for a maximum gas load of 40,000 Btu per hour (about 39 cubic feet per hour of gas).5 A technical representative of the water heater manufacturer stated that, provided no hot water was used and assuming a basement temperature of 80° F, the water heater would operate about four times per day for a 15- to 25-minute heating cycle to maintain the preset water temperature of 120° F. Hot water use or a cool basement would increase the frequency of operation. The representative also stated that the water heater would use between 10,000 and 20,000 Btu (10 to 19 cubic feet of gas) in each heating cycle. In addition, the pilot light at the base of the water heater consumes 400 Btu (0.4 cubic feet of gas) per hour. The furnace and the fireplace may have been run occasionally during the approximate 12 1/2 days of occupancy. All other appliances in the house were electric. Around the foundation of the house was an underground external drainage system. This system, consisting of a 4-inch-diameter perforated plastic pipe surrounded by gravel, was designed to collect water and direct it away from the foundation and out to the rear of the house. Another drainage system was located under the concrete basement floor. This system, also consisting of perforated pipe surrounded by gravel, was designed to direct any water accumulating under the foundation into the sump pit6 in the floor of the basement. An automatic sump pump in the sump pit discharged the water toward the exterior of the house. “Weep holes” approximately 1 1/2 to 2 inches in diameter had been placed at intervals in the concrete footer around the perimeter of the foundation to allow water to flow between the drainage systems. Water and sewer lines passed under the foundation of the house from a point just outside the northeast wall, near the north corner of the house. Both lines entered the basement through the concrete floor. 5 British thermal unit (Btu)– The quantity of thermal energy required to raise the temperature of 1 pound of water 1 degree Fahrenheit at or near 39.2° F. One cubic foot of the natural gas supplied by Washington Gas at the time of the accident would generate approximately 1,033 Btu of heat. 6 A sump pit is an opening in the floor that is designed to accumulate water for the sump pump. The sump pit for this residence was in the east corner of the back portion of the basement.

Factual Information 6 Pipeline Accident Report Postaccident Inspection and Testing Testing and Examination As part of postaccident testing to locate the source of the accumulated natural gas, the gas pipelines were pressure-tested to 31 pounds per square inch, gauge (psig).7 The test revealed a leak in the 3/4-inch-diameter polyethylene gas service line leading to the house. The leakage flow rate was measured and calculated to be about 6,500 cubic feet per hour. Excavation of the pipeline revealed a TV cable that had been installed at a depth of about 13 inches from the surface sometime after the electrical service line and gas pipeline had been installed. The pipeline was found at a depth of about 45 inches, and just underneath the pipeline was a portion of the electrical service to the house. Examination of the gas service line revealed a roughly circular 0.38- to 0.44-inch- diameter hole in the pipeline about 7 feet from the north corner of the house. An insulated copper tracer wire ran alongside the gas service line,8 and the electrical triplex crossed beneath it. One of the three cables of the triplex was found to be in contact with the gas service line. Because the electrical line was disturbed during the postaccident excavation, the exact preaccident location of the cables in relation to the gas service line and to the hole in the gas service line could not be determined. When excavated, one of the two conductors (current-carrying cables) (designated “cable A” for identification) was found touching the gas service line about 3.75 inches away from the hole along the horizontal axis of the pipe. At this location, the other conductor (designated “cable B”)9 was underneath and touching cable A. The neutral cable was several inches away from the other two. (See figure 3.) Examination at the Safety Board laboratory revealed that the polyethylene pipe material surrounding the hole in the gas service line was blackened and appeared thinner and cratered, consistent with heat damage.10 Also, the thinned material formed a conical peak around the hole, consistent with the effect of pressure on a heated and softened pipeline wall. (See figure 4.) 7 A gas pressure of 31.5 psig for the leaking pipeline was recorded at 2:55 a.m. at the Washington Gas Chantilly Gate Station that supplied natural gas into the distribution system serving South Riding. 8 The tracer wire is designed to carry an electrical signal that can be read by above-ground equipment and is used to locate the polyethylene pipeline. The signal is only applied to the wire when the pipeline location is being determined. 9 Note for reference purposes: In the Safety Board Metallurgical Laboratory factual report that is part of the public docket for this accident (Docket DCA-98-MP-003), the conductors designated “cable A” and “cable B” in this report are referred to as “Hot Lead 1” and “Hot Lead 2,” respectively. 10 The Vicat softening temperature for the material used in gas pipelines is 247° F (119° C). (The Vicat softening temperature is intended to provide a standard for comparing the softening effects of temperature on various thermoplastic resins. It is defined in American Society for Testing Materials standard D1525 as the temperature at which a flat-ended needle of 1-mm2 circular cross section will penetrate a thermoplastic specimen to a depth of 1 mm under a specified load using a selected rate of temperature rise.) According to the manufacturer of the material used to construct the gas pipeline in this accident, the material becomes sufficiently molten to fuse with itself at 375 to 400° F (190 to 204° C).

Factual Information 7 Pipeline Accident Report Figure 3. Cables and pipeline before removal. Although the TV cable appears to lie near the pipeline in this view, it was found at a depth of about 13 inches and was thus about 32 inches above the pipeline. Figure 4. Hole discovered after accident in the 3/4-inch polyethylene natural gas pipeline leading to the residence. Neutral Cable A TV Cable Hole Hole Reflected in Mirror Gas Service Pipeline Cable B

Factual Information 8 Pipeline Accident Report The insulation on the section of tracer wire adjacent to the hole was completely missing, and the insulation on nearby portions of the tracer wire was blackened or otherwise discolored and showed evidence of melting. About 7 inches from the area of missing insulation, a 2.5-inch section of tracer wire was missing insulation along one side. The copper tracer wire in this area had separated and showed evidence of localized damage and thinning consistent with some type of electrochemical erosion or metal loss. Nicks and cuts typical of mechanical damage were also observed in the area of the damaged insulation. Laboratory examination of the triplex’s three electrical cables revealed evidence of prior repairs, corrosion, and heat and mechanical damage. As noted previously, the service triplex to the house had been spliced to the triplex stub at this location. Two of the three cables still had the original in-line aluminum compression crimp connectors installed near the damaged gas pipe. The original crimp connector in the third cable, one of the conductors (cable A), had been removed when the conductor was repaired by installing a short piece of new cable with two in-line crimp connectors. Both conductor cables were damaged and parted at or near one of the crimp connectors. Cable B was completely separated. Between the two separated ends of the cable lay a clod of dirt. Portions of the interior of the clod showed a glassy appearance consistent with exposure to high heat. One end of the parted cable was attached to what remained of a crimp connector. Almost a third of the 4-inch-long crimp connector was missing. (See figure 5.) Figure 5. Top: An aluminum crimp connector that was attached to one of the burned electrical cables found in proximity to the damaged natural gas pipeline. Bottom: An exemplar crimp connector (without its cold-shrink insulation).

Factual Information 9 Pipeline Accident Report Examination of the separated end of the connector revealed that approximately 60 percent of the surface was melted and had a glassy appearance, consistent with exposure of the connector to high temperature.11 Removal of a small area of the melted and glassy material revealed white aluminum hydroxide deposits underneath. The aluminum hydroxide deposits were also observed on the remaining 40 percent of the damaged surface and on portions of the exterior surface of the connector. Aluminum hydroxide is a corrosion product that forms on aluminum that is exposed to moisture in a low-oxygen environment. Cuts and tears of various sizes were found in the cold-shrink insulation installed over the crimp connector immediately adjacent to the separation. Examination of cable A revealed that a 1.3-inch section of the spliced-in repair cable was missing near one crimp connector. The connector still held almost 2 inches of the repair cable’s end. The damaged ends of the repair cable near the missing section appeared to be undefined masses of solidified aluminum and debris, indicating that the cable had melted and resolidified. A small portion of cable A’s insulation remained in place between the two melted ends of the aluminum cable. The interior surface of this section of insulation bore the imprint of the missing section of cable. The neutral cable was intact. The insulation that had been placed over the crimp connector after a splice showed cuts and holes. Aside from the damaged electrical conductors, no potential sources of heat were discovered in the area around the pipeline failure. Soil Sampling On the day of the accident, soil samples were collected at four locations near the destroyed residence, including one sample from beneath the concrete basement slab near the sump pit. Testing revealed methane and a smaller concentration of ethane in each of the soil samples. NOVEC Accident Report NOVEC provided the Safety Board with its own accident report, which concluded that the hole in the gas pipeline occurred after and as an indirect result of the explosion. The report concluded that the gas that had accumulated in the residence and exploded came from some unknown source inside the house, possibly “through a defect or damage to the internal gas piping system, connection fittings, or the natural gas appliances.” NOVEC also examined the meter base and the associated service cables from the destroyed residence. The company reported evidence of pitting on the cables that company representatives said they believe indicates that arcing or shorting occurred between the cables within the meter base after the explosion. 11 The melting range is 646 to 657° C (1195 to 1215° F) for the 1350 aluminum alloy used in the cable.

Factual Information 10 Pipeline Accident Report Pipeline and Electric Company Utility Separation Policies Washington Gas Light Company internal procedures required that steel transmission12 pipelines be installed at least 12 inches from other underground metallic objects. This procedure required all other steel pipelines (those not considered transmission pipelines) to be installed at least 6 inches away from other metallic objects. The company had no separation requirements for polyethylene pipelines; however, company officials stated that the company’s routine practice was to apply the requirements for steel pipelines to polyethylene pipelines. NOVEC trench specifications required various separation distances between the company’s own cables and conduits. The company did not have a written procedure requiring a specific separation between NOVEC’s buried secondary electric lines (those serving a single residence) and other underground facilities, such as gas pipelines. NOVEC’s procedures did require that the National Electrical Safety Code be followed.13 Several NOVEC personnel stated that, as a general practice, they maintained at least 6 inches of clearance between electrical lines and all other underground facilities. Regulatory Standards and Guidance Regarding Facility Separation Gas Pipeline Separation Requirements The U.S. Department of Transportation’s Research and Special Programs Administration (RSPA), through the Office of Pipeline Safety (OPS), promulgates regulations that establish minimum safety standards for the transportation of natural gas by pipeline. The regulations concerning underground clearance requirements for gas transmission lines and mains are in 49 Code of Federal Regulations (CFR) Section 192.325 and can be summarized as follows: • Each transmission line must be installed with at least 12 inches of clearance from other underground structures. If this clearance cannot be attained, then the transmission line must be further protected from damage. • Each main must be installed with sufficient clearance from other underground structures to allow for proper maintenance and to protect it from damage. 12 In simplified terms, transmission pipelines provide large volumes of product to utility companies or other distributors; smaller main lines then carry the product from the utility company or distributor to different locations within the service areas where service pipelines (such as the one involved in this accident) branch off to serve individual customers. 13 See “Electrical Facility Installation Standards” section below for more information on National Electrical Safety Code requirements. The National Electrical Safety Code is an American National Standards Institute code that was developed by the Institute of Electrical and Electronics Engineers.

Factual Information 11 Pipeline Accident Report • Each plastic transmission line or main must be installed with sufficient clearance, or must be insulated, from any source of heat so as to prevent heat damage to the pipe. These regulations are only applicable to gas transmission lines and mains. The separation requirements in 49 CFR Part 192 do not apply to residential gas service lines. For intrastate pipeline facilities within Virginia, the Virginia State Corporation Commission has adopted and enforces the OPS Federal regulations as its minimum pipeline safety standards. The commission also has the authority to adopt more stringent regulations. Section 56-257 of the Code of Virginia was amended in 1996 to specifically authorize the commission to establish minimum separation requirements, not to exceed 12 inches, between crossings of underground pipes or conduits; however, the commission had not established any such minimum. The 1996 amendment also required that utility pipes and conduits be installed “with sufficient clearance, or shall be insulated from any source of heat, so as to prevent the heat from impairing the serviceability of the pipe or conduit.” This provision applies to facilities laid in public streets and right-of-ways, not to those located on private property. The Gas Piping Technology Committee publishes the GPTC Guide for Gas Transmission and Distribution Piping Systems to provide guidance for natural gas operators to ensure regulatory compliance.14 The guide does not specifically address gas service lines but does suggest that: sufficient clearance should be maintained between mains and other underground structures to provide heat damage protection from other underground facilities such as steam or electric power lines, particularly where plastic piping is installed in common trenches with sources of heat. Electrical Facility Installation Standards No Federal agency analogous to the OPS is tasked specifically with ensuring the safety of electrical distribution systems. NOVEC, as a rural electric cooperative, falls under the purview of the U.S. Department of Agriculture’s Rural Utilities Service. The Rural Utilities Service does not conduct routine safety inspections of the facilities of participating utilities. The Rural Utilities Service does require rural cooperatives that participate in the agency’s loan program to certify that their facilities are installed in accordance with the provisions of the National Electrical Safety Code. Section 1, Paragraph 010, of the National Electrical Safety Code states that its purpose is the “practical safeguarding of persons during the installation, operation, or maintenance of electric supply and communication lines and associated equipment.” It further states in Paragraph 012.A. that “all electric supply and communication lines and equipment shall be designed, constructed, operated, and maintained to meet the requirements of these rules.” 14 The Gas Piping Technology Committee is an American National Standards Institute technical committee made up of technical specialists from both industry and government.

Factual Information 12 Pipeline Accident Report Section 35, Paragraph 352.B.4. of the National Electrical Safety Code calls for direct-buried electrical cables to be installed and maintained with adequate vertical separation when crossing other underground structures “to permit access to and maintenance of either facility without damage to the other.” This paragraph further states that “a vertical separation of 12 inches is, in general, considered adequate, but the parties involved may agree to a lesser separation.” The Safety Board was not able to identify any written or oral agreement between Washington Gas Light Company and NOVEC that governed the separation of the two companies’ lines. Electrical distribution facilities are also subject to the Virginia State Corporation Commission’s regulatory oversight. The commission had not adopted the National Electrical Safety Code or developed a comprehensive set of minimum safety standards applicable to electrical facilities. Postaccident Actions Washington Gas Light Company has revised its Operating Instructions Manual to include requirements for maintaining at least 12 inches of clearance between new polyethylene gas pipelines and existing electrical facilities. Allowances are made for lesser separation, given specific protections. The revision also requires that existing polyethylene gas pipelines be separated from electrical facilities as necessary whenever those pipelines are excavated for maintenance or other reasons. Since the accident, Washington Gas Light Company has also established a policy to voluntarily install EFVs in all new or renewed residential service lines. OPS representatives have met with various industry and governmental organizations to discuss the issue of separation between underground gas pipelines and electrical lines. These OPS representatives also notified the Safety Board staff that the OPS plans to include the issue in the “Best Practices” initiative focusing on excavation damage prevention. After the accident, several utility operators, including NOVEC and Washington Gas Light Company, formed the Utility Industry Coalition of Virginia. The coalition has developed preliminary voluntary standards that call for 12 inches of separation between utilities, unless an acceptable barrier is provided. NOVEC revised its policy to follow these voluntary standards. The Virginia General Assembly has modified Virginia law to require every utility operator in the State that is not subject to U.S. Department of Transportation oversight to install its utility lines “in accordance with accepted industry standards.” The new statute also requires that the State Corporation Commission “promulgate any rules or regulations necessary to enforce the provisions of this section as to those operators that do not comply with such accepted industry standards.” The new laws become effective July 1, 2001.

Factual Information 13 Pipeline Accident Report Pipeline Accidents Involving Electric Line Failures The Safety Board is aware of two accidents in which electric line failures reportedly generated heat that damaged polyethylene natural gas pipelines. The Georgia Public Service Commission investigated an April 9, 1998, natural gas leak and fire at the Oaks Shopping Center in Dublin, Georgia.15 Just before the accident, the gas department was excavating a leaking pipeline. During the excavation, the gas ignited and a gas department employee received first- and second-degree burns to his hands and face. The Public Service Commission found that an electric cable serving a nearby house crossed underneath the gas pipeline. The electric cable had a splice connector “which appeared to have failed and melted the 2-inch PE [polyethylene] gas main that caused the leak.” The second accident was investigated by the Illinois Commerce Commission.16 On February 3, 1999, flames coming from the ground near two gas meters spread to a multifamily residential building in Hanover Park, Illinois. The fire caused in excess of $250,000 damage to the house and its contents. There were no injuries. The Illinois Commerce Commission found that the day before the accident, a fault had been detected in one of the electric cables that ran near the pipeline. The electric cable was marked but not repaired that day; instead, electric service was restored to the affected house using “jumpers” that bypassed the fault and allowed the customer to have 120-volt electric service until the faulted cable could be repaired. Postaccident excavation of the pipeline revealed that a section of electrical cable had melted near the hole in the polyethylene gas pipeline. The Illinois Commerce Commission concluded that the electric cable was buried very close to the pipeline, and it appeared “that the heat generated by the fault in the cable melted the PE [polyethylene] service piping.” 15 Georgia Public Service Commission, Report of Natural Gas Safety Inspection No. BM98-023, City of Dublin, Georgia, April 9, 1998. 16 Illinois Commerce Commission, Incident Report, Nicor Gas Company, Elgin, Illinois, February 3, 1999.

14 Pipeline Accident Report Analysis The Accident The Loudoun County Fire Marshal’s Office inspected the destroyed house and concluded that the explosion occurred when gas leaking from the gas service line accumulated in the basement and was ignited by the pilot light on the water heater. Given the extent and physical nature of the destruction, the Safety Board agrees that the explosion occurred in the house basement and that the pilot light for the water heater, an open flame, was a likely ignition source. All parties to the investigation agreed that gas from some source had accumulated inside the house. A question remained, however, about the source of the gas, with NOVEC contending in its own report that the explosive gas accumulation resulted from a leak or defect in the gas piping inside the house. Safety Board investigators assessed the possibility that the accumulated gas that ignited resulted from a gas leak inside the house rather than from the leak in the gas service pipeline that was found after the accident. All physical evidence suggests that the gas that exploded accumulated in the basement rather than in some other part of the house. And the only known, constantly present ignition source was the water heater pilot light. Thus, for the explosion to have occurred as the evidence suggests that it did, enough natural gas would have had to accumulate inside the basement to bring the gas concentration there to at least 4.5 percent, because the flammability limits of natural gas in air are approximately 4.5 to 14.5 percent.17 Because natural gas is lighter than air, the gas entering the basement may have initially tended to accumulate near the ceiling before beginning to mix throughout the basement. The pilot light for the water heater was near the floor. The volume of the basement was calculated to be about 9,370 cubic feet.18 About 422 cubic feet of natural gas would therefore have been needed to fill the basement from the ceiling down to the level of the pilot light with a uniform concentration sufficient for ignition. According to the surviving homeowner, the air conditioner was on during the evening of the explosion and was circulating air throughout the house. This may have increased the air exchanges within the basement and thus the volume of gas needed to fill the basement to explosive levels. 17 The flammability limits refer to the range of concentrations of natural gas in air that can be ignited. The limits of this range are referred to as the lower and upper explosive limits. 18 Although investigators did not attempt to determine what furniture or other household items may have been in the basement at the time, such items would not, in the Safety Board’s view, have significantly reduced the overall volume of the basement susceptible to gas permeation.

Analysis 15 Pipeline Accident Report But 422 cubic feet of natural gas would have only brought the gas concentration to the lowest explosive limit4.5 percent. According to the National Fire Protection Association,19 “mixtures at or near the lower explosive limit (LEL) or upper explosive limit (UEL) of a gas or vapor produce less violent explosions than those near the optimum concentration.”20 The amount of damage inflicted on the residence suggests that the concentration was probably higher than the lower limit. While it is impossible to determine the exact gas concentration at the time of this accident, the violence of the explosion indicates that the accumulation of gas in the basement of the structure was likely greater than the 422 cubic feet that would have been required to produce the lowest explosive level. Gas meter readings before and after the explosion indicated that a total of 1,100 cubic feet of gas had been supplied to the house during the 12 1/2 days leading up to the explosion. During that period, the water heater was the only continuously operating gas appliance in the house. Information provided by the water heater manufacturer indicated that, with no hot water usage, the water heater would have consumed about 700 cubic feet of gas in the 12 1/2 days before the explosion.21 Because the house was occupied intermittently during this time and some hot water was used, the amount of gas consumed by the water heater was probably greater than 700 cubic feet. Subtracting the gas used by the water heater from the total 1,100 cubic feet of gas supplied to the house leaves less than 400 cubic feet of metered gas not attributable to the water heater. An unknown amount of gas escaped through the meter during the 40 minutes or more that elapsed between the time of the explosion and the time the valve to the meter was completely shut off. Also, some gas could have been used to heat water during the family’s periods of temporary occupancy in the 12 1/2 days before the accident or in testing the other gas-burning appliances as the family was taking residence. Even if the entire 400 cubic feet of gas had leaked inside the house, this would have been less than that necessary to reach even the lower explosive limit in the basement at the level of the water heater’s pilot light. And as noted above, the explosive mixture was likely greater than the lower limit. The measured gas usage thus suggests that the source of the accumulated gas lay outside the house. Furthermore, a resident more than 150 feet away from the accident residence reported smelling a “strong” odor of natural gas in the 1/2 hour before the explosion. An outdoor pipeline leak would be the most likely source of a gas odor that could be detected at that distance. Moreover, the metered amount of gas into the house would fall even 19 National Fire Protection Association. 2001. NFPA 921, Guide for Fire and Explosion Investigations, 2001 Edition, Quincy, Massachusetts, p. 133. 20 For natural gas, the optimum concentration occurs near the middle portion of the range between LEL and UEL. 21 Calculations use an average heating cycle consuming 12,000 Btu operating 4 times a day and the gas usage of the pilot light at 400 Btu per hour. This is approximately comparable to the average gas usage measured while the home was unoccupied between when the gas meter was originally installed and the gas service transferred to the new homeowners.

Analysis 16 Pipeline Accident Report further short of the amount required to create an explosive mixture in the basement if enough of it had leaked out of the house to cause an odor of gas 150 feet away. Finally, an outside source for the gas was found in the leaking gas service pipeline. Pressure testing of this line revealed a natural gas leak of about 6,500 cubic feet per hour. This leak rate was sufficient to have supplied the quantity of gas that would have been required to bring the gas concentration in the basement of the house to an explosive level. The location of the hole in the gas service lineabout 7 feet from the house foundationwould account for the reported strong smell of gas some distance away and at the same time facilitate the underground migration of gas into the house. The trench in which the gas service line was installed, which was backfilled with relatively porous material, would have provided a path to the foundation of the house along which the gas could migrate. Tests of four soil samples collected at different sites near the accident residence showed the presence of methane and a smaller concentration of ethane, indicating that natural gas had migrated and permeated the soil around and underneath the house. (See “Soil Permeation With Gas” section below for more information.) The Safety Board therefore concludes that, based on the size and location of the hole in the gas service line, the amount of gas that would have been needed to cause the accident, the presence of a strong smell of gas outside the house before the explosion, and the presence of natural gas in the soil underneath the residence, the most likely source of the natural gas that filled the residence basement and fueled the explosion was the damaged gas service line leading to the house. Electrical Service Line Damage The two damaged electrical conductors that were found crossing under the gas service line were melted and partially consumed. The damage was consistent with exposure to temperatures in excess of the melting point of aluminum, or 1,195 to 1,215° F. Because clay and rock are poor conductors of heat, the temperature in the earth environment surrounding an arcing cable will drop significantly as the distance from the arc increases. Thus, while the nearest conductor was found 3.75 inches from the hole along the horizontal axis of the gas service line, the conductors were disturbed during the excavation of the gas service line and were likely closer to the hole when they failed. The insulation on the tracer wire and the cold-shrink insulation covering the crimp connectors on both cable B and the neutral cable contained nicks, cuts, and tears. Since NOVEC installers and service technicians are not likely to have initially installed torn or defective cables or insulation, the nicks, cuts, and tears found in the cables and insulation most likely resulted from post-installation mechanical damage that occurred during excavation or backfilling. Although a television cable was installed above the electrical cables and gas pipeline, this cable was buried only to a depth of about 13 inches. Furthermore, the equipment used to install such cable is incapable of reaching a depth of 45 or more inches, which was the depth at which the pipeline and electrical cables were found at the damage location. The Safety Board therefore concludes that work performed

Analysis 17 Pipeline Accident Report either during installation of the gas service line or during subsequent excavation of the electrical line, or both, damaged the protective insulation for the triplex electrical conductors and splices in the area of the hole in the gas service line. Removal of a small area of the melted and resolidified material from the heat- damaged section of cable B revealed aluminum hydroxide deposits indicative of corrosion. The corrosion deposits were also observed on the unmelted 40 percent of the damaged surface of cable B, as well as on portions of the exterior surface of the connector. This corrosion likely resulted from moisture that reached the crimp connector of cable B through the cuts and tears in the crimp connector insulation. Because the cable ends inside the crimp connector do not meet, the full current load of the conductor must be transferred through the crimp connector. Unimpeded current flow thus depends on there being firm contact between the crimp connector and the cable ends. Evidence indicates that in this accident, the corrosion that occurred on and/or within one side of the splice connection increased the contact resistance between the cable end and the crimp connector. Because the rate of corrosion of aluminum can be significantly accelerated when the material is energized,22 the amount of corrosion likely increased fairly rapidly, reducing the metal-to-metal contact. When the contact resistance increased sufficiently, the connector was no longer capable of supporting the required current flow without overheating and arcing. This arcing generated heat sufficient to destroy a portion of the conductor and the connector and to soften and weaken the nearby gas pipeline. Therefore, given the evidence of prior excavation damage to the insulation on cable B and the evidence of corrosion on the sides of the crimp connector near the damage, the Safety Board concludes that the damage to the protective insulation covering the splice in the electrical conductor identified as cable B allowed moisture to reach the crimp connector, causing corrosion that increased electrical resistance between the crimp connector and the cable sufficient to cause the splice to overheat and fail. As the conductor failed under an inductive load, the additional mass of aluminum in the connector and the cable melted, vaporized, and burned. Given that no other heat source was present near the hole in the gas service line and that the temperature necessary to melt, vaporize, and burn the aluminum missing from the splice connection was far in excess of the approximately 250° F that would soften and weaken the polyethylene pipeline, the Safety Board concludes that heat generated from the arcing resulting from cable B’s failure under load caused the gas service line wall to soften and weaken until the internal pressure breached the pipeline and it began to leak. Cable A showed evidence of melting and resolidification, but unlike cable B, cable A did not show evidence of corrosion. Also unlike cable B, a small portion of cable A’s insulation remained intact between the two melted ends of the cable, indicating that cable A was probably not at elevated temperatures for as long as cable B. Finally, the 22 William H. French, “Alternating Current Corrosion of Aluminum,” Paper T 73 120-3, recommended and approved by the Insulated Conductors Committee of the Institute of Electrical and Electronics Engineers (IEEE) Power Engineering Society (PES) for presentation at the IEEE PES Winter Meeting, New York, N.Y., January 28 through February 2, 1973.

Analysis 18 Pipeline Accident Report evidence of potential electrical shorting within the meter base that was reported by NOVEC suggests that at least one conductor into the house may have been energized at the time of the explosion. Based on this evidence, the Safety Board concludes that the failure of the conductor identified as cable A was a secondary event that may have occurred after the explosion as a result of short circuiting within the damaged residence’s electrical system. Soil Permeation With Gas Tests of four soil samples collected at different sites near the accident residence showed the presence of methane and a smaller concentration of ethane. The presence of ethane in the samples confirms that the combustible gas was natural gas, not another naturally occurring source of methane, such as sewer or landfill gas. The presence of natural gas in these samples also verifies that the natural gas had permeated the soil around and underneath the house. Bluestone rock dust was used as a backfill material around the gas pipelines and electric cables installed in trenches and buried within the South Riding neighborhood. Because this material is more porous than the surrounding soil that was placed back on top of the imported backfill, it likely provided a path the escaped gas could follow from the buried utilities to the foundation of the house. Underground drainage systems had been installed to collect water and route it away from the foundation of the house. Both drainage systems consisted of perforated plastic pipe surrounded by gravel. Both the perforated drain pipe and the gravel are readily permeated by gas. Weep holes had been installed in the concrete footer around the perimeter of the foundation to allow water to flow between the two systems. Gas could easily pass through these weep holes from the external drainage system to the internal system under the concrete slab. The basement of the house offered several avenues by which gas could have entered and accumulated. (See figure 6.) For example, the sump pit penetrated the concrete floor and provided a possible path. Additionally, the water service line passed under the foundation of the house from a point just outside the northeast wall, near the north corner of the house in proximity to the hole in the gas service line. This line entered the basement through a sleeve penetrating the concrete floor. Also, since the concrete for new foundations is poured during discrete construction steps, cracks may have been present in the foundation where different pours adjoined. The Safety Board concludes that the gas present in the soil around and under the house entered the basement of the residence either through penetrations in the concrete slab or cracks in the foundation, or both.

Analysis 19 Pipeline Accident Report Figure 6. Paths of possible migration of gas into the basement of the residence. Adequacy of Standards for Minimum Utility Separation Distances Before the accident, Washington Gas Light Company specified separation distances for steel pipelines but not for polyethylene pipelines. Company management indicated that the company routinely applied the requirements for steel pipelines to polyethylene pipelines, and the installation contractor’s foreman stated that he placed the gas service line in a trench with 12 inches of horizontal separation from the electrical line. Nonetheless, the NOVEC crew reported that they found the gas service line only 6 inches above the electrical cables when they excavated to repair an electrical line fault after the gas service line was installed and before the accident. Since the accident, Washington Gas Light Company has revised its Operating Instructions Manual to require at least 12 inches of clearance between new polyethylene gas pipelines and existing electrical facilities. Allowances are made for lesser separation if specific protections are implemented. The revision also requires that existing polyethylene gas pipelines be separated from electrical facilities as necessary if a lack of separation is discovered during maintenance activities. 25905 Rickmansworth Lane Not to Scale Sump Water and Sewer Entrances Leak Drain Tiles Gas and Electric Services Footer with Weepholes Foundation Wall Floor Slab Drain Tiles Plan View View from Back Not to Scale Gravel

Analysis 20 Pipeline Accident Report Before the accident, NOVEC trench specifications required various separation patterns between their own electrical facilities; however, the company did not have a written procedure requiring a minimum separation between its buried secondary electric lines and other underground facilities, such as gas pipelines. NOVEC’s procedures did require NOVEC personnel to follow the National Electrical Safety Code, which called for electrical cables to be installed and maintained with a vertical separation of 12 inches when crossing other underground structures. But several NOVEC personnel stated that, as a general practice, they maintained at least 6 inches of clearance between electrical cables and all other underground facilities, which was not consistent with the code’s separation requirements. Postaccident excavation revealed that one of the failed electrical conductors may have been touching the gas service line; in any case, the conductors were close enough to the gas service line to damage it when a splice connection in one of the conductors faulted under load and generated an arc. The Safety Board therefore concludes that had the gas and electrical service lines involved in this accident been adequately separated, the heat from the arcing electrical conductor failure would probably not have damaged the gas service line, and the accident would not have occurred. Since the accident, NOVEC has adopted voluntary standards through its participation in the Utility Industry Coalition of Virginia that require a minimum separation distance of 12 inches from other underground facilities unless an acceptable barrier is provided. While the OPS has promulgated regulations that establish minimum underground clearance requirements for gas transmission lines and mains, no similar regulation applies to a residential gas service line such as the one involved in this accident. Since the accident, OPS representatives have met with various industry and governmental organizations to discuss the issue of separation between underground gas pipelines and electrical lines. These representatives also reported to the Safety Board staff that the OPS plans to include the issue in the OPS “Best Practices” initiative focusing on damage prevention. RSPA has not, however, initiated any regulatory action to ensure that residential gas service pipelines are separated from other underground structures. Therefore, the Safety Board believes that RSPA should require gas utility operators to maintain a specified minimum separation distance, sufficient to protect against both thermal and mechanical damage, between plastic gas service lines and underground electrical facilities whenever they install a new gas service line or perform maintenance on existing lines. Since the National Electrical Safety Code already addresses the separation issue for electrical facilities, the Safety Board believes that electrical industry associations and the U.S. Department of Agriculture’s Rural Utilities Service should inform their member utilities of the circumstances of this accident and of the need to ensure that underground electrical facilities are installed and maintained with separation between plastic gas pipelines in accordance with the National Electrical Safety Code.

Analysis 21 Pipeline Accident Report Excess Flow Valves Excess flow valves (EFVs) are available that respond to an excessive flow of gassuch as may occur as a result of a leak by automatically closing and restricting the gas flow. EFVs can greatly reduce the consequences of service line ruptures. They are typically installed at the connection of the service line to the main pipeline. Depending on the manufacturer, EFVs compatible with the operating conditions in this accident are available that are designed to close when the flow rate exceeds about 550 to 850 cubic feet per hourabout 1/10 of the flow rate measured in the service pipeline after the South Riding accident. Based upon the leakage flow rate measured after the explosion and before the pipeline was excavated, the Safety Board concludes that, had an EFV been installed in the gas line to the residence, the EFV would have closed after the hole in the pipeline developed, and the explosion likely would not have occurred. In the early 1980s, the Safety Board advocated using EFVs on service lines to schools and other buildings in which large numbers of people gather. As EFVs became cheaper and more widely available, the Safety Board began advocating the installation of EFVs on new or renewed residential service lines. During the 1980s, RSPA, which has oversight responsibilities for the pipeline industry, did not require EFVs. Consequently, the Safety Board included the use of EFVs on its 1990 list of Most Wanted safety improvements. 23 On September 26, 1990, as a result of its investigation of five natural gas accidents in the Kansas City-Topeka area, the Safety Board recommended that RSPA: P-90-12 Require the installation of excess flow valves on new and renewed single- family, residential high pressure service lines which have operating conditions compatible with the rated performance parameters of at least one model of commercially available excess flow valve. On April 4, 1995, RSPA notified Congress by letter that it had decided not to require universal installation of EFVs and instead would issue performance standards and customer-notification requirements for EFVs. In a September 28, 1995, letter to RSPA, the Safety Board expressed its disappointment with this decision. The Board noted the continued strong evidence that a way was needed to quickly restrict the flow of gas to a failed pipe segment. On September 28, 1995, as a result of RSPA’s failure to issue EFV requirements, the Safety Board classified Safety Recommendation P-90-12 “Closed— Unacceptable Action.” On March 6, 1996, as a result of its investigation of a June 9, 1994, natural gas explosion in Allentown, Pennsylvania, the Safety Board wrote to the governors of all 23 In October 1990, the Safety Board developed the “Most Wanted” list, drawn up from previously issued safety recommendations, to bring special emphasis to the safety issues the Board deems most critical. The Most Wanted list is reviewed, revised, and reissued annually. The Most Wanted list is available on the Web at http://www.ntsb.gov/Recs/MostWant.htm.

Analysis 22 Pipeline Accident Report 50 states and the District of Columbia asking that they require gas distribution operators to install EFVs in all new or replaced gas service lines when operating conditions are compatible with commercially available valves (Safety Recommendation P-96-3). Of the States that replied, most advised that they intended to follow the lead of RSPA and had no plans to require the installation of EFVs. The State of Virginia did not initially respond to Safety Recommendation P-96-3. Also on March 6, 1996, the Safety Board recommended that RSPA: P-96-2 Require gas distribution operators to notify all customers of the availability of excess flow valves; any customer to be served by a new or renewed service line with operating parameters that are compatible with any commercially available excess flow valve should be notified; an operator should not refuse to notify a customer because of the customer’s classification or the diameter or operating pressure of the service line. On February 3, 1998, RSPA issued its final rule regarding EFVs. The rule requires gas distribution operators either to install EFVs on new or replaced single-residence service lines expected to operate continuously at not less than 10 psig or to inform customers of the availability and benefits of EFVs and install them if the customer agrees to pay for their installation and maintenance. On October 6, 1998, the Safety Board classified Safety Recommendation P-96-2 “Closed—Unacceptable Action,” in part because RSPA’s final rule limits required notifications by gas operators to residential customers even though many commercial service lines have operating characteristics compatible with the same EFVs used for residential service lines. Because the Safety Board had no reasonable expectation that further action on EFVs was likely by either RSPA or the States, the Safety Board, on May 3, 2000, removed the recommendations regarding EFVs from its Most Wanted list. After the South Riding accident, on August 3, 2000, the Safety Board wrote the Governor of Virginia asking for information about Virginia’s intentions with respect to Safety Recommendation P-96-3. In an August 16, 2000, response, the Virginia Corporation Commission noted that the State had adopted and will enforce RSPA’s final rule. The commission further noted that it had not identified any noncompliance relative to the EFV provisions. It also noted that many Virginia gas operators install EFVs for existing customers upon request, provided the customer pays for the installation, and that all Virginia operators were now installing EFVs on all new and replaced service lines when operating conditions are compatible with commercially available EFVs. As a result, on October 3, 2000, the Safety Board classified Safety Recommendation P-96-3 to the State of Virginia “Closed—Acceptable Alternate Action.”24 24 Safety Recommendation P-96-3 was classified “Closed” to 30 States. In a July 5, 2000, letter, the Safety Board asked for updates from the States for whom the recommendation remained in an “Open” status.

Analysis 23 Pipeline Accident Report According to an American Gas Association survey provided to the Safety Board in the spring of 2000, since the issuance of the RSPA final rule on EFVs, approximately one- half of the operators of gas distribution systems have elected to install EFVs, and one-half have developed procedures to inform customers of their availability. In the latter case, the RSPA rule permits operators to pass along the cost of EFV installation and maintenance to those customers who choose to have the valve installed. While the Safety Board is encouraged that utility companies that do not provide the valves are at least making them available to their customers, the Safety Board is concerned that customers may not fully understand the safety benefits that EFVs can provide when they are faced with a decision that may require that they pay for the installation and maintenance of the device. Furthermore, Safety Board investigation of a fatal gas pipeline accident in St. Cloud, Minnesota, (four fatalities)25 indicates that commercial establishments can also benefit from the protection offered by EFVs. Likewise, an accident in Bridgeport, Alabama, (three fatalities)26 may have been prevented if the gas service line had been equipped with an EFV. Both accidents involved excavation damage to underground natural gas service lines, and both involved gas that migrated underground to nearby buildings, where it subsequently exploded. Although both the St. Cloud and Bridgeport accidents involved older gas lines that would not have been subject to a RSPA requirement unless they had required maintenance, an EFV may have prevented both accidents. Without a requirement that, where appropriate for operating conditions, commercial gas service lines be equipped with EFVs, further accidents involving pipeline failures leading to fires and explosions can be expected. As noted earlier, current RSPA rules do not require that new commercial customers be informed about the availability of EFVs, even though their operating environments may be compatible with commercially available and relatively inexpensive EFVs. In light of the fact that accidents continue to occur that could have been prevented by the use of EFVs, the Safety Board believes that RSPA should require that EFVs be installed in all new and renewed gas service lines, regardless of a customer’s classification, when the operating conditions are compatible with readily available valves. 25 National Transportation Safety Board, Natural Gas Pipeline Rupture and Subsequent Explosion, St. Cloud, Minnesota, December 11, 1998, Pipeline Accident Report NTSB/PAR-00/01 (Washington, D.C.: NTSB, 2000). 26 National Transportation Safety Board, Natural Gas Service Line Rupture and Subsequent Explosion and Fire, Bridgeport, Alabama, January 22, 1999, Pipeline Accident Brief PAB-00-01 (Washington, D.C.: NTSB, 2000).

24 Pipeline Accident Report Conclusions Findings 1. Based on the size and location of the hole in the gas service line, the amount of gas that would have been needed to cause the accident, the presence of a strong smell of gas outside the house before the explosion, and the presence of natural gas in the soil underneath the residence, the most likely source of the natural gas that filled the residence basement and fueled the explosion was the damaged gas service line leading to the house. 2. Work performed either during installation of the gas service line or during subsequent excavation of the electrical line, or both, damaged the protective insulation for the triplex electrical conductors and splices in the area of the hole in the gas service line. 3. The damage to the protective insulation covering the splice in the electrical conductor identified as cable B allowed moisture to reach the crimp connector, causing corrosion that increased electrical resistance between the crimp connector and the cable sufficient to cause the splice to overheat and fail. 4. Heat generated from the arcing resulting from cable B’s failure under load caused the gas service line wall to soften and weaken until the internal pressure breached the pipeline and it began to leak. 5. The failure of the conductor identified as cable A was a secondary event that may have occurred after the explosion as a result of short circuiting within the damaged residence’s electrical system. 6. The gas present in the soil around and under the house entered the basement of the residence either through penetrations in the concrete slab or cracks in the foundation, or both. 7. Had the gas and electrical service lines involved in this accident been adequately separated, the heat from the arcing electrical conductor failure would probably not have damaged the gas service line, and the accident would not have occurred. 8. Had an excess flow valve been installed in the gas line to the residence, the valve would have closed after the hole in the pipeline developed, and the explosion likely would not have occurred.

Conclusions 25 Pipeline Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the accident in South Riding, Virginia, was the corrosion and subsequent overheating and arcing at a splice in one of the conductors of the triplex electrical service line, which, because of inadequate separation between the electrical conductors and the gas service line, led to the failure of the gas service line and the subsequent uncontrolled release of natural gas that accumulated in the basement and was subsequently ignited. Precipitating the electrical service line failure was damage done to the electrical service line during installation of the gas service line and/or during subsequent excavation of the electrical line.

26 Pipeline Accident Report Recommendations As a result of its investigation of the South Riding, Virginia, accident, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Require gas utility operators to maintain a specified minimum separation distance, sufficient to protect against both thermal and mechanical damage, between plastic gas service lines and underground electrical facilities whenever they install a new gas service line or perform maintenance on existing lines. (P-01-1) Require that excess flow valves be installed in all new and renewed gas service lines, regardless of a customer’s classification, when the operating conditions are compatible with readily available valves. (P-01-2) To the Edison Electric Institute: To the National Rural Electric Cooperative Association: To the American Public Power Association: Inform your member utilities of the circumstances surrounding the July 7, 1998, explosion and fire in South Riding, Virginia, and of the need to ensure that underground electrical facilities are installed and maintained with separation between those facilities and plastic gas pipelines in accordance with the National Electrical Safety Code. (P-01-3) To the U.S. Rural Utilities Service: Inform your participating rural utilities of the circumstances surrounding the July 7, 1998, explosion and fire in South Riding, Virginia, and of the need to ensure that underground electrical facilities are installed and maintained with separation between plastic gas pipelines in accordance with the National Electrical Safety Code. (P-01-4)

Recommendations 27 Pipeline Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: June 12, 2001

FD07210 ｜ 1998_美国_RAR9802.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

( PB98-916302 NTSB/RAR-98/02 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, DC 20594 RAILROAD ACCIDENT REPORT COLLISION AND DERAILMENT OF UNION PACIFIC RAILROAD FREIGHT TRAINS 5981 NORTH AND 9186 SOUTH IN DEVINE, TEXAS ON JUNE 22, 1997 6889A

Abstract: On June 22, 1997, Union Pacific Railroad (UP) freight trains 5981 North and 9186 South collided head-on in Devine, Texas. The conductor from 5981 North, the engineer from 9186 South, and two unidentified individuals who may have been riding on 5981 North were killed. The engineer from 5981 North received minor injuries, and the conductor from 9186 South was seriously burned. The major safety issues discussed in this report are the train dispatcher’s performance and workload, the adequacy of management oversight of the dispatcher apprentice program and dispatching operations, the sufficiency of the Federal Railroad Administration (FRA) oversight of dispatching operations, the effectiveness of conditional track warrant control authority, the adequacy of disaster preparedness, the crashworthiness of locomotives and event recorders, and the merits of positive train separation control systems. As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the UP, the FRA, and the Texas Railroad Commission. In addition, the Safety Board reiterated a safety recommendation to the FRA. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Information about available publications may be obtained by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, SW Washington, DC 20594 (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (703) 605-6000

COLLISION AND DERAILMENT OF UNION PACIFIC RAILROAD FREIGHT TRAINS 5981 NORTH AND 9186 SOUTH IN DEVINE, TEXAS JUNE 22, 1997 RAILROAD ACCIDENT REPORT Adopted: May 19, 1998 Notation 6889A NATIONAL TRANSPORTATION SAFETY BOARD

this page intentionally left blank

iii CONTENTS EXECUTIVE SUMMARY........................................................................................................... v INVESTIGATION Accident Narrative ........................................................................................................................................1 Injuries….......................................................................................................................................................6 Railroad Damage...........................................................................................................................................6 Personnel Information...................................................................................................................................6 Third-Shift Dispatcher............................................................................................................................6 5981 North Traincrew ............................................................................................................................7 9186 South Traincrew ............................................................................................................................7 Train Information..........................................................................................................................................8 5981 North..............................................................................................................................................8 9186 South..............................................................................................................................................8 Postcollision Train Information ....................................................................................................................8 5981 North..............................................................................................................................................8 9186 South............................................................................................................................................10 Track and Signal Information .....................................................................................................................10 Operations Information ...............................................................................................................................10 Dispatching Information .............................................................................................................................12 Responsibilities and Duties ..................................................................................................................12 Workload ..............................................................................................................................................12 Apprentice Program..............................................................................................................................13 Violations .............................................................................................................................................15 Meteorological Information ........................................................................................................................16 Medical, Pathological, and Toxicological Information ..............................................................................16 Third-Shift Dispatcher..........................................................................................................................16 5981 North Traincrew ..........................................................................................................................16 9186 South Traincrew ..........................................................................................................................16 Emergency Response ..................................................................................................................................16 Survival Aspects..........................................................................................................................................17 Locomotive Cab Survivability..............................................................................................................17 Fire and Rescue Services......................................................................................................................17 Municipal Disaster Plan .......................................................................................................................17 Tests and Research......................................................................................................................................18 Sight Distance.......................................................................................................................................18 Train Brake Controls ............................................................................................................................18 Locomotive Event Recorders ...............................................................................................................18 Other Information........................................................................................................................................19 Nonsignalized Territory Accident Risk................................................................................................19 Federal Railroad Administration ..........................................................................................................20 Union Pacific Railroad Postaccident Actions ......................................................................................20 Safety Board Public Hearing................................................................................................................21

iv ANALYSIS General Factors ...........................................................................................................................................22 Accident Narrative ......................................................................................................................................22 Dispatcher Performance and Workload ......................................................................................................23 Management Oversight ...............................................................................................................................25 Dispatcher Apprentice Program ...........................................................................................................25 Dispatching Operations ........................................................................................................................26 After-Arrival Conditional Authority ....................................................................................................26 Federal Railroad Administration Train Dispatching Oversight..................................................................27 Emergency Response and Disaster Preparedness .......................................................................................28 Crashworthiness..........................................................................................................................................29 Locomotives .........................................................................................................................................29 Event Recorders....................................................................................................................................29 Positive Train Separation Control Systems ................................................................................................30 CONCLUSIONS Findings.......................................................................................................................................................32 Probable Cause............................................................................................................................................33 RECOMMENDATIONS.............................................................................................................34 APPENDIXES Appendix A—Transcript of Track Warrants 8289 and 8290 .....................................................................37 Appendix B—Acronyms and Abbreviations ..............................................................................................39

v EXECUTIVE SUMMARY At 10:52 p.m. on June 22, 1997, Union Pacific Railroad (UP) freight trains 5981 North and 9186 South collided head-on in Devine, Texas. The trains were operating on a single main track with passing sidings in dark (nonsignalized) territory in which train movement was governed by conditional track warrant control authority through a dispatcher. The conductor from 5981 North, the engineer from 9186 South, and two unidentified individuals who may have been riding on 5981 North were killed in the derailment and subsequent fire. The engineer from 5981 North received minor injuries, and the conductor from 9186 South was seriously burned. Estimated damages exceeded $6 million. The National Transportation Safety Board determines that the probable cause of this acci- dent was the failure of the third-shift dispatcher to communicate the correct track warrant infor- mation to the traincrew and to verify the accu- racy of the read-back information because the UP management had not established and imple- mented workload policies and operational pro- cedures to ensure a safe dispatching system and the Federal Railroad Administration (FRA) had failed to provide standards and oversight in all aspects of train dispatching operations. Contrib- uting to the accident was the lack of an installed positive train separation control system that would have prevented the trains from colliding by automatically intervening in their operation because of inappropriate actions being taken. The major safety issues discussed in this re- port are the train dispatcher’s performance and workload, the adequacy of the UP management oversight of the dispatcher apprentice program and dispatching operations, the sufficiency of the FRA oversight of dispatching operations, the effectiveness of conditional track warrant con- trol authority, the adequacy of disaster prepar- edness, the crashworthiness of locomotives and event recorders, and the merits of positive train separation control systems. As a result of its investigation, the Safety Board makes recommendations to the UP, the FRA, and the Texas Railroad Commission. In addition, the Safety Board reiterates a safety recommendation to the FRA.

this page intentionally left blank

1 Accident Narrative About 10:52 p.m. on June 22, 1997, Union Pacific Railroad (UP) freight trains 5981 North and 9186 South1 collided head-on in dark (nonsignalized) territory at milepost (MP) 290.4 in Devine, Texas.2 The collision occurred on a single main track at the north end of a concrete ballast deck bridge. (See figure 1.) Five locomotive units and 20 freight cars derailed, and a fire ensued. The engineer from 9186 South, the conductor from 5981 North, and two unidentified individuals received fatal injuries. The conductor from 9186 South sustained serious injuries, and the engineer from 5981 North received minor injuries. Earlier that day at 2:30 p.m., train 5981 North had departed Laredo. (See figure 2.) Train 5981 North was given authorization by track warrant3 from the second-shift train dispatcher4 to proceed to Callaghan (MP 385.3), the first station after Laredo. (See figure 3 for blank standard UP track warrant form.) At Callaghan, the 5981 North met a southbound train and was authorized by the dispatcher to proceed to Gardendale (MP 339.5), where it was stopped and met another southbound train. While 5981 North was stopped, the U.S. Border Patrol

1The UP designated them as freight trains MLDLI and ZYCMX, respectively. 2All train movements and locations are within Texas except where specified otherwise. 3A track warrant is given via radio by or through proper railroad personnel to govern train movements. The Federal Railroad Administration interprets track warrants as train orders by radio. Until 1985, train orders were written instructions to govern the movements of a train issued by the train dispatcher through the telephone to on- line train order operators, who in turn typed these instructions for delivery to the traincrews of passing trains. These instructions involved the transmitting, typing, and repeating of their contents. In 1985, the train order method for train movements was discontinued and replaced by the track warrant system on most railroads. 4Dispatchers for the Austin subdivision work either a first (6:30 a.m. to 2:30 p.m.), second (2:30 to 10:30 p.m.), or third (10:30 p.m. to 6:30 a.m.) shift at the UP Harriman Dispatch Center in Omaha, Nebraska. apprehended two suspected illegal immigrants who were riding the train. Leaving Gardendale about 6:45 p.m., train 5981 North proceeded to the side track at Derby (MP 321.5), where eight ballast cars were added to the train. The engineer said that after these cars were added and the proper air test was performed, the train proceeded to and entered the siding at Melon (MP 318.0). At that time, the engineer of train 5981 North requested automobile transportation and was driven to a nearby store to purchase food. The conductor remained with train 5981 North. As the engineer was returning to the train, he overheard an exchange on a railroad radio installed in the car; in this exchange, the dispatcher authorized the second of the two trains being met at Melon to proceed farther south beyond Melon. The engineer stated that after he boarded the locomotive, the conductor received the track warrant authorization from the second-shift train dispatcher at 9:18 p.m. instructing the train to depart Melon and proceed to Gessner (MP 278.5), where 5981 North would be required to take (enter) the siding. At 10:30 p.m., the third-shift train dispatcher issued a track warrant instructing 5981 North to proceed from Gessner to San Antonio after meeting 9186 South at Gessner. Train 5981 North was instructed to enter the siding at Gessner so that 9186 South could pass on the main track. At Devine, the 5981 North crew noted a bright glow on the horizon, and both the engineer and the conductor rose from their respective seats trying to identify this glow. At that moment, the headlight of an oncoming locomotive came into view. The engineer of 5981 North said he placed the train into emergency braking, exited the rear door of the control compartment, and jumped from the locomotive. The conductor exited the forward door of the control compartment and either jumped or was thrown from the locomotive. Earlier at 9:56 p.m. on June 22, 1997, train 9186 South had been authorized by track INVESTIGATION

5 warrant 8261 from the second-shift train dispatcher to proceed to Gessner, departing San Antonio about 10:10 p.m. The train was authorized by track warrant 8289 (see figure 4) from the third-shift dispatcher at 10:28 p.m. to proceed from Gessner to Melon. Train 9186 South passed the Gessner siding and entered the city of Devine. At some point, the crew saw the oncoming northbound train, and both the engineer and the conductor jumped from the lead locomotive as the trains collided. The printed copy5 of track warrant 8289 (see figure 4) contained four elements: (box 2) Proceed from Gessner to Melon on main track, (box 7) Not in effect until after arrival of 5981 North at Gessner, (box 8) Hold the main track at last named point [Melon], and (box 15) Flag protection not required against following trains on the same track. According to the voice recordings between the 9186 South crew and the third-shift train dispatcher, the instructions contained three elements: (box 2) Proceed from Gessner to Melon on main track, (box 8) Hold the main track at last named point, and (box 15) Flag protection not required against following trains on the same track. In the voice recordings, 9186 South was authorized to proceed from Gessner to Melon (box 2); absent from the voice recordings was “not in effect until after arrival of 5981 North at Gessner” (box 7). The third-shift (relieving) dispatcher reported that during the shift changeover between 10:15 and 10:20 p.m., he discussed with the second-shift (departing) dispatcher how many trains were operating and their status. The majority of the UP trains on the Austin subdivision at that time were on the San Antonio to Laredo territory, and a National Railroad Passenger Corporation (Amtrak) train was operating from Temple to Taylor. The third-shift dispatcher stated that several radio calls were coming in and “it was busy,” which was “probably an average night for that position.” His first radio conversation was at 10:20:37 p.m. with the Amtrak traincrew. During this conversation, the third-shift dispatcher cleared and voided the track bulletin

5Generated from the train dispatcher’s work station computer, as displayed on the screen when the instructions were radio-issued to the crew. item that had been previously issued to the Amtrak train. The conversation ended at 10:21:50 p.m. The next radio communication was initiated at 10:24:10 p.m. by the traincrew of UP IYCLD, which was operating on the Austin subdivision. The traincrew “gave up” its track warrant to the dispatcher, who then created a new track warrant directing the train to proceed from Gardendale on the main track of the Austin subdivision. This conversation ended at 10:26:03 p.m. At 10:26:05 p.m., the dispatcher called train 9186 South, and the conductor responded immediately. The dispatcher said, “Yeah, let me get you an ‘after-arrival’ there at Gessner while I have a minute, over.” The conductor responded, “All right, ready.” When communicating track warrant instructions to a traincrew, dispatchers are required to read the information, as it is presented on the screen, and to verify the accuracy of the information, comparing the oral read-back from the traincrew with the information shown on the screen. The third-shift dispatcher then transmitted the track warrant information to 9186 South, omitting the instruction “not in effect until after arrival of 5981 North at Gessner” (the box 7 instruction on the track warrant). The third-shift dispatcher later said that he could not recall whether he had included the box 7 instruction (to remain at Gessner) on the track warrant when formally transmitting authorization to 9186 South by voice. The recorded radio transcripts of the transmission of this track warrant between the dispatcher and the 9186 South traincrew did not include this instruction. The conductor repeated the information to the dispatcher, and the dispatcher okayed the read-back information despite the omission of the box 7 instruction that was on the computer screen display. Their conversation ended at 10:28:10 p.m. Four seconds later, the dispatcher called train 5981 North and accurately relayed the track warrant (8290) information for that train to its conductor. Their conversation ended at 10:30:04 p.m. (See appendix A for transcript of track warrants 8289 and 8290.) See the Operations Information section for more information about UP dispatching techniques.

6 Injuries* Type 5981 North Crew 9186 South Crew Unidentified Total Fatal 1 1 2 4 Serious 0 1 0 1 Minor 1 0 0 1 Total 2 2 2 6 *Based on the injury criteria (49 Code of Federal Regulations 830.2) of the International Civil Aviation Organization, which the National Transportation Safety Board uses in accident reports for all transportation modes. Railroad Damage Two locomotive units and 14 cars were derailed from train 9186 South; both locomotive units and 2 cars were destroyed. Three locomotive units and six cars were derailed from train 5981 North; one locomotive unit and five cars were destroyed. The estimated costs were: Locomotives $ 4,150,000 Cars 501,300 Track 40,000 Structures 900,000 Lading 320,000 Clearing 103,767 Total $ 6,015,067 Personnel Information Third Shift Dispatcher -- The 39-year-old train dispatcher began working for UP as a section man in 1975, and he transferred in 1979 to the signal department, where he worked as the systems signal man in Salt Lake City, Utah. He became a signal maintainer in Caliente, Nevada, in April 1990; an electronics technician at the Harriman Dispatch Center (HDC)6 in February 1994; and then an apprentice train dispatcher in May 1996.

6Opened in 1989, the dispatch center houses the entire UP main track operations system and the dispatchers who oversee train operations. According to the third-shift dispatcher, his training began at the HDC with a 3-week class in the railroad operating rules, including the dispatching and air brake rules. He stated that because he had replaced a trainee who had dropped out, his training had been shorter than that of other dispatchers and he had missed the basic railroading review, which was primarily designed for apprentice train dispatchers lacking a background in railroading. He then had 1 month of training in dispatcher duties using a simulator to become familiar with the computer- aided dispatching (CAD) system.7 In July, he started 1-month on-the-job training (OJT), during which he observed an experienced dispatcher operate the line and later operated the line while being observed by the OJT dispatcher trainer. Afterwards, as part of the qualifying period, the manager of train dispatchers observed him as a trainee performing dispatch duties during a shift. He became a qualified dispatcher on August 17, 1996, and since then had worked on the Austin subdivision. Before June 22, 1997, he had not been cited for any dispatching rules violations. After the Devine accident, the third-shift dispatcher stated that he believed that he had been adequately trained to operate as a dispatcher. He added that the simulator and OJT were not equal to handling the dispatching demands and said, “How can training be equal

7Supports the track warrant system that is unique to the UP.

7 to . . . a dozen radios going off and 10 people yelling at you at the same time. . . . I guess the main thing that would be missing from all of that would be really interaction with somebody out in the field . . . especially when you’re new. . . . Having to deal with that sort of thing is hard.” The third-shift dispatcher reported that he was in good health, and, according to his medical records, he had normal vision, with no color-vision problems, and normal hearing. His last UP physical was in 1989. He reported that he was not taking any prescription or over-the- counter medications at the time of the accident. He stated that he did not smoke tobacco or drink alcohol. The third-shift dispatcher had not worked on Friday, June 20, 1997. On Saturday, June 21, he woke about 9 a.m., remained at home performing chores, left for work about 9:40 p.m., and arrived there at 10:15 p.m. He started his shift about 10:20 p.m. and worked until 6:20 a.m. on Sunday, June 22. After returning home, he retired at 7 a.m. and slept until about 12:30 p.m. He remained at home during the day, left for work about 9:40 p.m., arrived about 10:15 p.m., and started his shift. 5981 North Traincrew -- The UP records indicated that the crew of train 5981 North met the requirements as prescribed in the Hours-of- Service Act. The 27-year-old engineer was hired in July 1989 by the UP as a trainman at San Antonio. In June 1993, he transferred to engine service and worked as a fireman while participating in the training program to become a locomotive engineer. In December 1993, he was promoted to locomotive engineer. He had passed his most recent physical examination in March 1995. His vision and hearing were normal. He reported being well-rested before the accident. The engineer had worked the previous 3 days before the accident. He was a certified locomotive engineer under the regulations found in 49 Code of Federal Regulations (CFR) Part 240, was current on the UP operating rules, and had passed his last rules examination in January 1995. The 48-year-old conductor was hired in May 1973 by the UP as a trainman at San Antonio. In May 1975, he was promoted to conductor. He passed his last physical examination in May

1. According to the guidelines established by

UP, the conductor was qualified to perform the duties of a conductor on the Austin subdivision. He was current on the UP operating rules and had passed his last rules examination in April 1995. The conductor had worked the previous 2 days before the accident. 9186 South Traincrew -- The UP records indicated that the crew of train 9186 South met the requirements as prescribed in the Hours-of- Service Act. The 39-year-old engineer was hired in August 1976 by the UP as a laborer at San Marcos. In May 1985, he transferred to a clerical position; moving to Omaha in July 1989, he worked in a crew dispatching position. He transferred to San Antonio in May 1993 as a trainman and in October 1994 was promoted to conductor. In March 1995, he transferred to the position of student engineer to learn the craft of locomotive engineer; on May 12, 1995, he was promoted to locomotive engineer. He passed his last physical examination on September 12, 1996. According to the UP guidelines, the engineer was qualified to perform the duties of a locomotive engineer on the Austin subdivision. He was a certified locomotive engineer under the regulations found in 49 CFR Part 240, was current on the UP operating rules, and had passed his last rules examination on June 10, 1997. The engineer had worked the previous 2 days before the accident. The 37-year-old conductor was hired in June 1996 by the UP as a brakeman at San Antonio. Within 3 weeks, he received formal training, with examinations, that would later qualify him as a conductor. In February 1997, he was qualified as and promoted to conductor; during the previous 6 months, he had worked primarily in yard service. In April 1997, he was assigned to work as a freight conductor. For the 60 days before the collision at Devine, he worked as a freight conductor, alternating his duty cycles with yard service positions. He passed his last physical examination in December 1996. According to the UP guidelines, the conductor was qualified to perform the duties of a conductor on the Austin subdivision. He was current on the UP operating rules and had passed his last rules examination on

8 June 27, 1996. The conductor had worked the previous 2 days before the accident. Train Information Train 5981 North -- The train consisted of locomotive units UP5981 (a 3,800-horsepower EMD8 SD60), UP4211 (a 3,000-horsepower EMD SD-40-2), and UP5084 (a 3,500- horsepower EMD SD50M) and 83 loaded and 11 empty freight cars. On June 22, 1997, at 7,200 feet long and drafting 8,200 tons, train 5981 North originated at Laredo, where it was inspected at 12:20 p.m. An initial terminal air brake test was successfully completed at 2:20 p.m., and the train departed at 3 p.m. Eight loaded ballast cars were added at Derby. Train 9186 South -- The train consisted of locomotive units UP9186 (a 4,000-horsepower General Electric C40-8) and UP6143 (a 3,800- horsepower EMD SD60-M) and 62 loaded freight cars. At 4,071 feet long and drafting 3,284 tons, train 9186 South originated at the UP Yard Center near Chicago, Illinois, on June 21, 1997. Two carmen inspected the train and then assisted in performing a successful initial terminal air brake test, and the train departed at 6:03 a.m. On June 22 at 2:40 a.m., the train was given an intermediate (1,000-mile) air brake test at Texarkana. The air brake test was successfully completed, and 9186 South departed at 4:09 a.m. Train 9186 South arrived at 8:48 p.m. at San Antonio, where it was to receive another air brake test. The outbound traincrew reported that the radio was defective on the lead locomotive unit, and the radio was subsequently replaced. The air brake test was successfully completed by the traincrew, and 9186 South departed at 10:10 p.m. Postcollision Train Information The three-unit locomotive consist of train 5981 North remained on the bridge, but the two- unit locomotive consist of train 9186 South toppled from the bridge onto the road below. A

8Electro-Motive Division of General Motors. number of trailing freight cars in each train piled up on and around the locomotive wreckage on the bridge and in the street below. Diesel fuel spilled, and a fire ensued, extensively damaging most of the equipment in the immediate proximity of the overpass. (See figure 5.) Train 5981 North -- The lead locomotive unit UP5981 exhibited massive catastrophic structural damage; the short-hood structure, cab assembly, and electrical cabinet were effectively sheared off horizontally at the top of the frame assembly deck plate surface. The diesel engine was found to have been displaced aft about 8 feet, and the main generator had separated from the engine. The frame had bowed downward, displaying a bend estimated at 1 foot. The remaining car body (sheet metal) was heavily deformed, and the entire unit had been consumed by the fire. The trailing locomotive unit UP4211 also exhibited massive damage; the cab assembly and electrical cabinet were found to be sheared off level with the top deck of the short-hood structure, which remained relatively structurally undamaged. The car body (sheet metal) and internal machinery on the aft-end of the unit were compressed in a forward direction, having been contacted by the third locomotive in the consist, which overrode this unit. Approximately one-third of the front of the unit exhibited fire damage. The trailing locomotive unit UP5084 overrode the aft-end of the succeeding unit and came to rest with its lead-end resting on top of the frame of the locomotive in the number two position. The leading truck assembly had detached from its mounting and was wedged between the two locomotive structures. The trailing truck remained attached. The fuel tank was detached from its normal mounting position and came to rest on the ballast beneath the unit. The locomotive, which exhibited fire damage on its exterior surfaces, was the least damaged of the units involved.

9 Figure 5 - Photograph of trains 5981 North and 9186 South after impact.

10 Train 9186 South -- The lead locomotive unit UP9186 traveled down the northwest embankment slope and landed upright on the road, approximately parallel to the bridge, with the aft-end of the unit resting on the northwest embankment slope. The unit lost its front truck assembly, exhibited inward deformation to its front pilot plate and short-hood structure, and was consumed by the fire. The cab structure remained intact and was not crushed by the impact. The trailing locomotive unit UP6143 fell toward the pavement on the east side of the bridge, landed cab-end down, and oriented slightly on its right side on top of derailed freight car wreckage, with the aft-end raised up and the left side resting on wreckage that remained on the bridge. The front truck assembly had separated, and the fuel tank showed massive deformation damage. The front pilot plate and short-hood structure were substantially deformed inward; the cab remained structurally intact. The remainder of the unit exhibited extensive car body panel (sheet metal) deformation, and the entire unit was consumed by the fire. Track and Signal Information The track in the area of the collision was constructed with 112-pound rail, which was manufactured and laid in 1943, and later restructured into continuous-welded-rail. The rail rested in double shoulder tie-plates secured to 9-foot timber cross ties with 5/8- by 6-inch cut track spikes. The ties were supported in 2- inch crushed rock ballast and maintained with 12-inch shoulders to restrain lateral movement. Longitudinal movement was restricted with channel lock rail anchors base-applied to every cross tie in a box pattern. The southbound alignment for the undulating track was tangent at the point of impact (POI). Train 9186 South negotiated a 1° 23′ left-hand curve at MP 289.5, ascended a 0.51-percent grade before cresting the hill at MP 290, and was descending the 0.82-percent grade leading to the POI. At MP 290.4, 5981 North negotiated the 3° 11′ right-hand curve at MP 293 before entering the long tangent approach to the POI. The track is maintained to meet or exceed the Federal Railroad Administration (FRA) standards for a class 4 track.9 The UP track personnel inspect the track 7 days a week. The weekly inspection records between May 1 and June 3, 1997, indicate no FRA track defects were found. An inspection of the track was conducted on the day of the accident, and no FRA defects were discovered. The 140-foot concrete ballast deck bridge at the POI consisted of two 30-foot approach spans and an 80-foot main span extending over the highway. The bridge had extensive damage as a result of the collision and was replaced with a similar structure on the approach spans. The main span was changed from built-up beam sections over the highway to welded beams over the highway. The concrete deck was replaced with a steel deck to hold the ballast and ties. The accident territory did not employ a block signal system (wayside signals) to govern train movements and was called dark (nonsignalized) territory; the movement of trains was controlled by a track warrant system. Operations Information According to the UP, 12 or 13 trains in both directions pass through the Devine area daily. The movement of trains over the territory is governed by the UP operating rules, timetable instructions, and general orders. The operating rules were provided by the Third Edition of the General Code of Operating Rules, dated April 10,

1. Any rule modifications or revisions to the

operating rules were part of the UP Timetable No. 2, effective October 29, 1995, that included the “System Special Instructions,” which provided general revisions, and the “Service Unit San Antonio, Austin Subdivision,” which contained information specific to operating trains through the territory where this accident occurred. The

9Maintained to accommodate passenger and freight trains at maximum allowable speeds of 80 and 60 mph, respectively.

11 permanent track speeds for the trains were designated in the timetable, and temporary speed restrictions were issued through the train dispatcher by track bulletin.10 The train movements were controlled by the train dispatcher, who issued instructions in the form of track warrants. Track warrants evolved from train orders and are not addressed in the CFR. Each train received its original movement instructions at the initial station of the train. Subsequently, the train dispatcher issued additional track warrants by radio to the traincrews at intermediate locations. The receiving crewmember was required to write down the track warrants, as received over the radio, on a standard UP form and to read them back to the train dispatcher. This method of operation allowed the train dispatcher to establish or change the meeting locations of trains and add movements on the territory. To establish a meeting point between opposing trains, the train dispatcher issued a track warrant (see figure 3) to one train that included, at a minimum, a box 2 that stated the “proceed from” and “to” limits being granted and a box 10 that instructed “clear main track at last named point” as prescribed in box 2. The train traveling in the opposite direction was issued a track warrant that included, at a minimum, a box 2 that stated the “proceed from” and “to” limits being granted and a box 8 that instructed “hold main track at last named point” (the “to” limit granted in box 2). The train instructed to clear the main track at the station where the meet was to take place was not authorized to proceed on the main track beyond the initial switch of the siding without additional track warrant authority. The train instructed to hold the main track was not authorized to proceed beyond the switch at the end of the last named point for the “to” station until additional track warrant authority was issued. This system protected the two opposing trains, and the physical passing of the trains was accomplished.

10Track bulletins are addressed to trains that operate through the dispatcher’s assigned territories and contain temporary speed restrictions, locations of personnel and equipment working, and possible safety hazards. When one train arrived at a station earlier than the other train, the dispatcher had two options for giving the first train further instructions. The dispatcher could either wait until the meet had taken place and then authorize both trains to proceed beyond this station in the opposite directions or authorize the train that had arrived at the station early to proceed to the next station but not leave that station until “after the arrival” (after-arrival) of the opposing train. The dispatcher gave movement instructions to trains, but the trains could not act on these instructions until a prescribed event occurred, such as the arrival of another train. This method (conditional track warrant control authority)11 allowed the train dispatchers to prepare the train movements in advance and pace their workloads. All track warrants that were issued by the train dispatcher were created on a computer screen using the CAD system. The dispatcher requested a track warrant by entering the train’s ID (mainframe computer symbol) and the subdivision on the computer screen menu. The CAD system then generated a track warrant screen displaying a box 1 (to void a previously issued track warrant), a box 2 (to establish directional authority limits), and a box 4 (to establish “work between” or nondirectional limits). Should the train dispatcher choose to establish directional authority, the dispatcher would place an “x” in box 2 and type the “proceed from” and “to” locations (specifying the limits the train was being granted). (See figure 3 for the blank UP track warrant form.) Trains were authorized from station to station, moving through the territory in short segments, which gave the dispatcher flexibility in establishing a meeting location between opposing trains. A conflict resolution logic had been developed for the CAD system to prevent two trains from receiving nonconditional authorization onto the same segment of track at the same time. For example, if a train dispatcher authorized a southbound train from station A to station B, the computer accepted this as a valid track warrant. If the train dispatcher subsequently issued a track warrant authorizing a northbound

11Although authority for the train movement has been issued, a specific condition must be met before the authority is acted on.

12 train from station B to station A, the CAD system detected the conflict, and the screen immediately displayed the required conditional authority instruction (box 7) that the northbound train not leave station B until after-arrival of the southbound train. At the same time, a third screen displayed a conflict between the two trains. After interviews with several dispatchers, the Safety Board found that dispatchers were aware that this protection was available in the system. During an interview with the third-shift train dispatcher, he recalled mentioning to the 9186 South traincrew that he intended to issue an after- arrival authority. During the formal transmission of track warrant 8289, the dispatcher failed to orally communicate the box 7 requirement (not in effect until after the arrival of 5981 North at Gessner) even though the CAD system had generated the box 7 after-arrival instruction on the screen. When the train dispatcher was later asked how he had determined that the track warrant would be an after-arrival, he stated that he had logically come to that conclusion because of the train movements in the territory and, specifically, the conflict with the northbound train. Dispatching Information Responsibilities and Duties -- Train dispatchers at the HDC are responsible for scheduling the movement of trains over a specified segment of railroad. Their duties include arranging train meets and passes with minimum delays, managing unexpected delays and emergency situations, and issuing track warrants to traincrews. The track warrant information is conveyed by using various types of signaling equipment and radios to communicate with maintenance-of-way employees or operating personnel. Dispatchers formulate and transmit track warrants by typing information into their computer terminals and then orally issuing the track warrants to traincrews. Both dispatchers and traincrews are instructed to follow proper radio procedures when communicating track warrants to ensure that train movement information is accurately exchanged. The dispatcher’s primary task is to read the track warrant data as they are presented on the computer screen. After receiving and recording the data, a train crewmember is required to read them back to the dispatcher for verification. During the repeat for verification, the dispatcher compares the oral information being received with the data on the computer screen. The dispatchers also record information on paper, such as the train ID and the conductor’s name. Several dispatchers reported that the most difficult time for a dispatcher was during the first 30 minutes of the shift, when a dispatcher was “trying to assimilate everything” and mentally planning the operation of the territory during that shift. At this time, the relieving dispatcher has to process the information just received from the briefing of the departing dispatcher, prioritize the tasks that are to be performed during the current shift, and respond to radio transmissions received from traincrews that could not be responded to during the shift changeover. In addition, supervisors often called the dispatchers during the first 10 to 15 minutes to be apprised of operations on the territory. Dispatchers at the HDC operate inside a station with waist-high walls partitioning one dispatcher from another. Several dispatchers, including the third-shift dispatcher, stated that radio conversations between other dispatchers and operating crews can be overheard, that adjacent dispatchers also converse with each other about train movements and other operational matters, and that conversations and other noise are greatest during shift changeover. Intercoms are available for communications but are generally not used. Many dispatchers reported that they find the noise distracting and believed that glass barriers to muffle sounds would decrease the noise and provide a better working environment. Workload -- The UP told the Safety Board that a workload study team began assessing the dispatcher workload in the third quarter of 1997 with the intent to conduct ongoing studies of positions with high workload issues. The UP management indicated that the dispatcher workload was determined, first, by the time dispatchers spend in communication with train and maintenance-of-way employees and, second, by the number of CAD functions performed by a dispatcher in a given period of time. According to the UP management, “there

13 is no specific information available which would determine what constitutes high workload, as a rule of thumb, . . . a position [is considered] to be a possible high workload if the data indicates a consistent pattern of quantifiable activity in excess of six hours.” The Safety Board reviewed data, provided by the UP, on the Austin subdivision. The average number of trains each day from January to June 1997 was 12.5. During the same time in 1996 and 1991, respectively, the average number of trains each day was 10.8 and 6.47. The third-shift dispatcher reported that he usually directs between 15 and 20 trains on the three subdivisions in his territory. The UP indicated that, on average, dispatchers deal with 21 telephone and radio calls each hour, talking to traincrews, track maintenance workers, and dispatch center supervisors. It added that when discussing track warrant information, dispatcher and traincrew conversations typically take about 2 minutes. According to the FRA, one dispatcher stated that he spends about 6 hours of his shift on the telephone and radio. According to dispatchers interviewed at the HDC, because of the high workload on several territories, some dispatchers issuing track warrants may be mentally or physically attending to their next task and not concentrating on the read-back communication from the traincrew. The dispatchers also stated that newly qualified dispatchers were involved in territories of high-operating demands. Several dispatchers reported experiencing increased stress while on duty and specifically cited the following as contributing factors to the elevated stress levels: increased workload due to increased train volume and congestion, the lack of support from management in recognizing the dispatching challenges, the management requirement that they work on scheduled off- days, and the frustrated attitude of the traincrews. The UP management reported that some of the recent concerns expressed by the dispatchers were volume-related issues. Dispatchers stated that the workload continued to increase after the Devine accident due to increased train volume. Their duties focused on moving trains in and out of sidings, dispatching vans to pick up crewmembers who had reached the maximum hours-of-service time, dispatching relief crewmembers, and responding to increased numbers of phone calls from the field personnel. Apprentice

Program

The UP management indicated that it tries to select people to become train dispatchers who have been associated with the railroad industry, such as those working in the maintenance-of-way, signal, and communications departments; in the customer service center; and in crew management placement. Some dispatchers expressed concern that apprentice dispatchers are being selected without having a railroad background. The UP management reported that because of technological changes, they have had to expand the applicant pool to include engine crew employees and college-educated people from outside the rail industry. The UP management stated that it uses a screening method to select apprentice (trainee) dispatchers. Prospects from outside the industry are required to take and pass a series of tests that include a learning abilities test, as well as math, typing, and psychological profile tests. Applicants who pass these tests then undergo an interview process before being considered for training. The apprentice dispatchers receive training in the fundamental workings of the UP, the operating rules, and the CAD system; they also receive a training manual and OJT with a dispatcher trainer. (Safety Board investigators found that the training manual lacked organizational structure, a class syllabus or outline, student objectives, a focus for major points, and summaries for reviewing important areas.) Apprentice dispatchers are placed on a territory, where they will later dispatch full time, and observe one or more qualified dispatchers during each of the three shifts. As apprentice dispatchers become more familiar with the operations, they perform OJT dispatcher duties under the supervision of an OJT dispatcher trainer. At the time of the Devine collision, the training process to become a qualified dispatcher took about 3 months to complete. Since March 1998, the UP has extended this program to 6 months, increasing the rules part of the training from 2 to 3 weeks

14 and requiring more on-the-job and simulator training. Like many other railroads, the UP has no formal training or procedures for the dispatcher trainers who oversee the apprentice dispatchers during OJT. As reported in the FRA 1995 Train Dispatchers Follow-up Review,12 the FRA detected inconsistencies in many railroads in the area of OJT and found that OJT, in some instances, has been delegated to subordinates without adequate direction, control or evaluation methodology. Additionally, some management officials did not have definitive opinions, nor did they provide direct guidance, regarding necessary components of dispatcher training programs. This leads to unstructured training and inconsistent training. The FRA found no evidence during its 1987-88 and 1993 train dispatcher reviews that inadequate dispatcher training directly resulted in train accidents. Nevertheless, the FRA noted that training directly impacts train dispatcher efficiency and productivity, which have the potential to impact safety, and that the failure to provide well-defined training may also contribute to train dispatcher stress, fatigue, and work overload. The FRA advised that within 36 months of its 1995 dispatchers review, it would [p]ublish an ANPRM [advanced notice of proposed rulemaking] proposing minimum training standards for train dispatchers, to include initial, periodic, refresher, and physical characteristic training; and minimum operating rule training and testing standards. These standards will be based upon data developed through the partnership between FRA, BN[SF], ATSF [Atchison, Topeka and Santa Fe

12This report responds to the congressional mandate to assess corrective actions taken by the rail industry in addressing concerns identified in the FRA National Train Dispatcher Safety Assessment of 1987-88. Railway] and Amtrak. As part of the review, FRA will examine railroad operating rules to assess consistency, standardization, and applicability to today’s railroad environment. The FRA also reported that it established a Railroad Safety Advisory Committee (RSAC), consisting of representatives from government, industry, and unions, to address issues of train dispatching. The FRA noted that dispatcher training standards have been developed and published, that it anticipated the formal presentation of those standards at an RSAC meeting in 1998, and that it expected the standards to be voluntarily adopted by the railroads. The UP management stated that before the Devine accident, OJT dispatcher trainers had at least 5 years of experience working as dispatchers. The UP reported that since the Devine accident, OJT dispatcher trainers with between 15 and 20 years of experience are preferred, although some UP dispatchers have reported that on several occasions dispatchers with less than 5 years of experience have served as OJT dispatcher trainers. Several OJT dispatcher trainers have been reported to have less than 2 years of experience, and some dispatcher trainers occasionally performed OJT duties only a few months after becoming qualified dispatchers themselves. Several dispatchers told Safety Board investigators that they believed OJT dispatcher trainers should have a minimum 5 years of dispatching experience before assuming training duties. Apprentice dispatchers take direction from qualified dispatchers who are directly supervised by corridor managers. According to the UP, a train dispatching background and field experience are the two attributes that make better supervisory corridor managers. However, corridor managers are not required to have been qualified dispatchers. Those involved in the UP training process are the director of train dispatching personnel and hiring, two rules instructors at the HDC, a rules instructor from Salt Lake City, the manager of train dispatching, the corridor manager, the region director of the apprentice

15 area, and the dispatcher trainer. The UP management stated that all of these individuals must generally agree that a dispatcher trainee has qualified as a dispatcher. The UP reported that in April 1997, it incorporated changes requiring a formal qualification process that takes place over a 4-day period. According to the UP management, this 4-day qualification process is performed only after an apprentice train dispatcher has demonstrated the knowledge and ability to qualify. During those 4 days, the apprentice dispatcher is evaluated in 16 dispatching-specific areas and is not allowed to perform solo train dispatching service until acceptable proficiency has been demonstrated in all areas. The UP stated that this evaluation process “will be followed in all instances.” Several UP dispatchers reported that on occasion management had determined an apprentice dispatcher was qualified for a specific territory despite the OJT dispatcher trainer’s conclusion that the apprentice needed additional supervision. Moreover, one dispatcher stated that management pressured him to start dispatching duties despite his own belief that he was not yet fully trained. The UP management has stated that when a qualified dispatcher fills a new position, “the person is provided training until she or he feels ready to work the position.” Following the Devine accident, the UP management scheduled daily safety and production meetings for dispatchers before the start of each shift. The guidelines for these meetings, according to the UP, require the “meetings to focus on ‘safety issues, rules and the state of the railroad’.” The UP management stated that meetings, which last up to 15 minutes, are supervised by a corridor manager or the region director or both. The manager of train dispatching publishes a monthly outline for the corridor managers to review, which includes suggested subject matter, such as recent rules, issues, and general operating concerns. The UP dispatchers reported that initially during these meetings, management discussed the Devine accident and emphasized safe dispatching operations. Several UP dispatchers have since reported that the subsequent meetings focused more on operations and less on safety and that because management often did not attend, the meetings were cancelled. According to the UP management on March 30, 1998, the requirement to conduct these meetings remains in effect. Violations -- The UP management reviews the dispatching tapes and produces a rules violation report13 when a dispatching error has occurred. According to the UP, before June 22, 1997, it had no formal process to monitor the issuance of track warrants containing a box 7 after-arrival order. Safety Board investigators examined the UP violation reports for the 6 months before and 1 month after the Devine accident. Four different dispatchers on five occasions, including the Devine accident, failed to read all or parts of the box 7 instruction of the track warrant. Three of these four dispatchers, including the third-shift dispatcher, had been trained in the last year before the Devine accident. The UP management reported that each of the box 7 rule violations was handled independently over a period of time and “each of these incidents was looked at from a global perspective” by the UP management. According to the UP, it noted that a possible common thread between these incidents was the experience level of the dispatchers involved and, as a result, it reviewed and expanded the section of its apprentice dispatcher program that focused on track warrant control authorities. The FRA review of the UP violation incidents occurring at the HDC from January through August 1997 indicated that 52 percent of all rule violations were by 7 of the 43 dispatching positions. The FRA reported that these seven dispatching positions typically had multiple authority territories or an unusually high number of track warrants, or both. The UP violation data also indicated that about 30 percent of the violations occurred within the first hour of an 8-hour shift. The UP reported that in July 1997, it implemented a track warrant audit process that involves the daily retrieval of printed copies of recent track warrants to compare with the issuing dispatcher’s audio recording. According to the UP, five track warrant issuances for each of three different train dispatchers are audited to determine whether the track warrant is issued

13Document generated by the UP for its use only.

16 and repeated exactly as it appears on the printed copy. The UP stated that it defined 13 categories of potential errors and that each track warrant is checked for compliance with these failure categories. Three failure categories were defined as “cardinal rules” that, if not met, require the immediate notification of the regional director for train handling with the involved train dispatcher. Meteorological Information At 10:51 p.m., the weather station at Hondo, which is 19 nautical miles northwest of Devine, reported clear skies with 10-mile visibility, 78°- F temperature, 71°-F dew point, and 11-knot winds. Medical, Pathological, and Toxicological Information Third-Shift Dispatcher -- Following the accident, the third-shift dispatcher was removed from service. Consistent with FRA regulations, he took a breath test and provided blood and urine specimens for postaccident alcohol and drug testing. About 2 a.m. on June 23, a breath test was administered to the dispatcher, who was then taken to a local hospital, where at 3:45 a.m., he provided blood and urine specimens, which were sent to and analyzed by Northwest Toxicology, Incorporated. The results of the urine analysis and the blood and breath test analyses were negative for drugs and for alcohol. 5981 North Traincrew -- The engineer was transported to an area hospital for treatment of superficial abrasions and released the same day. His postaccident toxicological testing was negative for drugs and alcohol. The body of the conductor of 5981 North was found adjacent to the track beneath wreckage debris. The autopsy report indicated that he had received severe chest and abdominal injuries, that he had sustained severe burn trauma, and that his right arm had been severed. The postaccident toxicological testing indicated the presence of ethyl alcohol in his blood (0.011 w/v%) and urine (0.024 w/v%). Northwest Toxicology, Incorporated, concluded, Based upon the information provided by the FRA regarding the putrefaction of the body and the low concentration of ethyl alcohol found, it cannot be determined whether the ethyl alcohol present in the blood and urine is due to antemortem consumption or postmortem production. 14 The severely burned and mangled bodies of two unidentified people, believed to have been the individuals who may have been riding on one of the 5981 North locomotive units, were found beneath wreckage debris on the pavement under the bridge near the POI. 9186 South Traincrew -- The body of the 9186 South engineer was found adjacent to the track about 126 feet north of the north bridge abutment. The autopsy report indicated that he had sustained severe chest injuries and blunt force trauma to the head. His postaccident toxicological testing was negative for drugs and alcohol. Within minutes after the collision, a firefighter found the conductor of 9186 South standing on the road on the east side of the overpass near the burning wreckage. He had sustained first and second degree burns to the face, torso, and leg, and was helicoptered to the U.S. Army Hospital in San Antonio for treatment. His postaccident toxicological testing was negative for alcohol but indicated the presence of morphine in both the urine (107,929 ng/ml) and blood (45 ng/ml). Morphine was administered to the conductor at the medical facility to which he was admitted. Emergency Response Shortly before 11 p.m. on June 22, 1997, a Devine Police Department (DPD) officer, on routine motor patrol near the UP track south of the railroad bridge at MP 290.4, reported that he observed a passing northbound train, heard a loud explosion sound, and noted that the passing train was rapidly decelerating. Seeing flames and black smoke at the railroad overpass in his

14The postmortem production of alcohol can occur during the decomposition process with no prior alcohol consumption.

17 rear view mirror, he radioed the DPD dispatch desk, which received the transmission at 10:52 p.m. and notified the Devine Volunteer Fire Department (DVFD) and the DPD with an “all- hands” respond request. Numerous 911 phone calls were also received from concerned residents reporting a loud explosion sound. While driving to the accident scene, the officer who had witnessed the event encountered the engineer of 5981 North, who had been injured after jumping from the northbound train; the engineer indicated that the other train possibly contained hazardous materials. Other police officers and an emergency medical service (EMS) ambulance and staff soon arrived at that location, which later functioned as the medical staging area for the accident. The EMS ambulance staff determined that the engineer of 5981 North did not have life-threatening injuries, and he was later transported by ambulance to a local hospital. The chief of the DVFD activated the Incident Command System and assumed control as the incident commander. A temporary command post was established on the west side of the overpass. Because the 5981 North engineer had indicated that hazardous materials may have been on board a train, the community disaster plan was implemented, and the Devine Emergency Management Coordinator was dispatched. The Chemical Transportation Emergency Center15 was contacted about 11:06 p.m. by the DPD, which also contacted the railroad to request hazardous materials consist information. The UP responded by phone and fax that no hazardous materials products were on board either train. Because of the concern about a toxic materials release, the DVFD chief had directed an evacuation of all residences within a 1/4-mile radius of the fire. The DPD had closed roads around the fire scene to all traffic but emergency vehicles. Between 75 and 100 residents were sheltered at the local high school and were permitted to return to their residences when the UP confirmed that no

15The center, operated by the Chemical Manufacturers Association, was established to provide initial and immediate information about handling hazardous materials and other chemicals. hazardous materials products were involved in the fire. The firefighting suppression effort continued to focus on the blaze, which reportedly flared several hundred feet high and was seen up to 30 miles away. About 1 a.m. on June 23, the fire had been substantially suppressed, and the DVFD chief directed that all water lines be shut down. About 1:37 a.m., the fire was declared under control. Survival Aspects Locomotive Cab Survivability -- On the northbound train, the operating cab had separated from the lead unit (UP5981) and was found crushed beneath the wreckage debris. The cab had been fully consumed by fire, and no survival space remained. On the southbound train, the operating cab of the lead unit (UP9186) had not been significantly crushed during the collision, but the cab and the entire unit were fully consumed by the fire. Fire and Rescue Services -- The 29- member DVFD provides exclusive firefighting support to Devine, a rural community of about 4,000 people. Supplementary firefighting support is available through mutual aid requests to neighboring communities. The DVFD is commanded by the chief (he works professionally for and in the city of San Antonio as a trained, full-time firefighter) and is supported by three assistant chiefs. At the time of the accident, the DVFD fire suppression equipment consisted of two conventional pump trucks (750 gpm and 1000 gpm) and three small support trucks. The DVFD’s support apparatus included ladders, nozzles and hoses, lights, self- contained breathing equipment, and a small stock of fire suppression foam. Municipal Disaster Plan -- The city of Devine has a comprehensive, documented plan (issued in 1990 and revised in August 1996), based on the State model, which is coordinated by the Emergency Management Coordinator and an assistant staffer of the Devine Emergency Management Agency. Under the plan, Devine conducts an annual simulated live-disaster exercise and a semiannual table-top drill. All the Devine municipal agencies (fire, police, emergency management, and public works)

18 participated in the most recent simulation exercise, which occurred about 6 months before the train accident. The exercise involved a hazardous materials truck fire in a congested residential neighborhood and the hazardous materials cleanup. The most recent table-top drill occurred about 1 year before the train accident. Tests and Research Sight Distance -- Sight distance tests, conducted from 10:15 p.m. on June 24 until 12:10 a.m. on June 25, 1997, indicated that given the topography of the area, visibility from the POI was unrestricted for a minimum of 4,000 feet for train 5981 North and of 6,400 feet for train 9186 South. Train Brake Controls -- Because of the accident damage to the lead locomotive unit on 5981 North, the control positions could not be determined. On the lead locomotive unit of 9186 South, the observed control positions were: automatic brake valve, handle in emergency; independent brake, applied; reverser, forward; throttle, idle; and dynamic brakes, off. Locomotive Event Recorders -- On August 11, 1997, the Safety Board laboratory received the Pulse Data Pack event recorder, the Pulse Data Pack DP-400 event recorder cartridge, and the speed indicator from locomotive UP4211 of train 5981 North; the Q- Tron event recorder, the UP event recorder download diskette, and the speed indicator from locomotive UP5084 of train 5981 North; and the burned remains of the event recorder from locomotive UP9186 of train 9186 South. The Pulse Data Pack event recorder from locomotive UP4211 was designed to record the time, distance traveled (miles), speed (mph), traction motor current (load amps), automatic brake setting, throttle position, independent brake pressure (psi), and reverser position. These digitally encoded parameters were sampled every 5 3/4 seconds. The data were then written to the magnetic tape in two consecutive and identical records of 2 7/8 seconds in length during the 5 3/4-second period between the samples. The data from the cartridge of the Pulse Data Pack event recorder from locomotive UP4211 were found to be anomalous when read out using equipment in the Safety Board laboratory. The recorder and its magnetic tape were taken to the manufacturer16 for analysis. The manufacturer indicated that the event recorder appeared to be operating properly and the magnetic tape could be read, but no input signals concerning traction motor current or brake reduction levels could be found. Locomotive UP5084 was equipped with a Q-Tron Datacord 5000 solid-state recording system that was designed to record the time, date, unit number, distance traveled (miles), speed (mph), traction motor current (load amps), brake pipe pressure (psi), throttle position, and brake cylinder pressure (psi). The parameter values were recorded whenever a parameter changed. The magnitude of the change necessary to trigger a parameter recording is preprogrammed into the recording system. The manufacturer of the Q-Tron recorder indicated that the maximum recording resolution of the recorder was 1/10 second, with the exception of speed, which was recorded at 1-second intervals. The collision log report from the locomotive UP5084 Q-Tron recorder read-out at the Safety Board laboratory follows: Recorder Train Time Speed Action 10:49:44 p.m. 43.6 mph Throttle position changed from 8 to 4. Traction motor current decreased steadily from 416 to 205 amps during the following 6 seconds. 10:49:50 p.m. 42.5 mph Throttle position changed from 4 to 0 and remained at 0 thereafter. Traction motor current decreased from 205 to 99 amps about 1 second later and gradually decreased to 0 amps during the following 4 seconds.

16Pulse Electronics, Incorporated, Rockville, Maryland.

19 10:49:52 p.m. 42.2 mph Brake cylinder pressure changed from 0 to 6 psi and increased to 76 psi during the following 10 seconds. 10:49:53 p.m. 41.7 mph Brake pipe pressure changed from 89 to 59 psi and decreased to 0 psi within 1 second. 10:50:23 p.m. 18.7 mph Brake cylinder pressure changed from 77 to 7 psi and decreased to 0 psi during the following 3 seconds. 10:50:25p.m.17 0 mph The type of event recorder equipment from locomotive UP4211 of train 5981 North and from locomotives UP9186 and UP6143 of train 9186 South was customarily carried in the nose section of the controlling end of the locomotive. The event recorder equipment from locomotive units UP5981 and UP5084 of train 5981 North was most likely located in the locomotive alcove either immediately on the right, attached to the sidewall, or on the left, attached to the bulkhead wall. No standards have been developed for the location of event recorder equipment. The event recorder from locomotive UP5981 of train 5981 North was destroyed by crushing force, and the event recorders on locomotives UP9186 and UP6143 of train 9186 South were destroyed by the fire. The Safety Board is working with the FRA, class 1 railroads, railroad employee union representatives, and locomotive event recorder and locomotive manufacturers to develop and implement an FRA rule detailing specific survivability standards that locomotive event recorders must adhere to. The Safety Board has encouraged the FRA to address the survivability of event recorders in all known or anticipated accident scenarios, considering the experience with other modal standards of event recorder crashworthiness. At the time of this report, the FRA had no anticipated date of issuance for the standards.

17The railroad recording time was not synchronized with the time of the police report. Other Information Nonsignalized Territory Accident Risk -- The Safety Board investigated an earlier accident having similar circumstances as those that occurred in the June 1997 Devine accident. On August 30, 1991, near Ledger, Montana,18 a Burlington Northern Railroad Company (BNSF)19 train was operating in dark (nonsignalized) territory, and the radio transmission for authority to the main track was improperly delivered. The train dispatcher failed to detect an improper read-back from the crew in the field. In the Ledger accident, the train dispatcher did not detect the crew’s misreading of a train station when the crew read the track warrant back to the train dispatcher. Thus, two trains had authority to proceed to the same block of track from opposite directions at the same time. The trains collided head-on and three crewmembers were fatally injured. After the Ledger collision, the BNSF determined that if the train dispatcher had to perform a physical or mechanical task during the repeat process, the failure to detect an incorrect read-back would be less likely to occur. The computerized system that BNSF uses was reprogrammed, and, during the read-back by the crews, the dispatcher must now perform specific tasks. The track warrant that the dispatcher originally issued is displayed on the computer screen, but the variable fields that are unique to this track warrant are not filled. As the crew reads the original track warrant to the train dispatcher, the train dispatcher follows along on the computer screen and a pull-down selection menu appears at each variable field. Within the pull-down menu are randomly generated numbers or station names. Only one of the choices corresponds to that in the original track warrant. The train dispatcher must select the correct “fill-in,” hit the enter key before the cursor will move on the screen, and fill all the

18For more information, see Railroad Accident Report--Head-On Collision between Burlington Northern Railroad Freight Trains 602 and 603 near Ledger, Montana, on August 30, 1991 (NTSB/RAR-93/01). 19The Burlington Northern Railroad Company and the Atchison, Topeka and Santa Fe Railway Company merged on October 1, 1995, and formed the Burlington Northern and Santa Fe Railway Company. The carrier is referred to as the BNSF throughout this report.

20 fields correctly before the screen will clear and allow the next task to be performed on the computer. In addition, the BNSF traincrews in the field are required to identify a specific train before using authority to the main track and must write the train ID, time passed, location passed, or current time and location on the track warrant form; they can be disciplined for not performing this activity. After the accident at Devine on June 22, 1997, the BNSF further modified its track warrant system to include a “total number of lines issued” statement at the end of the track warrant. If a train dispatcher is issuing a track warrant that has a box 7 after-arrival restriction, a total of nine lines for the track warrant may be created. If the train dispatcher fails to transmit the box 7 after-arrival restriction, yet informs the crew that they have been given a total of nine lines, the crew in the field should challenge the train dispatcher’s original transmission. Federal Railroad Administration -- The FRA began a review of the UP operations on August 23, 1997. Following this 14-day comprehensive safety inspection of the UP by Federal and State inspectors, the FRA announced on September 10, 1997, that the “findings of widespread safety deficiencies in the areas of training, dispatching, and employee fatigue are of great concern to the FRA, and we strongly encourage that our recommendations be implemented.” Based on the findings by the inspection team, the FRA recommended mandatory classes and job briefings for dispatchers, dispatcher supervisors, and other operating officials; management identification of the safety officer on duty; adequate training for all employees on all equipment they use; and adequate crew transportation for traincrews whose hours-of-service have expired. Between November 3 and 7, 1997, the FRA conducted another safety audit of the HDC and reported that it “observed inefficient and unsafe practices by supervisors and dispatchers at the HDC, which can be attributed to lack of training and extreme work overload.” Union Pacific Railroad Postaccident Actions -- According to the UP, since the Devine accident on June 22, 1977, it has developed a safety action plan for the HDC covering communication, dispatching training and staffing, and track warrant control. The plan is reviewed regularly within the HDC and with the FRA. A dispatching safety hot line has been established for employees to express their concerns and make suggestions regarding dispatching safety and rules issues. The UP is setting up focus teams of managers and dispatchers to develop policies and procedures for rules compliance, two-way communications, and dispatcher skill levels. The UP identified several corridor managers who had no experience as train dispatchers and has scheduled training for them in dispatching system procedures. An annual dispatcher retraining program has been initiated to include a complete review of safety rules. A mentor program has been established in which dispatchers with more than 5 years of experience coach one or more train dispatchers with less experience. The UP has also modified the train dispatcher selection, training, and qualification program. It has revised the dispatcher track warrant training module to include current process changes and suggestions from the FRA February 1998 Safety Assurance and Compliance Report and also revised its training manual. The UP has a staff of 15 dispatcher training personnel, in addition to the 8 positions that continue to support and develop train dispatching systems, and has hired 9 former train dispatchers and 39 apprentice train dispatchers during the 6 months since the Devine accident. In September 1997, the UP added to its staff a director of efficiency testing for the HDC and all UP centers with dispatching operations. Finally, the Austin subdivision was split in January 1998 to reduce the dispatcher workload. The UP stated that the visibility of the box 7 after-arrival instruction on the track warrant control and track warrant form has been enhanced and heightened on its computers. Dispatcher acknowledgment procedures have been implemented for box 7, as well as an interactive read-back feature. The UP has instituted an oral summary requirement for the box numbers and the total boxes checked in the

21 sending and receiving of every track warrant. According to the UP, it has discontinued the use of box 7 after-arrival authority in nonsignalized track warrant control territory and is signalizing the Austin subdivision from San Antonio to Laredo, which should be completed by December 31, 1998. Also, the UP is upgrading its digital dispatcher recording system to allow both sides of the train dispatcher conversation to be monitored. Safety Board Public Hearing -- In March 1998, the Safety Board conducted a 3-day public hearing in Springfield, Virginia, that concerned the safety oversight of the UP. The results of this hearing, “The Special Investigation of the Effectiveness of Safety Oversight on the Union Pacific Railroad,” will be addressed in future Safety Board reports.

22 General Factors The weather at the time of the collision was reported to be clear, with visibility of 10 miles, and did not adversely affect train operations. No mechanical problems or equipment failure were noted. During the pre- and postaccident inspections, no defects or deviations were found in the track or equipment. No evidence of dispatching computer equipment malfunction was found. A print-out of the track warrant information from the dispatcher’s computer confirmed the accuracy of track warrant 8289 for train 9186 South as presented on the computer screen. The previous and subsequent issuance of track warrants contained accurate information for other traincrews. A review of the UP records indicated that all crewmembers met the requirements as prescribed in the Hours-of-Service Act. Information obtained during the postaccident interview with the dispatcher did not indicate that he was fatigued. The data retrieved from the event recorders confirm that train 5981 North was handled in accordance with accepted train handling practices while operating on a track warrant as prescribed by the UP operating rules. Because event recorder data from train 9186 South were destroyed in the fire and no testimony could be obtained from the traincrew, the Safety Board could not retrieve information about the train’s functions and operations. Postaccident toxicological tests were negative for drugs and alcohol for the train dispatcher and the engineers of trains 5981 North and 9186 South. In the case of the deceased conductor of 5981 North, the alcohol levels detected were consistent with expected postmortem microbial production of ethanol. No evidence was found that alcohol had been consumed by the 5981 North conductor immediately before or during the trip, and his medical and personnel records contained no information relating to alcohol-related incidents or problems. The level of drugs found in the blood and urine specimens of the conductor of 9186 South was apparently due to drug administration after the accident. The Safety Board therefore concludes that neither the weather nor the train equipment or track caused or contributed to the collision. The computer-generated track warrant 8289 information was correct. Both operating traincrews were in compliance with the requirements specified in the Hours-of-Service Act and were qualified to perform their duties; no crewmember or dispatcher fatigue was indicated. Neither alcohol nor drug use appears to have been a factor in the accident. Accident Narrative During the issuance of track warrant 8289 to train 9186 South, the third-shift dispatcher failed to accurately communicate the track warrant information in its entirety to the traincrew from his computer screen as it was apparently displayed. He omitted the after- arrival instructions (hold the main track at Gessner until the arrival of train 5981 North) when formally issuing authorization to train 9186 South to proceed from Gessner to Melon. The recorded radio transcripts of the transmission between the dispatcher and the 9186 South traincrew substantiated that the dispatcher did not include the after-arrival instructions of track warrant 8289 to the crew. When the train 9186 South conductor repeated the track warrant back to the dispatcher, the third-shift dispatcher failed to confirm the accuracy of the read-back information from the crew with the display on the computer screen. Had the third-shift dispatcher done so, he would have noted the discrepancy between the track warrant that was displayed on his computer screen and the read-back information and could have corrected the inconsistency and provided the after-arrival instruction (hold the main track at Gessner until the northbound train had ANALYSIS

23 passed). Because train 9186 South was not notified to wait for the northbound train to pass at Gessner, it proceeded from Gessner toward the northbound train, which was earlier authorized to proceed and occupy the block of track from Melon to Gessner. Therefore, the Safety Board concludes that the third-shift dispatcher’s failure to accurately issue track warrant 8289 to train 9186 South and his failure to detect and correct the 9186 South conductor’s repeat of the track warrant authority limit resulted in the crew receiving an incorrect track warrant that allowed the opposing trains 5981 North and 9186 South to operate on the same track in opposite directions through Devine on June 22, 1997. Dispatcher Performance and Workload The third-shift dispatcher had been operating as a qualified dispatcher since August

1. Most of his experience had been

dispatching trains in dark (nonsignalized) territories, such as the one in which this accident occurred. He had no previous dispatching violations before June 22, 1997. During the 10 months before the Devine accident, the third- shift dispatcher had demonstrated sufficient knowledge of dispatching duties. He had accurately communicated track warrant information to other traincrews during previous and subsequent issuance of track warrants. However, he failed to accurately communicate the track warrant 8289 information to train 9186 South and to validate the line repeat-back from the conductor of that train. At the time of the Devine accident, the UP verification process of track warrants relied on the train dispatcher to detect an inaccurate read- back message and to ensure that a complete and accurate transmission was received from the traincrew. This verification process, in which the train dispatcher just followed the oral repeat- back received from the crew, did not provide a redundancy feature that would confirm whether an accurate repeat-back of the original transmission had registered with and been noted by the train dispatcher. On the day of the accident at Devine, the third-shift dispatcher understood that when communicating a track warrant to a traincrew, his primary tasks were to read the information as presented on the screen and verify its accuracy, comparing the oral read-back from the traincrew with the information on the screen; he believed that he had been following the established UP track warrant communication procedures. Track warrants have not been addressed in the CFR and, therefore, their use as a method of operation for train movement has not been federally directed. The Safety Board concludes that the third-shift dispatcher did not communicate the accurate information in track warrant 8289 to the crew of train 9186 South. Therefore, the Safety Board believes that the UP should evaluate its dispatcher training program and make necessary revisions to place greater emphasis on all safety critical activities including procedures used to issue and confirm track warrants. In addition, the Safety Board believes that the FRA should revise 49 CFR 220 to address track warrants and other current railroad operating practices. The third-shift dispatcher stated that on the night of the accident, his workload was “probably an average night for that position” and that from the start of his shift, he had received several radio calls and “it was busy.” Immediately after the shift changeover, he had to process the information just received from the departing dispatcher and prioritize the tasks that he was to perform during the shift. That night the dispatcher’s first task was the radio transmission with the delayed Amtrak train still on his territory, which was a rare occurrence for the beginning of this shift. Immediately after this, he turned his attention toward dispatching the UP trains and spent the majority of his initial time on the radio. The third-shift dispatcher issued the incomplete track warrant information to the crew of train 9186 South within the first 10 minutes of his shift. Veteran dispatchers at the HDC reported that the most difficult time of a shift is the first 30 minutes, when a dispatcher is “trying to assimilate everything” and mentally planning the operation of the territory. The Safety Board examined the UP dispatcher rule violations data and found that approximately 30 percent of the violations occurred within the first hour after the start of a new, 8-hour shift, particularly on territories of high-operating demands. The Safety Board concludes that the UP dispatchers’ elevated workload at the

24 beginning of shifts may contribute to the disproportionately greater number of dispatching violations occurring during this time. Therefore, the Safety Board believes that the UP should conduct an audit of its train dispatching operations to identify specific factors that can lead to dispatching errors and include in the audit an assessment of dispatching errors that occur during or shortly after shift changes or because of improper radio procedures. The Safety Board is concerned that an error similar to the one committed by the third-shift dispatcher was also committed by two other dispatchers, all of whom were trained in the year before the June 22, 1997, accident. The third- shift dispatcher, although reporting that he believed his training was adequate, stated, “How can training be equal to . . . a dozen radios going off and ten people yelling at you at the same time. . . . Having to deal with that sort of thing is hard.” The Safety Board therefore examined the challenges faced by less experienced dispatchers operating in territories of high-operating demands. Many of the territories to which less experienced dispatchers are initially assigned, such as the Austin subdivision, have nearly doubled in train volume since the early 1990s, when they may have been more easily dispatched because of the fewer trains operating. Such territories often pose operational challenges to even the most experienced dispatchers. Veteran dispatchers reported that under conditions of high-operating demands, less experienced dispatchers may issue track warrants while mentally or physically attending to their next task and not concentrating on the read-back communication from the train crewmembers. The FRA noted during its safety audit of the HDC that dispatchers working under high-workload conditions were not consistently monitoring the computer screens during read-backs of track warrants because of other task demands, which included answering the telephone, communicating with other dispatchers, and reading lineups and performing transfers with their relief shift dispatchers. Some dispatchers, as a result, may forgo safe dispatching practices in an attempt to manage the high-operating demands. The Safety Board is concerned that newly qualified dispatchers initially assigned to territories of high-operating demands may not have the opportunity to refine their skills to increase their dispatching efficiency. Rudimentary skills taught to apprentice dispatchers in the initial training program can be further developed as they operate in territories of moderate-operating demands. Those assigned to territories of high-operating demands who have not developed critical skills and strategies to operate efficiently may relinquish safe procedures to manage the high-operating demands. The box 7 after-arrival errors committed by the newly qualified dispatchers were the result of their omitting track warrant verification procedures, perhaps as a means to manage their dispatching duties. The Safety Board concludes that some UP apprentice dispatchers may not have been adequately prepared to be placed and operate safely in territories of high-operating demands immediately after completing the training program. The majority of all HDC dispatching errors for dispatchers occur in territories of high- operating demands. As train volume increases, the workload demands on the dispatcher likewise increase. The Safety Board is thus concerned that for both veteran and newly qualified dispatchers, the need to manage the steady increase in train traffic may jeopardize their ability to attend to all critical tasks and to dispatch trains safely. The UP has a study under way to determine which territories on its system pose the highest operating demands on its dispatchers. Several operational factors are being assessed, including the train volume, the number of track warrants issued, and the amount of time spent issuing track warrants. The Safety Board notes that this assessment is a critical step in determining where the greatest challenges are for the UP dispatchers but advises that a comprehensive evaluation of operational demands in a given territory needs to consider both the task and the knowledge, skill, and ability of the dispatchers, including the level of task demands, the operator’s mental and physical capacity, the

25 work strategy, and the skill level.20 For instance, one UP dispatcher with many years of experience indicated that handling 18 trains on his territory was not difficult for him; however, a less-experienced dispatcher working the same territory felt overloaded by the dispatching demands. The Devine accident demonstrates that not all qualified dispatchers are equally prepared to manage similar operating demands. The errors committed by qualified, but less experienced, dispatchers strongly indicate a need for careful consideration of the placement of dispatchers in territories of high-operating demands. The Safety Board believes that the UP should conduct an audit of its train dispatchers’ activities to evaluate the current workload and should make necessary changes to dispatcher operations to distribute workload based on the individual dispatcher’s qualifications, ability, and experience. Management Oversight Dispatcher Apprentice

Program

Although the UP had a policy that an apprentice dispatcher became a qualified dispatcher only with the full agreement of several officials involved in the training process and would be provided training until ready to work the position, the Safety Board found some instances in which these standards were not being upheld by management. Dispatchers indicated that management has qualified apprentice dispatchers despite opposition from some OJT dispatcher trainers involved in the training process, and dispatchers believed that the qualifying process has been compromised to expedite the placement of new dispatchers in the dispatching operations. The Safety Board concludes that the UP may have jeopardized safe dispatching operations by qualifying unprepared apprentice dispatchers and assigning less experienced dispatchers to territories of high-operating demands. Another area in which the UP did not adhere to its policies was in upholding the experience level of OJT dispatcher trainers for apprentice dispatchers. The UP management reported that

20Welford, A.T., “Mental Workload as a Function of Demand, Capacity, and Skill,” Ergonomics, 21, 1978, pp. 151-167. qualified dispatchers responsible for conducting the OJT for apprentice dispatchers must have at least 5 years of dispatching experience. According to UP dispatchers, however, dispatchers with less than 5 years of experience were training apprentice dispatchers. Some veteran dispatchers believed that 5 years should be the minimum experience level for an OJT dispatcher trainer. Since the accident at Devine, the UP has increased to 10 years the minimum experience level for the OJT dispatcher trainers. The Safety Board has learned from the UP dispatcher data that fewer than half of the UP dispatchers have attained this experience level and concludes that because the UP did not meet its 5-year experience standard for OJT dispatcher trainers, complying with the higher standard of a minimum 10-year experience level for OJT dispatcher trainers may not be achieved. Therefore, the Safety Board believes that the UP should examine the circumstances in which its policy to require a minimum 5 years of experience to qualify as an OJT dispatcher trainer was not followed and take action to ensure that the UP qualification policies are followed. Like many other railroads, the UP had no formal training or procedures for the dispatcher trainers who oversee the apprentice dispatchers during OJT. The FRA reported that in many railroads the OJT had been delegated to subordinates without adequate direction, control, or evaluation methods, which led to unstructured and inconsistent training. Although the FRA found no evidence during its reviews that inadequate dispatcher training directly resulted in train accidents, it noted that training directly impacts train dispatcher efficiency and productivity, which can impact safety. Additionally, the lack of well-defined training may contribute to train dispatcher stress and fatigue, as well as work overload. The Safety Board concurs with the FRA’s position. Therefore, the Safety Board believes that the UP should develop and implement a comprehensive program to select and train experienced dispatchers to serve as dispatcher trainers. The FRA report in 1995 stated that the FRA would publish in 1998 an ANPRM proposing minimum training standards for train dispatchers that include initial, periodic, refresher, and physical characteristic training and minimum

26 operating rule training and testing standards. The Safety Board urges the FRA to encourage the timely adoption and implementation of these standards. Dispatching Operations -- The safety of the system is directly dependent on the appropriate actions of those operating in safety- sensitive areas. Management has a responsibility to establish an operating environment most conducive to safe operations. The Safety Board examined the UP management efforts to ensure a safe and efficient operating environment for the dispatchers. Although the UP policies do address many critical safety-sensitive areas, the Safety Board has identified areas in which actual company practice has fallen short of company standards. The Safety Board understands that apprentice dispatchers have become qualified dispatchers without the concurrence of OJT dispatcher trainers or the apprentice dispatcher trainee. Newly qualified dispatchers have been placed in territories of high-operating demands without the benefit of developing skills through experience. By failing to accommodate the needs of less experienced dispatchers and by not adhering to its own standards, the UP failed to create an environment conducive to safe dispatching operations. Consequently, the Safety Board concludes that the third-shift dispatcher’s failure to communicate the information in track warrant 8289 accurately to the 9186 South traincrew and to verify the accuracy of the read-back information resulted from operational shortcomings at the HDC. The UP company policy did not require that corridor managers have previous dispatching experience, and some did not. Although during normal operations this typically does not pose a problem, dispatchers expressed frustration with what they perceived as poor decisions by some corridor managers during more complex operating situations. Dispatchers reported that during the daily safety and production meetings, some corridor managers lent support to the dispatchers’ workload challenges on their territories, and other corridor managers were not interested in discussing the problems experienced by the dispatchers. As a result, dispatchers sought advice from other sources, such as upper management officials, when confronting certain complex situations. The Safety Board concludes that some UP corridor managers did not consistently provide appropriate technical support to the train dispatchers. Therefore, the Safety Board believes that the UP should evaluate and determine the technical expertise required of corridor managers and make the necessary changes to ensure that corridor managers are qualified to provide proper dispatching assistance to the train dispatchers. The UP train dispatchers also expressed concern about the noise level originating from adjacent dispatching stations at the HDC. The noise level is highest during the shift changeover when the dispatchers brief their replacements about the status of their territories. Waist-high barriers separate dispatchers from each other, but do not block out distracting conversations. Higher partitions, used at some dispatch centers, serve better as sound barriers and provide a quieter working environment. The Safety Board has investigated accidents in which distractions hindered the performance of a safety-critical operator. The Safety Board concludes that although no evidence was found that adjacent noises in the dispatching area contributed to the third-shift dispatcher’s inattention to the track warrant 8289 information in the Devine accident, a dispatcher’s performance may be affected by unnecessary, avoidable sound distractions. Therefore, the Safety Board believes that the UP should identify all distractions, evaluate their effects on dispatchers, and take action to establish a working environment conducive to safe dispatching operations. After-Arrival Conditional Authority -- The use of after-arrival instructions creates an inherent danger by giving a traincrew conditional authority, under which, if a condition is met, their train is allowed to proceed into a block of track even though that track is occupied by an opposing train. (In the Devine accident, the condition was the physical passing of another train.) Should a failure occur in the transmission or comprehension of a track warrant that results in the omission or inaccurate communication of the condition, two opposing trains may occupy the same block of track at the same time, as they did in the Devine accident. Once an error has occurred in dark

27 (nonsignalized) territory and two trains are on the same track at the same time, no wayside signals are available to warn one train of the presence of the other. After the 1991 Ledger train collision, the BNSF dispatching system was reprogrammed to add another protection barrier against the occurrence of a train dispatcher error. If the train dispatcher does not correctly apply the read-back information from the traincrew, the computer screen does not clear, and the next computer screen display will not appear. This redundancy feature increases protection against dispatcher error in the BNSF dispatching system. The UP attempted to mitigate the risk of a dispatcher error by adding a warning system that required the train dispatcher to acknowledge a message on the computer screen. In the UP dispatching system, the UP elected to display its track warrant box 7 (“not in effect until after arrival of”) on the computer screen to reduce the risk of a dispatcher error and a train collision. The Safety Board has investigated other railroad accidents in which the avoidance of a collision depended on the use of a rule or standard operating practice that proved to be insufficient to prevent an accident. In the Devine accident, the third-shift dispatcher failed to adhere to procedural policy and to follow verbatim the read-back message from the traincrew. The system employed by the UP at the time of the Devine accident allowed for such a failure to occur and permitted the third-shift dispatcher to overlook a critical element during the issuance of track warrant 8289. Hence, the UP method used for dark (nonsignalized) territory operations needs to be revised to ensure that an oversight by a dispatcher cannot occur. The Safety Board concludes that had the UP after-arrival system in dark (nonsignalized) territory operations not been used in the Devine accident area, the opposing trains 5981 North and 9186 South would not have been occupying the same block of track. Therefore, the Safety Board believes that the UP should discontinue permanently the use of after-arrival orders in dark (nonsignalized) territory The Safety Board also believes that the FRA should require railroads to discontinue permanently the use of after-arrival orders in dark (nonsignalized) territory. Federal Railroad Administration Train Dispatching Oversight The Safety Board has previously examined the FRA oversight of train dispatching. After the Safety Board investigated the derailment of an Amtrak train at Fall River, Wisconsin,21 in October 1986, it urged the FRA to: Conduct a thorough study of the selection process, training, duties, and responsibilities of train dispatchers to determine whether the workload is beyond the normal job stress level and to determine what selection and training standards are used for train dispatchers. Establish selection and training standards and limits of workload for dispatchers. (Safety Recommendation R-87-66) In 1990, the FRA reported to the U.S. Congress that the imposition of Federal training standards for train dispatchers was not necessary. The FRA based its judgment on a number of factors that it found during the FRA nationwide review of train dispatching. In a September 1991 letter to the Safety Board, the FRA wrote of its intent to implement a formal research and development study of dispatcher training programs, workload measurement models, occupational stresses, and fatigue effects. The FRA stated in January 1995 that it had found that train dispatchers continue to provide safe, efficient service to the industry; however, it believed that several dispatching areas, particularly training and testing, had shortcomings. In February 1995, the Safety Board advised the FRA that it was disappointed that many of the study’s findings and concerns were not adequately addressed in the published recommendations for action. For example, the study identified several major safety-related problems in the occupational stress, workload, and environmental policies affecting dispatchers, but the FRA still has not completed satisfactory regulatory activity to establish

21For more information, see Railroad Accident Report--Derailment of Amtrak Passenger Train 8 Operating on the Soo Line Railroad, Fall River, Wisconsin, on October 9, 1986 (NTSB/RAR-87/06).

28 dispatcher standards. Therefore, the Safety Board concludes that the FRA has failed to develop dispatcher standards and needs to accelerate the establishment of regulatory standards for train dispatchers. Because the FRA has only partially met the intent of Safety Recommendation R-87-66 by conducting a study of the selection process, training, duties, and responsibilities of train dispatchers, the Safety Board is classifying Safety Recommendation R-87-66 “Closed-- Unacceptable Action/Superseded” and issuing a new safety recommendation to the FRA. The Safety Board believes that the FRA should develop and establish dispatcher selection and training standards, dispatcher trainer standards, and workload limits for dispatchers by January 1, 2000. During its investigation of a train collision that occurred on July 30, 1988, near Altoona, Iowa,22 the Safety Board examined the FRA’s surveillance and enforcement of compliance with Federal regulations. The Safety Board cited the FRA as contributing to the cause of the Altoona accident because of the inadequate FRA surveillance and enforcement of compliance with Federal regulations. After its investigation of the August 1991 Ledger head-on collision between two BNSF freight trains, the Safety Board found that several procedural dispatching errors occurred during the train radio transmissions that precipitated the accident. Three years before the Ledger accident, the FRA, in its National Train Dispatcher Safety Assessment of 1987-88, had recommended that the BNSF immediately implement a program for dispatchers to teach and enforce radio procedures that comply with all applicable Federal and carrier radio rules. The Safety Board found that had either the FRA or the BNSF adequately followed up on the recommendations to the BNSF, the Ledger accident would not have happened.

22For more information, see Railroad Accident Report -- Head-On Collision between Iowa Interstate Railroad Extra 470 West and Extra 406 East with Release of Hazardous Materials near Altoona, Iowa, July 30, 1988 (NTSB/RAR-89/04). Following the Devine accident in June 1997, the FRA documented significant dispatcher procedural deficiencies at the HDC that had preexisted that accident. Although the FRA had in place a routine operating practices oversight program for the HDC, the FRA has no record that its previous routine inspections had cited these dispatcher procedural deficiencies. The Safety Board concludes that the FRA surveillance and enforcement of compliance with Federal regulations at the HDC before the Devine accident were inadequate and ineffective. Therefore, the Safety Board believes that the FRA should evaluate its surveillance and enforcement activities at dispatching centers and take appropriate corrective actions to ensure that Federal oversight is adequate and effective. Emergency Response and Disaster Preparedness Within minutes of the collision, a DPD officer, as well as the first fire, rescue, and EMS personnel, had arrived on scene. The chief of the DVFD activated the Incident Command System and assumed control as incident commander. He acted effectively and managed the incident successfully to completion without serious injury to responders, local residents, or officials at the accident site. However, the DVFD did not have access to an adequate amount of fire suppression foam equipment that would have further aided its efforts to mitigate the massive fire that ensued after the collision. Such equipment is not readily available for rural fire departments, although hazardous materials are routinely transported through their jurisdictions. The increase in rail traffic on the San Antonio to Laredo railroad corridor indicates a need for such readily available firefighting equipment to mitigate a fire event such as the one that occurred in the Devine accident. Therefore, the Safety Board concludes that although the local emergency response was timely and adequate, the lack of readily available fire suppression foam equipment shows a need for additional firefighting equipment to mitigate significant fire events. Consequently, the Safety Board believes that the Texas Railroad Commission should develop a system that would make fire suppression foam equipment readily available to emergency management agencies and local rural fire departments for the fighting of hazardous materials fires.

29 Crashworthiness Locomotives -- The operating cab of the lead locomotive of train 5981 North had separated from the unit, was found crushed beneath the pile of wreckage debris, and was fully consumed by the fire. Based upon the engineer’s statement, he was able to successfully jump from the unit several hundred feet before impact and landed on the ground immediately adjacent to the railroad right-of- way. The body of the conductor was found adjacent to the track beneath wreckage debris north of the north bridge abutment. Given the injuries sustained, massive crush, and severe burn trauma, his death resulted from being crushed near the POI beneath wreckage debris, which was further engulfed in the fire. Based on the available evidence, the conductor may not have jumped before impact but may have been on or near the left front corner of the locomotive at the time of impact. Upon collision, the impact momentum may have resulted in his body being thrown and then crushed by wreckage debris of the derailing equipment, which then caught afire. Fragments of two unidentified, severely traumatized and burned bodies, suspected to be transients, were found beneath wreckage debris near the POI. The likely location of the two people before the collision was either in the cab of the second locomotive, which was crushed and overridden by wreckage, or beneath the floorboards of the lead locomotive, which was fully crushed by wreckage. The operating cab of the lead locomotive of train 9186 South was not significantly crushed on impact, but the unit derailed and was then fully consumed by the massive fire. Based on the evidence, the two crewmembers apparently exited the locomotive with the intention of jumping clear before impact. The body of the engineer was found adjacent to the track. Given the location of the body and the injuries sustained, he died as a result of his impact with the ground. The conductor was found standing on the road beneath the bridge near the burning wreckage. Given his severe burn injuries and the lack of ground-impact type injuries, he probably was subjected to the heat of the massive fire after jumping clear of the locomotive very close to the POI. Based upon the estimated speeds of the locomotives at impact, the loss of survival space in the locomotives, and the severity of the massive fire, the Safety Board concludes that the collision in Devine was not survivable for crewmembers or anyone occupying the locomotive equipment at the time of the impact. Event Recorders -- In its investigations, the Safety Board relies on data recovered from the event recorders to determine train speed, direction of travel, distance, throttle position, brake application, and cab signal aspects, when applicable, before and during an accident. As was demonstrated in the Safety Board’s investigation of the February 1996 freight train derailment near Cajon Junction, California,23 certain critical data are retrieved only in the event recorder of the lead locomotive unit and not in the event recorders of the trailing units. In the Devine accident, the event recorder data for train 9186 South and the lead locomotive of train 5981 North were destroyed by impact forces or fire, or both, and critical event recorder data were lost that could not be retrieved from the other event recorders. The Safety Board has investigated other accidents in which the event recorder data were compromised due to impact forces or water or fire exposure. In its Corona, California,24 Knox, Indiana,25 and Mobile, Alabama,26 accident investigations, the Safety Board found that critical operational data were lost because the

23For more information, see Railroad Accident Report--Derailment of Freight Train H-BALT1-31 Atchison, Topeka and Santa Fe Railway Company near Cajon Junction, California, on February 1, 1996 (NTSB/RAR-96/05). 24For more information, see Railroad Accident Report--Atchison, Topeka and Santa Fe Railway Company (ATSF) Freight Trains ATSF 818 and ATSF 891 on the ASTF Railway in Corona, California, on November 7, 1990 (NTSB/RAR-91/03). 25For more information, see Railroad Accident/Incident Summary Report -- Knox, Indiana -- September 17, 1991 (NTSB/RAR-92/02/SUM). 26For more information, see Railroad Accident Report--Derailment of Amtrak Train No. 2 on the CSXT Big Bayou Canot Bridge near Mobile, Alabama, on September 22, 1993 (NTSB/RAR-94/01).

30 event recorders were not crashworthy. Since 1993, when the FRA required the use of locomotive event recorders, the Safety Board has advocated the development of standards for the crashworthiness of these devices. Three of the five event recorders in the Devine accident were destroyed either from crash forces or fire exposure. The event recorder on the lead locomotive of 5981 North was destroyed by damage incurred in the accident. Data were recovered from the event recorders on the two trailing locomotives of 5981 North. The event recorders on the lead locomotive and the trailing locomotive of 9186 South were destroyed in the postaccident fire. From a fire resistance standpoint, the type of encasement employed by the manufacturer did not protect the event recorders from thermal destruction. None of the event recorders on the locomotives were designed to meet crash forces or fire exposure standards. The Safety Board concludes that had the event recorders been designed to withstand crash forces and fire exposure, the three destroyed event recorders would have survived and could have provided data for the investigation. The Safety Board is familiar with the crashworthiness standards in the aviation industry that require the ability to withstand impact shock forces of 3,500 g27 and fire exposure at 1,100° F for 1 hour, which allow the retrieval of event recorder data after a catastrophic event occurs to the aircraft. Similar standards are not available in the railroad industry. Although the FRA assured the Safety Board in August 1997 that actions have been taken to develop standards for crashworthiness, no standards have been established. Therefore, the Safety Board believes that the FRA, working with the railroad industry, should develop and implement event recorder crashworthiness standards for all new or rebuilt locomotives by January 1, 2000.

27An acceleration equal to the acceleration of gravity, about 32 feet per second per second. Positive Train Separation Control Systems A positive train separation (PTS) control system can prevent trains from colliding by automatically intervening in the operation of a train when an engineer does not comply with the requirements of a signal indication or operating rules. The Safety Board has long advocated a PTS control system and since 197028 has issued safety recommendations calling for this prevention measure. Since most train collisions result from human error, a highly effective train control system is needed as a preventive measure. Greater security is provided by a train control system capable of intervening should a failure to observe signals and operating rules occur for whatever reason. Following its investigation of the head-on collision between two BNSF freight trains near Ledger, the Safety Board urged the FRA in July 1993 to: Establish a firm timetable that includes at a minimum, dates for final development of required advanced train control system hardware, dates for an implementation of a fully developed advanced train control system, and a commitment to a date for having the advanced train control system ready for installation on the general railroad system. (R-93-12) The Safety Board classified Safety Recommendation R-93-12 “Open--Acceptable Response” on July 8, 1994, after the FRA took action to seek the “final system definition, migration path, and timetable” for a PTS control system by December 1994. The Safety Board has investigated numerous train collisions in which the probable cause or contributing cause was the inattention of the traincrew to wayside signals. After its investigation of the Thedford, Nebraska,29

28For more information, see Railroad Accident Report--Head-on Collision Between Penn Central Trains N-48 and N-49 at Darien, Connecticut, August 20, 1969 (NTSB/RAR-70/03). 29For more information, see Railroad Accident Report--Collision and Derailment Involving Three

31 accident, the Safety Board stated that had a PTS control system been in place, it could have detected that the engineer was not responding appropriately to the signal indications and could have slowed and stopped the train, thus preventing the collision. The Silver Spring, Maryland, accident30 in February 1996 was the latest in a series of collisions that could have been prevented if a PTS control system had been in place. The Safety Board determined that the probable cause of the accident was the apparent failure of the engineer and the traincrew because of multiple distractions to operate their train according to signal indications and the failure of the FRA, the Federal Transit Administration, the Maryland Mass Transit Administration, and the CSX Transportation Inc. . . . to provide a redundant safety system that could compensate for human error. As a result of the Silver Spring accident investigation, the Safety Board reiterated Safety Recommendation R-87-16, which asked the FRA to promulgate Federal standards to require the installation and operation of a train control system on main line tracks that will provide for positive separation of all trains,31 and Safety Recommendation R-93-12. The FRA and the railroad industry share responsibility for the development and implementation of a PTS control system. Under its regulatory authority, the FRA can order a railroad to install a PTS control system. In the Devine accident, a PTS control system could have detected that the 9186 South engineer was not responding appropriately to the track warrant and then have slowed and stopped the train, thus preventing the head-on collision. The Safety Board concludes that had a PTS control

Burlington Northern Freight Trains near Thedford, Nebraska, on June 8, 1994 (NTSB/RAR-95/03). 30For more information, see Railroad Accident Report--Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation Amtrak Train 29 near Silver Spring, Maryland, on February 16, 1996 (NTSB/RAR- 97/02). 31Issued to the FRA in May 1987 after the review of accident investigations since 1967 in which the accidents could have been prevented had a mandated train separation system been in effect. system been installed and working in the Devine accident area, the two trains would not have been allowed to enter the same block of track traveling in opposite directions and, as a result, the head-on collision on June 22, 1997, would not have occurred. Therefore, the Safety Board reiterates Safety Recommendation R-87-16 to the FRA.

32 Findings

1. Neither the weather nor the train equipment

or track caused or contributed to the collision. The computer-generated track warrant 8289 information was correct. Both operating traincrews were in compliance with the requirements specified in the Hours-of-Service Act and were qualified to perform their duties; no crewmember or dispatcher fatigue was indicated. Neither alcohol nor drug use appears to have been a factor in the accident.

1. The third-shift dispatcher’s failure to

accurately issue track warrant 8289 to train 9186 South and his failure to detect and correct the 9186 South conductor’s repeat of the track warrant authority limit resulted in the crew receiving an incorrect track warrant that allowed the opposing trains 5981 North and 9186 South to operate on the same track in opposite directions through Devine on June 22, 1997.

1. The

third-shift dispatcher did not communicate the accurate information in track warrant 8289 to the crew of train 9186 South.

1. The Union Pacific Railroad dispatchers’

elevated workload at the beginning of shifts may contribute to the disproportionately greater number of dispatching violations occurring during this time.

1. Some Union Pacific Railroad apprentice

dispatchers may not have been adequately prepared to be placed and operate safely in territories of high-operating demands immediately after completing the training program.

1. The Union Pacific Railroad may have

jeopardized safe dispatching operations by qualifying unprepared apprentice dispatchers and assigning less experienced dispatchers to territories of high-operating demands.

1. Because the Union Pacific Railroad did not

meet its 5-year experience standard for OJT dispatcher trainers, complying with the higher standard of a minimum 10-year experience level for OJT dispatcher trainers may not be achieved.

1. The third-shift dispatcher’s failure to

communicate the information in track warrant 8289 accurately to the 9186 South traincrew and to verify the accuracy of the read-back information resulted from operational shortcomings at the Harriman Dispatch Center.

1. Some Union Pacific Railroad corridor

managers did not consistently provide appropriate technical support to the train dispatchers.

1. Although no evidence was found that

adjacent noises in the dispatching area contributed to the third-shift dispatcher’s inattention to the track warrant 8289 information in the Devine accident, a dispatcher’s performance may be affected by unnecessary, avoidable sound distractions.

1. Had the Union Pacific Railroad after-arrival

system in dark (nonsignalized) territory operations not been used in the Devine accident area, the opposing trains 5981 North and 9186 South would not have been occupying the same block of track.

1. The Federal Railroad Administration has

failed to develop dispatcher standards and needs to accelerate the establishment of regulatory standards for train dispatchers. CONCLUSIONS

33

1. The

Federal Railroad Administration surveillance and enforcement of compliance with Federal regulations at the Harriman Dispatch Center before the Devine accident were inadequate and ineffective.

1. Although the local emergency response was

timely and adequate, the lack of readily available fire suppression foam equipment shows a need for additional firefighting equipment to mitigate such significant fire events.

1. Based upon the estimated speeds of the

locomotives at impact, the loss of survival space in the locomotives, and the severity of the massive fire, the collision in Devine was not survivable for crewmembers or anyone occupying the locomotive equipment at the time of the impact.

1. Had the event recorders been designed to

withstand crash forces and fire exposure, the three destroyed event recorders would have survived and could have provided data for the investigation.

1. Had a positive train separation control

system been installed and working in the Devine accident area, the two trains would not have been allowed to enter the same block of track traveling in opposite directions and, as a result, the head-on collision on June 22, 1997, would not have occurred. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the failure of the third-shift dispatcher to communicate the correct track warrant information to the traincrew and to verify the accuracy of the read-back information because the Union Pacific Railroad management had not established and implemented workload policies and operational procedures to ensure a safe dispatching system and the Federal Railroad Administration had failed to provide standards and oversight in all aspects of train dispatching operations. Contributing to the accident was the lack of an installed positive train separation control system that would have prevented the trains from colliding by automatically intervening in their operation because of inappropriate actions being taken.

34 As a result of its investigation, the National Transportation Safety Board makes the following recommendations: -- to the Union Pacific Railroad: Evaluate your dispatcher training program and make necessary revisions to place greater emphasis on all safety critical activities including procedures used to issue and confirm track warrants. (R-98-18) Conduct an audit of your train dispatching operations to identify specific factors that can lead to dispatching errors and include in the audit an assessment of dispatching errors that occur during or shortly after shift changes or because of improper radio procedures. (R-98-19) Conduct an audit of your train dispatchers’ activities to evaluate the current workload and make necessary changes to dispatcher operations to distribute workload based on the individual dispatcher’s qualifications, ability, and experience. (R-98-20) Examine the circumstances in which your policy to require a minimum 5 years of experience to qualify as an OJT dispatcher trainer was not followed and take action to ensure that your qualification policies are followed. (R-98-21) Develop and implement a comprehensive program to select and train experienced dispatchers to serve as dispatcher trainers. (R-98-22) Evaluate and determine the technical expertise required of corridor managers and make the necessary changes to ensure that corridor managers are qualified to provide proper dispatching assistance to the train dispatchers. (R-98-23) Identify all distractions, evaluate their effects on dispatchers, and take action to establish a working environment conducive to safe dispatching operations. (R-98-24) Discontinue permanently the use of after-arrival orders in dark (nonsignalized) territory. (R-98-25) --to the Federal Railroad Administration: Revise 49 Code of Federal Regulations 220 to address track warrants and other current railroad operating practices. (R-98-26) Require railroads to discontinue permanently the use of after-arrival orders in dark (nonsignalized) territory. (R-98-27) Develop and establish dispatcher selection and training standards, dispatcher trainer standards, and workload limits for dispatchers by January 1, 2000. (R-98-28) Evaluate your surveillance and enforcement activities at dispatching centers and take appropriate corrective actions to ensure that Federal oversight is adequate and effective. (R-98-29) RECOMMENDATIONS

35 Working with the railroad industry, develop and implement event recorder crashworthiness standards for all new or rebuilt locomotives by January 1, 2000. (R-98-30) --to the Texas Railroad Commission: Develop a system that would make fire suppression foam equipment readily available to emergency management agencies and local rural fire departments for the fighting of hazardous materials fires. (R-98-31) Also, as a result of its investigation, the National Transportation Safety Board reiterates the following recommendation: --to the Federal Railroad Administration: Promulgate Federal standards to require the installation and operation of a train control system on main line tracks that will provide for positive separation of all trains. (R-87-16) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman ROBERT T. FRANCIS II Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member May 19, 1998

this page intentionally left blank

this page intentionally left blank

FD07211 ｜ 1998_美国_RAR9803.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1998 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

PB98-916303 NTSB/RAR-98/03 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT DERAILMENT OF AMTRAK TRAIN 4, SOUTHWEST CHIEF, ON THE BURLINGTON NORTHERN SANTA FE RAILWAY NEAR KINGMAN, ARIZONA AUGUST 9, 1997 6912B

Abstract: About 5:56 a.m., on August 9, 1997, National Railroad Passenger Corporation (Amtrak) train 4, the Southwest Chief, derailed on the Burlington Northern Santa Fe Railway tracks about 5 miles northeast of Kingman, Arizona. The engineer and assistant engineer saw a “hump” in the track as they approached bridge 504.1S. The train derailed as it crossed the bridge. Subsequent investigation revealed that the ground under the bridge’s supporting structure had been washed away by a flash flood. One hundred seventy-three passengers and 10 Amtrak employees were injured. No fatalities resulted. Damages totaled about $7.2 million. The major safety issues discussed in this report are: safety of structures subject to damage in severe storms, passenger safety and emergency response procedures, and protection of employees on or adjacent to the track in the performance of their duties. As a result of its investigation, the National Transportation Safety Board issued recommendations to the Burlington Northern Santa Fe Corporation, the Federal Railroad Administration, the Federal Highway Administration, the Arizona Department of Transportation, Amtrak, the Mohave County Sheriff’s Department, the International Association of Chiefs of Police, the National Sheriffs’ Association, the Association of American Railroads, and the American Short Line and Regional Railroad Association. Also, the Safety Board reiterated one safety recommendation to the Federal Railroad Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov/. Other information about available publications may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (202) 314-6551 (800) 877-6799 Safety Board publications may be purchased, by individual copy or by subscription, from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (703) 605-6000

Railroad Accident Report Derailment of Amtrak Train 4, Southwest Chief, on the Burlington Northern Santa Fe Railway near Kingman, Arizona August 9, 1997 Notation 6912B Adopted August 31, 1998 National Transportation Safety Board 490 L’Enfant Plaza East, S.W. Washington, D.C. 20594

this page intentionally left blank

August 7, 2003 On August 31, 1998, the National Transportation Safety Board adopted final report on the accident. Following the report’s adoption, the Burlington Northern Santa Fe Corporation sent the Safety Board a Petition for Reconsideration, dated December 3, 1998. Based on this petition, the Safety Board reopened the investigation and contracted for additional research to be conducted by the civil engineering consulting firm Ayres Associates. a The Safety Board used the information developed by Ayres Associates to supplement the original investigation. Based on the new information, the Safety Board amended the report by adding text, revising text, and revising findings as summarized below. A concurring statement was added, and this statement is also included below. For more information, see the full Response to Petition for Reconsideration at the Safety Board website . The following text is inserted at page 22 before the “Signals” section: Results of Study by Ayres Associates After the completion of its initial investigation of this accident, the Safety Board contracted with Ayres Associates of Fort Collins, Colorado, a civil engineering consulting firm, to perform additional tests and research, to include a hydraulic analysis and a hydrology study.1 This information was used to supplement the original investigation and provide additional information on the relationship between the Burlington Northern Santa Fe Corporation railroad bridge and the ADOT highway bridge. The tests and research assigned to Ayres Associates had two objectives: • Reanalyze the hydrology and hydraulics and conduct a detailed scour analysis of the failure of BNSF bridge No. 504.1S near Kingman, Arizona, on August 9, 1997. • Determine the relationship between the scour at the BNSF bridge and the ADOT reinforced concrete box (RCB) culvert located approximately 1,000 feet downstream.

1 Ayres Associates Final Report: Hydraulic, Erosion, and Scour Analysis of the 1997 BNSF Bridge Failure Near Kingman, Arizona. March 2001.

a-1

As part of its work on this project, Ayers Associates developed the following timeline: BNSF Bridge 504.1 Historical Timeline Year Comment 1883 Single main track constructed (now north track); consisted of 4 timber spans with total length of 37 feet.a 1907 Bridge 504.1N replaced on driven timber piles, bridge length 37 feet. 1922 South track and bridge 504.1S constructed on mud sills on hardpan. 1934 Hwy 66 with box culvert constructed 1,000 ± feet downstream of bridge 504.1N. 1940 Bridge 504.1N replaced; it is on driven timber pile bents; piles range from 19 to 22 feet from cutoff to pile bottom. 1940 ATSF records show a drainage area of 3.8 square miles draining to the bridge. 1954 Aerial photograph shows a headcut approximately 580 feet upstream of Hwy 66 culvert. 1958 ATSF replaces mud sills for bridge 504.1S. 1959 ATSF bridge inspector recommends putting grout and stone between spans 1 and 2. Work performed 1964. 1963 Stock tank constructed immediately upstream of bridge. 1964 Grout and stone placed between spans 1 and 2. 1966 Inspection records indicate riprap floor first placed in 1966. 1967 Aerial photograph shows a headcut approximately 690 feet upstream of Hwy 66 culvert. 1971 ADOT widens Route 66 and extends concrete box culvert 20 feet upstream. 1975 Bridge inspector first notices some erosion at the streambed under the railroad bridge. 1/2/1975 ATSF engineering department letter recommends replacing bridge 504.1 under 1977 CIP because of scouring at mud sills. 1975 ATSF bridge forces place grout and stone between spans 2 and 3.

a-2

BNSF Bridge 504.1 Historical Timeline Year Comment 12/9/1975 ATSF engineering calculates 19.09 square-mile drainage area. 1976 Aerial photograph shows a headcut approximately 760 feet upstream of Hwy 66 culvert. 1/13/1976 Hydraulic calculations, sketch of bridge opening, and flow line elevation with initials AAM made, flow line Elev. 3272.34 NAVD. 1/13/1976 ATSF management expresses concern about proposed concrete crosswall and removal of the bridge from the 1977 CIP. 5/18/1976 ATSF maintenance-of-way forces install concrete crosswall on downstream side of bridge. 1976 More riprap and grout placed in July; grouted riprap lined entire channel under bridge but upstream and downstream extent unknown. 5/1976 Bridge 504.1 removed from 1977 CIP. 7/24/1976 High water recorded over top rail. 7/29/1976 High water measured over 2 inches above base of bridge rail. 1978 Aerial photograph shows a headcut approximately 775 feet upstream of Hwy 66 culvert. 4/5/1987 I-90 bridge over Schoharie Cr., Albany, NY, fails killing 10 people. 4/29/1988 NTSB determines probable cause of I-90 bridge failure was severe erosion in the soil beneath the spread footing; spread footings without piles had supported the piers. 9/1988 FHWA issues TA5140.20 and “Interim Procedures for Evaluating Scour at Bridges.” TA5140.20 requires the States to evaluate all their bridges over water for scour. The interim procedures and subsequent HEC-18 states: a. Spread Footing on Soil Insure that top of the footing is below the sum of the long term degradation, contraction scour, and lateral migration. Place the bottom of the footing below the total scour line from step 4. Top of the footing can act as a local scour arrestor.

a-3

BNSF Bridge 504.1 Historical Timeline Year Comment 2/1991 FHWA issues HEC-18, “Evaluating Scour at Bridges,” which replaces “Interim Procedures for Evaluating Scour at Bridges.” 10/28/1991 FHWA issues TA5140.23, which supersedes TA5140.20. 1992 Aerial photograph shows a headcut approximately 930 feet upstream of Hwy 66 culvert, within 50 feet of crosswall. 1993 FHWA issues second edition of HEC-18. 1995 FHWA issues third edition of HEC-18. 2/18/1997 BNSF bridge inspector performs programmed bridge inspection. 7/3/1997 Aerial photograph shows a headcut approximately 930 feet upstream of the Hwy 66 culvert. 7/9/1997 BNSF bridge inspector performs bridge inspection, noting no problems. 8/9/1997 BNSF track supervisor is at bridge for special high water inspection at 4:30 a.m.; water is “lapping against bottom of bridge.” 8/9/1997 Amtrak Train 4 derails while crossing bridge at 5:56 a.m. aThe year 1883 is listed as the year of construction for the railroad. ADOT provided the study team with an Arizona map dated 1874 that shows the Atlantic & Pacific Railroad in place, apparently on the alignment of today’s BNSF railroad. It is not clear whether 1883 or 1874 or some time earlier should be stated as the railroad’s construction date. Ayres Associates conducted a hydrology study to estimate the peak discharge rates through bridge 504.1S for floods of various recurrence intervals and for the flood of August 1997 that resulted in the bridge failure. A secondary objective was to quantify the hydrologic impact of the construction of the railroad embankment in 1883. The peak discharge values developed were used to analyze potential bridge scour and as input in the hydraulic computer modeling study. The most significant results and conclusions of the hydrology study were as follows: • The flood-frequency relationship for bridge 504.1S was determined. • Construction of the railroad significantly increased the peak discharge rate at the upstream side of bridge 504.1S for every recurrence interval.

a-4

• The range of plausible peak discharge values for the flood of August 1997 is from 450 cubic feet per second (cfs) to 875 cfs. • The most probable peak discharge rate is 875 cfs, based on the box culvert high-water marks. • The peak flow of 875 cfs is found to have a recurrence interval greater than 2 years but less than 5 years. A bed profile and wash section survey was conducted on portions of seven channels in the vicinity of the accident site, including the channels associated with railroad bridges 501.5, 503.1, 503.7, 504.1, 505.6, 505.9, and 506.9. The purpose of the survey was to document the condition of the wash and to determine the location and extent of existing headcuts and knickpoints along the surveyed channels. The most significant results and conclusions of the channel profiles and cross sections survey were as follows: • Following the construction of the railroad in 1883, sheet and discontinuous channelized flows were concentrated at the railroad bridges. • In 1934, ADOT constructed Highway 66 downstream of the railroad and placed its box culverts directly downstream of the railroad bridges. In most places, the culvert inverts (bottoms) were constructed below the invert of the channel, thus requiring excavation of the channel bed. The presence of two bridges along each drainage way resulted in the concentration of flow in the reach between the bridges causing general degradation of the channels. The placement of the Highway 66 culvert inverts below the channel bed probably produced short oversteepened reaches upstream of the culverts, causing small headcuts to form. • The headcuts migrated upstream as flood events occurred over 63 years and helped accelerate channel incision and degradation on all the channels. • The rate at which the headcuts progressed upstream and the rate of general degradation of the channel were dependent on the competence of the caliche. The caliche in the lower half of the reach between the bridge 504.1 and Highway 66 RCB culvert 4217 was less erosion resistant and allowed a relatively rapid progression of degradation and upstream headcut migration. • Channel incision, the upstream progression of headcuts, and the downstream extension of the channels below the highway were caused primarily by flow concentration at both the railroad and Highway 66. • It is likely that if the highway had not been built, flow concentration at the railroad bridge would still have resulted in the downstream

a-5

extension of the channel, which was already evident in the 1939 railroad ravine section. The general degradation that produced the downstream extension of the channel below the railroad bridge would have eventually extended beyond the erosion-resistant caliche. Once the degrading channel extended beyond the erosion- resistant caliche, a headcut would have developed that would then have migrated upstream and caused bridge 504.1S to fail. • The stock tanks and grading activities in the watershed above bridge 504.1 had no significant effect on the incision of the channel or the failure of bridge 504.1. A geotechnical investigation was conducted to determine the extent and variability of the caliche along channel 504.1. The most significant results and conclusions of the geotechnical investigation were as follows: • The caliche horizon within the study area is variable in extent, thickness, degree of cementation, and resistance to erosion by flowing water. • Based on the blow count data from the borings, there is a significant reduction in the hardness of the caliche near U.S. Highway 66. This is also verified by observations in the channel banks and in the pit and trench excavations, and by the results of the erodibility tests made at Texas A&M and Colorado State Universities. • The caliche horizon near the upstream end of the Highway 66 box culvert is neither hard nor uniform. It is highly erodible. • The caliche horizon is more resistant to erosion in the area upstream of and just downstream of the railroad bridge. • Erosion of the caliche horizon is by surface shear from flowing water, plunging flow, and the undermining of the competent portion by erosion of the weaker underlying sediments. The undermined competent portion of the caliche horizon fails by gravity. Total scour at a bridge is the combination of long-term degradation of the streambed, general scour of the stream channel under the bridge, and local scour at the piers and abutments. The measurements of the three components are added together to obtain the total scour at a pier or abutment. A scour study was conducted to determine: • The relative importance and role of each of the three components of scour; • The morphology of the channel, and human impacts on the morphology; • The significance of the type of bridge foundations used;

a-6

• The interaction between bridge No. 504.1 and the U.S. Highway 66 box culvert (RCB culvert 4217) downstream; • The importance of the crosswall downstream of bridge 504.1, and the cause of the failure of the crosswall; and • The importance of the stock tank just upstream of the bridge. The most significant results and conclusions of the scour study were as follows: • The grouted riprap that was placed on the streambed under bridge 504.1N and 504.1S apparently had sufficient thickness, rock size, and binding to protect the piers from local scour. • Assuming that the grouted riprap covered the channel bed beneath the bridge, as indicated by BNSF personnel, there was no contraction scour beneath the bridge deck in the August 1997 flood because the area was protected by grouted riprap. • The August 1997 flood might have caused as much as 3.3 feet of local scour at the crosswall if the peak discharge rate was 450 cfs and as much as 5.6 feet if the peak discharge rate was 875 cfs. Either of these scour depths could have caused failure of the crosswall. The local scour downstream of the crosswall might not have attained its full depth because of the underlying caliche. The caliche at the location of the crosswall was highly resistant to erosion but was still erodible. • A combination of long-term degradation and local scour downstream of the crosswall caused the crosswall to fail. Its failure allowed the long-term degradation of the streambed to undermine the grouted riprap, which was protecting the shallow mudsill foundations of the bents. The undermining of the grouted riprap allowed the foundations of bents 3, 4, and 5 to be undermined and to fail. • Incision of the channel crossed by bridge 504.1 was initiated when the railroad was constructed in 1883. The construction of RCB culvert 4217 probably accelerated the long-term degradation, but it also formed an elevation control, which will limit the ultimate depth of degradation at bridge 504.1. Long-term degradation in this channel has occurred by headcut migration in the upstream direction and by gradual channel lowering progressing in the downstream direction. • Without direct profile or photographic evidence from the late 1930s, it is difficult to conclusively determine the importance of the excavation of the channel at Highway 66 in the formation of the headcut that contributed to the failure of bridge 504.1.

a-7

• The construction of the crosswall and the placing of grouted riprap up to 20 inches thick across the bed under bridge 504.1 reveal that ATSF/BNSF personnel knew the bridge was vulnerable to scour. • The stock tanks and grading activities in the watershed above bridge 504.1 had no significant effect on the incision of the channel or the failure of bridge 504.1. The Ayres Associates study team conducted one-dimensional hydraulic analyses in order to clarify the impacts and relative importance of the railroad and Highway 66 on the morphology of the channel downstream of bridge 504.1. The most significant results and conclusions of the hydraulic computer modeling study were as follows: • The construction of the railroad in 1883 increased the velocity and erosion potential in the channel downstream from bridge 504.1 by increasing the drainage area (relevant for 2-year and smaller floods) and by constricting the flow to the width of the bridge opening (relevant for all floods). Because of the gradual rate of re-expansion downstream of the bridge (an assumption whose validity can be verified only by site observation of flooding or by two-dimensional modeling), the increase in velocity extended downstream beyond the present-day location of Highway 66. • The construction of Highway 66 in 1934 caused an increase in velocity downstream of the box culvert for all discharge rates, leading to a markedly increased erosion potential downstream of the highway. Upstream of the box culvert, the highway embankment caused backwater, leading to reduced velocities and erosion potential, for discharges equal to and greater than the 5-year peak. For smaller flows, the excavation of the streambed, and the resulting oversteepened reach just upstream of the box culvert, led to locally increased velocities and a hydraulic jump. The higher velocities and hydraulic jump almost certainly led to significant scour upstream of the box culvert. If the conditions in the model are representative of the post-highway condition, they could definitely have led to the initiation of the headcut that is observable moving upstream toward the bridge in the historic aerial photographs. • The excavation to place the culvert was and is a common practice. When the invert of a culvert is depressed below the natural channel grade, it is now advisable to consider the possible need for erosion protection in the oversteepened reach just upstream of the culvert. • If the bottom of the box culvert had been placed at the existing channel grade, the potential for erosion upstream of the culvert would have been reduced, rather than increased, for all discharge

a-8

rates. The maximum velocity downstream of the box culvert, however, would not have been any less under these alternative conditions than under the actual conditions. • There was little or no impact on the erosion or morphology of the channel imposed by the widening of Highway 66 in 1971. [ORIGINAL REPORT TEXT RESUMES AT THIS POINT.] The text beginning on page 60 is revised as follows: However, the BNSF report did not include ADOT bridge inspection data or pictures of the streambed dating back to 1971, information that would have been helpful in determining the relationship between the box culverts and the railroad bridges. The Safety Board therefore concludes that the relationship of the two structures and their respective zones of influence is not fully understood. The relationship between the U.S. Highway 66 box culvert and railroad bridge 504.1 is complex. Bridge 504.1, built in 1883, concentrated overland sheet flow into a single drainage course. The concentrated flow had more sediment transport capacity than the upland sheet flow and began to erode a channel at the railroad bridge. With time, the channel increased in size and progressed downstream. In the early years, the flow partially re-expanded downstream of the railroad bridge. Highway 66, built in 1934, 1,000 feet downstream from the bridge, re- concentrated the flow that had re-expanded downstream of the railroad bridge. The concentrated flow through the box culvert accelerated channel incision downstream of the culvert. The bottom of the box culvert was set about 2 feet lower than the level of the existing swale. The excavation to place the box culvert probably left a short, steep reach of streambed just upstream of the culvert. This could have initiated the headcut that the aerial photographs show moving upstream from 1954 to 1997 and that eventually contributed to the failure of the crosswall downstream of bridge 504.1. Unfortunately, the available aerial photographs date back only to 1954, and no detailed channel bed profiles just upstream of the highway are available from the period just after the construction of the highway. Without direct profile and photographic evidence from the late 1930s, it is difficult to precisely determine the importance of the box culvert channel excavation in the formation of the headcut. The box culvert also provided a positive benefit to the channel. The concrete floor of box culvert 4217 is now an elevation control point that will limit the ultimate depth of the long-term channel incision and degradation at

a-9

the bridge. Had ADOT constructed a bridge on piles at this location instead of a box culvert, the ultimate degradation at the railroad bridge would have been deeper. The Safety Board therefore concludes that both the railroad construction in 1883 and highway construction in 1934 concentrated the overland flow of water and accelerated erosion of the ephemeral streambed. The headcut that contributed to the failure of the crosswall and railroad bridge may have originated at the highway bridge after construction of U.S. Highway 66 in 1934; the upstream progression of the headcut was primarily caused by flow concentration between the railroad bridge and the highway bridge. The American Association of State Highway and Transportation Officials provides guidelines for highway bridge construction.2 The association’s 1931 guide, “Standard Specifications for Highway Bridges and Incidental Structures,” advises that a careful study shall be made of local conditions, including flood height and flow, size and performance of other openings in the vicinity carrying the same stream, characteristics of the channel and of the watershed area, climatic conditions, available rainfall records and any other information pertinent to the problem and likely to affect the safety or economy of the structure. However, ADOT reported that it did not have any hydrology studies or hydraulic design documents from the initial bridge construction in 1934 or from the widening project in 1971. The construction drawings do have annotations denoting drainage areas, but no calculation sheets or other evidence was provided to demonstrate how those numbers were derived. According to ADOT, the highway bridge was performing well in 1971 and there was no reason to change the size of the waterway opening;3 therefore, no hydrologic or hydraulic studies were needed prior to the roadway-widening project in 1971. ADOT also reported that since the accident, it has completed studies confirming that the highway bridge culverts are adequately sized and designed. However, the Safety Board believes that an opportunity was missed in 1971 when ADOT did not carry out comprehensive studies that would have identified the already existing upstream channel deterioration and that could have prompted ADOT and ATSF efforts to assess the interaction between the bridges and develop strategies to address erosion problems.

2 Before the 1970s, this organization was known as the American Association of State Highway Officials. 3 According to ADOT, the highway bridges along this stretch of highway were not designed to deal with heavy flooding and, in fact, water has crossed above the highway in the area of the subject bridge several times since 1934. The 1969 “Standard Specifications for Highway Bridges” published by the American Association of State Highway Officials states that, “On wide flood plains, the lowering of approach fills to provide overflow sections designed to pass unusual floods over the highway is a means of preventing loss of structures.”

a-10

In 1975, the ATSF engineering department recommended that the railroad bridge be replaced because of concerns about the bridge’s ability to provide an adequate waterway opening and recurring erosion problems. Although the bridge was not replaced, records in 1976 indicate the addition of riprap along the streambed and a concrete crosswall downstream of the bridge. Therefore, the railroad also had an opportunity to communicate with ADOT and develop joint strategies to address erosion problems. Nevertheless, the railroad was aware of the vulnerability of the bridge and should have closely monitored erosion in the vicinity and taken whatever measures were necessary to ensure safe operations. Although a track supervisor conducted a track inspection during the severe weather and flooding on the morning of the accident, he was not qualified to conduct bridge inspections, and no restrictions were placed on train speeds. The additional information developed by the Ayres Associates’ study reinforces the finding that an adequate bridge inspection could have detected risk to the bridge. According to the historical photographs, at the time the crosswall was constructed, the headcut that threatened the bridges was about 240 feet away. For at least the 5 years preceding the south bridge failure (1992–1997), the headcut was about 80 feet from the bridge and less than 50 feet from the crosswall. The railroad bridge concentrated the water flow to form a channel, which would erode and deepen over time even if the highway bridge/box culverts did not exist. Although both structures accelerated erosion of the streambed, it is the owner’s responsibility to monitor and ensure a bridge’s structural integrity against the effects of erosion, including headcuts or any other changes that may arise over time. Therefore, the Safety Board concludes that regardless of the cause of the headcut, Burlington Northern Santa Fe Railway and its predecessors were aware of the erosion problems affecting the railroad bridge and had ample opportunity over the years to detect the headcut and take appropriate remedial action. Moreover, the railroad decided not to replace the bridge in its 1977 Capital Improvement Program as recommended by its engineering department in 1975, reflecting that department’s concern about the bridge’s ability to provide an adequate waterway opening and recurring erosion problems. [ORIGINAL REPORT TEXT RESUMES AT THIS POINT.] Finding 8 on page 75 is deleted and a new finding 8 is inserted as follows:

• The relationship of the highway box culverts and the railroad bridges and their

respective zones of influence is not fully understood. Both the railroad construction in 1883 and highway construction in 1934 concentrated the overland flow of water and accelerated erosion of the ephemeral streambed. The headcut that contributed to the failure of the crosswall and railroad bridge a-11

may have originated at the highway bridge after construction of U.S. Highway 66 in 1934; the upstream progression of the headcut was primarily caused by flow concentration between the railroad bridge and the highway bridge. A new finding 9 is inserted on page 75 as follows:

1. Regardless of the cause of the headcut, Burlington Northern Santa Fe Railway

and its predecessors were aware of the erosion problems affecting the railroad bridge and had ample opportunity over the years to detect the headcut and take appropriate remedial action. Moreover, the railroad decided not to replace the bridge in its 1977 Capital Improvement Program as recommended by its engineering department in 1975, reflecting that department’s concern about the bridge’s ability to provide an adequate waterway opening and recurring erosion problems. [EXISTING FINDING 9 IS RENUMBERED TO FINDING 10 AND SUCCESSIVE FINDINGS ARE RESPECTIVELY RENUMBERED.] The National Transportation Safety Board, consisting of Chairman Ellen G. Engleman, Vice Chairman Mark V. Rosenker, and Members John J. Goglia, Carol J. Carmody, and Richard F. Healing, approved the Response to Petition for Reconsideration. A concurring statement was filed with the Response to Petition for Reconsideration. Consequently, the following text is inserted on page 79 immediately following the report adoption date. On July 31, 2003, as part of the National Transportation Safety Board’s response to a December 3, 1998, petition for reconsideration submitted by the Burlington Northern Santa Fe Corporation, John J. Goglia, Member, filed the following statement concurring with the Safety Board’s response. Richard F. Healing, Member, joined Member Goglia in this opinion. Notation 6912E Member GOGLIA, concurring:

Based on the information in the docket, I believe we should have included in the contributing causes of this accident the Arizona Department of Transportation’s (ADOT’s) failure to react (for years) to the erosion that was progressing toward the railroad property. It is also interesting to note (and in contrast to ADOT’s inaction, the BNSF’s action) that on the upstream side of the railroad property the same type of erosion is occurring, yet the railroad (as a responsible landowner) has for some time taken actions to prevent this erosion from reaching the adjacent property.

a-12

iii Contents Executive Summary .......................................................................................................... v Factual Information .......................................................................................................... 1 The Accident ....................................................................................................................... 1 Synopsis ....................................................................................................................... 1 Preaccident Events ....................................................................................................... 5 Postaccident Events...................................................................................................... 5 Injuries................................................................................................................................. 7 Damage................................................................................................................................ 8 Amtrak Train 4............................................................................................................. 8 Track, Structures, and Signals...................................................................................... 9 Personnel Information......................................................................................................... 9 Amtrak Train 4 Crew ................................................................................................... 9 BNSF Personnel Information..................................................................................... 13 Train Information .............................................................................................................. 14 Track, Structures, and Signal Information ........................................................................ 15 Track .......................................................................................................................... 15 Structures ................................................................................................................... 15 Bridge 504.1S Maintenance and Inspection............................................................... 18 Signals........................................................................................................................ 22 Operations Information ..................................................................................................... 23 Amtrak/BNSF Train Operations ................................................................................ 23 BNSF Operations Center............................................................................................ 24 Protection for Employees During Special Inspections............................................... 25 Meteorological Information .............................................................................................. 27 Medical and Pathological Information.............................................................................. 30 Emergency Response......................................................................................................... 31 Notification ................................................................................................................ 31 Mohave County Sheriff’s Department Response....................................................... 32 Fire Departments’ and Other Groups’ Responses...................................................... 33 Hospitals..................................................................................................................... 33 Emergency Preparedness............................................................................................ 34 Amtrak Passenger Train Emergency Response Training........................................... 35 Fire .................................................................................................................................... 35 Survival Aspects................................................................................................................ 35 Crashworthiness ................................................................................................................ 37 Locomotives and Fuel Tanks ..................................................................................... 37 Passenger Cars and Emergency Lighting................................................................... 38 Tests and Research............................................................................................................ 39 Locomotive Event Recorders..................................................................................... 39 Signal Event Recorders.............................................................................................. 41 Equipment Detectors.................................................................................................. 41

iv High Water Detector .................................................................................................. 41 Amtrak Locomotive Couplers.................................................................................... 43 Stopping Distance ...................................................................................................... 43 Geotechnical Investigation......................................................................................... 44 Postaccident Actions ......................................................................................................... 45 The BNSF .................................................................................................................. 45 The FRA..................................................................................................................... 46 Arizona Department of Transportation...................................................................... 49 Other Information.............................................................................................................. 49 Amtrak’s Proposed Procedures for Passenger Manifests........................................... 49 Amtrak’s On-Board Service Personnel Emergency Situation Training..................... 51 Analysis ............................................................................................................................ 53 General .............................................................................................................................. 53 The Accident ..................................................................................................................... 54 Safety of Structures Subject to Damage in Severe Storms................................................ 55 Failure of Bridge 504.1S............................................................................................ 55 Risk Concern for Route 66 Concrete Box Culverts................................................... 59 Adequacy of Inspection Procedures During Severe Weather Events................................ 60 Protection of Trains During Severe Weather Conditions.................................................. 61 Passenger Safety and Emergency Response Procedures................................................... 63 Passenger and Crew Accounting................................................................................ 63 Adequacy of Emergency Training.............................................................................. 65 Emergency Lighting and Public Address Systems..................................................... 67 Seat Securement......................................................................................................... 69 Emergency Response......................................................................................................... 70 General....................................................................................................................... 70 Unverified Notification Information.......................................................................... 70 Protection for Employees on or Adjacent to Track in Performance of Their Duties........ 71 Locomotive Event Recorders ............................................................................................ 73 Locomotive Fuel Tank Crashworthiness........................................................................... 74 Conclusions ...................................................................................................................... 75 Findings............................................................................................................................. 75 Probable Cause.................................................................................................................. 76 Recommendations ........................................................................................................... 77 Appendix A—Investigation .............................................................................................. 81 Appendix B—Event Chronology and Layout of Seligman Subdivision........................... 83 Appendix C—Applicable BNSF Instructions................................................................... 89 Acronyms and Abbreviations............................................................................................ 93

v Executive Summary About 5:56 a.m., on August 9, 1997, National Railroad Passenger Corporation (Amtrak) train 4, the Southwest Chief, derailed on the Burlington Northern Santa Fe Railway tracks about 5 miles northeast of Kingman, Arizona. Amtrak train 4 was en route from Los Angeles, California, to Chicago, Illinois, and had just left the Kingman station. The train was traveling about 89 mph on the eastbound track when both the engineer and assistant engineer saw a “hump” in the track as they approached bridge 504.1S. They applied the train’s emergency brakes. The train derailed as it crossed the bridge. Subsequent investigation revealed that the ground under the bridge’s supporting structure had been washed away by a flash flood. Of the 294 passengers and 18 Amtrak employees on the train, 173 passengers and 10 Amtrak employees were injured. No fatalities resulted from the accident. The damages were estimated to total approximately $7.2 million. The National Transportation Safety Board determines that the probable cause of this accident was displacement of the track due to the erosion and scouring of the inadequately protected shallow foundations supporting bridge 504.1S during a severe flash flood because the Burlington Northern Santa Fe management had not provided adequate protection, either by inspection or altering train speeds to fit conditions. Contributing to the accident was the failure of the Burlington Northern Santa Fe management to adequately address the erosion problems at bridge 504.1S. The major safety issues identified in this report are: • Safety of structures subject to damage in severe storms, • Passenger safety and emergency response procedures, and • Protection of employees on or adjacent to the track in the performance of their duties. As a result of this accident investigation, the Safety Board makes recommendations to the Burlington Northern Santa Fe Corporation, the Federal Railroad Administration, the Federal Highway Administration, the Arizona Department of Transportation, the National Railroad Passenger Corporation (Amtrak), the Mohave County Sheriff’s Department, the International Association of Chiefs of Police, the National Sheriffs’ Association, the Association of American Railroads, and the American Short Line and Regional Railroad Association. Also, the Safety Board reiterates one safety recommendation to the Federal Railroad Administration.

this page intentionally left blank

1 Factual Information The Accident Synopsis About 5:56 a.m.,1 on August 9, 1997, National Railroad Passenger Corporation (Amtrak) train 4, the Southwest Chief, derailed on the Burlington Northern Santa Fe Railway (BNSF)2 tracks about 5 miles northeast of Kingman, Arizona. Amtrak train 4 was en route from Los Angeles, California, to Chicago, Illinois, and had just left the Kingman station when the accident occurred. The train was traveling about 89 mph on the eastbound track when both the engineer and assistant engineer saw a “hump” in the track as they approached bridge 504.1S.3 They stated that they applied the train’s emergency brakes. It was later discovered that the ground under the bridge supporting structure had washed away during a flash flood. Train 4 had a four-unit locomotive, one baggage car, nine passenger cars, and six material handling cars (MHCs). As the train passed over bridge 504.1S, the first three locomotive units uncoupled and separated from the rest of the train and each other, each unit coming to a stop east of the derailed train. The fourth unit remained coupled to the train. The third and fourth units, including all but the last car, derailed in the upright position. Although some cars were at a slight angle to each other and leaning, all cars remained coupled and generally aligned with the track. The tenth car, a sleeping car, came to rest spanning what had been the track at the location of bridge 504.1S. (See figure 1 for an aerial view, looking south, of the Kingman accident site. Figures 2 and 3 show, respectively, a map and a schematic of the derailment site.)

1 Kingman, Arizona, is in the mountain time zone but does not change to daylight savings time. The times referenced in this report will be in accordance with the time used by the railroad for the local time, mountain daylight time (MDT), unless noted. 2 The BNSF resulted from the October 1, 1995, merger of the former Burlington Northern Railroad and the former Atchison, Topeka and Santa Fe Railway. The mainline segment through Kingman was part of the former Atchison, Topeka and Santa Fe Railway. 3 The BNSF designates bridges by their milepost (MP) numbers. There are two separate bridges at MP 504.1; one for the eastbound track and another for the westbound track. The bridges are designated by the BNSF as the south and north bridges, respectively. This report will designate them as bridge 504.1S (for the eastbound track) and bridge 504.1N (for the westbound track).

Factual Information 2 Figure 1. Aerial view of the derailment site, looking south

Factual Information 3 Figure 2. Map of the derailment site ARIZONA Accident Site Kingman Seligman Flagstaff Phoenix

!

BNSF Route Map

Factual Information 4 Figure 3. Schematic of the derailment site 1563

To Kingman

100'

100'

1420

1556

1428

1564

1526

32088

32051

38017

558'

BRIDGE 504.1

BNSF RIGHT of WAY

BNSF RIGHT of WAY

33036

31501

34060

34076

34133

39007

1254

1888'

AMTRAK ENGINE 52

AMTRAK ENGINE 80

DCA97MR004 Amtrak Train 4 Burlington Northern Santa Fe near Kingman, Arizona August 9, 1997 MP 504 N 34076

34133

39007

1254

2304'

1888'

919'

AMTRAK ENGINE 52

AMTRAK ENGINE 80

AMTRAK ENGINE 50

AMTRAK ENGINE 47

MP 504 To Flagstaff

A Source: BNSF RAILWAY

A

Factual Information 5 Preaccident Events At 12:06 a.m. August 9, the BNSF contract weather forecasting service issued a potential severe weather alert for the Kingman area, followed by an update at 12:52 a.m. At 1:43 a.m., the BNSF received a flash flood warning for the Kingman area from its contract weather forecasting service. The warning estimated that 2 inches of rain had already fallen over this stretch of track and that rain was still falling at a rate of about 1 inch per hour. In response to the warning, the BNSF Network Operations Center (NOC) arranged for a track supervisor to be called about 1:57 a.m. The track supervisor was instructed to inspect the track in his assigned area, which included the eastbound and westbound tracks east of Kingman, including the accident site. About 4:05 a.m., the track supervisor began his inspection at MP 516.5, traveling by hy-rail vehicle eastward on the eastbound track. He stopped at and inspected three bridges west of the bridges at MP 504.1. He said that he got out of his vehicle to inspect each of these bridges. He said he did not note anything unusual. Between 4:30 and 4:45 a.m., the track supervisor stopped at bridge 504.1S. He made his observations at this bridge without getting out of his vehicle. He later stated that he saw water flowing adjacent to and under the bridge from the south side, but that he did not note anything unusual about the track alignment or take exception to either the eastbound or westbound bridge. He stated that a light rain was falling at the time. Shortly after 5:35 a.m., the BNSF freight train B-CHCLAC1-05 passed over the westbound bridge, bridge 504.1N. The train crewmembers did not note anything unusual about either bridge from their positions in the locomotive. The track supervisor finished the special inspection of his territory at 6:01 a.m. He was about 40 miles east of Kingman when he heard the train dispatcher communicating with someone over the radio about an Amtrak train derailing at bridge 504.1S. (See figure 4 for a photo of the water flow under the bridge immediately after the derailment took place.) Postaccident Events About 5:56 a.m., the BNSF NOC received a radio communication from the engineer of Amtrak train 4 informing it of the train’s derailment and its location. The NOC passed the information on to its Resource Operations Center (ROC) and a BNSF special agent, who notified the Mohave County Sheriff’s Department at 6:01 a.m. Also about 5:56 a.m., the Mohave County Sheriff’s Department received a 911 call from a local resident reporting a train derailment. Three officers, who were already in the immediate area (searching for people who were reportedly stranded because of flash flooding), were dispatched to the scene and arrived at 6:05 a.m. Later, a Mohave County Sheriff’s Department lieutenant arrived on scene and assumed the duties of Incident Commander.

Factual Information 6 Figure 4. Flow of water under bridge 504.1S after the derailment

Factual Information 7 At 6:06 a.m., the Mohave County Sheriff’s Department requested a medical response to the derailment from the Kingman Fire Department. About 6:15 a.m., a paramedic unit, a rescue unit, and a 4x4 brush engine arrived. A rescue unit from the Hualapai Fire Department was already on scene. About 6:15 a.m., the Kingman Regional Medical Center was notified by the Mohave County Sheriff’s Department dispatcher of the derailment and told that it involved about 300 people. The hospital activated its emergency plan, calling nurses and emergency room personnel to report to the hospital. Medical supplies, nurses, Red Cross personnel, and volunteers were sent to the Kingman Junior High School to assist passengers after they had gone through triage. At 6:17 a.m., the Kingman Fire Department requested mutual aid assistance from the Valley Vista, Golden Valley, and Pinion Pines fire departments. By 6:20 a.m., the first of three Arizona Department of Public Safety helicopters arrived on scene. Two military helicopters from Nellis Air Force Base arrived on scene later with a flight surgeon and medical crew. At 6:30 a.m., a medical command post was set up next to the treatment and triage area. School buses were used to transport people with minor to moderate (or no) injuries to the local hospital and the Kingman Junior High School, which was used as a shelter for passengers and crew. About 6:56 a.m., injured people began arriving at the hospital by helicopters, ambulances, and buses. Over 100 people were treated. The last person was admitted to the hospital at 11 a.m. Thirty-four injured people were transported to Bullhead Community Hospital, Las Vegas University Medical Center, Flagstaff Regional Medical Center, John C. Lincoln Hospital North Mountain, and Las Vegas Valley Hospital. By 8 a.m., about 230 people had been transported from the scene. BNSF personnel, emergency medical services (EMS) personnel, and some passengers helped throughout the response. Shortly after 9 a.m., the last person was transported from the scene. (A chronology of the entire accident event sequence appears in appendix B.) Injuries Table 1 is based on the injury criteria of the International Civil Aviation Organization.4

4 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “Any injury which results in death within 30 days of the accident” and serious injury as an injury that “(1) Requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.”

Factual Information 8 Table 1. Injuries On December 5, 1997, Amtrak submitted documentation compiled by its Claims Department to the Safety Board that listed 40 reported injuries that had not been included in the medical records compiled by 6 area hospitals within 24 hours of the accident. Damage The BNSF and Amtrak provided the damage estimate information used in table 2. Table 2. Damage Amtrak Train 4 The train came to rest with the last passenger car, sleeping car 32088, bridging the gap of the collapsed bridge 504.1S. The last locomotive unit, ATK 52, and the rest of the cars remained coupled. The three locomotive units that uncoupled from the train came to rest with the lead locomotive unit, ATK 47, about 5,263 feet beyond ATK 52; the second unit, ATK 50, about 4,268 feet beyond ATK 52; and the third unit, ATK 80, about 1,888 feet beyond ATK 52. All but the first two locomotive units and the last car derailed. All cars derailed upright with the passenger cars at shallow angles to each other. Damage to the locomotive units and cars affected the end vestibule and diaphragm, coupler and coupler pocket, and undercar-mounted equipment. A rail penetrated the 4th locomotive unit, ATK 52, from its front, exited through the rear, and extended 19 feet into the first baggage car, ATK 1425. The rail penetrated below the floor level of ATK 52 through the top of the fuel tank; no significant amount of diesel fuel was Train Crew Passengers Total Fatal 0 0 0 Serious 1 24 25 Minor 9 149 158 None 8 121 129 Total 18 294 312 Equipment: Locomotives $ 400,000 Equipment: Cars $ 5,627,400 Track $ 454,000 Structures $ 681,000 Signal/Communications $ 17,000 Engineering and Other $ 42,000 Total $ 7,221,400

Factual Information 9 lost. Several passenger cars had structural body damage to their exteriors, consisting of bent or buckled ends. All passenger cars sustained damage to the underside mid-section areas, which rendered the service lighting, emergency lighting, and public address system inoperable. Amtrak considered car ATK 31501, the 6th car in the train, a possible total loss. The supporting trucks on five of the six MHC cars had to be rebuilt. (Figures 5 and 6 show, respectively, overall damage to the north side of the train and typical damage to a single coach.) Track, Structures, and Signals Damage to the track required the replacement of 5,390 feet of 136-pound continuous welded rail (CWR), which comprised 3,650 feet on the south track and 1,740 feet on the north track. Bridge 504.1S was destroyed. It was subsequently replaced with three 20-foot prestressed concrete spans on steel H-pile bents. Bridge 504.1N sustained less extensive derailment damage but was replaced when bridge 504.1S was replaced with three 20-foot prestressed concrete spans on steel H-pile bents to provide the same waterway opening for the parallel bridges. Signal and telecommunications damages and costs were incidental to the track damage. Personnel Information Amtrak Train 4 Crew The operating train crew consisted of an engineer, an assistant engineer, a conductor, and two assistant conductors. All five crewmembers had completed their mandatory off-duty time, as required by Federal Railroad Administration (FRA) regulations, and all were qualified on the operating rules and the area’s physical characteristics to operate passenger trains over this territory. During the interviews with Safety Board investigators, all five said that they had felt well rested on the morning of the accident and that they had had no physical problems before the accident. Engineer. The engineer of train 4, age 52, began work in the railroad industry in 1967 with the former Chicago, Burlington and Quincy Railroad. He became a brakeman in 1969, and was promoted to engineer in 1973. In August 1987, he went to work for Amtrak as an engineer. On the day of the accident, he was working as the locomotive engineer on his regular assignment. He became certified to operate over the Kingman territory in October 1996 and had worked over that territory for about 7 months. On his latest Amtrak locomotive engineer evaluation, March 25, 1997, his supervisor had noted that he was a “thorough engineer.” He had no record of any disciplinary actions.

Factual Information 10 Figure 5. Damage to the north side of Amtrak train 4 Figure 6. Damage typical to Amtrak train 4 coaches

Factual Information 11 His last physical examination took place in July 1997, and it determined that he was in good health. He wears glasses and has stated that he has some hearing problems that he believes do not affect his ability to operate a train safely. He stated that he is not required to wear a hearing aid. He was taking a prescription nasal spray prescribed by his physician. He stated that his physician had said it was not necessary to obtain company approval to take this medication, so he did not obtain written approval. According to statements he made to investigators, on Thursday, August 7, 1997, the engineer awoke about 8 a.m. and spent the day at home doing chores. He traveled to Kingman on Thursday night and arrived at 3:18 a.m. He went to sleep and awoke at 8:30 a.m. on Friday. He was not on duty during the day and spent it doing miscellaneous activities. On Friday night, he went to bed between 6 and 7 p.m. and slept until about 2 or 2:30 a.m. He stated that he awoke Saturday morning feeling rested and went on duty at 4:12 a.m. at Kingman. Assistant Engineer. The assistant engineer, age 53, began railroad work in August 1972 with the former Southern Railroad as a switchman. In 1974, he was promoted to engineer. In 1987, he went to work as an engineer for Amtrak. He became qualified to work over the Kingman territory in March 1997, and he had worked over that territory for almost 7 months when the accident took place. He was not assigned to a specific train and worked as an extra board employee.5 On the day of the accident, he was working as the assistant engineer. On his last Amtrak locomotive engineer evaluation, dated January 15, 1997, his supervisor noted that he displayed good trainhandling skills. His employee record showed three instances of disciplinary action involving suspension for operating rules violations: a STOP signal violation (30 days in 1988); a switch operating violation (5 days in 1989); and his train occupying a track without dispatcher authority (30 days in 1993). His last physical examination took place in December 1996, and it showed that he was in good health. He wears glasses while operating the train. He reported some hearing loss that does not require the use of a hearing aid. He stated that he was not taking any medications at the time of the accident. According to his statements, the assistant engineer reported for work on Thursday at 4:33 p.m. and departed Albuquerque, New Mexico, for Kingman at 6:30 p.m. He arrived on Friday morning about 3:18 a.m., went to a hotel, and went to bed. He said he awoke Friday morning about 11:30 a.m., felt relaxed and took a nap during the day, and went to bed Friday night about 8 p.m. He slept until 12:30 a.m. Saturday morning and went on duty at 4:12 a.m. in Kingman. Conductor. The conductor, age 54, began railroad work in May 1964 on the former Penn Central Railroad as a road freight conductor. He began working for Amtrak in April 1986 as a conductor. He became qualified to work over the Kingman territory in November 1995 and had worked over the territory for about 1½ years. On the day of the

5 An extra board employee is a qualified employee not working a regularly assigned position.

Factual Information 12 accident, he was working his regular assignment, which he had worked for about a week. He had no record of any disciplinary actions. His last physical examination took place in March 1995, and it showed that he was in good health. He wears glasses for reading. He told investigators that he has suffered some hearing loss (he does not wear a hearing aid). He stated that he was not taking any medications at the time of the accident. The conductor said he awoke about 7 a.m. on Thursday and did some work around the house. He arrived at the train station in Albuquerque about 3:26 p.m. and traveled to Kingman. He arrived at 3:18 a.m. Friday morning and slept from 4 a.m. to about 6:30 a.m. He reported that he went to breakfast, later napped for about 2 hours, and spent the rest of the day in town. On Friday night, he went to sleep about 6:30 p.m., awoke about 2 a.m., and reported for duty about 4:27 a.m. in Kingman. Assistant Conductors. One assistant conductor, age 46, began railroad work in August 1974 as a brakeman with the former Denver and Rio Grande Western Railroad. He started working for Amtrak in April 1989 as a conductor. He was working the extra board on train 4, and he had worked over this territory for 3 weeks. He had no record of disciplinary actions. His last physical examination took place in November 1995, and it showed that he was in good health. He wears glasses and, according to him, has “bad” hearing but does not wear hearing aids. He was taking the prescription medications Norflex and Tranxene (muscle relaxers) to help him sleep; he had received company approval to use these medications. On Thursday, the assistant conductor awoke about 10 a.m. and reported for duty about 4 p.m. He traveled from Albuquerque to Kingman and arrived about 3:18 a.m. on Friday. He slept from about 4:15 a.m. until about 10:15 a.m., then spent the remainder of the day in town. He went to bed between 7 and 8 p.m. and slept until 2:30 a.m. Saturday morning. He went on duty at 4:27 a.m. The other assistant conductor, age 51, began working for the railroad industry in 1966 with the former Atchison, Topeka and Santa Fe Railway (ATSF); he left and returned on different occasions to attend college until 1973. In 1973, he began working as a switchman; he was promoted to conductor in 1976. He started working for Amtrak in

1. His last physical examination, in April 1996, found that he was in good health. He

worked over this territory on and off for several years and had been assigned to this job for a couple months before the accident. He became qualified to work over the Kingman territory in August 1987 and had worked this territory intermittently for several years. He had no record of disciplinary actions. He awoke Saturday morning about 2:45 a.m. and reported for duty at 4:27 a.m.

Factual Information 13 BNSF Personnel Information The BNSF policy at the time of the accident was to use local track inspectors to perform emergency inspections within their areas.6 Performing an emergency inspection included observing track and bridge conditions for the movement of trains. The BNSF designates track inspectors in accordance with the qualifications prescribed in the FRA’s track safety standards at 49 CFR 213.7. The BNSF also has bridge inspectors who are assigned by territory to perform normal bridge inspections. According to the BNSF, because of the number of bridges and the size of the territories, bridge inspectors do not normally perform emergency inspections unless the inspector is in the area requiring the emergency inspection. Track Supervisor. The track supervisor, age 44, began his railroad career on the former ATSF in January 1979 as a trackman in San Bernardino, California. He worked as a heavy equipment operator in 1981. That year he also became a student foreman, a position he filled until 1987. He later gained additional experience while working as a foreman in other miscellaneous assignments. In 1995, he became an assistant roadmaster with the Navajo System steel gang. On July 31, 1995, he started working in his current position as a track supervisor. One of his responsibilities as track supervisor was track inspection. His training for track inspection included a 4-week program in Albuquerque, New Mexico, that provided instruction on track charts, rules, and standards, as well as railroad maintenance and safety. He received additional on-the-job training and experience while working on other assignments. The track supervisor’s bridge inspection training was primarily on the job; he stated that his knowledge was gained through conversations with bridge inspectors about their duties and responsibilities. He had not received any formal classroom training in bridge inspection, bridge maintenance, or high-water inspection. The BNSF formal training course for Maintenance of Way Track Foremen and Inspectors does not contain a section on bridge inspections. The track supervisor reported that he worked on Friday until 4 p.m. He went home (he lives in the Kingman area near the BNSF tracks) and did household chores and took a nap from 5 until 8 p.m. He stayed around the house and then went back to sleep at 10 p.m. About 1:57 a.m., he was awakened by a phone call from the BNSF maintenance- of-way dispatch desk in Fort Worth, informing him of heavy rain between Pica (MP 446.9) and Hackberry “Berry” in part of his territory and instructing him to inspect the track in his area (MP 473 to MP 516.5). Had he not been called to perform an emergency inspection, the track supervisor would have supervised a project about 4 a.m. that morning. Bridge Inspector. The bridge inspector for the Kingman area, age 56, began working for the former ATSF in March 1968 as a bridge helper. In 1969, he became a bridge foreman; in September 1976, he became a bridge inspector. He had about 200

6 In this instance, a track supervisor, who was a qualified track inspector, performed the inspection.

Factual Information 14 bridges on his territory, including the bridges at MP 504.1. He was responsible for performing an inspection twice a year on each bridge, culvert, and other drainage structures in the territory. He had no specific training to become a bridge inspector, only that experience gained on the job. He had attended several company training sessions on bridge inspection and welding. There are no State or Federal requirements for training or qualifications of railroad bridge inspectors. The bridge inspector was on vacation when the accident occurred. He stated that, had he been called to inspect bridges in the Kingman area at this time, it would have taken him at least 4 1/2 hours to drive there from his home, which was located 296 miles from Kingman. Train Information Train 4 was assembled at Amtrak’s Redondo Junction facility at Los Angeles, California. FRA initial terminal air brake tests and mechanical inspections were performed by Amtrak mechanical forces about 2 p.m., Pacific daylight time, on August 8,

1. Locomotive daily inspections were also performed. The tests included cab signal

and automatic train stop tests, which were completed without any noted defects. (The next locomotive daily inspection was scheduled to have taken place at the next crew change point, Albuquerque, New Mexico. The train was to have received an FRA- required 1,000-mile intermediate inspection upon arrival at Kansas City, Missouri.) Beyond the initial tests and inspections, no other mechanical tests or inspections were performed on the train before the accident, nor were any due. The locomotive consist of train 4 had four P42-8DC, General Electric (GE) diesel electric units, built in 1997 (ATKs 47, 50, 80, and 52, respectively). The passenger equipment consisted of one Heritage class baggage car, followed by a Superliner transition dormitory sleeping car for the on-board service personnel, a Superliner II coach, two Superliner I coaches, another Superliner coach, a Superliner II Sightseer Lounge, a Superliner I dining car, a Superliner I sleeping car, and a Superliner II sleeping car (32088), followed by six MHCs. A review of locomotive maintenance records revealed no anomalies. The on-site inspection found that the air brake manifolds of several cars had been knocked off in the derailment with under-bottom damage. This damage prevented the performance of any air brake tests.

Factual Information 15 Track, Structures, and Signal Information Track The accident site is located about 12.3 railroad miles east of Kingman, Arizona. The BNSF tracks through the accident area are within the Peacock Mountain range in the Hualapai Valley flood plain. The general terrain is flat desert land with several dry gullies that cross under the tracks and the adjacent highway, Arizona State Route 66 (Route 66). The two main tracks in the accident area are designated as the north track (signaled for westbound trains) and the south track (signaled for eastbound trains). Railroad MPs are in descending order from west to east. The Kingman station is at MP 516.4 and the accident occurred at MP 504.1. The track was straight from MP 512 to MP 504. The south track gradient from Kingman to Getz (MP 513.9) was ascending for eastward trains on a 1.0 to 1.5 percent gradient; from Getz to the accident site, the track was descending for eastward trains from a maximum of 1.0 (MP 512 to MP 511) to 0.06 percent at the bridges at MP 504.1. The BNSF maintains the track to meet or exceed the minimum requirements of the FRA Track Safety Standards for Class 5 track, contained in 49 CFR 213. The FRA Class 5 designation provides maximum allowable operating speeds of 80 mph for freight trains and 90 mph for passenger trains. The minimum track inspection frequency required by Class 5 standards is twice a week with 1 calendar day between inspections. The track had last been inspected on August 6, with no defects noted. The most recent track geometry test for track alignment, gauge, and surface was on July 16, with no defects noted in the accident area. A contractor performed the latest ultrasonic rail tests for determining rail integrity on August 6, with no defects noted in the accident area. Both tests were performed within the prescribed timeframes of 49 CFR 213. The south track in the area of the derailment was constructed with 136-pound CWR. The rail was manufactured by Colorado Fuel & Iron and installed new in 1984. The rail rested in 7-inch by 14-inch double shoulder tie plates, secured to timber crossties with three to four track spikes per tie plate. Longitudinal movement of the rail was restricted by the application of base-applied drive-on rail anchors applied to every other tie. Track ballast consisted of 2-inch stone ballast with the shoulders maintained to 12 inches beyond the end of the tie. Structures The BNSF bridge involved in the derailment was located at MP 504.1. The railroad through the derailment site was originally constructed as a single main track, now the north track, in 1883, by the ATSF. In 1922, the south track and bridge were constructed. The bridges on both tracks at MP 504.1 are identified by the BNSF as bridge 504.1, but the two bridges are structurally independent of each other.

Factual Information 16 BNSF bridge records indicate that the system has 250 timber-framed bent bridges. Of these bridges, 143 are similar in construction to bridge 504.1S, which is a structure founded on timber mud sills7 on erodible soils or rock. Of these 143 bridges, 80 are located on FRA Class 4 (or higher) track on which passenger trains operate. The other 63 of the 143 bridges are, with the exception of 1 bridge, located on secondary main lines or branch lines. The 107 timber-framed bent BNSF bridges dissimilar in construction to bridge 504.1S are either on pilings, on concrete footings in rock, or located over paved roadways or concrete-lined channels. Bridge 504.1S. The bridge was a treated timber trestle with four 9-foot spans supporting a ballast deck spanning a total length of 37 feet, 2 inches. The trestle was made of: two end framed bents8 and three intermediate framed bents, each consisting of five round timber posts of 12 inches in diameter; one timber cap,9 12 inches wide by 14 inches deep by 14 feet long; and one timber sill, 12 inches by 12 inches by 16 feet, resting on timber footer blocks, 6 3/4 inches by 10 3/4 inches by 32 inches, packed tightly side by side, forming a mud sill 32 inches by 16 feet. The mud sill rested on “hard pan”10 soil and was buried about 12 inches in an upper layer of soil and concrete slurry. Each intermediate framed bent was braced laterally with two diagonal lateral sway timber braces; each brace extended from a top corner to the opposite bottom corner of the framed bent. The bridge was braced longitudinally by four timber struts, or “hog jaws,” from the top of each end framed bent to the sill of the adjacent intermediate framed bent. The bridge deck was made of 3-inch by 10-inch transverse deck planks. At each edge of the deck was a 6-inch by 6-inch timber stringer below the deck planks and a timber ballast curb 32 inches high with approximately 3 feet of stone ballast. The bridge had a “free board” (bottom of bridge to bottom of streambed) of 76 inches and a center height (base of rail to bottom of streambed) of 111 inches. (See figure 7 for a terminology guide for a timber-bent bridge supported on timber blocking.) Bridge 504.1N. The existing bridge was built in 1940 to replace a bridge built in 1907, which had replaced the original 1883 bridge. The existing bridge was a ballast-deck treated-timber trestle with T-rail stringers on driven-timber pile bents.

7 A mud sill is a single piece of timber or a unit composed of two or more timbers placed upon a soil foundation as a support for a single column, a framed trestle bent, or another similar member of a structure. 8 A framed bent is a framed supporting unit of a trestle made up of two or more timbers as columns connected at their topmost ends by a cap. 9 The cap is the topmost piece of a framed timber bent, which serves to distribute loads upon the piles and to hold them in their proper relative positions. 10 Hard pan is a layer of hard soil cemented by almost insoluble materials that restrict the downward movement of water.

Factual Information 17 Figure 7. Guide to terms for timber-bent bridges supported on timber blocking Top Cap

Vertical Posts

Ballast Curb

Grade Tie

"T" Rails

Deck Plank

Firm/Rock Footing at Ground Line

Sediment or Loose Material

Bottom Sill

Bracing

Mud Blocking & Shims

Timber Bent Supported on Timber Blocking Terminology Guide No Scale

DCA97MR004 Amtrak Train 4 Burlington Northern Santa Fe near Kingman, Arizona August 9, 1997

Factual Information 18 The overall length of the bridge was 37 feet, 2 inches; it was made of four spans with nominal span lengths of 9 feet, 3 inches each. Each of the five bents, numbered 1 through 5 from east to west, had five timber piles ranging from 19 to 22 feet from the cutoff to the pile bottom. On each framed bent was a 12-inch by 14-inch cap supporting stringers made from 90-pound steel T-rail. Six live-load T-rail stringers were centered under each running rail, and one T-rail stringer was outboard of each running rail. The T- rail stringers were secondhand rails that weighed 90 pounds per yard and were approximately 10 and 28 feet long, respectively. Each long stringer spanned three of the four panels, and each short stringer spanned one panel. The short and long stringers were interlaced over framed bents numbered 2 and 4. The deck of bridge 504.1N was made of 3-inch by 10-inch transverse deck planks. At each edge of the deck was a 6-inch by 6-inch timber stringer below the deck planks and a ballast curb of two timbers: one 6 inches by 10 inches on the deck planks and a second 6-inch by 12-inch curb timber above the first. The track rested on approximately 24 inches of stone ballast. Bridge 504.1S Maintenance and Inspection Railroad documents dated 1975 showed that the bridges at 504.1 served a drainage area of 19.09 square miles. However, an ATSF document from 1940 showed that, during the 1940 renewal of the north track bridge (504.1N), the drainage area was calculated to be 3.80 square miles. Although the documents showed that a waterway opening of 267.0 square feet was required, versus the existing 174.8 square feet, they noted that no scouring11 had occurred at either end of the bridge, and that the present opening was larger than the 120-square-foot opening under Route 66, which was located about 1,000 feet downstream to the north. Maintenance records showed that the mud sills were replaced in 1958. In 1959, the bridge inspector recommended grouting the water path and adding stones between spans 1 and 2. This work was performed in 1964. During 1971, the State of Arizona widened Route 66 and extended the concrete box culvert downstream from BNSF bridge 504.1. (See figure 8 for a photo of the box culvert.) The original concrete box culvert had been built in 1936. Following the accident, Safety Board investigators observed evidence of streambed erosion between the highway box culvert and bridge 504.1.

11 Scour is the result of the erosive action of running water excavating and carrying away material from the bed and banks of streams. Different materials scour at different rates. Loose granular soils are rapidly eroded under water action while cohesive cemented soils are more scour resistant. (From Underwater Inspection of Bridges, FHWA-DP-80-1, November 1989.)

Factual Information 19 A January 1975 ATSF internal memo discussed the replacement of bridge 504.1 for the 1977 Capital Improvement Program (CIP), stating that replacement was needed “due to scouring of the mud blocks for the bridge under the eastbound main track [bridge 504.1S].” Based on its calculations of the larger drainage area, the ATSF believed that a “structure several times larger than the existing bridge” would be required. The memo then stated: Under the circumstances, it is suggested we place a concrete crosswall downstream from the bridge in order that the streambed will silt in behind the crosswall covering the mud blocks. As a matter of information we have already arranged to place the crosswall and in our opinion, this bridge will now last several more years. In as much as the bridge is not capable of handling its runoff, the water now presently runs in an easterly direction adjacent to the track to the next structure. By December 1975, additional grouted stone was placed at spans 2 and 3 because of the noted scour at the mud sills. A January 13, 1976, handwritten document from ATSF management stated, with regard to the proposed concrete crosswall and removal of bridge 504.1 from the 1977 CIP budget list, that this approach was not the appropriate way to address existing concerns. In May 1976, ATSF maintenance-of-way employees installed a 38-foot-long unreinforced concrete crosswall, 16 inches thick and 30 inches deep, about 17 feet downstream from the north side of the bridge. At this time, the bridge was removed from the 1977 budget list for replacement. Figure 8. Highway box culvert downstream from bridge 504.1

Factual Information 20 The BNSF bridge inspection program requires an annual inspection, with intermediate inspections to be conducted as needed. The last programmed bridge inspection took place on February 18, 1997. Another bridge inspection was conducted by the bridge inspector on July 9, 1997. During these inspections, no exceptions were taken to the condition of the bridge structure. In addition, no scouring was reported at the crosswall or the supporting mud sills at the timber bridge framed bents. (Table 3 summarizes the history of bridge 504.1S.) Table 3. Summary of noted events at bridge 504.1S Date Events 1922 ATSF builds second track bridge (504.1S) south of existing bridge (504.1N). 1936 State of Arizona constructs Route 66 with box culverts, one 1,000 feet downstream from bridge 504.1. 1940 ATSF bridge records show 3.8 square miles drainage area. 1958 ATSF bridge forces replace mud sills. 1959 ATSF bridge inspector recommends putting grout and stone between spans 1 and 2. 1964 ATSF bridge forces place grout and stone between spans 1 and 2. 1971 State of Arizona widens Route 66 and extends the concrete box culverts. 1/2/75 ATSF engineering department letter recommends replacing bridge 504.1 under 1977 CIP because of scouring at mud sills. 1975 ATSF bridge forces place grout and stone between spans 2 and 3. 12/9/75 ATSF engineering calculates 19.09 square miles drainage area. 1/13/76 ATSF engineering department letter expresses concern about proposed concrete crosswall and removal of the bridge from the 1977 CIP. 5/18/76 ATSF maintenance-of-way forces install concrete crosswall. May 1976 Bridge 504.1 removed from 1977 CIP. 7/24/76 High water recorded over top of rail on bridge. 7/29/76 High water measured at 2 inches above base of bridge rail. 2/18/97 BNSF bridge inspector performs last programmed bridge inspection. 7/9/97 BNSF bridge inspector performs last bridge inspection, noting no problems. 4:30 a.m. 8/9/97 BNSF track supervisor is at bridge for special high water inspection. 5:56 a.m. 8/9/97 Amtrak train 4 derails while crossing bridge.

Factual Information 21 About 3:30 a.m. on August 9, before beginning inspection of sections of his assigned track, including the eastbound and westbound tracks east of Kingman, the track supervisor contacted the dispatcher to obtain an eastbound train “informational line-up.”12 The dispatcher informed him that a hold had been placed on Amtrak train 4 at Griffith (MP 526.8). The dispatcher was not required to take this precaution, but the track supervisor understood it would provide an extra measure of protection for him. He began his on-track inspection at MP 516.5 about 4:05 a.m. His inspection took place in the dark while it was raining. He stated that he rode eastbound in a hy-rail vehicle (traveling about 15 to 20 mph) on the south track and looked for water running alongside the track, making sure it was not going over the track or scouring the ballast. He later told investigators that while traveling over bridges, he specifically looks at the tracks’ gauge, line, and surface to determine whether there is trouble on the bridge. He said he pays closer attention to the bridge if water is running underneath it. The track supervisor stated that, when beginning his inspection on the day of the accident, he observed a “greater” volume of fast-moving water running alongside the track near MP 510; it was an area where he had not seen it before. About 4:30 a.m., he stopped and got out of the hy-rail vehicle at three bridges west of bridge 504.1. At the first location where he saw water flowing underneath a bridge (507.4), he got out of his hy-rail vehicle and checked the earth around the bridge’s framed bents. He repeated this procedure for the next two bridges where water had accumulated (bridges 507.3 and 505.9). Between 4:30 and 4:45 a.m., he arrived at bridge 504.1 and observed “a greater portion of water coming from the south side of the south track” from behind him, and that “a smaller portion of water was coming from in front” of him. He stated, “That’s the first time that I saw that volume of water under that particular bridge.” The water was “lapping against the bottom of the bridge.” He did not think the volume was excessive. The water was moving rapidly, and he believed it was already subsiding. He stated that the best indicator he had of any problem was “the line gauge and surface of the track structure.” As to inspecting the bridge for scour problems, he stated that “I knew from experience that what—that I was looking for anything out of the ordinary—and at the time the knowledge that I had—I took no exception to anything I observed.” He did not get out of his hy-rail vehicle to inspect bridge 504.1, as he had at the other bridges. When the track supervisor was at Truxton, MP 477.3, the dispatcher told the track supervisor that he was releasing Amtrak train 4 through Griffith and that he would let the track supervisor know when Amtrak train 4 was leaving Kingman. (Truxton is about 50 miles from Griffith.) The dispatcher informed the track supervisor when he was about 5 minutes from Peach Springs (MP 465.8) that Amtrak train 4 had left Kingman. By this time, the track supervisor had completed his inspection and had not found any abnormalities resulting from the storm. The rain had ceased by the end of his inspection.

12 The term “informational line-up” refers to a list of trains and their approximate locations obtained from the train dispatcher and used to clear on-track equipment. Line-ups provide information to railroad personnel on the number, time, and location of trains at designated station or terminal points on the railroad for a particular track segment. They are usually valid for up to 4 hours; however, they are subject to change due to train traffic conditions.

Factual Information 22 While he was getting off the track at Peach Springs at 6:01 a.m., he overheard radio communications about the derailment. The track supervisor stated that he had been on this job since July 31, 1995, and had only made special inspections because of heavy rain once or twice (in 1996). This was the first such occasion in 1997. He stated that “Based on what I—at that time I felt completely 100-percent confident that my railroad was able to support traffic of any nature after I had made the inspection.” He estimated that the 40 miles of territory he covered contained about 50 bridges. For BNSF track inspectors performing special inspections for high water, the ATSF instructions, which were dated October 27, 1995, and still in effect for the BNSF, addressed special inspections in Section 82: Track Inspection - Chief Engineer’s Instructions, part 82.6 “Special Inspections.” These instructions state, in part: 82.6.1 High Water Perform these inspections during heavy rain or flooding:

1. Inspect the track for the following:

• Washouts • Scour • Surface irregularities • Water over the rail

1. Inspect drainage structures for the following:

• Erosion behind dump planks and headwalls and around piers and footings • Obstructions from drift and debris The only recorded instances of high water for the Kingman area took place on July 24, 1976, when a roadmaster recorded high water over the top of the rail on the bridges at MP 504.1, and on July 29, 1976, when a roadmaster measured high water at 2 inches above the base of the rail. No accidents involving high water or bridge failure were recorded for the Kingman area. Signals The signal system in the accident area is an automatic block signal (ABS) system, arranged for train movement with the current of traffic (signaled in one direction) and supplemented by an automatic train stop (ATS) system. The ABS extends about 97 miles from control point (CP) 526.9 to West Seligman, MP 429.8, on double track, and it has color light signals controlled by Electro Code Model 4 electronics track circuits. The BNSF designates the tracks as follows: (1) north track for westward train movements; and (2) south track for eastward train movements. A failed equipment detector (FED) is located at MP 512.5 and a high water detector (HWD) is at bridge 505.9. (See Tests and Research.)

Factual Information 23 Signals on the south track (for eastward train movements) are numbered according to railroad MPs and end with a numeral 2. Signals on the north track (for westward train movements) are also identified by MPs, but they end with a numeral 1. (See figure 9.) Figure 9. Signal system layout Operations Information Amtrak/BNSF Train Operations The accident occurred on the south main track on the Seligman West Subdivision, Arizona Division of the BNSF. Train operations are governed by the General Code of Operating Rules, Timetable No. 1, dated August 1, 1996, and by special instructions. Train movements are controlled by the signal indications of an ABS system. Amtrak passenger trains operating over this territory are equipped with ATS systems configured to allow them to operate at the maximum permissible speed of 90 mph. The maximum permissible speed for freight trains is 70 mph. The ATS feature is designed so that a penalty brake application will occur if the engineer does not activate a button when passing a wayside signal. The object is to enforce the observance of restricting indications of a wayside signal by requiring the engineer to “acknowledge” (depressing a button) when passing signals displaying such indications. “Restricting indications” include all signal indications other than a CLEAR or proceed signal. If the engineer fails to acknowledge such a restrictive indication, the train will automatically stop. All four locomotive units were equipped with event recording devices. The data from the event recorders were downloaded on scene to provide a preliminary readout, which indicated that the train was proceeding at about 89 to 90 mph, with the throttle in ← Eastward Westward → 5022 5052 5082 5102 South Track North Track 5021 5051 5081 5101 Bridge Bridge MP 512.5 FED MP 504.1 MP 505.9 Hot Box & Dragging (High Water Detector) Equipment Dete

Factual Information 24 the no. 3 position and the brakes fully released when the brake pipe pressure decreased from 110 to 0 psi. The data further indicated that a trainline-induced emergency (TLEM)13 occurred first, followed by an engineer-induced emergency (EIE) about 3 to 5 seconds later. The automatic brake handle changed from the released position to the emergency position about the same time that the EIE took place. Amtrak train 4 was scheduled to depart Kingman at 4:57 a.m., but for BNSF operational reasons (reported as “other trains”) during its trip from Los Angeles, California, it arrived late. It left Griffith (MP 526.8) at 5:24 a.m. BNSF Operations Center The BNSF directs all train movements from its operations center in Fort Worth, Texas. The train dispatcher directing train movements for the Seligman West Subdivision works from the operations center and plans, directs, and monitors train movements at a DigiCon®14 Centralized Traffic Control (CTC) system. From this location, the dispatcher can also communicate with all trains within his assigned area. Before the accident, the BNSF did not have a formal method for instructing dispatchers about their responsibilities in the event of a flash flood warning. On August 10, 1997, the BNSF issued a “Maintenance Alert” that specified procedures relating to possible flash floods. (For the complete Maintenance Alert, see appendix C.) The BNSF provided a comparison of the “before accident” and “after accident” responsibilities of the dispatcher as follows: August 8, 1997, instructions When possible flash flooding conditions were reported, Engineering Department Personnel were contacted and instructed to patrol track. While no specific restrictions were placed on train operation, if track inspection revealed a dangerous condition, the train dispatcher was to require trains to stop and examine track before movement was authorized. If a train arrived where an inspection was being made before the inspection was complete, the train would be held until maintenance personnel determined that track conditions at that particular location were safe for movement. August 9, 1997, instructions In addition to the procedures outlined above, train crews are instructed that the following will also apply when notified that flash flood warning conditions exist:

13 A TLEM means that the emergency brake was applied by some means other than the automatic brake handle or the “fireman’s” emergency brake valve. 14 Digital Concepts provided the DigiCon® system that is in use on the former ATSF.

Factual Information 25 Passenger trains will operate at restricted speed.15 All other trains will operate at a maximum speed of 40 mph. These restrictions will apply during the time and limits stated in the flash flood warning. At 12:06 a.m. on August 9, the BNSF operations center service interruption desk received its first alert of potential severe weather from its contract weather service. The alert was of thunderstorms and heavy rain on the Seligman subdivision. This notification was followed by an update at 12:52 a.m. (Alert 0000).16 According to the BNSF, the manager of the service interruption desk distributes the printed information to the train dispatcher, the train dispatcher’s supervisor, the chief dispatcher or manager of corridor operations, the corridor superintendent, the maintenance-of-way desk, and other managers. Table 4 (next page) provides a chronology of weather-related events concerning the Kingman accident. All events cited took place on August 9, 1997. Protection for Employees During Special Inspections When the decision was made to have the track in the Kingman area inspected because of the flash flood warning, the train dispatcher on duty placed a restrictive label on the approach to Griffith because a track inspector was out ahead of Amtrak train 4 on the informational line-up. The restrictive label was noted through the CTC DigiCon® system and would have prevented the dispatcher from requesting a more favorable signal than STOP for Amtrak train 4 to move eastward. Amtrak train 4 was not held at Griffith because the track supervisor did not report any problems to the train dispatcher before the turnover to the next dispatcher occurred (at about 5:40 a.m.). This information was given to the train dispatcher who was on duty when the accident occurred, and the restrictive label was removed. The second dispatcher told investigators that a track supervisor inspecting track would call him only if the track supervisor had something to report. Otherwise, the dispatcher might not hear again from the track supervisor after providing him an informational line-up. Because he received no reports of adverse conditions from the track supervisor, the dispatcher saw no reason not to run Amtrak train 4 into the track limits behind the track supervisor. In addition, he stated that no restrictions would have been placed on the train as long as the track supervisor was ahead of the train and had not issued a report requiring a train movement restriction. The dispatcher further stated that before the Kingman accident no restrictions were issued to trains for flash flood warnings.

15 Rule 6.27 of the BNSF General Code of Operating Rules defines “restricted speed” for the engineer of a train as being able to stop within half the range of vision: short of train, engine, railroad car, men or equipment fouling the track, stop signal, or derail or switch lined improperly, on the lookout for broken rail, and not exceeding 20 mph. 16 See Meteorological Information section.

Factual Information 26 Table 4. Weather-related events and information Time (a.m.) Events before the accident 1:43 BNSF receives flash flood warning (0001) for the Kingman area. 1:57 Track supervisor for Kingman area is notified. 2:24 National Weather Service issues severe thunderstorm and flash flood warning for central Mohave County, effective until 3:30 a.m. Also, before 3 a.m., weather updates (0002 and 0003) are issued to BNSF, including to “watch for flash flooding,” effective until 4:30 a.m. 3:39 Crewmembers of westbound train Q-LACMEM1-08 report to the BNSF train dispatcher that the rain is letting up at Walapai (MP 501.3), and that they saw water in the culverts. 3:56 Train Q-LACMEM1-08 crewmembers at MP 489.7 report to the train dispatcher that there is no water on the ground and only “trickles” in the ditch. 4:05 The track supervisor begins his special inspection at MP 516.5, moving in an eastward direction. 4:12 Dispatcher tells track supervisor of Q-LACMEM1-08 information. 4:28 Contract weather service issues update 0004 to BNSF, advising to “watch for flash flooding,” until 6 a.m. 4:30-4:45 Track supervisor reports from Hackberry (MP 509.4) to the BNSF train dispatcher. He does not report high water. He inspects bridge 504.1. He notes water flowing adjacent to and under the bridge. He does not note any unusual track alignment or take exception to either the east- or westbound bridge. 5:07 Dispatcher reports to track supervisor that eastbound Amtrak train 4 is leaving Franconia (west of Kingman). 5:35 Westbound train B-CHCLAC1-05 passes Walapai (MP 501.3). Shortly thereafter, this train crosses the bridge on the north track at MP 504.1. Train crew notices nothing unusual about the bridge on the south track. 5:46 Track supervisor reports from Peach Springs (MP 465.8) to dispatcher. He says he will clear shortly for Amtrak train 4. He does not report any high water. 5:56 Amtrak train 4 derails at bridge 504.1S.

Factual Information 27 The track supervisor confirmed that no mechanism is in place to protect him or other track inspectors if they are unable to contact the dispatcher for any reason; it is up to the employee to get out of the way of trains. He stated that his protection is “with the informational line-up.” He stated that the informational line-up is only good for about 4 hours and then “you have no authority to be on the track.” He also stated that the dispatcher is not expected to locate the inspector. Further, he stated that he does not notify the dispatcher when he stops to inspect a bridge. Both train dispatchers told investigators that they had not traveled the track through the area where they were responsible for dispatching trains. Meteorological Information WeatherData, Inc., (WDI) provides track-specific storm weather alerts and warnings to the BNSF. WDI is a private meteorological company located in Wichita, Kansas; it has been in business since 1981. WDI employs 38 associates and serves about 200 clients throughout North America. The company has two meteorological divisions; Weather Research and Weather Operations. Within Weather Operations, meteorologists are designated to work as either media meteorologists or storm warning meteorologists. All WDI meteorologists have bachelor’s of science degrees in meteorology or the equivalent training. All WDI storm warning meteorologists must pass internal training and certification before issuing storm warnings to WDI clients. WDI notifies the BNSF service interruption desk at its NOC with either a weather “alert” or “warning.” Whenever the meteorological state of the art allows, weather warnings are to be delivered to the NOC no less than 15 minutes before the weather affecting a certain portion of track is due. Warnings differ from alerts in that warnings require that some specific, immediate action be taken to safeguard the movement of trains. Alerts are informational and require no immediate action. At the time of the accident, BNSF instructions to WDI were that warnings were to be issued for tornadoes, winds in excess of 60 mph, hurricanes, blizzards, and flash floods. The actions to be taken by dispatchers and train crews for tornadoes and winds in excess of 60 mph are defined in System Special instruction number 35 (see appendix C). The BNSF reported that at the time of the accident no timetable or special instructions related to flash floods; however, the BNSF had an unwritten policy that a track inspector would be called to inspect tracks in areas that had flash flood warnings. The following are excerpts from the alerts and warnings issued by WDI to the BNSF concerning the weather around Kingman for the period on Saturday, August 9, that preceded the derailment:

Factual Information 28 Initial alert Start Time: 12:06 a.m. Locations: Seligman subdivision Conditions: Thunderstorms and Heavy Rain Comments: Strong thunderstorms are rapidly developing just southeast of, is that Pica, Pica, Arizona, moving east at 15 miles per hour. Radar estimates, moderate rainfall over track with up to 0.7 inches per hour rainfall rates. Expect from 0.4 to 0.6 inch of rain in the next 40 minutes, will monitor for flash flooding. Alert 0000 Start Time: 12:52 a.m. Expire Time: 2:30 a.m. Locations: Pica, AZ, to Kingman, AZ Conditions: Thunderstorms, Heavy Rain, Moderate Winds Comments: Update to previous warning. Strong to severe thunderstorms producing heavy rain with up to 1 inch an hour and gust wind continues to redevelop over this stretch of track. Kingman, AZ, has reported a gust to 50 miles per hour in the last 45 minutes. Therefore we are extending the previous warning. Warning 0001 Start Time: 1:43 a.m. Expire Time: 2:30 a.m. Locations: Truxton, AZ, to Hackberry, AZ Conditions: Flash Flood, Thunderstorms, Heavy Rain Comments: Thunderstorms continue to move to the east at 20 miles per hour. Radar estimates that nearly 2 inches of rain has fallen over this stretch of track with hourly rates of 1 inch an hour still falling. Watch for flash flooding! Warning 0002 Start Time: 2:21 a.m. Expire Time: 4:30 a.m.

Factual Information 29 Locations: Pica, AZ, to Harris, AZ Conditions: Flash Flood, Thunderstorms, Heavy Rain, Moderate Winds Comments: Strong thunderstorms continue to redevelop and move over this stretch of track this morning. Movement of these storms is to the east- southeast at 10 miles per hour. Rainfall amounts of 1 to 2 inches is likely, as well as, peak wind gusts less than 60 miles per hour. Watch for flash flooding. Alert 0003 Start Time: 2:32 a.m. Expire Time: 4:30 a.m. Locations: Harris, AZ, to Athos, AZ Conditions: Thunderstorms, Heavy Rain, Moderate Winds Comments: Strong thunderstorms continue to redevelop and move over this stretch of track this morning. Movement of these storms is to the east- southeast at 10 miles per hour. Rainfall amounts of 1/2 to 1 inch is likely over this stretch of track, as well as, peak wind gusts less than 60 miles per hour. Warning 0004 Start Time: 4:28 a.m. Expire Time: 6 a.m. Locations: Truxton, AZ, to Harris, AZ Conditions: Flash Flood, Thunderstorms, Heavy Rain Comments: Thunderstorms producing heavy rain continue to remain nearly stationary around the Kingman, AZ, area this morning. Radar estimates that nearly 3 to 3.5 inches of rain has fallen near this stretch of track with hourly rates of 1 inch an hour still falling. Watch for flash flooding! The threat for high wind has diminished, however, a gust to 45 miles per hour is still possible. The BNSF NOC managers told Safety Board investigators that “Warning 0001” had initiated the request to the BNSF maintenance-of-way operations desk to have the track inspected in the Kingman area. This warning covered the track between Truxton, MP 477.3, and Hackberry, MP 509.4.

Factual Information 30 A WDI employee told Safety Board investigators that he had been working that Friday night and early Saturday morning. He said he had issued the warnings on the basis of base reflectivity, “storm total precipitation,” “1-hour precipitation,” and vertically integrated products from the National Weather Service’s (NWS’s) Las Vegas and Flagstaff WSR-88D radar. These sources indicated heavy rates of rainfall, and data from the National Lightning Detection Network indicated intensifying thunderstorms over northwest Arizona. His SmartWARN17 Storm Warning System highlighted the area around Kingman as prone to flash flooding. He was aware that rains had fallen in the Kingman area during the 24 hours before his shift began. NWS postaccident interviews with local authorities and citizens showed that a light rain had begun around 1 a.m., with heavy rain starting around 1:30 a.m. and lasting for about 2 hours before tapering off to a light rain that continued until about 5 a.m. At 3 a.m., flooding was reported at East Bank and Kingman Avenue, causing people in the area to require rescue from three stalled cars. A plastic rain gauge at the airport recorded 1.76 inches of rainfall. A “bucket survey” north of the airport, closer to the train derailment and about where the strongest rain cells were located at 3 a.m., showed an estimated 3 to 4 inches of rainfall. Public works reported a measured 3.7 inches of rainfall but was not sure of the report’s source. A rancher to the northwest of the accident site (about 12 miles north of Kingman) recorded 2 inches in his rain gauge. NWS reports stated that approximately 2 inches of rain fell within the Hualapai Valley area, with a possible core precipitation of at least 3 inches, and possibly up to 4 inches, and that a considerable amount of water ran through Kingman, beginning around 1:30 a.m. Police and public works representatives could not get barricades up fast enough to keep people out of the washes. Four people had to be rescued by helicopter from two stranded vehicles. Medical and Pathological Information The accident caused no fatalities. Of the 294 passengers and 18 train crew members, 173 passengers and 10 train crewmembers were injured. Passengers and train crew personnel were injured by striking interior surfaces, such as seats, armrests, footrests, tables, luggage racks, walls, and beds, and from being thrown into the aisles during the impact. Passengers and train crewmembers who were injured were treated at six hospitals. Injuries consisted of strains, sprains, fractures, contusions, and multiple trauma. About 2 p.m., or 8 hours after the accident took place, the engineer, assistant engineer, conductor, and assistant conductors from Amtrak train 4 provided urine specimens and gave breath tests for postaccident alcohol and drug testing. Amtrak and

17 SmartWARN is a computer workstation developed by WDI to allow its storm warning meteorologists to quickly and effectively display meteorological data in a format that can easily be analyzed so accurate decisions about warnings can be made.

Factual Information 31 BNSF officials were present during the sample collection. All crewmembers tested negative for alcohol. Although samples from the train crewmembers had been collected, an FRA official on scene determined that postaccident toxicological testing for drugs and alcohol was not required. As a result, neither the track supervisor nor the dispatcher was tested. According to 49 CFR 219.201(b), No test shall be required in the case of an accident/incident the cause and severity of which are wholly attributable to a natural cause (e.g., flood, tornado or other natural disaster), as determined on the basis of objective and documented facts by the railroad representative responding to the scene. Emergency Response Notification About 5:56 a.m., the BNSF NOC received a radio communication from the engineer of Amtrak train 4 informing it of the train’s derailment and location. The NOC passed the information on to its ROC and a BNSF special agent, who notified the Mohave County Sheriff’s Department at 6:01 a.m. The NOC said it did not know the number of passengers on the train, the extent of the injuries, or the prospect of fatalities. The BNSF notified the U.S. Coast Guard National Response Center of the accident at 6:15 a.m. About 6:20 a.m., the BNSF special agent called the ROC manager and advised that the Mohave County Sheriff’s Department dispatcher had reported that at least two cars had derailed and that two unconfirmed fatalities were reported on the first car [dormitory car]. According to the BNSF transcript of the recorded communications between the BNSF special agent and the Mohave County Sheriff’s Department dispatcher, the sheriff’s dispatcher said, “Well, I got word that so far one car, two really serious, probably gonna be DOA [dead on arrival].” The BNSF special agent’s communication with the NOC Service Interruption Desk manager about the accident was also recorded. The agent said, “When I talked to Mohave County, they said … two fatalities and they’re still trying to get to the scene.” The NOC manager replied, “Two fatalities?,” and the BNSF special agent said, Yeah, two DOAs is what they called them, dead on arrival.… That’s just when they first got on the scene, that’s what they reported. Two cars for sure derailed and two, it looked like two DOAs.

Factual Information 32 During further conversation with an employee at BNSF operations, the BNSF special agent said, “… it’s not a confirm, but that’s pretty much what they said when they first got on [scene].” At 6:45 a.m., the BNSF special agent called the Mohave County Sheriff’s Department to get an update and talked to a sergeant who relayed information being transmitted over his radio from the scene. According to the BNSF transcript of the recorded communication, the sergeant said, “We’ve got two dead downstairs now… we’re still in the initial response stage and a lot of our information is gonna be really confusing.” The BNSF special agent replied, “Right, I understand. I thought I heard her say six possible on the downstairs side.” The sergeant said “Yes… they were in the first car.” The updated information was relayed to the BNSF Service Interruption Desk manager, who communicated it to the FRA and the Safety Board. The dispatchers at the Mohave County Sheriff’s Department did not remember whether a sergeant had been present during these conversations or had reported possible fatalities. The dispatchers did recall reporting critical injuries. A copy of the dispatch tape recording was provided by the Mohave County Sheriff’s Department to the Safety Board. The tape included radio and telephone conversations; the conversation between the Mohave County Sheriff’s Department dispatchers and the BNSF special agent was not recorded. The initial reports made by the BNSF to the Safety Board’s communications center via the U.S. Coast Guard National Response Center cited 8 to 13 fatalities. The general manager of Operations, Standards, and Compliance for Amtrak stated that the report of 8 to 13 fatalities resulted in Amtrak’s high-level response to the accident. The report of 13 fatalities was not recorded in transcripts. The source of the number could not be verified. The general manager told Safety Board investigators that he believed, after consulting Amtrak police officers, that inaccurate information regarding fatalities may have arisen because of confusion over terminology. He thought that someone on scene may have referred to the 13 on-board service crewmembers who were asleep in the dormitory car as “deadheads.”18 He also believed that this expression may have been misinterpreted by someone unfamiliar with railroad terms as indicating 13 fatalities in the dormitory car or 2 fatalities downstairs and 6 fatalities upstairs in the dormitory car. Mohave County Sheriff’s Department Response At 5:56 a.m., the Mohave County Sheriff’s Department received a 911 call from a local resident reporting a train derailment. Three officers who were already in the immediate area (searching for people who were reportedly stranded because of the flash flooding) were dispatched to the scene and arrived at 6:05 a.m. They helped the Kingman

18 “Deadhead” is a term used by railroad employees to identify off-duty railroad employees who are either going to or from work and traveling on the train.

Factual Information 33 Fire Department and emergency services personnel transport passengers and crew to triage areas, searched for train occupants, and secured the scene. They reported that no “life threatening” injuries were noted. Later, a Mohave County Sheriff’s Department lieutenant arrived on scene and assumed the duties of Incident Commander. The Incident Commander’s responsibilities were to coordinate the activities of the various responding fire departments (eight fire departments) and medical personnel (six organizations, including the Kingman Regional Hospital). The Incident Commander stated that he requested a passenger manifest from an unidentified Amtrak employee but did not receive one. He stated that Amtrak did not provide a complete passenger manifest. It took several days for Amtrak to provide an accurate passenger count of the entire train. Fire Departments’ and Other Groups’ Responses At 6:06 a.m., the Kingman Fire Department responded to a request from the Mohave County Sheriff’s Department for a medical response to the derailment. About 6:15 a.m., a paramedic unit, a rescue unit, and a 4x4 brush engine arrived. A rescue unit from the Hualapai Fire Department was already on scene. At 6:17 a.m., the Kingman Fire Department requested mutual aid assistance from the Valley Vista, Golden Valley, and Pinion Pines fire departments. An unidentified Amtrak employee told the captain of the Hualapai Fire Department that over 300 passengers and crew were on board train 4. By 6:20 a.m., the first of three Arizona Department of Public Safety helicopters arrived on scene. Two military helicopters from Nellis Air Force Base arrived on scene later with a flight surgeon and medical crew. At 6:30 a.m., a medical command post was set up next to the treatment and triage area. About 6:50 a.m., the city of Kingman activated its emergency operations plan to provide a shelter and staffing. School buses were used to transport people with minor to moderate (or no) injuries to a local hospital and the Kingman Junior High School, which was used as a shelter. Emergency responders placed injured passengers from the top level of the cars onto backboards and extricated them through the cars’ emergency windows. Ladders from fire trucks were used to provide stable platforms for lowering people onto the ground. By 8 a.m., about 230 people had been transported from the scene. BNSF personnel, EMS personnel, and some passengers helped throughout the response. No fatalities were reported by the EMS personnel. Shortly after 9 a.m., the last person was transported from the scene. At 11 a.m., the scene was cleared after the Kingman fire chief determined that no further fire or medical treatment issues were evident. During the emergency response, a total of 19 paramedics, 44 emergency medical technicians, 11 ambulances, 6 air units, and 6 school buses responded. Hospitals About 6:15 a.m., the Kingman Regional Medical Center was notified by the Mohave County Sheriff’s Department dispatcher of the derailment and told that it

Factual Information 34 involved about 300 people. The hospital activated its emergency plan, calling nurses and emergency room personnel to report to the hospital. Nurses, assisted by the Red Cross and volunteers, and supplies were sent to the Kingman Junior High School to help those who had completed triage. By 6:56 a.m., the injured people began arriving at the hospital by helicopters, ambulances, and buses. Over 100 people were treated. The last person was admitted to the hospital at 11 a.m. Thirty-four injured people were transported to Bullhead Community Hospital, Las Vegas University Medical Center, Flagstaff Regional Medical Center, John C. Lincoln Hospital North Mountain, and Las Vegas Valley Hospital. Emergency Preparedness Upon notification of the accident, the Kingman Regional Medical Center implemented its emergency plan, which had been created in December 1987 and last revised in June 1996. The plan is designed to provide rapid and effective emergency services in the event of a disaster internal or external to the facility. Medical staff members are to work with local police, fire, and ambulance services during an emergency. No problems were reported with the operation of the plan. Additional staff was called, and preparations were made for transfer of patients as necessary. The Mohave County Emergency Management Agency implemented its Emergency Operations Plan, which had last been updated on May 28, 1997. The plan detailed the responsibilities of responding agencies and listed the telephone numbers of agencies such as the Association of American Railroads and the ATSF. It did not include telephone numbers for Amtrak or the BNSF. Before the accident, on November 15, 1996, a joint full-scale exercise was held by Clark County, Nevada, and Mohave County, Arizona. Since the accident, three drills have been held (a tabletop exercise on September 30, 1997, for the Hoover, Davis, and Parker Dams to evaluate the operational readiness of the program; a full-scale exercise on November 11, 1997, involving hazardous materials transportation; and another tabletop exercise on December 3, 1997, assuming a Statewide flood affecting Mohave County, Kingman, Lake Havasu, and Bullhead City). On August 12, 1997, the Mohave County Emergency Management Agency held a postaccident critique. The critique was attended by the Arizona Department of Transportation, the Red Cross, the Arizona Department of Public Services, and the participating fire and law enforcement departments. During the critique, several agencies noted the need to improve communications. Poor weather conditions reportedly affected the operation of portable radios used by Mohave County Sheriff’s Department deputies. Also, because the primary radio frequency was used, it was difficult to hear other emergency traffic in the city. The Mohave County Emergency Management Coordinator planned to meet with county officials to improve the county’s communications system and to add the telephone numbers of the emergency service coordinators from Amtrak

Factual Information 35 and the BNSF to its plan. Amtrak and the BNSF were not invited to participate in the critique. Amtrak Passenger Train Emergency Response Training On April 29, and 30, and May 1, 1997, a Festival of the Emergency Arts was held at the Lake Havasu City Convention Center in Glendale, Arizona. At this festival, Amtrak’s manager of Emergency Preparedness addressed emergency responders about considerations that might affect emergency response procedures involving Amtrak train emergencies, such as: Railroad operations, equipment familiarization, passenger car construction, railroad right-of-way safety precautions, passenger evacuation, forcible entry, locomotive propulsion systems, train crew orientations, electrical and pneumatic hazards, on-board emergency equipment, use of emergency exit doors and windows, hazardous materials, tunnels and bridges, grade crossing accidents, search and rescue, fire suppression, derailments, and other types of incidents. Although Kingman fire and rescue personnel were invited by a State representative, the festival attendance sheet did not indicate that anyone from Kingman had attended this training. No evidence was found of the Mohave County Sheriff’s Department being invited to or attending the festival. Fire There was no postaccident fire. Survival Aspects When the accident took place, the engineer and assistant engineer were in the lead locomotive. They stated that, upon traversing the bridge, they saw a “hump” in the track. When the derailment occurred, they were thrown upward and back down and around inside the cab before the engineer could hit the emergency button. The assistant engineer broadcast “emergency” over the train radio and called the dispatcher, telling him to stop any trains in the area and to call emergency responders. The engineer and assistant engineer said they remained inside the locomotive cab and did not help during the evacuation because the locomotives came to a stop about 1 mile away from the evacuation site. The conductor and an assistant conductor were in the diner car (8th car). According to passenger statements, when the train went into emergency, the lights went out and the emergency lights came on in some cars. The train began to “jerk,” causing the conductor to grab the table in front of him as the train came to a stop. The assistant

Factual Information 36 conductor fell underneath a table. The conductor attempted to go out the forward door, but it was jammed. The conductor, chef, and assistant conductor went into the galley to open a window, then they tried to open the door using a crowbar. After opening the door, the conductor used his radio to call the engineer to ascertain the condition of the train. The conductor stated that he then assessed the condition of the train. At this time, he saw other train crewmembers inside the train; they had light sticks and were trying to open jammed doors. Another assistant conductor, who was in the dormitory car (2nd car), stated that he tumbled and bounced around inside the car. He joined the conductor and other train crewmembers who were walking along the train, opening jammed doors and distributing light sticks to passengers because the emergency lighting was not working in several cars. A sledgehammer was used to open jammed doors. The conductor instructed passengers to stay inside the train to avoid further injuries. The conductor asked some boy scouts on board the train to pass out light sticks and help open doors and windows. The conductor instructed train attendants to search the cars for injured passengers. The assistant conductor told the conductor that the sleeping car (10th car) was on the collapsed bridge; they began evacuating that car first. The conductor stated that he did not try to use the public address system because he did not think it was working. A sheriff’s deputy who was in the area heard noise of the derailment and was the first responder to arrive on scene. The conductor told him that about 300 people were on board the train and asked him to call for EMS and to provide portable lighting. The conductor stated he had no idea how many persons were injured or if there were any fatalities. The conductor did not have the passenger manifest with him. Subsequently, after walking through the train, the conductor determined that there were no fatalities. The on-board service personnel were either asleep in the dormitory car or had just awoken to begin their normal work assignments. Several sleeping crewmembers stated that they were awakened by the action of the derailing train and were injured in the derailment. Those who were not injured or who were in cars other than the dormitory car assisted in the evacuation of passengers. One train attendant, who was in a sleeping car (10th car), reported that she went downstairs to the vestibule area and noticed that the car had come to rest on the bridge. She saw and heard water on both sides of the car and immediately decided to evacuate it because she did not know whether the car would remain stable. She went upstairs and began to evacuate the sleeping car but realized it would be difficult because of its angle. She told passengers to stay calm. She informed them that a derailment had occurred. She checked each room to make sure no one was dead or needed help. She told passengers to put on their shoes, leave their luggage behind, and follow her downstairs. The lower vestibule door was opened and passengers began leaving. She led the passengers away from the train.

Factual Information 37 The train attendant had attended Amtrak’s P.R.E.P.A.R.E.19 training course in 1996 and told investigators that this training had taught her when to evacuate, how to triage, how to set up a command post, and how to assist emergency personnel and injured people. She said the training had made her “more knowledgeable, prepared, and focused on what needed to be done.” She said that she thought that all crewmembers should take the course at least every 2 years for refresher purposes. The chief of on-board services said that he made sure that the train attendants in the dormitory car were all right; he then proceeded to assist passengers. He said that he gave a copy of the passenger manifest, which contained the number of passengers in the sleeping cars, to a firefighter. On September 17, 1997, the Safety Board mailed 210 surveys to the passengers of Amtrak train 4; the Board received 41 responses by November 7, 1997. The survey generally asked individuals to provide information such as the car they had been in, their seat location, and their observations about the events that occurred before, during, and after the accident. In addition, investigators interviewed nine patients in the Kingman Regional Medical Center following the accident. Crashworthiness Locomotives and Fuel Tanks The locomotive of train 4 was made of four P-42-8DC diesel electric units, manufactured by GE.20 The units were less than 8 months old. The first three units were positioned with the operator’s cab facing east (forward), and the fourth unit was positioned with the operator’s cab facing west (to the back). Only the first unit, ATK 47, was occupied. A description of the condition of each unit is provided below. ATK 47, ATK 50, and ATK 80. These were the first three units of the four-unit locomotive consist. These units uncoupled and separated from each other after crossing the bridge. The lead unit, ATK 47, was occupied by an engineer and an assistant engineer. An inspection of the operator’s cab compartment indicated no visible interior damage. A visual inspection of the car bodies of these units made after the accident indicated a slight localized exterior side sheet panel (wrinkle) distortion, both on the left and right sides, in areas above the truck assemblies, as well as at the mid-section of the car body (of the third unit only). The distortion became slightly more progressive from the first to third units. No fuel leakage was apparent from these units.

19 P.R.E.P.A.R.E. stands for “Passenger Railroad Emergency Preparedness And Response Education.” 20 General Electric/Transportation Systems Division, Erie, PA.

Factual Information 38 ATK 52. ATK 52 was the fourth unit of the four-unit locomotive consist. In its passage over the bridge, this unit uncoupled from the 3rd unit but remained coupled to the baggage car. A postaccident visual inspection indicated localized left and right exterior side sheet panel (wrinkle) distortion in areas above the truck assemblies, as well as at the mid-section of the car body. The forward end sill, beneath the sloping fascia panel under the windshield, was deformed inward and wedged against the baggage car (ATK 1425). Inspection of the operator’s cab indicated only minor damage. The locomotive frame showed some structural damage. A prerecovery visual examination of the underframe panels proximate to the 2,100-gallon fuel tank compartment indicated that only a small amount of diesel fuel had leaked. The sight gauge (sight-port) of the fuel tank indicated that the tank was above one-half, but less than three-quarters, full during the prerecovery inspection. Amtrak estimated that the remaining fuel in the fuel tank totaled about 1,400 gallons. About 12 and 24 inches of clearance space were observed, respectively, between the ballast surface and underframe of the locomotive, on the left and right underside surfaces of the unit. Additional damage was sustained to this unit when an 82-foot-long piece of rail that dislodged from the track structure during the derailment became embedded in the unit. The rail had penetrated at the rear of the unit (which was its leading end) and extended its entire length. The opposite end of the rail was found to be cantilevered into the interior of the trailing baggage car. The rail segment passed through the fuel tank, puncturing at least one interior baffle. A portion of rail was visible at the right-side fuel filler pipe opening. (See figure 10.) Passenger Cars and Emergency Lighting The inspection of the passenger cars indicated that none had experienced any significant breach of the car body, with most of the damage focused on the car body end- structure areas. An on-scene inspection of the passenger car equipment was conducted by the members of the Safety Board’s Crashworthiness Group, with the results documented on the carrier’s equipment inventory forms. The emergency lighting system in each car is powered by a series of wet cell storage batteries, which are secured in a utility rack located in an interior compartment that is accessed from the exterior of each car. Inspectors found the electrical systems of most cars at minimum or no power. The electrical systems were disabled because of extensive undercarriage damage, resulting from severed wiring and related electrical conduits located on the car undercarriage. Postaccident inspection of the train seats found that the rotating locking devices or mechanisms were not engaged on 18 seat assemblies. No seat assemblies were found separated from their floor mountings.

Factual Information 39 Tests and Research Locomotive Event Recorders All four locomotive units were equipped with GE Integrated Function Computer (IFC) event recorders, which were successfully downloaded on scene to PCMCIA21 memory cards. The data from the lead locomotive (ATK 47) indicate that the train was traveling approximately 89 to 90 mph, with the throttle in position 3 (with a change to 4 and then 1), when the brake pipe pressure decreased from approximately 110 to 0 psi, and the emergency parameter changed from NONE to TLEM. Within the next 2 seconds, the pneumatic control switch (PCS)22 parameter changed from CLOSED to OPEN. Between 2 and 4 seconds after the PCS OPEN indication, the position of the air brake handle changed from RELEASED to EMERGENCY, and the EIE parameter changed from OFF to ON.

21 PCMCIA refers to the Personal Computer Memory Card Industry Association. Although the memory cards are often referred to as “PCMCIA cards,” the correct terminology is “PC cards.” The PCMCIA defines and publishes the PC card standard. 22 The PCS automatically retards the throttle to the IDLE position when a rapid reduction in automatic brake pipe pressure occurs. Figure 10. Visible rail segment

Factual Information 40 Although the recorder is equipped to record end-of-train (EOT) device data, no EOT device was installed on the accident train. Recorded and Played Back Parameters. The GE recorder stores the recorded data in a Permanent Core Memory (PCM) module, manufactured by Pulse Electronics, Inc. The number and type of parameters that are recorded are determined by GE as well as the individual railroad. GE provides a standard minimum list of parameters (which are always recorded, for all railroads), and the particular railroad may choose to add other parameters to that list. All the parameters in both the GE list and the customer optional list (if one exists) are “recorded”; however, they are not necessarily “played back” when the data are read out. To view the recorded data, two basic but separate steps must be taken. First, all the recorded data in the memory module are downloaded to a laptop computer file, or a file on a PCMCIA memory card. Second, the downloaded file must be read out or played back. The downloaded file is read out using an analysis program designed and written by Pulse Electronics, according to the railroad’s specifications. The program is designed to play back only those parameters specifically chosen by the individual railroad. The Amtrak GE IFC analysis program did not extract all the available parameters because the program was written to meet an older GE data format specification, which was not the specification for the recorders installed on the accident locomotives. Readout. The on-scene readout was performed using the Pulse Electronics GE IFC Data Analysis Software program PPN 17502 v3.2.23 This program version did not reveal any data related to emergency brake application(s), other than the PCS and brake pipe pressure parameters. These two parameters are sufficient to indicate whether an emergency brake application was made; they cannot be used to determine whether the crew initiated the emergency brake application. Subsequent to the on-scene portion of the investigation, Amtrak informed the Safety Board that the type of emergency (“Emergency” parameter) actually was recorded; a different type of readout software was needed to extract it. After the Safety Board consulted the recorder manufacturer, it was determined that six other parameters were actually recorded but not extracted by the Amtrak IFC analysis program. These were: emergency type, EOT emergency (on or off), bell, brake handle position, EIE (on or off), and dynamic brake derate (on or off). Because these parameters could not be extracted from the recorded data using the Amtrak analysis program, another analysis program had to be used to attempt to retrieve this data. A program that is intended for use with BNSF data was used in this case (Pulse Electronics Data Analysis Software program PPN 17463 v2.1). This program was used to print tabular data for ATK 47 for the last 2 miles of recorded data. Because this program

23 This is the latest Amtrak IFC analysis and readout program.

Factual Information 41 was designed for use with BNSF and not Amtrak recorders, none of the Amtrak optional parameters could be recovered. Signal Event Recorders Signal event recorders are located at Griffith, CP 526.8, and at automatic signals 5052 and 5051 for eastward and westward trains, respectively. The signal event recorder monitoring the position of signals, switches, and track occupancy at CP 526.8 indicated that Amtrak train 4 had passed CP 526.8 at 5:24 a.m. The event recorder at eastbound automatic signal 5052, the last signal Amtrak train 4 passed before derailing, recorded a time of 5:56 a.m. The last train that passed signal 5052 before the derailment was recorded at 3:36 a.m. The event recorder at westbound automatic signal 5051 indicated trains passing at 4:15 and 5:34 a.m. on the north track. Equipment Detectors Track-side FEDs are located at MP 512.5 for both tracks; each FED consists of a “hot box”24 and a dragging equipment detector that use radio communications. Amtrak train 4 was recorded as it passed the hot box detector on the south track at MP 512.5 at 5:49 a.m., operating at 89 mph. The printout indicated 80 axles (4 locomotives and 16 cars) with a recorded length of 1,474 feet. No defects were detected. High Water Detector Bridge 504.1, where Amtrak train 4 derailed, had no HWD; however, an HWD was located at bridge 505.9, which was linked to signals 5051 and 5082. (See figure 11, which shows the HWD location.) When the HWD is activated, it causes the signals at 5051 and 5082 to display a RED aspect, which, according to BNSF operating rules, requires the engineer to stop the train and proceed at restricted speed to the next signal. The HWD must then be manually reset before the signals will display any other aspect. The HWD at bridge 505.9 did not activate during the storm preceding the derailment because the flow of water was not high enough to contact the HWD. The HWD is mounted under the south bridge, approximately 18 inches below the bottom of the bridge deck, or about 5 feet above the streambed. (See figure 12 for a closeup view of the HWD.) On August 9, 1997, the HWD at bridge 505.9 was tested by submerging it in water. This de-energized the ZR relay that shunted or shorted the track circuit in approach to the danger of high water. Signal 5082 displayed a RED aspect for eastbound movements on the south track, and signal 5051 displayed a RED aspect for westbound trains on the north track.

24 Railroad jargon for an overheated bearing.

Factual Information 42 Figure 11. HWD on bridge 505.9 Figure 12. Closeup view of HWD

Factual Information 43 Bridges are not required to have HWDs. The BNSF does not have specific requirements for installing an HWD. According to the BNSF, an HWD was usually installed, with the concurrence of division level officers, at specific bridges when local maintenance personnel were aware of previous history of high water at that location. The BNSF informed the Safety Board that some superintendents preferred installing HWDs, while others did not. According to the BNSF, HWDs were installed before weather forecasting services were used. Amtrak Locomotive Couplers After the accident, the first three of the four locomotive units were found uncoupled and separated from the train and dispersed up to a mile away from the point of derailment. The front couplers on the second and third units had opened, allowing the preceding locomotive units to separate. The abutted rear-end couplers between the third and fourth units also had uncoupled. Each of the four GE P42-8DC locomotive units involved in the accident was equipped with an F8306E coupler and an F514E knuckle. The couplers had been manufactured by National Castings, Inc. They were F-type couplers made of E-grade steel. F-type couplers interlock to prevent vertical separation by means of a tang or metal horn on the opposite side of the knuckle, which fits into a pocket of a mate F coupler next to the knuckle. These F couplers also had a bottom shelf to prevent a coupler from falling between the rails and derailing a train in the event of a drawbar separation; the shelf would hold the detached coupler in place. Stopping Distance At the request of the Safety Board, Amtrak calculated train 4’s stopping distance with an emergency brake application on level, straight track with clean, dry rail from an initial speed of 88 mph and with the variance of one to four locomotive units in the train. For each locomotive unit consist, the calculation of the stopping distance reflects three different modes of braking: friction (no blended/dynamic), friction with dynamic, and no brake effort from the locomotives. The results of these tests are shown in table 5. Table 5. Calculated braking distances for an emergency brake application with 1 to 4 locomotive units and 16 cars Locomotive Type Units Total Weight (pounds) Train Braking Distances (feet) Add 2,469,200 for 10 pass and 6 MHC Friction Only Blended No Locomotive Brake P42-8DC 4 1,072,000 3,862 3,431 4,686 P42-8DC 3 804,000 3,705 3,365 4,306 P42-8DC 2 536,000 3,603 3,363 3,991 P42-8DC 1 268,000 3,488 3,362 3,675

Factual Information 44 Geotechnical Investigation The Safety Board requested geotechnical and drainage area information for bridge 504.1. The BNSF contracted with HDR Engineering, Inc.,25 to develop such information. The BNSF consultant’s work included a site reconnaissance, surface exploration, and laboratory testing of soils from the site. Following its analysis, HDR Engineering stated in its report26 that “Scour and undermining of shallow foundations with a loss of bearing support and settlement was the most probable cause of the bridge failure.” The consultant’s report also stated that “Transient subsurface groundwater and moisture conditions … and the vibration caused by the train passage could have possibly liquefied or greatly reduced the shear strength of the foundation soils and caused additional settlement under load.” The HDR Engineering report concluded that the probability of this second failure mode was small. HDR Engineering also performed a hydrology study to determine the drainage basin of bridge 504.1. The study included the hydrologic and hydraulic conditions associated with the accident bridge and other adjacent BNSF bridges. These included the bridges numbered 503.1, 503.7, 504.1 (the accident bridge), 505.6, and 505.9. All these bridges are located within interconnected drainage basins along the north side of the railroad grade fill. The bridges on the north and south tracks are of similar construction to bridges 504.1N and 504.1S, respectively. (That is, the north track bridges are timber-pile- supported and the south track bridges are on shallow foundations or mud sills.) In addition, bridges 503.1 and 503.7 each have a concrete crosswall immediately downstream, as did bridge 504.1. The HDR Engineering study showed that bridge 504.1 had a 19.5-square-mile drainage area basin within the Peacock Mountain range to a broad smooth valley (Hualapai Valley), drained by a major wash referred to as the Hualapai Wash. Flood flows would carry long distances overland before collecting into the washes. The watercourse for bridge 504.1 sloped at 207 feet per mile. With respect to scour, the study found the soils within the area highly erosive and unstable, with flow velocities approaching 3 fps. Scour at the accident site varied depending on its location within the basin. Graded roadways above the bridge area provided for collection and concentration of flow. The flow at the bridge is fully concentrated, which greatly increases the stream power potential and results in scour hole formation. The depth was unknown because of sedimentation filling the holes on the

25 HDR, Inc., offers a broad range of architectural and engineering services. The company employs more than 1,800 engineers, architects, scientists, and support personnel worldwide and is based in Omaha, Nebraska. Its subsidiary company, HDR Engineering, Inc., provides water/wastewater, transportation, and waste/energy services. 26 HDR Engineering, Inc., under contract with the BNSF, produced an engineering report entitled “System Analysis Seligman Subdivision Bridge No’s. 503.1-505.9.”

Factual Information 45 recession side of the flood. At all structures studied, the study found that the potential for scour depths sufficient to undermine shallow footings is great. HDR Engineering considered that structures supported on deep piles (such as 60-foot depths at bridge 504.1N) should be adequate. The HDR Engineering study stated that the highway box culvert downstream from railroad bridge 504.1 was undercapacity to carry the 50- and 100-year floods but more than adequate to handle the 10-year flood. It further noted that the washes draining bridges 503.1, 504.1, and 505.9 were eroded below the Route 66 structures. The channel bed immediately downstream from these highway structures had degraded from 3 feet to over 10 feet. The study also stated that these highway structures have the potential of being washed out with the next major flood event. The study stated that: At this time, based on the bed degradation which has developed below all five of the downstream highway 66 bridge structures, the highway structures have the potential of being washed out with the next major flood event, with the potential for the resultant headcut (of a potential magnitude of 5 feet) proceeding through the railway bridges (Br. 503.1, 504.1, and 505.9). The HDR Engineering report recommended installing a replacement structure for bridge 504.1 that would have longer spans of concrete slabs to provide a reduced risk of debris collection at the bridge, an increased waterway opening area for reduced stream velocities, and 60-foot piling to protect against scouring relative to the former shallow footings. Postaccident Actions The BNSF The BNSF replaced the two existing bridges at MP 504.1 with two separate ballasted deck structures, consisting of three 20-foot concrete slabs on steel H-pile bents with concrete caps and a concrete spreader at the ground line. The BNSF informed the Safety Board that the new structure provides a waterway opening of about 503 square feet with a capacity of 5,540 cubic fps. The BNSF further stated that the bridge is theoretically capable of handling runoff from a 40-year storm event. According to the BNSF, with the adjacent structures’ runoff capacity, a storm event of the 100-year-storm category could be handled. In addition, the downstream side of the stream channel has been widened. The BNSF engineering department is conducting systemwide training classes for its track and bridge inspection personnel, signal employees, and maintenance-of-way supervisors on how to recognize and report scouring around bridges and culverts. During this training, the employees are provided information to allow them to make reasonable judgments on the condition of the bridge or culvert and encouraged to call the bridge

Factual Information 46 inspector for final evaluation. Numerous pictures are shown during the training, including those representing this accident. Since the accident, the BNSF has identified all its bridges with similar supporting foundation structures for special inspection attention. The track supervisor involved in the inspection of the bridge in this accident stated, regarding his attendance at a class, that it: …made us aware of what that entails, what—they made us aware of the profile of downstream activity under any bridge, culvert, streambed or all that business, which I had prior—before the incident no—no knowledge of. The bridges with mud sill foundation or shallow foundation have been clearly marked on my territory so that I would be able to identify their location in any inclement weather or darkness. If I would observe water bank to bank at any depth in these locations trains are going to stop, and would not be allowed to proceed until [a] competent bridge inspector has made a determination that the mud sill bridge, which is a sound structure in itself if protected properly, is okay, and that sums that up pretty good. On March 2, 1998, the BNSF informed the Safety Board of a revision to the Maintenance Alert it issued following the accident at Kingman. This revised Maintenance Alert was the result of severe storm-related conditions and traffic delays on BNSF’s Northern California Division through the San Joaquin Valley. The revision states that when a flash flood warning has been issued for an area by the BNSF NOC, passenger trains are limited to 50 mph and freight trains are limited to 40 mph with the following exception—if the limits of the designated area include bridges having been identified as vulnerable to scour, all passenger trains and “key”27 freight trains are limited to restricted speed—the same as the initial Maintenance Alert.28 (See appendix C.) The FRA On September 4, 1997, the FRA issued Safety Advisory 97-129 recommending that railroads take certain actions to reduce the risk of train derailments that could result from severe weather conditions, particularly undetected flash floods. (The advisory is not regulatory but a recommended action.) The FRA determined that each railroad controlling train operations on Class 4 or higher track, or passenger trains in commuter or intercity service, should have programs and procedures in place to protect train operations during severe weather, and particularly flash flooding, by the means cited below:

1. The railroad should have in place a procedure that will assure that all

notifications issued by the NWS of flash flood warnings will be received within 15 minutes of issuance from the NWS, directly or through a contract

27 The BNSF has defined “key” freight trains as those carrying hazardous materials. 28 The BNSF has identified 14 bridges on the Northern California Division as being vulnerable to scour because their foundations do not have piling. 29 SA 97-1; 62 FR 46793.

Factual Information 47 weather forecasting service, by the train dispatchers or other employees controlling the movement of trains on all track of Class 4 or higher or upon which passenger trains operate in commuter or intercity service, within the warning area. In the case of such track located outside of the warning area but subject to damage from water resulting from the storm, the information should be obtained in time to permit timely response by the railroad.

1. After the receipt of a warning of a flash flood which might damage track or

bridges, the railroad should notify train crews and limit the speed of all freight and passenger trains to that which will permit the train to operate safely, consistent with the potential water levels and visibility conditions, on all track subject to damage from the flood. The limitations should continue until a special inspection in accordance with 49 CFR 213.239 has been performed of that track and it is determined that a hazard no longer exists. In making that inspection and determination, the time taken for the heaviest flow of water to reach the track should be considered.

1. Each railroad affected by this advisory should identify its bridges carrying

track of Class 4 or higher or over which passenger trains operate in commuter or intercity service, which are vulnerable to damage from flash floods or similar weather-related phenomena. Particular attention should be given to bridges which incorporate piers, bents, or abutments, which are founded on soil or degradable rock which could lose its integrity as a result of scour by moving water, and which are commonly referred to as “mud sills'” or “spread footings.”

1. The information developed in paragraph 3 should be compiled and made

available to each person who can be called upon to perform special inspections on the subject track following a flash flood warning. Consideration should be given to placing identifying marks on bridges that need particular attention in special inspections, along with the bridge number, to assist inspectors in locating them with certainty during inclement weather. Consideration should also be given to the use of automated high water detectors or similar sensing and warning systems on specific bridges which could incur water damage that would be hidden from or not otherwise detectible by a human inspector.

1. In addition to the bridge-specific information called for in paragraph 3, each

affected railroad should implement a training program for the persons performing special inspections. The training should include methods to recognize and protect the safety of railroad operations from the damaging characteristics of flowing water in general, with particular regard to the effects of a watercourse that takes a significant change in horizontal direction or vertical profile near the track; the effects of drift material accumulation on scour and the capacity of the waterway opening; and the potential for damage by impact of heavy floating objects.

Factual Information 48

1. Refresher training of track inspectors on the subjects addressed in

paragraph 5 should be conducted at least once each calendar year. Where practicable, that refresher training should include a joint inspection by a track inspector and a cognizant bridge maintenance or engineering employee over the inspector's assigned territory. During that joint inspection they should locate the vulnerable components in the bridges identified in paragraph 3, discuss the precautions to be taken in the event of indications of distress in those components, observe drainage conditions on and adjacent to the right-of-way, and note changes for inclusion in the revisions of information called for in paragraph 9.

1. If a track inspector is assigned to perform a special inspection in accordance

with paragraph 2, and bridges identified as vulnerable are in the track segment subject to damage from the flash flood, a cognizant bridge maintenance or engineering employee should be readily available by telephone or radio to assist in the interpretation of findings by the track inspector.

1. Each affected railroad should brief all of its track and bridge inspectors on

the contents of this advisory. These briefings should occur within 14 calendar days of the date of publication of this safety advisory in the Federal Register.

1. FRA believes that the actions described in paragraphs 3, 4, and 5 should be

completed within 60 calendar days of the date of publication of this safety advisory in the Federal Register. During this period, each affected railroad should complete an initial review of its bridges for vulnerability to high or rapidly flowing water and provide that information to its inspectors. More detailed reviews should be substantially completed and provided to inspectors during calendar year 1998 and then maintained in a current status.

1. FRA requests a letter within 45 calendar days of the date of publication of

this safety advisory in the Federal Register from each affected railroad specifying the actions it has taken and will initiate to enhance the safety of train operations in the event of a flood or a high or rapid water condition. On November 14, 1997, the FRA issued an amendment to Safety Advisory 97-1 that permits the use of other competent commercial weather services that receive and review warnings and weather data from the NWS as part of its procedures. The FRA Track Safety Standards (49 CFR part 213) state, “In the event of fire, flood, severe storm, or other occurrence which might have damaged track structure, a special inspection must be made of the track involved as soon as possible after the occurrence.” The advisory states that the FRA purposely made the provision general in nature, because “It is not practicable to specify in a minimum safety standard all the conditions which could trigger a special inspection, nor the manner in which any

Factual Information 49 particular special inspection must be conducted.” The FRA considers that, “It is more effective to provide information and guidance to the railroad industry, which each railroad can then adapt to its own circumstances.” Arizona Department of Transportation On August 12, 1997, the Arizona Department of Transportation (ADOT) inspected the box culvert immediately downstream from BNSF bridge 504.1. ADOT informed the Safety Board that it routinely inspects structures after major flash flood events. The remarks and recommendations section of the ADOT inspection form for that inspection included the following: “There were no significant culvert problems caused by the recent flow; recommend replace minor eroded fill behind the outlet wings.” According to 23 CFR 650.301, a structure is considered a bridge if the opening measures 20 feet or more along the roadway centerline. ADOT inspection reports indicated that the box culvert immediately downstream from BNSF bridge 504.1 is 32 feet long along the centerline of the roadway. As a result, the bridge (box culvert) is on the Federal Highway Administration’s inventory and is subject to inspection every 4 years,30 in accordance with Arizona’s box culvert inspection plan. The box culvert’s last scheduled inspection before the accident had taken place on February 26, 1997. With respect to the waterway opening, the ADOT inspection report for this inspection stated (in part): “3) channel openings 100 percent both ends, has 1.8 feet scour at outlet; ok, High water mark: 1 foot below ceiling near inlet.” The report did not indicate how recently the high water mark had been made. According to ADOT, an inspection of a scour-critical bridge includes a measurement of evidence of scour and scour calculations. ADOT considers a box culvert, because of the nature of the structure’s design, to be a low-risk or scour-stable structure. Other Information Amtrak’s Proposed Procedures for Passenger Manifests Amtrak’s general manager for Operations, Standards, and Compliance told the Safety Board that Amtrak has a contract with a service to provide a satellite-based communications system. The system is about 75-percent installed. It consists of a satellite communications unit in the body of the train that can permit portable two-way communications between the train and Amtrak’s national operations center.31 The locomotive would have a laptop-type computer, and the conductors would be able to

30 From 1971 to 1995, all box culverts over 20 feet in length on the State Highway System were inspected every 2 years. In 1995, the frequency interval was changed to every 4 years. 31 The Amtrak national operations center has been relocated from Philadelphia, Pennsylvania, to Wilmington, Delaware.

Factual Information 50 communicate through the locomotive’s computer and antennae. This communications system would be independent of the locomotive radio for communicating with the host railroad’s train dispatcher for train operations. According to Amtrak’s general manager for Operations, Standards, and Compliance, Amtrak will next develop a method to use the system to account for passengers on the train. This general manager stated that it is difficult to account for passengers on unreserved trains because tickets can be bought one day and not used for weeks, be given to someone else, or be used to board the train at other locations by paying the difference in fare. Amtrak compares the unreserved trains to transit and commuter systems, which passengers get on and off frequently. He stated that Amtrak must be able to provide a manifest to account for passengers on its reserved trains, despite the current practice of not requiring tickets for infants and small children. Amtrak has tried issuing nonrevenue tickets to account for such passengers but has found the process cumbersome and ineffective. The general manager for Operations, Standards, and Compliance also stated that, in past accidents and incidents, Amtrak personnel have had to search for the conductor’s pouch to count the tickets to determine the number of people on the train. This general manager has prepared a draft policy to change those procedures, and Amtrak has established a working group to ensure that an official passenger count is provided to the national operations center. The official count would include ticketed revenue passengers and nonrevenue nonticketed passengers such as infants, Amtrak employees traveling on a pass (regardless of travel status), employee dependents, and authorized employees of a railroad over which tracks Amtrak is operating. According to this general manager, Amtrak will use the satellite communications system to put a form in the computer. Each train conductor will add to the form some information about the number of people on board each train, and the information will be sent to the national operations center and made immediately available to other Amtrak personnel. He also stated that when the process has been tested satisfactorily, it will be implemented on all reserved seat trains. Amtrak train 4 was not equipped with the new communications equipment. According to the conductor and one assistant conductor, at the time of this accident, they were in the dining car working on tickets. The conductor said that he did not have time to look at the manifest because it was in the dormitory car. He also stated that the manifest contained the number of passengers in coach sections and a complete list of passengers in the sleeping cars. The conductor said that the manifest should have been up to date except for tickets taken at Kingman. On March 24, 1998, Amtrak demonstrated its new satellite communications system for Safety Board investigators. The system included an on-board mobile communications terminal in the locomotive, a conductor’s portable unit, and a global positioning system locator for the locomotive. The system demonstrated that Amtrak now has the ability to communicate, independently of a host carrier, with its own trains

Factual Information 51 anywhere in the United States (with certain exceptions, such as tunnels). The system is programmed to accommodate 19 preformatted messages for train status and direct communications between the train and its national operations center. These communications are also interactive between maintenance and customer service personnel. The system depends on accurate input by the on-board service personnel and on such personnel updating passenger information accurately. It has no remote printing capability. Also, if the locomotive unit loses power, the on-board computer will not work. Amtrak’s On-Board Service Personnel Emergency Situation Training Amtrak provides emergency situation training to its personnel through P.R.E.P.A.R.E. training, courses on assisting disabled passengers, and videotapes illustrating emergency procedures. In this training, emergency procedures are discussed while crewmembers are taught how to perform their duties, depending on their positions. Employees are taught about the classes of fires, what to do in an emergency, options to consider when deciding whether to evacuate a train, and how emergency personnel classify injuries during a triage. A Critical Assistance and Response for Employees program is also available to Amtrak employees. The Amtrak Manual for On-board Services Employees, dated February 1, 1992, Section A-4-6, details the procedures to be followed when responding to train emergencies involving fires, assisting in evacuations from different types of train cars, communicating using the public address system and intercom, and providing first aid for different types of injuries. In addition, the manual instructs train attendants to: … Ensure that all beds are properly made before boarding passengers. All beds will be made with the head toward the reading light. [According to an Amtrak representative, the beds are made with their ‘feet’ toward the engine]. Rooms with beds parallel to aisle, with a reading light at both ends of the bed will be made up to permit passengers to sleep with their feet toward the engine. Amtrak’s general manager for Operations, Standards, and Compliance stated that, in an emergency, it is the conductor’s responsibility to ensure that the appropriate entities are notified and to evaluate the scene to determine the type of evacuation procedures to be followed. The conductor is also responsible for providing information and assistance to emergency responders. This general manager also stated that Amtrak engineers usually review emergency procedures every 3 years, and the conductors review them every 2 years. On-board service crewmembers are scheduled for emergency situation training every 3 years. He further stated that employees who have been relocated recently may have missed scheduled training and that Amtrak determines which employees need training in emergency procedures by using the computer database for training records information. Table 6 shows Amtrak’s recorded dates of the last emergency situation training taken by its train crew and on-board service personnel involved in this accident.

Factual Information 52 Table 6. Emergency situation training record of train 4 personnel, as provided by Amtrak The train 4 engineer did not indicate that he had received any emergency situation training. The assistant engineer said that he had never been trained in handling a derailment. He further stated that the crew just developed teamwork to help each other. The conductor stated that he had received emergency training by watching a videotape that demonstrated how to remove windows and open doors. One assistant conductor had received training on how to flag oncoming trains and on notification procedures. The other assistant conductor stated that he had seen videotapes on emergency procedures and had participated in a course on how to evacuate passengers from tunnels. He said that Amtrak crewmembers needed more hands-on training and that, “Films every 3 years or so just doesn’t do it.” An Amtrak train attendant who received P.R.E.P.A.R.E. training in 1996 stated that the training afforded her the opportunity to be “more knowledgeable, prepared, and focused on what needed to be done” when the Kingman derailment occurred. The attendant recommended that all crewmembers take the training and have refresher courses every 2 years. Train crewmember position Date of last emergency situation training Engineer Assistant Engineer Conductor 1993 Assistant Conductor 1 Assistant Conductor 2 Chief On-Board Service 6/3/97 Lead Service Attendant 1 6/10/93 Lead Service Attendant 2 2/7/90 Service Attendant 1 6/24/93 Service Attendant 2 Service Attendant 3 Train Attendant 1 3/14/96 Train Attendant 2 5/2/97 Train Attendant 3 Train Attendant 4 4/24/96 Chef 4/18/90 Food Service 1 Food Service 2 4/24/96

53 Analysis General The BNSF’s FRA-qualified track supervisor had last inspected the track through the accident area on August 6, 1997, and did not note any defects. Neither the track geometry car tests nor the ultrasonic rail inspection tests noted any deficiencies. In addition, a postaccident inspection by investigators did not reveal any deficiencies from the BNSF-designated FRA Class 5 track safety standards. The Safety Board therefore concludes that the track did not cause or contribute to the accident. The signal system was thoroughly tested after the accident and no anomalies were found. All inspection and test reports were within the prescribed requirements of the FRA’s signal regulations. The Safety Board concludes that the signal system was not a factor in the accident. At the time of the accident, “Warning 0004,” issued by the BNSF contract weather service, WDI, was in effect for the accident location. The warning called for flash flooding, thunderstorms, and heavy rain. The Safety Board concludes that the weather warnings and alerts issued by WDI were both timely and substantially correct. A Safety Board review of Amtrak and FRA forms documenting the required predeparture mechanical and air brake tests and inspections revealed that all tests and inspections were performed as required and no defects were noted. Examination and testing of the train equipment at the accident site did not reveal any preexisting condition that may have caused or contributed to the accident. In addition, the operating crew did not report any anomalies with the mechanical condition of the train before the accident. Therefore, the Safety Board concludes that the mechanical condition of the train was not a factor in the accident. The engineer, assistant engineer, and conductors all were in good health, well rested, and qualified on the operating rules and physical characteristics to operate passenger trains over this territory. Because of the darkness and the speed at which the train was traveling, the operating crew had only a few seconds to identify and respond to (that is, apply the brakes) the anomaly noted in the track at the bridge. The crew applied the brakes about the time the train crossed the bridge. The Safety Board concludes that the health, rest, and qualifications of the train crew were not factors in the accident. On the day of the accident, the track supervisor was in good health. Although he had been awakened earlier than he had planned, no evidence indicates that fatigue impaired his performance. He was adequately trained to perform track inspections over his territory, and he responded in a timely manner to the instructions to inspect the track. However, he had not received training specific to bridge inspections; consequently, he was not qualified to conduct the necessary inspection of the bridge structures under these circumstances. The Safety Board therefore concludes that, although the track supervisor

Analysis 54 conducted a track inspection over his territory during the flooding, he was not qualified to conduct bridge inspections. Under the FRA’s regulation at 49 CFR 219.201(b), toxicological testing was not required to be performed in the case of this accident. The Safety Board found no evidence to indicate that the circumstances of the accident were related to fatigue or impairment. The Accident About 5:56 a.m. on the day of the accident, both the engineer and assistant engineer of Amtrak train 4 saw a “hump” in the track as they approached bridge 504.1S. They applied the train’s emergency braking but did not have sufficient time or distance to stop the train short of the “hump.” The train derailed, and the locomotive units separated as the train was crossing the bridge. The train came to a stop with the last occupied passenger car spanning the failed bridge. The ground under the bridge support structure had been washed away, and the bridge was probably collapsing while the train was passing over it. After receiving severe weather alerts and flash flood warnings from WDI earlier on the morning of the accident, the BNSF NOC had notified its maintenance-of-way operations desk of the information that applied to the Kingman area. The BNSF NOC had the responsibility to ensure the safety of its train operations through the Kingman area through its train dispatchers. Train operation personnel rely on the maintenance-of-way personnel to perform the appropriate inspections to provide the necessary level of safety for continued train operations. (This is an expected function of maintenance-of-way personnel and not unusual in the railroad industry during severe weather conditions.) When an unsafe condition is found, the track inspector has the responsibility to notify the train dispatcher so that the dispatcher can alert engineers of trains operating in the affected area to stop their trains or coordinate their trains’ movements with the track inspector, or both. About 1:57 a.m. on the morning of the accident, the track supervisor was ordered by the maintenance-of-way desk to perform a track inspection for his territory. He began his track inspection about 4:05 a.m., stopping at several bridges before bridge 504.1 without noting anything unusual. However, at bridge 504.1, the accident bridge, he did not stop but made his observations from his hy-rail vehicle. He later stated, “That’s the first time that I saw that volume of water under that particular bridge… [the water was] lapping against the bottom of the bridge.” He also stated, “I knew from experience that what—that I was looking for anything out of the ordinary—and at the time the knowledge that I had—I took no exception to anything I observed.” He did not report any problems to the dispatcher and continued with his inspection. The Safety Board identified several concerns as a result of its investigation. The most important were the circumstances that precipitated the bridge failure, the adequacy and method of the bridge inspection process, and the injuries to passengers of the Amtrak

Analysis 55 train. Because of these concerns, the investigation focused on safety issues identified in the following areas: safety of structures subject to damage in severe storms, passenger safety and emergency response procedures, and protection of employees on or adjacent to the track in the performance of their duties. Safety of Structures Subject to Damage in Severe Storms Failure of Bridge 504.1S The investigation examined the adequacy of the design, maintenance, inspection, and drainage area characteristics of bridge 504.1S in light of the severe weather and flash flood conditions affecting the bridge and the subsequent failure of the crosswall and the bridge supporting structure. The south bridge, 504.1S, was supported by a shallow foundation consisting of timber mud sills and timber blocking. BNSF records showed that the bridge supports were susceptible to scouring and erosion as early as 1959, when it was necessary to add stones and grout to a portion of the streambed. In the succeeding years, additional stones and grouting were added. Records also showed that, in 1975, maintenance personnel were still concerned about the bridge supporting structure and its water-carrying capacity. In fact, they remained so concerned that they recommended that the bridge be placed on the CIP list for replacement. BNSF bridge records identifying the size of the drainage area for bridge 504.1 were inconsistent. One record showed the drainage area as encompassing 3.8 square miles, while another showed the drainage area as totaling 19.09 square miles. The size of the drainage area is an important element in determining the required waterway opening for drainage structures. After the accident, the BNSF’s consultant (HDR Engineering, Inc.) determined that the drainage area for bridge 504.1 was 19.5 square miles. The consultant’s report cited the accepted engineering practice of using the 100-year storm criteria to provide for drainage structures but noted that local conditions and circumstances, such as the desert nature of the Kingman area, allowed for making an engineering judgment resulting in higher or lower values. According to the consultant’s report, the bridges located at MP 504.1 at the time of the accident were capable of withstanding a 24-year storm. The storm related to this accident was determined to have been approaching a 50-year storm event of 2 hours’ duration. (The August 9, 1997, storm’s effect differed among the five railroad bridges in the area. Bridge 504.1 experienced an approximate 50-year storm event, while bridge 503.7, for example, experienced an approximate 10-year storm event.) The bridge with which the BNSF replaced bridge 504.1 following the accident is capable of withstanding a 40-year storm.

Analysis 56 In 1975, ATSF (BNSF)32 management placed bridge 504.1 on the 1977 CIP replacement program because the results of engineering studies raised concerns about the bridge’s ability to provide an adequate waterway opening and about recurring erosion problems. In early 1976, however, ATSF (BNSF) bridge maintenance personnel made a field decision to build an unreinforced concrete crosswall on the downstream side of bridge 504.1. Bridge 504.1 was subsequently removed from the 1977 replacement program. Only two instances of high water were recorded for bridge 504.1 and both took place in 1976. This was after 1971 work affecting the box culverts downstream from the BNSF bridges had been performed by the ADOT and after bridge 504.1 had been removed from the CIP budget list. Before the 1997 derailment at bridge 504.1S, no accidents involving high water or bridge failure were recorded for the Kingman area. The purpose of the unreinforced concrete crosswall was to allow silt to back up and accumulate around the mud sills, thus acting to mitigate further scouring and erosion. However, no engineering evaluation was performed on the design and construction of the unreinforced concrete crosswall to determine the necessary anchorage, the appropriate size, the need for reinforcement, or the hydrologic characteristics of the waterway. The severe flash flooding and resultant stream flow between bridge 504.1 and Route 66 caused severe erosion that rapidly progressed upstream. The Safety Board cannot determine whether channel improvements made in 1971 contributed to this development, but evidence of streambed erosion was found during the on-site investigation. This erosion progression caused the failure of the unreinforced concrete crosswall because it was not anchored and was only 33 inches in depth. Because it was unreinforced, the crosswall broke into several pieces when its shallow footing was undermined. When the concrete crosswall failed, the rate of erosion accelerated through the accumulated silt to the point that it quickly progressed to the shallow foundation of the bridge. This process undermined the bridge’s mud sills and timber blocking and compromised the bridge’s ability to support Amtrak train 4. The Safety Board therefore concludes that the failure of the bridge 504.1S was caused by scour and erosion affecting the inadequately protected shallow foundations that supported the bridge; the scour resulted because a poorly designed concrete crosswall was built instead of a new and better-engineered bridge. (See figures 13 through 16.)

32 At this time, the October 1, 1995, merger between the ATSF and the Burlington Northern Railroad had not yet taken place.

Analysis 57 Figure 13. Crosswall after the accident Figure 14. Closer view of failed crosswall

Analysis 58 Figure 15. Scour and erosion at bridge 504.1 Figure 16. Another view of scour and erosion at bridge 504.1

Analysis 59 Consequently, the Safety Board believes that the BNSF should identify and perform a risk assessment of all system bridges that have shallow foundations of similar construction to the bridge that failed in the Kingman, Arizona, accident and replace those bridges determined to be susceptible to undermining and loss of the supporting foundation structure. In conjunction with the risk assessment, the BNSF should perform a hydrology study on shallow foundation structures with questionable drainage areas to determine their current drainage areas. The Safety Board also believes that the FRA should require that all railroads identify and perform a one-time risk assessment of the bridges on their systems that have shallow foundations of similar construction to the bridge 504.1 that failed in the Kingman, Arizona, accident and require replacement of those bridges determined to be susceptible to undermining and loss of the supporting foundation structure. In addition, the Safety Board is concerned that similar situations may exist on other railroad systems in the country that are subject to flash flooding. Therefore, the Safety Board believes that the Association of American Railroads and the American Short Line and Regional Railroad Association should provide information to make their memberships aware of the facts and circumstances of this accident. Risk Concern for Route 66 Concrete Box Culverts In its report to the BNSF, HDR Engineering noted concerns regarding the concrete box culverts under Route 66 adjacent to and downstream of the BNSF bridges in the accident area. Results of the BNSF hydrology study revealed that the highway box culvert downstream from railroad bridge 504.1 was apparently engineered to withstand a 25-year flood. According to the study, At this time, based on the bed degradation which has developed below all five of the downstream highway 66 bridge structures, the highway structures have the potential of being washed out with the next major flood event, with the potential for the resultant headcut (of a potential magnitude of 5 feet) proceeding through the railway bridges (Br. 503.1, 504.1, and 505.9). ADOT inspectors did not find any significant problems with the bridge (box culvert) either during the last scheduled inspection in February 1997 or the postaccident inspection of August 12, 1997. Although scour observations and measurements were made by the ADOT inspector, no scour calculations were made during either inspection. ADOT did not require scour calculations. Although the Safety Board did not request that the BNSF conduct a hydrology study or a scour vulnerability assessment of either the highway box culvert or the railroad bridges for the Kingman investigation, the BNSF provided this information to the Safety Board in its report. The Safety Board is concerned about the statements made in the BNSF report regarding the vulnerability of the box culverts and the potential effect such culverts might have on the railroad bridges in another severe storm situation.

Analysis 60 However, the BNSF report did not include ADOT bridge inspection data or pictures of the streambed dating back to 1971, information that would have been helpful in determining the relationship between the box culverts and the railroad bridges. The Safety Board therefore concludes that the relationship of the two structures and their respective zones of influence is not fully understood. The Safety Board believes that the ADOT should examine the “System Analysis Seligman Subdivision Bridge No.’s 503.1- 505.9” report in light of its own historical bridge inspection information and take any action it deems appropriate. In addition, the Safety Board believes that the Federal Highway Administration should examine the “System Analysis Seligman Subdivision Bridge No.’s 503.1-505.9” report and the ADOT historical bridge inspection data to determine the hydrologic relationship between the box culvert and bridge 504.1. If the examination determines that the structures have a detrimental hydrologic effect on each other, the Federal Highway Administration should alert the States and the FRA that similarly related structures may be vulnerable to similar problems. Adequacy of Inspection Procedures During Severe Weather Events The track supervisor inspecting the track and bridges stated that on the day of the accident he took no exception to anything that he observed. He stated that, based on his knowledge of bridge inspections at that time, he was, “Completely 100-percent confident that my railroad was able to support traffic of any nature after I had made the inspection.” He stated that if he had observed debris under the bridge, he would have become concerned, notified the dispatcher to stop trains in that area, and requested help from a roadmaster. He also stated that he had no knowledge that one bridge would be less able to support train traffic than another. On the day of the accident, the presence of water above the bridge foundation would have prevented thorough inspection of the bridge supporting structure by anyone, even a qualified bridge inspector. However, the high water levels could have indicated a potential for structural failure of the bridge foundations. A track inspector with relevant bridge inspection training could have recognized that the flooding had the potential to cause problems with several bridges in the Kingman area—including bridge 504.1—and taken measures to stop train traffic until a thorough inspection of the bridge supporting structure could be conducted. Following the accident, the BNSF developed a 1-hour training program concerning bridge inspections for maintenance-of-way employees. The training describes various types of bridges and their supporting structures (such as shallow-foundation and deep-foundation bridges) and “tell-tale” signs that the structure may have been damaged. The track supervisor who inspected bridge 504.1 on the day of the accident has since taken the BNSF training, and, in hindsight, found that his knowledge of bridges at the time of the derailment would not have been adequate for him to assess possible damage.

Analysis 61 For instance, before his training, the track supervisor was not alarmed by the presence of high water under bridge 504.1. Since his training, however, he recognizes the possibility of the bridge supporting structure being damaged as a result of any amount of water around it. The BNSF expects that this training will provide basic insight for track inspectors to recognize the types of bridges susceptible to damage in severe flash flooding conditions when a qualified bridge inspector is not immediately available to perform an inspection. Also, it will teach track inspectors to stop trains before they reach the bridge if they have any doubt as to the bridge’s safety. The program has not been in place long enough to evaluate its effectiveness. Before the training program was instituted, the BNSF should not necessarily have relied on its track inspectors to adequately assess possible bridge damage caused by flooding conditions; rather, the BNSF should only have relied on qualified bridge inspectors to perform these inspections. In this case, had the qualified bridge inspector for the area been notified immediately of the flash flooding near Kingman, he would not have arrived in time to have inspected the bridge before Amtrak train 4 derailed. When the derailment occurred, the bridge inspector assigned to this area was at home, on vacation, and he told investigators that it would have taken him at least 4 1/2 hours to drive to Kingman. Therefore, additional responsibility (such as for bridge inspections) was placed on the track supervisor, who at that time had not been trained to recognize the potential damage flood waters could cause to bridge foundations. Because the track supervisor was not a qualified bridge inspector and had not received formal training in this area, he was ill prepared to complete rudimentary bridge inspections. The BNSF understood that, during flooding conditions, a bridge inspector could take several hours to arrive on scene. As a result, the responsibility for ensuring the integrity of both the track and bridges was often placed on the track inspector (or, in this case, the track supervisor). The Safety Board concludes that Amtrak train 4 derailed when bridge 504.1S failed because the BNSF maintenance-of-way managers lacked proper foresight and planning regarding the assignment or training or both of personnel designated to conduct bridge inspections during severe weather. The Safety Board believes that the BNSF should evaluate, and improve as necessary, its basic bridge inspection training program for track inspectors to ensure that appropriate procedures are used in emergency situations. Further, the Safety Board believes that the BNSF management should periodically review bridge inspection training for track inspectors to ensure that it meets program objectives. Protection of Trains During Severe Weather Conditions On August 10, 1997, (the day after the accident) the BNSF issued a Maintenance Alert that stated a policy for trains operating during severe flooding. The Maintenance Alert was subsequently updated on February 20, 1998, because of severe storm-related conditions and traffic delays that affected the BNSF’s Northern California Division through the San Joaquin Valley. The updated version of the alert is applicable only to that BNSF division. Trains on all other BNSF divisions must comply with the August 10,

Analysis 62 1997, Maintenance Alert requirements of 40 mph for freight trains and “restricted speed” for passenger trains until the weather warning expires. In the February 20, 1998, version, the train speed restrictions for both freight and passenger trains were relaxed from the earlier Maintenance Alert. When weather warnings are issued for a “flash flood warning,” freight and passenger trains are restricted to 40 mph and 50 mph, respectively, except in the areas where the 14 bridges have been identified as being vulnerable to scour because their foundations do not have piling. In those instances, the BNSF’s passenger trains and “key trains” (those transporting hazardous materials) are required to operate at restricted speed, but all other freight trains can operate at 40 mph. The Maintenance Alert stays in effect until the weather warning expires. The Safety Board recognizes the added safety for the train crews and passengers provided by reducing the speed of the passenger trains to a level from which they can be stopped in a relatively short distance in the event of an emergency. The Safety Board does not understand, however, the safety rationale for BNSF freight train crews being permitted to travel at speeds that may still require stopping distances of up to a mile. The Safety Board concludes that when, because of flash flooding conditions, the integrity of bridges has yet to be validated, it is critical that trains be operated at a reduced speed such as “restricted speed.” Train operations at restricted speed provide a margin of safety for the engineer to operate the train at a speed slow enough, while not exceeding 20 mph, to be able to safely stop the train within one-half his range of vision, which could be affected by weather conditions such as heavy rain or darkness or both. Therefore, the Safety Board believes that the BNSF should conduct a thorough analysis to determine the appropriate personnel, inspection, and operating policies to be used during flash flooding conditions and establish procedures designed to ensure the safe passage of all trains. The analysis should address the minimum training requirements for personnel responding to emergency inspections and should evaluate current inspection procedures and response actions to determine their adequacy during abnormal or emergency situations. In addition, the Safety Board believes that the BNSF should change its policy regarding freight train operating speeds so that it is consistent with the required operating speeds of other trains during flash flooding weather warnings, as noted in the August 1997 BNSF Maintenance Alert. The Safety Board acknowledges the prompt action taken by the FRA in issuing its Safety Advisory 97-1 for special inspection procedures for bridges, which resulted from the Kingman accident. The Safety Board, however, is concerned because the items listed in the FRA’s advisory are only recommended; they are not regulatory requirements. When issuing the advisory, the FRA cited the Track Safety Standards (49 CFR 213), which state in part, “In the event of fire, flood, severe storm, or other occurrence which might have damaged track structure, a special inspection must be made of the track involved as soon as possible after the occurrence…” as justification for the advisory. The FRA stated that it purposely made this provision general in nature, because, “It is not practicable to specify in a minimum safety standard all the conditions which could trigger a special inspection, nor the manner in which any particular special inspection must be

Analysis 63 conducted.” The FRA believed, “It is more effective to provide information and guidance to the railroad industry, which each railroad can then adapt to its own circumstances.” Although bridge inspections during severe weather circumstances are not mentioned in the FRA’s Track Safety Standards, it appears that the FRA assumes that the language in 49 CFR Part 213.239 is a “catch-all” for everything that should be done but is not specifically addressed. Had the FRA’s Safety Advisory 97-1 been in effect before the accident, the BNSF may have: had a program in place to identify those bridges that had specific features susceptible to damage in severe weather; analyzed the potential for damage to those bridges; and made that information available to those responsible for inspecting the bridges in such situations. As noted in this accident, however, the track supervisor did not have this type of information before the accident. If he had had this information, he should have been able to recognize the susceptibility of bridge 504.1S to damage during the severe flash flooding and could have taken action to stop trains until an appropriate inspection could be made by a bridge inspector; alternatively, he could have halted train traffic until the water subsided and it could be determined that the bridge was not in danger. The Safety Board concludes that, had the FRA issued minimum standards for special inspection procedures for bridges that would be at risk during severe weather, such as those standards recommended in its Safety Advisory 97-1, the BNSF track supervisor would have had better guidance for making the special inspection. Because the FRA issued the safety advisory as an informational guideline, it has already taken the first step in specifying some minimum safety standards for bridge inspection. Therefore, the Safety Board believes that the FRA should incorporate the intent of Safety Advisory 97-1 into minimum safety standards for special inspection procedures for bridges that would be at risk during severe weather. Passenger Safety and Emergency Response Procedures Passenger and Crew Accounting During the emergency response to the Kingman accident, the Incident Commander requested a copy of the train 4 manifest from an Amtrak employee. The conductor told Safety Board investigators that a passenger manifest was located in the dormitory car, but he did not have time to obtain it because he was helping passengers. The chief of on-board services said that he gave a copy of a sleeping car manifest to a firefighter. It took several days for Amtrak to provide an accurate passenger count of the entire train. A complete manifest is necessary, in addition to the counts provided by the conductor, so that emergency responders will be able to locate people on the train as quickly as possible and be alerted about those people who may need immediate assistance because of injuries or disabilities. Although a complete manifest of train 4 was eventually available, infants and small children were not included on it because Amtrak does not require tickets for infants and small children. Because the survival of passengers or crewmembers could depend on their timely rescue by emergency responders, the

Analysis 64 complete manifest should be provided to the Incident Commander as soon as he arrives on scene. Although no complete manifest was available during the emergency response in this instance, the lack of one did not appear to negatively affect the efficiency of the emergency response. As a result of the Safety Board’s investigation of the Amtrak train accident in Mobile, Alabama,33 the following safety recommendation was issued to Amtrak on September 30, 1994: R-94-7 Develop and implement procedures to provide adequate passenger and crew lists to local authorities with minimum delay in emergencies. Amtrak responded to the safety recommendation on July 18, 1995, stating that a three-phase project to provide a satellite and messaging system between long-distance trains and the corporate entities associated with their operation would be implemented. According to Amtrak, phase I would install the system, phase II would expand the system to more trains, and phase III would provide nationwide voice communications. In a letter dated October 4, 1995, the Safety Board stated that it was pleased to learn that Amtrak was about to implement this project to provide satellite communications capability on trains and that the new system would provide more accurate passenger manifests. Pending implementation of the new system, the Board classified the safety recommendation “Open—Acceptable Response.” On October 19, 1997, an Amtrak official provided the Safety Board with an update of Amtrak’s progress in developing the satellite system. The official stated that it would be difficult to account for passengers on Amtrak’s unreserved trains because of the frequent stops such trains make. He compared the unreserved trains to transit systems. However, he said that a procedure to account for passengers on reserved Amtrak trains is possible, and that Amtrak has a computer system in place that could do it. The Safety Board recognizes the practical limitations concerning Amtrak’s providing a manifest on unreserved trains because those trains are frequently commuter trains on which passengers may board and detrain quickly, purchase tickets ranging from a per ride to a monthly basis, and not be confined to certain cars or seating. However, reserved trains do not have these characteristics, and the procedure currently used to account for reserved train passengers, by counting tickets, can be improved. The Safety Board is aware that Amtrak has taken steps to improve its means of communication and ability to account for all occupants on board its reserved trains, and the Safety Board is encouraged by Amtrak’s progress in this area. The Safety Board concludes that because an accurate passenger manifest was not provided by the Amtrak train 4 crew to the Incident Commander, the emergency response

33 Railroad Accident Report—Derailment of Amtrak Train No. 2 on the CSXT Big Bayou Canot Bridge Near Mobile, Alabama, September 22, 1993 (NTSB/RAR-94/01).

Analysis 65 to evacuate and account for all passengers from the train could have been delayed, thus endangering passengers whose locations or circumstances were unknown to emergency responders. Therefore, the Safety Board hereby reclassifies Safety Recommendation R-94-7 to Amtrak “Closed—Reconsidered” and believes that Amtrak should expedite the development and implementation of a passenger and crew accountability system on reserved trains. Adequacy of Emergency Training Although passengers were safely evacuated, statements from the on-board service personnel and a review of their training records indicated that the reactions of several of them were based on instinct rather than organized emergency training. For example, one Amtrak attendant stated, “We had no real instruction or direction. We all went on instinct to help one another to see if there were injuries.” He stated that they needed more emergency training. Another attendant had attended Amtrak’s P.R.E.P.A.R.E. training course, which she said made her feel “more knowledgeable, prepared, and focused on what needed to be done.” This attendant recommended that all Amtrak crewmembers take the P.R.E.P.A.R.E. course on at least a 2-year cycle. The Safety Board reviewed Amtrak’s emergency situation training records for the 18 on-board service persons and operating crewmembers involved in this accident. The training time intervals recorded varied between employees. The most recent training that could be identified from the employee records ranged from training taken 2 months before the accident to training taken as much as 7 years before the accident. Eight employees did not have any emergency situation training dates listed in their training records. These findings are inconsistent with Amtrak’s stated policy of scheduling emergency situation training at least every 3 years for on-board service attendants. Also, although the operating crew participated in refresher or recertification training, their training records indicate that the operating crew did not participate in emergency situation training with on-board service attendants. Train 4’s on-board service personnel did not use the public address system to communicate evacuation information to the passengers. Although some crewmembers believed that the public address system did not work, they did not attempt to use it even though Amtrak’s emergency training procedures, as provided in the Amtrak training manual, call for its use in emergency situations. Wreckage documentation showed that the public address system was inoperable in some of the cars because of the damage sustained by the equipment. During emergency situations, particularly those involving passenger evacuations, the train crew and on-board service personnel are responsible for managing and directing the safe evacuation of passengers. Passengers rely on the training, experience, and leadership of the on-board service personnel. Required periodic emergency situation training should prepare the train crewmembers to confidently perform their duties when emergency situations occur.

Analysis 66 Since 1984, the Safety Board has addressed the need for Amtrak to improve its emergency situation training program. Over the years, the Safety Board has recognized improvements in Amtrak’s training program. Following its investigation of the Amtrak train accident in Lugoff, South Carolina, on July 31, 1991,34 the Safety Board recommended that Amtrak: R-93-23 Require that all on-board service personnel periodically take training in emergency operating rules and first aid, cardiopulmonary resuscitation, and the use of the public address system during train emergencies. In a letter dated December 27, 1993, Amtrak concurred with the merit of this recommendation. Amtrak formed a committee to develop an appropriate program to address these issues. The Safety Board responded on February 10, 1994, that a meeting with Amtrak would be postponed until the committee began its review of the issues. As a result, the Safety Board classified Safety Recommendation R-93-23 “Open—Acceptable Response.” Based on the personnel training record data reviewed in this accident, however, not all Amtrak employees appear to have received the necessary training or retraining in accordance with Amtrak’s program. All employees should be provided the same level of emergency situation training within a reasonable time period. Although the evacuation went well in this accident, the responsibilities of train crewmembers should not be carried out in an ad hoc manner. Amtrak employees should be trained in their emergency responsibilities and not have to rely on instinct alone. The lack of communication between the conductor and on-board service chief in providing a complete passenger manifest to the Incident Commander demonstrates a need for additional training of Amtrak personnel to emphasize their responsibilities when receiving requests from emergency responders and coordinating the emergency response on scene. In the Safety Board’s investigation of an accident that occurred on February 16, 1996, near Silver Spring, Maryland,35 the importance of the timely exchange of information between train crew personnel and the Incident Commander was examined. Coincident with the accident investigation, the FRA published, on February 24, 1997, the Notice of Proposed Rulemaking for Passenger Train Emergency Preparedness, which proposed requiring minimum Federal safety standards for the preparation, adoption, and implementation of emergency preparedness plans by railroads connected with the operation of passenger trains, including freight railroads hosting the operations of rail passenger service. The rule also required each affected railroad to instruct its employees

34 Railroad Accident Report—Derailment and Subsequent Collision of Amtrak Train 82 With Rail Cars on Dupont Siding of CSX Transportation, Inc., at Lugoff, South Carolina, on July 31, 1991 (NTSB/RAR-93/02). 35 Railroad Accident Report—Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation Amtrak Train 29 Near Silver Spring, Maryland, on February 16, 1996 (NTSB/RAR-97/02).

Analysis 67 about the provisions of the plan. The FRA issued the final rule on Passenger Train Emergency Preparedness on May 4, 1998, with an effective date of July 6, 1998. The Safety Board concludes that Amtrak’s current system for providing emergency training for train crews and on-board service personnel has not been effective, which has resulted in personnel being provided differing levels of emergency situation training. The Safety Board believes that Amtrak should implement effective controls to monitor and ensure that all train crews and on-board service personnel receive the necessary initial and recurrent emergency training to provide for passenger safety. Emergency Lighting and Public Address Systems The failure of emergency electrical systems to provide emergency power can be a serious problem in critical situations such as derailments. The emergency electrical system for each passenger car on train 4 was either at minimal output or at no power as a result of the derailment. Extensive undercarriage damage resulted in severed wiring and electrical conduits. Consequently, neither the interior emergency lights nor the public address system was reliable for operation, and no back-up system was provided. Passengers either had to rely on the instructions they were given by the Amtrak personnel in their car or to evacuate the train on their own. Following a June 15, 1982, derailment of an Amtrak train in Emerson, Iowa,36 the Safety Board issued the following safety recommendation to Amtrak: R-83-25 Evaluate and modify, as necessary, emergency lighting systems in passenger-carrying cars to better protect the functioning of emergency lights in emergency situations. Amtrak responded in 1984 that the emergency lighting system was designed to provide a minimum of 2 hours of acceptable illumination when the primary power source was interrupted. Amtrak believed that this 2-hour period was a reasonable length of time in an emergency situation. Amtrak also stated that using the existing commercial, battery- operated, self-contained fixtures on railway cars is not feasible. The safety recommendation was classified “Closed—Unacceptable Action” in April 1988. On September 22, 1993, Amtrak train 2 struck a displaced railroad bridge and derailed into the Big Bayou Canot near Mobile, Alabama,37 at about 2:53 a.m. Forty-two passengers and 5 crewmembers were killed; 103 passengers were injured. The Safety Board issued the following safety recommendation to Amtrak:

36 Railroad Accident Report—Derailment of Amtrak Train No. 5 (the San Francisco Zephyr) on the Burlington Northern Railroad, Emerson, Iowa, June 15, 1982 (NTSB/RAR-83/02). 37 NTSB/RAR-94/01.

Analysis 68 R-94-8 Equip cars with portable lighting for use by passengers in an emergency. In July 1995, Amtrak stated that it was evaluating the use of portable chemical light sticks for permanent installation on all Amtrak trains. Such light sticks are weatherproof, maintenance-free, nontoxic, nonflammable, and not sources of ignition. They provide immediate and dependable light for up to 8 hours. Amtrak placed light sticks on all its passenger trains, and Safety Recommendation R-94-8 was classified “Open—Acceptable Action.” In the Kingman accident, the Amtrak light sticks provided sufficient emergency lighting until the arrival of emergency responders. Light stick use was limited, but the usefulness of the light sticks was well acknowledged by the passengers, and they provided a measure of safety when the emergency lighting failed. Based on these actions by Amtrak, the Safety Board classified Safety Recommendation R-94-8 “Closed— Acceptable Action” on March 26, 1998. The Safety Board is, however, concerned that not enough is being done to provide for passenger safety when emergency power is lost. In the 1996 Silver Spring accident,38 a contributing factor to the severity of the accident and the loss of life was the lack of appropriate regulations to ensure adequate emergency egress features on railroad passenger cars. One of the safety recommendations issued following this investigation called for the FRA to: R-97-17 Require all passenger cars to contain reliable emergency lighting fixtures that are each fitted with a self-contained independent power source and incorporate the requirements into minimum passenger safety standards. On February 25, 1998, the FRA responded to this safety recommendation, stating that: FRA findings in recent accidents support the Safety Board’s implied concern that placement of electrical conduits and battery packs below the floor of passenger coaches can result in damage that leads to the unavailability of emergency lights precisely at the time they are most needed. However, from initial investigation it is not certain whether current ‘ballast’ technology provides illumination of sufficient light level quality with reliable maintainability. At a meeting in December 1997, the FRA delegated this issue to its Railroad Safety Advisory Committee for Passenger Equipment Safety Standards Working Group and stated that this group will aggressively pursue this option for more reliable

38 NTSB/RAR-97/02.

Analysis 69 emergency illumination. The status of Safety Recommendation R-97-17 is “Open— Response Received.” The Safety Board concludes that passenger car interiors must have interior emergency lighting because a sufficient quantity of light sticks may not always be available, and light sticks may not be suitable for a large-scale evacuation such as the one that occurred in this accident. In addition, while the light stick may serve adequately as a personal emergency light source during an evacuation, it is not a self-contained emergency lighting source. Therefore, the Safety Board believes that Amtrak should install, in all new passenger equipment purchased after January 1, 2000, and in existing passenger cars during their major overhaul/rebuild operations, fixtures that use a “self- contained back-up energy reserve feature” to make the fixtures less vulnerable to the disruption of electrical power during derailments. In addition, the Safety Board reiterates Safety Recommendation R-97-17 to the FRA. Seat Securement Inspection of train 4’s seats indicated that none had become separated from their floor mountings. However, 18 seat assemblies were found with their rotating locking mechanisms not engaged. A disengaged seat lock can result in an uncontrolled rotation of the seat assembly, even in cases of a minor derailment, which may result in serious injuries to passengers. In the August 23, 1990, Batavia, Iowa,39 accident report, the Safety Board stated its concern regarding Amtrak’s seat locks and noted that seats can become unlocked either because the locking mechanisms are disengaged en route by passengers or because they are defective. The Safety Board issued the following safety recommendation to Amtrak: R-91-71 Implement procedures for on-board-service personnel to periodically check passenger seats en route for unlocked anti-rotational devices and take action to ensure seats are functional. On May 22, 1992, this safety recommendation was classified “Closed— Acceptable Action,” based on Amtrak’s response that it was immediately issuing instructions systemwide to check and ensure that seat locks are functional and engaged. Absolute assurance is not always possible, however, because passengers can readily disengage the mechanism to rotate the seat to suit their personal requirements and may fail to ensure that the locking mechanism is again positively engaged. Further, on- board service personnel may not be able to provide the constant vigilance necessary to ensure that the seat locking mechanisms have been properly restored, because the seat locking mechanism is not readily visible. A simple solution may be to employ a positive locking mechanism that requires use of a special keying feature accessible only to

39 Railroad Accident Report—Derailment of Amtrak Train No. 6 on the Burlington Northern Railroad, Batavia, Iowa, April 23, 1990 (NTSB/RAR-91/05).

Analysis 70 crewmembers (such as a conductor’s coach key). This procedure could provide for seat locking security and effectively eliminate manipulation by passengers. The Safety Board concludes that the current procedures used to check and ensure that passenger car seat locks are functional and engaged are inadequate. The Safety Board believes that Amtrak should install a positive seat securement system to prevent disengagement and undesired rotation in all new passenger cars purchased after January 1, 2000, and incorporate such a system into existing passenger cars when they are scheduled for overhaul. Furthermore, the Safety Board believes that the FRA should include in the passenger car safety standards a requirement for positive seat securement systems to provide against the disengagement and undesired rotation of seats in all new passenger cars purchased after January 1, 2000, and require the incorporation of such a system into existing passenger cars when they are scheduled for overhaul. Emergency Response General The Mohave County sheriff’s deputies who were in the vicinity of the derailment responded within minutes. The Kingman Fire Department and other mutual aid agencies responded to help with the search and rescue efforts and to transport the train crew and passengers. Emergency responders carried out triage on survivors and transported them to hospitals by helicopter, bus, and ambulance in a timely manner. Adequate resources and personnel were available to effectively manage the response. The Safety Board concludes that the emergency response was timely, and the resources provided for the emergency response were adequate. Unverified Notification Information During the initial communication of on-site information by local agencies, some confusion resulted in the erroneous reporting of 8 to 13 fatalities, when no fatalities had actually occurred. A BNSF special agent called the Mohave County Sheriff’s Department to inquire about the accident and was told that two persons in the upper level of the dormitory car were seriously injured and that those injured would probably be DOA. The BNSF relayed this information to other BNSF employees and, in some cases, stated that two DOAs were reported. In subsequent conversations with the Mohave dispatcher and a sergeant, the BNSF special agent overheard the dispatcher talking to someone on scene over the radio referring to “six downstairs.” The special agent asked if she had heard that there were two DOAs upstairs and six DOAs downstairs in the dormitory car; the sergeant replied, “Yes.” The initial speculation by the Mohave dispatcher that those persons with serious injuries would become DOAs apparently caused others to use that same terminology. This incorrect information was subsequently relayed to various, including Federal, organizations. The Safety Board recognizes that conflicting reports of the circumstances of an accident often are communicated initially, and that in the early

Analysis 71 stages of the response, emergency responders must speculate and evaluate the situation to ensure that adequate resources are available for the worst-case scenario; but speculation is not fact. The information that is relayed to responding agencies must be as accurate as possible, and information that is relayed to other parties must either be confirmed as factual or clearly characterized as unverified. The Safety Board concludes that the inaccurate reporting of fatalities that took place during the accident notification process was a result of unconfirmed information being relayed to Federal agencies by local organizations. Therefore, the Safety Board believes that the Mohave County Sheriff’s Department, the International Association of Chiefs of Police, and the National Sheriffs’ Association should review the circumstances of this accident with their dispatchers and emphasize the importance of relaying verified factual information when communicating with other agencies. Protection for Employees on or Adjacent to Track in Performance of Their Duties The FRA was required by the Rail Safety Enforcement and Review Act of September 3, 1992, to review the Track Safety Standards and revise them based on information derived from that review. One of the issues identified to be addressed was the safety of maintenance-of-way employees working on or along the railroad right-of-way. This issue was separated from the ongoing review of the Track Safety Standards and assigned to a separate Railroad Safety Advisory Committee, which was to study the issue and develop recommendations. As part of this study, FRA records identified 22 fatalities that occurred in the period between 1989 and 1993. An independent labor-management task force focused on 43 accidents that resulted in 46 fatalities and 150 injuries from 1986 through 1994. Most of the fatalities occurred while some form of protection system was available or in use. Through this process, the FRA initiated rulemaking activity, which resulted in the Roadway Worker Protection (RWP) regulations (found in 49 CFR 214) that became effective January 15, 1997. The track supervisor involved in the Kingman accident was, while inspecting the main track, operating with a track car operator informational line-up. This practice was permissible under the requirements of the FRA RWP regulations. Class I railroads, including the BNSF, were required to be in compliance with the new regulations as of March 15, 1997. The regulations also provided that carriers each prepare a plan for compliance and notify the FRA, at least 1 month before March 15, 1997, that its plan was prepared and available for FRA review. The RWP regulations permitted railroads that used informational line-ups as of March 14, 1996, to continue using them. However, the RWP regulations also required

Analysis 72 that the carrier’s plan for compliance with the regulations contain a schedule for the discontinuance of the informational line-up procedure by a definite date. The BNSF developed a plan as required by the regulations and notified the FRA before March 15, 1997. The plan called for the use of both train location line-ups and track car operator line-ups to be discontinued by August 1, 2016. The FRA reviewed this plan with the BNSF on April 9, 1997, at BNSF headquarters in Fort Worth, Texas. As of July 14, 1998, the FRA had not approved the BNSF plan. An internal BNSF memorandum, dated February 13, 1998, stated that, as of January 29, 1998, train location/track car operator line-ups were still in use on 14 branch lines and 4 main line subdivisions. The memo further stated that, although the BNSF had committed to discontinue the use of these line-ups by August 1, 2016, ongoing efforts were underway to employ alternate methods wherever possible, given communications constraints. The BNSF timeline for eliminating the use of line-ups was tied to expansion of cellular telephone coverage on remote territories and implementation of emerging control and voice communications technologies. Although the operational practices that the track supervisor used during his special inspection were not factors in the derailment of Amtrak train 4, the Safety Board is concerned about the potential risk to employees engaged in special inspections while located on or adjacent to the railroad tracks. In this accident, the track supervisor confirmed that no mechanism was in place to protect him or other track inspectors if they could not contact the dispatcher for any reason. He considered it the employee’s responsibility to get out of the way of trains. Track inspectors believe that their protection lies in the informational line-up, even though they know that the line-up is only valid for about 4 hours and that the dispatcher would not try to locate them. This practice places the responsibility on the employee to protect himself, and generally he can. If, however, the track inspector becomes incapacitated, or the communications equipment fails, or the dispatcher does not stop trains from entering the area occupied by the inspector, the inspector could be put in jeopardy. The RWP regulations were intended to provide protection and safety for on-track workers. They specifically address the need to discontinue the use of informational line- ups as the sole protection for track inspectors. The Safety Board concludes that the BNSF’s 18-year timeframe for discontinuing the practice of using informational line-ups to ensure worker safety is too long and, until eliminated, the practice has the potential to place railroad workers in danger. The Safety Board therefore believes that the BNSF should immediately discontinue the use of informational line-ups. The Safety Board is disappointed by the FRA’s lack of aggressive action to ensure that railroads become more responsive to the issue of roadway worker protection in a timely manner.

Analysis 73 Locomotive Event Recorders The problem of mismatched software readout programs being used to read event recorder information is not new to the Safety Board. Hundreds of software readout programs and versions of those programs are used to read out today’s solid-state event recorders. The Safety Board laboratory is constantly updating its readout programs to keep current with the many programs and software revisions as they evolve. Unlike magnetic tape recorders, solid-state event recorders can only be read out using a computer and appropriate software. Therefore, it is imperative that event recorder data be read out using the correct software, to ensure that all the recorded data are extracted and that the data are accurate. In this particular accident, however, Amtrak did not have the capability to read out all the data on its own recorders. Amtrak was unaware that valuable additional data had been recorded on its event recorders; six more parameters were actually recorded but not extracted by the Amtrak IFC analysis program. These parameters—emergency type, EOT emergency (on or off), bell, brake handle position, EIE (on or off), and dynamic brake derate (on or off)—provide data about the operational characteristics of the train important for performing an accurate accident investigation. The Safety Board therefore concludes that, had Amtrak been more familiar with the specifications of the event recorders on train 4, it could have obtained additional information from them that would have been useful. The FRA, in conjunction with the railroads and recorder/software manufacturers, is responsible for ensuring that all recorded data can be accurately and reliably retrieved after any train accident. No industry-wide procedures or Federal regulations address documentation of locomotive event recorders or readout system specifications. These specifications are necessary to conduct accurate readouts of event recorders. Physical inspections of the locomotive to determine the recording system specifications can be impractical or, in the case of severe accidents, impossible, because of component damage. Therefore, the Safety Board believes that the FRA should require that event recorder system specifications be kept as part of the locomotive’s records. These records should be readily accessible for FRA or Safety Board inspection and must be kept up to date. These records should include, at a minimum: (1) the name, version, and date of the readout program intended for use with the recorder currently installed on the locomotive; (2) the manufacturer, model number, and serial number of the event recording device and its associated components (to include the air brake manifold, axle generator or equivalent, and signal conditioning devices) currently installed on the locomotive; (3) a complete list of parameters that the recording system is currently configured to record; and, (4) the recording system’s manufacturer-prescribed modification, revision, and software- hardware version numbers.

Analysis 74 Locomotive Fuel Tank Crashworthiness All four units in the train 4 locomotive power consist were GE model P-42 locomotives, which is a relatively new locomotive design having a monocoque body incorporating a relatively high undercarriage clearance (to the top of the rails) and an integrated fuel tank. The fourth unit in the consist sustained noteworthy damage, being impaled by a length of rail that had dislodged from the track structure during the derailment. The rail punctured the end panels of the fuel tank and inflicted other serious structural damage, yet it caused no catastrophic rupture of the fuel tank or fire and only a minor amount of fuel spillage. Contributory to this lack of fuel tank damage was the ample undercarriage clearance available in this unit, as compared to other locomotives with conventional frame-suspended fuel tanks. Only performance in future accidents will prove whether the high ground clearance and integrated fuel tank design found in this type of unit will permit such tanks to continue to resist catastrophic rupture or breach, but the Safety Board acknowledges the crashworthiness performance of the advanced fuel tank design of the locomotives in this accident. The P-42 locomotive fuel tank of the fourth locomotive in the consist, with its relatively high ground clearance, integral location, and internal baffle system, demonstrated its ruggedness and ability to withstand the rigors of a serious derailment, as compared to a conventional, frame-suspended locomotive fuel tank, which in past derailments has been shown to be vulnerable to catastrophic puncture and potential fire. The Safety Board concludes that, in this accident, the new Amtrak P-42 locomotive fuel tanks demonstrated a level of crashworthiness that has not been shown by conventional, frame-suspended locomotive fuel tanks that have been vulnerable to catastrophic puncture and fire. The Safety Board has previously expressed its concern to the FRA about other locomotives built before the effective date of September 1, 1995, noting that many of these locomotives will remain in service for several years, and this accident demonstrates that new designs can improve the crashworthiness performance of locomotive fuel tanks. The Safety Board will continue to address the crashworthiness issue in future accident investigations and to monitor FRA progress in improving locomotive fuel tank crashworthiness.

75 Conclusions Findings

1. The track did not cause or contribute to the accident.
2. The signal system was not a factor in the accident.
3. The weather warnings and alerts issued by WeatherData, Inc., were both timely and

substantially correct.

1. The mechanical condition of the train was not a factor in the accident.
2. The health, rest, and qualifications of the train crew were not factors in the accident.
3. Although the track supervisor conducted a track inspection over his territory during

the flooding, he was not qualified to conduct bridge inspections.

1. The failure of bridge 504.1S was caused by scour and erosion affecting the

inadequately protected shallow foundations that supported the bridge; the scour resulted because a poorly designed concrete crosswall was built instead of a new and better-engineered bridge.

1. The relationship of the highway box culverts and the railroad bridges and their

respective zones of influence is not fully understood.

1. Amtrak train 4 derailed when bridge 504.1S failed because the Burlington Northern

Santa Fe maintenance-of-way managers lacked proper foresight and planning regarding the assignment or training or both of personnel designated to conduct bridge inspections during severe weather.

1. When, because of flash flooding conditions, the integrity of bridges has yet to be

validated, it is critical that trains be operated at a reduced speed such as “restricted speed.”

1. Had the Federal Railroad Administration issued minimum standards for special

inspection procedures for bridges that would be at risk during severe weather, such as those standards recommended in its Safety Advisory 97-1, the Burlington Northern Santa Fe track supervisor would have had better guidance for making the special inspection.

1. Because an accurate passenger manifest was not provided by the Amtrak train 4 crew

to the Incident Commander, the emergency response to evacuate and account for all

Conclusions 76 passengers from the train could have been delayed, thus endangering passengers whose locations or circumstances were unknown to emergency responders.

1. Amtrak’s current system for providing emergency training for train crews and on-

board service personnel has not been effective, which has resulted in personnel being provided differing levels of emergency situation training.

1. Passenger car interiors must have interior emergency lighting because a sufficient

quantity of light sticks may not always be available, and light sticks may not be suitable for a large-scale evacuation such as the one that occurred in this accident.

1. The current procedures used to check and ensure that passenger car seat locks are

functional and engaged are inadequate.

1. The emergency response was timely, and the resources provided for the emergency

response were adequate.

1. The inaccurate reporting of fatalities that took place during the accident notification

process was a result of unconfirmed information being relayed to Federal agencies by local organizations.

1. The Burlington Northern Santa Fe’s 18-year timeframe for discontinuing the practice

of using informational line-ups to ensure worker safety is too long and, until eliminated, the practice has the potential to place railroad workers in danger.

1. Had Amtrak been more familiar with the specifications of the event recorders on

train 4, it could have obtained additional information from them that would have been useful.

1. In this accident, the new Amtrak P-42 locomotive fuel tanks demonstrated a level of

crashworthiness that has not been shown by conventional, frame-suspended locomotive fuel tanks that have been vulnerable to catastrophic puncture and fire. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was displacement of the track due to the erosion and scouring of the inadequately protected shallow foundations supporting bridge 504.1S during a severe flash flood because the Burlington Northern Santa Fe management had not provided adequate protection, either by inspection or altering train speeds to fit conditions. Contributing to the accident was the failure of the Burlington Northern Santa Fe management to adequately address the erosion problems at bridge 504.1S.

77 Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: —to the Burlington Northern Santa Fe Corporation: Identify and perform a risk assessment of all system bridges that have shallow foundations of similar construction to the bridge that failed in the Kingman, Arizona, accident, and replace those bridges determined to be susceptible to undermining and loss of the supporting foundation structure. In conjunction with the risk assessment, perform a hydrology study on shallow foundation structures with questionable drainage areas to determine their current drainage areas. (R-98-48) Evaluate, and improve as necessary, your basic bridge inspection training program for track inspectors to ensure that appropriate procedures are used in emergency situations. (R-98-49) Require your management to periodically review bridge inspection training for track inspectors to ensure that it meets program objectives. (R-98-50) Conduct a thorough analysis to determine the appropriate personnel, inspection, and operating policies to be used during flash flooding conditions, and establish procedures designed to ensure the safe passage of all trains. The analysis should address the minimum training requirements for personnel responding to emergency inspections and evaluate current inspection procedures and response actions to determine their adequacy during abnormal or emergency situations. (R-98-51) Change your policy regarding freight train operating speeds so that it is consistent with the required operating speeds of other trains during flash flooding weather warnings, as noted in the August 1997 Burlington Northern Santa Fe Maintenance Alert. (R-98-52) Immediately discontinue the use of informational line-ups. (R-98-53) —to the Federal Railroad Administration: Require that all railroads identify and perform a one-time risk assessment of the bridges on their systems that have shallow foundations of similar construction to the bridge 504.1 that failed in the Kingman, Arizona, accident, and require replacement of those bridges determined to be

Recommendations 78 susceptible to undermining and loss of the supporting foundation structure. (R-98-54) Incorporate the intent of Safety Advisory 97-1 into minimum safety standards for special inspection procedures for bridges that would be at risk during severe weather. (R-98-55) Include in the passenger car safety standards a requirement for positive seat securement systems to provide against the disengagement and undesired rotation of seats in all new passenger cars purchased after January 1, 2000, and require the incorporation of such a system into existing passenger cars when they are scheduled for overhaul. (R-98-56) Require that event recorder system specifications be kept as part of the locomotive’s records. (R-98-57) —to the Federal Highway Administration: Examine the “System Analysis Seligman Subdivision Bridge No.’s 503.1- 505.9” report and the Arizona Department of Transportation’s historical bridge inspection data to determine the hydrologic relationship between the box culvert and bridge 504.1. If the examination determines that the structures have a detrimental hydrologic effect on each other, alert the States and the Federal Railroad Administration that similarly related structures may be vulnerable to similar problems. (H-98-41) —to the Arizona Department of Transportation: Examine the “System Analysis Seligman Subdivision Bridge No.’s 503.1- 505.9” report in light of your own historical bridge inspection information and take any action you deem appropriate. (H-98-42) —to the National Railroad Passenger Corporation (Amtrak): Expedite the development and implementation of a passenger and crew accountability system on reserved trains. (R-98-58) Implement effective controls to monitor and ensure that all train crews and on-board service personnel receive the necessary initial and recurrent emergency training to provide for passenger safety. (R-98-59) Install, in all new passenger equipment purchased after January 1, 2000, and in existing passenger cars during their major overhaul/rebuild operations, fixtures that use a “self-contained back-up energy reserve feature” to make the fixtures less vulnerable to the disruption of electrical power during derailments. (R-98-60)

Recommendations 79 Install a positive seat securement system to prevent disengagement and undesired rotation in all new passenger cars purchased after January 1, 2000, and incorporate such a system into existing passenger cars when they are scheduled for overhaul. (R-98-61) —to the Mohave County Sheriff’s Department (R-98-62): —to the International Association of Chiefs of Police (R-98-63): —to the National Sheriffs’ Association (R-98-64): Review the circumstances of the derailment accident that occurred at Kingman, Arizona, on August 9, 1997, with your dispatchers and emphasize the importance of relaying verified factual information when communicating with other agencies. —to the Association of American Railroads (R-98-65): —to the American Short Line and Regional Railroad Association (R-98-66): Make your membership aware of the facts and circumstances of the derailment accident that occurred at Kingman, Arizona, on August 9, 1997. Also as a result of its investigation of this accident, the National Transportation Safety Board reiterates the following safety recommendation: —to the Federal Railroad Administration: R-97-17 Require all passenger cars to contain reliable emergency lighting fixtures that are each fitted with a self-contained independent power source and incorporate the requirements into minimum passenger safety standards. BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member ROBERT T. FRANCIS II Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member August 31, 1998

this page intentionally left blank

81 Appendix A—Investigation The Safety Board was notified of this accident about 8:30 a.m., eastern standard time, on August 9, 1997, and dispatched a major railroad accident investigation team. Investigative groups examined the operation, track, structures, signals, mechanical, survival factors, and human performance aspects of the accident. The Burlington Northern Santa Fe Corporation, the National Railroad Passenger Corporation, the Federal Railroad Administration, the United Transportation Union, the Brotherhood of Locomotive Engineers, the Brotherhood of Maintenance of Way Employes, the Mohave County Sheriff’s Department, and the Arizona Corporation Commission assisted in the Safety Board investigation. As part of its investigation, the Safety Board conducted a 1-day deposition proceeding in Fort Worth, Texas, on October 15, 1997, at which 11 witnesses testified.

this page intentionally left blank

83 Appendix B—Event Chronology and Layout of Seligman Subdivision EVENT CHRONOLOGY (Times are in mountain daylight time unless noted.) 8/8/97 FRIDAY 9 p.m. to 5 a.m. (10 p.m. to 6 a.m. CDT) Third-shift dispatcher is on duty. 8/9/97 SATURDAY 12:06 a.m. The first alert of potential severe weather is issued by the Burlington Northern Santa Fe (BNSF) contract weather service, WeatherData, Inc. (WDI). The alert is for thunderstorms and heavy rain on the Seligman subdivision, and its text read, “Strong thunderstorms are rapidly developing just southeast of, is that Pica, Pica, Arizona, moving east at 15 miles per hour. Radar estimates moderate rainfall over track with up [to] 0.7 inches per hour rainfall rates. Expect from 0.4 to 0.6 inch of rain in the next 40 minutes, will monitor for flash flooding.” 12:30 a.m. The National Weather Service (NWS) office in Las Vegas issues a severe thunderstorm warning until 1:30 a.m. Saturday for Mohave County. 12:52 a.m. The BNSF receives an update from WDI (alert 0000). “Strong to severe thunderstorms producing heavy rain with up to 1 inch an hour and gust wind continues to redevelop over this stretch of track. Kingman, Arizona, has reported a gust to 50 miles per hour in the last 45 minutes. Therefore, we are extending the previous warning. To expire at 2:30 a.m.” 1:29 a.m. The NWS issues a Severe Thunderstorm and Flash Flood Warning effective until 2:30 a.m. for central Mohave County. 1:43 a.m. The BNSF is warned of flash floods by WDI (warning 0001). “Thunderstorms continue to move to the east at 20 miles per hour. Radar estimates that nearly 2 inches of rain has fallen over this stretch of track with hourly rates of 1 inch an hour still falling. Watch for flash flooding! To expire at 2:30 a.m.” (This warning initiated the track inspection.)

Appendix B 84 1:57 a.m. The track supervisor is called by the dispatcher. 2:21 a.m. The BNSF receives an update from WDI (warning 0002). “Strong thunderstorms continue to redevelop and move over this stretch of track this morning. Movement of these storms is to the east-southeast at 10 miles per hour. Rainfall amounts of 1 to 2 inches is likely, as well as peak wind gusts less than 60 miles per hour. Watch for Flash Flooding. To expire at 4:30 a.m.” 2:24 a.m. The NWS issues a Severe Thunderstorm and Flash Flood Warning effective until 3:30 a.m. for central Mohave County. 2:32 a.m. The BNSF receives an update from WDI (alert 0003). “Strong thunderstorms continue to redevelop and move over this stretch of track this morning. Movement of these storms is to the east-southeast at 10 miles per hour. Rainfall amounts of 1/2 to 1 inch is likely over this stretch of track, as well as peak wind gusts less than 60 miles per hour. To expire at 4:30 a.m.” 3:00-4:30 a.m. The track supervisor calls his personnel. By this time, the rain had begun to diminish. 3:30 a.m. The track supervisor talks to the dispatcher; he obtains the eastbound train line-up and learns that no trains are east of Cadiz. Also, the NWS Severe Thunderstorm and Flash Flood Warning expires. 3:39 a.m. Train EB Q-LACMEM1-08 is at Walapai (MP 501.3)—on adjacent track—and notes water in culverts and rain letting up. 3:56 a.m. Train EB Q-LACMEM1-08 is at MP 489.7—on adjacent track—and reports no water on the ground. 4:01 a.m. The dispatcher informs the track supervisor of the report of train EB Q-LACMEM1-08. 4:05 a.m. The track supervisor begins the track inspection at MP 516.5. 4:12 a.m. The dispatcher informs the track supervisor of EB Q-LACMEM1-08’s report of no water on the ground between Truxton (MP 477.3) and Hackberry (MP 509.4).

Appendix B 85 4:15 a.m. The track supervisor stops at MP 515.2 and MP 515.4, noting slight water movement. He talks to a westbound train at Getz (MP 513.9), reporting no high water near rails. 4:25 a.m. The track supervisor stops at bridge 507.4. 4:28 a.m. The BNSF receives an update from WDI (warning 0004) for the area between Truxton (MP 477.3) and Harris (MP 521.4). “Thunderstorms producing heavy rain continue to remain nearly stationary around the Kingman, Arizona, area this morning. Radar estimates that nearly 3 to 3.5 inches of rain has fallen near this stretch of track with hourly rates of 1 inch an hour still falling. Watch for flash flooding! The threat for high wind has diminished; however, a gust to 45 miles per hour is still possible. To expire at 6 a.m.” 4:30-4:45 a.m. The track supervisor reports from Hackberry (MP 509.4) and makes no report of high water. He stops at bridges 507.3 and 505.9. He inspects bridge 504.1. 5:00 a.m. The first-shift dispatcher comes on duty. (Serves till 1 p.m.) 5:07 a.m. The dispatcher informs the track supervisor near Truxton (MP 477.3) that Amtrak train 4 is leaving Franconia (west of Kingman). 5:24 a.m. Amtrak train 4 departs Griffith (MP 526.8). 5:35 a.m. Train WB B-CHCLAC1-05 passes Walapai (MP 501.3) and, shortly after, passes bridge 504.1. 5:40 a.m. The first-shift dispatcher and the third-shift dispatcher begin their changeover. 5:46 a.m. The track supervisor reports from Peach Springs (MP 465.8) that he will shortly clear for Amtrak train 4. He does not report any high water. 5:56 a.m. The derailment occurs. The BNSF Operations Center is notified by the crew of Amtrak train 4. The BNSF first-shift dispatcher notifies the BNSF Resource Operations Center (ROC) of the accident. 6:00 a.m. (7 a.m. CDT) The BNSF police department is notified of the accident by the BNSF operations desk. (8 a.m. EDT) The Safety Board Communications Center notifies the Rail Division duty officer.

Appendix B 86 6:01 a.m. The track supervisor gets off the track at Peach Springs (MP 465.8). The BNSF Operations Center notifies the Mohave County Sheriff’s Department of the accident. 6:06 a.m. The Kingman Fire Department responds to a request for aid from the Mohave County Sheriff’s Department. 6:15 a.m. The Kingman Regional Medical Center is notified of the accident. The first emergency response personnel arrive on scene. The BNSF notifies the U.S. Coast Guard National Response Center of the accident. 6:16 a.m. The command post is established. 6:17 a.m. The Kingman Fire Department requests mutual aid. 6:18 a.m. The fire department notes multiple injuries and no trapped victims. 6:19 a.m. The BNSF reports the accident as noted to the U.S. Coast Guard National Response Center. 6:20 a.m. The first reports cite up to 300 injured. The Mohave County Sheriff’s Department reports two unconfirmed fatalities to the BNSF ROC. 6:45 a.m. The Mohave County Sheriff’s Department reports two fatalities on the top deck of the first car and six fatalities on the lower deck to the BNSF ROC. The fatality situation is reported by the BNSF to the Federal Railroad Administration and the Safety Board. 6:56 a.m. Passengers begin to arrive at the hospital. 7:00 a.m. (9 a.m. EDT) The Safety Board Investigator-In-Charge is notified by the chief of the Railroad Division of the accident and of the 8 to 13 fatalities. Launch procedures are enacted. 9:10 a.m. The last passenger is transported from the scene. 10:00 a.m. (12 p.m. EDT) The Safety Board is informed that the news media is reporting no fatalities. 11:00 a.m. The last passenger is admitted to the Kingman hospital. 4:20 p.m. The Safety Board team from the D.C. office arrives on site (time approximate).

Appendix B 87 LAYOUT OF THE SELIGMAN SUBDIVISION

this page intentionally left blank

89 Appendix C—Applicable BNSF Instructions Excerpt from BNSF System Special Instructions for All Subdivisions No. 2 in Effect at 0001 Central, Mountain, and Pacific Continental Time, Saturday, March 1, 1997 35. Excessive Wind, Tornado, and Earthquake Instructions Excessive Wind Instructions: When weather bulletins forecasting high winds are received in the Network Operations Center, the train dispatcher will notify all trains in the area, giving the time and limits of the expected high winds. When notified that winds are forecast to be in excess of 60 MPH in the area, all trains except loaded unit coal and grain trains must stop during the time and within the limits stated. Tornado Watch and Warning Instruction Tornadoes are the most violent of all storms. Paths of destruction range from a few hundred feat in width to more than a mile and extend the length of a city block to 300 miles. The greatest potential for such storms exist usually from April through September. A "tornado watch" means atmospheric conditions are such that tornadoes may develop. A tornado watch is generally issued 4-6 hours before the conditions may occur. During a tornado watch, all train movements and yard activities will continue, keeping alert for any signs of weather change. The danger signs to look for are severe thunderstorms, hail, roaring noise, a funnel cloud or combination of the above. The radio on a locomotive or a pakset should be used to monitor instructions and information to and from the train dispatcher. In the want a crew spots a funnel cloud, the train dispatcher should be immediately notified, consistent with the crew’s safety. If a train or yard assignment has an occupied caboose, upon being notified of a tornado watch, the occupants of the caboose should immediately move to the locomotive consist. While in the process of moving to the locomotive, if the tornado watch turns into a "tornado warning”, or a funnel cloud is spotted, those affected should seek shelter in a nearby ditch, ravine, culvert, under abridge or in a depression. If none of these are available, lie face down on the ground with hands over the head away from the caboose or cars in the train. A "tornado warning" means a tornado has been sighted or verified by the National Weather Service or by persons associated with official weather spotters. The train dispatcher will keep trains and crews appraised of limits of tornado warnings. Train crews are to follow instructions as follows: During a tornado warning, all train movements and yard activities must stop. Any train enroute will stop and employees should seek appropriate shelter consistent with the safety of all involved, avoiding the stopping of strain on a high bridge, across railroad and highway crossing at grade, or anywhere the presence of a train could be a hindrance. After the tornado warning has been cleared and such information has reached the train crews, if the path of the tornado crossed the tracks at their location or in the immediate vicinity, crew members must inspect their train before moving to determine if any damage or derailment has occurred to the train or if the track structure has been damaged. After inspecting the train and track, and the train dispatcher has relayed the limits of the tornado's path, the train may proceed, prepared to stop when approaching bridges, culverts, or other points likely to be affected. The train dispatcher must be advised immediately of such conditions. (Continued next page.)

Appendix C 90 Excerpt from BNSF System Special Instructions for All Subdivisions No. 2 in Effect at 0001 Central, Mountain, and Pacific Continental Time, Saturday, March 1, 1997 (Continued from page 89.) Earthquake Instructions: When an earthquake is reported, the train dispatcher will do the following:

1. Instruct all trains within 150 miles of the reporting location to “proceed at restricted

speed due to earthquake conditions.” An acknowledgement must be obtained from each train or engine receiving these instructions.

1. Once magnitude and epicenter are known, the following inspection criteria apply:

If magitude is less than 5.0: - no inspection is required. If magnitude is 5.0 or greater: -Response will depend on the group of states and provinces within which the epicenter is located and the following criteria will apply within the designated radius from the epicenter: Group 1: California and Baja California, Mexico Group 2: Arizona, Colorado, Idaho, Montana, Nevada, New Mexico, Utah and Wyoming; Alberta, Canada and Chihuahua, Mexico Group 3: All other states (includes area east of Group 2, Oregon, Washington and British Columbia) Magnitude Criteria for Response Group 1 Group 2 Group 3 Range Radius Radius Radius 5.0 to 5.49 Trains proceed at restricted speed until signals 30 miles 40 miles 70 miles have been inspected 5.5 to 5.99 Trains proceed at restricted speed until signals, 30 miles 40 miles 70 miles track and bridges have been inspected 6.0 to 6.49 Trains stop until signals, track and bridges 50 miles 80 miles 150 miles have ben inspected 6.5 to 6.99 Trains stop until signals, track and bridges 70 miles 140 miles 220 miles have been inspected 7.0 to 7.49 Trains stop until signals, track and bridges 100 miles 300 miles 400 miles have been inspected 7.5 and Trains stop until instructed to proceed after inspection As As As Above of track, signals and bridges completed directed * directed * directed *

• Radius at discretion of the command center but not less than for magnitude 7.0 to 7.49

Appendix C 91 BNSF Maintenance Alert procedures relating to possible flash floods, issued August 10, 1997

Appendix C 92 BNSF Maintenance Alert procedures relating to possible flash floods, issued February 20, 1998

93 Amtrak -- National Railroad Passenger Corporation, v ATS -- automatic train stop, 22 ATSF -- Atchison, Topeka and Santa Fe Railway, 12 BNSF -- Burlington Northern Santa Fe Railway, 1 CFR -- Code of Federal Regulations, 13 CIP Capital Improvement Program, 19 CP -- control point, 22 CTC -- Centralized Traffic Control, 24 CWR -- continuous welded rail, 9 EIE -- engineer-induced emergency, 24 EMS -- Emergency Medical Services, 36 EOT -- end-of-train, 40 FED -- failed equipment detector, 22 FRA -- Federal Railroad Administration, 9 GE -- General Electric, 14 HWD -- high water detector, 22 IFC -- Integrated Function Computer, 39 MDT -- mountain daylight time, 1 MHC -- material handling car, 1 MP -- milepost, 5 NOC -- BNSF Network Operations Center, 5 NWS -- National Weather Service, 30 P.R.E.P.A.R.E. -- Passenger Railroad Emergency Preparedness And Response Education., 37 PCM -- Permanent Core Memory, 40 PCMCIA -- Personal Computer Memory Card Industry Association, 39 PCS -- pneumatic control switch, 39 ROC -- BNSF Resource Operations Center, 5 Route 66 -- Arizona State Route 66, 15 RWP -- Roadway Worker Protection, 71 TLEM -- trainline-induced emergency, 24 WDI -- WeatherData, Inc., 27

this page intentionally left blank

FD07212 ｜ 1999_美国_AAR9901.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

PB99-910401 ‘I NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 AIRCRAFT ACCIDENT REPORT UNCONTROLLED DESCENT AND COLLISION WITH TERRAIN USAIR FLIGHT 427 BOEING 737-300, N513AU NEAR ALIQUIPPA, PENNSYLVANIA SEPTEMBER 8, 1994 NTSB/AAR-99/01 DCA94MA076 6472A

The National Transportation Safety Board is an independent Federal Agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov/. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB99-910401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 Abstract: This report explains the accident involving USAir flight 427, a Boeing 737-300, which entered an uncontrolled descent and impacted terrain near Aliquippa, Pennsylvania, on September 8, 1994. Safety issues in the report focused on Boeing 737 rudder malfunctions, including rudder reversals; the adequacy of the 737 rudder system design; unusual attitude training for air carrier pilots; and flight data recorder parameters. Safety recommendations concerning these issues were addressed to the Federal Aviation Administration.

AIRCRAFT ACCIDENT REPORT NTSB/AAR-99/01 (PB99-910401) UNCONTROLLED DESCENT AND COLLISION WITH TERRAIN USAIR FLIGHT 427, BOEING 737-300, N513AU NEAR ALIQUIPPA, PENNSYLVANIA SEPTEMBER 8, 1994 • Pages 29-31 have been updated to correct figure placement. (4 Nov 99) Figures 9 and 10 were originally reversed. • Page 45 has been updated to correct a quotation mark. (4 Nov 99) "wow about 0943:08" was incorrectly quoted. • Page 102 has been updated to correct figure references for the United flight 585 simulations on roll and yaw rate. (16 Feb 00) THESE CORRECTIONS ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT:

this page intentionally left blank

Aircraft Accident Report Uncontrolled Descent and Collision With Terrain USAir Flight 427 Boeing 737-300, N513AU Near Aliquippa, Pennsylvania September 8, 1994 NTSB/AAR-99/01 PB99-910401 National Transportation Safety Board Notation 6472A 490 L’Enfant Plaza, S.W. Adopted March 24, 1999 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

this page intentionally left blank

Contents iii Aircraft Accident Report Contents Executive Summary................................................................................................ ix Abbreviations.......................................................................................................... xi Glossary of Terms...................................................................................................xv

1. Factual Information..................................................................................................1
2. 1 History of Flight ..................................................................................................1
3. 2 Injuries to Persons ...............................................................................................7
4. 3 Damage to Aircraft..............................................................................................7
5. 4 Other Damage......................................................................................................7
6. 5 Personnel Information .........................................................................................7
7. 5.1 The Captain.....................................................................................................8
8. 5.2 The First Officer ...........................................................................................10
9. 5.3 Flight Attendant Information........................................................................11
10. 6 Airplane Information.........................................................................................11
11. 6.1 Accident Airplane Maintenance Information...............................................12
12. 6.1.1 Inspections.............................................................................................12
13. 6.1.2 Events on Earlier Flights .......................................................................14
14. 6.2 Boeing 737 Hydraulic System Information..................................................15
15. 6.2.1 Hydraulic System Maintenance.............................................................18
16. 6.3 Boeing 737 Flight Control Systems..............................................................19
17. 6.3.1 Auto-Flight System ...............................................................................19
18. 6.3.2 Rudder Control System .........................................................................23
19. 6.3.2.1 Main Rudder PCU and Servo Valve ..............................................29
20. 7 Meteorological Information...............................................................................33
21. 8 Aids to Navigation.............................................................................................34
22. 9 Communications................................................................................................34
23. 10 Airport Information ...........................................................................................35
24. 11 Flight Recorders ................................................................................................35
25. 11.1 Cockpit Voice Recorder ...............................................................................35
26. 11.2 Flight Data Recorder.....................................................................................35
27. 12 Wreckage and Impact Information....................................................................36
28. 12.1 On-Site Examination ....................................................................................36
29. 12.2 Reconstruction Examination.........................................................................39
30. 12.2.1 Flight Control System Components ......................................................40
31. 12.2.2 Examination/Reconstruction of Cargo Compartments..........................41

Contents iv Aircraft Accident Report 1.12.2.3 Examination/Reconstruction of the Auxiliary Fuel Tank .....................41 1.12.3 Examination of Wreckage for Indications of Possible Bird Strike...............42 1.13 Medical and Pathological Information..............................................................43 1.14 Fire.....................................................................................................................43 1.15 Survival Aspects................................................................................................44 1.16 Tests and Research ............................................................................................44 1.16.1 Background Information—Other Significant Yaw/Roll Events...................44 1.16.1.1 United Airlines Flight 585 Accident .....................................................44 1.16.1.2 Eastwind Airlines Flight 517 Incident...................................................51 1.16.2 Wake Vortex Tests and Studies Resulting From the USAir Flight 427 Accident...........................................................................54 1.16.3 Flight and Simulator Tests of Effects of Various Flight Control and System Failures......................................................................................59 1.16.3.1 Eastwind Flight 517 Flight Tests...........................................................61 1.16.4 Flight Control Characteristics Flight Tests (Blowdown and Crossover Airspeed) .....................................................................................63 1.16.5 Examination and Testing of Flight Control Systems/Components ..............65 1.16.5.1 Rudder Pedal Assemblies......................................................................65 1.16.5.2 Tests to Determine the Effects of Rudder Cable External Forces, Breaks, and Blocked Input Linkage ......................................................66 1.16.5.3 Examination and Testing of Standby Rudder........................................68 1.16.5.3.1 Metallurgical Examination of Standby Rudder Components ........68 1.16.5.3.2 Standby System Actuator Binding/Jam Tests................................69 1.16.5.4 Detailed Examinations and Tests of Main Rudder PCUs .....................71 1.16.5.4.1 Detailed Examinations of Main Rudder PCU Servo Valves..........71 1.16.5.4.1.1 Examination of Exemplar Servo Valves for White Layer.........73 1.16.5.4.2 PCU Dynamic Testing ...................................................................73 1.16.5.4.3 Tests of Hydraulic Fluid.................................................................74 1.16.5.4.4 Tests to Determine the Effects of Silting .......................................75 1.16.5.4.5 PCU Servo Valve Chip Shear Tests...............................................76 1.16.5.4.6 PCU Tests Conducted to Determine the Effects of Air in the Hydraulic Fluid.........................................................................76 1.16.5.4.7 PCU Thermal Testing.....................................................................77 1.16.5.4.7.1 Baseline Test Condition ............................................................78 1.16.5.4.7.2 Simulated Hydraulic System Failure Condition........................78 1.16.5.4.7.3 Extreme Temperature Differential Test Condition....................79 1.16.5.4.7.4 Additional Testing.....................................................................80 1.16.5.4.8 Rudder Actuator Reversals During Servo Valve Secondary Slide Jams.....................................................................81

Contents v Aircraft Accident Report 1.16.5.4.9 Ground Demonstration of Rudder PCU Servo Valve Jam.............85 1.16.6 Flight Performance Simulation Studies........................................................87 1.16.6.1 USAir Flight 427 Simulation Studies....................................................90 1.16.6.2 United Flight 585 Simulation Studies .................................................100 1.16.6.3 Eastwind Flight 517 Simulation Studies .............................................116 1.16.7 Identification of CVR Sounds/Sound Spectrum Analysis..........................129 1.16.7.1 Sounds Similar to Thumps (Three Initial Thumps Within 1 Second and Two Subsequent Thumps About 1 Second Apart) .......................130 1.16.7.2 Sound of Electrical Impulse Recorded on the Captain’s Radio Channel .....................................................................................131 1.16.7.3 Sound Similar to Airplane Engines Increasing in Loudness...............132 1.16.7.3.1 Comparison of Engine Sound Signatures From the United Flight 585 CVR and a CVR From 737-200 Flight Tests...................................................................................134 1.16.7.4 Sounds of “Clickety Click” .................................................................134 1.16.7.5 Sound of Wailing Horn .......................................................................135 1.16.8 Study of Pilots’ (USAir Flight 427 and United Flight 585) Speech, Breathing, and Other CVR-recorded Sounds .............................................135 1.16.8.1 Independent Specialists’ Review of Pilots’ Speech, Breathing, and Other Sounds—USAir Flight 427 ................................................140 1.16.8.1.1 Summary of Observations of Interstate Aviation Committee Specialist....................................................................141 1.16.8.1.1.1 Interstate Aviation Committee Specialist’s Guidelines Applied to United Flight 585 CVR Information .....................143 1.16.8.1.2 Summary of Observations of U.S. Naval Aerospace Medical Research Laboratory Specialist......................................144 1.16.8.1.3 Summary of Observations of NASA’s Ames Research Center Specialist...........................................................................145 1.17 Operational and Management Information .....................................................145 1.17.1 USAir..........................................................................................................145 1.17.2 USAir Flight Training ................................................................................146 1.18 Additional Information....................................................................................147 1.18.1 Overall Accident Record and History of the 737 .......................................147 1.18.1.1 History of 737 Potential Rudder System and/or PCU-Related Anomalies/Events................................................................................148 1.18.1.1.1 QAR Data Findings......................................................................159 1.18.1.2 Recent Rudder-Related Events on 737s Equipped With the 1998 Redesigned Servo Valve.............................................................159 1.18.2 Independent Technical Advisory Panel......................................................162 1.18.3 Boeing 737 Certification Requirements and Information ..........................163

Contents vi Aircraft Accident Report 1.18.3.1 Initial Certification of the 737-100 and -200 Series............................163 1.18.3.2 Regulatory Changes Made After Certification of the 737-100 and -200 Series (Sections 25.671 and 25.1309) ..................................165 1.18.3.3 Certification of the Boeing 737-300, -400, and -500 Series (Derivative Certification) ....................................................................167 1.18.3.4 Certification of the 737-600, -700, and -800 Series............................169 1.18.4 Critical Design Review Team 737 Certification Information and Recommendations ......................................................................................175 1.18.5 Boeing 737 Rudder System Design Improvements....................................178 1.18.5.1 Fractures in 1998 Redesigned Servo Valve Secondary Slides............181 1.18.6 Human Performance Considerations ..........................................................183 1.18.6.1 Pilot Incapacitation..............................................................................183 1.18.6.2 Spatial Disorientation..........................................................................184 1.18.7 Wake Turbulence/Upset Event Information...............................................185 1.18.7.1 Previous Wake Turbulence Accidents.................................................185 1.18.7.2 Aviation Safety Reporting System Reports of Uncommanded Upsets/Wake Turbulence Encounters..................................................186 1.18.8 Ergonomics—Study of Maximum Pilot Rudder Pedal Force ....................189 1.18.9 Unusual Attitude Information and Training ...............................................194 1.18.9.1 Preaccident Activity ............................................................................194 1.18.9.2 Postaccident Activity...........................................................................197 1.18.10 Procedural Information Available to Boeing 737 Flight Crews.................198 1.18.10.1 Preaccident Information Available to 737 Pilots Regarding Abnormal Procedures (Flight Controls Malfunctions)........................198 1.18.10.2 Postaccident Changes/Information Available to 737 Pilots Regarding Abnormal Procedures (Flight Controls Malfunctions)......200 1.18.10.2.1 1994 Through 1995—Information and Changes Disseminated by Boeing...............................................................200 1.18.10.2.2 1996 Through 1997—FAA Issuance of Airworthiness Directive 96-26-07 .......................................................................................200 1.18.10.2.3 1997 Through 1998—Information and Changes Disseminated by Boeing...............................................................202 1.18.10.2.3.1 Implementation of AD 96-26-07 and Boeing 737 Operations Manual Revision by U.S. 737 Air Carrier Operators..............206 1.18.10.2.4 Safety Board Recommendations Relating to Unusual Attitude Training..........................................................................207 1.18.11 History of Safety Recommendations Resulting From the United Flight 585 and USAir Flight 427 Accidents and the Eastwind Flight 517 Incident......................................................................207

Contents vii Aircraft Accident Report 1.18.11.1 Galling of Standby Rudder Actuator Bearings—United Flight 585 Accident (Safety Recommendation A-91-77).....................................207 1.18.11.2 Weather-Related Recommendations—United Flight 585 Accident (Safety Recommendations A-92-57 and -58)......................................209 1.18.11.3 Recommendations Resulting From the July 1992 United Airlines Ground Check PCU Anomaly (Safety Recommendations A-92-118 Through -121)......................................................................................211 1.18.11.4 Flight Data Recorder Recommendations (Safety Recommendations A-95-25 Through -27).........................................................................213 1.18.11.5 October 1996 Recommendations Issued as a Result of United Flight 585, USAir Flight 427, and Eastwind Flight 517 (Safety Recommendations A-96-107 Through -120)..........................219 1.18.11.6 February 1997 Recommendations Issued as a Result of United Flight 585, USAir Flight 427, and Eastwind Flight 517 (Safety Recommendations A-97-16 Through -18)..............................230 1.18.12 Party Submissions.......................................................................................232 1.19 New Investigative Techniques ........................................................................237

1. Analysis..................................................................................................................240
2. 1 General ............................................................................................................240
3. 2 USAir Flight 427 Upset...................................................................................241
4. 2.1 USAir Flight 427 Computer Simulation Analysis......................................246
5. 2.2 USAir Flight 427 Human Performance Analysis.......................................247
6. 2.2.1 Rudder Jam/Reversal Scenario............................................................249
7. 2.2.2 Pilot Input Scenario.............................................................................252
8. 2.2.3 USAir Flight 427 Scenario Summary..................................................255
9. 2.2.4 Likelihood of Recovery From a Rudder Reversal...............................256
10. 3 United Flight 585 Upset ..................................................................................258
11. 3.1 United Flight 585 Computer Simulation Analysis .....................................258
12. 3.2 United Flight 585 Human Performance Analysis.......................................260
13. 4 Eastwind Flight 517 Upset ..............................................................................263
14. 4.1 Eastwind Flight 517 Computer Simulation Analysis .................................265
15. 4.2 Eastwind Flight 517 Human Performance Analysis...................................267
16. 5 Rudder System Jam Scenarios.........................................................................271
17. 6 Adequacy of the Boeing 737 Rudder System Design .....................................273
18. 6.1 FAA Certification System ..........................................................................281
19. 7 Flight Crew Procedures and Training..............................................................283
20. 7.1 Unusual Attitude Training for Air Carrier Pilots........................................283
21. 7.2 Unusual Attitude Training for Boeing 737 Pilots.......................................284
22. 8 Flight Data Recorder Capabilities ...................................................................288

Contents viii Aircraft Accident Report

1. Conclusions............................................................................................................292
2. 1 Findings...........................................................................................................292
3. 2 Probable Cause................................................................................................295
4. Recommendations.................................................................................................296
5. Appendixes ............................................................................................................299

Appendix A: Investigation and Hearing ................................................................299 Appendix B: Cockpit Voice Recorder Transcript .................................................300 Appendix C: History of Federal Aviation Administration Airworthiness Directives Related to the Boeing 737 Rudder System .............................................................328 Appendix D: Critical Design Review Recommendations and Federal Aviation Administration Responses ...................................333 Appendix E: List of Documented Boeing 737 Events...........................................339 Appendix F: Boeing’s “Blue Water” Assessment Team........................................345

Executive Summary ix Aircraft Accident Report Executive Summary On September 8, 1994, about 1903:23 eastern daylight time, USAir (now US Airways) flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering to land at Pittsburgh International Airport, Pittsburgh, Pennsylvania. Flight 427 was operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled domestic passenger flight from Chicago-O'Hare International Airport, Chicago, Illinois, to Pittsburgh. The flight departed about 1810, with 2 pilots, 3 flight attendants, and 127 passengers on board. The airplane entered an uncontrolled descent and impacted terrain near Aliquippa, Pennsylvania, about 6 miles northwest of the destination airport. All 132 people on board were killed, and the airplane was destroyed by impact forces and fire. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable cause of the USAir flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide. The safety issues in this report focused on Boeing 737 rudder malfunctions, including rudder reversals; the adequacy of the 737 rudder system design; unusual attitude training for air carrier pilots; and flight data recorder (FDR) parameters. Safety recommendations concerning these issues were addressed to the Federal Aviation Administration (FAA). Also, as a result of this accident, the Safety Board issued a total of 22 safety recommendations to the FAA on October 18, 1996, and February 20, 1997, regarding operation of the 737 rudder system and unusual attitude recovery procedures. In addition, as a result of this accident and the United Airlines flight 585 accident (involving a 737-291) on March 3, 1991, the Safety Board issued three recommendations (one of which was designated “urgent”) to the FAA on February 22, 1995, regarding the need to increase the number of FDR parameters.

this page intentionally left blank

Abbreviations xi Aircraft Accident Report Abbreviations AAIB Air Accidents Investigation Branch AC advisory circular ACO Aircraft Certification Office AD airworthiness directive AFIP Armed Forces Institute of Pathology AFA Air Force Academy AFM airplane flight manual AFS auto-flight system agl above ground level ALPA Air Line Pilots Association APU auxiliary power unit ARAC Aviation Rulemaking Advisory Committee ASB Alert Service Bulletin ASRS Aviation Safety Reporting System ATC air traffic control ATP airline transport pilot ATR Avions de Transport Regional BAC British Aerospace Corporation BWI Baltimore-Washington International Airport CAM cockpit area microphone CAMI Civil Aeromedical Institute CDR critical design review CFR Code of Federal Regulations CMD command (autopilot mode) CRM crew resource management CVR cockpit voice recorder CWS control wheel steering (autopilot mode) DER Designated Engineering Representative DNA deoxyribonucleic acid DOT Department of Transportation

Abbreviations xii Aircraft Accident Report EDP engine-driven hydraulic pump EDS energy dispersive x-ray spectrum E/E bay electrical/electronic compartment EGT exhaust gas temperature EMI electromagnetic interference EPR engine pressure ratio F Fahrenheit FAA Federal Aviation Administration FAR Federal Aviation Regulations FBI Federal Bureau of Investigation FD flight director FDAU flight data acquisition unit FDR flight data recorder FL flight level FSIB Flight Standards Information Bulletin GPR ground penetration radar GPWS ground proximity warning system HBAT Handbook Bulletin for Air Transportation HIRF High-intensity radiated fields Hg mercury HRC Hardness Rockwell C (scale) Hz Hertz IFR instrument flight rules IOE initial operating experience IRS inertial reference system KCAS knots calibrated airspeed KIAS knots indicated airspeed LIDAR Light Distancing and Ranging LOFT line-oriented flight training LVDT linear variable displacement transducer LWD left wing down

Abbreviations xiii Aircraft Accident Report M-CAB multipurpose cab (simulator) MCP mode control panel MM Maintenance Manual MPD Maintenance Planning Document MRB Maintenance Review Board MSG-3 Maintenance Steering Group 3 msl mean sea level N1 engine fan speed N2 engine compressor speed NAS National Aerospace Standard NASA National Aeronautics and Space Administration NCAR National Center for Atmospheric Research NG next generation nm nautical mile NOAA National Oceanic and Atmospheric Administration NPRM notice of proposed rulemaking NTSB National Transportation Safety Board OEM original equipment manufacturer ORD Chicago-O’Hare International Airport OSHA Occupational Safety and Health Administration OTS Officer Training School PA public address PADDS portable airborne digital data system PC production certificate PCU power control unit PF pilot flying PIT Pittsburgh International Airport PIT TRACON Pittsburgh terminal radar approach control PMA parts manufacturing approval P/N part number PNF pilot not flying POI principal operations inspector PPE personal protective equipment PSA Pacific Southwest Airlines psi pounds per square inch

Abbreviations xiv Aircraft Accident Report QAR quick access recorder RA radio altitude RWD right wing down SAE Society of Automotive Engineers SB service bulletin SEM scanning electron microscope SET special events training SFAR Special Federal Aviation Regulation SL service letter S/N serial number TOGA takeoff/go-around T/R thrust reverser UCP Unified Command Post USAF U.S. Air Force VFR visual flight rules VMS vertical motion simulator WSFO Weather Service Forecast Office WSR-88D Weather Surveillance Radar

Glossary of Terms xv Aircraft Accident Report Glossary of Terms Acceptance Test Procedure (for the Boeing 737 main rudder power control unit): A series of post-production functional tests used by Parker Hannifin Corporation to measure the performance of the main rudder power control unit (PCU). Actuator: A device that transforms fluid pressure into mechanical force. Adverse tolerance buildup: A description for a condition in which the assembling (stacking) of a series of parts, all of which are individually built within tolerances (that is, within an allowable deviation from a standard), has an adverse result. Aileron: An aerodynamic control surface that is attached to the rear, or trailing, edges of each wing. When commanded, the ailerons rotate up or down in opposite directions. Auto-flight system: A system, consisting of the autopilot flight director system and the autothrottle, that provides control commands to the airplane’s ailerons, flight spoilers, pitch trim, and elevators to reduce pilot workload and provide for smoother flight. The auto-flight system does not provide control commands to the 737 airplane’s rudder system. Bank: The attitude of an airplane when its wings are not laterally level. Block maneuvering speed: The recommended maneuvering speeds for each flap configuration that provide, for all airplane weights, adequate airspeed for maneuvering in at least a 40° bank without activation of the stickshaker. The “block” term simplified the concept so that a single airspeed was specified for all airplane weights less than 117,000 pounds; thus, airplanes operating at weights lighter than 117,000 pounds (such as the USAir flight 427 accident airplane) had a greater maneuvering margin. Blowdown limit: The maximum amount of rudder travel available for an airplane at a given flight condition/configuration. Rudder blowdown occurs when the aerodynamic forces acting on the rudder become equal to the hydraulic force available to move the rudder. Blue water: Lavatory fluid. Boeing’s Blue Water Assessment Team reviewed fluid contamination in the electrical/electronic compartment (E/E bay) from various potential sources, including lavatories, galleys, rainwater, and condensation. Catastrophic failure condition: A failure condition that will prevent continued safe flight and landing. (Source: Federal Aviation Administration Advisory Circular 25.1309-1A.) Command mode: A position on the two autopilot flight control computers that, when engaged, allows the autopilot to control the airplane according to the mode selected via the Mode Selector Switches, which include Altitude Hold, Vertical Speed, Level Change, Vertical Navigation, VOR Localizer, Lateral Navigation, and Heading Select.

Glossary of Terms xvi Aircraft Accident Report Compliance (when referring to PCU linkages): The elastic deformation of PCU internal input linkages that does not damage the linkages but allows additional motion. Computer simulation: A term in this accident report that refers to models of the USAir flight 427, United flight 585, and Eastwind flight 517 upsets that were used to develop potential accident scenarios. The Safety Board’s computer workstation-based flight simulation software used flight controls, aerodynamic characteristics, and engine models (developed by Boeing) to derive force and moment time histories of the airplanes. The Board developed its own equations to convert these forces and moments into airplane motion. Boeing performed similar flight simulations on its own computer workstations. Control wheel steering mode: A position on the two autopilot flight control computers that, when engaged, allows the autopilot to maneuver the airplane through the autoflight system in response to control pressure, similar to that required for manual flight, applied by either pilot. The use of control wheel steering does not disengage the autopilot. Cross-coupled: The ability of the aerodynamic motion about an airplane’s control axes to constantly interact and affect each other in flight. Crossover airspeed: The speed below which the maximum roll control (full roll authority provided by control wheel input) can no longer counter the yaw/roll effects of a rudder deflected to its blowdown limit. Directional control: The function that is normally performed by the rudder by pilot input or yaw damper input. (Also known as yaw control.) Dual jam (as used in this accident report): The simultaneous jams of the main rudder PCU primary to secondary slides and the secondary slide to the servo valve housing. Dutch roll: A combination yawing and rolling oscillations that is an inherent characteristic of all swept-wing airplanes. E/E bay: An airplane compartment that contains electrical and electronic components. Elevator: An aerodynamic control surface to the back of the horizontal stabilizer that moves the airplane’s nose up and down to cause the airplane to climb or descend. Empennage: The tail section of an airplane, including stabilizing and flight control surfaces. Extremely improbable failure condition: A condition that is so unlikely that it is not anticipated to occur during the entire operational life of all airplanes of one type and that has a probability on the order of 1 × 10-9 or less each flight hour based on a flight of mean duration for the airplane type. (Source: Federal Aviation Administration Advisory Circular 25.1309-1A.) Flap: An extendable aerodynamic surface usually located at the trailing edge of an airplane wing. The 737 also has an extendable aerodynamic surface located at the wing’s leading edge, which is called a Krueger flap.

Glossary of Terms xvii Aircraft Accident Report G: A unit of measurement. One G is equivalent to the acceleration caused by the earth’s gravity (32.174 feet/sec2). Galling: A condition in which microscopic projections or asperities bond at the sliding interface under very high local pressure. Subsequently, the sliding forces fracture the bonds, tearing metal from one surface and transferring it to the other. Heading: The direction (expressed in degrees between 001 and 360°) in which the longitudinal axis of an airplane is pointing, in relation to north. Hinge moment: The tendency of a force to produce movement about a hinge; specifically, the tendency of the aerodynamic forces acting on a control surface to produce motion about the hinge axis of the surface. Hydraulic fluid: Liquid used to transmit and distribute forces to various airplane components that are being actuated. Hydraulic pressure limiter: A device incorporated in the design of the main rudder PCU on all 737 next-generation (NG) series airplanes to reduce the amount of rudder deflection when active. It is commanded to limit hydraulic system A pressure (using a bypass valve) as the airspeed is increased to greater than 137 knots, and it is reset as the airspeed is decreased to less than 139 knots. Hydraulic pressure reducer: A modification on 737-100 through -500 series airplanes to reduce the amount of rudder authority available during those phases of flight when large rudder deflections are not required. The pressure reducer, added to hydraulic system A near the rudder PCU, will lower the hydraulic pressure from 3,000 to 1,000 pounds per square inch (psi) on 737-300, -400, and -500 series airplanes or to 1,400 psi on 737-100, and -200 series airplanes. Hydraulic system A (for 737-300, -400, and -500 series airplanes): A system that includes an engine-driven hydraulic pump and an electrically powered pump that provides power for the ailerons, rudder, elevators, landing gear, normal nosewheel steering, alternate brakes, inboard flight spoilers, left engine thrust reverser, ground spoilers, the system A autopilot, and the autoslats through the power transfer unit. Hydraulic system B (for 737-300, -400, and -500 series airplanes): A system that includes an engine-driven hydraulic pump and an electrically powered pump that provides power for the ailerons, rudder, elevators, trailing edge flaps, leading edge flaps and slats, autoslats, normal brakes, outboard flight spoilers, right thrust reverse, yaw damper, the system B autopilot, autobrakes, landing gear transfer unit, and alternate nose-wheel steering (if installed). Input shaft (of the 737 main rudder PCU): When rudder motion is commanded, this device moves the primary and secondary dual-concentric servo valve slides by way of the primary and secondary internal summing levers to connect hydraulic pressure and return circuits from hydraulic systems A and B so that hydraulic pressure is ported to the appropriate sides of the dual tandem actuator piston to extend or retract the main rudder PCU piston rod. Interpolation: The determination, or approximation, of unknown values based on known values.

Glossary of Terms xviii Aircraft Accident Report Iteration: A process used by the Safety Board that includes repeating Board computer simulations to compare the flights of USAir flight 427, United Airlines flight 585, and Eastwind Airlines flight 517 with available flight data recorder (FDR) data from those flights. The simulation process includes inputting assumed flight control surface (aileron, rudder, and elevator) positions, running the flight simulations, and comparing the output of the simulations (for example, altitude, airspeed, and heading) with FDR data. Kinematics: A process used by Boeing and the Safety Board that involves fitting curves through available FDR data (such as heading, pitch, and roll), obtaining flight control time history rates from these curves, and obtaining accelerations from these rates. Forces, moments, and aerodynamic coefficients are then obtained from these accelerations using Newton’s Laws. Knot: A velocity of 1 nautical mile per hour. Linear variable displacement transducer: An electromechanical device that measures linear movement and converts the measurement into an electrical signal (output voltage) that relates position to signal. In the 737 main rudder PCU, it is used to sense the yaw damper position. (Also referred to as a linear variable displacement transformer.) M-CAB: A Boeing multipurpose cab flight simulator that can be modified to simulate a variety of aircraft models and scenarios. It is an engineering simulator that is capable of simulating events that are outside of normal flight regimes, but it is not used for flight training. Metering edges: The sides of grooves that are cut into the land surface of the primary or secondary slides of the main rudder PCU servo valve. Flow of hydraulic fluid is controlled by positioning a metering edge relative to a metering port (that is, a rectangular hole in the valve housing and secondary slide through which hydraulic fluid flows). Metering occurs when the metering edge opens and closes the metering port. Minimum tolerance servo valve: A servo valve used by Boeing during thermal shock testing (for this accident investigation) because it had the tightest diametric clearances (between the primary and secondary slides and the secondary slide and valve housing) that would pass the PCU acceptance test procedure friction requirements. NG: Boeing’s next-generation 737 series, designated as the 737-600, -700, -800, and -900 models. Overtravel: The ability of a device to move beyond its normal operating position or range. Within the main rudder PCU servo valve, overtravel of the primary or secondary slides would be the result of elastic deformation of the mechanical input mechanism. Pitch control: The function that is performed by the elevator by moving the control column forward or aft, which raises or lowers the nose of the airplane. Portable airborne digital data system: A self-contained flight test data recording system developed by Boeing that was installed on a flight test airplane to record parameters

Glossary of Terms xix Aircraft Accident Report needed to evaluate airplane performance. For USAir 427 and Eastwind 517 flight testing, the system recorded all data at a sampling rate of 20 times per second. Power control unit (PCU): A hydraulically powered device that moves a control surface, such as a rudder, elevator, and aileron. Roll: Rotation of an airplane about its longitudinal axis. Roll control: The function that is performed by the ailerons and flight spoilers by moving the control wheel to the right or the left. Rotor (when referring to weather): An atmospheric disturbance produced by high winds, often in combination with mountainous terrain, and expressed by a rotation rate (in radians per second), a core radius (in feet), and a tangential speed (in feet per second). Rotation can occur around a horizontal or vertical axis. Rudder: An aerodynamic vertical control surface that is used to make the airplane yaw, or rotate, about its vertical axis. Rudder control quadrant: A device in the rudder system that connects rudder cables to control rods to transmit rudder system inputs. Reverse rudder response: A rudder surface movement that is opposite to the one commanded. Rudder hardover: The sustained deflection of a rudder at its full (blowdown) travel position. Rudder trim: A system that allows the pilots to command a steady rudder input without maintaining foot pressure on the rudder pedals. It can be used to compensate for the large yawing moments generated by asymmetric thrust in an engine-out situation. Servo valve (in the 737 main rudder PCU): A valve used to control rudder direction and rate of movement. The valve comprises a primary slide that moves within a secondary slide that, in turn, moves within the servo valve housing. These slides direct hydraulic fluid through passages to cause rudder movement. Servo valve housing (in the 737 main rudder PCU): A cylinder-shaped assembly that contains hydraulic fluid passages and interacts with the servo valve secondary slide. Servo valve primary slide (in the 737 main rudder PCU): A cylindrical piston that moves within the servo valve secondary slide. It is moved by an internal primary summing lever, which translates inputs from the yaw damper and/or the external input crank (which moves when a pilot applies pressure to a rudder pedal) into axial movement of the primary slide. Servo valve secondary slide (in the 737 main rudder PCU): A cylindrical “sleeve” that encloses the servo valve primary slide. It is moved by the internal secondary summing lever, which translates inputs from the yaw damper and/or the external input crank (which moves when a pilot applies pressure to a rudder pedal) into axial movement of the secondary slide. Sideload: The effect of lateral acceleration, typically the result of sideslip or yaw acceleration.

Glossary of Terms xx Aircraft Accident Report Sideslip: The lateral angle between the longitudinal axis of the airplane and the direction of motion (flightpath or relative wind). It is normally produced by rudder forces, yawing motion resulting from asymmetrical thrust, or lateral gusts. Silting: The accumulation of particles of contaminants in hydraulic fluid in a hydraulic component. The particles are smaller than the filter on the inlet side of the component and tend to settle at various edges and corners of valves and stay there unless washed away by higher flow rates. Slat: An aerodynamic surface located on an airplane wing’s leading edge that may be extended to provide additional lift. Spoiler: A device located on an airplane wing’s upper surface that may be activated to provide increased drag and decreased lift. Standby hydraulic system: An independent hydraulic system that contains its own electric pump that, when activated, powers the standby rudder system. It also provides an alternate source of power for both thrust reversers and extends the leading edge flaps and slats in the “ALTERNATE FLAPS” mode. Standby rudder system: A system that provides backup control of the rudder when activated or in the event of a hydraulic system failure. It is powered by the standby hydraulic system and is unpressurized during normal operations. Summing lever (in the 737 main rudder PCU): One of two internal levers (primary or secondary) within the main rudder PCU that applies force to move the servo valve’s primary or secondary slides, respectively. Also, an external lever that transmits rudder pedal and trim input to the PCU’s external input crank. Vertical motion simulator: A simulator at the National Aeronautics and Space Administration’s Ames Research Center that is the world's largest motion simulator (with 60 feet of vertical travel). It can be adapted to represent a large number of airplanes, helicopters, and spacecraft. The large motion of this simulator provides a more accurate representation of flight dynamics and accelerations than can be experienced in the Boeing M-CAB or a normal pilot training simulator. Wake vortex: A counterrotating airmass trailing from an airplane’s wing tips. The strength of the vortex is governed by the weight, speed, and shape of the wing of the generating aircraft; the greatest strength occurs when the wings of the generating aircraft are producing the most lift, that is, when the aircraft is heavy, in a clean configuration, and at a slow airspeed. (Also known as wake turbulence.) Yaw: Rotation of an airplane about its vertical axis. Yaw control: The function that is normally performed by the rudder by pilot input or yaw damper input. (Also known as directional control.) Yaw damper (in the 737 main rudder PCU): A system, composed of the yaw damper control switch and a yaw damper coupler, that automatically corrects for yaw motion. The 737 yaw damper coupler includes a rate gyro that senses aircraft motion about the yaw axis and converts the motion to an electrical signal that is sent to the main rudder PCU, which applies the rudder to stop the yaw.

Factual Information 1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On September 8, 1994, about 1903:23 eastern daylight time,1 USAir (now US Airways)2 flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering to land at Pittsburgh International Airport (PIT), Pittsburgh, Pennsylvania. Flight 427 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 as a scheduled domestic passenger flight from Chicago-O'Hare International Airport (ORD), Chicago, Illinois, to Pittsburgh. The flight departed ORD about 1810, with 2 pilots, 3 flight attendants, and 127 passengers on board. (Table 1, in section 1.2, shows an injury chart.) The airplane entered an uncontrolled descent and impacted terrain near Aliquippa, Pennsylvania. All 132 people on board were killed, and the airplane was destroyed by impact forces and fire. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules (IFR) flight plan. The accident occurred on the third day of a 3-day trip sequence for the flight crew. The pilots reported for duty on the day of the accident about 1215 in Jacksonville, Florida, and departed Jacksonville International Airport in the accident airplane, designated as USAir flight 1181, to Charlotte, North Carolina, about 1310. Flight 1181 arrived at Charlotte-Douglas International Airport about 1421. The next trip segment, also designated as flight 1181, departed Charlotte for ORD about 1521. The airplane arrived at the destination airport about 1707. At ORD, the accident airplane was designated as USAir flight 427 with an intended destination of Pittsburgh and the same flight crew performing flight duties. Flight 427 departed the gate at ORD about 1802, and became airborne about 1810. The flight plan filed for flight 427 indicated an estimated en route time of 55 minutes. Review of air traffic control (ATC) and cockpit voice recorder (CVR) information3 indicated that the captain was performing the radio communications and other pilot-not-flying (PNF) duties and that the first officer was performing the pilot-flying (PF) duties with the auto-flight system (AFS) engaged.4 The CVR indicated that, about 1845:31, ATC personnel at Cleveland Air Route Traffic Control Center cleared USAir flight 427 to descend from its en route cruise altitude of flight level (FL) 290 to FL 240.5 The captain responded, “out of two nine oh for 1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 2 For consistency, US Airways is referred to as USAir. 3 A complete transcript of the CVR is included in appendix B of this report. 4 For additional information regarding the AFS, see section 1.6.3.1. 5 FL 290 is 29,000 feet mean sea level (msl), based on an altimeter setting of 29.92 inches of mercury (Hg). Likewise, FL 240 is 24,000 feet msl.

Factual Information 2 Aircraft Accident Report two four oh….” As the airplane neared its destination (about 1850:56), Cleveland Center controllers advised the pilots of USAir flight 427 to “cross CUTTA [intersection]6 at and maintain one zero thousand….” The flight crew acknowledged the descent clearance, and the CVR recorded PIT automatic terminal information service information Yankee beginning about 1851:22. About 1853:15, the CVR recorded the cockpit door being opened and closed. About 1853:26, a flight attendant inquired about connecting flight and gate information and asked if the pilots wanted anything to drink. About 1854:02, the flight attendant exited the cockpit. About 1854:27, Cleveland Center reiterated the instructions to cross CUTTA intersection at 10,000 feet mean sea level (msl) and instructed the pilots to reduce the airspeed to 250 knots. According to ATC and radar information, at that time, Delta Air Lines flight 1083, a Boeing 727 that had been sequenced to precede USAir flight 427 on the approach to PIT from the northwest, was in level flight at 10,000 feet msl with an assigned airspeed of 210 knots and an assigned heading of 160°. Delta flight 1083 was in communication with Pittsburgh terminal radar approach control (PIT TRACON) personnel.7 About 1856:16, Cleveland Center stated, “USAir [427] reduce speed to two one zero [210 knots] that’s at the request of [PIT] approach….” About 11 seconds later, the Cleveland Center controller told the pilots of USAir flight 427 that they did not have to make the previously issued crossing restriction (cross CUTTA at 10,000 feet msl), “just uh, speed first…pd [pilot’s discretion] to ten….” About 1856:32, Cleveland Center told the pilots to “contact PIT approach (on frequency 121.25 Hertz [Hz]).” The captain acknowledged the instructions about 1856:36 and advised PIT TRACON about 1856:52 that he was “descending to ten [thousand feet msl].” About 1857:07, the CVR recorded the flight attendant returning to the cockpit and delivering juice drinks to the pilots. About 1857:23, PIT TRACON responded to the initial contact from the pilots of USAir flight 427. The controllers instructed the pilots to turn right to a heading of 160°, advised them that they would receive radar vectors to the final approach course for runway 28 right (28R) at PIT, and instructed them to reduce airspeed to 210 knots. About 1858:03, PIT TRACON instructed the pilots of Delta flight 1083 to descend to and maintain an altitude of 6,000 feet msl. About 1858:24, the accident airplane’s CVR recorded the sound of an aural tone similar to an altitude alert and the flight attendant stated, “OK, back to work.” Flight data recorder (FDR) information8 indicated that the airplane was at 10,818 feet msl at that time. About 1858:29, the CVR recorded the sound of the cockpit door opening and closing. 6 CUTTA intersection is located about 30 nautical miles (nm) northwest of PIT and is a northwest arrival fix for traffic landing at PIT. 7 Radar data show that, at their closest point (about 1902:39), Delta flight 1083 and USAir flight 427 were 4.1 nm apart at 6,000 feet msl. For additional information regarding radar data for airplanes in the vicinity of the accident site, see section 1.16.2. 8 For more information about the data recorded by the FDR, see sections 1.11.2 and 1.16.6.1.

Factual Information 3 Aircraft Accident Report About 1858:33, PIT TRACON controllers instructed USAir flight 427 to descend and maintain an altitude of 6,000 feet msl. The pilots acknowledged the descent instructions and, about 1859:04, started to accomplish the Preliminary Landing checklist (altimeters/flight instruments, landing data, shoulder harnesses, and approach briefing). The pilots conducted an approach briefing about 1859:28. According to ATC transcripts, about 1900:06, PIT TRACON instructed Delta flight 1083 to turn left to a heading of 130° and reduce airspeed to 190 knots. About 1900:14, the approach controllers assigned USAir flight 427 a heading of 140° and an airspeed of 190 knots, and the flight crew acknowledged the instructions. About 1900:24, the CVR recorded a sound similar to the flap handle being moved.9 About 1900:43, the first officer began a routine public address (PA) announcement,10 thanking the passengers for traveling with USAir and asking the flight attendants to prepare the cabin for arrival. At 1901:06, the CVR recorded a chime similar to the seatbelt chime. The CVR indicated that, while the first officer was making the PA announcement (about 1900:44), PIT TRACON instructed Delta flight 1083 to turn left to a heading of 100°. Also during the first officer’s PA announcement (about 1901:02), the captain of USAir flight 427 asked the controllers “did you say two eight left for USAir four twenty seven?” About 1901:06, the PIT TRACON controller responded “…USAir [427] it will be two eight right.” About 1901:16, the approach controller advised Delta flight 1083 to contact approach control on a different frequency.11 According to the CVR and ATC transcripts, about 1902:22 PIT TRACON stated “USAir 427, turn left [to] heading one zero zero. Traffic will be [at your] one to two o’clock [position, and] six miles, northbound, [a] Jetstream climbing out of thirty-three [hundred feet msl] for five thousand [feet msl].”12 The pilots of USAir flight 427 acknowledged the approach controller’s transmission at 1902:32 and stated, “We’re looking for the traffic [and] turning to one zero zero, USAir 427.” 9 According to USAir personnel, the standard configuration for a 737-300 airplane operating at an airspeed of 190 knots during an approach to land would be flaps 1, which provides for partial extension of the wing leading edge slats and full extension of the Krueger (leading edge) flaps and 1° of extension of the wing trailing edge flaps. During postaccident examination, the accident airplane’s flaps were found in the flaps 1 position (see section 1.12). 10 FDR data indicated that, when the first officer started the PA announcement, the airplane was descending through 7,800 feet msl. 11 Review of the ATC transcripts indicated that USAir flight 427 and Delta flight 1083 were using a common Pittsburgh approach control frequency for approximately 4 minutes 40 seconds. When he was interviewed after the accident, the captain of Delta flight 1083 stated that he did not recall hearing USAir flight 427 on the frequency. He described the flight conditions as “good weather, with no turbulence or bird activity.” He further stated that the horizon was clearly visible and that visibility was not restricted. 12 This traffic was an Atlantic Coast Airlines Jetstream 31, operating as flight 6425 and departing the Pittsburgh area on a 360° heading. Although ATC issued a traffic advisory to Atlantic Coast flight 6425 regarding “traffic at 11 o’clock” (USAir flight 427), the captain and first officer of the Jetstream stated that they did not see flight 427. The captain of Atlantic Coast flight 6425 recalled seeing traffic at his 12:30 to 1 o'clock position, which he believed to be a 727. This position and type of airplane was consistent with that of Delta flight 1083.

Factual Information 4 Aircraft Accident Report FDR data indicated that, about 1902:53, USAir flight 427 was rolling out of the left bank (moving through 7° of left bank toward a wings-level attitude) as it approached the ATC-assigned heading of 100° and was maintaining the ATC-assigned airspeed (190 knots) and altitude (6,000 feet msl). According to the CVR transcript, about 1902:54 the first officer stated, “oh, ya, I see zuh Jetstream.”13 As the first officer finished this statement (about 1902:57), the CVR recorded a sound similar to three thumps in 1 second,14 the captain stating “sheeez” (at 1902:57.5), and the first officer stating “zuh” (at 1902:57.6).15 Between about 1902:57 and about 1902:58, FDR data indicated that USAir flight 427’s airspeed fluctuated from about 190 knots to about 193 knots and then decreased to about 191 knots for the next 4 seconds. Between about 1902:57 and about 1902:59, FDR data indicated that the airplane’s left bank steepened from slightly less than 8° to slightly more than 20°. Figure 1 shows a plot of the FDR data during the last 30 seconds of the flight, along with CVR comments and sounds.16 About 1902:58, the CVR recorded an additional thump, two “clickety click” sounds, the sound of the engine’s noise getting louder,17 and the sound of the captain inhaling and exhaling quickly one time. Also about 1902:58, the FDR recorded a brief forward movement of the control column. About 1902:59, the left roll was arrested, and the airplane began to briefly roll right toward a wings-level attitude; FDR data show that, between about 1902:59 and about 1903, the airplane’s left bank had decreased to about 15°). Also about 1902:59, the airplane’s heading data, which had been moving left steadily toward the ATC-assigned heading of 100°, began to move left at a more rapid rate, passing through the 100° heading. At 1902:59.4, the CVR recorded the captain stating “whoa” and, at 1902:59.7, the sound of the first officer grunting softly. By just after 1903:00, the airplane had begun to roll rapidly back to the left again; its airspeed remained about 191 knots. FDR heading data indicated that, by 1903:01, the airplane’s heading had moved left through about 089° and continued to move left at a rate of at least 5° per second until the stickshaker activated about 1903:08. Between about 1903:01 and about 1903:04, the CVR recorded the sound of the first officer grunting loudly and making brief exclamatory remarks18 while the airplane continued to roll left, with several fluctuations in the roll rate. 13 The 737 has three windows on each side of the cockpit. These windows consisted of a forward-facing windscreen, a window located at the pilot’s side, and a middle window (located between the forward and side windows). Postaccident examination of radar data and simulations revealed that the Jetstream traffic would have been visible at that time through the lower part of the middle window on the first officer’s side of the airplane. 14 These sounds (and other sounds that occurred during the upset sequence) are discussed in detail in section 1.16.7. 15 In this report, CVR comments and noises, which are recorded continuously and can be accurately transcribed to the nearest one-tenth of a second, are depicted to the nearest one-tenth of a second during descriptions of the upset sequence portion of the flight for detail and clarity. FDR data are sampled at specific times and intervals, which vary depending on the parameter; therefore, FDR times in this report are referenced to the nearest full second. 16 The CVR time equals the FDR time in seconds plus 1900:43 (local time). 17 The sound of the engine noise getting louder was determined from a spectrum analysis of sounds recorded on the CVR (see section 1.16.7.3). This sound cannot be discerned simply by listening to the CVR and is therefore not described on the CVR transcript. 18 The pilots’ speech, breathing, and other sounds are discussed in greater detail in section 1.16.8.

Factual Information 5 Aircraft Accident Report Figure 1. FDR data during the final 30 seconds of USAir flight 427.

Factual Information 6 Aircraft Accident Report FDR information revealed that, just before 1903:03, the airplane’s left bank angle had increased to about 43°, the airplane had begun to descend from its assigned altitude of 6,000 feet msl, the control column had started to move aft, and the airspeed started to decrease below 190 knots. Less than 1 second later, the CVR recorded the sound of the autopilot disconnect horn. During the next 5 seconds, the FDR recorded increasing left roll, aft control column, decreasing altitude, and a decreasing airspeed to about 186 knots. Also between 1903:02.7 and 1903.07.7, the CVR recorded several brief remarks on the flight crew channels. At 1903:07.5, the CVR recorded a sound of increasing amplitude similar to onset of stall buffet and the captain stating “what the hell is this?” The CVR transcript indicated that, at 1903:08.1, a vibrating sound similar to aircraft stickshaker started and continued until the end of the recording. At 1903:08.3, an aural tone similar to an altitude alert sounded, and 1 second later, the traffic alert and collision avoidance system sounded “traffic traffic.”19 According to the ATC transcript, a radio transmission from USAir flight 427 about 1903:10 stated, “Oh (unintelligible) Oh [expletive].”20 The approach controller reported that, at that time, flight 427’s altitude readout on the radar screen indicated 5,300 feet. About 1903:14, the controller stated “USAir 427 maintain 6,000, over.” About 1903:15, the CVR transcript indicated that the captain made a radio transmission, stating “four twenty seven emergency.” Between 1903:18.1 and 1903:19.7, the CVR recorded the captain stating “pull…pull…pull.” From about 1903:09 to about 1903:22, the first officer’s radio microphone was activated and deactivated repeatedly, so the ATC tapes recorded exclamations and other sounds from the accident airplane. During postaccident interviews, air traffic controllers who were in the tower cab when the accident occurred reported that they observed dense smoke rising to the northwest of the airport shortly after USAir flight 427’s final transmission. The CVR stopped recording at 1903:22.8. About 1903:23, the airplane impacted hilly, wooded terrain near Aliquippa, Pennsylvania, approximately 6 miles northwest of PIT. The location of the accident was 40° 36 minutes, 14.14 seconds north latitude, 80° 18 minutes, 36.95 seconds west longitude at an elevation of about 930 feet msl. The accident occurred during daylight hours. 19 The traffic alert and collision avoidance system is an airborne system based on radar beacon signals that operate independent of ground-based equipment. Although it was not possible to positively determine what triggered the system’s alert, radar information indicated that, during the accident sequence, USAir flight 427 was within about 3 miles of Atlantic Coast flight 6425 when the accident airplane descended through the Atlantic Coast flight’s altitude. 20 The CVR transcript also indicated that the pilots of USAir flight 427 made a radio transmission to ATC about 1903:10 and that the captain’s cockpit microphone recorded the statement, “Oh God…Oh God.”

Factual Information 7 Aircraft Accident Report 1.2 Injuries to Persons 1.3 Damage to Aircraft The airplane was destroyed by ground impact and postcrash fire. According to insurance company records, the airplane was valued at $30 million. 1.4 Other Damage No structures on the ground were damaged. Trees and vegetation near the accident site were destroyed or damaged by the impact, fuel blight, and postcrash fire and during wreckage removal. 1.5 Personnel Information The flight crew consisted of the captain and the first officer. Three flight attendants were also on duty aboard the airplane. The 3-day trip sequence during which the accident occurred was the first time the captain and the first officer had flown together. Both pilots were off duty on Monday, September 5, 1994 (Labor Day holiday). According to their wives, both pilots spent their off-duty time relaxing with family and friends and received a normal amount of sleep21 before they reported for flight duty. The pilots reported for duty in Philadelphia, Pennsylvania, on Tuesday, September 6, about 1615 for the 3-day trip sequence. On the first day, the pilots flew to Indianapolis, Indiana, returned to Philadelphia, and then continued to Toronto, Ontario, Canada. They arrived in Toronto about 2310, completed their flight-related duties about 2327, and remained in Toronto overnight. According to the flight logs, the pilots’ duty time for the first day of their trip sequence was about 7 hours 12 minutes, including about 4 hours 56 minutes of flight time. At Toronto, the pilots had a scheduled layover of about 14 hours 30 minutes. Table 1. Injury chart. Injuries Crew Passengers Others Total Fatal 5 127 0 132 Serious 0 0 0 0 Minor/None 0 0 0 0 Total 5 127 0 132 21 The captain’s wife reported that he normally slept about 7½ hours each night when he was not working. She indicated that, on September 4 and 5, the captain went to bed between 2300 and 2400 and awoke between 0700 and 0800 the following mornings. The first officer’s wife reported that he normally slept about 8 hours each night when he was not working. She indicated that, on September 4, the first officer went to bed about 2200 and awoke about 0630 the next morning; on September 5, he went to bed about 2200 and awoke earlier than usual (about 0500) the next morning to begin the commute from his home near Houston, Texas, to Philadelphia, Pennsylvania, to report for duty later that day.

Factual Information 8 Aircraft Accident Report On the second day of the trip sequence (Wednesday, September 7), the pilots’ duty period began about 1400 at Toronto. They flew to Philadelphia, then Cleveland, Ohio; then Charlotte, North Carolina; and then Jacksonville, Florida. They arrived in Jacksonville about 2254, completed their flight-related duties about 2321, and remained in Jacksonville overnight. According to the flight logs, the pilots’ duty time for the second day of their trip sequence was about 9 hours 21 minutes, including about 5 hours 16 minutes of flight time. At Jacksonville, the pilots had a scheduled layover of nearly 13 hours before reporting for duty about 1215 on Thursday, September 8. 1.5.1 The Captain The captain, age 45, was hired by USAir on February 4, 1981, while on furlough from Braniff Airways. He held airline transport pilot (ATP) certificate No. 1954135 with a multiengine land airplane rating and a type rating in the 737. Additionally, he held a flight engineer certificate and a commercial pilot certificate with single-engine land, multiengine land, and instrument ratings. The captain’s most recent first-class Federal Aviation Administration (FAA) airman medical certificate was issued on July 9, 1994, with no restrictions or limitations. The captain’s initial flight experience was in general aviation, and he obtained a private pilot certificate in August 1969. He subsequently entered the U.S. Air National Guard and successfully completed the U.S. Air Force (USAF) pilot training program22 in December 1973. The Safety Board was unable to review the captain’s USAF training and flight records from before September 3, 1975, because, according to a USAF representative, flight records dated before then (including the captain’s initial training records) had been destroyed. The captain’s available military flight records indicated that, between September 3, 1975, and March 15, 1979, he accumulated about 894 hours of military flight time, including 227 hours of training and 667 hours in the Cessna O-2 observation airplane.23 The captain obtained a commercial pilot certificate in June 1974, a flight engineer certificate on July 28, 1976, and an ATP certificate with a type rating in the 737 on August 25, 1988. He was hired by Braniff Airways on October 17, 1977. His initial assignment with Braniff was as second officer on a Douglas Aircraft Company DC-8. On December 1, 1980, the captain was furloughed by Braniff. Two months later, the captain was hired by USAir. As he neared the end of the required 1-year probation period at USAir, the captain submitted a letter of resignation to Braniff on January 25, 1982, with an effective date of February 4, 1982. Braniff personnel records indicated that the captain would be considered for rehire. The captain’s first assignment with USAir was as a flight engineer on the 727. He was upgraded to first officer on the British Aerospace Corporation (BAC) 111 in 22 The USAF provides pilot training for Air National Guard personnel. 23 The Cessna O-2 is the military version of the Cessna 337, an in-line thrust, twin reciprocating engine- powered airplane. The Cessna O-2 is used in forward air control observations and is not approved for aerobatic maneuvers.

Factual Information 9 Aircraft Accident Report November 1982. He transitioned to the 737 in September 1987 as a first officer and was upgraded to captain on the 737 on August 25, 1988. According to USAir records, at the time of the accident, the captain had flown approximately 12,000 flight hours, including 3,269 hours as a 737 captain. He also had 795 flight hours as a 737 first officer. USAir records indicated that the captain was on extended sick leave from January 25 to April 28, 1994, because of back surgery.24 When he returned to flight duty, the captain underwent 737 requalification and crew resource management (CRM) training, which he completed on April 29, 1994. The captain’s most recent line check was completed on May 6, 1994, and his most recent line-oriented flight training (LOFT) was completed on July 19, 1994. A review of USAir’s training records indicated that the captain performed satisfactorily in initial, recurrent, CRM, and LOFT training and line and proficiency checks in all airplanes and all positions.25 Additionally, a review of the captain’s USAir personnel records, FAA airman certification records, and FAA accident/incident and violation histories revealed nothing noteworthy. During postaccident interviews, several check airmen, instructors, and first officers who were acquainted with the captain and his piloting abilities indicated that the captain was meticulous, very proficient, very professional, and attentive to detail and that he flew “by the book.” They also reported that the captain was well liked and exhibited excellent CRM skills. According to his wife, the captain did not complain of back pain after he returned to flight duty. She stated that he took no medication, other than allergy injections,26 and drank alcohol rarely. She considered his overall health to be “very good.” A review of the USAir-sponsored insurance company medical records revealed that, during the 5 years before the accident, the medical claims submitted by the captain indicated no significant illnesses or hospitalizations except for the back surgery shown in company records. The Safety Board’s review of the captain’s available flight records (civilian and post-1975 military records) revealed no documentation of aerobatic flight experience.27 24 The captain underwent back surgery in March 1994 to remove a ruptured disk. 25 Although the captain’s training records indicated that he satisfactorily completed all training and line and proficiency checks in all airplanes and all positions, the training record from his September 1987 transition from BAC-111 first officer to 737 first officer contained the instructor’s remark, “I would place at end of training, [the captain] in [the] lower 10 percent.” During postaccident interviews, the instructor stated that he did not recall the circumstances that prompted him to make this remark. He further stated that, if the captain had not satisfied all the requirements, he would have graded the captain’s performance unsatisfactory. 26 During postaccident interviews, the captain’s allergist stated that the captain exhibited mild allergy symptoms, such as sneezing, runny nose, and postnasal drip, which responded well to allergy injections. The allergist reported that the captain was current with his allergy injections, having received the most recent one in August 1994. 27 The Safety Board is aware that the USAF’s initial pilot training program included aerobatic training in the T-37 and T-38 jet trainers. (No records were available of the captain’s initial training in the Air Force.)

Factual Information 10 Aircraft Accident Report 1.5.2 The First Officer The first officer, age 38, was hired by Piedmont Airlines in February 1987 and became a USAir employee after USAir acquired Piedmont Airlines in June 1989. He held ATP certificate No. 2238867 with single-engine and multiengine land airplane ratings. Additionally, he held a commercial pilot certificate with single-engine land, multiengine land, and instrument ratings. The first officer’s most recent FAA first-class airman medical certificate was issued on July 7, 1994, with no restrictions or limitations. The first officer’s initial flight experience was in general aviation. He was issued a private pilot certificate in May 1973, multiengine and instrument ratings in December 1980, a commercial pilot certificate in January 1981, and the ATP certificate in October 1982. The first officer’s initial position with Piedmont Airlines was as a first officer on the Fokker F.28. He transitioned to first officer on the 737 on May 1, 1989, and remained in that position after he became a USAir employee in June 1989. At the time of the accident, the first officer had a total of 9,119 flight hours, including 3,644 flight hours as a 737 first officer. His most recent proficiency check, which included CRM refresher training, was satisfactorily completed on May 12, 1994. A review of the first officer’s USAir personnel records, FAA airman certification records, and FAA accident/incident and violation histories revealed nothing noteworthy. According to his training records, the first officer performed satisfactorily in initial and LOFT training and line and proficiency checks in all airplanes and all positions. During postaccident interviews, check airmen, instructors, and captains who were acquainted with the first officer and his piloting abilities indicated that the first officer was friendly, very well qualified, and an outstanding first officer who exhibited exceptional piloting skills. USAir’s Philadelphia-based chief pilot stated that the first officer was a "very dedicated, professional, dependable person." One captain who had flown with the first officer described an in-flight hydraulic system emergency that occurred during one of their flights. He stated that the first officer remained very calm during the emergency situation. According to the first officer’s wife, he did not take medication and was a moderate, occasional drinker. She characterized the first officer’s overall health as “excellent.” A review of the USAir-sponsored insurance company medical records revealed that the first officer had not made any medical claims during the 5 years before the accident. Examination of the first officer’s personal logbooks and records did not indicate any aerobatic flight training or experience. However, his flight logbooks indicated that he had performed spin recoveries on three occasions in 1973 in a Piper J-3 “Cub” airplane when he had total flight times between 77 and 93 hours.

Factual Information 11 Aircraft Accident Report 1.5.3 Flight Attendant Information The lead, or “A” position flight attendant was hired by Piedmont Airlines in May

1. He completed the USAir Merger Module Training that was required when USAir

acquired Piedmont Airlines in June 1989. His most recent recurrent training was satisfactorily completed on June 14, 1994, and he was qualified on the 737-300. The “B” position flight attendant was hired by Piedmont Airlines in March 1989. She also completed the USAir Merger Module Training in June 1989. Her most recent recurrent training was satisfactorily completed on February 2, 1994, and she was qualified on the 737-300. The “C” position flight attendant was hired by USAir in October 1988. Her most recent recurrent training was satisfactorily completed on October 14, 1993, and she was qualified on the 737-300. 1.6 Airplane Information N513AU, a 737-300 series airplane (model 737-3B7),28 serial number (S/N) 23699, was a pressurized, low-wing, narrow-body transport-category airplane, equipped with two CFM International29 CFM56-3B-2 engines (operated at the CFM56-3-B1 thrust rating). The No. 1 (left) engine, S/N 725150, had been operated about 13,880 flight hours since new, including 3,462 flight hours and 2,160 flight cycles since it was overhauled and installed on N513AU in August 1993. The No. 2 (right) engine, S/N 720830, had been operated about 16,810 flight hours since new, including 3,789 flight hours and 2,340 flight cycles since it was overhauled and installed on N513AU in July 1993. At the time of the accident, the airplane had been operated about 23,846 total hours of flight time and 14,489 cycles. When the accident airplane was manufactured and delivered to USAir in October 1987, it was registered as N382AU; USAir re-registered the airplane as N513AU in December 1987 after the airline acquired Pacific Southwest Airlines (PSA). The airplane was equipped with an auxiliary fuel tank, which had been deactivated and held no fuel at the time of the accident.30 The presence of the auxiliary fuel tank limited the cargo capacity of the aft cargo compartment. Dispatch records indicate that the airplane held a total of 15,400 pounds of fuel when it left the gate at ORD and that the estimated fuel consumption for the flight to Pittsburgh was about 6,400 pounds. According to the USAir dispatch papers for USAir 28 The 737-300 series airplane is one of several 737 models. Other 737 models include the -100, -200, -400, -500, -600, -700, -800, and -900. The 737-600 through -900 series airplanes are referred to as the 737 next-generation (NG) airplanes. 29 CFM International is a joint venture engine-manufacturing company formed in 1974 by General Electric (now General Electric Aircraft Engines) of the United States and Society National d’Etude et de Construction de Moteurs d’Aviation of France. 30 The accident airplane was equipped with a Patrick Aircraft Tank System auxiliary fuel tank system. This 425-gallon-capacity auxiliary fuel tank system was located in the forward end of the aft cargo bay. According to USAir maintenance records, the auxiliary fuel tank was installed in the accident airplane on October 17, 1987, and was deactivated in accordance with the manufacturer’s procedures on January 10, 1994.

Factual Information 12 Aircraft Accident Report flight 427, 8 passengers were seated in the first-class cabin, and 119 passengers were seated in the coach cabin. According to USAir’s dispatch papers, flight 427’s documented cargo consisted of 10 boxes of magazines weighing 1,939 pounds. The boxes were loaded in the forward compartment with about 425 pounds of passenger baggage; the aft cargo compartment was loaded with 1,275 pounds of passenger baggage. USAir’s dispatch papers also indicated that the airplane’s gross takeoff weight when it departed ORD was 114,969 pounds. The airplane had a certificated maximum gross weight of 135,500 pounds and a maximum takeoff weight for the departure runway (32L) at ORD of 118,700 pounds. On the basis of Safety Board calculations, flight 427, at the time of the accident, had an estimated operating weight of 108,600 pounds and a center of gravity of 19 percent mean aerodynamic chord, which was within the allowable weight and balance envelope for the approach and landing phase of flight. 1.6.1 Accident Airplane Maintenance Information 1.6.1.1 Inspections USAir’s FAA-accepted continuous airworthiness maintenance program for its 737s included six specific checks to be accomplished at various calendar or operating time intervals. The maintenance inspection intervals and the times and dates that those inspections were last accomplished on the accident airplane were as follows: • Wheel/Oil Check—Accomplished once every operating day. Accomplished on the accident airplane during transit check on September 8, 1994, about 5¾ flight hours before the accident. • Transit Check—Accomplished every 35 flight hours or 7 calendar days, whichever comes first. Accomplished on the accident airplane on September 8, 1994, about 5¾ flight hours before the accident. • "A" Check—Not to exceed 200 flight hours. Accomplished on the accident airplane on August 25, 1994, about 133 flight hours before the accident. • "B" Check—Not to exceed 1,150 flight hours. Accomplished on the accident airplane on May 19, 1994, about 1,008 flight hours before the accident. • "C" Check—Not to exceed 4,600 flight hours. The C check is broken down into four segments at 1,150-hour intervals. A quarter C check was completed on the accident airplane on July 20, 1994, about 433 flight hours before the accident. • "Q" Check—Not to exceed 11,000 hours or 42 months, whichever comes first. The initial Q check is not required until 20,000 hours or 80 months, whichever comes first. The Q check is an approved alternative to the structural inspection ("D" check). Maintenance endorsements for work completed during the accident airplane’s last Q check were dated February 3 through 5, 1993, about 19 months before the accident.

Factual Information 13 Aircraft Accident Report A review of the accident airplane’s maintenance records from June 2, 1994, to the accident date revealed the following five maintenance carryover items: • the left aft inboard flap assembly was dented, • an interim repair to correct a soft and spongy aisle floor section adjacent to seat row number 5 (about fuselage station 360) was needed, • the attach mount bushing on the thrust reverser “C” duct for the right engine was worn, • the lower left and right C duct sliders on the right engine were worn 30 to 49 percent, and • the lower left and right C duct sliders on the left engine were worn 30 to 49 percent. Examination of the maintenance work cards from the most recent C and Q checks noted several reports of lavatory fluid, known as “blue water,” leaking under the sink and toilet of the forward lavatory.31 Additionally, the work cards noted corrosion in the forward galley floor structure. Maintenance records for the most recent Q check indicated that a thrust reverser synchronizer lock (sync-lock) system32 was installed in accordance with Boeing Service Bulletin (SB) 737-78-1053, dated December 17, 1992, and USAir engineering authorization 18190. However, on February 11, 1993, Boeing issued Service Letter (SL) 737-SL-78-26, which advised all 737 operators to deactivate the sync-lock system (if installed) because of “the possibility of an intermittent condition which results in the inability to attain reverse thrust when commanded.” A USAir work card, dated February 5, 1993, stated “accomplish…de-activation of T/R [thrust reverser] sync lock system…[according to] 737-SL-78-26”33 and referenced USAir engineering authorization 18477, “De-activation of Thrust Reverser Sync Lock System,” dated February 4, 1993. The system’s wiring harness remained installed with its electrical connectors capped and secured and the electric synchronizer locks removed. The sync-lock system on the accident airplane remained deactivated on the date of the accident. 34 31 The last report of blue water leakage on the accident airplane was in May 1994, when blue fluid was found aft of the main entry door. The area was inspected and cleaned, and no additional leakage was noted. 32 The thrust reverser sync-lock system was designed to minimize the possibility of in-flight thrust reverser deployment. 33 Boeing’s 737-SL-78-26 was dated February 11, 1993, 6 days after USAir’s maintenance personnel indicated that they accomplished the deactivation of the thrust reverser sync-lock system (according to work card No. 3-72-93853, dated February 5, 1993). According to USAir personnel, they deactivated the thrust reverser sync-lock system in response to an advance copy of 737-SL-78-26, which they received in early February 1993. The installation and subsequent deactivation were completed during the same maintenance visit. 34 After the accident, the FAA issued Airworthiness Directive (AD) 94-21-05 R1, which became effective November 25, 1994. The AD required the installation of the sync-lock feature on all 737-300, -400, and -500 series airplanes.

Factual Information 14 Aircraft Accident Report Maintenance records also indicated that the main rudder power control unit (PCU) was replaced during the last Q check (February 1993) after leakage was observed at the rear seal. Three of the Q check work cards described the work pertaining to the main rudder PCU as follows: Work card No. J3-64-55501-2 indicated that the PCU “reference rod [had] been scraped against [the] vertical fin liner structure” and that the damaged area was cleaned up, inspected, and “found to be within limits.” Work card No. J3-65-27500-2 indicated that the “main bolt which attaches power control unit to rudder attach point has slight step worn in it.” The worn bolt was replaced. Work card No. J3-65-27500-3 indicated that the “rod bearing on [the] PCU at [the] PCU to rudder attach point has rough feel during operation” and that the PCU was replaced “due to leakage.” The replacement main rudder PCU, S/N 1596A, was examined and tested thoroughly during the accident investigation. (For additional information regarding the main rudder PCU, see sections 1.6.3.2 and 1.16.5.) USAir’s maintenance records showed that the periodic rudder functional checks required by Airworthiness Directive (AD) 94-01-07 (explained in more detail in sections 1.6.3.2.1 and 1.18.5) were successfully performed on the accident airplane three times in

1. The initial check was performed on March 21, 1994, at 22,368 flight hours and

13,511 flight cycles. Repetitive inspections were performed on June 14, 1994, at 23,100 hours and 13,994 cycles and on August 8, 1994, at 23,572 hours and 14,298 cycles. The maintenance records also indicated that the accident airplane was in compliance with all other applicable ADs at that time. 1.6.1.2 Events on Earlier Flights The accident airplane departed Windsor Locks, Connecticut,35 about 0620 on the morning of September 8, 1994, and was flown to Syracuse and Rochester, New York; Charlotte; and Jacksonville (where the accident flight crew boarded). The pilots of the earlier flights reported no difficulties with the airplane. However, a passenger who was on the accident airplane when it arrived in Jacksonville reported an "abrupt maneuver" during the approach to Jacksonville. Subsequent examination of the FDR information for this approach indicated a roll of 9° to the left followed by a roll of 12° to the right. The FDR indicated the event, from the beginning of the left roll to the return to wings-level attitude, occurred over 20 seconds. The pilots of that flight stated that they did not notice any unusually abrupt maneuvers. They suggested that a slight roll might have occurred as they changed to different modes of the autopilot, but they had no recollection of an unusual roll event. The pilots stated that the airplane’s systems and controls functioned normally during the flight. 35 The accident airplane remained in Windsor Locks on the night of September 7, 1994, where a maintenance transit check was accomplished. Records indicated that only routine service was performed and that no discrepancies were noted during this inspection.

Factual Information 15 Aircraft Accident Report The Safety Board also received postaccident passenger reports of an unusual sound that occurred during the flight immediately preceding the accident flight, from Charlotte to ORD. An off-duty/commuting USAir captain who traveled on flight 1181 from Jacksonville to Charlotte and then to ORD occupied a seat in the passenger cabin during the flight from Jacksonville to Charlotte; however, he occupied the observer’s jumpseat36 in the cockpit during the flight from Charlotte to ORD because of a full passenger load. According to the off-duty captain, during the flight from Charlotte to ORD, a passenger in the forward cabin told the flight attendant that he heard an unusual noise, and the flight attendant informed the flight crew of the passenger’s comment. While the flight crew attempted to determine the origin of the noise, the off-duty captain noted that the cabin address microphone had come out of its holder. The microphone was returned to its holder, and there were no further reports of unusual noises. During the Safety Board’s January 1995 public hearing regarding this accident,37 the off-duty USAir captain indicated that airplane operations during the two flights appeared to be "normal." He stated that the flight and cabin crew interaction appeared to be routine and professional and that both pilots seemed to be friendly and in good spirits. He observed no problems with the airplane and reported that the captain was performing the PF duties for the leg from Charlotte to Chicago. 1.6.2 Boeing 737 Hydraulic System Information Hydraulic power on the 737-300 is provided by three independent hydraulic systems, each of which is capable of operating pressures of about 2,950 pounds per square inch (psi). The systems are designated as hydraulic system A, hydraulic system B, and the standby hydraulic system. Hydraulic systems A and B have independent hydraulic reservoirs and two hydraulic pumps each. Although hydraulic systems A and B normally operate together to provide dual hydraulic power for primary flight controls (ailerons, elevators, and rudder), either system is capable of powering the flight controls alone if the other system fails. Further, if one of the hydraulic pumps in either the A or B systems were to fail, the remaining pump has sufficient capacity to provide full flight control authority for its respective system operation. The 737-300 hydraulic system A is powered by one engine-driven hydraulic pump (EDP) and one electrical-powered hydraulic pump. Hydraulic system A provides power for the ailerons, rudder, elevators, landing gear, normal nosewheel steering, alternate brakes, inboard flight spoilers, left engine thrust reverser, ground spoilers, the A system autopilot, and the autoslats through the power-transfer unit. The 737-300 hydraulic 36 The cockpit was configured with two crew seats (captain on the left and first officer on the right) with the throttle/communication/navigation console located between them. The observer seat is located behind the flight crew seats and console and in front of the cockpit-to-cabin access door. 37 The Safety Board conducted two sessions of its public hearing regarding this accident. The first session was held in Pittsburgh in January 1995, and the second session was held in Springfield, Virginia, in November 1995. Although it is unusual for the Safety Board to hold two sessions of a public hearing, the Board believed that a second session was warranted, given the scope and technical depth of the accident investigation.

Factual Information 16 Aircraft Accident Report system B is also powered by one EDP and one electrical-powered hydraulic pump. Hydraulic system B provides power for the ailerons, rudder, elevators, trailing edge flaps, leading edge flaps and slats, autoslats, normal brakes, outboard flight spoilers, right engine thrust reverser, yaw damper, the system B autopilot, autobrakes, landing gear transfer unit, and alternate nose wheel steering (if installed). The 737-300 standby hydraulic system is unpressurized during normal operations. This system is powered by an electric pump and can be activated manually by the pilots by arming “ALTERNATE FLAPS” or selecting the hydraulic system A or B flight control switch to “STBY RUD” (standby rudder) on the overhead panel in the cockpit.38 The 737-300 standby hydraulic system will activate automatically in the event of a loss of hydraulic system A or B pressure during takeoff or landing. (For automatic operation, speed must be greater than 60 knots, or the airplane must be airborne with wing flaps extended.) The standby hydraulic system powers the standby rudder system, provides an alternate source of power for both thrust reversers, and extends the leading edge flaps and slats in the ALTERNATE FLAPS mode. In the event of a failure of both hydraulic systems A and B, the ailerons and elevators can be operated manually without hydraulic power (referred to as manual reversion).39 The rudder has no manual reversion capability but can be operated with the standby hydraulic system.40 Controls and indicators for hydraulic systems A and B are located on the first officer’s overhead panel in the cockpit;41 they include on/off switches for each pump and amber lights that indicate hydraulic system low pressure or overheat conditions for the electrically driven pumps. Figure 2 illustrates the hydraulic system panel. 38 During normal operation, the hydraulic system A and B flight control switches would be in the ON position, and the ALTERNATE FLAPS switch would be in the OFF position. 39 According to Boeing, manual reversion requires approximately 40 pounds of force at the control wheel to initiate a roll and approximately 60 pounds of force at the control column to initiate a pitch change. 40 Although the 737 rudder technically has no manual reversion capability, it is possible for a pilot (with sufficient rudder pedal force) to command some rudder movement with no hydraulic system power. 41 Although located on the first officer’s overhead panel, the hydraulic system control panel is accessible to both pilots.

Factual Information 17 Aircraft Accident Report Figure 2. Boeing 737 hydraulic system panel. 29(5+($7 29(5+($7 /2:# 35(6685( /2:# 35(6685( /2:# 35(6685( /2:# 35(6685( <$: '$03(5 )((/#',)) 35(66 63(('#75,0 )$,/ 0$&+#75,0 )$,/ $872#6/$7 )$,/ /2:# 35(6685( /2:# 48$17,7< 67$1'%< +<' )/7#&21752/ 632,/(5 <$:#'$03(5 $/7(51$7(#)/$36 /2:# 35(6685( /2:# 35(6685( (1####4#######(/(&####5 2)) 21 $ (/(&###4#######(1#####5 2)) 21 % +<'#38036 $#################% $#############% 67'%< 58' 2)) $##21 67'%< 58' 2)) %##21 2)) $50 2)) 21 2)) 21 2)) 21 83 '2:1 2))

Factual Information 18 Aircraft Accident Report 1.6.2.1 Hydraulic System Maintenance USAir’s maintenance records indicated that the accident airplane had been serviced at the time of manufacture with Skydrol LD4 hydraulic fluid manufactured by Monsanto.42 According to Boeing, it ensures that the particulate count in the hydraulic systems of newly delivered airplanes meets the cleanliness requirement of National Aerospace Standard (NAS) 1638 Class 9. According to NAS 1638, “Cleanliness Requirements of Fluid Used in Hydraulic Systems,” the “cleanliness limit of the representative fluid sample from parts, assemblies, lines and fittings shall not exceed the permissible maximum contamination limits of the specified class…in Table I….” NAS 1638 Table I lists hydraulic fluid cleanliness limits by particle count and size, ranging from Class 00 to Class 12. Table 2 shows excerpts from the NAS table.43 Boeing's Maintenance Planning Document recommends the replacement of the hydraulic system A and B filters at C check intervals and the replacement of filters located at the flight control system PCUs "on condition"44 during maintenance of the filters’ respective components. USAir’s maintenance program incorporated these recommended replacement intervals. Boeing’s 737 Maintenance Manual (MM) did not recommend any specific interval for the sampling or replacement of the hydraulic fluid during the life cycle of the airplane. However, section 29-15-00 in the MM (pages 601-606), which describes Boeing’s recommended “Hydraulic Systems A, B, and Standby—Inspection Check” procedures and limits, states the following on page 601 (dated November 15, 1993): The operational environment of the airplane hydraulic system can affect the service life of the hydraulic fluid. You make a decision to take a sample of the hydraulic fluid for analysis if you find that it is necessary from your service experience…. If the fluid properties are greater than the limits…replace some quantity of fluid with new fluid until the fluid properties agree with the limits shown. 42 Skydrol LD4 is a phosphate ester hydraulic fluid. It is part of the Skydrol family of fire-resistant hydraulic fluids and meets the airframe manufacturer’s specifications for viscosity, flashpoint, and moisture content as a Type IV fluid. It has been used commercially since 1978. Table 2. Hydraulic fluid cleanliness limits from NAS 1638 Table I. 5-15 µ 15-25 µ 25-50 µ 50-100 µ

100 µ

Class 00 125 22 4 1 0 Class 1 500 89 16 3 1 Class 9 128,000 22,800 4,050 720 128 Class 12 1,024,000 182,400 32,400 5,760 1,024 43 The symbol µ in table 2 represents the unit of measurement termed a micron, which is 1/1,000 of a millimeter. For a point of reference, a 0.5-millimeter mechanical pencil is 500 microns in diameter. 44 Replacement “on-condition” means that the component or part is removed/replaced only after a defect or anomaly is noted during an inspection. The replacement is not based on a time or cycle limit.

Factual Information 19 Aircraft Accident Report During postaccident discussions, Boeing personnel stated that fluid sampling (or replacement/replenishment) intervals were to be established by the operator (along with the operator’s hydraulic fluid supplier) based on service experience and the operational environment. USAir’s maintenance program did not include a requirement to sample or replace the hydraulic fluid in the systems, and such sampling or replacement of hydraulic fluid were not required by the FAA. The Safety Board examined hydraulic fluid samples from the accident airplane during the investigation (see section 1.16.5.4.3 for details).45 1.6.3 Boeing 737 Flight Control Systems The flight controls on the 737 are the ailerons, flight spoilers, elevators, horizontal stabilizer, rudder, flaps, and slats. Flight control about the longitudinal (roll) axis of the airplane is provided by an aileron on each wing assisted by two flight spoilers. Flight control about the lateral (pitch) axis is provided by the horizontal stabilizer and two elevators. Flight control about the vertical or directional (yaw) axis is provided by the single-panel rudder.46 The ailerons and flight spoilers (roll control) are operated by moving the control wheel clockwise or counterclockwise,47 the elevator (pitch control) is operated by moving the control column forward or aft, and the rudder (directional/yaw control) is operated by moving either the right or left rudder pedal forward or aft. Figure 3 depicts the three axes of motion, and figure 4 shows the flight control surface locations. Boeing stated that the 737 roll and yaw control systems were designed to be capable of countering the effects of failures (such as loss of power on one engine, flap and/ or slat asymmetries, and hydraulic system failure) and achieve the desired crosswind control capability. According to Boeing, the 737 is aerodynamically cross-coupled (as are most airplanes); that is, motions about the roll and the yaw axes constantly interact and affect each other in flight. Thus, any yawing motion (sideslip) would cause the airplane to roll unless countered by the control wheel. The 737 rudder system is discussed in greater detail in section 1.6.3.2. 1.6.3.1 Auto-Flight System When engaged, the 737-300 AFS provides control commands to the airplane’s ailerons, flight spoilers, horizontal stabilizer, and elevators to reduce pilot workload and provide for smoother flight. The AFS does not provide control commands to the airplane’s rudder system. A yaw damper system automatically stabilizes the airplane about its yaw axis by limiting yaw motions caused by atmospheric disturbance or the airplane (an 45 On October 18, 1996, the Safety Board issued Safety Recommendation A-96-116, asking the FAA to “define and implement standards for in-service hydraulic fluid cleanliness and sampling intervals for all transport-category aircraft.” See section 1.18.11.5 for a full discussion of the FAA’s response to this recommendation. 46 For more information about the 737 rudder design, see section 1.6.3.2. 47 A clockwise control wheel input commands roll in a right-wing-down (RWD) direction, whereas a counter-clockwise control wheel input commands roll in a left-wing-down (LWD) direction. In this report, clockwise and counter-clockwise control wheel inputs will be described as right and left control wheel inputs, respectively.

Factual Information 20 Aircraft Accident Report Figure 3. Three axes of motion. Figure 4. Boeing 737 flight control surface locations. Angle of Airflow Sensors Leading Edge Flaps Leading Edge Slats Flight Spoilers Trailing Edge Flaps Ailerons Stabilizer Balance Tabs Elevator Rudder Ground Spoilers

Factual Information 21 Aircraft Accident Report inherent characteristic of all swept-wing airplanes). Section 1.6.3.2 contains additional details about the yaw damper system. Rudder trim control during flight is maintained by the pilots with automatic assistance from the yaw damper. The AFS consists of the autopilot flight director system and the autothrottle. Within the autopilot flight director system, commands from two flight control computers move the related flight controls (elevators, stabilizer trim, ailerons, and flight spoilers) through the hydraulic systems. The autopilot flight director system mode control panel (MCP) is located on the glareshield between the pilot positions and provides coordinated control of the autopilot and flight director (FD).48 The MCP contains power switches; indicator lights; flight mode selectors; and airspeed, altitude, vertical speed, heading, and bank angle selectors/displays. Figure 5 shows a 737 MCP display. The autothrottle moves thrust levers to maintain airspeeds and/or thrust settings selected by the pilots and/or calculated by the flight management computer. The autothrottle is armed by a switch on the MCP and is activated by the takeoff/go-around (TOGA) switches on the throttles. Page 14-15-1 of USAir’s 737-300 and -400 Pilot’s Handbook, under the heading “Autopilot Engagement Criteria,” states that the two autopilot flight control computers are engaged with separate switches, each of which can be in one of three positions: mechanically latched in the OFF position, magnetically held in the control wheel steering (CWS) or in the command (CMD) position,49 or magnetically released from the CWS or the CMD position. According to Boeing’s 737 Pilot’s Handbook, manually overriding autopilot commands with the control wheel or control column does not disengage the autopilot but shifts autopilot control from CMD to CWS mode.50 Manual override can shift the autopilot from CMD to CWS in the pitch and roll axes separately or together, depending on the inputs made by the pilot. When the airplane is operating in the CWS mode and the pilot is not exerting force on the control column or control wheel, the 48 The FD provides command bar “pointers” on the attitude indicator display to guide pilots when hand flying the airplane. Note: Autothrottle is depicted as A/T, and autopilot is depicted as A/P. Figure 5. Boeing 737 MCP display. 49 With CWS engaged, the autopilot maneuvers the airplane in response to control pressure applied by either pilot. The control pressure is similar to that required for manual flight, and the use of CWS does not disengage the autopilot. With CMD engaged, the autopilot will control the airplane according to the mode selected via the Mode Selector Switches, which include Altitude Hold, Vertical Speed, Level Change, Vertical Navigation, VOR Localizer, Lateral Navigation, and Heading Select. 50 If both autopilots are engaged (that is, for a dual-channel autoland operation), the autopilots will not shift from CMD mode to CWS mode. N1 SPEED LVL C HG HDG SEL APP ALT HO LD V/S C O URSE A/T IA S/MAC H VNAV HEADING LNAV ALTITUDE VERT SPEED A/P ENG AG E C O URSE ARM O FF O FF O N F/D VO R LO C C MD C WS O FF DN UP O FF O N F/D 125 280 130 31700 0000 125

Factual Information 22 Aircraft Accident Report autopilot will attempt to maintain constant pitch and bank attitude or, under certain circumstances, to roll level and maintain the previously selected altitude. A magazine article published in Boeing’s October through December 1995 issue of Airliner, entitled “737 Directional Control System,” stated that when a “force of 10 pounds is applied to the yoke, the control wheel moves and the autopilot reverts into CWS [mode].” The article indicated that the autopilot would continue to function in the CWS mode until the CMD mode was reselected or the autopilot was disengaged. The article also stated the following:51 Normally in CWS, pilots use wheel input rates of 5 to 10 degrees per second. If the wheel is turned at a high rate (40 degrees per second, or more), then the force required to turn the wheel approximately triples. This happens because the autopilot actuators can not respond fast enough and are being forced by the pilot’s input. So, for a very quick wheel motion, the lateral control forces can noticeably increase, but the corresponding roll rate doesn’t. According to USAir’s 737-300/400 Pilot’s Handbook, the autopilot disengages under the following circumstances: • Pressing either [autopilot] disengage switch. • Pressing either TOGA switch with a single [autopilot] engaged in CWS or CMD below 2,000 feet RA [radio altitude]. • Pressing either TOGA switch after touchdown with both [autopilots] engaged in CMD. • Moving the [autopilot] engage switch to OFF. • Activating either pilot’s control wheel trim switch. • Moving the stabilizer trim autopilot cutout switch to CUTOUT. • Loss of respective hydraulic system pressure. • Either left or right IRS [inertial reference system] failure or FAULT light illuminated. • Loss of electrical power or a sensor input which prevents proper operation of the engaged [autopilot] and mode. Page 14-55-1 of USAir’s 737-300/400 Pilot’s Handbook describes the autopilot disengage switches, which are located on the outer grips of each control wheel. The handbook states that, if a pilot presses the autopilot disengage switch on either control wheel, the switch “disengages both [autopilots]. [Autopilot] disengage lights flash and [autopilot] disengage warning tone sounds for a minimum of 2 seconds. Second push extinguishes [autopilot] disengage lights and silences disengage warning tone.” 51 This description of control wheel forces was supported in a September 26, 1995, letter from Boeing’s Director of Air Safety Investigation to the Safety Board.

Factual Information 23 Aircraft Accident Report 1.6.3.2 Rudder Control System The 737-300 has a single rudder panel actuated by a single hydraulic rudder PCU. A standby rudder actuator is available to move the rudder if hydraulic systems A and/or B fail. According to a Safety Board review of large transport-category airplanes (including Boeing, McDonnell Douglas, Airbus, and Lockheed models), the 737 is the only twin wing-mounted engine, large transport-category airplane designed with a single rudder panel and single rudder actuator. All other large transport-category airplanes with twin wing-mounted engines were designed with a split rudder panel, multiple hydraulic actuators, or a mechanical/manual/trim tab rudder actuation system. Pilot control of the 737-300 rudder is transmitted in a closed-loop system from the pilots’ rudder pedals in the cockpit through a single cable system to the airplane’s tail section and then through linkages to the main rudder PCU and a standby rudder PCU in the aft portion of the vertical stabilizer. The rudder pedals at each pilot position are located on either side of the control column stem, which is protected within a housing (commonly termed the “doghouse” by 737 flight crews) that is located between each pilots’ lower legs at the pilot positions. Figures 6 and 6a show the 737 rudder system. Figure 6. Boeing 737 rudder system. Standby Rudder PCU Captain’s Rudder Pedals Switch and Indicator Rudder Control Cables Aft Torque Tube Feel and Centering Unit Left Rudder Motion Electric Rudder Trim Actuator Rudder Hinge Line Aft Rudder Power Control Unit Input Rod Rudder Main PCU

Factual Information 24 Aircraft Accident Report According to Boeing personnel, because of the engine placements on the wings, the 737 rudder has to be sufficiently powerful to effectively counter the effects of a loss of engine power on one side during a maximum gross weight takeoff at low airspeeds, especially in crosswind conditions. A loss of engine power on one side of the airplane would result in a large yawing moment, in the direction of the inoperative engine, produced by thrust from the operating engine. The loss of engine power can be countered Figure 6a. Detailed view of 737 aft rudder system controls and linkages. Upper Crank Standby Power Unit Input Rod Aft Torque Tube Center Crank Lower Crank (Bell Crank) Rudder Power Control Unit Input Rod Aft Rudder Control Quadrant Input Rod Trim and Feel Rod Cable RB Cable RA AFT Quadrant

Factual Information 25 Aircraft Accident Report by a rudder input in the opposite direction (for example, left pedal input to counter loss of power on the right engine).52 When properly installed and rigged, the 737-300 main rudder PCU can command a maximum deflection of 26° to the right and the left of the rudder’s neutral position (under no aerodynamic load conditions); the rudder can travel to those limits at a maximum rate of 66° per second. (The 737 main rudder PCU is capable of producing about 5,900 pounds of output force to move the rudder when both hydraulic systems are operating at their normal operating pressure—2,950 psi each.) The rudder pedals move about 1 inch (from their neutral position) for every 6.5° of rudder surface travel (under no aerodynamic load conditions) until the rudder pedals reach their maximum travel of about 4 inches (backward and forward) from the neutral position. The rudder pedal stops at the pilots’ forward rudder control quadrant are set to provide a mechanical stop at 28° of rudder travel (exceeding the rudder’s travel authority) because compliance in the cable system (cable stretch) may require rudder pedal travel beyond the 4-inch limit to achieve the full travel rudder movement of 26°. With the aerodynamic loads encountered in flight, the available amount of rudder surface travel is reduced. The maximum amount of rudder travel available for an airplane at a given flight condition/configuration is referred to as the rudder’s “blowdown” limit.53 The rudder feel and centering unit is attached to the aft rudder torque tube in the vertical fin, forward of the main rudder PCU (see figure 6). This unit holds the rudder at the neutral (or trimmed) position when no rudder pedal force is applied. It also provides a feedback force to the rudder pedals that increases as the rudder pedals are depressed. The pilot rudder pedal force required for full rudder deflection is about 70 pounds; however, the rudder trim system allows the pilots to maintain a rudder deflection without having to maintain a rudder pedal force. During normal and abnormal operations, the rudder can be moved beyond the movement commanded by the hydraulic actuator through a pilot’s application of force on the rudder pedals. (Normal operation of the rudder refers to the rudder’s motion, or lack thereof, resulting from normal PCU servo valve operation. Abnormal operation refers to the rudder’s motion that results from a PCU servo valve that is functioning abnormally, for example, because of a rudder jam and/or reversal.54 Both types of operation can include rudder movement within the range of the rudder authority on the ground and/or to the rudder’s in-flight blowdown limit.) 52 The rudders on airplanes with fuselage-mounted engines are typically less powerful than the rudders on airplanes with wing-mounted engines. The rudders for fuselage-mounted engine airplanes do not have to be designed to counter as significant an asymmetrical thrust effect in the event of a loss of power on one engine. Because the rudder on airplanes with fuselage-mounted engines is less powerful, the consequences of a rudder hardover are less serious; thus, the Safety Board’s investigation did not consider this type of airplane. 53 Rudder blowdown is the maximum rudder angle resulting from a pilot-commanded full rudder input under the existing flight conditions. It represents a balance between the aerodynamic forces acting on the rudder and the mechanical forces produced by the PCU. The maximum rudder angle can be increased beyond that produced by the hydraulic force if the pilot exerts sufficient force on the rudder pedals. 54 Rudder reversals are discussed in section 1.16.5.4.7.

Factual Information 26 Aircraft Accident Report During normal rudder operation, if a pilot applies a sufficiently rapid rudder pedal input (the rudder pedal must move faster than the PCU’s ability to respond to the input), the PCU input crank would contact the PCU external body stop (manifold stop), transmitting force from the rudder pedal input to the rudder surface through the main rudder PCU and the rudder system's linkages. Also, the additional force applied by the pilot would increase the rudder PCU output force, moving the rudder farther in the intended direction of travel. The rudder feel and centering unit would oppose the rudder pedal force (decrease the force applied by the pilot’s foot)55 with about 9 to 70 pounds of force, depending on how far the rudder is away from its centered position. During normal operation of the rudder in flight, if a pilot applied between 9 and 70 pounds of force to a rudder pedal, the rudder would move in response until it reached its blowdown limit (when the aerodynamic forces acting on the rudder surface equal the hydraulic actuator force). According to Boeing engineers, if the pilot were to then apply additional force to the rudder pedal, the pedal would move about 1 inch farther, with no corresponding movement of the rudder, as the slack in the rudder linkage system is removed and the external input crank contacts the external stop. Any additional pilot application of force to the rudder pedal would result in rudder pedal movement of about 1 inch for each 300 pounds of rudder pedal force, which in turn would move the rudder surface slightly beyond the maximum deflection possible from the hydraulic actuator force. During a servo valve jam/rudder reversal, the rudder pedal force from a pilot resisting the jam would cause the rudder to move in the direction opposite the jam (toward the rudder’s neutral position). The feel and centering unit would add to the rudder pedal force. As a pilot applied force to a rudder pedal in opposition to the jam/reversal, the first inch of movement of the pedal would cause the PCU input crank to move to the PCU manifold body stop. After the PCU input crank contacts the manifold body stop, approximately 300 additional pounds of pilot rudder pedal force would be required to move the rudder pedal each additional 1 inch of travel until the rudder pedal contacts the forward quadrant stops. Pilot rudder pedal force in opposition to a jammed/reversing rudder malfunction would reduce the deflection of the rudder. The 737 rudder trim system allows the pilots to command a steady rudder input without maintaining foot pressure on the rudder pedals. The primary purpose for rudder trim is to compensate for the sustained large yawing moments generated by asymmetric thrust in an engine-out situation. Pilots also sometimes use a small amount of rudder trim during normal flight to compensate for slight yawing moment asymmetries, such as those caused by flight control and engine rigging imperfections. To trim the rudder on the 737-300, -400, and -500, the pilot uses an electrical trim motor activated by the trim switch located on the flight deck center pedestal. The rudder trim switch activates an electric rudder trim actuator (located near the aft control torque tube in the vertical fin) that rotates the feel and centering unit, thus changing the neutral, or zero, position of the rudder.56 The 737-300 electric rudder trim moves the rudder at a rate of about 0.5° per 55 USAF ergonomic studies indicate that the maximum rudder pedal force pilots can exert on the rudder pedals is about 500 pounds. For additional information regarding pilot rudder pedal force, see sections 1.16.6 and 1.18.8.

Factual Information 27 Aircraft Accident Report second to the desired rudder trim deflection; maximum rudder trim authority is ± 16°. According to USAir’s 737-300 Pilot’s Handbook, when the rudder trim is used, the rudder pedals are displaced proportionately. The 737 yaw damper system improves ride comfort by sensing turbulence- or airplane-generated yaw motion and countering the yaw with rudder surface movement. The system is initially activated by the yaw damper switch on the overhead panel in the cockpit and is continuously engaged during normal operations; all inputs are automatic and require no pilot action. The yaw damper system comprises the yaw damper control switch and a yaw damper coupler, which includes a rate gyro that senses airplane motion about the yaw axis and converts the motion to an electrical signal that is sent to the main rudder PCU. An electrohydraulic servo valve (or transfer valve) converts the electrical signal from the yaw damper coupler to PCU motion by directing hydraulic fluid from hydraulic system B to move the rudder left or right. The yaw damper system also includes a cockpit indicator of yaw damper activity. In the 737-300 series, the yaw damper can command up to 3° of rudder surface deflection in either direction at a rate of 50° per second (when correctly assembled/ rigged).57 Rudder movements that result from yaw damper system inputs do not move the rudder pedals. Figure 7 shows the main rudder PCU. Figure 8 shows the main rudder PCU schematic and installation. Figure 9 depicts the rudder, rudder trim, and yaw damper authority limits. 56 To trim the rudder on the 737-100 and -200, the flight crew turns a knob on the flight deck center pedestal that is mechanically connected to the rudder trim actuator. 57 The 737-300 yaw damper was initially designed with ± 30° of rudder authority. The -100 and -200 series airplanes’ yaw dampers were designed to command either ± 2 or ± 4° of rudder authority. Boeing indicated that units permitting ± 2, 3, or 4° of rudder deflection may be used interchangeably on 737-100 and -200 series airplanes, and units permitting ± 2 or ± 3° of rudder deflection may be used interchangeably on 737s in the -300, -400, and -500 series. For information regarding rigging of the yaw damper linear variable displacement transducer (LVDT), see section 1.16.1.2. Figure 7. Boeing 737 main rudder PCU. Servo Control Valve Yaw Damper LVDT

Factual Information 28 Aircraft Accident Report Figure 8. Boeing 737 main rudder PCU schematic and installation. Primary Summing Lever Yaw Damper Actuator Com pensator Secondary Summing Lever Com pensator Spring Electrical Connector Yaw Damper Position Transm itter Transfer Valve Caging Spring Yaw Damper Shutoff Valve Primary Valve Secondary Valve Input Shaft Internal Input Crank Dual Concentric Servo Valve To Vertical Fin RA PA A System - Off B System - On To Rudder Tander Actuator Bypass Valve Power Unit Torque Tube System A Input Return System B Input Rudder Hinge Line External Summing Lever Input Crank (External) Forward

Factual Information 29 Aircraft Accident Report Figure 9. Boeing 737-300, -400 and -500 rudder, rudder trim, and yaw damper authority limits. Note: The maximum 737 rudder deflection that the yaw damper can command is only a small portion of the total rudder travel. Yaw damper limits of the 737-100 and -200 can be 2, 3, or 4°, depending upon the installation.

Factual Information 30 Aircraft Accident Report 1.6.3.2.1 Main Rudder PCU and Servo Valve The main rudder PCU is powered by hydraulic systems A and B, each of which provides about 3,000 pounds of output force to move the rudder, for a total output force of about 6,000 pounds. The main rudder PCU operates by converting either a mechanical input from the rudder pedals or an electrical signal from the yaw damper system into motion of the rudder by means of mechanical linkages (summing levers, input cranks, and shafts) and a servo valve that directs hydraulic fluid either to extend or retract the PCU actuator rod that moves the hinged rudder surface. The body of the main rudder PCU is attached to the airplane vertical fin structure, and the actuating rod is attached to the rudder. The PCU moves the rudder right or left when actuated by rudder pedal or trim input or signals from the yaw damper. Rudder pedal and trim input are transmitted to the PCU’s external input crank through an external summing lever and linkage. The external input crank is also moved by feedback from motion of the rudder, which comes from a mechanical system linkage (see figure 8). The input shaft rotates, actuating the internal summing levers and moving the primary and secondary slides of the servo valve. The 737 main PCU servo valve was designed by Boeing and is manufactured to Boeing specifications by Parker Hannifin Corporation. It is a dual-concentric tandem valve composed of a primary slide that moves within a secondary slide that, in turn, moves within the servo valve housing. The primary and secondary concentric slides are moved by primary and secondary internal summing levers, which translate inputs from the yaw damper58 and/or the external input crank (which moves when a pilot steps on the rudder pedals) into axial movement of the slides. Figure 10 shows an expanded view of the servo valve. When rudder motion is commanded (by the yaw damper, rudder pedal input, and/or rudder trim), the internal input shaft moves the servo valve slides through the internal summing levers to connects hydraulic pressure and return circuits from hydraulic systems A and B so that hydraulic pressure is ported to the appropriate sides of the dual-tandem actuator piston to extend or retract59 the main rudder PCU piston rod. At the same time, fluid is directed from the other side of the piston to the hydraulic return system. As the 58 When the yaw damper solenoid control valve is energized, 3,000 psi of hydraulic pressure is applied to the transfer valve, which proportionally converts electrical signals from the yaw damper coupler into hydraulic flow and control pressure. The control pressure moves the yaw damper actuator assembly piston (mod piston), which moves the pivot point of the internal summing levers. The internal summing levers move the primary and secondary slides of the servo valve from neutral, which causes movement of the pistons in the actuator assembly. Movement of the yaw damper actuator piston generates a balancing signal by the LVDT, which assists in returning the transfer valve to the neutral position. Feedback, provided through the external summing lever and linkage, returns the slides of the servo valve to near neutral, which maintains hydraulic pressure to hold the actuator position against the air load while not commanding further motion. 59 When the actuator moves in the extend direction, it commands left rudder; when it moves in the retract direction, it commands right rudder.

Factual Information 31 Aircraft Accident Report rudder reaches the commanded deflection, external linkages reposition the servo valve’s internal summing levers to nullify the initial command signal and arrest further motion. During normal operation, the primary summing lever applies force to move the primary slide, and the secondary summing lever applies force to move the secondary slide as needed. The primary slide is normally displaced first, and the secondary slide is displaced only when the primary slide does not provide enough hydraulic flow to keep up with the input commanded by the pilots or the yaw damper (that is, when the movement of only the primary slide is not sufficient to move the rudder at the commanded rate). The normal maximum axial movement from the neutral positions to the extreme travel positions in either the extend or retract directions is about 0.045 inch for both the primary and secondary slides, for a combined distance of about 0.090 inch. Both the primary and secondary slides are designed so that they can move about 0.018 inch axially beyond their normal operating range (overtravel capability). The two slides are designed to provide approximately equal flow. Thus, the primary slide alone can provide a rudder rate of about 33° per second, and the primary and secondary slides together can provide a rudder rate of about 66° per second (under zero aerodynamic load conditions). The outside diameter surfaces of the primary and secondary slides are composed of Nitralloy 135 that, in its prefinished form (slightly larger in diameter than its finished form), is nitrided60 to a depth from 0.005 to 0.008 inch to a surface hardness of 55 to 58 on Figure 10. Boeing 737 main rudder PCU servo valve. 60 Nitriding is a process in which the surface of the part is impregnated with nitrogen to increase hardness. Primary slide Secondary slide Servo valve housing

Factual Information 32 Aircraft Accident Report the Hardness Rockwell C (HRC) scale. The inside surfaces of the secondary slide and the servo valve housing are made of 52100 hardened steel (surface hardness 57 to 62 on the HRC scale). The outside diameter surfaces of the primary slide are very close to the inside diameter surfaces of the secondary slide, and the outside diameter surfaces of the secondary slide are very close to the inside diameter surfaces of the servo valve housing. In a March 18, 1999, letter, Parker advised the Safety Board that two engineering documents from 1966,61 which were produced during prototype testing of the servo valve, revealed that dimensional changes were made to the prototype because of conditions and performance results observed during the initial testing. According to the letter, a March 11, 1966, Parker engineering order modified certain dimensions in the servo valve slightly to “insure accumulated tolerances will not cause reverse flow.” Additionally, the letter stated that a December 9, 1966, Parker engineering order indicated that other modifications were made “to preclude bottoming of [the] secondary slide at the detent at the max[imum] tolerance stackup.” According to the letter, after the dimensional changes were incorporated into the prototype servo valve’s design, it passed the acceptance test procedure, and no further flow problems were noted. Parker personnel stated that no servo valves with the original prototype dimensions were provided to customers. The letter further stated, “as we can best determine, ‘reverse flow’ was used to refer to cross-flow or higher internal leakage in the servo valve than is desirable…but had nothing to do with reversal in the dual concentric servo valve” and indicated that “the reversal phenomenon in the servo valve…was first seen in the 1992 examination of the…United Airlines Boeing 737 rudder power control unit [which resulted from a July 16, 1992, anomaly found during a ground check, as discussed later in this section and in more detail in sections 1.16.1.1 and 1.18.1.1]—rudder or servo valve reversal was not an issue recognized at the time of the 1966 Engineering Orders.” Before 1989, the servo valve assembly engineering drawings did not specify diametrical clearances between the primary and secondary slides or between the secondary slide and servo valve housing. However, “shop travelers” (manufacturing documents that include instructions for specific tasks) used before 1989 indicated that the minimum and maximum clearances were 0.00010 and 0.00015 inch, respectively. On March 14, 1989, Parker released an engineering order that amended the servo valve assembly drawings to specify minimum and maximum diametrical clearances of 0.00015 and 0.00020 inch, respectively, between the outside diameter of the secondary slide and the inside diameter of the servo valve housing assembly and between the outside diameter of the primary slide and the inner diameter of the secondary slide assembly. According to Parker, the engineering drawing clearances normally allow the servo valve assembly to pass the functional testing that is part of the acceptance test procedure, and the servo valve components may then be individually polished based on functional test results to obtain the proper ease of movement. Because of the variability in dimensions of individual servo valve primary and secondary slides and the tight 61 These documents were located by Parker in response to requests made in the context of litigation resulting from the USAir flight 427 accident.

Factual Information 33 Aircraft Accident Report clearances required by the design, the servo valve components are assembled, installed, and maintained as matched sets. Before 1992, the acceptance test procedure for the servo valve assembly was based on compliance with performance standards. (According to Parker, each valve was to be “trimmed”62 until the desired functional performance was obtained.) Actual travel (or overtravel) capability of the primary and secondary slides had not been measured. In 1992, as a result of findings from the main rudder PCU anomaly found during a July 1992 United Airlines ground check, Boeing established maximum axial distances between metering edges for both the primary and secondary slides, and Parker instituted a functional test. In addition, the FAA issued AD 94-01-07, effective March 3, 1994, which required operators to test 737 main rudder PCUs at 750-hour intervals for internal hydraulic fluid leakage until they are replaced with new PCUs containing servo valves designed to prevent secondary slide overtravel. (For additional information regarding this part of AD 94-01-07, see section 1.18.5 and appendix C.) In addition to the functional testing performed on each individual main rudder PCU servo valve, one valve was subjected to qualification testing at the time of the 737’s initial certification.63 The purpose of this qualification testing was to ensure that the servo valve would be able to withstand the operational and environmental stresses expected during its life. 1.7 Meteorological Information The official PIT hourly weather observation taken at 1852 stated: sky condition—clear, visibility—5 miles, temperature—73o Fahrenheit (F), dew point—1o F, wind—250o at 7 knots, altimeter setting—30.10 inches Hg [mercury], remarks—few cumulus cirrus. A PIT special weather observation taken at 1932 stated: sky condition—clear, visibility—15 miles, wind—240° at 6 knots, altimeter setting— 30.10 inches Hg; remarks—few cumulus cirrus. The PIT hourly weather observation taken at 1952 stated: sky condition—clear, visibility—15 miles, temperature—69° F, dew point—54° F, wind—240° at 5 knots, altimeter setting—30.10 inches Hg. 62 Trimming is the machine grinding of the outside diameter/groove interface that forms the metering edges for the primary and secondary slides. Trimming moves the metering edges to new longitudinal positions to better align the metering edges with the metering ports to meet functional test requirements. 63 The qualification testing involved functional and environmental testing (including pressure, vibration, and thermal testing) under conditions that replicated assumed operating conditions (based on Boeing’s analyses). The redesigned servo valve being retrofitted on earlier 737 series airplanes and installed on the 737-NG series airplanes (see section 1.18.5) also underwent qualification testing, and those tests included conditions that exceeded the assumed operating conditions (including thermal conditions that simulated an overheated hydraulic system) to evaluate the component’s functional limits.

Factual Information 34 Aircraft Accident Report The PIT Weather Service Forecast Office (WSFO) is located about 2 miles north- northwest of PIT and about 6 miles southeast of the accident site. A Weather Surveillance Radar-88 Doppler (WSR-88D) is installed at that location. (At the time of the accident, the WSR-88D was operational but had not been officially commissioned.) The WSR-88D base reflectivity products64 provided to the WSFO for the times of 1859 and 1905 indicated random radar returns in the PIT area. According to PIT WSFO personnel, those returns were consistent with the local ground clutter pattern around the radar. No primary radar returns were noted in the vicinity of the accident airplane. Some witnesses reported that they observed large flocks of migrating birds and geese in the area the afternoon and evening before the accident. However, radar data revealed no evidence of such activity in the vicinity of the accident site at the time of the accident. According to measurements transmitted by a radiosonde balloon65 launched by the PIT WSFO at 1914, the winds near 6,000 feet msl were from 274° at 15 knots, and the temperature at that altitude was about 47° F. The wind gust recorder at PIT indicated that wind speeds at the surface varied from 6 to 8 knots between 1840 to 1940. (Wind directions were not recorded by the wind gust recorder.) According to sunrise and sunset tables, on September 8, 1994, at 1903 at the accident location, the altitude of the sun above the horizon was approximately 7.9°. The magnetic bearing from the accident location to the sun was about 278.7°. Sunset at 6,000 feet occurred about 1949. During postaccident interviews, witnesses on the ground reported that the weather was clear and sunny at the time of the accident, and the winds were calm near the accident site. Pilots of other airplanes that were operating in the vicinity of PIT about the time of the accident were also interviewed. They reported that the sky was clear with unlimited visibility and that the air was smooth with light winds and no turbulence. The captain of Delta flight 1083, which was sequenced ahead of the accident flight on the approach, stated that the horizon was clearly defined and that visibility was not restricted. 1.8 Aids to Navigation No difficulties with the navigational aids were known or reported. 1.9 Communications No difficulties with communications were known or reported. 64 Base reflectivity products display weather echo intensity and are used to detect precipitation. 65 A radiosonde balloon is an instrument used for the simultaneous measurement and transmission of meteorological data. The PIT WSFO launches two radiosonde balloons about 0700 and 1900 every day.

Factual Information 35 Aircraft Accident Report 1.10 Airport Information PIT is located 15 miles northwest of the city of Pittsburgh. The airport elevation is 1,203 feet. The airport has four runways. Flight 427 was scheduled to land on runway 28R, which is 10,502 feet long and 150 feet wide. No significant Notices to Airmen were in effect for PIT during the time period in which USAir flight 427 was estimated to arrive. 1.11 Flight Recorders The two flight recorders installed on the accident airplane were removed from the wreckage and sent to the Safety Board’s laboratory in Washington, D.C., for readout. 1.11.1 Cockpit Voice Recorder The CVR installed on the accident airplane was a Fairchild model A-100A.66 The CVR recording consisted of four channels of audio information: the cockpit area microphone (CAM), the captain position, the first officer position, and the jumpseat/ observer position.67 Although the CVR unit showed evidence of external and internal structural damage, the recording medium (magnetic tape) was in good condition, and the quality of the recording was excellent.68 A transcript was prepared of the entire 30-minute 56-second recording. A copy of the CVR transcript appears in appendix B. 1.11.2 Flight Data Recorder The FDR was a Loral/Fairchild Data Systems model F1000 (S/N 442), which recorded 13 parameters69 of airplane flight information using solid-state nonvolatile flash memory as the recording medium. Although the FDR exhibited external and internal impact damage, the crash-protected memory module unit and recording medium were 66 The CVR identification plate and S/N were missing; however, USAir maintenance records indicate that the CVR on the accident airplane was S/N 5061. 67 The audio obtained from the jumpseat/observer channel was of a lower intensity and sounded more “hollow” than that obtained from the CAM. Further investigation revealed that similar audio information was obtained in a 737 airplane in which the microphone selector switch at the jumpseat/observer position was left in the oxygen mask position and the oxygen mask was stowed correctly in its formed plastic sleeve. 68 The Safety Board uses the following categories to classify the levels of CVR recording quality: excellent, good, fair, poor, and unusable. An excellent recording is one in which virtually all of the crew conversations can be accurately and easily understood. The transcript that is developed from the recording may indicate only one or two words that were not intelligible, usually because of simultaneous cockpit/radio transmissions that obscured each other. 69 Title 14 CFR Section 121.343 required that, by May 26, 1995, large airplanes type certificated before October 1, 1969 (which included the accident airplane), be equipped with FDRs that record 11 parameters. The regulations also required that airplanes type certificated after October 1, 1969, and airplanes manufactured after May 26, 1989, be equipped with FDRs that record 17 parameters. Additionally, the regulations required that airplanes manufactured after October 11, 1991, be equipped with FDRs that record 31 parameters. Even though the accident airplane’s FDR recorded 13 parameters, it has often been referred to as an 11-parameter recorder because it was not required by 14 CFR Section 121.343 to record the engine EGT and fuel flow parameters.

Factual Information 36 Aircraft Accident Report intact and yielded good data. Recorded parameters that were sampled at once-per-second intervals were altitude, indicated airspeed, heading, microphone keying, exhaust gas temperature (EGT, both engines), fuel flow (both engines), compressor speed (N2, measured as a percentage, for both engines), and fan speed (N1, measured as a percentage, for both engines). Recorded parameters that were sampled at more frequent rates were roll attitude and control column position (two times per second), pitch attitude and longitudinal acceleration (four times per second), and vertical acceleration (eight times per second). The FDR did not record data regarding the flight control surface positions, and Federal regulations (14 CFR Section 121.343) did not include a requirement to record such data. (See section 1.18.11.4 for information about Safety Board recommendations regarding FDRs.) 1.12 Wreckage and Impact Information 1.12.1 On-Site Examination The on-site phase of the investigation, including examination, documentation, decontamination, and recovery of the wreckage, occurred between September 9 and September 20, 1994. The accident airplane’s primary impact point was in a densely wooded area on an up-sloping hillside on the south side of a dirt road that was oriented southwest/northeast and accessed three houses. The airplane wreckage was severely fragmented, crushed, and burned, and some sections had been destroyed or nearly destroyed by fire. Because some portions of the wreckage were not visible above the ground, investigative personnel used ground-penetrating radar (GPR) to locate and recover additional pieces of the wreckage. (See section 1.19 for details about the use of GPR.) Some pieces of wreckage were excavated from the hillside at depths of up to 8 feet. Most of the airplane wreckage, including all flight controls and major components, was located within a 350-foot radius of the main impact crater. The left wing and the No. 1 engine, which were located south of the access road and east of the main impact crater, exhibited severe impact and postimpact fire damage. The No. 1 engine was separated from the left wing and partially covered by burned left wing skin and spar materials. A ground scar, about 25 feet in length, extended in an easterly direction from the No. 1 engine and left wing wreckage on an up-sloping hill. The outboard end of the ground scar contained several small pieces of red glass, and portions of the left wing tip were located nearby. Trees located near the ground scar and the left wing had broken limbs and branches. The right wing, which was located along the northern edge of the access road about 40 feet west of the main impact crater, also exhibited severe impact damage. The No. 2 engine was separated from the right wing and located along the northern edge of the access road about 30 feet west of the main impact crater. Sections of the right wing were found on the north side of the access road and the adjacent hillside, and the inboard section

Factual Information 37 Aircraft Accident Report of the wing was facing in the northeast direction. The remaining leading edges of both wings were crushed in an aft and up direction. Examination of the spoiler control surfaces and actuators revealed that the four wing spoilers were located in the retracted position at impact with no evidence of preimpact failure. Examination of the Krueger (leading edge) flaps and leading edge slats indicated that they were extended symmetrically at impact with no evidence of preimpact failure of the flaps; slats; and their attachments, rollers, or tracks.70 The trailing edge flaps were in a partially extended symmetrical position. Jackscrew and hydraulic actuator measurements indicated that the leading and trailing edge devices were positioned consistent with a flaps 1 setting. The trailing edge flaps exhibited compression damage and postimpact fire damage. No evidence was found of structural fatigue or preimpact fire on the trailing edge flaps or flap tracks. The wing spoilers were fractured and exhibited fire damage. The landing gear were found in the retracted position. Both engines were found fragmented, burned, and separated from their respective pylons. The pylons, nacelles, and thrust reverser components from both engines were fragmented and scattered around the impact crater. Examination of the engines, nacelles, and pylons revealed damage that was consistent with engine low- and high- pressure rotors rotating at impact.71 Fragments of engine thrust reverser components (including the cascades, hinges, latches, cowls, and bulkhead) and the 12 thrust reverser actuators72 were located, identified, and examined. All thrust reverser components exhibited damage consistent with ground impact and exposure to heat. Examination of the thrust reverser actuators indicated that the left engine thrust reverser locking actuators were in the stowed position at impact; however, the right engine thrust reverser locking actuators were discovered in the extended position. (Three of the four left engine nonlocking thrust reverser actuators and all four right engine nonlocking thrust reverser actuators were in the stowed position.) The four locking thrust reverser actuators were removed from the main wreckage for further inspection and disassembly. Subsequent x-ray inspection and disassembly of the four thrust reverser locking actuators indicated that all four locking actuator pistons were in the stowed position, with locking keys engaged, at impact. The airplane’s tail section was located in an inverted position near the north edge of the access road, about 20 feet west of the left wing. The horizontal stabilizers and elevators remained attached to the tail section. The outboard trailing edge of the right 70 Because of unusual damage observed on the inboard hinge of the No. 1 slat, the Safety Board conducted ultraviolet light and metallurgical inspections of components of the slat track. For additional information regarding these inspections, see section 1.12.3. 71 FDR data indicated that the engines were operating normally and symmetrically until ground impact. However, the CVR and physical evidence indicated that the auxiliary power unit (APU) was not operating up to ground impact. 72 Six thrust reverser actuators, two locking and four nonlocking, were located on each of the two engines. The locking actuators are designed to prevent thrust reverser deployment without the application of hydraulic pressure.

Factual Information 38 Aircraft Accident Report horizontal stabilizer and the right elevator exhibited heat, smoke, and soot damage patterns consistent with postimpact fire. The outboard 5 feet of the leading edge of the left horizontal stabilizer was destroyed. The inboard 7 feet of the left horizontal stabilizer, adjacent to the auxiliary power unit (APU) access door, was crushed 5 feet in the aft direction, exposing the internal spars and ribs. Both elevators were attached at their respective horizontal stabilizers, and flight control continuity was established within the tail section. The elevator tab rods were connected and operated properly (that is, elevator "up"/tab "down," and vice versa). Both elevator balance weights were attached, and the elevator neutral shift rods were attached to the stabilizer and the elevator centering unit. The elevators were positioned about 14° trailing edge up, and the horizontal stabilizer was in an intermediate position. The vertical stabilizer and rudder were located adjacent to the tail section. The vertical stabilizer was resting on its left side with the lower portion of the vertical fin adjacent to the horizontal stabilizer. The leading edge of the vertical stabilizer skin was destroyed, and the exposed vertical webs were crushed in the upward and aft direction. The vertical stabilizer aft of the rear spar sustained fire damage, and an 11- by 4-foot area, about 6½ feet from the base of the vertical stabilizer, was consumed by fire. The rudder had a 10-foot, 3-inch area, about 6½ feet from the base of the rudder hinge, of burned and missing structure. A bend in the PCU actuator rod was consistent with a rudder position of about 2° to the right (airplane nose right). The cockpit, which was found approximately 45 feet south of the main impact crater, was severely fragmented. The identified sections of the cockpit and the forward portion of the fuselage exhibited compression damage, deformation along the airplane's longitudinal axis, and some postimpact fire damage. Although sections of the seat tracks for both pilots were identified, it was not possible to determine either seat position at impact.73 The left rudder pedal shafts were sheared at both pilot positions; both right rudder pedals exhibited bending but were not sheared.74 Cockpit instrumentation and switches that were identified included a radio magnetic indicator, two airspeed indicator digital displays, the autopilot MCP, ground proximity warning system (GPWS) switch, and an FD switch. The radio magnetic indicator showed 212°, the airspeed displays indicated 264 knots, and the GPWS and FD switches were in the “on” position; damage to the autopilot MCP precluded a determination of the preimpact mode selections. A ground and helicopter search for additional airplane components was conducted during the on-site phase of the investigation, but no additional components were found. Several light-weight items (for example, pieces of interior insulation and a passenger business card) were discovered as far as 2½ miles east-northeast of the main wreckage; these items exhibited soot and smoke damage. One witness stated that he heard the sound of the crash while he was playing golf about 2 miles east-northeast of the accident site; about 2 minutes later, he observed blackened insulation falling onto the golf course. The insulation, business card, and sections of the airplane’s cargo liner were sent to 73 Pilot seat position is discussed further in section 1.18.8. 74 The rudder pedal assemblies were retained for further examination, as described in section 1.16.5.1.

Factual Information 39 Aircraft Accident Report Safety Board and Federal Bureau of Investigation (FBI) laboratories for examination, which revealed no evidence of explosive residue. Before removal from the accident site, the wreckage was thoroughly examined, components were identified and photographed, and critical measurements were recorded. Also, fire and explosives experts examined pieces of the wreckage for evidence of preimpact fire and/or explosion, and no such evidence was found. After the airplane wreckage was documented and decontaminated, it was relocated from the accident site to a hangar facility at PIT for further examination and a two-dimensional reconstruction. Except for certain components and control cables that were retained for further examination,75 the airplane wreckage was released to USAir on April 3, 1995. 1.12.2 Reconstruction Examination Between October 30 and November 11, 1994, the Safety Board conducted a two- dimensional reconstruction of the wings and the fuselage, including the forward pressure bulkhead, floor beams, wheels and tires, wheel wells, auxiliary fuel tank, and roll control cables. The reconstruction was accomplished to determine whether a control cable failure, bird (or other airborne object) strike, floor beam failure, or in-flight explosion were involved in the accident. Because of its experience in reconstructing the Boeing 747 airplane involved in the Pan American World Airways flight 103 in-flight explosion and crash that occurred near Lockerbie, Scotland,76 the Air Accidents Investigation Branch (AAIB) of Farnborough, England, was asked to and did participate in the effort to reconstruct the USAir flight 427 accident airplane. The AAIB representatives stated that the destruction and fire damage (which they considered “extreme for that associated with civil aircraft accidents”) complicated efforts to identify components and reconstruct the airplane. Despite the complications, the AAIB found no evidence of any preimpact explosion. The wreckage was further examined by explosion experts from the FAA and the FBI, and they also found no evidence of any preimpact explosion. With the use of Boeing drawings, Safety Board investigators identified pieces of the fuselage and wings, and the pieces were positioned on the hangar floor according to their structural station locations. Numerous pieces of the lower forward fuselage and sections of the wing were too small, fragmented, or severely damaged by postimpact fire to be identified. The lateral and longitudinal floor beam structures were severely fragmented. The amount of identifiable lateral floor beam structure varied at each fuselage station, with a minimum of 5 percent identified forward of the center wing section and a maximum of about 95 percent identified at the rear galley/lavatory. Overall, about 50 percent of the floor beams (lateral and longitudinal, forward and aft) were recovered and identified for use in the reconstruction. 75 For additional information on the retained items, see section 1.12.2.1. 76 See Air Accidents Investigation Branch. 1990. “Report on the accident to Boeing 747-121, N739PA, at Lockerbie, Dumfriesshire, Scotland on 21 December 1988.” Aircraft Accident Report 2/90.

Factual Information 40 Aircraft Accident Report No sections of the forward galley or the forward lavatory floor structure were identified. The aft galley floor panel was charred, and the attached seat tracks exhibited fire and heat damage; however, the floor beams that supported the aft galley exhibited no signs of fire or heat damage. The floor of the lavatory in the aft cabin was charred, and the attached forward and aft floor beams displayed evidence of peeled paint and sooting. The identifiable sections of passenger cabin and cockpit structure exhibited no evidence of streaking or burns that would be consistent with preimpact fire or explosion. No evidence of streaking or burned/sooted structure was found on the interior or exterior surfaces of cabin and cockpit materials. Portions of all of the doors and their respective frames were identified and documented. These doors included the forward entry, forward service, aft entry, aft galley service, forward cargo, rear cargo, lower nose compartment access, electrical/electronic compartment (E/E bay), overwing emergency exit, and APU service doors. The majority of structure identified in the forward fuselage was located near the fuselage doorways. The doors forward of the wing were the most severely fragmented. The examination of the remains of the doors, door frames, and locking mechanisms revealed witness marks and other evidence that was consistent with all of the doors being in the closed position at impact. The wing center section and the main landing gear wheel wells were severely fragmented and exhibited minimal fire damage. Approximately 60 percent of the center section wing structure was positively identified. Examination of the reconstruction confirmed that the landing gear were in the retracted position at impact. No evidence of preimpact failures or fire in the wheel wells before impact was found. The examination of the tires and wheels revealed no evidence of a tire explosion or fire damage before impact. 1.12.2.1 Flight Control System Components During the wreckage reconstruction, flight control system components were examined and separated by location and system function. The following flight control system items were removed from the wreckage for further examination: the main rudder PCU, standby rudder PCU, rudder trim actuator, rudder feel and centering unit, aileron PCUs, spoiler mixer and ratio changer, flight and ground spoiler actuators, slat control valve, autopilot servos, various autopilot electrical relays, both pilots’ rudder pedal and control yoke systems, and most of the control cables. In addition, hydraulic fluid samples were obtained from various locations in the accident airplane’s hydraulic systems for laboratory evaluation and analysis. (See section 1.16.5.4.3 for further information.) The aft rudder control quadrant was found attached to its mounting bracket and separated from the vertical stabilizer. The aft rudder control quadrant input rod, the main rudder PCU input rod, and the lower end of the rudder torque tube (see figures 6 and 6a) were fractured, and the cable attach points were separated from the quadrant on each end. The upper portion of the tower shaft was located at the vertical fin with the main and standby rudder PCUs attached. The input rod for the standby PCU remained attached with no signs of damage or binding.

Factual Information 41 Aircraft Accident Report The broken ends of all identified flight control cables, and several unidentified cable sections, were inspected at 10-power magnification to determine their mode of failure. The examination revealed no evidence of preimpact cable failure. Measurements of the broken aileron cable sections and pulley positions indicated a right control wheel input at impact. Safety Board investigators identified about 60 percent of the rudder control cable length for the right-side cable and about 20 percent of the rudder control cable length for the left-side cable. Both right- and left-side cables were kinked about every 20 inches (the approximate distance between floor beam locations), and both cables exhibited multiple breaks at the turnbuckle locations. Some recovered and identified cables were sent to the Safety Board materials laboratory for metallurgical examination, which revealed that the cable breaks resulted from tensile overload. No evidence of preimpact failure of the rudder cables was found. 1.12.2.2 Examination/Reconstruction of Cargo Compartments Identified sections of the forward and aft cargo compartments were examined for evidence of preimpact fire or explosion. One section of aluminum flooring from the forward cargo compartment exhibited sooting on the lower side, but no evidence of fire, heat, or soot damage was found on the upper (inner) floor surface. Neither of the two cargo compartment pressure relief/emergency access panels (which form a section of the cargo compartment ceiling liner in the forward and aft compartments) displayed fire damage on either side. No evidence of fire damage or soot was found on either the aft cargo door or the recovered pieces of the forward cargo door. In addition, the forward outflow valve showed no evidence of soot deposits. Pieces of cargo compartment liner exhibited evidence of smoke and fire damage that was consistent with a postimpact fire. 1.12.2.3 Examination/Reconstruction of the Auxiliary Fuel Tank Safety Board investigators examined the recovered pieces of the auxiliary fuel tank system for evidence of preimpact fire, explosion, corrosion, or structural failure. Investigators identified about 85 percent of the auxiliary tank fuel control valve box components and fuel transfer/vent hoses and fittings, about 50 percent of the electrical control box components, and about 40 percent of the auxiliary fuel tank structure. The identified sections of the auxiliary fuel tank included portions of the upper panel (including a 5-inch portion of the forward upper seam), the center and lower portions of the forward panel, center and lower portions of the aft panel, side angle panels, and sump drain doubler from the lower panel. The compression beams located at the aft pressure bulkhead were the only pieces of auxiliary fuel tank support structure that were identified. Although a small section of the forward tank panel displayed fire damage, identified mating sections of the tank structure contained no evidence of heat or fire damage. Further examination of the auxiliary fuel tank panels and support structure revealed no additional evidence of heat or fire damage. The auxiliary fuel tank components (valves, screens, filters, and motors) did not exhibit any abnormal characteristics, and the auxiliary fuel tank valve positions were

Factual Information 42 Aircraft Accident Report consistent with a deactivated fuel tank.77 The auxiliary fuel tank pressure relief valve was found intact. Postaccident pressure and leak tests revealed that the relief valve opened at 9 psi; the valve is designed to open at 10 ± 1 psi. The bleed air filter exhibited no evidence of internal or external contamination and no odor of fuel. Examination of the identified fuel lines and hoses revealed varying amounts of heat and fire damage. For example, the portion of steel braid-covered fuel hose that extended forward from the auxiliary fuel tank to the bulkhead at body station 727 showed no evidence of heat or fire damage. However, the steel braid-covered fuel hose that extended forward from the body station 727 bulkhead to the wing center section exhibited severe heat and fire damage; only the end fittings and steel braid remained intact. One portion of the wing center section structure, installed 4 feet away from the charred portion, exhibited severe charring; however, the center section structure exhibited no evidence of heat or fire damage. The fuel hose assembly contained in the airplane’s center fuel tank exhibited heat exposure and burned hose rubber; however, the crossfeed line (external to the center fuel tank) was not charred. 1.12.3 Examination of Wreckage for Indications of Possible Bird Strike Because of witness reports that large flocks of migratory birds were observed in the Pittsburgh area throughout the afternoon and evening of the accident,78 the Safety Board examined the wreckage for indications of a possible bird strike. Ultraviolet light, a method commonly used for detecting blood,79 was used to examine several pieces of the radome, portions of the forward pressure bulkhead, left wing slats, cockpit flight control components, and leading edges of the vertical and horizontal stabilizers for bird remains. Although no evidence of bird stains, remains, or other organic matter was found on most of the examined areas, investigators noted a small (10- by 5-inch chordwise) stain on the outer surface of the outboard No. 1 slat. A 3- by 5-inch section of the stain, located in the upper external portion aft of the leading edge of the slat and oriented in a spanwise direction, exhibited a more intense white fluorescence when illuminated by ultraviolet light. The stained area was adjacent to fractured segments of the No. 1 outboard slat track. Two small samples of the fluorescent debris were removed from the slat surface and the adjacent interior slat cavity. The samples were examined by an ornithologist at the 77 According to USAir’s maintenance procedures, after auxiliary fuel tank deactivation, the fuel transfer valve and the fuel fill valve should be in the closed position, with the fuel fill valve circuit breaker in the cockpit pulled and collared to ensure that the valve remains closed (unless intentionally reactivated). The auxiliary fuel tank bleed air circuit breaker (which controls the bleed air solenoid valve) is also pulled during the deactivation process. The fuel fill valve and auxiliary fuel tank bleed air circuit breakers were not located in the wreckage. 78 No such observations were reported in official weather observations, by pilots of other airplanes in the area, or in WSR-88D data. 79 According to an Armed Forces Institute of Pathology (AFIP) laboratory report on its examination of a portion of the accident airplane’s left wing, biological material can fluoresce when viewed under an ultraviolet light of the appropriate wavelength.

Factual Information 43 Aircraft Accident Report Smithsonian Institution’s Associate Division of Birds, who determined that the debris exhibited no characteristics that resembled those of a bird. The outboard No. 1 slat was also examined by specialists from the Armed Forces Institute of Pathology (AFIP). According to the AFIP laboratory report, the pieces of debris were inspected using an Omnichrome Alternate Light Source unit (all wavelength spectrums and all optical filters), a Luminol solution, and Leucomalachite Green solution. The AFIP report stated that none of the inspection techniques revealed any luminescence that would indicate the presence of blood or blood-like material on the debris pieces but that “several type of fibers, minerals and other fuel and petroleum products were present in the samples collected [on scene].” The report concluded that the samples examined contained “no blood or blood-like products.” The fractured segments of the No. 1 outboard slat track that were adjacent to the stained area of the No. 1 slat were removed from the wreckage and transported to the Safety Board’s materials laboratory for metallurgical examination. The metallurgist’s report of the examination stated that the aileron hinge bracket “was grossly distorted and separated approximately at a roller position. Visual examination of the separated arm revealed features typical of an overstress separation. No evidence of preexisting fracture areas was noted.” 1.13 Medical and Pathological Information Toxicological samples (muscle tissue) from both pilots were sent to the FAA’s Civil Aeromedical Institute (CAMI) in Oklahoma City, Oklahoma, for examination. Although ethanol was detected in muscle tissue samples from both the captain (34 mg/dl, or 0.034 percent weight/volume—also known as blood alcohol content) and first officer (54 mg/dl, or 0.054 percent blood alcohol content), the toxicological reports stated that “the delay in the collection and the analysis of specimens may have resulted in postmortem ethanol production.” The pilots’ toxicological results were negative for all drugs of abuse and prescription as well as over-the-counter medications. 1.14 Fire An intense postimpact fire melted localized sections of the airplane structure and scorched nearby trees and the ground surrounding the crash site. Fire-fighting personnel and equipment from Hopewell Township and Beaver and Allegheny Counties, Pennsylvania, arrived at the accident site within minutes of the crash, and firefighters began efforts to extinguish the fire immediately after arriving on the scene. The fire burned for approximately 5 hours before it was extinguished but continued to smolder for several days.

Factual Information 44 Aircraft Accident Report 1.15 Survival Aspects Because the airplane was destroyed and no occupiable space remained intact, the accident was not survivable. The Beaver County Coroner’s Office investigative report stated that all airplane occupants were killed as a result of “blunt force impact trauma.” The emergency response by Hopewell Township, Beaver County, and Allegheny County authorities was initiated after they received telephone calls informing them of the accident. The authorities began to arrive at the accident site within minutes after the crash. 1.16 Tests and Research 1.16.1 Background Information—Other Significant Yaw/Roll Events Because of early indications that the initial upset of USAir flight 427 might have been caused by an unintended or uncommanded rudder movement, which was considered (but not established as a cause or factor) in connection with the 1991 crash of a 737 at Colorado Springs, Colorado (United Airlines flight 585),80 the Safety Board reviewed all of the information collected for the investigation of that accident during the investigation of the USAir flight 427 accident.81 In addition, the Safety Board investigated a 1996 yaw/roll incident involving a 737 near Richmond, Virginia (Eastwind flight 517), to determine if the upset event may have been related to an anomalous rudder movement. Because much of the testing and research that was done in connection with the USAir flight 427 investigation also incorporated information or examined components from the United accident and Eastwind incident,82 factual information from these two events is presented in the next two subsections. 1.16.1.1 United Airlines Flight 585 Accident On March 3, 1991, United Airlines flight 585, a 737-291, N999UA, was rolling out of a right turn to the north on the final approach for runway 35 at Colorado Springs Municipal Airport in Colorado Springs, Colorado, when it suddenly yawed and then rolled to the right, pitched nose down, and crashed short of the runway. The airplane impacted 80 See National Transportation Safety Board. 1992. United Airlines Flight 585, Boeing 737-291, N999UA, Uncontrolled Collision With Terrain for Undetermined Reasons, 4 Miles South of Colorado Springs Municipal Airport, Colorado Springs, Colorado, March 3, 1991. Aircraft Accident Report NTSB/AAR-92/06. Washington, DC. 81 In addition, one of the recommendations in the FAA’s 1995 Critical Design Review (CDR) report was that the Safety Board begin a combined investigation of the United flight 585 and USAir flight 427 accidents. (See section 1.18.4 for more information on the CDR team and its report.) 82 For more information, see, for example, section 1.16.3.1 (Eastwind Flight 517 Flight Tests), section 1.16.6 (Flight Performance Simulation Studies), section 1.16.5.4 (Detailed Examinations and Tests of Main Rudder PCUs), and section 1.16.7.4.1 (Comparison of Engine Sound Signatures From United Flight 585 CVR and CVR from 737-200 Flight Tests).

Factual Information 45 Aircraft Accident Report the ground about 0943:42.83 All 25 people aboard the airplane were killed, and the airplane was destroyed by impact forces and postcrash fire. When the accident sequence began (CVR and FDR evidence indicated that the upset began about 0943:32), the airplane was operating at 160 knots with flaps extended to 30° and the landing gear extended. CVR and meteorological information indicated that the pilots of United flight 585 were conducting a visual approach to the runway in moderate- to-severe turbulence and gusty wind conditions; low-level windshear was reported. The United flight 585 CVR indicated that, as the pilots prepared for the approach to the destination airport, they discussed the strong gusty winds and windshear conditions they expected to encounter during the approach, airspeed adjustments to compensate for those conditions, and missed approach procedures. The captain was performing the PF duties, and the first officer was performing PNF duties. About 0938:14, the first officer requested information from ATC regarding pilot reports concerning loss or gain of airspeed. About 0939:26, when the airplane was on a southerly heading and had just passed abeam (and to the east) of the end of runway 35, the CVR recorded the captain saying “…we’re not gonna be in a rush…we want to stabilize it out here….” The first officer responded, “yeah, I feel the same way.” About 0940:44, while the first officer was busy completing a checklist, the captain requested additional information from ATC regarding traffic. The pilots began a series of right turns toward the (northbound) final approach. They incrementally extended flaps, extended the landing gear, and accomplished the final descent checklist. Figure 11 shows a plot of United flight 585’s ground track based on FDR and radar data. As the pilots began to align the airplane with the final approach course, the airplane was experiencing airspeed changes (± 10 knots) and rapid heading changes.84 About 0942:29, 0942:31, and 0943:01, the CVR recorded the flight crew stating information related to uncommanded airspeed changes. According to the CVR, the first officer said “wow” about 0943:08 and “we’re at a thousand feet” at 0943:28.2. At 0943:32.6, the CVR recorded the first officer exclaiming “oh god;” less than 1 second later (at 0943:33.5), the captain stated “fifteen flaps,” and the first officer responded “fifteen.” The CVR sound spectrum study indicated that the sounds before impact were consistent with both engines accelerating.85 FDR data indicated that United flight 585 began a sharp heading change to the right and a sudden descent about the time the captain called for “fifteen flaps.” The CVR recorded the first officer stating “oh” at 0943:34.4 and the captain exclaiming “oh” loudly at 0943:34.7. One second later, the first officer and the captain each stated “[expletive]” 83 All times in this subsection are mountain standard time, based on a 24-hour clock. The CVR time equals FDR time in seconds plus 0941:55 (local mountain standard time). 84 The FDR installed on United flight 585, a Fairchild Digital Flight Recorder Model F800 (S/N 4016), directly recorded five parameters. Altitude, indicated airspeed, magnetic heading, and microphone keying versus time were recorded at once per second, and vertical acceleration was recorded eight times per second. The Safety Board conducted simulation studies to derive additional flight-related information from the FDR and radar data (see section 1.16.6).

Factual Information 46 Aircraft Accident Report (at 0943:35.4 and 0943:35.7, respectively). At 0943:36.5, the CVR recorded the captain stating “no” very loudly and, about 1 second later, the first officer and the captain stating “oh, [expletive]” (at 0943:37.5 and 0943:38.2, respectively). The CVR recorded the first officer stating “oh, my god…oh, my god….” beginning at 0943:38.4, the captain stating “oh, no, [expletive]” beginning at 0943:40.5, and the sound of impact just before the CVR recording ended at 0943:41.5. The accident airplane’s maintenance history included two rudder-related pilot writeups during the week before the accident. On February 25, 1991, a pilot wrote that “on departure got an abnormal input to rudder that went away. Pulled yaw damper circuit breaker.” The noted corrective action was “replaced yaw damper coupler and tested per maintenance manual.” On February 27, 1991, a pilot wrote that “yaw damper abruptly 85 According to United Airlines personnel, the command “fifteen flaps” is part of the company’s go- around procedure. Although United’s standard procedure for a go-around at the time of the accident included the statement “go-around thrust” before reducing the flap setting, no such statement was recorded by the accident airplane’s CVR. Company personnel advised the Safety Board that the “fifteen flaps” command would have no function, other than a go-around, at the United flight 585 airplane’s altitude and configuration. Further, the Safety Board’s report regarding the United flight 585 accident stated, “four or five seconds prior to impact, two signatures were noted that are consistent with two engines accelerating.” These indications of increasing engine power are consistent with an attempted go-around. Figure 11. Ground track of United flight 585.

Factual Information 47 Aircraft Accident Report moves rudder occasionally for no apparent reason on ‘B’ actuators. Problem most likely in yaw damper coupler…unintended rudder input on climbout at FL250. [Autopilot] not in use, turned yaw damper switch OFF and pulled circuit breaker. Two inputs, one rather large deflection.” The main rudder PCU yaw damper transfer valve (see figure 8) was removed and replaced, and the airplane was returned to service. The main rudder PCU from United flight 585 was severely damaged by ground impact and postcrash fire. Operational testing of the complete PCU was not possible because of fire damage. However, visual examination of the servo valve indicated that the secondary slide of the PCU servo valve was at its neutral position during the postcrash fire. The Safety Board’s investigation of the rudder anomaly discovered during a July 1992 United Airlines ground check (discussed earlier in section 1.6.3.2.1 and further in section 1.18.1.1) revealed that the 737 rudder had the potential to operate in a direction opposite to that commanded by the flight crew if the main rudder PCU primary slide became jammed to the secondary slide and pushed the secondary slide to its internal stop. Adverse tolerance buildup86 in some secondary slides and servo valve housings could allow a rudder reversal if the secondary slide was forced to its internal stop. Examination of the United flight 585 servo valve indicated that the buildup of tolerances of the secondary slide and servo valve components were such that the maximum travel of the secondary slide (regardless of the relative position of the primary slide) would not result in a reversal of the rudder surface motion. Examination of the standby rudder actuator input bearing revealed evidence of metal transfer (also referred to as galling)87 between the input shaft and the bearing. However, the examination determined that the galling did not have sufficient contact area to result in binding that could not be overcome by pilot input on the rudder pedals. (Galling of the input bearing of the standby rudder actuator is discussed in more detail in section 1.16.5.3.2.) During its investigation of the United flight 585 accident, the Safety Board also reviewed the performance of the flight crew. First officers who had flown recently with the captain of United flight 585 described his strict adherence to standard operating procedures and conservative approach to flying. They indicated that the captain briefed all approaches even in visual conditions, always reported equipment malfunctions, and discussed deferred maintenance items with the first officer. The first officers also reported that, if the captain had not previously flown with a first officer, he would observe that first officer perform PF duties during the first leg of a trip sequence. Further, a first officer who had previously flown with the captain in gusty, turbulent weather reported during a 86 Adverse tolerance buildup occurs when the assembling (stacking) of a series of parts, all of which are individually built within tolerances (that is, within an allowable deviation from a standard), has an adverse result. 87 Galling is a condition in which microscopic projections or asperities bond at the sliding interface under very high local pressure. The sliding forces subsequently fracture the bonds, tearing metal from one surface and transferring it to the other.

Factual Information 48 Aircraft Accident Report postaccident interview that the captain had advised him to conduct a go-around if windshear was encountered. The first officer stated that the captain had indicated that he had no problem with an early go-around and had encouraged the first officer to conduct a go-around if he thought the approach was unsafe. Regarding the first officer’s performance, the captain of United flight 585 had flown a 3-day trip sequence with the United flight 585 first officer a few weeks before the accident and had described her to a friend as “very competent.” According to the Safety Board’s final report on this accident, “comments on the CVR indicate that the pilots were alert and aggressive throughout the final 9 seconds [of the accident sequence].” The Safety Board also examined the available information regarding the weather conditions present in the Colorado Springs area at the time of the accident (strong gusty winds with the potential for mountain rotors88 and windshear). Additional expertise in this area was provided by the National Oceanic and Atmospheric Administration (NOAA), National Center for Atmospheric Research (NCAR), and National Aeronautics and Space Administration (NASA). The Safety Board’s final report on the United flight 585 accident stated the following: Normally, intense rotors produce a distinctive “roaring” sound. A person 12 miles north of COS [Colorado Springs airport] reported a rotor hitting the ground about noon. He was inside a building and went outside to observe the rotor after hearing what he described as a roaring sound. However, there were no reports from witnesses to this accident hearing such sounds. Most of the weather investigation focused on the possibility of a rotor as a cause or a factor in this accident…. While approaching [Colorado Springs], flight 585 probably encountered orographically induced atmospheric phenomena, such as updrafts and downdrafts, gusts, and vertical and horizontal axis vortices. The most likely phenomenon that would cause the airplane to roll was a horizontal axis vortex…. It is possible that flight 585 encountered a strong horizontal axis vortex that induced a rolling moment which exceeded the airplane’s control capabilities, but the FDR data is not consistent with such an encounter. [The Safety Board’s review of FDR data from airplanes that had penetrated horizontal axis vortices89 revealed that the FDRs recorded a transient altitude increase (pressure decrease) and anomalous airspeed indications. These were not observed in the FDR data from United flight 585.] NOAA originally estimated, and NOAA research work has confirmed, that a typical rotor on the day of the accident could have a rotational velocity of 0.06 radians/second (3.4 degrees per second) with a radius of 1,640 feet. The tangential velocity at the core radius would have been 100 feet per second. Simulations showed that such a rotor had little effect on airplane control except that performance problems could develop if the airplane 88 A rotor is an atmospheric disturbance produced by high winds, often in combination with mountainous terrain, and expressed by a rotation rate (in radians per second), a core radius (in feet), and a tangential speed (in feet per second). Rotation can occur around a horizontal or vertical axis. One radian equals approximately 57°.

Factual Information 49 Aircraft Accident Report remained in the downflow field of the rotor. In a sustained downflow, the airplane would either have to lose altitude or airspeed, similar to the outcome of entering the downflow field of a microburst…. The airplane did lose altitude at a higher than normal rate, but the airspeed remained constant…. …It was determined that rotors with rotation rates of 0.6 radians/second (34 degrees per second) with a 250 feet core radius (150 feet/second tangential velocity) generated extreme control difficulties…. Wind shears or gust fronts severe enough to produce control difficulties also produced flight responses that were clearly different than those recorded on the accident airplane…. Large changes in heading into the wind, large increases in airspeed, and rapid rolling away from the wind if not controlled by the pilot…. Wind-induced side slip…with marked increases in normal acceleration (G-load). On December 8, 1992, the Safety Board adopted the following probable cause statement for the United flight 585 accident: The National Transportation Safety Board…could not identify conclusive evidence to explain the loss of United Airlines flight 585. The two most likely events that could have resulted in a sudden uncontrollable lateral [roll] upset are a malfunction of the airplane’s lateral [roll] or directional control system or an encounter with an unusually severe atmospheric disturbance. Although anomalies were identified in the airplane’s rudder control system, none would have produced a rudder movement that could not have been easily countered by the airplane’s lateral [roll] controls. The most likely atmospheric disturbance to produce an uncontrollable rolling moment was a rotor (a horizontal axis vortex) produced by a combination of high winds aloft and the mountainous terrain. Conditions were conducive to the formation of a rotor, and some witness observations support the existence of a rotor at or near the time and place of the accident. However, too little is known about the characteristics of such rotors to conclude decisively whether they were a factor in this accident. As a result of the United flight 585 accident investigation, the Safety Board made seven safety recommendations, including Safety Recommendations A-92-57 and -58, which were issued on July 20, 1992.90 These recommendations asked the FAA to 89 The Safety Board’s review of its accident/incident database revealed that, although several high- altitude horizontal axis vortex encounters resulted in serious injuries (from turbulence), only one instance of such a vortex resulted in a catastrophic air carrier accident. (See National Transportation Safety Board.

1. Braniff Airways, Inc., BAC-111, N1553, August 6, 1966, near Falls City, Nebraska. Washington, DC.)

During the Safety Board’s investigation of the USAir flight 427 accident (and subsequent reexamination of United flight 585 data), Air Line Pilots Association (ALPA) personnel advised the Safety Board of a documented mountain rotor encounter that occurred on January 29, 1993. A 737-200 operating as Alaska Airlines flight 66 encountered a mountain rotor while climbing through 900 feet above ground level (agl) after takeoff from Juneau, Alaska. (For additional information, see Human Performance Segment Factual Report, Addendum, November 20, 1998.)

Factual Information 50 Aircraft Accident Report Develop and implement a meteorological program to observe, document, and analyze potential meteorological aircraft hazards in the area of Colorado Springs, Colorado, with a focus on the approach and departure paths…. This program should be made operational by the winter of 1992. (A-92-57) Develop a broader meteorological aircraft hazard program to include other airports in or near mountainous terrain, based on the results obtained in the Colorado Springs, Colorado, area. (A-92-58) In response to Safety Recommendation A-92-57, NOAA and NCAR collected weather and wind data in the Colorado Springs area between February and April 1997. The June 1998 NOAA/NCAR interim report91 indicated that numerous mountain-induced weather phenomena were observed, including low-altitude windflow reversals, windshears, and horizontal axis vortices (rotors). The Safety Board’s review of the NOAA/NCAR data revealed that, in several cases, the upper wind directions were similar to, but weaker than, those that existed in the Colorado Springs area when the United flight 585 accident occurred.92 The data from these cases showed that mountain rotors were present. Some of the weaker rotors measured by NOAA/NCAR were located between the surface and about 3,000 feet above ground level (agl), whereas other (stronger) rotors were observed at altitudes exceeding 4,000 feet agl. The rotors observed during the NOAA/NCAR data gathering program had a maximum rotational rate of 0.05 radians per second, which is less than the rotational rate of 0.6 radians per second that was demonstrated during the investigation of the United flight 585 accident to be necessary to produce extreme control difficulties in a 737 airplane. According to NOAA scientists, stronger upper windspeeds produce proportionally stronger rotors. Therefore, if the upper windspeeds encountered by United flight 585 were three times stronger than those measured by NOAA/NCAR, the rotor rotational rate could be three times stronger. (For example, a rotor three times stronger than the maximum observed by NOAA/NCAR would have a maximum rotational rate of 0.15 radians per second.) In its January 20, 1999, letter to the FAA, the Safety Board indicated that, pending the issuance of the NOAA/NCAR final report, Safety Recommendation A-92-57 was classified “Open—Acceptable Response.” The Safety Board’s letter also indicated that, pending further information about a meteorological program to observe, document, analyze, and report meteorological hazards at other airports in mountainous areas, Safety Recommendation A-92-58 was classified “Open—Unacceptable Response.” 90 For additional information regarding the seven recommendations, see sections 1.18.11.1, 1.18.11.2, and 1.18.11.3. 91 A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs Area: Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997), NOAA/NCAR, June 1998. As of March 1999, a final report had not been issued. 92 The Safety Board’s review of the data indicated that the upper winds present at the time of the United flight 585 accident were about two to three times stronger than those observed in the NOAA/NCAR data.

Factual Information 51 Aircraft Accident Report Further, in connection with its investigation of the USAir flight 427 accident, the Safety Board reexamined the CVR, FDR, meteorological data, airplane performance data, and physical evidence from the United flight 585 accident investigation. As part of its reexamination of airplane performance data, the Safety Board conducted additional airplane performance simulation studies using the FDR and radar data (see section 1.16.6.2). The Safety Board also conducted additional human performance studies based on the FDR and CVR data from the United flight 585 accident (see sections 1.16.8 and 1.18.8). 1.16.1.2 Eastwind Airlines Flight 517 Incident On June 9, 1996, Eastwind Airlines flight 517, a 737-200, N221US, experienced a yaw/roll upset about 2200 near Richmond, Virginia. The airplane was operating at an airspeed of about 250 knots and an altitude of about 4,000 feet msl in visual flight rules (VFR) conditions when the yaw/roll event occurred. The pilots were able to regain control of the airplane and land at the destination airport without further incident. None of the 53 airplane occupants were injured, and no damage to the airplane resulted from the incident. During postincident interviews, the captain reported that he was flying the airplane with the autopilot disengaged93 and his feet resting lightly on the rudder pedals during the descent to land at Richmond. Both the captain and first officer reported that they had not encountered any turbulence or unusual weather during the flight, which originated from Trenton, New Jersey, or the approach to land. However, the captain said that, as the airplane descended through about 5,000 feet msl, he felt a brief rudder “kick” or “bump” on the right rudder pedal but that the pedal did not move. The captain stated that he glanced at the first officer’s feet to see if he had contacted the rudder pedals but that the first officer had his feet flat on the floor. FDR information94 and flight crew and flight attendant interviews indicated that, as the airplane descended through about 4,000 feet msl, the airplane yawed abruptly to the right and then rolled to the right. The captain stated that he immediately applied “opposite rudder and stood pretty hard on the pedal.” The captain stated that, almost simultaneously with these rudder inputs, he applied left aileron.95 Further, the captain consistently reported that the rudder pedal control felt stiffer than normal and did not seem to respond normally throughout the upset event. The first officer stated that he saw the captain 93 The captain reported that it was his practice to disconnect the autopilot when descending through 10,000 feet msl and manually fly the airplane to landing. 94 The FDR installed on the Eastwind flight 517 airplane, a Loral/Fairchild Data Systems model F1000 (S/N 00948), recorded 11 parameters. Altitude, airspeed, magnetic heading, engine pressure ratio (EPR) engine No. 1, EPR engine No. 2, and microphone keying were recorded at once-per-second sampling intervals. Parameters that were sampled more frequently than once per second were roll attitude and control column position versus time (two times per second), pitch and longitudinal acceleration (four times per second), and vertical acceleration (eight times per second). The CVR installed on the incident airplane, which was designed to preserve about 30 minutes of data, continued to record after the upset event and recorded over the data pertinent to the incident. Because no pertinent CVR data was available, the Safety Board referenced the incident times as follows: radar time equals FDR time in seconds minus 11,000 plus 2205:47 (local eastern standard time).

Factual Information 52 Aircraft Accident Report “fighting, trying to regain control” and “standing on the left rudder.” According to the captain, these flight control inputs slowed the yaw/roll event; however, the airplane “was still trying to roll,” so he advanced the right throttle to compensate for the rolling tendency with differential power.96 The captain stated that, after he made these inputs, the airplane appeared to move back toward neutral “for one or two seconds” and “might have momentarily banked left because of all the correction present” before returning abruptly to a right bank. The flight crew performed the emergency checklist, which included disengaging the yaw damper. Subsequently, the upset event stopped, and the airplane flew normally for the remainder of the flight. The pilots reported a delay of several seconds between the disengagement of the yaw damper and the end of the upset event. During postincident interviews, the lead flight attendant of Eastwind flight 517 stated that she was standing in the aisle near the rear of the airplane cabin before the upset began. At that time, she heard a distinct thump from below but not directly underneath her feet. (The rear flight attendant also reported hearing a thump sound while the airplane yawed to the right) She reported that, immediately after the thump occurred, the airplane began “rocking with a violent back and forth motion…. The motions…lasted no more than fifteen seconds, were violent from start to finish, and appeared to come in cycles.” The FDR data revealed that the airplane rolled rapidly to the right about 10° with a simultaneous heading change to the right of about 5° per second. The FDR data also revealed that the airplane rolled back to the left, to a maximum left bank angle of approximately 15°, while the right engine thrust increased. 97 (The airplane was in a 15° left bank for approximately 3 seconds and remained in a left bank for an additional 9 seconds while the engine thrust increased; however, the FDR recorded little heading change.) While the right engine pressure ratio (EPR) increased, the airspeed increased from about 250 to about 254 knots. The airplane’s heading changed to the left; hesitated at about 95 During an interview 5 days after the incident, the captain estimated that he input about 40 to 45° of control wheel displacement and stated that “the airplane seemed to hold in a 25 to 30° bank.” A statement obtained from the first officer at the same time was consistent with the captain’s estimates of control wheel input and bank angle. However, during an interview 10 days later, the captain indicated that a flight test in which the airplane rolled about 15° “provided a better recreation of the motions of the airplane during the incident.” (FDR data indicated that the incident airplane rolled between 10 and 15° during the upset event.) Although both pilots estimated the captain’s control wheel input during the incident to be about 40 to 45°, Safety Board and Boeing kinematic studies indicated that the initial control wheel input was closer to 60°. Additionally, during the interview 5 days after the incident, the captain estimated that he input about 3 to 4 inches of left rudder pedal displacement; however, in an interview 2 years later, the captain stated that the rudder pedals moved no more than 1 or 2 inches. The captain stated that he immediately put “a lot” of pressure on the rudder pedals but that they “did not go down to the floor.” 96 During postincident interviews, the captain told Safety Board investigators that his automatic decision to use differential power to counter the yaw/roll event reflected his experience in turbopropeller- driven airplanes. 97 About 5 seconds after the beginning of the upset, the EPR values for the right (No. 2) engine began to increase. The right engine EPR values increased to a maximum of 1.32; remained constant at 1.26 for 5 seconds; increased to 1.30 for 1 second; and then decreased to about 1.01, which was consistent with EPR values of the left (No. 1) engine for the entire incident.

Factual Information 53 Aircraft Accident Report 242°; and began a series of heading oscillations of decreasing magnitude, including a left heading excursion of 4.1° and a right heading excursion of 5.6° (both in 1 second). During the heading oscillations, the airplane’s roll attitude also oscillated between an approximate wings-level attitude and 10° left wing down (LWD). The heading and roll oscillations decreased while the airplane maintained an approximate constant heading of about 240°. Postincident examination of the airplane’s maintenance records revealed three flight crew-reported rudder-related events during the month preceding the incident. The first event occurred on May 14, 1996, when the captain of the June 9 Eastwind incident flight experienced a series of uncommanded “taps” on the right rudder pedal just after takeoff, which he stated felt “like someone hitting their foot on the right rudder.” The captain returned to the departure airport and landed without further incident. As a result of the uncommanded rudder movements reported to have occurred on May 14, the main rudder PCU was replaced that same day,98 and the airplane was returned to service.99 During a May 21 overnight inspection, rudder sweep and PCU leak examinations were conducted. The captain reported that the rudder pedal bumps he experienced on May 14 felt identical to the rudder pedal bump he felt at the onset of the yaw/roll event on June 9. Additionally, the Eastwind flight 517 lead flight attendant was a cabin crewmember on the May 14 flight, during which the captain experienced the uncommanded rudder “taps.” The flight attendant stated that she did not hear any sounds during the May 14 event and reported that the event was much less intense than the June 9 incident. She was in the front of the cabin during the May 14 event but was near the rear of the cabin during the June 9 incident. The other two uncommanded yaw/roll events were reported to have occurred on June 1 and June 8, 1996.100 As a result of these reports, the yaw damper transfer valve and the yaw damper linear variable displacement transducer (LVDT) were removed and replaced on June 8. The incident pilots performed a postmaintenance test flight on the morning of June 9 and reported that the airplane performed normally, with no rudder system anomalies noted during the test flight. Because the airplane performed satisfactorily during the test flight, it was returned to service. When Safety Board investigators examined the rudder system and the main rudder PCU after the June 9 incident, they observed that the rudder’s yaw damper system had been adjusted such that the rudder neutral (at rest) position was 1.5° to the left when the 98 The Eastwind flight 517 main rudder PCU servo valve was assembled and tested at Parker on April 15, 1996. 99 As a result of the uncommanded rudder movements reported to have occurred on May 14 (and another undocumented rudder event that occurred on or about May 31), on June 2, 1996, Eastwind issued Flight Crew Briefing Bulletin 96-03, which advised company pilots of the circumstances of the events and requested that pilots notify maintenance immediately if an unexplained yaw movement occurred. 100 The airplane’s June 1, 1996, logbook entry stated, “…[airplane] may have exp[erienced] 2 each [slight] rudder yaws [to] the left…approx[imately] 30 sec[onds] apart…. No rudder pedal movement….” The June 8, 1996, logbook entry stated, “with yaw damper off in level flight aircraft rolls to the right and the yaw damper test indicator also goes to the right.”

Factual Information 54 Aircraft Accident Report yaw damper system was engaged and the rudder trim was set at zero. The active yaw damper could move the rudder 1.5° farther to the left of this neutral position and 4.5° to the right of this neutral position with no aerodynamic loads.101 Postincident PCU testing at Parker’s facility indicated that the yaw damper LVDT neutral position was incorrectly set. (The normal limit of yaw damper authority on the rudder, if properly set, would have been 3° to the left and 3° to the right of the rudder’s neutral position.) Additional examination and testing conducted by the Safety Board, Eastwind, and Boeing revealed that the wiring from the yaw damper coupler to the main rudder PCU was chafed and could have resulted in a short circuit, causing a full yaw damper command left or right. Additionally, examination of the yaw damper system revealed damage from infiltration of fluid that was consistent with, but not conclusive evidence of, an electrical fault. The main rudder PCU and yaw damper coupler were removed and replaced, new wiring was installed between the PCU and the yaw damper coupler, and the airplane was returned to service. To date, no further pilot complaints or maintenance writeups regarding rudder “bumps” or other anomalous rudder motions have been reported on the incident airplane. 1.16.2 Wake Vortex Tests and Studies Resulting From the USAir Flight 427 Accident The PIT Automated Radar Terminal System III radar tracking data indicated that the only airplanes operating in the vicinity of USAir flight 427 when the upset occurred were Atlantic Coast flight 6425, a Jetstream 31 that had just departed PIT and was climbing and heading north, and Delta flight 1083, a 727-200 that was preceding USAir flight 427 to PIT. The Safety Board plotted radar tracking data for these three airplanes to determine whether the wake vortices102 from either the Atlantic Coast or Delta airplanes might have played a role in the USAir airplane’s accident sequence. The radar data indicated that, at the time of the upset, USAir flight 427 and Atlantic Coast flight 6425 were separated by 1,500 feet vertically (flight 427 was at the higher altitude) and 3.5 nautical miles (nm) horizontally (with flight 427 northwest of flight 6425). About 8 seconds later (about 1903:11), radar data showed that USAir flight 427 was at 5,300 feet msl (600 feet above Atlantic Coast flight 6425) and that the airplanes were 3.1 nm apart. About 1903:20, the radar data indicated that USAir flight 427 was at 2,300 feet msl (2,600 feet below Atlantic Coast flight 6425) and that the airplanes were 2.8 nm apart.103 The radar tracks of the two airplanes did not cross at any time. 101 With the rudder trim set at zero, the yaw damper travel limits were ± 3° about the 0° rudder position (not the rudder’s neutral position). 102 According to the FAA’s Aeronautical Information Manual, all airplanes generate wake vortices (a pair of counterrotating airmasses trailing from the wing tips) while in flight. The strength of these vortices depends on the weight, speed, and shape of the wing of the generating aircraft. The greatest vortex strength occurs when the generating aircraft is heavy, in a clean configuration, and at a slow airspeed. 103 The recorded radar data plots and separation tables are included in the Performance Group Chairman’s Report of Investigation, dated January 14, 1995.

Factual Information 55 Aircraft Accident Report The radar data showed that Delta flight 1083 was descending through 6,300 feet msl on an easterly heading when it passed the approximate location where the initial upset of USAir flight 427 subsequently occurred. The accident airplane reached that location about 69 seconds after Delta flight 1083. According to information provided by Delta Air Lines and ATC records, Delta flight 1083 would have been operating at an estimated weight of 126,400 pounds, in the flaps 1 configuration, and at an ATC-assigned airspeed of 190 knots when it passed the location where the initial upset occurred. USAir flight 427, also on an easterly heading, was at 6,000 feet msl when the initial upset occurred. The closest Delta flight 1083 and USAir flight 427 were to each other was 4.1 nm apart (both airplanes were at 6,000 feet msl) about 24 seconds before the upset occurred. About the time of the upset (1902:50), the distance between the two airplanes had increased to 4.5 nm. NASA and Safety Board aerodynamics experts performed a study of the most likely movement of the wake vortices produced by Delta flight 1083 (at its estimated weight and configuration). The study indicated that the wake vortices would have drifted with the wind104 and descended at a rate of 300 to 500 feet per minute. On the basis of these rates, the wake vortices would have likely descended to between 5,800 and 6,000 feet msl during the 69 seconds after Delta flight 1083 descended through 6,300 feet msl near the location of the initial upset. The study indicated that USAir flight 427 most likely encountered the wake vortices produced by Delta flight 1083 about the time of the initial upset. In September and October 1995, the Safety Board conducted a series of flight tests near Atlantic City, New Jersey, to examine the aerodynamic effects of 727-generated wake vortices on a 737. These tests were conducted with participation and support from parties to the USAir flight 427 investigation, including the FAA, Boeing, USAir, and the Air Line Pilots Association (ALPA), as well as other interested parties, including NASA. The tests used a highly instrumented 737-300 provided by USAir105 and a 727-100 owned by the FAA and equipped with wing-tip smoke generators to assist in the visual identification of the wake vortex core.106 To accurately simulate the wake turbulence conditions encountered by the accident airplane, the test airplanes were loaded to the approximate weights of USAir flight 427 and Delta flight 1083 at the time of the wake vortex encounter. Most of the flight tests were conducted in early morning hours when calmer 104 As previously indicated, a radiosonde balloon that was launched approximately 6 miles southeast of the accident site about 11 minutes after the accident measured winds at 6,000 feet msl from 274° at 15 knots. 105 The 737 used for the wake turbulence flight tests (which was flown by FAA, Boeing, USAir, and ALPA pilots during the flight tests) was equipped (by Boeing) with an FDR that had enhanced recording capabilities. More parameters, such as control input and control surface position, were included, and parameters were sampled and recorded more frequently than those parameters recorded by the FDR on the accident airplane. The flight test airplane also had a digital audiotape recorder and a video recording system with seven cameras (two in the cockpit facing forward out the windshield, one in the cockpit facing the flight crew and the instruments, one under each wing tip facing forward, one on the vertical fin facing forward, and two in the midcabin facing out windows toward the wing tips). A T-33 observation airplane (provided by Boeing) also used video recording equipment to document the flight tests. 106 The 727-100 provided by the FAA (and flown by FAA flight test pilots) for the wake turbulence flight tests is shorter than the 727-200, but both airplanes’ wing lengths and shape are identical.

Factual Information 56 Aircraft Accident Report atmospheric conditions would be most likely to permit strong, stable, long-lasting wake vortices. During the tests, the 737 penetrated the 727’s smoke-indicated wake vortex cores about 150 times107 from various intercept angles; in turns, climbs, descents, and level flight at various altitudes;108 and at separation distances of between 2 and 4.2 nm (USAir flight 427 and Delta flight 1083 were 4.5 nm apart at the time of the upset). For other flight test conditions, the flight test pilots positioned the 737 so that specific airplane surfaces (for example, left wing, right wing, vertical fin, engine, and fuselage) passed through the wake vortex cores. The pilots performed intercepts under the following conditions: autopilot on without pilot input, autopilot on with pilot input (in CWS mode), autopilot off without pilot input (hands off), and autopilot off with pilot input. Information was obtained from the videotapes, enhanced FDR, Boeing’s portable airborne digital data system (PADDS),109 the 2-hour CVR installed on the 737, and test pilot statements. These data revealed that the 727 wake vortices remained intact as much as 6 to 8 miles behind the wake-generating airplane, and wake strength values ranged from 800 to 1,500 feet/sec2. The videotapes revealed numerous examples of wake vortices breaking apart; linking up; and moving up, down, and sideways. The 737 encounters with the wake vortices occasionally resulted in rapid airspeed fluctuations of ± 5 knots, although some fluctuations resulted from the wake vortices’ interaction with the pitot- static system and low-level (± 0.1 G) turbulence. Further, the data showed that the wake vortices did not move in a straight or uniform path (as previously assumed by wake turbulence models that had been developed before the accident). Rather, flight test participants noted large fluctuations in the vertical position of the wake vortex cores over short distances. The wake movement was especially unpredictable when the wake was generated during a descent. During public hearing testimony related to the USAir flight 427 accident, Boeing’s flight test pilot described the 727 wake vortices as follows: …the wakes…stay at this three, four, five foot diameter core all the way back until they burst…. They flow left, right, up and down, inside maybe a 15 foot diameter tube on a stable day. It is possible to quickly hit the same wake twice, because the wake is not fixed in space. You could possibly get a left roll and…[if] the wake vortex is actually on your left side at that point…if you cross over, it means that you roll right back into the wake…. 107 Data from the 150 wake encounters were examined to identify 737 flight characteristics during wake vortex encounters; CVR sound signatures from 50 of the 150 wake encounters were selected and compared with the sounds recorded by the accident airplane’s CVR. 108 According to the FAA test pilot involved in the wake turbulence flight tests, part of the flight test safety plan “required that we do this at a high altitude…15,000 feet [msl] or greater, in case there was some type of an upset that would take some time to recover from…. We were above a deck of clouds at about [18,000] or 19,000 feet [msl] for the first encounter….” 109 PADDS is a high-rate, self-contained flight test data recording system developed by Boeing that was installed on the flight test airplane to allow investigators to record and evaluate parameters that were not recorded by the accident airplane’s FDR system. The PADDS system recorded all data at higher sampling rates (20 times per second) than the FDR system that was installed on the incident airplane.

Factual Information 57 Aircraft Accident Report According to the flight test pilot statements, although the wake encounters had varying effects on the 737 flight handling characteristics, the effects usually lasted only a few seconds and did not result in a loss of control or require extreme or aggressive flight control inputs to counteract. The flight test pilots with experience flying in air carrier operations stated that the wake encounters experienced during the flight tests were similar to those that they had experienced during normal flight line operations. The pilots described the wake encounters as “routine” and not startling. The flight test data also indicated that even “routine” wake vortices could result in strong rolling110 and yawing moments,111 depending on the wake vortex intercept angle. During public hearing testimony, the FAA flight test pilot reported that, at wake vortex intercept angles of less than 10° (particularly at intercept angles of between 2 and 5°), the airplane experienced strong rolling tendencies. However, the pilot stated that, at intercept angles of 10° or more, the encounter did not result in a significant rolling moment, although the airplane experienced a couple of sharp bumps as it crossed the wake vortex. The FAA flight test pilot reported that, when the airplane encountered the wake vortex with no autopilot or manual control (hands-off condition), he observed uncommanded roll angles between 15 and 30°. When the airplane encountered the wake vortex under manual control (hands-on condition) and with the autopilot on (with and without pilot input), the FAA pilot observed roll angles between 10 and 20°. According to the flight test pilots, the rolling moment tended to self-correct as the airplane passed through the wake vortex. The FAA flight test pilot said that “the airplane would start to roll as you [entered the wake]…then as you hit the right vortex, it would roll you back up to level again….” Several of the flight test pilots reported that the wake vortex encounters were generally short in duration (unless the pilots intentionally maneuvered the airplane to stay in the wake effect) because the wake vortex tended to force the airplane out of its effects. The FAA test pilot stated that it was very difficult to keep the airplane in the vortex. During test conditions in which the vortex was positioned on the top of the airplane and hit the vertical fin (in the flaps 1 configuration at 190 knots), the pilot reported that full aileron deflection was required to counter the vortices’ tendency to push the airplane out of the vortex. During the public hearing testimony, Boeing’s flight test pilot stated that he did not use much rudder during the wake turbulence flight tests; rather, he used mostly aileron. The pilot stated that “the only time you use the rudder pedal is when you have a definitive yawing moment… or you have a very…high rolling moment….” Boeing’s flight test pilot also reported that “every now and then, I started to use the rudder, but then you would translate left or right out of the full effect of the [wake vortex] core and then I would be left with either putting… the [control] wheel back in or leaving the rudder there and just playing with the [control] wheel.” The pilot stated he did not experience anything during 110 Boeing’s flight test pilot stated that the effect of the wake turbulence was “a bit stronger than I would have expected…[resulting in] probably 25 to 30 [degrees of roll].” 111 Wake turbulence-related yawing moments were transient in nature and did not result in large sustained heading changes.

Factual Information 58 Aircraft Accident Report the wake vortex encounters that he believed would prompt a pilot to apply and hold full rudder. In the public hearing testimony, the flight test pilots indicated that the wake encounters they experienced during the flight tests were not disorienting or violent enough to have caused a sustained loss of control. However, the flight test pilots said that a strong wake vortex encounter would likely be startling and surprising to pilots when encountered unexpectedly during otherwise smooth, routine flight operations. The wake turbulence encounter flight test data were compared with the results of computer flight simulations112 performed at Boeing using its previously developed mathematical model. The comparison indicated that the simulation model adequately predicted wake-induced lift, roll, and pitch characteristics; however, the mathematical model did not accurately predict the wake-induced yawing moment characteristics of the airplane during certain wake encounters. The videotape taken during the flight tests revealed that, when the airplane passed over or directly through the wake vortex cores, the wake (as shown by the smoke) was disrupted by the 737’s wings, fuselage, and horizontal tail surfaces; under these circumstances, the yawing moments predicted by the simulation were not evident in the flight test data. However, when the airplane was slightly underneath the wake so that its vertical tail surface passed through the wake vortex core generated by the 727, the wake that contacted the vertical tail surface had not been previously disrupted. The flight test data revealed that this situation resulted in a transient yaw response that exceeded the yaw predicted by the simulation wake turbulence model. Boeing’s mathematical wake vortex model was refined based on the wake turbulence encounter flight test data, and additional flight simulations were performed by investigators to further evaluate the interaction of USAir flight 427 with Delta flight 1083’s wake vortices. The simulations employed various wake vortex characteristics, wake vorticities, positions, and core sizes; the accident airplane’s closure rates and intercept angles with the wake; and the use or operation of the airplane’s autopilot, yaw damper, and autothrottle. Encounters with wake vortices in these simulations did not result in significant problems controlling the airplane. 112 Flight simulations were conducted at Boeing using its computer workstation-based flight simulation software and its multipurpose cab (M-CAB) engineering simulator. The M-CAB utilizes a standard, 6 degree-of-freedom motion base to provide some acceleration cues to the occupants of the cab. The motion base can replicate some short-term accelerations or some smaller magnitude, long-term accelerations. It can rotate the cab through roll, pitch, and yaw angles of about ± 30° and can translate the cab in the forward/aft, side, and vertical directions about up to about ± 2 feet. Long-term vertical accelerations, such as those from sustained normal flight loads, cannot be duplicated. Some side loads, such as those from sustained sideslips, can be duplicated by rolling the cab to a steady angle, similar to tilting a chair sideways. Forward accelerations, such as those felt during a normal takeoff roll acceleration, can be somewhat replicated by rotating the cab upward to a steady pitch attitude.

Factual Information 59 Aircraft Accident Report 1.16.3 Flight and Simulator Tests of Effects of Various Flight Control and System Failures The Safety Board used Boeing’s multipurpose cab (M-CAB) engineering simulator, “flown” by FAA flight test pilots, to document and test several possible 737 failure or malfunction scenarios. The following possible flight control/system failure scenarios were examined: • loss of engine power, with various flight control inputs and rates; • asymmetric thrust reverser extension; • yaw damper hardover; • leading edge asymmetry, with or without autoslats; • asymmetric autoslat deployment at stickshaker; • flap malfunction; • loss of roll control spoilers; • elevator malfunction; • outer slat damaged and extended over wing; and • rudder hardover, at various rates of input, with AFS on and off. Of all the simulations conducted, only the rudder hardover simulation produced results that were generally consistent with the data from USAir flight 427’s FDR.113 Specifically, some of the results of the M-CAB simulation of the rudder hardover scenario were similar to FDR heading data that were recorded several seconds after the initial upset. This similarity prompted additional investigation of rudder hardover scenarios. Because the pilots who flew the M-CAB simulator responded differently (either in the magnitude or the timing of their responses), the simulator results were not consistent among the pilots, and precise matches of the FDR data were thus not possible. As a result, the Safety Board and Boeing conducted flight simulations on computer workstations to remove the individual variances introduced by the pilots who participated in the M-CAB study. The workstation simulations enabled engineers to make small parametric changes to the input data and then determine the effects of various rudder hardware scenarios and resultant wheel and elevator responses. These simulation studies are discussed in section 1.16.6. 113 For example, for an asymmetric thrust reverser extension to result in the left yawing moment recorded by the accident airplane’s FDR during the first several seconds of the upset, the right engine would have had to have been in forward thrust and the left engine in reverse. Boeing’s calculations revealed that the net thrust differential required to sustain the left yaw recorded by the FDR during the first few seconds of the upset would be 37,890 pounds, affecting the airplane’s yaw to the left. However, the FDR’s recorded engine power settings (66 percent N1 at 190 knots), indicated that the accident airplane’s engines could have only been producing a net thrust differential of 13,269 pounds (4,500 pounds forward thrust on the right engine and 8,769 pounds reverse thrust on the left engine), affecting the airplane’s yaw to the left.

Factual Information 60 Aircraft Accident Report Boeing’s M-CAB simulator was also used to conduct postaccident simulator flights using the accident airplane’s FDR data, with a rudder hardover induced either manually or electronically to represent the USAir flight 427 upset condition. During the simulator exercise, the participants114 were briefed by Boeing personnel regarding the circumstances of the USAir flight 427 accident, prepared for and expecting the upset event when it occurred, and coached through a specific recovery technique (full right control wheel maintained throughout the duration of the event, and forward control column pressure sufficient to reduce the normal load factor and maintain airspeed above the crossover point).115 The pilots were able to recover from the upset (or at least stabilize the roll to the point at which a continued loss of control would not have likely occurred) when they applied the recovery technique promptly at the beginning of the event. If the pilots varied their responses from the specific techniques that they were told to apply (for example, when they modified the control wheel input in anticipation of the simulator’s responses to the inputs or applied aft control column pressure to maintain 6,000 feet), it became much less likely that the pilots would successfully recover from the upset event.) Additionally, Safety Board investigators, with representatives from parties to the investigation and a research scientist from NASA’s Ames Research Center, documented possible pilot responses to the upset using the vertical motion simulator (VMS) at the Ames Research Center.116 The VMS had a larger range of motion than the Boeing M-CAB and could therefore more accurately replicate the airplane motion recorded by the accident airplane’s FDR. The time histories of the airplane motion, as documented by the FDR and the initially derived positions of the flight control surfaces (based on computer workstation modeling), were input into the VMS. In addition, a portion of the accident airplane’s CVR was synchronized to the FDR data and replayed during the VMS runs. The VMS cab did not resemble a 737 cockpit; however, the cab included a view of a computer- simulated horizon, which was adjusted to the accident airplane’s attitude. The VMS allowed participants to feel the motion of the airplane, listen to the CVR excerpts, and view the horizon and control inputs to assess possible flight crew responses (such as whether the flight crew might have responded to the upset with left rudder pedal input). In addition, a NASA specialist on human spatial orientation rode in the simulator to provide observations on the possibility that pilot disorientation contributed to the accident. (See section 1.18.6.2 for additional discussion regarding the NASA specialist’s observations.) 114 Participants in these postaccident simulator flights included pilots and nonpilots from the Safety Board and parties to the investigation. 115 See section 1.16.4 for more information on the crossover airspeed. 116 A research scientist from NASA’s Ames Research Center described the VMS as “…a full 6 degree- of-freedom simulator that has a vertical thrust of plus and minus 30 feet, lateral thrust of plus and minus 20 feet, and a fore and aft thrust of 2.5 feet…. there are full visual simulations on the VMS….” The motion base of the VMS simulator permits an improved replication of the feel of the airplane motion over that of Boeing’s M-CAB (or most other motion-based simulators.) Although the acceleration cues are better represented by the VMS, its range of motion limits the range of lateral and vertical acceleration cues available to the occupants of the VMS cab.

Factual Information 61 Aircraft Accident Report 1.16.3.1 Eastwind Flight 517 Flight Tests On June 22 through 24, 1996, the Safety Board conducted flight tests in the Eastwind flight 517 incident airplane, with Boeing, FAA, and Eastwind Airlines participation. The flight tests were to document the operation and limits of the airplane’s yaw damper system, test and record the airplane’s responses to various rudder inputs, and expose the captain of Eastwind flight 517 to various rudder inputs and document his reactions to and insights on the inputs. For the flight tests, the airplane’s yaw damper system bias remained misadjusted so that it could command 1.5° to the left and 4.5° to the right of the rudder’s trimmed position (as it was at the time of the incident). As with the wake vortex tests, additional test equipment and instrumentation were installed on the incident airplane to record and document the flights.117 During the ground and flight tests,118 the incident airplane was operated with a Boeing flight test pilot in the left seat and an FAA flight test pilot in the right seat; the captain of Eastwind flight 517 and additional Boeing and FAA personnel were seated in the cabin. The first flight test was conducted at altitudes between 8,000 and 13,000 feet msl, at an airspeed of 250 knots, and with the yaw damper engaged and the flaps and landing gear retracted. Attempts were made to induce an in-flight yaw damper failure and subsequent hardover command through a series of rapid and abrupt rudder pedal and control wheel inputs; however, the flight test pilots were unsuccessful in inducing a yaw damper hardover. Before the second test flight, the incident yaw damper coupler was removed, and a different yaw damper coupler, a yaw damper fault insertion box, and associated wiring were installed to allow the flight test pilots to command a yaw damper hardover condition using an electrical signal. The second flight test was also conducted at altitudes between 8,000 and 13,000 feet msl; at an airspeed of 250 knots; and with the yaw damper engaged, autopilot disengaged, and flaps and landing gear retracted. Yaw damper hardovers to the left and right were electronically commanded by the flight crew via the cockpit switchbox, and the maximum rudder and control wheel positions needed to stabilize the airplane were noted. Additionally, rudder pedal release tests were conducted using the following procedures: 117 During the Eastwind flight tests, the PADDS system recorded 28 parameters, including 5 yaw damper-related parameters and 3 rudder system parameters, which provided valuable data for investigators. (The Eastwind flight 517 FDR recorded 11 parameters, none of which provided yaw damper or rudder position information.) The PADDS system recorded all data at higher sampling rates (20 times per second) than the FDR system that was installed on the airplane at the time of the incident. Additionally, a digital audiotape was installed to record CVR data beyond the normal 30-minute duration, and a Boeing noise recording system was installed to record noises emanating from the aft cabin and galley area during the flight tests (to determine the source of the thump noise described by the flight attendants from flight 517). 118 Ground taxi tests were conducted before each of the two test flights to test the rudder and yaw damper system for anomalies that would preclude safe test flights and perform operational tests of the additional test equipment and instrumentation installed on the airplane.

Factual Information 62 Aircraft Accident Report • While maintaining straight and level flight using control wheel and rudder pedal inputs, right rudder trim was added in 1° increments, from 0 to 6° trailing edge right rudder position. • Rudder pedal inputs were released. • Rudder position and control wheel input needed to control bank angle were noted. During portions of the second flight test, the captain of Eastwind flight 517 occupied the right pilot seat previously occupied by the FAA flight test pilot119 and controlled the airplane during a series of yaw damper hardover insertions and rudder pedal release conditions (including four yaw damper hardovers of 4.5° right rudder, three rudder pedal releases from the 6° right rudder trim position, and three rudder pedal releases from the 4° right rudder trim position). Recorded FDR and PADDS data indicated that the captain responded to the first yaw damper hardover 0.6 seconds after its initiation by stepping on the left rudder pedal. The flight test FDR data indicated that the airplane’s bank angle increased to a maximum of about 4.5° right wing down (RWD) and that its heading changed about 2° (both in 1 second) before the airplane responded to the Eastwind flight 517 captain’s recovery efforts. During the three subsequent yaw damper hardovers, the Eastwind flight 517 captain, at the direction of the Boeing flight test pilot, allowed the airplane to respond to the hardover condition for a few seconds before the captain responded with rudder pedal input. When the Eastwind flight 517 captain was exposed to the 6° right rudder pedal release test condition (during which FDR and PADDS equipment recorded a 4° right heading excursion and a bank angle increase to 8° RWD, both within 2 seconds), he stated “that was more like it.” (The incident FDR data indicated a 4.1° right heading change within 1 second and a maximum bank angle increase to 10° RWD within 2 seconds.) The Eastwind flight 517 captain indicated that the motion of the airplane during the portion of the second test flight, for which he was seated in the right pilot seat in the cockpit, was similar to the airplane motion he recalled experiencing during the incident and that the yoke pressure felt the same. However, the captain indicated that the rudder response during the first and second tests seemed different from what he experienced during the incident. He stated that the rudder felt stiffer and less effective during the actual incident. 119 The FAA test pilot moved to the cockpit observer jumpseat and continued to control the yaw damper hardover switchbox.

Factual Information 63 Aircraft Accident Report 1.16.4 Flight Control Characteristics Flight Tests (Blowdown and Crossover Airspeed) In September 1995, a series of flight tests were conducted from Boeing Field in Seattle, Washington, to validate existing and acquire additional aerodynamic data for the 737-300 flight simulator data tables, study the airplane’s performance during high sideslip conditions, and measure the airplane’s response to various roll and yaw inputs. The flight tests were conducted with the USAir 737-300 that was used for the wake vortex tests conducted in September and October 1995 (see section 1.16.2). The flight tests included operating the 737-300 (instrumented with the Boeing PADDS system) at a flaps 1 setting and at airspeeds from 150 to 225 knots calibrated airspeed (KCAS). The flight test conditions included steady heading sideslips; airplane roll response to control wheel input, rudder pedal input, cross controls of control wheel and opposite rudder pedal input, and combined controls of control wheel and rudder pedals; autopilot turns; and slowdown turns to aerodynamic stall. Several flight test conditions required the test pilots to maintain control of the airplane and, if possible, a constant (or steady) heading by using the control wheel to oppose full rudder surface deflections. These tests revealed that, in the flaps 1 configuration and at certain airspeeds, the roll authority (using spoilers and ailerons) was not sufficient to completely counter the roll effects of a rudder deflected to its blowdown limit. The airspeed at which the maximum roll control (full roll authority provided by control wheel input) could no longer counter the yaw/roll effects of a rudder deflected to its blowdown limit was referred to by the test group participants as the “crossover airspeed.” The flight tests revealed that, in the flaps 1 configuration and at an estimated aircraft weight of 110,000 pounds,120 the 737-300 crossover airspeed was 187 KCAS at one G.121 At airspeeds above 187 KCAS, the roll induced by a full rudder deflection could be corrected by control wheel input; however, in the same configuration at airspeeds of 187 KCAS and below, the roll induced by a full rudder deflection could not be completely eliminated by full control wheel input in the opposite direction, and the airplane continued to roll into the direction of the rudder deflection. The flight test data also confirmed that an increase in vertical load factor, or angle-of-attack, resulted in an increase in the crossover airspeed. The flight tests also revealed that the test airplane’s rudder traveled slightly farther than originally indicated by Boeing’s 737-300 computer models before reaching its aerodynamic blowdown limit. Data from the flight test were incorporated into Boeing’s M-CAB engineering software, and flight simulations were performed. The M-CAB flight simulations indicated that, with a rudder deflected to its aerodynamic blowdown limit and in the configuration and conditions of the USAir flight 427 accident airplane, the roll 120 At the time of the initial upset, USAir flight 427 had an estimated operating weight of 108,600 pounds and was operating at an airspeed of about 190 knots. 121 One G is equivalent to the acceleration caused by the earth’s gravity (32.174 feet/sec2).

Factual Information 64 Aircraft Accident Report could not be completely eliminated (and control of the airplane could not be regained) by using full control wheel inputs if the airspeed remained below 187 KCAS. The pilots who were involved in the flight and simulator tests indicated that successful recovery required immediate flight crew recognition of the upset event and subsequent prompt control wheel inputs to the full authority of the airplane’s roll control limits and pitch flight control inputs to maintain a speed above the crossover airspeed.122 To return the airplane to a wings-level attitude, the pilots had to avoid excessive maneuvering that would increase the vertical load factor, or angle-of-attack, and thus increase the crossover airspeed. In June 1997, additional flight tests were conducted by FAA and Boeing test pilots123 using a newly manufactured 737-500124 to obtain additional information regarding crossover airspeeds and quantify 737-300 controllability, handling characteristics, techniques, and altitude required for recovery from rudder deflections to aerodynamic blowdown limits. (Earlier flight tests had been limited to 75 percent of the available rudder rate deflection because of concern that, at higher deflection rates, the vertical fin would be overstressed during a dynamic maneuver.) The flight test conditions included full-rate rudder deflections and/or maximum rate aileron roll maneuvers that were initiated at various airspeeds, configurations, and aircraft weights and with variable pilot responses (delayed and immediate response, aggressive flight control input, and autopilot on and off). During the tests, strain gauges attached to the vertical fin revealed that the full-rate rudder deflections did not exceed the design loads for the vertical fin structure. Because the flight test airplane was to be subsequently delivered to a customer, all maneuvers were conducted within the airspeed, G, and roll angle limitations specified in the 737 airplane flight manual (AFM). The Boeing test pilots described the handling of the airplane when they applied full left rudder with the test airplane configured similar to the USAir flight 427 accident airplane (190 knots and flaps 1). One pilot described how the airplane would initially respond to aileron inputs and begin to roll out of the rudder-induced bank attitude and how, by pulling back on the control column and adding some vertical load factor, the recovery could be stopped and the airplane could hang in a sideslip bank. The test pilot said that he did not apply additional aft column inputs at these moments but that these inputs would have caused the airplane to “roll into the rudder.” The pilot concluded that “you can control roll rate with the control column.” The other Boeing test pilot said that, in referring to the control inputs required to perform a recovery from full rudder input, “there is some technique required between the G [normal load factor] and the roll.” 122 Pilots who participated in these M-CAB simulations reported that, for a full rudder hardover condition with an airspeed greater than 187 KCAS, they initially applied full opposite control wheel and then slightly reduced the wheel deflection in response to the recovery rate. The pilots then found it necessary to apply more wheel to counter the roll being produced by the rudder. The pilots reported that three such cycles of the wheel were normally required to find the control wheel position that would neutralize the roll. 123 Safety Board staff were not on board the airplane during the flight tests. However, Safety Board investigators helped design the test procedures, attended postflight debrief sessions and discussions, and reviewed all the data gathered during the flight tests. 124 The 737-500 series airplane is approximately 8 feet shorter than the 737-300 series and requires less roll authority (ailerons and spoilers) to counter the effects of a rudder deflection. After the flight tests, Boeing adjusted the data in the 737 simulator model to account for this difference.

Factual Information 65 Aircraft Accident Report The flight test pilots affirmed that the Boeing M-CAB and computer simulation models incorporated the tradeoff between normal load factor and roll control but that the tradeoff occurred at a greater load factor in the simulator than in the airplane. (Thus, the airplane was somewhat more prone to a loss of roll control from an aft control column input than was the simulator.) The flight test pilots said that the Boeing simulation would need to be modified according to the flight test results. Boeing’s flight test pilots stated that, when they allowed the airspeed to increase to about 220 to 225 KCAS (sacrificing altitude as necessary to maintain airspeed),125 the airplane recovered easily. The pilots reported that, when they initiated the event at higher airspeeds, the airplane was easier to control and that recovery was accomplished with less roll. The Boeing flight test pilots also indicated that, when the airplane was configured at higher flap settings at the initiation of the event, recovery was easier but that the airframe experienced considerable vibration. 1.16.5 Examination and Testing of Flight Control Systems/Components The 737 flight control systems from the USAir flight 427 airplane were examined and tested to determine if they were a factor in the upset event and the accident. Examination of the airplane’s flight control system components revealed no physical evidence of preimpact malfunction. The Safety Board also examined and tested the accident airplane’s rudder system components, including rudder pedal assemblies; rudder cables; and standby and main rudder PCUs, yaw damper, linkages, and input arms. 1.16.5.1 Rudder Pedal Assemblies The accident airplane’s rudder pedal assemblies from both flight crew positions were removed from the wreckage. Both rudder pedal assemblies were fragmented and heavily distorted. The rudder pedal assembly from the first officer’s position exhibited postimpact fire damage. The left rudder pedal pivot lugs on both rudder pedal assemblies were fractured near their respective support tubes.126 Figure 12 shows a diagram of the rudder pedal assemblies as installed on the accident airplane. The rudder pedal assemblies were visually and microscopically examined by a Safety Board metallurgist and others on December 8, 1994, at Boeing’s Equipment Quality Analysis Laboratory in Renton, Washington. According to the Safety Board metallurgist, microscopic examination of the fracture faces revealed features typical of bending overstress fractures on both pivot lugs. With the support tubes positioned vertically, both left rudder pedal pivot lugs failed in the forward (and slightly downward) 125 The test pilots indicated that the amount of altitude lost during the recoveries varied but that, with a prompt response and good technique, control could be regained with a loss of less than 500 feet. The pilots also indicated that, if they did not have to comply with the vertical load factor restrictions imposed for the tests, they would have been able to recover with less lost altitude. 126 During normal operation, the rudder pedal pivot lugs are held stationary in the upper ends of the support tubes and allow the pedals to pivot and articulate as they are activated and as the brake is applied.

Factual Information 66 Aircraft Accident Report direction. The right rudder pedal pivot lugs on both assemblies were bent but remained attached to their support tubes. With the support tubes positioned vertically, the right rudder pedal pivot lug at the captain’s position was bent forward and downward, but the right rudder pedal pivot lug at the first officer’s position was bent forward and upward. 1.16.5.2 Tests to Determine the Effects of Rudder Cable External Forces, Breaks, and Blocked Input Linkage The Safety Board used an out-of-service 737-200 for a series of flight control system tests that examined the effects that external (nonsystem) inputs to the rudder cables from within the airplane’s cargo compartment and rudder cable separations127 would have on the rudder. All tests were conducted on the ground (with no aerodynamic loads). CVR equipment similar to that on the USAir flight 427 airplane was installed on the test airplane. To examine the effects of pressure applied to the rudder cable from within the cargo compartment (possibly from a passenger stepping through a soft spot in the cabin floor), incremental loads of between 50 and 250 pounds were applied vertically to the rudder cables within the forward cargo compartment, and the rudder deflection was measured. The testing showed that a maximum rudder deflection of 3.2° was measured when a 250-pound force was applied to the left rudder cable; all other test conditions (lesser loads and the right rudder cable) resulted in rudder deflections of no more than 2.3°. Figure 12. Rudder pedal assemblies as installed on the USAir flight 427 airplane. 127 The maintenance records for the USAir flight 427 airplane indicated that a temporary patch had been made to the floor above an area of the rudder cable. Thus, the testing attempted to simulate an outside force from above the patched area that could have deflected the rudder cable. Captain’s Rudder Pedals First Officer’s Rudder Pedals Forward Rudder Control Quadrants Bus Rod between Captain’s and First Officer’s Control Quadrants

Factual Information 67 Aircraft Accident Report To examine the effects on the rudder system of rudder cable separations, the rudder cables in the test airplane were cut, and the rudder system responses (sounds and rudder pedal and rudder surface movement) were recorded. A cable was cut during two tests (under light and no load conditions at two different locations within the fuselage), and the rudder cable was replaced between test conditions. The first cable cut was performed at fuselage station 360128 with no pressure on the rudder pedals. A loud “bang” was recorded by the CVR when the cable was cut, but no rudder pedal or rudder surface movement resulted. The second cable cut was performed at fuselage station 259.5129 with the pilot’s feet resting lightly on the rudder pedals. Another “bang” was recorded by the CVR when the cable was cut, and no rudder surface movement resulted. However, the left rudder pedal, which corresponded to the cut cable, moved to the -5° position. In both cable separation conditions, normal leg force applied to the rudder pedals after the cable cut resulted in the rudder pedal connected to the cut cable moving to the floor, but the rudder pedal attached to the uncut cable maintained the ability to move the rudder surface in the direction of the intact cable. The Safety Board’s review of the sounds recorded by the CVR during the rudder cable separation tests revealed that the sounds generated by cutting the rudder cables were impulsive and had energy that was distributed throughout the frequency spectrum. Another characteristic of the sounds recorded during the tests was the multiple secondary signals that appeared to be the result of mechanical “ringing” of the rudder cable system. The unknown thump sounds recorded by the CVR during the upset of flight 427 (see section 1.16.7.1) were in the low-frequency (below 500 Hz) range only and exhibited no “ringing” or secondary signals. Other tests were conducted to determine the effects on the rudder system of the presence of a foreign object or blockage between the main rudder PCU external input crank and one of the PCU external manifold stops. Figure 13 shows the locations of the 737’s external manifold stops. Safety Board investigators inserted a business card (folded three times) between the manifold body stop and the input crank arm and observed the effect of this blockage on yaw damper and rudder pedal inputs. The tests indicated that, when the input crank arm’s movement was blocked at the aft stop, a sustained left yaw damper command caused the rudder to travel to its full left deflection. The test also showed that, when the blockage was positioned at the forward side of the external input crank, a sustained right yaw damper command caused the rudder to travel to a full right rudder deflection. When the yaw damper command was sustained, the movement in either direction could not be stopped until the blocking material was removed from its position between the manifold stop and the external input crank; yaw damper (or rudder pedal) input opposite the direction of rudder movement tended to keep the blockage in place. When the yaw damper input command was stopped, the rudder 128 Fuselage station 360 is located near seat row 5 in the cabin; maintenance records for the accident airplane indicated that a soft interim floor panel repair was accomplished in this location. 129 Fuselage station 259.5 was selected for the cable cut test because that location allowed easy control cable access.

Factual Information 68 Aircraft Accident Report surface returned to neutral. In some tests, yaw damper or rudder pedal input in the direction of the rudder movement dislodged the blockage, and normal rudder control was regained. Examination of the main rudder PCU, as installed in an in-service 737 airplane, revealed that the PCU linkage was positioned so that it prevented a foreign object from dropping into the space between the aft stop and the crank arm. The PCU’s orientation would also make it difficult for a foreign object to lodge between the forward stop and input link. The external summing lever effectively covers the gap in the PCU retract direction (left rudder command). 1.16.5.3 Examination and Testing of Standby Rudder 1.16.5.3.1 Metallurgical Examination of Standby Rudder Components The Safety Board conducted a metallurgical examination of USAir flight 427’s standby rudder actuator input shaft, bearing, and thrust bearing race in its materials laboratory in Washington, D.C. Initial examination of the components revealed the effects of galling. The input shaft exhibited two areas of material buildup on the lubricated land surface on the inboard side of the shaft’s Teflon seal. The bore of the bearing in which the shaft turns contained two shallow cavity areas corresponding in orientation, size, and shape to the two areas on the shaft that contained the material buildup, and the thrust bearing race exhibited a non-uniform roller contact pattern. Energy dispersive x-ray spectrum (EDS) analyses were performed on the input shaft and the bearing. According to a Safety Board metallurgist, EDS performed on the surface of the input shaft in an area not affected by the galling produced a spectrum consistent with the type 440C stainless steel specified for the input shaft. However, the Figure 13. Locations of Boeing 737 main rudder PCU external manifold stops. Internal Servo Stops External Manifold Stop (Retract) External Servo Stops External Manifold Stop (Extend)

Factual Information 69 Aircraft Accident Report metallurgist stated that EDS performed on the bearing bore and the galled areas of the shaft generated spectra that were consistent with the type 416 stainless steel specified for the bearing. Measurements of the accident airplane’s standby rudder actuator components were within the engineering drawing specifications. 1.16.5.3.2 Standby System Actuator Binding/Jam Tests Safety Board investigators conducted tests on the rudder system of a 737 to examine the effects of variable input shaft binding forces and input shaft binding at different positions, with and without yaw damper input and various hydraulic system failures. Before testing, the investigators verified that the airplane’s rudder system rigging and main and standby rudder PCU installations met in-service standards; the investigators also cycled the rudder systems to verify instrumentation and operational limits and establish a baseline. The standby rudder actuator was removed from the test airplane and replaced with a standby rudder actuator that was selected for the testing because it exhibited input shaft and bearing galling similar to the unit that was installed on the USAir flight 427 accident airplane. The following rudder commands were input with the main and standby rudder PCUs pressurized:130 full rudder pedal inputs in both directions with the yaw damper disengaged, full rudder pedal inputs in both directions with the yaw damper engaged, and full yaw damper commands in both directions. In all of these tests, the rudder system functioned normally, and higher-than-normal pilot rudder pedal forces were not required.131 After these tests, the standby rudder actuator was replaced with one that had an input shaft that could be adjusted to various levels of binding (intended to simulate galling). The replacement actuator was used to determine the effects of binding of the standby rudder input shaft and bearing and the various levels of force that would be required to overcome such binding. Tests were conducted with the actuator adjusted so that 60 to 70 and 100 pounds of force were required to move the actuator input arm. The tests also measured the effects of left, right, and no yaw damper commands. The tests showed that, with 60 to 70 pounds of standby rudder binding force, the rudder could travel 7° to the left with a full left yaw damper command and 8° to the right with a full right yaw damper command. With 100 pounds of standby rudder binding force, the rudder could travel 8° to the left and right with full left and right yaw damper commands, respectively.132 Test conditions that simulated hydraulic system failures, along with binding of the standby actuator, did not significantly affect the rudder system’s 130 The standby and main rudder PCU input rods move together regardless of which PCU is pressurized. 131 According to Boeing, normal input force is about 0.5 pounds. 132 The 737-300 yaw damper still commanded ± 3° of motion. Therefore, if the standby actuator jammed when the rudder was positioned 3° left of its neutral position, the yaw damper could command rudder movement 3° in either direction, resulting in left rudder movement to 6° of left, or right deflection back to neutral. If the rudder was at 6° left when the standby actuator binding occurred, the yaw damper could command rudder movement that would result in between 3 and 9° of left rudder deflection.

Factual Information 70 Aircraft Accident Report operation. Ergonomic research indicates that pilots should have no difficulty applying 80 to 100 pounds of leg-pushing force against the rudder pedal, thus overriding the effect of such standby rudder actuator binding. (For additional information regarding ergonomic research on pilot rudder pedal forces, see section 1.18.8.) Tests were also conducted to determine the effects of a hard jam (not just binding) of the standby rudder actuator input shaft and bearing at the neutral, 3° (simulating left and right yaw damper inputs), and maximum standby rudder actuator positions (limited by the main rudder PCU external manifold stop). The tests showed that, with the standby rudder actuator input shaft jammed at the neutral position, the rudder could travel 6° to the left and 4° to the right with respective full yaw damper commands. A force of 45 pounds on the left rudder pedal or 55 pounds on the right rudder pedal would return the rudder to the neutral position; when the yaw damper command was turned off, the rudder remained at neutral. When the standby rudder actuator input shaft was jammed at the 3° left position, the rudder could travel 10° to the left with a full left yaw damper command and 3° to the right with a full right yaw damper command. With the yaw damper at its full deflection, a force of 95 pounds or 25 pounds on the appropriate rudder pedal, respectively, would return the rudder to the neutral position. When the yaw damper was turned off, the rudder was positioned 2° left of the neutral position When the standby rudder actuator input shaft was jammed at the 3° right position, the rudder could travel 2° to the left with a full left yaw damper command and 13° to the right with a full right yaw damper command. With the yaw damper at its full deflection, a force of 30 or 110 pounds on the appropriate rudder pedal, respectively, would restore the rudder to the neutral position. When the yaw damper was turned off, the rudder was positioned 4° to the right of the neutral position. With the standby rudder actuator input shaft jammed at a position required for a full maximum rate left rudder input (limited by the main rudder PCU external manifold stop), the rudder traveled 19° to the left of the neutral position. Under this test condition, 65 pounds of force applied to the right rudder pedal returned the rudder to the neutral position. The 65-pound force to the right rudder pedal would create a 140-pound force on the standby PCU input arm. Regardless of whether the standby rudder actuator input shaft was jammed at 3° left or 3° right of the neutral position or at the main rudder PCU body stop in either direction, the rudder moved to an off-neutral position when the hydraulic system was powered. With the standby rudder actuator input shaft and bearing jammed at the neutral position, no initial offset to the rudder occurred. In every case, the rudder could be centered by applying rudder pedal force to oppose the offset. The replacement standby actuator contained an input shaft and bearing that displayed galling similar to the unit that was installed in the United flight 585 airplane. Subsequent testing indicated that a full 3° yaw damper command would result in a 5° rudder movement to the left and a 6° rudder movement to the right. Another galled

Factual Information 71 Aircraft Accident Report input shaft and bearing were installed in the standby rudder actuator, and subsequent tests indicated that full 3° yaw damper commands to the left and right resulted in 6° of rudder movement in the respective directions. 1.16.5.4 Detailed Examinations and Tests of Main Rudder PCUs 1.16.5.4.1 Detailed Examinations of Main Rudder PCU Servo Valves Several times during this investigation, the Safety Board subjected the USAir flight 427 PCU133 to Parker’s postproduction acceptance test procedure (which is a performance-based test only and does not require the measurement of diametrical clearances). The acceptance tests did not reveal any disqualifying anomalies. To determine the diametrical clearances that existed within the USAir flight 427 PCU servo control valve slides and clarify the variability of clearances that passed the acceptance tests, the Safety Board measured the clearances between the primary and secondary slides and between the secondary slide and the servo valve housing on three PCU servo valves—a new-production PCU servo valve and the PCU servo valves from the USAir flight 427 and Eastwind flight 517 airplanes.134 The primary and secondary slides and the servo valve housing of each PCU were measured in three places—at the input lever end, midpoint, and spring end (see figure 10). Table 3 lists the minimum diametrical clearances (in inches) measured for each PCU at each position. As part of its investigation, the Safety Board conducted further detailed examination and testing of the main rudder PCU servo valves from USAir flight 427, Eastwind flight 517, and United flight 585. The Safety Board also examined a “minimum tolerance” servo valve that was used by Boeing during thermal shock testing (see section 1.16.5.4.7);135 new-production servo valves; the servo valve from the Silk Air flight 185 accident in Palembang, Indonesia;136 and five servo valves supplied by Parker that had been removed from service and had varying hours of operation (referred to as exemplar valves). The Safety Board’s materials laboratory examined the primary and secondary 133 Postaccident tests and examinations were performed on the USAir flight 427 main rudder PCU servo valve and the primary and secondary slides in their condition as recovered. The PCU actuator rod and external input linkage, however, exhibited impact damage that precluded normal operation; thus, these components (and their associated hardware) were replaced to facilitate testing. 134 It was not possible to measure the clearances that existed within the PCU servo valve from United flight 585 because the valve was damaged by the postaccident fire and attempts to remove the PCU from the wreckage. Table 3. Diametrical clearance measurements (in inches) for three PCUs. Measurement position 427 PCU slide to housing 427 PCU slide to slide 517 PCU slide to housing 517 PCU slide to slide New PCU slide to housing New PCU slide to slide Input lever end 0.000130 0.000170 0.000190 0.000200 0.000195 0.000190 Midpoint 0.000140 0.000140 0.000170 0.000180 0.000215 0.000200 Spring end 0.000170 0.000150 0.000180 0.000190 0.000190 0.000210

Factual Information 72 Aircraft Accident Report slides and housing from each of these main rudder PCU servo valves137 using a specially designed borescope and video recording system. Each segment of the primary and secondary slides’ outside diameter surfaces, the metering ports,138 and the inside diameters of the secondary slide and the servo valve housing were examined with a 90° borescope at magnifications up to 130 times. The outside diameter surfaces of the primary and secondary slides were also examined with a binocular microscope. A few small chipped areas were noted on the metering edges of the primary slide of each of the units examined; the locations of the chipped areas did not correspond circumferentially to the metering port areas. Examination with a scanning electron microscope (SEM) revealed that the dimensions of the largest chipped area on the USAir flight 427 primary slide was 0.006 inch in circumference by 0.002 inch in length. The other primary slides examined (including the new-production servo valve primary slide) had chipped areas of similar or larger size yet still met specifications. The metering ports for the secondary slide and the servo valve housing inside diameter surfaces were also examined using a 15° borescope so that the metering port edges could be better viewed. No evidence of deformation or distress was noted on any of the metering ports on any of the secondary slides and servo valve housings. In addition, small deposits of material that appeared to have the same composition as the secondary slide were observed on the slide’s outside diameter surface adjacent to the metering edge. To identify the origin of these material smears, the Safety Board reviewed Parker’s manufacturing procedures. This review found that, during manufacture, the servo valve slides are trimmed (or cut) at the metering edges, burr-wiped (or polished), and functionally tested in matched assemblies. The Safety Board obtained from Parker 135 This servo valve was specifically selected from existing stock because it had the tightest tolerances between the primary and secondary slides and the secondary slide and the servo valve housing that would pass the PCU acceptance test friction requirements. According to Boeing, the diametric clearance between the secondary slide and the servo valve housing was 0.000070 inch. (The same clearance in the USAir flight 427 valve was 0.000130 inch.) 136 The December 19, 1997, accident involving Silk Air flight 185, a 737-300, 9V-TRF, had not, as of March 1999, revealed any evidence that the accident was related to a rudder anomaly. The airplane was en route from Jakarta, Indonesia, to Singapore when it disappeared from the ATC radar screen at 35,000 feet msl and crashed at the mouth of a river about 33 miles northeast of Palembang. The Safety Board is participating in the Indonesian government’s ongoing accident investigation under the provisions of Annex 13 to the Convention on International Civil Aviation. The airplane’s CVR and FDR were evaluated by the Safety Board’s laboratory in Washington, D.C. That evaluation revealed that both had stopped recording before the airplane disappeared from the radar screen. (The CVR stopped recording first and the FDR stopped recording about 6 minutes later, 1 minute 14 seconds before the airplane’s last radar return was recorded.) The recorded data indicated no problems with the airplane or unusual comments by the flight crew. 137 The main rudder PCU from the Silk Air accident airplane was examined by Safety Board investigators under the supervision of a representative from the Indonesian government. The examination did not reveal any evidence of a preimpact jam or failure. 138 Metering ports are rectangular holes in the servo valve housing and secondary slide through which hydraulic fluid flows to cause actuation of the unit. Metering edges are the sides of grooves that are cut into the outside diameter surface of the primary and secondary slides. Flow of hydraulic fluid is controlled by positioning the metering edges relative to the metering ports.

Factual Information 73 Aircraft Accident Report two primary slides in an intermediate manufacturing condition to microscopically observe the trimmed and trimmed/burr-wiped conditions. SEM examination of the trimmed-only primary slide revealed numerous pieces of folded-over metal curled over the metering edge at the trimmed edge of the slide. SEM examination of the trimmed and burr-wiped primary slide showed areas on the slide’s outside diameter adjacent to the trimmed edge that appeared to be flattened down and smoothed over, similar to that observed on the USAir flight 427 primary slide. 1.16.5.4.1.1 Examination of Exemplar Servo Valves for White Layer As discussed in section 1.16.5.4.1, the five servo valves supplied by Parker that had been removed from service were referred to as exemplar servo valves. During manufacture, the outside diameter surfaces of the primary and secondary slides in the servo valve were nitrided (impregnated with nitrogen to increase hardness). The nitriding process can produce a brittle surface layer, referred to as a “white layer.” The Safety Board considered whether such a layer, if it remained after the manufacturing process, could have provided chips that could cause jamming of the unit. Parker reported that the thickness of the white layer created during nitriding is monitored by cutting into samples and that the manufacturing process removes an amount of material from the outside diameter surface that is far greater than the typical thickness of the white layer. Also, the grooves in the primary and secondary slides are cut after the parts are nitrided, preventing the accumulation of the white layer at the corner between the grooves and outside diameter surfaces. The Safety Board’s materials laboratory cross-sectioned the five exemplar slides and found no white layer on the slides’ outside diameter surfaces or within the grooves. 1.16.5.4.2 PCU Dynamic Testing On September 16 through 20, 1996, the Safety Board conducted a series of tests to examine the effects of dynamic external loads (such as those that the USAir flight 427 airplane might have experienced during the wake turbulence encounter) applied axially to the main rudder PCU actuator rod. These tests, conducted on a new-production PCU and the flight 427 PCU,139 included the following test conditions: (1) wake encounter simulation tests (600- and 1,200-pound140 load inputs to the PCU in the left and right rudder directions while the yaw damper was cycling), (2) yaw damper hardover tests (hardover commands input coincident with 600- and 1,200-pound loads applied to the PCU in the left and right rudder directions), (3) manual rudder input with no yaw damper input (600- and 1,200-pound loads applied to the PCU actuator rod in the left and right rudder directions coincident with manual left and right rudder input commands), (4) manual rudder input with no yaw damper input but with hydraulic system pressurization failures, and (5) a 3,500-pound input test (performed on the production PCU only). Both PCUs responded normally throughout all tests without any abnormal motions.141 139 The PCU from United flight 585 was too badly damaged to test. 140 The main rudder PCU output rod on the accident airplane might have been subjected to a load as high as 600 pounds as a result of its encounter with wake turbulence from Delta flight 1083; the Safety Board doubled that load to 1,200 pounds for the dynamic tests to establish a margin of confidence.

Factual Information 74 Aircraft Accident Report 1.16.5.4.3 Tests of Hydraulic Fluid During on-site and reconstruction activities for USAir flight 427, the Safety Board obtained hydraulic fluid samples from the accident airplane’s main rudder PCU and other portions of hydraulic systems A and B for further examination.142 After visual inspection for color and clarity, a small portion of each fluid sample was analyzed using gas chromatography/mass spectrometry143 and tested for moisture content; the remaining fluid was filtered for contaminant particle counting and tested for acidity. The tests revealed that the system A hydraulic fluid was 94 percent Skydrol LD4 fluid and that the system B hydraulic fluid was 77 percent Skydrol LD4 fluid; the remaining percentage in both systems was identified as Chevron HyJet fluid. The average system moisture content, color of the fluid, and average system acid numbers for the fluids in both systems A and B met the specifications for in-service fluid limits in Boeing Material Specification 3-11J, dated December 22, 1993.144 Table 4 shows those specifications. Table 5 shows the results of the contaminant particle counting tests of the hydraulic fluid in one sample from the accident airplane’s PCU. The results correspond to NAS 1638 fluid standards for Class 11.145 141 Because the tests showed that dynamic loads had no effect on PCU operation, the tests were not repeated on the Eastwind PCU. 142 Tests performed using hydraulic fluid samples from the USAir flight 427 airplane could not be conducted in accordance with standard industry practices because of the limited volume of fluid in the samples available. According to NAS, the “fluid sample size shall be proportional of the total volume of fluid contained in the device being checked…. The sampling procedure shall provide a method of applying motion to the item being checked which will result in fluid agitation within, so that a reasonable assumption shall be made that the fluid [sample] will be representative of particle dispersion in the total fluid volume.” The hydraulic fluid samples from the accident airplane were obtained from damaged and broken components under uncontrolled circumstances, and it is possible that the fluid samples did not represent the true contamination level of the hydraulic fluid in the system before the accident. 143 In this analysis method, a mixture of compounds is separated by gas chromatography, and the molecular composition of each is determined by mass spectrometry. 144 According to this document’s Qualified Products List for hydraulic fluid, both identified fluids were classified by Boeing as Class 1, Grade A hydraulic fluids and were approved for use in 737 hydraulic systems. Table 4. Boeing Material Specification 3-11J specifications for in-service fluid limits. Fluid properties In-service fluid limits Visual Must be transparent. No phase separation or precipitation. All colors are satisfactory. Percent of water by weight 0.1 to 0.8. Neutralization (acid No.—in mg KOH/gm) 1.5 mg KOH/gm maximum. 145 As previously mentioned, Boeing ensures that the hydraulic fluid particulate count of newly delivered airplanes meet the NAS 1638 fluid standards for Class 9. Tests conducted on hydraulic fluid samples from the Eastwind flight 517 airplane indicated that the level of contaminants in that fluid was roughly equivalent to the NAS 1638 fluid standards for Class 10, which permits a lower number and smaller size of particles than Class 11 but a higher number and larger size of particles than Class 9.

Factual Information 75 Aircraft Accident Report 1.16.5.4.4 Tests to Determine the Effects of Silting The primary slide metering edges are “underlapped” relative to the secondary slide metering ports, which allows a certain amount of hydraulic fluid circulation.146 In contrast, the secondary slide metering edges are “overlapped” relative to the servo valve housing metering ports, which minimizes hydraulic fluid flow.147 Because of the possibility that the fine, subfiltration-size particles that normally circulate through the hydraulic system suspended in hydraulic fluid could build up in the servo valve and restrict the movement of the secondary slide, the Safety Board conducted tests, using hydraulic fluid from an in-service 737,148 to determine if such a buildup (or silting)149 within the PCU could result in a jam of the PCU servo valve primary or secondary slides or an increase in sliding force to cause an anomalous rudder command. The USAir flight 427 PCU external input crank was rigidly fixed (pinned in position), which prevented the PCU servo valve from moving off its neutral position. Hydraulic pressure was applied to the PCU in its neutral position for about 1.2 hours to allow silting to occur. The pin was then removed. The external input crank did not move after it was released. (According to Boeing representatives, a servo valve bias spring normally allows the external input crank to move toward the retract direction when the external input crank is not fixed.) A force of Table 5. Results of contaminant particle counting tests. Particle size 5-15 µ 15-25 µ 25-50 µ 50-100 µ

100 µ

Hydraulic system A 482,116 8,897 1,328 70 6 Hydraulic system B 489,510 7,631 733 5 0 146 When the primary slide is in its neutral position relative to the secondary slide, the axial position of the metering edges on the primary slide falls short (typically by 0.001 to 0.002 inch) of closing off the secondary slide metering ports. This shortfall allows for some hydraulic fluid to continually circulate throughout the area. The amount of hydraulic system A fluid flowing through the servo valve when it is not in motion varies from 300 cc/min in a new servo valve up to 3,000 cc/min in an old servo valve. The hydraulic system B (including yaw damper) fluid flows through the servo valve at 1,370 cc/min. 147 When the secondary slide is in its neutral position relative to the servo valve housing, the metering edges of the secondary slide extend axially beyond (typically by 0.001 to 0.002 inch) the edges of the servo valve housing metering ports, completely covering the metering ports and restricting hydraulic fluid flow. However, a small amount of hydraulic fluid leakage occurs around the metering ports through the diametrical clearance between the secondary slide and the servo valve housing. 148 At the beginning of the testing, the hydraulic fluid used met the hydraulic fluid cleanliness limits in NAS 1638 standard for class 10 fluid. At the end of the testing, the fluid met the limits for class 12. (See table 2 for permissible contaminant ranges for selected fluid classes.) 149 The term “silting” refers to the accumulation of particles of contaminants in hydraulic fluid in a hydraulic component. The particles are smaller than the filter on the inlet side of the component and tend to settle at various edges and corners of valves and stay there unless washed away by higher flow rates. In other words, when the servo valve is in the hydraulically neutral position, the flow of hydraulic fluid is restricted, and the servo valve can function as a filter by catching some of the particles. These particles tend to accumulate at the upstream side of edges and corners of narrow orifices (such as the servo valve ports); however, movement of the servo valve from the hydraulically neutral position results in increased hydraulic fluid flow, which tends to flush any accumulated particles through the servo valve.

Factual Information 76 Aircraft Accident Report 4 pounds was required to move the external input crank. Normal input crank operation requires about 1.5 pounds of force. 1.16.5.4.5 PCU Servo Valve Chip Shear Tests The Safety Board conducted two series of tests to determine if a chip of material could lodge between the PCU servo valve primary and secondary slides or between the secondary slide and the valve housing and result in a jammed servo valve. The first series of tests were conducted at Boeing’s Equipment Quality Analysis Laboratory in January 1995 with chips of various materials that could be found in an airplane system. These materials included rubber, Teflon, steel wire, aluminum alloys, hardened and stainless steels, lockwire, aluminum-nickel-bronze, and chrome plating. The chip sizes were manufactured so they would be large enough to fill as much as possible of the 0.015- by 0.045-inch primary metering ports. Chips were inserted into these metering ports at the interface of the primary and secondary slides of a servo valve slide assembly. The primary slide was then moved to close off the metering port. The tests demonstrated that, when forces of up to 44 pounds were applied150 to move the primary slide to close off the secondary slide metering ports, all but one type of chip sheared. The chip that did not shear was a hardened-steel chip that jammed the primary slide to the secondary slide and did not shear with the maximum force of 44 pounds applied.151 When investigators examined the servo valve after the primary slide jammed on the hardened-steel chip, they noted a physical mark on the surface of the primary slide where the chip was inserted. The physical mark had the approximate size and shape of the hardened-steel chip. A second series of chip shear tests was conducted at Boeing’s facility in Everett, Washington, in February 1997. These chip shear tests were similar to the January 1995 tests except that (1) the February 1997 test chips were inserted in the secondary metering ports at the interface of the secondary slide to the servo valve housing, (2) different sizes of hardened-steel chips were used and (3) forces of up to 140 pounds were applied. In the February 1997 tests, all of the chips were successfully sheared, and each shearing event created a mark on the secondary slide that was approximately the shape of the chip. The maximum shear force needed was 140 pounds for a 0.042-inch wide by 0.014-inch thick chip. The minimum shear force for the same material was 23 pounds for a 0.011-inch wide by 0.013-inch thick chip. 1.16.5.4.6 PCU Tests Conducted to Determine the Effects of Air in the Hydraulic Fluid To determine the effects that air in the hydraulic fluid would have on the main rudder PCU operation, the Safety Board conducted operational tests in August 1996 of the USAir flight 427 PCU. During these tests, nitrogen was introduced into the system A 150 According to Boeing, the PCU design allows a maximum input force of about 50 pounds to the primary slide and 200 pounds to the secondary slide. 151 This chip was 0.032 to 0.058 inch wide by 0.012 to 0.016 inch thick.

Factual Information 77 Aircraft Accident Report hydraulic fluid, upstream of the PCU. (Gaseous nitrogen was used to simulate air for these tests.) Tests were conducted with manual inputs at the external input crank with a cyclic yaw damper input (hydraulic system A pressure off with a sustained 0.3-Hz152 cyclic damper input, hydraulic system B pressure off with a sustained 0.3-Hz cyclic yaw damper input, and a ± 3° stepped yaw damper command in each direction). The PCU responded normally (the output command matched the input command) during these tests. 1.16.5.4.7 PCU Thermal Testing A hydraulic system thermal analysis by Boeing engineers indicated that the failure of one of the 737 airplane’s EDPs could result in the overheating of the fluid in one of the hydraulic systems. Further, in response to recommendations made by an independent technical advisory panel,153 the Safety Board conducted two series of thermal tests (in August and October 1996)154 to identify the effects of thermal variations on the operation of the main rudder PCU. The hydraulic fluid used in the Safety Board’s silting tests was used for both series of thermal tests.155 During the August 1996 thermal tests, a total of 12 tests were conducted: 4 on a new-production PCU and 8 on the USAir flight 427 PCU. During the October 1996 thermal tests, a total of 19 tests were conducted: 8 on the new-production PCU and 11 on the USAir flight 427 PCU. The tests for both series were conducted first on the new- production PCU (to verify setup and methodology) and then on the USAir flight 427 PCU. Testing under all of the thermal test conditions was accomplished by pushing or pulling the external PCU input crank with a rod (simulating a left or right input command) and using sufficient force to move the secondary slide. (In the absence of jamming or binding, the secondary slide moves when about 12 pounds of force is applied at the input crank.) The results of three thermal test conditions (performed on both PCUs during both the August and October 1996 test series) are discussed in this report section. Two of these test conditions were included in this section because the tests and their results were representative of all other thermal tests that were conducted under conditions believed at the time to approximate those that a 737 airplane might encounter during normal operation (baseline and with a hydraulic system failure). The third test condition, which used hot hydraulic fluid injected directly into a cold PCU to explore the effects of extreme temperature differentials on the main rudder PCU’s operation, was selected for inclusion 152 0.3 Hz—about 1 cycle every 3+ seconds—approximates the airplane’s nominal dutch roll frequency and corresponding yaw damper output to dampen dutch roll. 153 The independent technical advisory panel was created by the Safety Board in January 1996 to review the work of the Safety Board’s Systems Group. See section 1.18.2 for more information about the panel. 154 The October 1996 tests used improved temperature control and data recording capabilities. For additional information regarding thermal tests, see “Systems Group Chairman’s Factual Report of Investigation Addendum—Main Rudder PCU Thermal Testing and Dimensional Examinations,” dated April 18, 1997. 155 As previously discussed, the hydraulic fluid used in the silting tests was collected from in-service 737 aircraft and met the NAS 1638 hydraulic fluid cleanliness limits for Class 10 and Class 12 fluids.

Factual Information 78 Aircraft Accident Report in this section because the USAir flight 427 PCU exhibited anomalous behavior during this test condition. For these three thermal test conditions, the exterior temperature of the PCU servo valve housing was allowed to reach and stabilize at a temperature believed, at the time the tests were conducted, to be representative of the vertical stabilizer cavity (where the rudder PCU is located) of the accident airplane just before the upset (-27 to -40° F).156 These temperatures were achieved before each test without hydraulic fluid circulating through the PCU. Also, the PCU servo valve housing continued to be cooled by the cold ambient air inside the test chamber and was warmed to varying degrees and at varying rates by the introduction of hydraulic fluid into the servo valve. 1.16.5.4.7.1 Baseline Test Condition This test condition approximated the system operating temperatures that investigators initially hypothesized for the USAir 427 accident airplane if both hydraulic systems A and B were operating normally (PCU temperatures of about 10 to 20° F and hydraulic fluid temperatures of about 70° F at the PCU inlet). Test results for this condition indicated that the difference in the servo valve exterior surface temperature and the hydraulic fluid temperature at the PCU was approximately 50 to 60° F. Both the new- production PCU and the accident airplane’s PCU responded normally during all tests under this condition. 1.16.5.4.7.2 Simulated Hydraulic System Failure Condition In this test condition, the temperature of the hydraulic fluid entering the PCU was raised to simulate a malfunction of one of the EDPs. Boeing could not provide flight test data for the temperature of the hydraulic fluid at the PCU. Therefore, at the Safety Board’s request, Boeing performed a thermal analysis, which indicated that a failed EDP could raise the temperature of the hydraulic system reservoir associated with the pump failure to 180 to 207° F. (The 737 incorporates a hydraulic fluid temperature sensor near the EDPs that provide a cockpit indication of an overheat condition when the hydraulic fluid reaches or exceeds 220° F. The accident airplane’s CVR recorded no flight crew comment regarding hydraulic system overheating.) Boeing’s thermal analysis also indicated that, if the hydraulic fluid were to overheat to a point just below the threshold of the overheat detector, the hydraulic fluid would cool to about 170° F as it passed from the hydraulic pumps to the end of the pressurized section of the fuselage. The fluid would then pass through about 15 feet of 3/8-inch diameter steel tube before it would reach the hydraulic fluid inlet point on the main rudder PCU. 156 The temperatures used during these tests (-27 to -40°F) were based on the results of Boeing’s thermal analyses. In October and December 1996, Boeing conducted flight tests to measure the operating temperatures of the 737 hydraulic system and main rudder PCU in a normal operating environment. The December 1996 tests indicated that the PCU servo valve housing operating temperature was greater than -27°F, as discussed at the end of this section.

Factual Information 79 Aircraft Accident Report The tests for this condition were conducted with the hydraulic fluid temperature raised to about 170° F at the point that the fluid entered the thermal test chamber. The fluid was then cooled by the ambient conditions in the chamber (temperatures in the chamber were between -27 and -40° F) as the fluid passed through the steel tubing into the main rudder PCU. Testing was conducted with both hydraulic systems A and B overheated and with only system A overheated (system B was at about 60° F). Test results for these conditions indicated that the difference in the servo valve exterior surface temperature and the hydraulic fluid temperature at the PCU inlet was approximately 100° F. Both the new- production PCU and the accident airplane’s PCU responded normally during all tests under this condition. 1.16.5.4.7.3 Extreme Temperature Differential Test Condition This test condition examined the effects of subjecting the PCU to a relatively extreme differential between the hydraulic fluid temperature at the PCU inlet and the servo valve exterior surface temperature. The extreme temperature differential produced during this test condition would not be expected during normal flight operations. For this test condition, the PCU was cooled to about -40° F while both hydraulic systems were depressurized (no hydraulic fluid passing through the PCU). At the beginning of these tests, heated hydraulic fluid only from system A (at a temperature of 170° F) was inserted directly into the PCU. The maximum temperature differential between the inlet hydraulic fluid and the servo valve housing of 180° F was attained 25 seconds after insertion of the heated hydraulic fluid. The new-production PCU responded normally under the extreme temperature differential test condition. However, the USAir flight 427 PCU exhibited anomalous behavior during these tests. During the August 1996 extreme temperature differential tests, the accident airplane’s PCU responded normally for the initial three external input crank commands, but the external input crank stuck in the full left rudder position for about 5 seconds at the end of the fourth input command. Afterward, the movement of the external input crank was normal, except for a hesitation in motion as the crank was pushed and pulled on each input command in both the rudder left and rudder right directions. The anomalous operation of the USAir flight 427 PCU was verified by a repeat test. During this repeat test, the PCU responded normally for one input command. However, during the next two input command cycles, the external input crank moved slower than normal for the left rudder command. At the end of the fourth left rudder command cycle, the external input crank stuck in the full left rudder position for about 1 second, after which the movement of the external input crank returned to normal. To further examine the extreme temperature differential test condition, the PCU temperature was once again lowered to about -40° F and stabilized, and the test was repeated again. During this repeat test, the PCU responded normally for the first three input commands. During the next 3 input commands, however, the external input crank moved slower than normal during the left rudder command. At the end of each of these left rudder command inputs, the force required to return the input crank to neutral

Factual Information 80 Aircraft Accident Report increased to about 124 pounds for about 1 second. Afterward, the external input crank returned to its neutral position with the application of less than 5 pounds of force. The October 1996 tests under the extreme temperature differential test condition, which utilized improved temperature control and data collection systems, yielded similar results for the USAir flight 427 PCU. Examination of the hydraulic fluid flow data revealed that momentary, anomalous increases in hydraulic system fluid return flow occurred during the jamming/binding. Further examination of the data indicated that the servo valve secondary slide momentarily jammed to the servo valve housing and that the subsequent overtravel of the primary slide resulted in an increase in system return flow that could cause a rudder actuator reversal (travel in the direction opposite to that commanded). Although reversal of the PCU actuator was not noted by any of the participants or observers during the tests, the periods of anomalous hydraulic system fluid flow observed in the data were consistent with the misporting of the hydraulic fluid from the effects of the jammed secondary slide and overtravel of the primary slide, resulting in a momentary output command opposite to the input command. 1.16.5.4.7.4 Additional Testing The USAir flight 427 PCU was disassembled and examined at Parker after both of the August and October 1996 test series were completed. The primary slide, secondary slide, and interior of the servo valve housing showed no evidence of damage or physical marks from jamming or binding during the thermal testing. The PCU also passed the functional acceptance test procedure used by Parker for validating PCU performance. On October 4, 1996, at the Safety Board’s request, Boeing conducted a flight test to measure the operating temperatures of the 737 hydraulic system and main rudder PCU in a normal operating environment. A test airplane was flown for about 2 hours at an altitude of up to 30,000 feet. Measurements included static air temperature outside the airplane (-40° F), temperature on PCU body (20° F), and temperature of the hydraulic fluid exiting the EDP (100° F). Additional temperature data was obtained during a flight test on December 6, 1996, that was conducted by Boeing (at the request of the Safety Board) with additional instrumentation. During this flight test, a test airplane was flown for about 2 hours at an altitude of up to 35,000 feet, and then the airplane descended to 20,000 feet for 1 hour. Data from this flight test indicated the following temperatures at 35,000 feet: static air outside the airplane, -58° F; hydraulic system A fluid at the outlet of the EDP, 58° F; hydraulic system A fluid at the PCU inlet, 22° F; hydraulic system B fluid at the PCU inlet, 34° F; PCU servo valve housing, 35° F; and ambient air around the PCU (inside the vertical stabilizer), -15° F. Data from this flight test indicated the following temperatures at 20,000 feet; static air outside the airplane, -36° F; hydraulic system A fluid at the outlet of the EDP, 65° F; hydraulic system A fluid at the PCU inlet, 35° F; hydraulic system B fluid at the PCU inlet, 35° F; PCU servo valve housing, 38° F; and ambient air around the PCU (inside the vertical stabilizer), 0° F.

Factual Information 81 Aircraft Accident Report In February 1997, Boeing independently conducted a third series of thermal tests.157 These tests were conducted on a main rudder PCU that was specifically selected by Boeing because it had the tightest diametrical clearances (between the primary and secondary slides and between the secondary slide and servo valve housing) that would pass the Parker functional acceptance test procedure frictional requirements.158 Boeing reported that this minimum tolerance PCU servo valve operated normally for each test condition designed to simulate a hydraulic system overheat, with one or both hydraulic systems circulating fluid through the servo valve before insertion of the heated fluid and at Boeing’s estimated normal operating temperatures within the vertical fin (conditions similar to those used in the Safety Board’s simulated hydraulic system failure tests). Boeing conducted additional tests in which hot hydraulic fluid was injected directly into the minimum tolerance servo valve. Hydraulic fluid was not circulated through the servo valve before insertion of the heated hydraulic fluid (conditions similar to those used in the Board’s extreme temperature differential tests). In some tests under these two conditions, the minimum tolerance servo valve’s secondary slide jammed to the servo valve housing (and remained jammed as long as the force on the input crank was maintained). The smallest temperature differential between the inlet hydraulic fluid and the servo valve housing at which the minimum tolerance PCU jammed was 145° F. 1.16.5.4.8 Rudder Actuator Reversals During Servo Valve Secondary Slide Jams After the Safety Board’s October 1996 thermal tests, Boeing engineers began an independent detailed examination of the test data. Their review of the data indicated that the PCU servo valve responded slowly and erratically to the input commands when the secondary slide was jammed to the housing by the thermal shock and an input was applied to the external input arm. Boeing subsequently conducted tests using a new-production PCU that had been modified to simulate a jam of the secondary slide to the servo valve housing at various positions and then to simulate the application of a full rudder input to the PCU. These tests revealed that, when the secondary slide was jammed to the servo valve housing at certain positions, the primary slide could travel beyond its intended stop position because of bending or twisting of the PCU’s internal input linkages (compliance). This deflection allowed the primary slide to move to a position at which the PCU commanded the rudder in the direction opposite of the intended command (reversal). Specifically, the tests revealed that, when the secondary slide was jammed at positions greater than 50 percent off neutral toward the extend or retract position and a full-rate command was applied to the PCU, the rudder would move opposite to the commanded position.159 157 See Boeing’s Test and Analysis of 737 Rudder Power Control Unit (PCU) Valve Thermal Jam Potential, Boeing correspondence B-B600-16147-ASI, May 29, 1997. 158 As noted in section 1.16.5.4.1, the diametrical clearance of the minimum tolerance servo valve (secondary slide to servo valve housing) was 0.000070 inch. (The same clearance in the USAir flight 427 main rudder PCU servo valve was 0.000130 inch.

Factual Information 82 Aircraft Accident Report Figures 14 and 15 show normal operation of the servo valve. Figure 16 shows the servo valve with a secondary slide jam (normal operation). Figure 17 shows the servo valve with a secondary slide jam and primary slide in the overtravel condition. 159 The Safety Board has investigated several fatal aviation accidents that have involved flight control reversals. In some cases, improper maintenance resulted in an airplane’s aileron controls being connected backward so that a pilot control wheel input intended to command a right turn resulted in a left turn. See the following National Transportation Safety Board accident reports: ANC94LA101 (August 3, 1994), FTW92FA218 (August 25, 1992), ATL88LA149 (June 4, 1990), ANC88FA062 (May 20. 1988), LAX85LA104 (January 10, 1985), MIA84FA040 (December 4, 1983), and MKC83FA090 (April 15, 1983). Also, see National Transportation Safety Board Briefs of Accident 1469 (August 20, 1982) and 3-1496 (June 9, 1976). Figure 14. Normal operation of the 737 PCU servo valve with slides in the neutral position (no jam). 5#####/HIW####3###5LJKW#####5 Primary Slide Primary and S e c o ndary S lide s at Ne utral Rudde r Rate = 0 Neutral Secondary Slide Valve Body

Factual Information 83 Aircraft Accident Report Figure 15. Normal operation of the 737 PCU servo valve with slides in the extend command position (no jam). Figure 16. PCU servo valve intended operation with the secondary slide jammed to the servo valve housing and primary slide opposing. No rm al Full Rate Co m m and- Primary & S e c o ndary S lide s Full Ope n Rudder Rate TEL 5#####/HIW####3###5LJKW#####5 Primary Slide Neutral Secondary Slide Valve Body Inte nde d Operatio n: S ec o ndary S lide Jamme d Full Open, Primary S lide Oppo s ing (Full Cro s s Flo w) Rudde r Rate = 0 Secondary Slide - Jammed To Valve Body 5#####/HIW####3###5LJKW#####5 Primary Slide Neutral Valve Body

Factual Information 84 Aircraft Accident Report After studying the thermal test conditions in which the USAir flight 427 main rudder PCU jammed, the Safety Board attempted to determine the combined effects of PCU servo valve secondary slide jamming and input linkage deflections (compliance) to determine if the USAir flight 427 PCU was more susceptible to reversal than other servo valves. These tests were conducted in November 1996 on three PCUs: a new-production PCU, the USAir flight 427 PCU, and the Eastwind flight 517 PCU. For this series of tests, a tool was used to mechanically jam the secondary slides of all three PCUs to their respective servo valve housings. Manual inputs were then applied to the PCUs with the yaw damper energized and deenergized (no yaw damper command was applied in both cases). When inputs at a less-than-maximum rate were made to the PCU, all three PCUs operated normally. However, if the external input crank rate exceeded the capability of the PCU to respond at its maximum rate, the input caused deflection of the internal linkages (that is, caused them to bend or twist), resulting in overtravel of the primary slide and a reverse rudder response (that is, a response opposite to that commanded). To identify the threshold for reversal, the Safety Board conducted tests on the three PCUs to determine the distance that the secondary slides had to be placed away from the neutral (“no rudder command”) position to result in rudder actuator reversal when an input force was applied to the PCU. The tests indicated that each of the three PCUs would stall (stop movement) or reverse when the secondary slide was jammed at or beyond the following positions (expressed as a percentage of full secondary slide travel from the neutral position): Figure 17. PCU servo valve with the secondary slide jammed to the servo valve housing and the primary slide in the overtravel condition. Secondary Slide - Jammed To Valve Body Ne wly Dis co ve re d Failure Effe c t: S e c o ndary S lide Jamme d Full Ope n, Primary S lide Ove r-S tro ke d In Oppo s ing Direc tio n Rudde r Rate TEL 5#####/HIW####3###5LJKW#####5 Primary Slide Neutral Valve Body

Factual Information 85 Aircraft Accident Report • New-production PCU: 38 percent in the extend direction, 54 percent in the retract direction. • USAir flight 427 PCU: 12 percent in the extend direction, 41 percent in the retract direction. • Eastwind flight 517 PCU: 17 percent in the extend direction, 30 percent in the retract direction. On August 20, 1997, the Safety Board conducted additional tests on the USAir flight 427 and Eastwind flight 517 PCUs to determine the effects of a jammed secondary slide on the force and rate of rudder movement. For these tests, each PCU was installed in a test fixture at Parker that simulated the airplane installation, and the servo valve secondary slide was jammed with the jamming tool. Table 6 shows the test results, which indicated that the position of the secondary slide jam affected the rudder’s output (force and rate). 1.16.5.4.9 Ground Demonstration of Rudder PCU Servo Valve Jam In June 1997, the Safety Board participated in a ground demonstration conducted by Boeing at its facility in Seattle, Washington.160 The demonstration was intended to identify and document the cockpit characteristics of a rudder PCU servo valve secondary slide jam. The demonstration was accomplished in a newly manufactured 737-300 airplane that was fitted with a special tool to simulate a rudder PCU servo valve secondary Table 6. Test results on the effects of a jammed secondary slide on the force and rate of rudder movement. PCU Position (percent off neutral) Force (percent of full PCU output capability)a Rate (degrees per second) USAir 427 0 100 31.7 USAir 427 12 50 3.9b USAir 427 22 76 9.5b USAir 427 50 88 17.8b USAir 427 71 93 26.6b USAir 427 100c ~ 100 ~ 33 Eastwind 517 0 100 31.7 Eastwind 517 22 34 4.8b Eastwind 517 50 79 14.3b Eastwind 517 71 89 25.4b Eastwind 517 100c ~ 100 ~ 33 a Full PCU output capability is 5,800 pounds. b Rudder motion was in the opposite direction from that commanded. c The 100-percent secondary slide jam position was not tested for either PCU because of test equipment limitations. Force and rate values for both 100-percent positions are estimated by Boeing.

Factual Information 86 Aircraft Accident Report slide jam at three different positions (about 0 percent, about 25 percent, and about 50 percent of travel from the neutral position). The demonstration was conducted while the airplane was parked on the ground with both engines off and with hydraulic systems powered by an external source of power. Before the demonstration began, the participants sat in the pilot seats of another newly manufactured 737-300 and manipulated the rudder pedals to become familiar with the feel of a normally functioning 737 rudder system on the ground. The participants then moved to the airplane that was fitted with the special jamming tool, and each participant manipulated the rudder pedals under the three simulated rudder jam conditions. As recorded in the Human Performance Group Chairman’s addendum report, one Safety Board participant described the demonstration as follows: All demonstrations were conducted in the cockpit, with Boeing test pilot…sitting in one of the pilot seats to coordinate the procedure…. When I was the active participant, I sat in the right seat wearing the seat belt. The first demonstration in the test airplane represented a jam of the secondary slide about 25 percent off [its] neutral position. I pushed the respective rudder pedals slowly to their full down positions as though I were performing a slow rudder system check. The right rudder pedal seemed easier to push down than the left pedal, although the difference seemed subtle. I then performed about 7 tests in which I [applied] hard left rudder. With one or two exceptions, this input triggered a rudder reversal on the pedals. Immediately after my input, the left rudder pedal began moving outwards until it reached the upper stop. The motion was slightly slower than an input I would expect from a human. The motion was steady and continued without pause no matter how hard I pushed to counter it (“unrelenting” was a description that, at the time, seemed to capture my impression)…. [When] I…“stopped fighting” the motion, [the] action of the rudder system ended almost immediately and the rudder pedals returned to the neutral position. On subsequent trials, I “stopped fighting” the rudder motion earlier, before the left pedal had reached the upper stop. Again, the rudder motion stopped almost immediately as soon as I stopped applying pressure, no matter where the pedal was located, and the pedals returned to neutral. The second demonstration represented a jam of the secondary slide about 0 percent off [its] neutral position. I pushed each respective rudder pedal slowly to the lower stop as though performing a rudder system check. The right pedal again seemed easier to push than the left pedal, although the difference was small. I also pushed the rudder pedals aggressively and abruptly, but this did not produce a rudder reversal situation. The third demonstration represented a jam of the secondary slide about 50 percent off [its] neutral position. I performed about 9 trials. When 160 Representatives of the interested parties who were members of the Human Performance Group were notified of the demonstration but declined to participate. However, party members of the Systems Group and a representative from the expert technical panel were present during the testing and participated informally in the tests.

Factual Information 87 Aircraft Accident Report I moved the pedals slowly and steadily [as though performing a rudder system check], I was generally able to move the pedals to their stops without starting a reversal. Sometimes, however, even a slow input initiated a rudder reversal situation (this time with the right pedal moving to the upper stop). Any abrupt motion on the pedals initiated an immediate rudder reversal situation. The rudder reversal motion was faster than was the case with a jam in [the] 25 percent position, perhaps similar to a relaxed or slow input speed by a human operator. Again, it was impossible to stop the motion by physically pushing against the rudder pedal. On several trials, I tried relaxing my input momentarily before the rudder pedal reached the upper stop. I found that the rudder reversal motion continued. This [was not true in the jam at the approximate 25 percent position], when the relaxation of pressure seemed to automatically stop the reversal motion. This motion was faster, easier to initiate, and more difficult to stop. Other participants reported similar experiences during the demonstrations They described the rudder back pressure during the reversal as “machine-like,” “startling,” and “relentless.” Another Safety Board employee who participated in the demonstrations stated that he switched the hydraulic system B flight control switch to “standby rudder” during the simulation of a secondary slide jam near the 50-percent position, which eliminated the rudder reversal and allowed the rudder to be centered by rudder pedal inputs in the normal direction. He reported that the centering was slow and required more rudder pedal pressure than in the absence of a jam but that there was no need to release the rudder pedal pressure and reapply it to eliminate the reversal. During subsequent rudder sweeps with the standby rudder system engaged, the rudder did not reverse. This Safety Board employee (who is 5 feet 8 inches tall) further stated that he was able to reach the hydraulic system A and B flight control switches in the overhead panel without difficulty from either the left or right pilot seats. 1.16.6 Flight Performance Simulation Studies During the investigation of the USAir flight 427 accident, Boeing applied a “kinematics analysis,” that is, a technique developed from prior flight test activities to derive from available FDR data the position of the flight control surfaces that were not among the parameters recorded by the FDR.161 The Safety Board reviewed Boeing’s kinematics process early in the investigation and then developed its own kinematics programs that ran on the Board’s computer workstation. The Safety Board developed the programs to validate the kinematics solutions being developed by Boeing for the USAir flight 427 investigation and now has the technique available for use in future aviation investigations. 161 Boeing’s kinematics process involves fitting curves through available FDR data (such as heading, pitch, and roll), obtaining time histories of rates from these curves, and obtaining accelerations from these rates. Forces, moments, and aerodynamic coefficients are then obtained from these accelerations using Newton’s laws of physics. Boeing uses its aerodynamic models to derive flight control time histories from the aerodynamic coefficients.

Factual Information 88 Aircraft Accident Report The Safety Board’s kinematic results were compared with Boeing’s kinematic results for the same inputs. Because the review of the kinematic results indicated that more frequent heading samples were needed to effectively perform the kinematic calculations, the Safety Board and Boeing used interpolation techniques to curve fit the FDR’s magnetic heading data and thereby provide data between the FDR data points. (As indicated in section 1.11.2, the accident airplane’s FDR recorded magnetic heading data at a once-per-second rate.) The FDR’s once-per-second magnetic heading data could be matched by different interpolation techniques, each resulting in different rudder surface time histories. Further, kinematics techniques magnified the noise162 that was inherent in the accident airplane’s FDR data, so smoothing techniques were needed to reduce this noise and minimize the potential for erratic signatures in the extracted control surface time histories. Safety Board investigators used the Safety Board’s workstation-based flight simulation computer program163 for the 737-200 and -300 to perform simulations of the flights of USAir flight 427, United flight 585, and Eastwind flight 517.164 The flight simulation process was used by the Safety Board, rather than the kinematics process, because it eliminated the uncertainties introduced into the kinematics process through the data interpolation and smoothing techniques (required because of the limited number of FDR parameters recorded and the limited sampling of the data). The Safety Board initially used assumed flight control (control wheel [aileron and spoilers], rudder, and control column [elevator]) positions (based on earlier Boeing and Safety Board kinematic solutions and FDR-recorded column position when available) as inputs into its computer simulations and then compared the output of the simulations—such as altitude, airspeed, and heading—with the available FDR data. Safety Board investigators then modified the control input, reran the simulations, and continued this process (known as iteration) until a good match with the FDR data was obtained.165 Various factors affect the extent to which the derived control surface positions reflect the actual control surface positions. For example, the accuracy of the USAir flight 427 simulations is affected by the fidelity of the aerodynamic modeling of the airplane in the flight conditions at the time of the upsets. The aerodynamic models used in the simulations are validated by flight tests, but this validation process is limited by safety 162 According to page 60 of Boeing’s “Submission to the National Transportation Safety Board for the USAir 427 Investigation,” dated September 30, 1997, “when the heading data is sampled at less than twice a second, the rudder position derived using kinematics becomes contaminated with an overlying ‘noise’ signal that shows up as an oscillation in derived rudder…. Proper interpolation can reduce the ‘noise’ providing more reliable information on rudder movement.” 163 The Safety Board’s flight simulation computer program is a Windows™-based executive program that uses Boeing-developed flight control, aerodynamics, and engine models to derive force and moment time histories of the airplane. Safety Board-developed equations of motion convert these forces and moments into airplane motion. 164 The Safety Board’s workstation-based flight simulations used computer software that describes the physics of the motion of an airplane in flight and various computer subroutines, including those that use data and equations from Boeing, to describe the 737’s aerodynamic characteristics and engine thrust. 165 Boeing also performed similar flight simulations on its own computer workstations.

Factual Information 89 Aircraft Accident Report factors, such as the structural load limits for which flight tests can be safely conducted, and the number of flight tests to be conducted. In addition, the computer simulations generally assumed calm air conditions. Although most of the flight from ORD to PIT occurred in smooth air, studies of FDR, CVR, and radar data indicate that, during the initial upset, USAir flight 427 encountered wake vortices from the 727 that preceded it on the approach to PIT (Delta flight 1083). Therefore, the effect of the wake was taken into account at the times when the FDR and CVR data indicated that the accident airplane was being affected by the wake vortices. The effects of the wake vortices on the airplane’s motion were based on a theoretical model that was modified to account for the effects on the yawing moment that were developed from the wake vortex flight tests and improve the match with vertical acceleration and pitch angle FDR data.166 Further, the United flight 585 airplane most likely encountered significant winds and turbulence; thus, the computer simulations were adjusted to account for such winds. However, because the actual wake vortex and turbulence conditions were not known, the respective contributions of the flight control surfaces and wake turbulence/winds to the motion of the airplane are uncertain. For example, if a large rolling moment resulting from a wind gust was quickly countered by the flight crew through a large control wheel movement, the resulting roll recorded by the FDR would be relatively small. If the wake turbulence/wind gust effect introduced into the simulation was less than the actual wake turbulence/wind gust experienced by the flight crew, the control wheel movements derived through the simulations would be less than the movements that actually occurred. Other factors affecting the accuracy of the simulation studies include instrumentation calibration errors and time lags in data recording. In addition, the directional gyroscopes that provided heading information to the FDRs in the Eastwind flight 517 and United flight 585 airplanes could have introduced errors in the recording of the heading data when the airplanes were operating in certain flight attitudes. The Safety Board accounted for part of the potential heading gyro gimbal errors by using a computer program especially developed for that purpose.167 166 The effects of the wake vortices were introduced into the simulations by slight modifications to the coefficients from the 737 aerodynamic model. Initially, the wake was modeled at Boeing using a Rankine vortex model and aerodynamic strip theory for all aerodynamic coefficient wake deltas except yaw. The Rankine wake vortex model assumes that the rotational velocity increases linearly with distance from the center of the vortex to the core radius. The velocity then decreases as the square of the distance beyond the core radius. The effect of the wake on the yawing moment coefficient was obtained using empirical data from the wake vortex flight tests. The wake was positioned relative to the airplane by Boeing to match the peaks and valleys in the FDR-recorded vertical acceleration data. The Safety Board modified Boeing’s lift and pitching moment coefficient wake deltas (preserving the locations of the peaks and valleys) to better match FDR vertical acceleration and pitch angle data. The original wake resulted in a full control wheel input at 1902:58.5, when the bank angle was about 15°. This result was judged to be an excessive response from a human performance standpoint. A wheel response range of 40 to 60° at that time was considered more realistic, so the wake rolling moment was modified to match a 60° wheel input. The yawing moment from the wake resulted from the encounters of the vertical stabilizer with the wake. The vertical stabilizer wake encounter at 1902:58.5 was extended by 0.10 second to facilitate a match with the FDR heading data. Similarly, the vertical stabilizer wake encounter at 1903:01.5 was extended by about 0.35 second.

Factual Information 90 Aircraft Accident Report Because a pilot exerting considerable force on the rudder pedals could alter the rudder blowdown limit that would result from the hydraulic actuator alone,168 the simulations also had to account for the estimated pilot rudder pedal force time history. This estimation was accomplished for the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident based on the physical characteristics of the flying pilot, available human performance research data, and CVR information. (See section 1.18.8 for further information.) The Safety Board used its computer simulation studies to evaluate a significant number of potential scenarios for the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident. The Safety Board also used Boeing’s kinematic results (flight control surface time histories) for USAir flight 427 in performing computer simulations to assess how well the Boeing heading (and pitch and roll) results matched the FDR data.169 Boeing used its kinematic results in performing its own computer simulations for Eastwind flight 517 and comparing the heading results with FDR data. All parties to the investigation had the opportunity to submit proposed accident scenarios. However, only Boeing submitted detailed simulations or studies. The Safety Board notes that Boeing may be one of the few entities in the world with the technological ability and knowledge of the 737 airplane to conduct the complex and sophisticated simulations that were used during this investigation to evaluate potential accident scenarios. Accordingly, the Safety Board assumed that the alternative scenarios provided by Boeing were the best alternatives that could be developed. The Safety Board therefore gave serious consideration to the scenarios submitted by Boeing for the USAir flight 427, United flight 585, and Eastwind flight 517 upset events. The results of the Safety Board’s best-match solutions170 from simulation studies and Boeing’s kinematic solutions are discussed in sections 1.16.6.1, 1.16.6.2, and 1.16.6.3 for the USAir flight 427 and the United flight 585 accidents and the Eastwind flight 517 incident, respectively. 171 1.16.6.1 USAir Flight 427 Simulation Studies USAir flight 427 was flying in calm air while making a left turn to a heading of 100°. About 1902:57, as the airplane was rolling toward wings level, it was experiencing 167 A heading gyro consists of a rotating gyro mounted inside two gimbals, and heading data is subject to gyro gimbal error. Heading is determined by the angle of the outer gimbal to the airplane body. Combinations of pitch, roll, and gyro rotor alignment introduce angle errors into the outer gimbal and produce predictable heading errors that can quantified and corrected. For a further description of gimbal error, refer to the Safety Board’s “Addendum to Eastwind Rudder Jam Study,” November 11, 1998. 168 During normal rudder operation, a considerable pilot force on the rudder pedals can result in the rudder moving beyond its blowdown limit based on hydraulic actuator force alone. However, in a rudder reversal situation, a considerable pilot force on the rudder pedals can reduce the blowdown limit. 169 The USAir flight 427 FDR recorded roll attitude twice per second and pitch attitude four times per second. 170 The Safety Board’s best-match solutions are the derived flight control surface position time histories that best match the recorded FDR data, radar data, and human performance information. 171 For additional information regarding the Safety Board’s simulation studies, see the Board’s “Rudder Jam Simulation Study,” dated January 27, 1998.

Factual Information 91 Aircraft Accident Report airspeed deviations and accelerations consistent with wake turbulence produced by the wake vortex of a Boeing 727.172 Within the next few seconds, USAir flight 427 rolled to about 20° of left bank, back to 15° left bank, and then farther to the left. The airplane entered an aerodynamic stall about 1903:08 and rolled more rapidly to the left. The Safety Board’s workstation-based flight simulator computer program for a 737-300 airplane was used to simulate the event. Input to the simulation for engine thrust was based on N1 (fan speed) data recorded on the FDR. As previously mentioned, the flight control surface position time histories needed for the computer simulations were not available from the FDR and had to be estimated or derived. The Board derived the elevator position time history from the control column position recorded by the FDR. The initial control wheel (aileron and spoilers) position inputs were based on kinematic solutions and were then derived by iteration. The Safety Board’s best-match simulation showed that, just after 1902:58, the wake vortex produced a nose left heading change. This simulation assumed that the flight crew responded to the nose left yawing motion with a right rudder pedal input about 1903:00. This scenario further assumed that the secondary slide was jammed to the servo valve housing and that the flight crew’s rudder pedal input resulted in a rudder motion reversal, with the rudder reaching its blowdown limit (about 12.5°) about 1903:00. Thus, the best-match simulation indicates that the initial wake vortex-related left yaw (and left heading change) was followed about 1 second later by movement of the rudder to its left blowdown limit, which resulted in a continuing left yaw/heading change. On the basis of these assumptions, rudder position time histories were developed for jams of the secondary slide to the servo valve housing at 100, 71, 50, and 22 percent from the neutral position.173 The rudder position, once reversed,174 was assumed to remain at the blowdown limit175 corresponding to a main rudder PCU servo valve jam at the 100-percent position (blowdown limit is partly dependent on jam position, airspeed, and 172 Evidence of the turbulence is reflected in the vertical acceleration and airspeed data recorded on the FDR. 173 For more information on the Safety Board’s USAir flight 427 rudder jam studies, see “Rudder Jam Simulation Study,” dated January 27, 1998, and “Addendum to Rudder Jam Simulation Study,” dated February 26, 1999. In addition, the “Kinematics Validation Study,” dated August 4, 1997, contains information regarding basic kinematics validation, curve fits, and simulation closure. 174 In a reversal scenario, the primary and secondary slides are misaligned to produce reverse flow and internal leakage, which creates a restricted flow and loss of pressure. Because of the reduced hydraulic pressure ported to (moving) the actuator in the overtravel situation, the 100-percent jam resulted in the rudder moving at a reduced rate of about 32° per second. 175 Rudder blowdown is the maximum rudder angle resulting from a pilot-commanded full rudder input under the existing flight conditions. It represents a balance between the aerodynamic forces acting on the rudder and the mechanical forces produced by the PCU. The maximum rudder angle can be increased (or decreased if the rudder reverses) beyond that produced by the hydraulic force if the pilot exerts sufficient force on the rudder pedals. Rudder blowdown was modeled in the simulation using Boeing data and equations that rigorously model the PCU from the valve input to rudder deflection. For the blowdown simulation, the valve input was set to full open (full commanded rudder), and provisions for pilot rudder pedal forces were added, which lower the blowdown angle in a reversal. The blowdown simulation was verified by comparing its output with Boeing’s blowdown rudder plots for several conditions based on a normally operating actuator and available flight test data.

Factual Information 92 Aircraft Accident Report sideslip angle) until 1903:08, about the time the airplane stalled. The timing of the rudder inputs was modified by iteration until the simulation produced heading time histories consistent with the FDR data. The heading data that resulted from the simulation with the secondary slide jammed to the servo valve housing at the 100-percent position matched the FDR heading data better than simulations with the secondary slide jammed at the other three positions. Control surface position data are presented for the 100-percent jam. The pilot rudder pedal force time history is shown in figure 18a.176 The rudder surface and control wheel positions are shown in figures 18b and 18c, and the resultant heading, bank angle, pitch angle, and vertical acceleration data, compared with the FDR data, are shown in figures 18d through 18g, respectively. 176 The Safety Board’s best-match simulation used 400 pounds of rudder pedal force reducing to 200 pounds, based on ergonomic and other research data (see section 1.18.8). However, the Safety Board was also able to match the USAir flight 427 FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds). Figure 18a. Pilot rudder pedal force for USAir flight 427. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 0 100 200 300 400 500 600 oh ya, Isee zuh jetstream sheez/zuh whoa soft grunting loud grunting sound similar to autopilot disconnect oh # Right USAir 427 Simulator Input 100% Jam Solution Pedal Force (lbs) Time (hr:min:sec)

Factual Information 93 Aircraft Accident Report Figure 18b. Rudder surface positions for USAir flight 427. Figure 18c. Control wheel positions for USAir flight 427. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -5 0 5 10 15 20 25 USAir 427 Simulator Input 100% Jam Solution Rudder (deg) Time (hr:min:sec) 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -20 0 20 40 60 80 100 oh ya, Isee zuh jetstream sheez/zuh whoa soft grunting loud grunting sound similar to autopilot disconnect oh # USAir 427 Simulator Input 100% Jam Solution Wheel (deg) Time (hr:min:sec)

Factual Information 94 Aircraft Accident Report Figure 18d. Heading data for USAir flight 427. Figure 18e. Bank angle data for USAir flight 427. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 20 30 40 50 60 70 80 90 100 110 120 USAir 427 Simulator Response to 100% jam FDR data Simulation Heading (deg) Time (hr:min:sec) 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -80 -70 -60 -50 -40 -30 -20 -10 0 10 20 oh ya, Isee zuh jetstream sheez/zuh whoa soft grunting loud grunting sound similar to autopilot disconnect oh # USAir 427 Simulator Response 100% Jam Solution FDR data Simulation Bank Angle (deg) Time (hr:min:sec)

Factual Information 95 Aircraft Accident Report Figure 18f. Pitch angle data for USAir flight 427. Figure 18g. Vertical acceleration data for USAir flight 427. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -30 -20 -10 0 10 oh ya, Isee zuh jetstream sheez/zuh whoa soft grunting loud grunting sound similar to autopilot disconnect oh # USAir 427 Simulator Response 100% Jam Solution FDR data Simulation Pitch Angle (deg) Time (hr:min:sec) 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0 2.2 USAir 427 Simulator Response 100% Jam Solution FDR data Simulation Vertical Load Factor - N z Time (hr:min:sec)

Factual Information 96 Aircraft Accident Report According to Boeing’s September 30, 1997, submission to the Safety Board,177 Boeing first improved its wake vortex model using the results of the wake vortex flight tests. Boeing then used its kinematics process to determine the flight control position time histories during the upset sequence of USAir flight 427. Boeing’s kinematic analysis required that the FDR heading data be curve fit using interpolation techniques178 and then run through data smoothing techniques. These various techniques resulted in numerous curves that could fit the USAir flight 427 FDR heading data.179 Boeing’s scenario assumed that, about 1902:58, the first officer input right control wheel (overriding the autopilot, which had been commanding some right control wheel) because of the continuing left acceleration that the wake vortex encounter produced. The first officer applied considerable right control wheel, which arrested the left roll and increased the right roll acceleration. Boeing’s scenario then assumed that a left rudder input occurred just after 1902:59, resulting in a left rudder movement of about 12° just before 1903:00. About 1903:00, the full right control wheel and the left rudder inputs were being returned to neutral (the left rudder deflection was reduced to about 3°), but the airplane was still in the effect of the wake, which was rolling the airplane to the left. To counter the left roll, the first officer again applied considerable right control wheel; however, the airplane continued to accelerate in a left roll. Boeing’s scenario also assumed that, between 1903:00 and 1903:01, the first officer again applied left rudder pedal pressure, driving the rudder hard to the left, and maintained the left rudder pedal input until ground contact.180 The rudder surface and control wheel position time histories resulting from Boeing’s kinematic analysis for this scenario are presented in figures 19 and 20, respectively. Further, the Safety Board used Boeing’s kinematically derived flight control position time histories as inputs in the Board’s computer simulation to derive heading, bank angle, pitch angle, and vertical acceleration data and compared these results with the FDR data. These results are presented in figures 21a through 21d, respectively. 177 Boeing first presented its kinematic analysis of the USAir flight 427 upset event in its “Submission to the National Transportation Safety Board for the USAir 427 Investigation,” dated September, 30, 1997. On October 31, 1997, Boeing presented the Safety Board with a refined version of its USAir flight 427 kinematic analysis. The Board used Boeing’s data from its later presentation for this report. 178 A variety of methods exist for curve-fitting data, including mathematical models such as the cubic spline, least squared polynomial, and fast Fourier transform techniques. Boeing used a technique that involved fitting the data manually. (This manual technique involved reviewing the data and providing a nonlinear fit between the FDR data points.) 179 See page 17 of Boeing’s “Submission Supplement USAir 737-300 accident near Pittsburgh,” dated September 30, 1997. 180 Page 49 of Boeing’s September 30, 1997, submission states that “from [just after stickshaker activation] until ground impact, the controls remained at full right wheel, full left rudder, and full aft column.”

Factual Information 97 Aircraft Accident Report Figure 19. USAir flight 427 rudder surface positions resulting from Boeing’s kinematic analysis. Figure 20. USAir flight 427 control wheel positions resulting from Boeing’s kinematic analysis. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -5 0 5 10 15 20 25 Nose Right Nose Left USAir 427 Simulator Input Boeing Kinematic Solution Rudder (deg) Time (hr:min:sec) 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -20 0 20 40 60 80 100 Left Right USAir 427 Boeing Kinematic Solution Simulator Input Wheel (deg) Time (hr:min:sec)

Factual Information 98 Aircraft Accident Report Figure 21a. Derived heading data for USAir flight 427 using Boeing’s kinematic analysis. Figure 21b. Derived bank angle for USAir flight 427 using Boeing’s kinematic analysis. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 20 30 40 50 60 70 80 90 100 110 120 USAir 427 Simulator Response to Boeing Solution FDR data Simulation Heading (deg) Time (hr:min:sec) 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -80 -70 -60 -50 -40 -30 -20 -10 0 10 20 Left Wing Down Right Wing Down USAir 427 Simulator Response to Boeing Solution FDR data Simulation Bank Angle (deg) Time (hr:min:sec)

Factual Information 99 Aircraft Accident Report Figure 21c. Derived pitch angle for USAir flight 427 using Boeing’s kinematic analysis. Figure 21d. Derived vertical acceleration data for USAir flight 427 using Boeing’s kinematic analysis. 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 -30 -20 -10 0 10 USAir 427 Simulator Response to Boeing Solution FDR data Simulation Pitch Angle (deg) Time (hr:min:sec) 19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0 2.2 USAir 427 Simulator Response to Boeing Solution FDR data Boeing Oct 31st solution Vertical Load Factor - Nz Time (hr:min:sec)

Factual Information 100 Aircraft Accident Report According to Boeing’s September 30, 1997, submission, three of the hypothetical system-related scenarios (a dual slide jam, a secondary slide jam with primary slide overtravel, and an input linkage jam) and one hypothetical flight crew input scenario evaluated during the investigation all “potentially fit a kinematic analysis.” However, with regard to the three hypothetical system-related scenarios, Boeing’s submission commented that “evidence does not support finding as probable cause.” Boeing’s submission further stated that “there is no evidence to support a conclusion that an uncommanded full rudder deflection occurred. While there is no evidence of a crew- commanded, sustained left-rudder input, such a possibility is plausible and must be seriously considered, especially given the lack of evidence of an airplane-induced rudder deflection.” 1.16.6.2 United Flight 585 Simulation Studies United flight 585 was flying in turbulent air while making a right turn to the final approach to Colorado Springs Municipal Airport. Strong winds aloft created complex airflow patterns that moved from west to east across the mountains located west of the airplane’s flightpath; these airflow patterns likely included strong turbulence, eddies, rotational flow fields, and crosswind shear. The FDR data showed that, as the airplane was descending through an altitude of about 1,000 feet agl and was about on track to approach the airport from the south (about 0943:32)181, its heading changed to the right. The airplane impacted the ground about 9 seconds later. The airplane’s orientation and flightpath angle at impact were near vertical. The airplane was aligned approximately 205° magnetic heading, and the ground track (as defined by the debris field) was about 020° magnetic heading.182 The Safety Board’s workstation-based simulator for a 737-200 airplane was used to simulate the event. The simulation process used available FDR data, radar data, and information on the accident location and airplane orientation at impact. Input to the simulation for engine thrust was based on engine sounds recorded on the CVR. The flight control surface position time histories needed for the simulation were not among the parameters recorded by the FDR and thus had to be estimated or derived. The control wheel (aileron and spoilers), rudder surface, and elevator position time histories used in each simulation were derived by iteration. The simulations assumed that the airplane encountered turbulence with a crosswind gust (perhaps associated with a mountain rotor).183 In the Safety Board’s best- match simulation that involved a rudder movement for this event, these winds produced a heading change and yaw rate to which the pilot was assumed to have responded (about 0943:32) with left rudder pedal input.184 This scenario further assumed that this input 181 All times in this subsection are mountain standard time, based on a 24-hour clock. 182 The heading and ground track were about 180° opposed because of the near-vertical flightpath angle. 183 The Safety Board considered several rotor scenarios in its studies, including moving rotors above, below and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s flightpath; and horizontal rotors that transitioned to vertical rotors along the airplane’s flightpath.

Factual Information 101 Aircraft Accident Report occurred while the main rudder PCU servo valve secondary slide was jammed to the servo valve housing, resulting in a rudder reversal to the right. The general wind field was derived by comparing the ground track from the radar data with the airspeed and heading data from the FDR. An approximation of a vertical gust profile was developed from the vertical load factor data. Crosswind gust components were also used in this best-match simulation. In this simulation, at 0943:21, when the airplane was nearly aligned with the landing runway, the airplane began to experience a significant heading change to the right. The simulation indicated that a right bank angle of about 30° was required to produce this heading change. The Safety Board determined that the heading change and the rolling moment that occurred after 0943:21 were likely the result of turbulence, and these data became the baseline for the turbulence models used in some of the Board’s simulations.185 Rudder position time histories were developed for jams of the secondary slide to the servo valve housing at 100, 71, 50, 40, and 30 percent from the neutral position. The rudder position, once reversed, was assumed to remain at the blowdown limit186 corresponding to a servo valve jam at the 100-percent position (blowdown limit is partly dependent on jam position, airspeed, and sideslip angle) for the duration of the reversal. The timing of the rudder inputs was modified by iteration until the simulation produced heading time histories consistent with the FDR data. The heading data that resulted from the simulation with the secondary slide jammed to the housing at 100 percent produced the Safety Board’s best-match with the FDR heading data.187 The pilot rudder pedal force, rudder surface, and control wheel time histories for the 100-percent jam are presented in figures 22a through 22c, respectively.188 The resultant heading, normal load factor, pitch angle, and bank angle data for the Safety Board’s 100-percent jam solution compared with the FDR data are presented in figures 22d through 22g, respectively. Roll and yaw rate, two parameters pertinent to human 184 The complete data sets for this and other scenarios can be found in the Safety Board’s “United flight 585 Simulation Study,” dated October 19, 1998, and the Board’s “Addendum to Simulation Study,” dated February 23, 1999. 185 The 100-percent jam scenario does not include the rotational eddy from the turbulence model; the 30-percent jam (which is not presented in this report) does include the eddy. 186 Because of fire damage to the United flight 585 PCU, the Safety Board was unable to perform laboratory tests to determine the rudder deflection rate and the hinge moment capability of the PCU with the secondary slide jammed at various positions from neutral. Therefore, data from the USAir flight 427 PCU servo valve tests in which the secondary slide was jammed at 71, 50, and 22 percent from neutral were used. Data from the Eastwind flight 517 PCU servo valve tests were not used because that servo valve had a leaky bypass valve. 187 Because of the reduced hydraulic pressure ported to the actuator in the overtravel situation, this 100-percent jam would result in the rudder moving at a reduced rate of about 32° per second to the reduced blowdown limit. 188 The Safety Board’s best-match simulation used 300 pounds of force reducing to 200 pounds, based on ergonomic and other research data (see section 1.18.8). The Safety Board was also able to match the United flight 585 FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds).

Factual Information 102 Aircraft Accident Report performance, are presented in the figures 22h and 22i, respectively, for the 100-percent jam case. CVR data are presented on figures 22f, 22g, and 22i to correlate verbal responses of the pilots to simulated pitch angle, bank angle, and yaw rate, respectively. Wind direction and horizontal and vertical windspeeds used in the Safety Board’s best- match scenario are presented in figures 22j through 22l, respectively. Figure 22a. Pilot rudder pedal force positions for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -500 -450 -400 -350 -300 -250 -200 -150 -100 -50 0 50 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Input Left Right Pedal Force (lbs) Time (hr:min:sec)

Factual Information 103 Aircraft Accident Report Figure 22b. Rudder surface positions for United flight 585. Figure 22c. Control wheel positions for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -30 -25 -20 -15 -10 -5 0 5 10 15 20 25 30 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Input Nose Left Nose Right Equivalent Rudder (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -100 -80 -60 -40 -20 0 20 40 60 80 100 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Input Left Right Equivalent Wheel (deg) Time (hr:min:sec)

Factual Information 104 Aircraft Accident Report Figure 22d. Heading data for United flight 585. Figure 22e. Normal load factor data for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 300 310 320 330 340 350 360 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response FDR points Simulation Heading (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response FDR data Simulation Normal Load Factor (G's) Time (hr:min:sec)

Factual Information 105 Aircraft Accident Report Figure 22f. Pitch angle data for United flight 585. Figure 22g. Bank angle data for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -90 -80 -70 -60 -50 -40 -30 -20 -10 0 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Pitch Angle (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -180 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 180 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Left Right Bank Angle (deg) Time (hr:min:sec)

Factual Information 106 Aircraft Accident Report Figure 22h. Roll rate for United flight 585. Figure 22i. Yaw rate for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -10 0 10 20 30 40 50 60 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Body Axis Roll Rate - pb (deg/sec) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -15 -10 -5 0 5 10 15 20 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Body Axis Yaw Rate - rb (deg/sec) Time (hr:min:sec)

Factual Information 107 Aircraft Accident Report Figure 22j. Wind direction for United flight 585. Figure 22k. Horizontal windspeeds for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 220 230 240 250 260 270 280 290 300 310 320 UAL 585 Simulator Study 100% Secondary Slide Jam Wind Direction (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0 10 20 30 40 50 60 70 UAL 585 Simulator Study 100% Secondary Slide Jam Wind Speed (kts) Time (hr:min:sec)

Factual Information 108 Aircraft Accident Report One of the Safety Board simulation scenarios that produced a good match with the FDR data and other physical evidence assumed a sustained equivalent control wheel input to the right with no rudder input. The equivalent control wheel input could represent a pilot command, a rotational wind, or a combination of the two. Figures 23a through 23g show the resultant data for rudder surface and control wheel positions and heading, normal load factor, calibrated airspeed, pitch angle, and bank angle data, respectively. Figures 23f and 23g also show CVR data. Figure 22l. Vertical windspeeds for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -15 -10 -5 0 5 10 15 20 UAL 585 Simulator Study 100% Secondary Slide Jam Vertical Wind Speed (kts - positive down) Time (hr:min:sec)

Factual Information 109 Aircraft Accident Report Figure 23a. Rudder surface positions for United flight 585 assuming a sustained equivalent control wheel input. Figure 23b. Control wheel surface positions for United flight 585 assuming a sustained equivalent control wheel input. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -25 -20 -15 -10 -5 0 5 10 15 20 25 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Input Nose Left Nose Right Equivalent Rudder (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -100 -80 -60 -40 -20 0 20 40 60 80 100 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Input Left Right Equivalent Wheel (deg) Time (hr:min:sec)

Factual Information 110 Aircraft Accident Report Figure 23c. Heading data for United flight 585 assuming a sustained equivalent control wheel input. Figure 23d. Normal load factor for United flight 585 assuming a sustained equivalent control wheel input. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -15 -10 -5 0 5 10 15 20 UAL 585 Simulator Study 100% Secondary Slide Jam Vertical Wind Speed (kts - positive down) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response FDR data Simulation Normal Load Factor (G's) Time (hr:min:sec)

Factual Information 111 Aircraft Accident Report Figure 23e. Calibrated airspeed for United flight 585 assuming a sustained equivalent control wheel input. Figure 23f. Pitch angle data for United flight 585 assuming a sustained equivalent control wheel input. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 140 160 180 200 220 240 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response FDR data Simulation Vcas (Kts) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -90 -80 -70 -60 -50 -40 -30 -20 -10 0 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response Pitch Angle (deg) Time (hr:min:sec)

Factual Information 112 Aircraft Accident Report In a June 23, 1997, letter to the Safety Board, Boeing provided its analysis of the United flight 585 accident.189 Boeing’s analysis concluded that a rudder hardover scenario did not fit the FDR data and that a “new rotor model” did match the data.190 Further, Boeing derived this new rotor model to match the available data and introduced a rotational effect of near zero just before 0943:28, which increased linearly to about 0.4 radians per second just before 0943:29 and then increased linearly to about 1.8 radians per second about the time the airplane impacted the ground (just before 0943:42). Boeing’s simulation using its new rotor model produced the data shown in figures 24a through 24g for rudder surface positions, windshear, control wheel positions, heading, bank angle, normal load factor, and pitch angle, respectively. As shown in figure 24c, Boeing’s simulation assumed a left control wheel input by the flight crew just after 0943:30. Figure 23g. Bank angle data for United flight 585 assuming a sustained equivalent control wheel input. 189 Boeing’s analysis was resubmitted to the Safety Board in a September 14, 1998, letter. 190 According to Boeing, “the new rotor model is significantly different from that evaluated during the original [United flight] 585 investigation. The original [rotor] model was a solid rotating core of air with a distinct boundary. This meant that the air at the outside edge of the core was at a very high velocity for large cores with high rotational velocity. [Boeing’s new rotor] model is not a solid rotating body, but has a velocity profile which varies significantly as the distance from the center core increases. The model was developed based on a simulation of the weather conditions that existed in the Colorado Springs area on the day of the accident.” 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response Left Right Bank Angle (deg) Time (hr:min:sec)

Factual Information 113 Aircraft Accident Report Figure 24a. United flight 585 rudder surface positions according to Boeing’s new rotor model. Figure 24b. Rotational windshear encountered by United flight 585 according to Boeing’s new rotor model. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -25 -20 -15 -10 -5 0 5 10 15 20 25 Boeing Simulation Match UAL585 Rudder (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 Boeing Simulation UAL585 P Shear (rad/sec) Time (hr:min:sec)

Factual Information 114 Aircraft Accident Report Figure 24c. United flight 585 control wheel positions according to Boeing’s new rotor model. Figure 24d. United flight 585 heading data according to Boeing’s new rotor model. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 Boeing Simulation Match UAL585 Wheel (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 300 310 320 330 340 350 360 Boeing Simulation Match UAL585 Simulation FDR Points Heading (deg mag) Time (hr:min:sec)

Factual Information 115 Aircraft Accident Report Figure 24e. United flight 585 bank angle data according to Boeing’s new rotor model. Figure 24f. United flight 585 normal load factor data according to Boeing’s new rotor model. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -180 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 180 Boeing Simulation Match UAL585 Bank Angle (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 Boeing Simulation Match UAL585 Simulation FDR Data Normal Load Factor (G's) Time (hr:min:sec)

Factual Information 116 Aircraft Accident Report 1.16.6.3 Eastwind Flight 517 Simulation Studies Pilot statements and data from Eastwind flight 517 indicated that the airplane was flying in relatively calm air191 when it rolled and yawed to the right. The event lasted about 13 seconds. Postincident investigation revealed that the airplane’s yaw damper had been rigged incorrectly so that the neutral point of the rudder would be 1.5° to the left if the rudder trim knob were set to zero. Ground tests and measurements indicated that, in this incorrectly rigged condition, a yaw damper hardover would move the rudder an additional 1.5° to the left or 4.5° toward the right. Flight tests conducted in the Eastwind flight 517 airplane indicated that compliance within the rudder system would reduce the right yaw damper authority from 4.5 to 3.7° (± 0.25° error band) right during the flight conditions at the time of the upset. The Safety Board’s workstation-based simulator for a 737-200 airplane was used to simulate the events. Input to the simulation for engine thrust was based on data recorded on the FDR. The flight control surface position time histories needed for the simulations were not among the parameters recorded by the FDR and thus had to be estimated or derived. With the use of a detailed Boeing elevator model, the elevator input was derived from the control column position recorded by the FDR. The control wheel (aileron and spoilers) position input time histories were initially estimated from a kinematic analysis; the final control wheel position time histories were derived by iteration. Figure 24g. United flight 585 pitch angle according to Boeing’s new rotor model. 191 Although the Eastwind flight 517 FDR data showed that the flight was mostly smooth, there were two positive spikes in the vertical load factor of about 1.2 Gs about 45 and 5 seconds before the event. There were coincident signatures in the longitudinal load factor data. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -90 -80 -70 -60 -50 -40 -30 -20 -10 0 Boeing Simulation Match UAL585 Pitch Angle (deg) Time (hr:min:sec)

Factual Information 117 Aircraft Accident Report For the rudder position time history input in the Safety Board’s best-match simulation, the rudder was assumed to have been trimmed to its zero position at some time before the roll and yaw event to compensate for the yaw damper offset. (This action would result in the trim knob being positioned about 1.5° to the right, which is the position where the trim knob was discovered during postincident cockpit documentation.) The Safety Board’s best-match simulation also assumed a rudder input similar to a yaw damper hardover to the right followed by a left rudder pedal input by the pilots to counter the yaw from this rudder input. The Board’s simulation scenario then assumed that a rudder reversal occurred as a result of the left rudder pedal input while the PCU servo valve secondary slide was jammed to the servo valve housing. Rudder position time histories were developed for a number of different conditions, including jams of the secondary slide to the servo valve housing at 100, 71, 55, 43, and 30 percent from the neutral position. The rudder position, once reversed, was assumed to remain at the jam-reduced blowdown limit (which is partly dependent on jam position within the servo valve, airspeed, and sideslip angle) for about 13 seconds, consistent with the period of heading shift recorded by the Eastwind flight 517 FDR during the incident. The timing of the rudder inputs was modified by iteration until the simulation produced heading time histories consistent with the FDR data. The simulation assumed that, consistent with flight crew reports, the rudder PCU servo valve became unjammed at some point, enabling the captain to regain control of the airplane. Because there was no evidence of the rudder position after the captain regained control of the airplane, the Safety Board considers its simulation to be meaningful only until 2210:42. This time is also when Boeing terminated the data in its simulations that were presented in its August 14, 1998, submission supplement.192 The heading data that resulted from the simulation with the secondary slide jammed to the servo valve housing at the 55-percent position provided the best-match with the FDR heading data. 193 This scenario assumed that the rudder pedal input resulted in a rudder reversal and rudder movement194 to the (reduced) blowdown limit (6.5°) corresponding to the 55 percent jam.195 Figure 25a shows the right and left EPR settings recorded by the FDR and those used in the Safety Board’s simulations. The control wheel, pilot rudder pedal force, and rudder surface time histories for a 55-percent jam are shown in figures 25b through 25d, respectively. The resultant roll angle, vertical acceleration, and 192 See Boeing’s “Submission Supplement USAir 737-300 Accident Near Pittsburgh,” dated August 14, 1998. 193 The Safety Board’s best-match simulation used 500 pounds of force reducing to 250 pounds, then gradually reducing to 0 pounds, based on ergonomic and other research data (see section 1.18.8). The Safety Board was also able to match the Eastwind flight 517 FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds). 194 Because of the reduced hydraulic pressure ported to the actuator in the overtravel situation, this 55-percent jam would result in the rudder moving at a reduced rate of about 15° per second. 195 For data related to other jam scenarios, refer to the Safety Board’s “Eastwind Rudder Jam Study,” dated June 5, 1998; its “Addendum to Eastwind Rudder Jam Study,” dated November 11, 1998; and its “Addendum 2 to Eastwind Rudder Jam Simulation Study,” dated February 18, 1999.

Factual Information 118 Aircraft Accident Report heading data, compared with the FDR data, are shown in figure 25e through 25g, respectively. Figure 25h shows the simulator heading, corrected for gimbal error, compared with the FDR-recorded heading data for a family of gyro gimbal spool-up angles for the 55-percent jam case. Yaw and roll rates (parameters pertinent to human performance) are presented in figures 25i and 25j, respectively, for the 55-percent jam case. Figure 25a. Right and left EPR settings for Eastwind flight 517. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 0.7 0.8 0.9 1.0 1.1 1.2 1.3 1.4 Eastern Daylight Time (HH:MM:SS) Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release FDR Right EPR Simulation Right EPR FDR Left EPR Simulation Left EPR EPR right

Factual Information 119 Aircraft Accident Report Figure 25b. Control wheel positions for Eastwind flight 517. Figure 25c. Pilot rudder pedal force for Eastwind flight 517. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -80 -70 -60 -50 -40 -30 -20 -10 0 10 20 30 40 50 60 70 80 Eastern Daylight Time (HH:MM:SS) Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Left Right Effective Wheel (deg) 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -650 -600 -550 -500 -450 -400 -350 -300 -250 -200 -150 -100 -50 0 50 Eastern Daylight Time (HH:MM:SS) Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release pedal force, lb

Factual Information 120 Aircraft Accident Report Figure 25d. Rudder surface positions for Eastwind flight 517. Figure 25e. Roll angle data for Eastwind flight 517. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 Eastern Daylight Time (HH:MM:SS) Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Nose Left Nose Right Effective Rudder (deg) 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -20 -15 -10 -5 0 5 10 15 20 Eastern Daylight Time (HH:MM:SS) Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Left Right FDR Data Simulation Roll Angle (deg)

Factual Information 121 Aircraft Accident Report Figure 25f. Normal acceleration data for Eastwind flight 517. Figure 25g. Heading data for Eastwind flight 517. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 0.7 0.8 0.9 1.0 1.1 1.2 1.3 1.4 1.5 Eastern Daylight Time (HH:MM:SS) Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release FDR data Simulation Normal Acceleration - Nz (G's) 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 230 235 240 245 250 Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Eastern Daylight Time (HH:MM:SS) FDR Simulation Heading (deg)

Factual Information 122 Aircraft Accident Report Figure 25h. Heading data corrected for gimbal error for Eastwind flight 517. Figure 25i. Yaw rate for Eastwind flight 517. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 230 235 240 245 250 Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Gimbal Error Corrected Indicated Heading 0 deg spool-up 15 deg spool-up 30 deg spool-up 45 deg spool-up 60 deg spool-up 75 deg spool-up 90 deg spool-up 105 deg spool-up 120 deg spool-up 135 deg spool-up 150 deg spool-up 165 deg spool-up 180 deg spool-up FDR data Indicated Heading (deg) Eastern Daylight Time (HH:MM:SS) 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -10 -5 0 5 10 Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Left Right Body Axis Yaw Rate - rb (deg/sec) Eastern Daylight Time (HH:MM:SS)

Factual Information 123 Aircraft Accident Report Boeing’s August 14, 1998, submission supplement presented four scenarios for the Eastwind incident that were evaluated using Boeing’s kinematic analysis and computer simulations.196 In its submission supplement, Boeing suggested that one of its scenarios (number 4) was most consistent with the physical evidence, pilot reports, and kinematic analysis. Scenario 4 involves a preexisting yaw damper hardover condition that resulted in a rudder surface movement to 3° to the right, which the pilots compensated for with 3° of left rudder trim. According to this scenario, the yaw damper hardover condition cleared itself at the beginning of the upset event (about 2210:28), resulting in a sudden rudder movement to 3.7° to the left197 and prompting a right rudder input (just after 2210:28) by the pilot(s), which resulted in the rudder moving to 6° to the right. In a February 19, 1999, letter to the Safety Board, Boeing provided “the results and analysis of a flight test…in support of conclusions made in [scenario 4 of Boeing’s submission supplement].” Boeing’s letter included a rudder plot that demonstrated a pilot rudder pedal response within ¼ second after the yaw damper hardover condition cleared (see figures 26a through 26c). Figure 25j. Roll rate for Eastwind flight 517. 196 According to Boeing’s submission supplement, scenario 1 involved a preexisting left yaw damper hardover with a subsequent right yaw damper hardover, followed by a small nose-right rudder pedal input; scenario 2 involved a right yaw damper hardover with a servo valve secondary slide jam and reversal; scenario 3 involved a preexisting left yaw damper hardover with a subsequent right yaw damper hardover, plus a secondary slide jam and reversal; and scenario 4 involved a preexisting right yaw damper hardover that subsequently cleared, and the resultant yaw damper movement prompted a right rudder pedal input. 197 The 3.7° left rudder position occurred because of the previous left rudder trim, the misrigged LVDT (see section 1.16.1.2), and compliance within the airplane’s rudder system. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -15 -10 -5 0 5 10 15 Eastwind Event 55% Jam Simulation with rudder round-over varying left pedal force input & subsequent release Left Right Body Axis Roll Rate - pb (deg/sec) Eastern Daylight Time (HH:MM:SS)

Factual Information 124 Aircraft Accident Report Figure 26a. Eastwind flight 517 heading data according to Boeing’s scenario. Figure 26b. Eastwind flight 517 pilot rudder pedal force according to Boeing’s scenario. 22:10:25.00 22:10:30.00 22:10:35.00 234 235 236 237 238 239 240 241 242 Eastwind Event Boeing Solution from fig 4 of February 24, 1999 letter FDR data Boeing Heading Solution Heading (deg) Time (hr:min:sec) 22:10:28.00 22:10:29.00 22:10:30.00 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 Nose Left Nose Right Eastwind Event Boeing Solution from fig 4 of February 24, 1999 letter Rudder Pedal (deg) Time (hr:min:sec)

Factual Information 125 Aircraft Accident Report In Boeing’s scenario, the pilots subsequently maintained the pressure on the right rudder pedal and used left control wheel and differential engine power to maintain directional control until the roll and yaw event ended. Boeing’s August 1998 submission supplement stated the following regarding scenario 4: The airplane rolls to the left during the initiation of the event and matches the heading very closely…. This scenario correlates with the reported nearly simultaneous input of rudder and wheel during the recovery…. [The captain’s] usage of significant rudder input…is consistent with the manner in which [he] used rudder…during flight testing. The [captain’s] stiff rudder comment may have been caused by the lack of expected airplane response to the significant rudder pedal input made by the pilot. The only significant discrepancy with the pilot report is the direction of his pedal command and his report that there was no yaw to the left. Boeing’s submission supplement also stated that “the yaw damper hardover and recovery proposed in scenario 4 does match the flight data recorder information.” According to Boeing’s scenario 4, the yaw damper would have been active after the yaw damper hardover cleared at the beginning of the upset event. Boeing’s estimated rudder, yaw damper response, and rudder command is shown in figures 27a, and Boeing’s estimated rudder with pilot command and no yaw damper activity is shown in figure 27b. Figure 26c. Eastwind flight 517 rudder positions according to Boeing’s scenario. 22:10:28.00 22:10:29.00 22:10:30.00 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 Eastwind Event Boeing Solution from fig 4 of February 24, 1999 letter Rudder (deg) Time (hr:min:sec)

Factual Information 126 Aircraft Accident Report Figure 27a. Boeing’s kinematic rudder for Eastwind flight 517 and rudder with pilot command and yaw damper activity. Figure 27b. Boeing’s kinematic rudder for Eastwind flight 517 with pilot command and no yaw damper activity. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -8 -6 -4 -2 0 2 4 Eastwind Boeing Kinematic Analysis Fig 11, May 12, 1998 presentation Kinematic Rudder Rudder with pilot command & Yaw damper Rudder (deg) Time (hr:min:sec) 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00 -8 -6 -4 -2 0 2 4 Eastwind Boeing Kinematic Analysis Fig 11, May 12, 1998 presentation Pilot Command Rudder (deg) Time (hr:min:sec)

Factual Information 127 Aircraft Accident Report Figure 28a presents the rudder time history that resulted from Boeing’s kinematic analysis of scenario 4. The heading time history that Boeing derived from its kinematically developed rudder (uncorrected for what Boeing has determined to be a simulator heading error) and used in its computer simulations is shown in figure 28b. Figure 28c shows the average flight test heading error, and 28d presents the “error corrected” heading time history compared with the FDR heading data. Figure 28a. Eastwind flight 517 rudder positions according to Boeing’s scenario. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 -10 -5 0 5 10 Eastwind Event Boeing Solution from fig 16 of August 14, 1998 submittal Nose Left Nose Right Time (hr:min:sec) Effective Rudder (deg)

Factual Information 128 Aircraft Accident Report Figure 28b. Eastwind flight 517 heading data according to Boeing’s scenario. Figure 28c. Eastwind flight 517 average flight test heading error according to Boeing’s scenario. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 230 235 240 245 250 Eastwind Event Boeing Solution from fig 16 of August 14, 1998 submittal FDR data Boeing Heading Curve fit Heading Heading (deg) Time (hr:min:sec) 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 -10 -5 0 5 10 Eastwind Event Boeing Solution from fig 16 of August 14, 1998 submittal Time (hr:min:sec) Heading Errro (deg)

Factual Information 129 Aircraft Accident Report Boeing’s submission supplement concluded that “multiple scenarios have been identified that match at least some of the data and crew reports from the Eastwind 517 event. None of the scenarios fully match all the data, kinematic analysis, and crew reports.” The submission supplement also included Boeing’s belief that, “...under the NTSB standard for identifying ‘probable cause,’ there is insufficient data to find a ‘probable cause’ for this event.” 1.16.7 Identification of CVR Sounds/Sound Spectrum Analysis During the examination of the CVR recording from the USAir flight 427 airplane, the CVR Group members noted several sounds that occurred during the initial upset and descent into terrain that they were initially unable to identify or explain. These sounds were as follows: • sound similar to three thumps (at 1902:56.547, 1902:56.72, and 1902:56.855); • sound of electrical impulse recorded on the captain’s radio channel (at 1902:56.9); • sound of two thumps (at 1902:58.2 and 1902:59.2); • sound similar to airplane engines increasing in loudness (at 1902:58.27); • sound of “clickety click” (at 1902:58.6 and 1902:59.5); and • sound of wailing horn (at 1903:02.1). Figure 28d. Eastwind flight 517 corrected heading according to Boeing’s scenario. 22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 230 235 240 245 250 Eastwind Event Boeing Solution from fig 16 of August 14, 1998 submittal FDR data Boeing Heading Curve fit Sim Heading minus sim heading error Heading (deg) Time (hr:min:sec)

Factual Information 130 Aircraft Accident Report To identify the sources of the sounds, the Safety Board examined the recording on a spectrum analyzer, which gives a visual presentation of the frequency content of the signals, and a computer signal analyzer, which allows detailed analyses of the analog waveform, frequency content, and detailed timing information. (Additionally, at Boeing’s request, the Safety Board’s Sound Spectrum Group conducted an additional review of the CVR sounds with Boeing flight test and system design engineers participating; no additional information was gained as a result of this review.) When Safety Board investigators compared the CVR sounds from USAir flight 427 with CVR sounds obtained from known in-flight explosions, no similarities were noted. The Safety Board also provided the original CVR recording to the FBI’s forensic audio laboratory in Quantico, Virginia, which examined the recording to identify any unusual sounds or signatures that might be associated with criminal or terrorist activity. The laboratory discovered no sounds that appeared to result from explosions, gun shots, or any other identifiable acts of violence. 1.16.7.1 Sounds Similar to Thumps (Three Initial Thumps Within 1 Second and Two Subsequent Thumps About 1 Second Apart) Beginning at 1902:56.5, the accident airplane’s CVR recorded a sound on the CAM channel, which investigators characterized as similar to three thumps within 1 second. Simultaneously, the CVR recorded an electrical impulse (when plotted, this impulse showed itself as a voltage spike) on the captain’s channel (see section 1.16.7.2). These sounds were followed by two additional thump sounds, about 1902:58.2 and 1902:59.2. Examination of the entire 31-minute CVR recording revealed that the CVR had not recorded anything similar to the thump sounds during the previous 30½ minutes. Examination of each of the thump sounds using the spectrum analyzer and computer signal analyzer revealed that the sounds exhibited frequency signatures with most of their energy in the low-frequency (below 500 Hz) range. The “impulse” type of sound that is usually formed when two hard surfaces strike each other contains energy distributed equally through a large range of frequencies. Because investigators were initially unable to identify the source of these thump sounds, and because of the circumstances of the accident, the Safety Board devised a test to document the effects (and sounds) of rudder cable(s) breaking. As previously discussed, the sounds recorded by the CVR during these tests were impulsive in nature, with energy distributed throughout the frequency spectrum. (See section 1.16.5.2 for details of the rudder cable break tests.) Because the sounds were recorded by both the CAM and the jumpseat/observer channels of the CVR, indicating that the sounds could have been transmitted to those microphones through the air and/or through the airplane’s metal structure, the Safety Board conducted tests to derive the source and relationship of the thump sounds. A test 737-300 was configured to represent the accident airplane’s condition at the time the thump sounds were recorded: the cabin and cockpit doors were closed, the jumpseat/ observer position oxygen mask was stowed properly,198 the CAM was positioned in the same location as in the accident airplane, and two crew microphones were used. 199

Factual Information 131 Aircraft Accident Report Investigators then struck the airplane structure at various locations (inside and outside) with a rubber mallet and moved/bumped service equipment within the cabin, with the CVR recording the resultant sounds. Examination of the CVR recording from the tests revealed that the rubber mallet impact sounds were recorded by each microphone as two distinct events; in both cases, the first recorded event was the sound transmitted through the airplane structure, and the second was the sound that was transmitted through the air. The time difference between the recorded sounds for any given mallet strike corresponded directly to the distance between the microphone and the location of that mallet strike. Further, investigators noted that the sound signals would arrive first at the microphone closest to the mallet strike. Thus, it was possible to calculate the approximate distance and direction to the source of the sounds. Reexamination of the thump sounds recorded by the accident CVR, in relation to the sounds recorded by the CVR recording from the tests, revealed that the accident CVR recorded sounds consistent with a sound from a source approximately 12 to 16 feet back from the CAM (corresponding to the fuselage area about the location of passenger seat row 1 or 2). Although the rubber mallet strike tests could duplicate the timing of the thump sounds, the sound signatures produced during the tests (whether from mallet strikes, jumping in the cabin, or movement of cabin service equipment) were distinctly different from those recorded by the accident CVR. The pilots who participated in the wake turbulence encounter test flights reported that, under some flight test conditions, they heard sounds in the cockpit that they associated with the wake turbulence encounters. The pilots described the sounds as “whooshing” sounds and stated that they were usually heard during the test conditions in which the main fuselage passed through the center of the wake core. The Sound Spectrum Group compared the CVR sounds from USAir flight 427 with the CVR sounds recorded during the wake turbulence flight tests and noted that the sounds recorded during some of the wake encounters were very similar in frequency, energy, and timing to the thumps recorded by the accident CVR. 1.16.7.2 Sound of Electrical Impulse Recorded on the Captain’s Radio Channel At 1902:56.9, an electrical impulse (a voltage spike) of unknown origin was recorded on the captain’s radio channel. The duration of the voltage spike was measured to be 0.0068 seconds. Further examination of the voltage spike revealed that it was composed primarily of two frequencies (2818 and 400 Hz) superimposed on one another. Safety Board investigators subjected a representative CVR installation to a test series of 198 For additional information regarding the jumpseat/observer position oxygen mask, see section 1.11.1. 199 The thump sounds on the accident airplane’s CVR were not recorded on either pilots’ channel. Investigation revealed that both pilots wore headsets with boom microphones that were wired “hot” to the CVR. According to the manufacturer, the microphones were designed to pick up voice frequencies and suppress most background noises. Further, the microphones would not be sensitive to sounds transmitted through the airplane structure because they were isolated from the structure by the human body.

Factual Information 132 Aircraft Accident Report disturbances, including electrical field, magnetic field, induced voltage spike, radio frequency susceptibility, over- and undervoltage transients, power interruptions, and high voltage induced transients (simulating lightning strikes). The CVR recording from the test revealed that, although some of the test conditions induced voltage spikes and noise on the CVR recording, none of the spikes resembled the voltage spike recorded by the accident CVR. However, during the testing, investigators noted that activation of a radio/intercom selector switch in the intercom position produced a voltage spike nearly identical to the spike recorded by the accident CVR. The spring-loaded radio/intercom selector switch on the radio selector panel is located outboard of the pilots’ knees in the cockpit. 1.16.7.3 Sound Similar to Airplane Engines Increasing in Loudness A review of the sound signatures associated with the rotating engines recorded by USAir flight 427’s CVR revealed that, throughout the 31-minute CVR recording, the engine’s sound signatures changed in frequency as the engine speed increased or decreased200 but remained constant in intensity (volume). During the upset sequence, the CAM channel of the accident CVR also recorded variations in the volume of the sound signatures associated with the engines. The sound spectrum study indicated that, at 1902:58.27 and 1903:02.3, the sounds on the CVR recording that were associated with both engines simultaneously increased in volume by about 30 percent; at the same time, the frequency of the engine sound signatures, and the volume of all other background noises, remained constant. The first increase signature occurred about 0.17 seconds after the first thump in the second set of thump sounds; the second increase occurred about 1 second later, just before the captain exclaimed “hang on.” Although FDR data indicated that the engine power settings changed during the accident sequence,201 the engine sounds (when identifiable) remained at the increased volume throughout the remainder of the CVR recording. The Safety Board attempted to determine why the volume of the engine sound signatures increased in a manner that did not correspond to FDR-recorded changes in engine power setting during the upset sequence. The Board considered the following possibilities: the ability of the CVR recording system to pick up these sounds had increased; the sound transmission path between the engines and the CVR area microphone had changed; and the amount of engine inlet fan noise had increased. The Safety Board could not identify any physical or electrical phenomena that would account for an increase in the ability of the CVR recording system to record the volume of the engine sound signatures, while sound signatures at all other frequencies remained unchanged, as they did in the accident airplane’s CVR recording. The engine noise volume increase affected 200 Examination of these sound signatures revealed two distinct traces, one being slightly higher in frequency than the other. Review of the FDR data revealed that the right engine fan speed (N1) was operating at 1 to 3 percent higher revolutions per minute than the left engine fan speed. This difference coincided with the difference in engine fan speeds calculated from the CVR engine sound signatures. 201 The FDR data indicated that, after a brief increase in engine power setting at 1903:02, the engine power settings began to decrease from the peak power setting recorded during the accident sequence (about 80 percent N1); by 1903:09, the engine power settings had decreased to about 30 percent N1, at which point they remained until ground impact.

Factual Information 133 Aircraft Accident Report both engines equally and symmetrically, and the accident CVR did not record an increase in background wind noise. In other accident investigations,202 the Safety Board observed that a change in the engines’ sound transmission path because of a change in the airplane’s structure (loss of a fuselage panel or a cabin door opening in flight) was accompanied by a dramatic increase in background wind noise. No such increase in background wind noise was recorded by the USAir flight 427 CVR. The Safety Board’s review of CVR information from previous investigations yielded several occurrences (such as a bird strike or a loss of engine cowling structure) that affected the amount of inlet fan noise that one of the engines produced. However, these occurrences on previous accidents did not affect both engines equally and simultaneously. Safety Board investigators also examined a representative sample of the CVR recordings from the wake vortex flight tests203 (discussed in section 1.16.2) in an attempt to identify any potential relationship between crossing a wake vortex and the engine sound signature recorded by the CVR. None of the sampled CVR recordings showed any significant change in the engine sound signatures as a result of the wake encounters. During a series of flight tests on the 737-300 conducted by the Safety Board in September 1995 to evaluate flight control characteristics and validate and expand Boeing’s 737 mathematical simulator model, the instrumented airplane was subjected to several full rudder deflection and maximum rate aileron roll maneuvers. During postflight examination of the audio recordings from these flights, Safety Board investigators observed that, during some of the maneuvers, the engine sound signatures increased in volume, similar to the volume increases that were observed on the accident CVR recording. The airplane maneuvers that resulted in such changes to the engine sound signatures included large rudder displacements (both right and left) at various angles and rates in which flight test pilots utilized opposite aileron to limit rudder-induced bank angle (steady heading sideslip) and rudder-only flight control input (both right and left) at various rudder displacement angles and rates. The test maneuvers in which large and rapid rudder displacements were applied resulted in the greatest change in engine sound signature intensity. When the CVR recordings from the flight tests were compared with the CVR recording from the USAir flight 427 airplane, the best match was with the flight test condition involving rapid rudder input from 0 to 14° rudder. 202 See National Transportation Safety Board. 1990. Aloha Airlines Flight 243, In-flight Structural Failure, near Maui, Hawaii, April 28, 1988. Aircraft Accident Report NTSB/AAR-89/03. Washington, DC. Also see National Transportation Safety Board. 1990. United Airlines Flight 811, In-Flight Cargo Door Separation, near Honolulu, Hawaii, February 24, 1989. Aircraft Accident Report NTSB/AAR-90/01. Washington, DC. 203 Fourteen encounters were selected for this examination; these selections were considered representative of wake vortex penetrations from all the various entry angles and trailing distances behind the wake-producing airplane.

Factual Information 134 Aircraft Accident Report 1.16.7.3.1 Comparison of Engine Sound Signatures From the United Flight 585 CVR and a CVR From 737-200 Flight Tests Because of the Safety Board’s findings (discussed in section 1.16.7.3) that certain sideslip and yaw maneuvers in a 737-300 could result in changes in engine sound signatures, investigators next attempted to determine whether such maneuvers in a 737-200 would result in similar changes in engine sound signatures and, if so, whether any such changes could be discerned on the United flight 585 CVR. 204 According to Boeing, the overall geometry and proportions of the 737-200 and -300 series fuselages are very similar; however, the airplanes are equipped with significantly different engines. The 737-200’s engines are equipped with inlet vanes or diffusers that intentionally make the inlet airflow turbulent.205 Therefore, investigators recognized the possibility that maneuvers causing the inlet airflow to be slightly more turbulent might not produce significant change in the engine’s noise-producing characteristics. On June 3, 1996, the Safety Board conducted an engine perturbation flight test using a United Airlines 737-200 at the United Airlines Maintenance Operations facility in Indianapolis, Indiana. The flight test consisted of airplane maneuvers similar to those conducted during 737-300 flight control characteristics testing in September 1995. (See section 1.16.4.) The CVR recordings of the 737-200 flight test during sideslip and yaw conditions revealed engine sound signature changes similar to those heard in the 737-300 flight test CVR recordings for the same conditions. The CVR recording from United flight 585 was compared with the CVR recording from the 737-200 flight test. However, analysis of the engine sounds on the United flight 585 CVR was hampered by two factors: the recording was of poor quality with obscuring background noise and the pilots of United flight 585 were changing the engine power settings—and therefore, varying the revolutions per minute frequency—almost constantly during the approach to land. Investigators attempted to compensate for these factors when possible and then extracted and plotted the resulting engine sounds. Further, investigators plotted the FDR data (heading, altitude, vertical Gs, and indicated airspeed) along with the CVR data. No changes in engine sound volume were detected on the United flight 585 CVR. 1.16.7.4 Sounds of “Clickety Click” During public hearing testimony, Boeing’s flight test pilot speculated that the clickety click sounds might have been caused by the windshield wipers “chattering” or “slapping” on the windshield as the wake vortex impacted the airplane’s fuselage. He 204 The Safety Board would have attempted to apply the same techniques to the CVR recording from the Eastwind flight 517 incident, which also involved a 737-200; however, the 30-minute CVR tape continued to run after the airplane landed, and the relevant portion of the flight was recorded over. 205 According to the engine manufacturer, the engines installed on the 737-200 series airplane were designed when controlling/reducing inlet noise was not a critical issue for manufacturers. Because of the differences in engine inlet design, the engines installed on the 737-200 series airplanes produced more noise than the engines installed on the 737-300 series airplanes.

Factual Information 135 Aircraft Accident Report stated that when the wake core hit the fuselage, “it actually lifted the windshield wiper perpendicular off the wind screen and then it popped back with a rather subtle clicking noise.” The Safety Board was unable to find a sound on the wake turbulence flight test CVR recordings that matched the clickety-click sounds recorded by the accident CVR at 1902:58.6 and 1902:59.5. 1.16.7.5 Sound of Wailing Horn Although the wailing horn sound that was recorded by the USAir flight 427 CVR was originally identified as being “similar to autopilot disconnect,” further investigation revealed that the wailing horn recorded by the accident CVR did not sound the way the autopilot disconnect aural warning was designed to sound. According to Boeing engineers, the autopilot aural warning is generated by sweeping electronic sound oscillators from low to high frequency, resulting in a sound that is described in Boeing literature as a “fast wailer.” The aural warning is designed to continue to cycle every second for as long as the horn is activated. On the accident CVR recording, the wailing horn started as a fast wailer but, after one cycle, lapsed into a fast-cycle warbling tone, which continued to the end of the recording. Investigation revealed that the unit that generated the autopilot disconnect aural warning on the accident airplane also generated most of the cockpit aural warnings. The unit was equipped with multiple sound oscillators and bells and generated aural warnings, in addition to autopilot disconnect, for engine fire, loss of pressurization, aircraft overspeed, and takeoff/landing conditions. The unit was designed with a warning priority schedule—when a warning is being sounded and a warning with a higher priority is sensed, the unit will stop the lower priority warning and sound the higher priority warning. The Safety Board conducted tests on a USAir 737-300 that was equipped similarly to the accident airplane. These tests revealed that, when the autopilot disconnect and landing gear warnings206 were sounded simultaneously, the test airplane unit produced a cockpit aural warning that appeared to mix the steady landing gear warning tone with the wailing autopilot disconnect horn, producing a warbling tone centered around the landing gear warning tone—similar to the aural warning recorded by the accident airplane’s CVR. However, when the test airplane unit was examined on a test bench, all warnings were within specification, and the warning priority specifications functioned in a manner consistent with their design. Further examination revealed that unintended mixing of aural warnings can result from incomplete electrical grounding of the warning system. 1.16.8 Study of Pilots’ (USAir Flight 427 and United Flight 585) Speech, Breathing, and Other CVR-recorded Sounds As part of its investigation of the USAir flight 427 accident, the Safety Board examined the pilots’ speech (voice fundamental frequency, or pitch; amplitude, or 206 According to Boeing representatives, the landing gear warning can be activated when one or both throttles are retarded to idle and the landing gear is not extended.

Factual Information 136 Aircraft Accident Report loudness; speaking rate; and content) and breathing (inhaling, exhaling and grunting) patterns recorded by the CVR during the routine portions of the flight, the initial upset, and the uncontrolled descent. Investigators extracted several acoustical measures of speech (fundamental frequency, amplitude, and speaking rate) from pilot statements on the CVR recording to understand the actions and emotional states of the pilots during the accident sequence.207 Similar speech analysis techniques have been used previously by Russian, Japanese, and Australian investigative and research authorities208 and by Safety Board investigators on three occasions before this investigation.209 The Safety Board reviewed the USAir flight 427 CVR for pilot speech samples appropriate for computer speech analysis. The Safety Board observed that the captain spoke the airplane’s call sign, “four twenty seven,” during routine and emergency radio transmissions, providing a basis for direct comparison using the same words. When the captain spoke the phrase “four twenty seven” during routine flight operations, the average fundamental frequency value was 144.6 Hz. However, when the captain stated four twenty seven about 1903:15 during the emergency descent, the speech fundamental frequency increased 47 percent, to 214 Hz. Figure 29 graphs the fundamental frequency measures obtained for the captain’s statements before and during the upset period, showing changes in the fundamental frequency of his speech as the emergency situation developed.210 Figure 30 graphs the amplitude measures obtained for the same statements. According to scientific literature,211 fundamental frequency, amplitude, and speaking rate tend to increase in response to increased psychological stress. The captain’s speech fundamental frequency during the 3 minutes before the initial upset event generally ranged between 127 and 148 Hz and then increased to 210 Hz when he stated “sheeez.” Additionally, the captain’s amplitude during the 3 minutes before the upset event ranged between 237 and 520 volts212 and then increased to 904 volts when he 207 See “Speech Examination Factual Report, May 5, 1997” for details on the extraction procedures, which employed computer analysis. 208 For additional information, see Brenner, Malcolm, Mayer, David, and Cash, James [NTSB]. “Speech Analysis in Russia.” In Methods and Metrics of Voice Communications. 1996. Ed. B.G. Kanki and O.V. Prinzo. Washington, DC: Department of Transportation, Federal Aviation Administration, Office of Aviation Medicine, DOT/FAA/AM-96/10. Also see Mayer, David L., Brenner, Malcolm, and Cash, James R. [NTSB]. “Development of a Speech Analysis Protocol for Accident Investigation.” In Methods and Metrics of Voice Communications. 1996. In addition, see Aircraft Accident Investigation Report [Japan], Japan Air Lines Co., Ltd., Boeing 747 SR-100, JA8119, Gunman Prefecture, Japan, August 12, 1985 and Bureau of Air Safety Investigation Accident Investigation Report, Mid-Air Collision Between Cessna 172-N VH-HIZ and Piper PA38-112 VH-MHQ, near Tweed Heads, New South Wales, 20 May 1988 (BASI Report 881/1042). 209 For additional information, see NTSB Aircraft Accident Reports FTW91FA144 and SEA95FA175. Also see National Transportation Safety Board. 1990. Grounding of the U.S. Tankship EXXON VALDEZ on Bligh Reef, Prince William Sound near Valdez, Alaska, March 24, 1989. Marine Accident Report NTSB/MAR-90/04. Washington, DC. In addition, see Brenner, M., and Cash, J. 1991. “Speech Analysis as an Index of Alcohol Intoxication—The Exxon Valdez Accident.” Aviation, Space, and Environmental Medicine, 62, 893-98. 210 Only those statements that were free of artifacts caused by background conversation or other sounds appear on this graph and the one in figure 30. Of the three measured aspects of the captain’s speech, fundamental frequency provided the most measurable data. Missing data precluded similar measurements of the captain’s speech rate or amplitude.

Factual Information 137 Aircraft Accident Report stated “sheeez.” (The captain’s speech amplitude reached its maximum measured value of 2,865 volts at 1903:18.1 during the emergency descent.) Review of the first officer’s speech during the accident flight revealed that he did not speak enough during the emergency period to provide a basis for meaningful analysis. The Safety Board conducted a similar laboratory speech analysis examination of the speech and other sounds recorded by the United flight 585 CVR. The only measurable data obtained during this examination was for speech fundamental frequency.213 The captain’s speech fundamental frequency when he spoke the word “flaps” during routine and emergency radio transmissions provided a basis for direct comparison. When the captain said “flaps” during routine flight operations, his speech exhibited an average fundamental frequency of 131 Hz. However, when the captain stated “flaps” at 0943:33.5 during the upset event, the fundamental frequency of his speech had increased 77 percent, to 233 Hz. 211 See Ruiz, R., Legros, C., and Guell, A. 1990. “Voice analysis to predict the psychological or physical state of a speaker.” Aviation, Space, and Environmental Medicine, 61, 266-71. Also, see Brenner, M., Doherty, E.T., and Shipp, T. 1994. “Speech measures indicating workload demand.” Aviation, Space, and Environmental Medicine, 65:21-26. 212 Amplitude is often measured in decibels, a logarithmic scale determined relative to an internationally accepted calibration standard. Because no calibration standard was available in the CVR recording, amplitude was measured in volts (the direct measure of physical intensity) and plotted on a logarithmic scale for convenience. 213 Amplitude could not be measured because of the automatic gain control feature on the microphone. Speech rate could not be measured because of the limited amount of speaking by either crewmember during the emergency period.

Factual Information 138 Aircraft Accident Report Figure 29. Fundamental frequency measures of the USAir flight 427 captain’s speech. Fundamental Frequency (Hertz) 0 50 100 150 200 250 300 350 400 Altimeters and flight instruments thirty eleven? approach brief? ah, don’t do this to me. OK, one four zero heading and one ninety on the speed, did you say two eight left for USAir four twenty seven? two eight right, thank you. two eight right. seven for six. boy, they always slow you up so bad here. we’re looking for the traffic, turning to one zero zero, USAir four twenty seven. sheez. whoa. hang on. hang on. hang on. hang on. what the hell is this? oh God.. oh God. four twenty seven emergency. pull pull USAir from twenty seven

Factual Information 139 Aircraft Accident Report Figure 30. Amplitude measures for the USAir flight 427 captain’s speech. Log Amplitude (Volts) 100 1000 10000 Altimeters and flight instruments thirty eleven? approach brief? ah, don’t do this to me. OK, one four zero heading and one ninety on the speed, did you say two eight left for USAir four twenty seven? two eight right, thank you. two eight right. seven for six. boy, they always slow you up so bad here. we’re looking for the traffic, turning to one zero zero, USAir four twenty seven. sheez. whoa. hang on. hang on. hang on. hang on. what the hell is this? oh God.. oh God. four twenty seven emergency. pull pull USAir from twenty seven (Invalid data) (Invalid data) (Invalid data) (Invalid data) (Invalid data) (Invalid data)

Factual Information 140 Aircraft Accident Report 1.16.8.1 Independent Specialists’ Review of Pilots’ Speech, Breathing, and Other Sounds—USAir Flight 427 The laboratory speech analysis results and CVR tape and transcript from USAir flight 427 were provided to three independent specialists from the Interstate Aviation Committee, Moscow, Russia;214 the U.S. Naval Aerospace Medical Research Laboratory, Pensacola, Florida;215 and NASA’s Ames Research Center, Moffett Field, California.216 Their areas of specialization were general speech analysis (focusing on issues of psychological stress and physical effort), breathing physiology,217 and communication information, respectively. The specialists agreed that the USAir flight 427 CVR recorded no speech patterns by the pilots or other sounds to indicate that either pilot was physiologically impaired or incapacitated; rather, the specialists stated that both pilots sounded alert and responsive throughout the flight, including the upset and accident sequence. The specialists agreed that the first indication of the upset event on the CVR recording occurred about 1902:57, just as the first officer finished stating, “oh, ya, I see zuh Jetstream.” Within 1 second, the CVR recorded a sound similar to three thumps (see section 1.16.7.1), “sheeez” from the captain, and “zuh” from the first officer. The specialists stated that the speech patterns of the pilots indicated that they were surprised by the initial upset, but the specialists agreed that the pilots responded promptly to the situation and were attempting to control the airplane and identify the problem. None of the specialists were able to determine if the pilots were operating the control wheel, the rudder, or both in their efforts to control the airplane. To ensure that all the straining, grunting, and other sounds recorded by the CVR were thoroughly and accurately documented,218 the Safety Board and the independent speech experts from Moscow’s Interstate Aviation Committee and the U.S. Naval 214 This specialist is the Chief of the Acoustical Laboratory at the Interstate Aviation Committee. He has a medical degree and graduate level training in psychology. He has participated in more than 250 aviation accident investigations and specializes in medical and psychological aspects, especially the psychological analysis of speech. 215 This specialist is a Research Physiologist in the Aviation and Operational Medicine Department of the U.S. Naval Aerospace Medical Research Laboratory. He has a doctorate degree in exercise physiology, and his research includes work on the effects of physical fitness on normal load factor tolerance and the development of anthropometric standards for naval aviators. 216 This specialist is a Research Psychologist at the NASA’s Ames Research Center. She has a doctorate degree in behavioral sciences, and her research addresses aerospace human factors, focusing on crew communication, coordination, and performance issues. 217 Breathing sounds are normally not audible on the CAM channel, which is recorded by a microphone in the overhead panel above the pilots (and used for most CVR transcripts). However, breathing sounds are often audible on the “hot microphone” channels recorded from boom microphones attached to the headset of each pilot and positioned directly in front of each pilot’s mouth. The breathing information in this investigation was recorded on these hot microphone channels. 218 The CVR transcript indicates that the captain inhaled and exhaled quickly at 1902:58.7 and that the first officer was grunting at 1903.01.6. Several other instances of such sounds on the CVR are not noted in the transcript. The Safety Board does not generally document every such sound when preparing official transcripts of CVR recordings.

Factual Information 141 Aircraft Accident Report Aerospace Medical Research Laboratory reexamined the sounds recorded by the CVR between 1902:57.6 and 1903:23. Both experts noted additional sounds recorded on the first officer’s hot microphone channel that could indicate high physical loads. These sounds and their duration were documented by Safety Board investigators as follows: 219 • “zuh” from 1902:57.6 to 1902:57.8, • a rapid inhale from 1902:59.7 to 1902:59.9, • a soft grunt from 1903:00.3 to 1903:00.5, • a louder grunt from 1903:01.5 to 1903:01.6, • a loud exhale from 1903:01.8 to 1903:02.1, and • “oh [expletive]” from 1903:04.6 to 1903:05.1. No other inhaling, exhaling, or vocalizing sounds were detected during this time period. 1.16.8.1.1 Summary of Observations of Interstate Aviation Committee Specialist The specialist from Moscow’s Interstate Aviation Committee reviewed the pilots’ speech communication and other noise evidence recorded by the CVR to evaluate the pilots’ responses, actions, and psychological state during the emergency. He stated that, at 1902:57.5, both pilots exhibited symptoms of sudden surprise that were “characteristic of a human response to sudden motion or to a physical disturbance.” The specialist observed that both pilots showed symptoms of psychological stress (increased amplitude and fundamental frequency of speech, increased frequency of breathing, and reduced information within a statement) beginning almost immediately after the initial upset and that these symptoms increased throughout the accident sequence. However, the specialist believed that the increased psychological stress did not necessarily interfere with the pilots’ ability to respond to the emergency situation. The specialist’s report stated that stress can be viewed as having the following three increasing stages,220 which reflect typical changes in performance: Psychological stress, at low levels, can improve a person’s performance by providing a constructive mobilization of attention and resources (first stage). As the person’s stress increases, the performance often displays 219 One participant in this examination thought that the louder grunting and loud exhale (the fourth and fifth sounds on the list) were part of the same straining effort but agreed with the other participants to provide separate timings for both sounds. 220 As a guideline, the specialist from the Interstate Aviation Committee indicated that stage 1 speech is characterized by an intra-individual increase in fundamental frequency of about 30 percent compared with that individual’s speech in a relaxed condition, stage 2 speech is characterized by an increase in fundamental frequency of 50 to 150 percent, and stage 3 speech is characterized by an increase of 100 to 200 percent. These guidelines are advisory and considered with other speech factors in characterizing the speaker’s level of stress.

Factual Information 142 Aircraft Accident Report hasty or premature actions [such as the omission of words or checklist items]. However, they can still accomplish their task (second stage). It is only at the highest levels of stress (third stage, or “panic”), that the person can not think or perform clearly. The specialist further observed that, although the captain’s level of psychological or emotional stress was increasing during the emergency, he was still capable of adequate responses; the captain’s attempts to evaluate the situation were reflected in his statements “hang on” and “what the hell is this?” (about 1903:05 and 1903:08, respectively). According to the specialist, although the captain’s response to an ATC transmission at 1903:15 was “incomplete and it is obvious that the situation was unclear for him,” the attempt to respond demonstrated that the captain was capable of appropriate responses. The specialist’s review of the USAir flight 427 captain’s fundamental frequencies indicated that when he spoke the phrase “four twenty seven” during the emergency (about 1903:15), the fundamental frequency was 47 percent higher than the average fundamental frequency when that phrase was spoken during routine flight operations. Additionally, although this communication was incomplete (“four twenty seven emergency”), it was appropriate for the situation. The specialist believed that the captain was operating at the second stage of psychological stress at that time because his speech displayed characteristics of a significant level of stress but did not indicate that he had reached a level of panic (the third stage). The specialist stated that neither of the USAir flight 427 pilots exhibited the third stage of psychological stress until 1903:17.4 (about 5 seconds before ground impact). The specialist reported that the captain then appeared to enter the highest stage of emotional stress because he issued inadequate commands between 1903:18.1 and 1903:19.7 (“pull…pull…pull”) and was unable to “act and react in accordance to the situation.” The specialist also noted that the first officer “demonstrated high levels of psychological stress before the impact, reflected by the speech degrading into short exclamations and expletives.” In his analysis of the pilots’ physical responses, the specialist reported that the first officer exhibited signs of high physical effort (coinciding with signs of increased psychological stress). According to the specialist, the first officer exhibited speech disruptions, such as grunts and forced exhalations beginning at 1902:59.7 (when he was likely to have been actively controlling the airplane) and continuing for several seconds. The specialist stated that: …a person making a great physical effort develops a musculo-skeletal “fixation” (of the chest), which leads to deterioration of the normal expansion and ventilation of the lungs (inhaling and exhaling). These changes are manifested during speech. Sounds such as grunting and strain appear in speech as the person tries to minimize the outflow of air. Inhaling and exhaling become forced and rapid.” The specialist further stated that normal use of the cockpit controls should not produce these types of sounds. He said that the sounds emitted by the first officer during

Factual Information 143 Aircraft Accident Report the upset sequence indicated that “[he] was struggling unusually hard…[as] if he was experiencing unusual resistance in the use of a control.” The specialist noted that, although the first officer displayed signs of significant physical effort almost immediately after the upset event, he did not display those signs throughout the entire accident sequence. At 1903:04.6, when the first officer stated “oh [expletive],” no evidence of grunting, straining, or forced exhalation was recorded. However, at 1903:18.5, the first officer’s statement of “oh [expletive]” was accompanied by forced exhalation, exhibiting evidence of high physical exertion. The specialist stated that the first officer’s “unconscious pressing of ATC/intercom switch suggests that he could be trying to position his hands on the control wheel during the high pulling forces.”221 According to the specialist, during the last 5 seconds of the flight, the captain began to exhibit symptoms of increased physical effort, as evidenced by short, forced inhalations after each “pull” command. On the basis of his observations, the specialist from the Interstate Aviation Committee developed the following conclusions: • The accident sequence was completely unexpected by the crew. It caused their orientation response of the “What is that?!” type. • The accident sequence was completely unclear for the crew. • From the beginning of the accident sequence until 1903:18.1 the captain did not apply high physical loads to the controls and, most likely, did not participate in the control. • The first officer applied physical loads and controlled the airplane. The loads were high, probably maximum, but varied during the upset period. • Both crew members experienced high psychological stress. At the last moments (beginning at 1903:17.4), stress increased and became a panic (stage 3). 1.16.8.1.1.1 Interstate Aviation Committee Specialist’s Guidelines Applied to United Flight 585 CVR Information The Safety Board applied the specialist’s guidelines and criteria to the speech and other sounds recorded by the United flight 585 CVR. In this case, when the captain spoke the word “flaps” during the accident sequence (at 0943:33.5),222 his speech fundamental frequency was 77 percent higher than when he spoke the same word during routine flight operations. In addition, the captain’s statement “fifteen flaps” (at 0943:33.5) signified a 221 Evidence from the ATC transcript and the CVR indicated that the first officer’s ATC/intercom switch was intermittently activated from 1903:09:4 (shortly after CVR began to record a vibrating sound similar to an airplane stickshaker at 1903:08.01) to the end of the CVR recording at 1903:22.8. In addition to the intercom switches located on the radio selector panels outboard of each pilot’s knees in the cockpit (discussed in section 1.16.7.2), an intercom switch is also located on the forward side of the control wheel (away from the pilots). 222 All times in this section are mountain standard time, based on a 24-hour clock.

Factual Information 144 Aircraft Accident Report go-around decision but occurred without the captain first stating “go-around thrust,” as specified in the procedures section of the company flight manual at the time of the accident. According to the specialist’s guidelines, the captain’s responses (high fundamental frequency value and omission of a standard procedure item while communicating and responding appropriately to the situation) indicated that he was likely operating at the second stage of stress at 0943:33.5. He had not reached panic but was displaying characteristics of a high level of stress within about 1½ seconds of the onset of the emergency period. The Safety Board’s examination of the remaining 8 seconds of CVR information indicated that the pilots likely reached the third stage of stress—panic— before the airplane crashed. 1.16.8.1.2 Summary of Observations of U.S. Naval Aerospace Medical Research Laboratory Specialist The specialist from the U.S. Naval Aerospace Medical Research Laboratory reviewed the USAir flight 427 CVR to provide observations on pilot breathing and muscular exertion. The specialist stated that both pilots appeared “conscious and fully aware of the emergency nature of the situation” and that “neither seemed impaired or incapacitated [according to] the sounds heard on the tape.” With regard to the captain, the specialist noted that “after the onset of the emergency period, the rate of breathing of the [captain] increased...there was an initial, large exhalation with the utterance ‘sheeez’ in response to the first sudden, unusual movement of the aircraft at the start of the emergency sequence. That was followed shortly by a deep, rapid inhalation223 before the word ‘whoa’ was heard from the captain, almost as if he was startled by the continued departure of the aircraft from normal flight. The breathing response of the captain after the onset of the emergency appears to have been a normal sympathetic nervous system response that would include increased heart rate, breathing rate, body temperature, and blood pressure, all commonly observed in emergency situations.” The specialist stated that, almost immediately after the initial upset, the CVR recorded two rapid grunting exhalations on the first officer’s channel, which the specialist attributed to the first officer’s muscular exertion to control the airplane during the accident sequence. The specialist also stated that the first grunting sound was soft, whereas the second was louder and more forceful, representing the use of increased muscular force. Other than the first officer’s deep rapid breathing, no additional audible (nonverbal) noises were recorded on the first officer’s channel during the remainder of the recording. The specialist stated that, although the CVR did not record similar indications of muscular exertion/strain on the captain’s channel, “that is not to say that the [captain] was not on the controls, but only that he did not appear to be exerting increased muscular force….”224 223 The USAir flight 427 captain’s breathing response is noted in the CVR transcript at 1902:59.1 as a “sound similar to person inhaling/exhaling quickly one time.” 224 This specialist stated that the captain (who had recently returned to flying duties after back surgery) may have been reluctant to exert excessive muscular force with his upper body because of the surgical repair.

Factual Information 145 Aircraft Accident Report The specialist stated that “the physical act of manipulating the controls of modern aircraft under normal conditions does not usually require excessive muscular force…during emergency situations, increased muscular force may be needed….” 1.16.8.1.3 Summary of Observations of NASA’s Ames Research Center Specialist The specialist from NASA’s Ames Research Center reviewed the USAir flight 427 CVR, focusing on the flight crew’s task-related (routine and emergency), procedural (ATC communications, checklists, and PA announcements), and nontask-related (interpersonal interactions) speech communications. She stated that the pilots’ speech communications during the routine portion of the flight appeared to be complete, cooperative, and responsive and that the interactions between crewmembers were casual and friendly. She reported that crew coordination was thorough and that neither pilot appeared reluctant to seek or incorporate information from each other or ATC. The specialist noted that all coordination issues and questions had been resolved and that all appropriate procedural communications appeared to have been accomplished (checklists and PA announcements) before the initial upset occurred. The specialist indicated that an evaluation of the speech communications recorded during the emergency portion of the flight was made difficult because flight crew speech in the final 25 seconds of the CVR recording was minimal and often fragmented. The specialist stated that the comments made by the first officer throughout the accident sequence did not contain much information. She reported that the best source of verbal information during the accident sequence was contained in the captain’s statements between about 1902:57 and about 1903:10. The specialist stated that, although the captain’s language was ambiguous during this period, it indicated that he recognized that a problem existed but that he had not yet identified the source or nature of the problem. 1.17 Operational and Management Information 1.17.1 USAir At the time of the accident, USAir employed approximately 46,000 people and operated a fleet of 443 aircraft, including 234 Boeing 737s.225 USAir maintained major hub operations in Pittsburgh and Charlotte and smaller hub operations in Philadelphia; Indianapolis; and Baltimore, Maryland. USAir’s heavy maintenance, structural repairs, and overhauls were accomplished in Pittsburgh; Charlotte; and Winston-Salem, North Carolina. In the 6 years preceding the accident, USAir had grown as the result of several mergers. The largest mergers occurred in 1988, when USAir acquired PSA, and in 1989, when USAir merged with Piedmont Airlines. According to USAir personnel, 225 Records indicate that the 234 Boeing 737 airplanes operated by USAir included 79 737-200 series models, 101 737-300 series models, and 54 737-400 series models.

Factual Information 146 Aircraft Accident Report standardization of the different pilot groups that resulted from the mergers was accomplished through a process described as “mirror-imaging.” Specifically, USAir developed a team of check airmen from USAir, PSA, and Piedmont Airlines to establish standardized procedures for the merged aircraft fleet based on the procedures used by USAir at the time. Checklists, flight operations manuals, and pilot handbooks were rewritten, and flight and simulator training sessions were revised to implement the standardized procedures. A review of USAir staffing assignments revealed that management and training positions were staffed by personnel with backgrounds from USAir, PSA, and Piedmont. USAir management and training personnel reported that they believed that the merged airlines’ procedures, personnel, and aircraft had been successfully integrated. At the time of the accident, USAir had a full-time Quality Assurance/Flight Safety Department that was responsible for identifying, communicating, and resolving flight safety-related issues. The Director of Flight Safety reported to the Vice President of Flight Operations. The Quality Assurance/Flight Safety Department interacted with the FAA, ALPA, USAir management, USAir training personnel, and line pilots to develop and disseminate safety-related information to flight crews. Safety information was communicated to employees via electronic mail; bulletin boards; attachments to flight paperwork; printed notices distributed to company mailboxes; periodic “Flight Crew View” publications; and USAir’s Flight Training and Standards Department during simulator, line check, CRM, and LOFT training sessions. Because USAir was a military contract carrier, the Department of Defense completed a survey in June 1994 that rated the airline’s capabilities. USAir received “excellent” to “above average” ratings in all areas of flight crew operations, training, and safety. 1.17.2 USAir Flight Training USAir’s Flight Training and Standards Department was responsible for ensuring the continuing competency of the pilots, check pilots, and instructors in each of the aircraft operated by the company. At the time of the accident, six flight training managers were responsible for training in the following aircraft: • Boeing 727, 757, and 767; • Boeing 737-300 and -400; • Boeing 737-200; • Douglas DC-9 and McDonnell Douglas MD-80; • Fokker F.100; and • Fokker F.28. The training staff for the 737-300 and-400 airplanes consisted of two senior check airmen, 6 check pilot designees, and 47 full-time check pilots. According to the Director

Factual Information 147 Aircraft Accident Report of Flight Training and Standards, USAir flight training staff performed all training and flight check functions, including initial simulator training, initial operating experience (IOE), proficiency checks, requalifications, line checks, CRM, LOFT, and special airport qualification training. Additionally, the Director of Flight Training and Standards stated that the FAA, ALPA, and USAir flight training personnel met regularly to discuss standardization matters, such as syllabi, procedures, training techniques, grading criteria, and trend analyses. 1.18 Additional Information 1.18.1 Overall Accident Record and History of the 737 According to Boeing, 737 series airplanes have flown more than 92 million hours since entering service in December 1967. During its investigation of the USAir flight 427 accident, the Safety Board reviewed the overall accident history record of the Boeing 737 airplane and compared this record with other generally comparable airplane types. The Safety Board examined worldwide aviation accident and departure data provided by Airclaims Limited of London, England.226 These data indicated that 737 series airplanes were involved in 43 total loss accidents227 between January 1988 and December 1997, which corresponds to 0.99 total loss accidents per 1 million departures.228 Table 7 shows total loss accident data for several airplane types arranged in order of least to most number of total loss accidents per 1 million departures. 226 Airclaims Limited is an aviation consulting firm that collects data, in part, for the aviation insurance industry. The Airclaims Limited database is recognized by the aviation industry as a definitive source for worldwide aviation accident information. 227 Airclaims Limited defines a total loss as an aircraft that has been destroyed or for which the estimated repair costs rendered the aircraft a total loss under the terms of the insurance contract. (Airclaims Limited notes that some aircraft that became total losses have been repaired and returned to service.) Any total losses that Airclaims listed as the result of a deliberate violent act were eliminated from these data. 228 Airclaims Limited. 1998. Airliner Loss Rates. Heathrow Airport, England. Table 7. Number of worldwide total loss accidents and total loss accidents per 1 million departures for selected aircraft types, 1988-97. Airplane type Total number of loss accidents Total loss accidents per 1 million departures Boeing 757 4 0.62 Douglas DC-9/McDonnell Douglas MD-80 27 0.86 Airbus A319, A320, and A321 5 0.95 Boeing 737 43 0.99 Boeing 727 23 1.19 Fokker F.28, F.70, and F.100 15 2.23

Factual Information 148 Aircraft Accident Report 1.18.1.1 History of 737 Potential Rudder System and/or PCU-Related Anomalies/Events The following list of selected 737 yaw/roll events describes identified rudder- related anomalies that were reported before the USAir flight 427 accident. (Yaw/roll events reported after the USAir flight 427 accident are discussed later in this section and are listed in appendix E.) Some of the anomalies summarized in this section were previously discussed in the Safety Board’s final report on the 737 accident at Colorado Springs, and others were reported to Boeing through various means (such as reports from AAIB and the civil airworthiness authority of New Zealand). As a result, the extent to which these events were documented and the amount of available data regarding these events varied widely. • On July 24, 1974, the flight crew of a 737 reported that a rudder moved "full right" upon touchdown. The investigation revealed that the primary and secondary slides were stuck together by a shotpeen ball lodged in the servo valve. • On October 30, 1975, during a main rudder PCU inspection, shotpeen balls were found in a servo valve that had undergone chrome plating. • On August 26, 1977, the flight crew of a 737 reported that, during taxi, the right rudder pedals moved in "half way" and then jammed. This event happened three times and was corrected each time by cycling the rudder with the standby rudder system. Further examination indicated that the main rudder system was contaminated by metal particles. • On August 31, 1982, a 737 reported that the rudder "locked up" on approach and that the flight crew initiated a go-around and activated the standby rudder system. The subsequent landing was uneventful. The examination of the PCU revealed internal contamination and worn seals, which resulted in the PCU having a limited capability to generate enough force to move the rudder. • On November 8, 1990, during an overhaul, a main rudder PCU was found to have internal corrosion. The primary slide was stuck to the secondary slide at the neutral position as a result of the corrosion. No malfunctions were reported before disassembly. • On January 4, 1993, the flight crew of a United Airlines 737-300, N309UA, reported a “hydraulic block/binding” during the flight control check. The main rudder PCU was removed from the airplane and shipped to Parker for examination. When tested in its “as received” condition, the PCU exhibited reduced rates, complete stalls, and reversals while being commanded in the retract direction (right rudder). Further examination at the Parker facility revealed that the servo valve retaining nut was loose; when the retaining nut was tightened properly (to 170 inch-pounds), investigators were unable to duplicate the anomalies that were observed during the previous testing. As a result of this investigation, Boeing and Parker modified the spring guide (which locks the retaining nut in place) to provide better engagement with and

Factual Information 149 Aircraft Accident Report retention of the nut. The companies also devised an additional test procedure to stroke the secondary slide within the internal limits of the servo valve. This test procedure was added to Parker’s acceptance test procedure and Boeing’s Overhaul Manual. • On April 16, 1993, the flight crewmembers of an Air New Zealand 737-200 reported that they were descending from FL 350 to FL 330 (because of turbulence encountered at the higher altitude) when they experienced a series of uncommanded rudder inputs (with rudder pedal feedback) that continued (randomly right and left) throughout the remainder of the flight. The pilots reported that, during landing, a “large” left rudder offset was experienced. Both pilots stated that the rudder was stiffer than normal throughout the incident flight. Postincident testing revealed that the yaw damper coupler was capable of normal operation (although the rate gyro tested “out of limits”) and that the standby and main rudder PCUs operated normally except when the standby PCU was tested at cooler temperatures229 with 3,000 psi hydraulic pressure. Under those test conditions, the input arm required up to 4.5 pounds of force before it moved; the input arm normally moves with about 0.5 pounds of force. Evidence of corrosion was found on the outer diameter of the bypass valve sleeve, and slight galling was noted on the input shaft and bearing. • On August 31, 1994, a British Airways 737-200, G-BGJI, experienced a full left rudder deflection and subsequent rudder jam when the standby rudder system was selected during ground operations. According to the United Kingdom civil airworthiness authority, when the standby rudder system was selected, no rudder movement was possible through the rudder pedals. However, when the standby rudder system was deactivated and rudder system operation was transferred to hydraulic systems A and/or B, the rudder jam was eliminated, and the rudder returned to neutral. The standby rudder actuator was removed and replaced, and the rudder subsequently functioned normally on hydraulic systems A and B and the standby hydraulic system. A partial teardown of the standby rudder actuator revealed that the servo valve had seized; examination revealed corrosion and water in the unit and corrosion in the bypass valve, input shaft, and input shaft bearing. In January 1999, Parker notified the Safety Board that a recent search of its files produced three additional reports of anomalous Boeing 737 main rudder PCU operation. Two reports were from 1982, and one was from 1984. The first report, dated October 4, 1982, indicated that Parker had examined a main rudder PCU at Boeing’s request “to determine the cause for rudder lockup during flight.”230 No date for the rudder lockup event was specified in the report. Fluid samples removed from the unit were found to be contaminated, but the nature of the contamination 229 Since the time that it was notified of this event, the Safety Board has made several requests (first in May 1993 and most recently in October 1998) for additional information regarding the temperatures used during these tests. To date, officials at Air New Zealand, the New Zealand civil airworthiness authority, and Boeing have been unable to provide the requested information.

Factual Information 150 Aircraft Accident Report was not described in the report. The PCU passed Parker’s acceptance test procedure at room temperature; however, when it was cooled to -65° F, the PCU failed the linkage breakout friction test (which measures the amount of force needed to move the input arm) in the extend direction and the yaw damper system test (which measures consistency of yaw damper response). According to the report, a new-production PCU also failed these tests at -65° F. The incident PCU was disassembled after the testing, and no discrepancies were noted. Parker summarized the results of its examination as follows: ...no determination could be made as to the cause for the rudder lockup. Both units, during the subtemperature tests, exhibited high friction and reduced reactions to electrical input signals. These high frictions and reactions exceeded the allowable specifications [sic]; however, it is Parker[]’s opinion that this would be expected at the low temperatures. This friction would be the result of changes in the materials, which would affect the close tolerance fit of mating parts, ie: linkages, bearings, lap fits of valve assemblies, etc..... The second report, dated October 8, 1982, also stated that a main rudder PCU was examined “to determine the cause for rudder lockup during flight.” The report did not specify a date of the rudder lockup event. The PCU passed all of Parker’s acceptance tests with the exception of the yaw damper system test and the yaw damper engage test (which tests the yaw damper’s response when it is switched on). Disassembly of the PCU indicated excessive wear on the yaw damper’s walking beam assembly. When the servo valve was removed from the PCU and the primary slide was fully retracted into the secondary slide, the primary slide jammed against the secondary slide. However, when the servo valve was reinstalled on the PCU, the primary slide could not travel as far in the secondary slide as it had when it was removed from the PCU; thus, the primary slide did not jam in the secondary slide. The report indicated that the servo valve was removed and tested again but that “no evidence of binding, jamming, or lockup could be verified.” Parker summarized the results of its examination as follows: ...no determination could be made as to the cause for a rudder lockup. The test findings for the phase Lag and Yaw Damper Engage tests were determined to have been caused from the Transfer Valve being off null position. It was determined that the Servo Slide does not have enough travel by design to allow the Primary Slide to bottom into the Secondary Slide and jam. Parker[]’s conclusion to the investigation is that none of the noted findings could have caused the rudder lockup. The third report, dated May 11, 1984, describes a January 25, 1984, examination of a main rudder PCU that experienced an “intermittent kick and hardover condition.” According to the report, Boeing notified Parker that an operator had experienced an intermittent rudder kick and hardover condition during flights at high altitude and that the 230 According to the report, a Parker facility had previously examined the unit, found no fault with it, and returned it to the customer.

Factual Information 151 Aircraft Accident Report PCU had been removed and overhauled at a repair station. According to the report, after the PCU was reinstalled on another airplane in the operator’s fleet, that airplane also experienced a “rudder kick and hardover condition.” Boeing requested that the operator remove the PCU and send it to Parker for detailed analysis. When tested at room temperature, the PCU passed all of Parker’s acceptance tests except the linkage breakout friction test in both the extend and retract directions. When tested at -65° F, the PCU failed the yaw damper system test. The report stated that, after the examinations, the unit was reassembled, recertified, and returned to the operator. Parker summarized the results of its examination as follows: ...a determination as to the cause of the rudder kick and hardover condition could not be made from the discrepancies found during testing and disassembly.” As a result of the USAir flight 427 accident and other accidents and incidents involving apparent 737 directional control anomalies, the Safety Board reviewed available information regarding more than 100 other 737 yaw/roll upset events and anomalies that were reported since the 737 was initially certificated.231 Further, the Safety Board examined more thoroughly available data from many of these events for evidence that servo valve jamming or other main rudder PCU anomalies were involved (including the events described individually in this report).232 When available, FDR and/or quick access recorder (QAR)233 data from these 737 events were obtained by the Safety Board for examination, comparison, and evaluation. The Safety Board’s review indicated that 71 of the reported yaw/roll events involved anomalous operation of the rudder system. In many cases, the identified causes were yaw damper anomalies; others were attributed to rudder PCU anomalies. The Safety Board determined that several of the anomalous yaw damper events were the result of a failure within the yaw damper rate gyro, which is located in the yaw damper coupler in the E/E bay beneath the cabin directly behind the cockpit. In many airplanes, the forward lavatory or galley is located directly above the E/E bay, and several 231 Information from Boeing indicates that, between 1990 and 1994 (before the USAir flight 427 accident) there were 187 reported yaw/roll events involving the 737. (Yaw/roll event reporting is mostly voluntary. The number of such reports increased considerably after the USAir flight 427 accident.) In comparison, information from Boeing’s Douglas Products Division indicates that, over about 75 million flight hours, there had been only 3 reported yaw/roll events involving the DC-9/MD-80 series airplanes. Information from Airbus indicates that, over about 4 million flight hours as of November 1995, there had been only one reported yaw event involving the A-320, and that event was caused by a rudder mistrim. 232 See appendix E for a complete list of the 112 documented 737 rudder events that were examined by the Safety Board. This list is not necessarily intended to suggest that the events are similar to those involved in the USAir flight 427 accident; it is simply a documentation of 737 yaw/roll events that have been reported to and followed by the Safety Board. Additionally, the list is not necessarily a complete list of all yaw/roll events because air carriers often do not report events in which the yaw/roll anomaly ceased when the yaw damper or autopilot system was disengaged. Thus, although several air carriers have been aggressive about reporting yaw/roll events (especially during the months after the USAir flight 427 accident), many such events may not have been reported. 233 QARs have greater data storage capabilities than FDRs but are primarily intended for air carrier maintenance fault analysis. QARs are not protected/hardened to survive crash impact or fire conditions.

Factual Information 152 Aircraft Accident Report 737 yaw damper system-related anomalies were found to be the result of fluid contamination (resulting from leakage of lavatory fluid, or “blue water”) of the yaw damper coupler, associated wires, and/or connectors. (The 737 series airplanes have a documented history of blue water contamination and erosion;234 see appendix F for more information.) Another possible source of yaw damper anomalies that was considered is electromagnetic interference (EMI) or high-intensity radiated fields (HIRF).235 Several events that appear to involve PCU servo valve and/or rudder-related anomalies and may have potential relevance to the flight control issues investigated in connection with the USAir flight 427 accident are discussed in the following text. Two additional events that also appear to have potential relevance to the USAir flight 427 accident—the United flight 585 accident and the Eastwind flight 517 incident—were discussed previously (in section 1.16.1) and are not discussed further in this section. July 1992 United Airlines Ground Check PCU Anomaly (737-300) On July 16, 1992, during a preflight rudder control ground check at ORD, the captain of a United Airlines 737-300 noted that the left rudder pedal stopped and jammed near 25-percent pedal travel. The captain reported that he was moving the rudder pedals more rapidly than usual when the jam occurred. He further stated that the rudder pedals returned to their neutral position after he removed foot pressure from the left rudder pedal. The airplane returned to the gate, and the main rudder PCU was removed for further examination. The main rudder PCU was tested and examined at United Airlines’ facility in San Francisco, California, and Parker’s facility in Irvine, California. The testing revealed that the PCU exhibited anomalous behavior, ranging from sluggish movement of the actuator piston to a full reversal in the direction of piston travel opposite to the direction being commanded, when the input crank was fixed against the PCU body stops (to move the primary and secondary slides throughout their full travel) and the yaw damper piston was in the extend position. The testing also revealed high internal fluid leakage. When investigators tapped on the dual servo valve housing or the summing levers or released the force on the input crank, the PCU returned to normal operation. 234 According to Boeing, the 737 is not designed to port excess blue water overboard; instead, the airplane is equipped with a shallow drip pan at each lavatory, which is intended to catch spills and overflows and prevent blue water contamination/erosion. However, 737 operators report that the drip pan cannot catch large spills, such as those that result from overfilling the lavatory system. See section 1.6.1.1 for information regarding blue water contamination from the accident airplane’s maintenance records. 235 EMI or HIRF can induce an electrical potential in electrical wiring and circuits or be received by an airplane’s navigational systems. Numerous navigational anomalies and sudden flight control movements on 737s and other airplanes have been attributed to EMI (generated by on-board portable devices, such as laptop computers, electronic games, or cellular telephones) or HIRF (generated from outside sources, such as radio towers, radar sites, and power stations). Technical literature indicates that it is possible for EMI or HIRF to affect an airplane’s autopilot or yaw damper system up to the limits of the system. See Shooman, M.L. “A Study of Occurrence Rates of Electromagnetic Interference to Aircraft with a Focus on HIRF….” National Aeronautics and Space Administration, Langley Research Center, Hampton, Virginia, April 1994, pp. 2, 7, and 20. Also see Flight Standards Information Bulletin for Airworthiness 97-16A, “Lightning/High Intensity Radio Frequency Protection Maintenance,” Federal Aviation Administration, August 4, 1997.

Factual Information 153 Aircraft Accident Report Further examination of the servo valve components showed that the secondary slide could move axially beyond its designed operating position (overtravel), resulting in abnormal porting of hydraulic fluid. When the secondary slide overtraveled to its mechanical stop (internal stop) in the servo valve housing, the abnormal flow could produce full pressure opposite to that intended at the actuator piston. Thus, the rudder would move in a direction opposite to the commanded direction; for example, rudder input intended to command left rudder could result in the rudder moving right. The Safety Board’s examination of this servo valve revealed that overtravel of the secondary slide occurred when the rudder pedals were moved rapidly to command a maximum rate of rudder travel or when a pedal was fully depressed to command full deflection of the rudder. During subsequent tests, the overtravel of the secondary slide was determined to be the result of the failure of the secondary summing lever to maintain contact with its respective external stop. Examination of the summing levers revealed that the secondary summing lever did not meet design specifications in that the chamfer236 on the summing lever was 50°, rather than the specified 45°, at the point where it contacted the external stop. This anomaly allowed the secondary summing lever to move beyond its external stop; thus, the secondary slide and summing lever could continue to move beyond the normal range of travel until the secondary slide bottomed out at its internal stop in the servo valve housing.237 As a result of its investigation of this incident, the Safety Board became concerned about the potential for rudder reversal in all 737 main rudder PCUs, specifically, that the internal stops of the dual-concentric servo valve could allow sufficient movement to route hydraulic fluid through a flow passage located outside the normal valve operating range, resulting in movement in the direction opposite to the control input. On November 10, 1992, the Safety Board issued Safety Recommendations A-92-120 and -121. Safety Recommendation A-92-120 asked the FAA to Issue an airworthiness directive mandating design changes for main rudder PCU servo valves that would preclude the possibility of rudder reversal attributed to the overtravel of the secondary slide. On March 3, 1994, AD 94-01-07 became effective (see sections 1.6.3.2.1 and 1.18.5). Because the Safety Board determined that the AD satisfied the intent of Safety Recommendation A-92-120, it was classified “Closed—Acceptable Action” on August 11, 1994. 236 A chamfer is an oblique face located at a corner (a beveled edge). 237 The servo valve was designed to prevent abnormal flow if the secondary slide bottomed out at its internal stop; however, during the investigation of this incident, it was discovered that parts built within tolerances could be assembled with a resulting tolerance buildup that would allow the abnormal flow to occur if the secondary slide moved to its internal stop. Thus, in addition to the potential for overtravel because of the incorrect chamfer, it became evident that the secondary slide could also be forced into the overtravel range if it became jammed to the primary slide. Normal movement of the primary slide could produce a rudder reversal if a primary to secondary slide jam existed.

Factual Information 154 Aircraft Accident Report Safety Recommendation A-92-121 asked the FAA to Conduct a design review of servo valves manufactured by Parker Hannifin that have a design similar to the 737 rudder power control unit servo valve that control essential flight control hydraulic power control units on transport-category airplanes certificated by the Federal Aviation Administration to determine that the design is not susceptible to inducing flight control malfunctions or reversals due to overtravel of the servo slides. On January 19, 1993, the FAA stated that it had completed a design review of the servo valves manufactured by Parker on all transport-category airplanes. The FAA stated that its review indicated that the problem identified in this incident investigation existed only in the main rudder PCU on the 737 airplane. Because this design review met the intent of Safety Recommendation A-92-121, it was classified “Closed—Acceptable Action” on June 10, 1993. (See section 1.18.11.3 for additional information regarding these recommendations and two others related to this incident.) British Airways Incident (747-436, G-BNLY) On October 7, 1993, a British Airways 747-436, G-BNLY, experienced an in-flight upset as the airplane climbed through 100 feet agl during its departure from London’s Heathrow Airport. The airplane suddenly pitched down from 14 to 8° nose up because of uncommanded downward travel of the elevators on the right side of the airplane. The flight crew maintained control of the airplane and landed uneventfully at Bangkok, Thailand, the flight’s intended destination. The incident was investigated by the AAIB. The elevators on the 747-400 are not interconnected. Postincident examination of the airplane’s QAR238 indicated that the elevators on the right side of the airplane moved to near their maximum downward deflection limit. The elevators on the left side of the airplane moved upward to counter the right-side downward deflection, which allowed recovery of the airplane. The AAIB’s investigation revealed that failure of the inboard elevator PCU occurred because the servo valve secondary slide overtraveled to the internal retract stop and that the primary slide had moved to the limit of the extend linkage stop. (The 747 elevator PCU, as with the 737 main rudder PCU, contains dual-concentric servo control valves and is manufactured by Parker.) The AAIB issued its final report on this accident on December 14, 1994.239 The report identified the following causal factors: The secondary slide of the servo valve of the inboard elevator Power Control Unit (PCU) was capable of overtravelling to the internal retract stop; with the primary slide moved to the limit imposed by the extend 238 In testimony at the Safety Board’s January 1995 public hearing session regarding USAir flight 427, the AAIB investigator stated that, without the information available on the QAR, the event would have probably been attributed to a wake vortex encounter rather than an elevator-related anomaly. 239 See Air Accidents Investigation Branch. 1994. Report on the incident to Boeing 747-436, G-BNLY, at London Heathrow Airport on 7 October 1993. Aircraft Accident Report 1/95.

Factual Information 155 Aircraft Accident Report linkage stop, the four chambers of the actuator were all connected to both hydraulic supply and return, the servo valve was in full cross-flow resulting in uncommanded full down travel of the right elevators. A change to the hydraulic pipework associated with the right inboard elevator Power Control Unit was implemented on the Boeing 747-400 series aircraft without appreciation of the impact that this could have on the performance of the unit and consequently on the performance of the aircraft elevator system, in that it could exploit the vulnerability of the servo valve identified in (i) above. As a result of its investigation, the AAIB recommended that the Safety Board “consider re-issuing safety recommendation A-92-121 [asking the FAA to determine whether servo valves in other than those in the 737 PCU could induce flight control malfunctions or reversals] to verify that its full intent has been met.” Page 22 of the AAIB final report stated that Boeing was queried about what consideration it gave to the 747 inboard elevator PCU based on the Safety Board’s Safety Recommendation A-92-121 and that Boeing replied: Parker did an analysis to support the NTSB recommendation. Parker looked at all possible jam positions with pilot limiting linkage stops, specifically with the primary slide jammed at null and determining possible reversals. There were no discrepancies uncovered and therefore no actions taken. The extreme stop condition was not envisioned at the time. In connection with its investigation of the USAir flight 427 accident and because of its continuing concern about the potential for failure of the PCU servo valves in other designs and applications, the Safety Board issued Safety Recommendation A-96-117 on October 18, 1996. Safety Recommendation A-96-117 requested the FAA to Conduct a detailed design review of all dual-concentric servo control valves that control essential flight control system actuators on transport- category airplanes certificated by the FAA to determine if the design is susceptible to inducing flight control malfunctions and/or reversals as a result of unexpected improper positioning of the servo slides. If the design is determined to be susceptible, mandate appropriate design changes. On May 13, 1998, the FAA stated that its detailed design review of dual-concentric servo valves would address the intent of this safety recommendation. However, on February 2, 1999, the Safety Board indicated that airplanes produced by Airbus were not included in the FAA’s review. Pending the Safety Board’s review of the FAA’s detailed design review, including information on Airbus airplanes, Safety Recommendation A-96-117 was classified “Open—Acceptable Response.” (See section 1.18.11.5 for additional information regarding this recommendation.) Sahara India Airlines Training Flight Accident (737-200, VT-SIA) On March 8, 1994, a Sahara India Airlines 737-200, VT-SIA, was on a training flight when it experienced a loss of control during initial climbout after takeoff at the Palam Airport in New Delhi, India. The airplane crashed on an airport ramp area, caught

Factual Information 156 Aircraft Accident Report fire, and collided with a parked Aeroflot IL-86 near the international terminal. The four pilots on board the 737 (three pilots-in-training and one instructor pilot) and five individuals on the ground were killed, and four individuals on the ground received serious injuries. The final accident investigation report, issued in November 1996,240 stated that the cause of the accident was “the application of wrong rudder by [the] trainee pilot...during [an] engine failure exercise.” On November 14, 1994, the main rudder PCU from the Sahara Airlines 737 was examined at Parker’s facility in Irvine, California, under the supervision of Safety Board investigators. Examination of the PCU revealed that the unit had apparently been serviced at a facility other than the manufacturer and that a different serial number had been applied to the PCU. A servo valve test was performed to simulate a jammed primary slide and subsequent overtravel of the secondary slide. The test indicated that the PCU could reverse if the primary slide was jammed to the secondary slide and the rudder was moved rapidly or to its limits. According to Parker personnel, the PCU spring guide appeared to have been modified to a different configuration (one which would have fit a Boeing 707). Parker personnel attributed the PCU’s reversal potential to the use of this modified spring guide, which permitted more overtravel than a properly configured spring guide would have. It was not possible to determine where the spring guide had been reworked or when it had been installed. On December 5, 1994, the U.S. Accredited Representative to the Sahara accident (under the provisions of Annex 13 to the Convention on International Civil Aviation) advised the Indian Court of Inquiry of the incorrect spring guide installation and the resultant potential for reverse rudder operation. In a June 6, 1995, letter, the U.S. Accredited Representative advised the Indian Court of Inquiry that the final report regarding the Sahara accident did not mention the PCU-related findings. The Safety Board did not receive a response to either of these letters. Continental Airlines Flight 1057 (737-300, N17344) On April 11, 1994, Continental Airlines flight 1057, a 737-300, N17344, experienced flight control anomalies during a flight between Houston, Texas, and Tegucigalpa, Honduras. The flight crew diverted to San Pedro Sula, Honduras, and made a successful emergency landing. During postincident interviews, the pilots reported that they were in cruise flight at FL 370 when they heard a muffled boom and felt an uncommanded yaw and roll to the right. The pilots applied full opposite aileron to counteract the roll and disengaged the autopilot; however, they reported that control wheel forces were high for the remainder of the flight. The pilots reported that they maintained higher-than-normal airspeeds for improved controllability during the approach and landing. Review of the FDR information revealed that the yaw/roll event was consistent with a 2.5° sustained rudder input, which was consistent with the yaw damper authority 240 Report on Accident to Sahara India Airlines 737 Aircraft VT-SIA During Training Flight at IGI Airport, Delhi, on March 8, 1994. Indian Director General—Civil Aviation, November 1996.

Factual Information 157 Aircraft Accident Report for the given flight conditions (241 knots at 37,000 feet msl). Postincident examination of the airplane’s yaw damper revealed a higher-than-normal output voltage on the rate gyro of the yaw damper coupler. Further examination of the yaw damper revealed an intermittent open resistance condition in the yaw damper engage solenoid valve; this condition could allow the voltage from the PCU to build up over time within the yaw damper coupler and result in a maximum yaw damper command. The cause of the intermittent yaw damper engage solenoid operation was determined to be hydraulic fluid contamination of the solenoid’s coil assembly. On June 9, 1997, the FAA issued AD 97-09-15, which requires replacing the yaw damper engage solenoid with a solenoid that has encapsulated electrical coils to prevent the intrusion of hydraulic fluid. The solenoid was to be replaced the next time the PCU is repaired or within 5 years or 15,000 flight hours from the AD’s date of issuance. British Airways Maintenance Test Flight Incident (737-236, G-CBJI) On October 22, 1995, a British Airways 737-236, G-CBJI, experienced several yaw/roll oscillations during a postmaintenance test flight. The pilots were preparing to test the passenger oxygen mask automatic deployment system at an altitude of about 20,000 feet msl and an airspeed of 290 knots when the oscillations began. The pilots disconnected the autopilot and autothrottle system, and the captain reported that he believed he turned off the yaw damper system; however, the oscillations continued. The oscillations exceeded 10° of bank with a period between peaks of about 2 seconds. The flight crew declared an emergency and started a descent back to the departure airport (London’s Gatwick Airport). At an altitude of about 7,000 feet msl and an airspeed of 250 knots, the oscillations began to decrease in severity and subsequently stopped completely. The pilots landed the airplane at Gatwick Airport without further incident. The incident was investigated by the AAIB, which determined that the cause of the yaw/roll oscillations was corrosion of a multipin electrical connector inside the yaw damper coupler. The failure resulted in the yaw damper moving the rudder back and forth within the yaw damper limits (± 2° on this airplane). The combination of rudder oscillations, air density, and airspeed allowed for excitation of the airplane’s natural frequency in the dutch roll mode. Once the airplane descended to denser air and reduced airspeed, the excitation was damped and the oscillations stopped. The AAIB’s investigation found that the corrosion in the electrical connector was most likely the result of leakage from the forward lavatory or galley. Additionally, the investigation revealed that it might be possible to “generate stray current paths capable of sustaining engagement of the yaw-damper system when selected to OFF, but only in the presence of a high resistance in the engage-switch earth [ground] path.” As a result of this incident and others involving fluid contamination of the 737 E/E bay components, Boeing created an assessment team to investigate the problem and recommend solutions. Appendix F provides information about the assessment team’s activities, composition, and recommendations.

Factual Information 158 Aircraft Accident Report Delta Air Lines Incident (737-200, N377DL) On August 13, 1998, a Delta Air Lines 737-200, N377DL, experienced a yaw/roll event while en route from Houston to Cincinnati, Ohio. The event occurred while the airplane was in cruise flight at FL 330 in the vicinity of Memphis, Tennessee. The airplane was operating on the autopilot and in the “heading select” and “altitude hold” modes with the autothrottles engaged. The pilot stated that the first irregularity he noted was that the airplane did not turn when the heading bug was moved a few degrees. He noted that the control wheel was not centered so he added rudder trim and disengaged the autopilot. He then reengaged the autopilot, but rudder trim was required again. About 5 minutes after reengaging the autopilot, the airplane made an abrupt uncommanded right turn. The pilot said that he then took the controls, disengaged the autopilot, and applied left rudder and “a little left aileron.” He did not turn off the yaw damper. The pilot stated that he thought the airplane had lost an engine. After the event, the flight continued uneventfully and landed in Cincinnati. The pilot made a maintenance entry regarding the autopilot, and the airplane was decommissioned by Delta maintenance for the subsequent flight. The FDR on the airplane recorded 11 parameters, but rudder surface or rudder pedal position were not among those parameters. Examination of the FDR and radar data revealed that on the flight from Houston to Cincinnati, while at an altitude of 34,000 feet and an airspeed of 320 knots on a northerly heading, the airplane experienced a right heading excursion of 4.2° within 1 second. The airplane’s bank angle changed from about 1° RWD to about 13° RWD within 2 seconds of the initial heading change. After the 4.2° heading change, the airplane’s heading increased in an oscillatory manner until the airplane was steadied after a total heading change of 7°. The heading was stabilized within 20 seconds of the initial heading excursion. On the subsequent flight, the same airplane experienced a yaw/roll event while en route from Cincinnati to Greensboro, North Carolina. The flight crew reported that the airplane abruptly yawed left and then started to roll left. The captain reported that, during this left yaw event, he had to apply considerable right control wheel input to maintain wings-level flight. The flight crew reported that the yaw stopped but that the airplane then yawed to the right just past neutral. The flight crew then disengaged the yaw damper. Both crewmembers reported that the rudder pedals “pulsed” for the remainder of the flight. Further examination of the FDR data indicated that, while at a cruise altitude of 23,000 feet and an airspeed of 325 knots, the airplane first experienced a left heading change of 1.6° within 1 second, followed approximately 20 seconds later by a right heading change of 2° within 1 second. During the same time, the airplane’s roll angle was between 3° LWD and 5° RWD. Further calculations by the Safety Board determined that the rudder position changes necessary to produce the abrupt yaws were consistent with a yaw damper system input to the rudder and would not have exceeded the yaw damper system authority. Delta subsequently examined the main rudder PCU and yaw damper coupler and reported that no anomalies were found.

Factual Information 159 Aircraft Accident Report 1.18.1.1.1 QAR Data Findings Although the origins of many 737 yaw/roll events were identified, some were not as easily explained, including the anomalous yawing motions reported by the pilots who flew the United flight 585 airplane during the month before the accident; the accidents involving United flight 585, Sahara India Airlines, and USAir flight 427; the preincident Eastwind Airlines rudder “bumps;” the Eastwind flight 517 uncommanded yaw/roll incident; and the SilkAir accident (for more information regarding the SilkAir accident, see section 1.16.5.4.1). During its investigation of the USAir flight 427 accident, the Safety Board contracted with Flight Data Limited. in the United Kingdom to examine QAR data from 737s operating in Europe for evidence of unusual rudder activity and rudder movements opposite to the control wheel movements. Review of the resultant QAR data (about 57,000 hours of operational data from 27 airplanes, including rudder position and control wheel position) indicated the following: • 737 rudder position remained within the yaw damper range of operation during 97 to 98 percent of the samples (including departure, cruise, and approach-to- landing phases of flight). • 737 control wheel position data showed that pilots were not likely to exceed 20° of control wheel input during cruise flight (99.9 percent of cruise flight control wheel position samples were within 20° of neutral). • 737 control wheel position data indicated that the control wheel remained within 20° of neutral in 94.4 percent of the samples during the departure phase of flight (between 50 and 5,000 feet agl) and in 95.9 percent of the samples during the approach-to-landing phase of flight (between 5,000 and 50 feet agl). 1.18.1.2 Recent Rudder-Related Events on 737s Equipped With the 1998 Redesigned Servo Valve Parker redesigned the main rudder PCU servo valve twice—once in response to Safety Recommendation A-92-120 and AD 94-01-07 and again after Safety Board testing in 1996 revealed the potential for the servo valve primary slide to overtravel if the secondary slide jammed to the housing. (See section 1.18.5 for additional information.) The second redesigned servo valve was completed in 1998. The following two rudder- related events involved 737s that were equipped with the newly redesigned servo valve: United Airlines Ground Check Rudder Anomaly (737-300, N388UA) On February 19, 1999, the flight crew of a 737-300, N388UA, operated by United Airlines reported a stiff or sluggish rudder response during a pre-takeoff flight control check at Seattle, Washington. The flight crew stated that, when left rudder pedal was applied, the required pedal pressure felt somewhat greater than normal and that the right pedal would only move with an unusually large amount of force. After the pilots repeated the check several times with similar results, they returned to the terminal gate.

Factual Information 160 Aircraft Accident Report Maintenance personnel tested the rudder pedals and also found that an unusual amount of force was required to move the right rudder pedal. The maintenance personnel further found that the force required to move the right rudder pedal increased with the rate of input and that the left rudder pedal required slightly more force than that normally experienced. The rudder system was examined, and no discrepancies were noted in the cables, linkages, and push rods. The main rudder PCU was removed from the airplane. After a replacement PCU was installed, the forces required to move the rudder pedals returned to normal. The airplane was then returned to service, and no further problems with the rudder system have been reported. The main rudder PCU (which was equipped with the modified servo valve per AD 97-14-04 and had been tested to check for cracking of the secondary slide 71 flight hours [61 flights] before the anomalous ground check in Seattle)241 was examined under the Safety Board’s direction at United’s maintenance facility in San Francisco. Before disassembly, the PCU input crank was noted to be visibly offset. Further, the PCU did not pass Parker’s standard acceptance test procedure. After disassembly of the PCU servo valve, the valve spring guide was found to be mispositioned, thereby pushing the secondary slide off center and resulting in high leakage and an unequal amount of force necessary to achieve a right or left rudder input. After the guide was properly positioned, the servo valve passed the acceptance test procedure. The mechanic who had previously performed the test to detect secondary slide cracking on the incident servo valve indicated to Safety Board investigators that the servo valve was the first one at United to be tested for such cracks. The mechanic stated that, after he tested the servo valve for a cracked secondary slide, the PCU passed the acceptance test procedure. However, the mechanic reported that he then demonstrated the test to detect secondary slide cracking to another United employee using the same PCU but that he did not repeat the acceptance test procedure after completing the second (demonstration) test. Parker representatives indicated that implementation of the secondary servo valve slide test procedures to detect cracking could have displaced and rotated the spring guide. They also stated that a mispositioned spring guide should have been noted during an acceptance test procedure or after testing of the rudder system when the PCU was installed on the airplane. Additionally, Parker representatives indicated that improper rudder response caused by the mispositioned spring guide should have been noticed either during flight control checks or in flight. The Safety Board’s investigation of this incident is continuing. USAirways Metrojet In-flight Rudder Movement (737-200, N282AU) On February 23, 1999, a 737-200 operated by USAirways as Metrojet flight 2710, N282AU, made an emergency landing at Baltimore-Washington International Airport 241 For additional information regarding AD 97-14-04, see section 1.18.5.

Factual Information 161 Aircraft Accident Report (BWI) after the flight crew reported to ATC that it was experiencing control problems with the airplane’s rudder. The flight crew consisted of a training captain and a captain who was receiving initial operating experience (IOE). The training captain reported that, while in cruise flight with the autopilot engaged, he noticed that the control wheel was rotating to the left but that the airplane was not turning. The training captain stated that, after he disconnected the autopilot and took control of the airplane, he noticed that the right rudder pedal was displaced at what appeared to be full forward travel. The training captain stated that he had to apply left aileron input and asymmetric engine power to prevent the airplane from rolling to the right. Further, that captain reported that he pushed on the left rudder pedal but that it would not move. The captain receiving IOE stated that he also pushed on the left rudder pedal and found that it would not move. According to the pilots, they turned off the yaw damper, but the right rudder pedal remained displaced. The pilots reported that, after they moved the hydraulic system B switch to the standby rudder position242 the rudder pedals returned to their neutral position. The flight crew reported that the rudder pedals moved, or “kicked,” several times during the approach to landing. The airplane was examined at BWI by Safety Board investigators with participation from Boeing, FAA, USAirways, ALPA, and International Association of Machinists and Aerospace Workers representatives. Investigators inspected the operation of the rudder system from the rudder pedals to the main rudder PCU and standby rudder PCU for any evidence of jamming or other malfunction that could have caused the event but found no evidence of any jam. Investigators also tested the landing gear (by retracting them while the airplane was raised on jacks) but found no evidence of binding or jamming in the nosewheel steering mechanism. The main rudder PCU and a standby rudder PCU were removed from the incident airplane at the Safety Board’s request. After replacement PCUs were installed, the airplane was returned to service. No problems with the rudder system have been reported since the airplane reentered service. The main rudder PCU (which was equipped with the modified servo valve per AD 97-14-04) was removed from the airplane and examined by investigators at Parker’s facility in Irvine, California. The PCU passed all functional examinations, and the subsequent teardown examination found no evidence of a jam or binding in the servo valve. Examination of the standby rudder PCU revealed no discrepancies and no galling of the input rod bearing. The FDR from the incident airplane was examined at the Safety Board’s laboratory. The FDR recorded 11 parameters, and rudder surface and rudder pedal position were not among the parameters. Simulation and kinematic studies of the data are being conducted by the Safety Board and Boeing. Preliminary results of these studies indicate that, during the upset, the rudder moved slowly to the blowdown limit. The Safety Board's investigation of this incident is continuing. 242 Moving the B hydraulic system switch to the standby rudder position removes B hydraulic system pressure from the main rudder PCU and energizes the standby hydraulic pump, thus pressurizing the standby rudder PCU.

Factual Information 162 Aircraft Accident Report 1.18.2 Independent Technical Advisory Panel In January 1996, the Safety Board formed an independent advisory panel to review the work accomplished by the Systems Group in the USAir flight 427 investigation, ensure that all systems issues had been fully addressed, and provide guidance and suggestions to the Systems Group as appropriate. The six-member advisory panel consisted of five technical experts and engineers specializing in aircraft systems and hydraulic components from NASA, the FAA, the USAF, and two hydraulic component manufacturing companies and one independent system safety and reliability consultant. The advisory panel members’ areas of specialization included • failure analysis, • hydraulic systems and components, • contamination/filtration, • FAA Critical Design Review (CDR) team/hydraulics, and • powered flight controls. The advisory panel’s initial meeting was held in Washington, D.C., on February 8,

1. At the meeting, the panel members were presented with all completed factual

reports, test data, transcripts of public hearing testimony, and an outline of further planned engineering tests and actions for the USAir flight 427 accident as well as pertinent information regarding the United flight 585 accident. During the first meeting, one of the panel members stated that he had worked on a military fighter project that had used a control system PCU similar in design to the 737 main rudder PCU. He stated that an accident caused by a jammed PCU occurred very early in the initial production test flights. According to the panel member, the investigation of that accident determined that the PCU jammed when a sudden full-rate input caused hot hydraulic fluid to enter the cold PCU. The panel member reported that the thermal expansion of the inner parts of the PCU into the cold PCU body resulted in the jammed condition. The Systems Group developed thermal shock test plans and, with the panel’s participation, conducted these tests on a new-production main rudder PCU and the USAir flight 427 airplane’s main rudder PCU. (The results of those tests are discussed in section 1.16.5.4.7.) In comments dated October 31, 1996, another panel member stated that the accident airplane’s PCU servo valve had characteristics that might have made it more susceptible to binding than other main rudder PCU servo valves. That panel member stated that the characteristics that may have made the accident PCU servo valve more susceptible to binding resulted from a combination of factors, such as dirty hydraulic fluid, thermal shock, rapid input, and normal load factors. The panel member further noted that, although the accident PCU servo valve diametrical clearances met the specifications that existed at the time it was manufactured, those specifications had been refined since that time. Other panel members did not provide formal comments on the thermal test results.

Factual Information 163 Aircraft Accident Report In addition, the independent technical advisory panel was also involved in the following investigative activities: • Tests to determine the effects of silting from fluid contamination on the main rudder PCU. • Cable break tests. • Review of wake turbulence encounter flight test data. The advisory panel concluded that the forces involved in wake encounters were not sufficient to produce a yaw of the magnitude observed (after the initial upset) in flight dynamics simulations of USAir flight 427. • Examination and hardness tests of the bent PCU actuator rod. The advisory panel concluded that the actuator rod exhibited impact-related damage and that the rod hardness was found to be within specifications. • Review of other scenarios, including (1) separation of rudder skin, leading edge slat failure over the wing, and asymmetric spoilers—the advisory panel considered these were unlikely to have resulted in the accident because of the low yaw moments produced; (2) yaw damper anomalies—the advisory panel concluded that most yaw damper anomalies involve minor flight control interruptions, which would not result in a loss of aircraft control; and (3) foreign object jam at the external stop or external link that would prevent return of the input lever—the advisory panel concluded that the external protection of the stop gap made this scenario unlikely. • Review of available information regarding 737 yaw incidents. • Review of 1990 revision to the servo valve tolerances. • Review of maintenance records for the accident airplane. • Examination of the mechanical linkage and cables for rudder jam/reversal mechanism. In April 1997, the independent technical advisory panel briefed the Safety Board on its work. The panel recommended several areas for further study, including the thermal shock phenomenon, the servo valve’s tight diametrical slide clearances, possible causes of linkage binding, and the effects of silting. The Safety Board conducted further study in some of these areas. In September 1997, the advisory panel’s formal efforts ended, but individual members of the panel continued to be contacted for consultation as needed by the Safety Board. 1.18.3 Boeing 737 Certification Requirements and Information 1.18.3.1 Initial Certification of the 737-100 and -200 Series The Boeing 737 design was conceived in the early 1960s, and the original type certificate (which included the 737-100 and -200 series airplanes) was issued in December

1. According to original type certification documentation, Boeing performed analysis

Factual Information 164 Aircraft Accident Report and testing and demonstrated compliance with the type certification requirements that were contained in 14 CFR Part 25 at that time. When the 737-100 and -200 series airplanes were certificated, 14 CFR Section 25.695, entitled “Power-boost and power-operated control system,” stated the following: (c) The failure of mechanical parts (cables, pulleys, piston rods and linkages) and the jamming of power cylinders must be considered unless they are extremely remote.243 According to transcripts of meetings attended by FAA and Boeing personnel on May 4 and 5, 1965, FAA certification personnel raised questions during the 737-100 and -200 certification process about the airplane’s single-panel, power-actuated rudder design. At that time, Boeing personnel stated that redundancy was provided by the dual- concentric PCU servo valve and dual load path design244 of the rudder actuator system. The Boeing officials indicated that the servo valve assembly was designed to accommodate a single jam (primary slide to secondary slide or secondary slide to housing) without resulting in a loss of control of the PCU because, if either the primary or secondary slides were to jam, the other slide should still move to counteract the jam and connect the proper flow paths to command rudder movement in the intended direction. Boeing officials also acknowledged that such a single jam could remain undetected until the valve assembly was removed and examined and that a single jam might not be perceptible to the pilot during normal operations, although it would result in a slower rudder movement and a reduced hinge moment. During the 737 initial certification process, Boeing provided the FAA with a failure analysis of possible malfunctions of the rudder control system (Boeing document D6-14072, dated March 1967). In addressing several possible rudder control system failures, this analysis stated repeatedly that a jammed rudder or rudder control system could be “countered by the use of the lateral [roll] control system.” The Boeing analysis also stated that the 737’s “lateral [roll] control authority exceeds the rudder control authority at any rudder angle it would be reasonable to expect the pilot to command under all flight conditions” and that lateral control authority could therefore be used “to overcome the effect of a jammed rudder control system or loss of rudder control.” 245 Further, in specifically addressing the requirements of 14 CFR Section 25.695(c), Boeing stated in the March 1967 failure analysis report that “…in the event of a jamming failure 243 “Extremely remote” was not specifically defined, and a mathematical probability was not officially provided. However, during postaccident discussions, several FAA aircraft certification representatives stated their belief that extremely remote was essentially a probability of 1 × 10-6 or less for each flight hour. 244 The dual load path design provides two structurally redundant paths for inputting pilot commands to the main rudder PCU, including separate and independent linkages, levers, and cranks, so that a failure or malfunction in one load path will not affect the proper operation of the PCU. The redundant paths are created by the use of redundant designs (such as a push rod within a push rod or a fastener within a fastener) or mirror-image designs (for levers, linkages, and cranks). 245 This statement was made in the context of addressing the effects of a failure of the manual control system between the rudder pedals and the forward rudder quadrants at the pilots’ stations.

Factual Information 165 Aircraft Accident Report that immobilizes the rudder system[,] yaw control can be maintained through the use of lateral [roll] control.” 1.18.3.2 Regulatory Changes Made After Certification of the 737-100 and -200 Series (Sections 25.671 and 25.1309) In April 1970, the FAA issued amendment 25-23 to 14 CFR Part 25. According to the FAA, the amendment was intended “to improve the airworthiness requirements applicable to the type certification of transport category airplanes.” (35 Federal Register 5665, April 8, 1970.) Among the new requirements promulgated in the amendments were those in Section 25.671 (which appears in Subpart D of Part 25, “Design and Construction,” and supersedes the requirements of 25.695). Section 25.671, entitled “General,” states in part: (c) The airplane must be shown by analysis, tests, or both, to be capable of continued safe flight and landing after any of the following failures or jamming in the flight control system and surfaces (including trim, lift, drag, and feel systems), within the normal flight envelope, without requiring exceptional piloting skill or strength.[246] Probable[247] malfunctions must have only minor effects on control system operation and must be capable of being readily counteracted by the pilot. (1) Any single failure, excluding jamming (for example, disconnection or failure of mechanical components, such as actuators, control spool housing, and valves). (2) Any combination of failures not shown to be extremely improbable,[248] excluding jamming (for example, dual electrical or hydraulic system failures, or any single failure in combination with any probable hydraulic or electrical failure). (3) Any jam in a control position normally encountered[249] during takeoff, climb, cruise, normal turns, descent, and landing unless the jam is shown to be extremely improbable, or can be alleviated. A runaway of a flight control to an adverse position and jam must be accounted for if such runaway and subsequent jamming is not extremely improbable. 246 The terms “normal flight envelope” and “exceptional piloting skill” are not defined in the Federal Aviation Regulations (FAR). However, the 737 AFM contains flight limitations, such as allowable load limits and airspeeds in the “Limitations” section. 247 Probable was (and is) defined in FAA Advisory Circular (AC) 25.1309-1A, “System Design and Analysis,” June 21, 1988, as a probability of failure on the order of greater than 1 × 10-5 for each flight hour. 248 “Extremely improbable” failure conditions are described in FAA AC 25.1309-1A as “those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type” and “having a probability on the order of 1 × 10-9 or less each flight hour, based on a flight of mean duration for the airplane type.” 249 The term “normally encountered” was not defined in the FARs. However, as further discussed in section 1.18.3.4, the FAA defined a “normally encountered” rudder position for the 737-NG certification as 2.5° or less.

Factual Information 166 Aircraft Accident Report FAA Amendment 25-23 also included new requirements in Section 25.1309, entitled “Equipment, Systems, and Installations” (which appears under Subpart F of Part 25, “Equipment”). That section states in part: (a) The equipment, systems, and installations, whose functioning is required by this subchapter, must be designed to ensure that they perform their intended functions under any foreseeable operating condition. (b) The airplane systems and associated components, considered separately and in relation to other systems, must be designed so that – (1) The occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane[250] is extremely improbable, and (2) The occurrence of any other failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable.251 Warning information must be provided to alert the crew to unsafe system operating conditions, and to enable them to take appropriate corrective action. Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors, which could create additional hazards. (d) Compliance with the requirements of paragraph (b) of this section must be shown by analysis, and where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider – (1) Possible modes of failure, including malfunctions and damage from external sources; (2) The probability of multiple failures and undetected failures; (3) The resulting effects on the airplane and occupants, considering the stage of flight and operating conditions, and (4) The crew warning cues, corrective action required, and the capability of detecting faults. The FAA’s Advisory Circular (AC) 25.1309-1A describes various acceptable means for showing compliance with the requirements of Section 25.1309(b), (c), and (d). According to the AC, Section 25.1309 requires that there be “a logical and acceptable inverse relationship between the probability and the severity of each failure condition, such that ‘minor’ failure conditions may be probable, ‘major’ failure conditions must be 250 Such a failure is referred to as a “catastrophic” failure condition in FAA AC 25.1309-1A. 251 “Improbable” failure conditions are described in the FAA’s AC 25.1309-1A as “those not anticipated to occur during the entire operational life of a single random airplane. However, they may occur occasionally during the entire operational life of all airplanes of one type.” These conditions are further defined as “those having a probability on the order of 1 × 10-5 or less, but greater than on the order of 1 × 10-9 each flight hour, based on a flight of mean duration for the airplane type].”

Factual Information 167 Aircraft Accident Report improbable, and ‘catastrophic’ failure conditions must be extremely improbable.”252 The AC provides the following definitions of those failure conditions: • Minor: those that would not significantly reduce airplane safety, and which involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload, such as routine flight plan changes, or some inconvenience to occupants; • Major: those that would reduce the capability of the airplane or the a crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or some discomfort to occupants; or, in more severe cases, a large reduction in safety margins or functional capabilities, higher workload or physical distress such that the crew could not be relied on to perform its tasks accurately or completely, or adverse effects on occupants; and • Catastrophic: those that would prevent continued safe flight and landing. In a May 13, 1998, letter, the FAA Administrator offered the following additional explanation of the term “catastrophic failure condition:” A catastrophic failure is one that will always result in an accident. In the case of a dual slide jam in the rudder PCU, this condition will not always result in an accident. The airplane is fully controllable in that configuration throughout much of its flight envelope. Thus, it is not a catastrophic event as defined by FAA regulations and policy. Not being catastrophic, the regulations do not require that the dual slide jam be extremely improbable. Nevertheless, with the service history and the number of hours of operation on the 737, the FAA believes a dual slide valve jam has been shown to be extremely improbable and in compliance with the regulations. 1.18.3.3 Certification of the Boeing 737-300, -400, and -500 Series (Derivative Certification) According to 14 CFR Section 21.17, an applicant for a type certificate must show that the aircraft meets the applicable regulatory requirements “that are effective on the date of application for that certificate.” However, according to Section 21.19, when a manufacturer proposes a change to an aircraft that has already been certified, a new application for a new type certificate is required only if (a) The Administrator finds that the proposed change in design, configuration, power, power limitations (engines), speed limitations 252 The AC further states that “the failure of any single element, component, or connection during any one flight...should be assumed, regardless of its probability” and that “subsequent failures during the same flight, whether detected or latent, and combinations thereof, should also be assumed, unless their joint probability with the first failure is shown to be extremely improbable.”

Factual Information 168 Aircraft Accident Report (engines), or weight is so extensive that a substantially complete investigation of compliance with the applicable regulations is required [or]; (b) ...the proposed change is...in the number of engines or rotors; or...[t]o engines or rotors using different principles of propulsion or to rotors using different principles of operation. Further, 14 CFR Section 21.101 states that (a) ...an applicant for a change to a type certificate must comply with either– (1) The regulations incorporated by reference in the type certificate; or (2) The applicable regulations in effect on the date of the application, plus any other amendments the Administrator finds to be directly related. (b) If the Administrator finds that a proposed change consists of a new design or a substantially complete redesign of a component, equipment installation, or system installation, and that the regulations incorporated by reference in the type certificate for the product do not provide adequate standards with respect to the proposed change, the applicant must comply with– (1) The applicable [regulatory] provisions . . . in effect on the date of the application for the change, that the Administrator finds necessary to provide a level of safety equal to that established by the regulations incorporated by reference in the type certificate for the product; and (2) Any special conditions, and amendments to those special conditions, prescribed by the Administrator to provide a level of safety equal to that established by the regulations incorporated by reference in the type certificate for the product. When the 737-300 series airplane was added to the 737 type certificate in November 1984 (followed by the 737-400 series in 1988 and the -500 series in 1990), some updated regulations were added to the type certification basis for those models. However, the certification basis for those airplanes consisted primarily of the same certification requirements and design criteria that existed for the original -100 and -200 series airplanes (certificated 17 years earlier). The -100 through -500 series airplanes were certificated with the original rudder system design. According to Boeing and FAA personnel, the newer series 737 airplanes (737-300, -400, -500) were derived from the existing certificated models (737-100 and -200) and the flight control system designs for the newer series airplanes were similar to the existing models (and not unique to the newer series airplane). The officials stated that the FAA therefore did not require Boeing to meet the certification requirements of 14 CFR Sections 25.671 or 25.1309. In a November 24, 1998, letter to the Safety Board, the FAA stated that “it is by no means certain that if [Section] 25.671 amendment 23 had been applied to the original 737 certification, that the system would have been significantly different.”

Factual Information 169 Aircraft Accident Report According to an appendix to Boeing’s 1967 analysis report that was added in 1984 to address the certification of the 737-300, “the 737-300 rudder control system is essentially unchanged from the 737-200 design. Modifications to the 737-200 design have been made due to differences in 737-300 requirements, aerodynamic characteristics, and to provide improved uncontained engine failure protection. All of the modifications have no effect on the basic method of system operation, failure modes, redundancy, or interaction with other systems.” In addressing the requirements of Section 25.695(c), the 1984 appendix stated that, in the event of a jamming failure that immobilized the rudder system, yaw control can be maintained through the use of the lateral (roll) system. In a separate failure analysis report pertaining to the 737-300, -400, and -500 series airplanes that addressed potential rudder system failures (prepared by Boeing in February 1995 at the FAA’s request), Boeing indicated that lateral control authority would be adequate to control a rudder offset for a jam at a normally encountered flight position. In discussing a jam of the manual input linkage to the hydraulic control valve in the main rudder PCU, the analysis report stated that roll control authority “exceeds the rudder control authority for most but not all flight conditions.” In discussing the effects of a jam of the main rudder PCU servo valve’s primary or secondary slides, the analysis report stated that “for most valve jams the rudder would remain operable and no pilot action would be required” but that “for a worst case jam [seizure of either the primary or the secondary slide at its fully deflected position, resulting in the loss of actuator force capability in one direction] the pilot could maintain flight path control using the lateral control system.” The Safety Board notes that the Boeing 757, which was certificated in 1982, was designed with three rudder actuators. Boeing indicated that the use of three actuators on that airplane allowed autopilot control over the rudder during autolandings and removed the need to mass balance the rudder. 1.18.3.4 Certification of the 737-600, -700, and -800 Series According to the FAA type certification data sheets, Boeing showed compliance with most of the current requirements of 14 CFR Part 25, including Section 25.671, during certification of the 737-600, -700, and -800 series airplanes (737-next-generation [NG] series airplanes).253 In a November 24, 1998, letter to the Safety Board, the FAA indicated that it had encouraged Boeing to comply with the newer regulations in certifying the 737-NG series airplanes and that Boeing had elected to do so. During meetings in January and February 1996, Boeing, the FAA, and Joint Airworthiness Authority representatives developed an agreement for an acceptable means 253 According to Boeing, 737-NG series airplanes fly for longer ranges, at higher altitudes, and at faster speeds; use less fuel; and produce less noise that the earlier series 737s. The 737-NG series airplanes also have a longer/wider wing with improved aerodynamics, advanced cockpit displays, and more powerful engines. Because of the enhanced engine power, the 737-NG series airplanes have a larger rudder so that airplane control can be maintained in the event of an engine failure. The main rudder PCU of the 737-NG series airplanes is more powerful than that used on earlier series airplanes, and the PCUs are therefore not interchangeable.

Factual Information 170 Aircraft Accident Report of showing 737-NG compliance with Section 25.671(c)(3). The representatives agreed that service history and exposure time could be used to show compliance.254 In a February 1996 document entitled “Primary Flight Controls, Ground Spoilers, and High Lift System Certification Plan,” Boeing indicated that it intended to show compliance with Section 25.671(c)(3) by design review, safety assessment, flight tests and simulations, and service experience. This document also contained a description of the intended means of compliance, which stated in part: A system safety analysis will be conducted to show that failure conditions that could prevent continued safe flight and landing are extremely improbable. Design changes have been made to ensure that uncommanded rudder motion is controllable with wheel in the vast majority of the flight envelope. Means are available on the flight deck which will allow the rudder to return to the faired position. Jams causing uncommanded motion that could be uncontrollable will be shown to be extremely improbable due to the very short exposure time and the very low failure rate demonstrated in service. In an April 23, 1996, letter, the FAA informed Boeing that its proposed certification plan for the 737-NG was acceptable (with some exceptions that were not relevant to Section 25.671). On September 29, 1997, the FAA closed issue paper F-2, which addressed flight control jams for the 737-NG series airplanes. The issue paper defined the normally encountered flight control positions for the 737-NG, noting that “applicants have generally been unable to demonstrate that it would be extremely improbable for a flight control jam to occur in a control position normally encountered, or that a jam could be alleviated” and that “therefore, it must be shown that the airplane retains structural integrity, has sufficient remaining control authority, and is controllable following such a jam, without requiring exceptional piloting skill or strength.” The FAA stated that a jam in a flight control is expected to occur approximately once every 10 million flight hours. Boeing indicated its belief that a jam in a flight control is expected to occur approximately every 9 million flight hours. The FAA indicated in issue paper F-2 that, during takeoff, normally encountered roll/yaw control positions were those necessary to counteract a steady 15-knot crosswind and that it would also be necessary to consider approach and landing configurations to address jams during the final flight phase. The issue paper further defined normally encountered roll/yaw control positions after takeoff as the more critical of one-third of the total travel of the control surface, the authority limit of the yaw damper, or those positions required to counter a 25-foot-per-second discrete gust. In its November 24, 1998, letter to the Safety Board, the FAA indicated that it considered the normally encountered control position for the 737-NG series airplanes to be 2.5° of rudder, which is approximately the maximum yaw damper authority. 254 The information in this paragraph and in several of the paragraphs that follow is contained in briefing materials prepared by Boeing for presentations it made to the FAA during October 1997. Boeing provided those briefing materials to the Safety Board in response to its requests for information pertaining to certification of the 737-NG series airplanes.

Factual Information 171 Aircraft Accident Report Issue paper F-2 also described Boeing’s position, as indicated in a June 26, 1997, document, that a 2° rudder displacement should be accepted as the maximum normally encountered position. Boeing stated that the “service history of these systems on previous models provides evidence to validate the qualitative evaluations of these areas. Additionally, further jam protection features have been added to the flight control system for the 737-600/-700/-800.” Boeing also stated that …for areas of the flight control system where rigid jams cannot be shown to be extremely improbable, Boeing plans to conduct analysis and/or testing to demonstrate that continued safe flight and landing is possible, without requiring exceptional piloting skill or strength, after a jam in a normally encountered position. Based on a review of in-service jam incidents, there is no evidence which would indicate that a jam failure becomes more likely [at] greater…deflection[s]. From Boeing service history, the probability of a jam is less than 10-7/flt hr. …therefore, evaluation of jams will be accomplished at the maximum control position which addresses 99% of system operational exposure time. Jams outside the 99% boundary are extremely improbable based on the 10-7/flt hr failure rate. This maximum control position will be determined from a survey of in-service and flight test recorded data. According to Boeing’s October 1997 briefing materials, the FAA informed Boeing on October 15, 1997, that the 737-NG elevator and rudder control systems did not comply with Section 25.671(c)(3). The FAA indicated that the definition of extremely improbable in Section 25.671(c)(3) did not allow the use of exposure time and that the possibility of the jam itself must be less than 10-9. In its November 24, 1998, letter to the Safety Board, the FAA indicated that it initially concluded that the use of a small exposure time (as proposed by Boeing) was not appropriate to show a jam to be extremely improbable. The FAA stated that its conclusion was based on the belief that this type of probability analysis had never been used to show compliance with Section 25.671(c)(3) and that no existing policy provided direction on the use of this type of analysis. The briefing materials stated that Boeing appealed the FAA’s finding of noncompliance and presented its position on October 22 and 27, 1997, to local FAA certification officials in Seattle and on October 28 and 29, 1997, to FAA upper management in Washington, D.C. Boeing’s position was that a showing of jam avoidance was permitted by Section 25.671(c)(3). Boeing stated that its interpretation of Section 25.671(c)(3) was that a new airplane without a service history must be designed for jam tolerance but that derivative airplanes with a proven service history could be designed for jam tolerance where possible and jam avoidance in other areas. Boeing stated that the FAA’s interpretation of Section 25.671(c)(3) was inconsistent with the language of the rule. Boeing cited AC 25.1309-1A, paragraphs 10a and 10b, in its argument that existing FAA policy allowed an event to be shown to be extremely improbable by multiplying the failure rate of the jam by the exposure time of the flight phase(s) when the jam would be catastrophic.

Factual Information 172 Aircraft Accident Report Boeing further asserted that the FAA’s interpretation of Section 25.671(c)(3) would not have allowed a finding that the Boeing 747, 757, 767, and 777 complied with that rule, even though the FAA had already made such findings. Boeing indicated that its proposed exposure time-based analysis had been used in past certifications of these airplanes for failures that are only catastrophic during short segments of flight, such as rudder control on takeoff with an engine out, spoiler surface hardover at low altitude, autolands, 777 rejected takeoffs, and 777 thrust asymmetry compensation failures on takeoff. Boeing stated that both the 737-NG and 747 were exposed to rate jams, which could result in rudder hardovers that would be controllable except at a low altitude, and that a jam avoidance design philosophy had been used in the certification of the 747. Boeing argued that, because the 747 and the 737-NG have the same certification basis, the rule has not been changed, and no advisory material has been issued, the 747 precedent established policy and an acceptable means of showing compliance with the rule. Boeing indicated that the FAA’s change in position regarding the acceptability of Boeing’s originally proposed means of showing 737-NG compliance came “late in the game” with no practical opportunity for a design fix. Boeing argued that the change in the FAA’s past interpretation of the rule was not justified, given the number of flight hours accumulated by the existing 737 series and the design improvements incorporated to enhance the system, and that the new interpretation had not achieved consensus across the aviation industry. Boeing indicated during its October 1997 presentations to the FAA that it did not believe a “position jam” (defined by Boeing as one that would occur in a normally encountered position and fix the rudder in a steady-state position) was an issue because the failure would be controllable. Boeing indicated that rate jams (defined by Boeing as those that would cause a hardover position outside of that normally encountered) could be caused either by a dual slide jam or an input arm jam. (Boeing’s presentation did not address the single jam/reversal failure mode.) According to Boeing, concerns about a dual slide jam could be eliminated because of the servo valve’s dual concentric design.255 Further, Boeing indicated that no input arm rate jams had been identified in the 737 fleet’s service history and that, as a result of this finding, a design review, and tests, no input arm rate jam scenario was foreseeable. As further protective measures, Boeing cited the addition of a hydraulic pressure limiter, which would reduce the exposure time of a catastrophic rudder hardover to a 60- to 90-second window on takeoff and landing, and a rudder hardover shutdown procedure. Boeing’s qualitative assessment indicated that a catastrophic rate jam (that is, one that would occur during the 60- to 90-second exposure window at takeoff or landing) was extremely improbable based on service experience, design, and limited exposure. 255 Boeing indicated that the probability of a jam of the primary slide was 2.36 × 10-3 and that the probability of a secondary slide jam was 2.10 × 10-8. These calculations were based on Boeing’s awareness of 7 possible occurrences of a jam of the primary slide in 74 million flight hours and the recognition that the jam could be latent over the entire mean time between unscheduled removal of the PCU (estimated by Boeing to be 25,000 hours). Boeing indicated that there have been no known occurrences of a jam of the secondary slide and that one failure was assumed for the calculation.

Factual Information 173 Aircraft Accident Report Additionally, Boeing’s calculations of failure rate and exposure time indicated that the quantitative probability of such a catastrophic rate jam was 7.02 × 10-10. The certification fault tree analysis provided by Boeing to the FAA indicated that the possibility of an engine out during takeoff and a jammed servo valve were considered. However, Boeing indicated that the exposure time for this potential scenario was 7 seconds “during takeoff from V1 through liftoff where the lateral controls can be used to help control the engine out.” The fault tree analysis assumed that “there is always adequate lateral control to overpower a rudder hardover when the rudder pressure limiter is operational.” The analysis also assumed that “under normal circumstances flight crew members, ground crew members and maintenance personnel will perform their routine tasks without errors or omission. Additionally, under anticipated normal circumstances, flight crew members will perform their non-normal procedures and basic airmanship per their training.” In its November 24, 1998, letter to the Safety Board, the FAA stated that, in response to Boeing’s October 1997 presentations, it agreed that Section 25.671 allowed the type of qualitative analysis proposed by Boeing and that, based on the Boeing 747 precedent, the use of such analysis was appropriate to demonstrate compliance with the rule. However, the FAA requested that Boeing show that it had evaluated the design of the 737-NG flight control system with regard to critical jam conditions, considered postulated jams, and determined that they were extremely improbable. On November 1, 1997, a group of Boeing engineers, including four Designated Engineering Representatives (DER) performed an inspection of the 737-NG elevator control system for position jams and the rudder system for rate jams. Boeing provided the FAA with the documentation of these inspections and FAA Form 8110-3, Statement of Compliance with the Federal Aviation Regulations (FAR), in which the DERs requested a finding of compliance with Section 25.671 (c)(3). The form indicated that the DERs performed an inspection of the elevator, rudder, main rudder PCU and associated input and feedback linkages, and the standby rudder PCU and associated input and feedback linkages. The form stated that “the inspections identified eight areas of interest with regard to jam potential [one of which pertained to the rudder]. Each jam area was analyzed or tested by the DERs and design specialists. For each jam case, it was concluded that either the jam could not occur or sufficient control movement would be available for continued safe flight and landing.” In supplemental data provided to the FAA to support the requested finding of compliance with Section 25.671(c)(3), Boeing indicated that the DERs concluded that the “rudder PCUs are not susceptible to jams that cause uncommanded motion” and that the “service history shows that there have been NO events or PCU rate jams in flight on Boeing models.” Boeing concluded that “(1) rudder position jams are controllable when the jam occurs within a normally encountered position and (2) Rudder PCU rate jams are extremely improbable as supported by analysis, test, and service history.”

Factual Information 174 Aircraft Accident Report Boeing listed rudder system design features of the 737-NG series that preclude jamming, including the following: • Dual concentric control valves allow continued control if either valve jams (rate jam)—designed for jam tolerance. • Internal summing levers are bussed together to increase stiffness (for chip shearing capability)—designed for jam tolerance. • The input stops are oriented to prevent exposure to jams—designed for jam avoidance. In its November 24, 1998, letter to the Safety Board, the FAA stated that Boeing provided data that showed the ability of the 737-NG to land safely with the rudder jammed at 2.5° of deflection (defined by the FAA’s issue paper F-2 as the maximum normally encountered control position). The FAA further stated that with the incorporation of the hydraulic pressure limiter, rate jams (rudder hardovers) were found to be controllable throughout the flight envelope except for a short period of time during takeoff and landing, which the FAA identified as being about 2 minutes. According to the FAA, Boeing showed that a rate jam during this exposure time is extremely improbable. In addition, the FAA stated that some detailed design features of the rudder control system aid in jam protection, including the following: • controlled clearances between bearing races and interfacing surfaces so that a bearing jam does not seize a rotating joint or shaft, • a controlled clearance between internal summing linkages and the PCU manifold that is much larger than possible debris particles, • increased servo valve chip shear capability, • PCUs installed in a sealed compartment that is rarely accessed and only for maintenance, • before each takeoff, a system functional check or operational check by a maintenance crew to ensure no anomalies after rudder system maintenance, and • a rudder system freedom-of-control check by the flight crew before each takeoff to ensure that no anomalies are present. The FAA stated in its November 24, 1998, letter that, after reviewing the data provided by Boeing and all known jams on 727, 737, and 747 airplanes, it determined that the design changes made for the 737-600, -700, and -800 rudder system would prevent similar jams from occurring or would allow alleviation of such jams. The FAA also indicated that it was able to find compliance with Section 25.671 for the 737-NG series airplanes based on the certification of the 747, the DER evaluation, flight tests, and simulator tests that showed that jam overrides are acceptable to overcome jams and that the override system operates correctly when installed.

Factual Information 175 Aircraft Accident Report 1.18.4 Critical Design Review Team 737 Certification Information and Recommendations Because the USAir flight 427 accident and other 737 accidents raised questions regarding the 737’s flight control systems, the FAA stated that, on October 20, 1994, its Transport Airplane Directorate began a Critical Design Review (CDR) of the 737 flight control systems with emphasis on the roll control and directional flight control systems. The CDR was conducted by a team of seven flight control systems specialists from the FAA, Transport Canada (the Canadian airworthiness authority), and the USAF.256 According to the CDR team’s report,257 the team’s specific objectives were to • identify those failure events, both single and multiple, within certain flight control systems that result in an uncommanded deflection or jam of a flight control surface; • identify latent failures in each axis of flight control; • review the service history of the failed or malfunctioning component or subsystem through a review of ADs, SBs, SLs, Service Difficulty Reports, Safety Board recommendations, NASA Aviation Safety Reporting System (ASRS) reports, and other reports; • identify and review the maintenance or inspection requirements (task and inspection interval), as provided by the manufacturer’s Maintenance Planning Document, Maintenance Review Board report, or MM for each identified component or subsystem with critical failure potential. The CDR reviewed the certification basis and compliance of the 737-100 and -200 and 737-300, -400, and -500 series airplanes. The CDR team noted that the results of the analyses and tests conducted by Boeing during certification of the 737-100 and -200 and 737-300, -400, and -500 series airplanes showed compliance with the applicable certification regulations. However, the CDR noted the ambiguity of some of the terminology used in 14 CFR Section 25.671 (although that section was not part of the certification basis of the -100 through -500 series 737s); specifically, the CDR questioned the usage of the terms “normal flight envelope” and “normally encountered.” The CDR team’s report indicated that it did “not agree with the rationale that only control positions associated with ‘normally encountered’ should be considered. There are too many 256 The CDR team also involved one Safety Board observer. Five of the seven flight control specialists were employed by the FAA in the following capacities: aviation safety inspector, aircraft certification engineer, flight test pilot, aerospace mechanical systems engineer, and project engineer. Another specialist was employed by Transport Canada as an Airworthiness Inspector, and the other specialist was a Chief Master Sergeant in the Colorado Air National Guard. Each of the seven specialists had expertise in 737 certification, 737 operations, systems and/or maintenance, flight control and hydraulic systems design/ specifications, or latent failures. 257 The CDR team’s report, entitled “B-737 Flight Control System Critical Design Review,” was issued May 3, 1995.

Factual Information 176 Aircraft Accident Report variables (atmospheric conditions, pilot technique, airplane condition [trim requirement], air traffic, etc.) to define ‘normally encountered’ other than that it may be less than full deflection. The Team’s position is that if a control position is possible, it is there for a purpose, and the pilot can use that control authority.” The CDR team’s report further stated that it believed “the interpretations that have been applied in the past, regarding amount of flight control input to be considered in showing compliance with the referenced regulations, may not be sufficient.” Therefore, the CDR team reviewed failures, combinations of failures, and malfunctions without regard to their probability of occurrence. The CDR team’s report also cited an FAA issue paper developed during the certification of the 737-300 that addressed maintenance items resulting from certification activities. According to the report, the FAA determined that it was not necessary to establish a maintenance interval to show compliance with certification requirements. However, the report stated that the CDR team had “identified a number of latent failures that require some maintenance/flightcrew action to ensure that a latent failure, combined with any subsequent failure, is not hazardous…. The Team believes that inspection tasks and intervals should be established for vital components whose latent failure could have hazardous consequences, even though a failure analysis has shown a numerical probability of failure that allows the component to go uninspected for the life of the airplane or until an ‘on-condition’ overhaul.” According to the CDR report, the team also had general concerns regarding the design of the 737 aileron and rudder PCUs and specifically cited the use of the dual concentric servo valves and the potential for jamming as a latent condition of the PCU. According to the CDR team’s report, “…when considering some undetected (latent) failures…in the directional control system, in combination with some of the single failures…the potential for a sustained jam of the rudder at full deflection, as limited by blowdown, is increased. Since full rudder hardovers and/or jams are possible, the alternate means for control, the lateral control system, must be fully available and powerful enough to rapidly counter the rudder and prevent entrance into a hazardous flight condition.” The CDR team’s report included the results of a series of simulator exercises in Boeing’s M-CAB simulator (configured as a 737-300) that the team conducted on November 17, 1994. The purpose of these exercises was to determine the degree of hazard associated with certain control system malfunctions, including a rudder hardover. The rudder hardover was simulated by the PNF applying full rudder pressure to one pedal as rapidly as possible and holding the rudder pedal to the floor. This pressure resulted in rudder deflection rates of about 40° per second (the rudder system is capable of deflecting the rudder at a rate of 66° per second under no aerodynamic load). According to the CDR team’s report, tests evaluating “lateral [roll] versus directional control power” during a rudder hardover …basically confirmed Boeing’s contention that lateral [roll] control has more roll authority than does the dihedral effect from full rudder inputs for flight conditions tested except the flaps 1, 190 KIAS [knots indicated

Factual Information 177 Aircraft Accident Report airspeed] condition. For this condition lateral [roll] control also predominated, but recovery from a rudder “hardover” was slow and required precise pilot control of resulting pitch/airspeed. Prompt pilot response was required to prevent entering the inverted flight regime at high altitude/speed. The team’s report stated, “as qualified by Boeing, the rudder PCU dual concentric valve…was intended to prevent unacceptable rudder deflection after a single slide jam….The dual concentric arrangement does play a vital part in maintaining flight safety….the crew should be assured that they have a properly operating valve assembly.” The CDR team’s report further stated the following: There is no adequate means for testing the dual spool servo valve for proper operation on the airplane. The dual spool servo valve is a complex assembly and is a critical component of the rudder and aileron power control units and, therefore, critical to flight safety. Any facility authorized by the FAA to perform repair and maintenance or manufacture this component must assure the FAA of having the necessary equipment, personnel and data (design, manufacture, qualification and acceptance test procedures), including access to the latest revisions to the data provided by the [original equipment manufacturer]. The CDR team’s report made 27 recommendations to the FAA regarding 737 certification issues, including the following: Develop national policy and or rule making as necessary and applicable to transport category airplanes that define “normal,” with respect to jams. This definition should include consideration of a jam of a control surface at any position up to its full deflection as limited by design Develop national policy requiring that, when alternate means for flying an airplane are employed, those means shall not require exceptional pilot skill and strength and that the pilot can endure the forces for a sufficient period of time to ensure a safe landing Develop national policy for transport category airplanes requiring the determination of critical hydraulic flight control system and component sensitivity (jam potential and actuator performance) to contamination, requirements for sampling hydraulic fluid, and requirements for actuator components to eliminate or pass (shear) particulate contamination, Require failure analysis of the B-737 yaw damper identified components and any relevant tests be conducted to identify all failure modes, malfunctions and potential jam conditions of these vital elements. Require corrective action(s) for those failure modes or malfunctions not shown to be extremely improbable. Require appropriate action be taken to reduce the number of B-737 yaw damper failure occurrences to an acceptable level.

Factual Information 178 Aircraft Accident Report Require appropriate action be taken to correct the referenced galling condition of the standby rudder on the B-737. Revise B-737 flightcrew training programs to ensure the use of the proper procedures for recovery from flight path upsets and flightcrew awareness regarding the loss of airplane performance due to a flight control system malfunction. Consideration should be given to flightcrew action items as a consequence of the failure analysis developed for the relevant flight control system and the failure conditions/malfunctions examined…. Request the NTSB form a special accident investigation team to begin a new combined investigation of both the B-737 Colorado Springs and the Pittsburgh accidents. In an August 27, 1998, letter to the Safety Board, the FAA described its actions in response to the CDR team’s recommendations. The FAA, among other things, referred several of the regulatory and policy issues raised by the CDR team’s recommendations (including the definition of normally encountered) to an Aviation Rulemaking Advisory Committee; referred the issue of hydraulic fluid contamination to the Society of Automotive Engineers (SAE) A-6 Committee—Aerospace Fluid Power, Actuation, and Control Technologies—which made recommendations on contamination limits; and issued several ADs to address operational and maintenance issues. (A complete list of the recommendations made by the CDR team and the FAA’s follow-up actions in response to those recommendations are contained in appendix D.) Also in response to the CDR team’s recommendations, the Safety Board convened an independent technical panel of consultants (see section 1.18.2) and combined the investigation of USAir flight 427 with the investigation of United flight 585 (see section 1.16.1.1). 1.18.5 Boeing 737 Rudder System Design Improvements As a result of the rudder reversal mechanism that became apparent during the investigation of the July 16, 1992, United Airlines ground check incident (see section 1.18.1.1), the Safety Board issued Safety Recommendation A-92-120, asking the FAA to issue an AD to require 737 operators to incorporate design changes for the main rudder PCU servo valves that would preclude the possibility of rudder reversals attributed to overtravel of the secondary slide.258 In response to this recommendation, the FAA issued AD 94-01-07, effective March 3, 1994. The AD required a leak test of the 737 main rudder PCU in accordance with Boeing SL 737-SL-27-82-B. The leak test involved inputting full rapid rate rudder commands and monitoring the hydraulic system flow demand to detect signs of internal leakage, which would indicate that the secondary slide was extending beyond its design limits. The AD required the leak test to be repeated at 750-flight hour intervals until the main rudder PCU was replaced with a unit designed to preclude overtravel of the secondary slide and included improved control of dimensional 258 As previously discussed, overtravel is the axial movement of the servo valve slides beyond the intended design limit.

Factual Information 179 Aircraft Accident Report tolerances and part matching. The AD required replacement of the main rudder PCUs within 5 years of the AD’s effective date. The redesign of the servo valve was approved by the FAA by the time that AD 94-01-07 became effective. The FAA also issued AD 96-23-51, effective November 27, 1996. The AD required that all 737 airplanes be inspected within 10 days and tested in accordance with Boeing SB 737-27A1202 every 250 flight hours thereafter until the main rudder PCU was replaced with one that incorporated the redesigned servo valve. Boeing’s SB and the FAA’s AD required that the rudder pedals be exercised to determine if a secondary slide jam to the servo valve housing had previously occurred but had not been detected. Further, the FAA issued AD 97-14-04, which became effective on August 4, 1997, and superceded the servo valve replacement requirement of AD 94-01-07. The new AD required, within 2 years of its effective date, that the main rudder PCUs on all 737-100 through -500 series airplanes be replaced with units containing a redesigned servo valve.259 AD 97-14-04 also required the replacement of outer bolts on 737 main rudder PCU input rods. This requirement was mandated because fractured outer bolts had been discovered on two occasions during normal maintenance activities. In each case, the fracture was found to have initiated when the nut was sufficiently tightened to cause the nut threads to contact the shank of the bolt. The bolts are used in a dual load path design with inner and outer elements, either of which is sufficient to retain the input rod. However, if the redundant load path is compromised and fails, a fully deflected rudder is possible; therefore, a new bolt was designed to prevent the shank from contacting the nut threads. These bolts are to be replaced when the main rudder PCUs are removed to incorporate the redesigned servo valve. After Safety Board testing in 1996 showed that the servo valve primary slide could overtravel (move past its intended position) if the secondary slide jammed to the housing, Parker redesigned the servo valve again. The redesign, which was completed in 1998, lengthened the primary and secondary slides about 0.5 inch, modified the servo valve end cap, and moved the flow port pathways and metering edges farther apart so that, if the secondary slide were to jam to the servo valve housing, overtravel of the primary slide would not connect ports that could cause reverse operation. All 737-NG series airplanes (the -600, through -900 series) are being produced with the newly redesigned servo valve. The original servo valve design incorporated small washer-like “inserts” that had fluid passages cut into them. These inserts (made of 52100 steel) were installed in the inner diameter of the housing and secondary slide (made of surface-hardened Nitralloy) and formed the passages for hydraulic fluid flow through the valve. In the 1998 redesigned servo valve, the inserts were replaced with a one-piece design (made of 52100 steel) that provides the same function and reduces the number of parts required. The redesign of the inserts to the single-piece configuration was made possible by advances in manufacturing technology that allows the small fluid passages to be Electro Discharge Machined into the 259 According to Boeing, as of September 1998 there were 2,776 in-service 737s in the -100 through -500 series and 3,187 in-service PCUs (accounting for serviceable spares not installed on in-service airplanes).

Factual Information 180 Aircraft Accident Report single piece rather than built up by a group of smaller parts. Figure 31 shows the 1998 redesigned servo valve for both the earlier 737 series airplanes and the 737-NG airplanes. In addition, the FAA issued AD 97-14-03, which requires a redesigned yaw damper system on all 737-100 through -500 series airplanes by August 1, 2000. The redesigned system is to replace the current yaw damper coupler with a single electromechanical rate gyro that includes an improved coupler with a dual solid-state rate sensor. The system is also to provide improved system monitoring and fault analysis through improvements in built-in test equipment. The yaw damper system wire shielding and isolation are to eliminate potential electrical interference. All 737-NG series airplanes incorporate the redesigned yaw damper system. AD 97-14-03 also requires that all 737-100 through -500 series airplanes be modified by adding a hydraulic pressure reducer to hydraulic system A near the rudder PCU to reduce the amount of rudder available to the flight crew during those phases of flight when large rudder deflections are not required. The reduced rudder authority is to be accomplished by lowering the hydraulic pressure from 3,000 to 1,000 psi (737-300, -400, and -500) or 1,400 psi (737-100, and -200 series airplanes). The yaw damper system is not affected by the hydraulic pressure reducer because that system operates off hydraulic system B. The hydraulic pressure reducer system is inactive in the two situations in which full rudder authority may be required: below 1,000 feet agl during takeoff climb and below 700 feet agl during landing approach. The hydraulic pressure reducer to be installed on the 737-300, -400, and -500 series airplanes also restores full rudder authority regardless of altitude when the rotation speed of the two engines differs by more than 45 percent. According to Boeing personnel, because the hydraulic pressure reducer control and indication logic are incorporated into the redesigned yaw damper coupler, the pressure reducer will be added at the same time as the yaw damper system changes. Figure 31. Parker’s 1998 redesigned servo valve for 737 airplanes. 737 100/-200/-300/-400/-500 737- NG Valve

Factual Information 181 Aircraft Accident Report All 737-NG series airplanes incorporate a hydraulic pressure limiter into the main rudder PCU. The limiter is controlled by airspeed and limits pressure to hydraulic system A inputs of the PCU by a bypass valve. The limiter is commanded to limit hydraulic pressure as the airspeed is increased to greater than 137 knots and resets as the airspeed is decreased to less than 139 knots. 1.18.5.1 Fractures in 1998 Redesigned Servo Valve Secondary Slides In August 1998, Parker staff became aware that, during production slide testing, fractures had been discovered in several of the newly redesigned servo valve secondary slide legs. Subsequent examination of 502 servo valves in Parker’s stock revealed a total of 9 fractured secondary slides; 1 fractured secondary slide and 1 chipped secondary slide260 were subsequently discovered in stock by Olympic Airways personnel. (Another cracked secondary slide was also discovered in a Maersk 737 main rudder PCU that was removed from service on February 3, 1999, because of a malfunctioning yaw damper and leakage. The crack was discovered as a result of a test performed at Parker on February 9, 1999, to detect cracking of the secondary slide.) According to Parker and Boeing personnel, of the 1,686 redesigned servo valves that had been shipped (to Boeing or the airlines), about 969 had been installed on airplanes before the fractured secondary slides were discovered. Boeing and Parker personnel stated that all of the fractured secondary slides had been magnetic particle inspected in their preassembled form with no fractures detected.261 Safety Board personnel became aware in late September 1998 of the fractures in the redesigned servo valve secondary slides. The Safety Board’s (visual and microscopic) examination of the fractured secondary slides revealed that the fractures consistently occurred on only one of the two legs at the input side of the secondary slide. The fracture appeared to initiate at the relatively sharp radius where the secondary slide reduces in cross section to accommodate the input mechanism for the primary and secondary slides, and the fracture progressed all the way through the leg, deviating on an angle, in all but one secondary slide. (The location of the crack on the remaining slide was farther along the leg.) According to Boeing and Parker personnel, they examined several known and suspected cracking scenarios to determine the source of the cracks. These scenarios included delayed quench cracking, delayed cracking resulting from transformation of retained austenite to martensite, residual tensile stresses (from grit or bead blasting after machining), slow overstress, improper rig pin installation, and external impact loads. (External impact loads were generated by dropping the secondary slide from a height of about 3 feet onto a steel plate floor.) According to Boeing and Parker personnel, the fractures that resulted during tests involving external impact loads produced a fracture 260 According to Boeing personnel, the chipped secondary slide leg was not fractured completely through: both sides of the leg exhibited what appeared to be marks from a rigging tool, and Boeing indicated that the chip likely resulted from abusive handling of that rigging tool. 261 After the servo valve components undergo inspection, the servo valves are assembled, rigged, and tested at Parker.

Factual Information 182 Aircraft Accident Report surface with characteristics similar to those exhibited by the 10 fractured secondary slides. Boeing personnel stated that, although the cause of the fractured secondary slides has not yet been identified, improper handling would be the most likely mechanism. During a December 3, 1998, briefing at Safety Board headquarters in Washington, D.C., Boeing personnel stated that review of the potential fractured secondary slide leg scenarios indicated the following: • if only one leg of the secondary slide failed, rudder performance would be normal; • if the second leg of the secondary slide also failed, but the end piece remained in place, rudder performance would be normal except that trailing edge left movements would occur at half rate; and • if the second leg failed and the separated end piece moved within the PCU cavity, an input link jam off neutral might occur, resulting in a rudder hardover. Boeing and Parker personnel have developed and are instituting a modified servo valve production plan, which includes new (postassembly) servo valve dye penetrant inspection and PCU servo valve secondary slide displacement tests. Boeing drafted two alert service bulletins (ASB)262 that describe procedures for the PCU servo valve secondary slide displacement test, criteria for passing the test, and procedures for replacement of any discrepant servo valve assembly with one having a secondary slide that passed the displacement test. During the December 1998 briefing, Boeing personnel also prioritized the fractured secondary slide problem, asking “what’s more important: crack fix or reversal fix?” Boeing’s proposal indicated that its analysis showed that continued use of the current servo valve would be preferred over the 1998 redesigned servo valve. The proposal further stated that “as a precaution, Boeing believes correction of crack issue should have priority over correction of reversal scenario.” Because of this proposed shift in priorities, Boeing recommended that the deadline for the installation of redesigned servo valves (required by AD 97-14-04, which addressed the potential of a rudder reversal condition) be extended to August 2000 or later (instead of August 1999, as currently required). On January 13, 1999, the FAA issued a Notice of Proposed Rulemaking (NPRM, Docket No. 98-NM-383-AD), proposing an AD that would require operators to perform PCU servo valve secondary slide displacement tests (as described in Boeing’s draft ASBs) at regular intervals and replace the servo valve assembly if necessary. The NPRM stated that because the proposed AD is an “interim action and a final action has not yet been identified to adequately address the identified unsafe condition, it will be necessary to repeat the displacement test on all [737] series airplanes, including airplanes that are produced subsequent to those with line numbers specified in the draft alert service bulletins.” 262 When finalized, ASBs 737-27A1221 and 737-27A1222 will apply to 737-100 through -500 series airplanes and 737-NG series airplanes, respectively.

Factual Information 183 Aircraft Accident Report 1.18.6 Human Performance Considerations 1.18.6.1 Pilot Incapacitation The Safety Board is aware of two instances of pilot incapacitation involving unintentional rudder inputs during flight.263 The first instance occurred on June 11, 1980, and involved a Frontier Airlines 737 on a visual approach to its destination airport in Cheyenne, Wyoming. The captain of this flight reported that the first officer was manually flying the airplane and that he decided to fly the approach 10 knots faster than the normal approach airspeed because of a possible windshear encounter during the approach. The captain indicated that, as the airplane descended through about 800 feet agl, he observed the airspeed increasing and commented “we are too…fast” but that the first officer did not respond. The captain reported that, when he called for a go-around and reached for the throttles, the airplane’s nose yawed to the left. According to the captain’s postincident written report, “I…glanced at the First Officer and realized that he was incapacitated and apparently unconscious. I added full power and began a climb and missed approach. The aircraft was still wallowing around and I was having a problem getting the controls into a coordinated flight situation. The airplane flew best in a climbing left turn.” The captain stated that he instructed a flight attendant to put an oxygen mask on the first officer. The flight attendant advised the captain that the first officer’s left leg was rigid and was pushing against the left rudder pedal. The flight attendant moved the first officer’s leg off the rudder, and the captain regained normal control of the airplane. The captain stated that he returned to land without further incident, and the first officer began to revive as the airplane taxied to the terminal. (The article in Flying magazine indicated that the first officer’s incapacitation/seizure was the result of a chemical imbalance, which was subsequently treated successfully.) During postincident interviews with Safety Board personnel, the captain reported that he was “startled” at the beginning of the incident; he stated that he flew reflexively and that his motor responses were sharp and unaffected by the sudden change of events. However, the captain stated that, until the flight attendant observed that the first officer was depressing the left rudder pedal, he did not know what was causing the airplane to yaw to the left. The captain reported that he was surprised that he was not aware that the left rudder pedal was pushed forward. The second instance of pilot incapacitation involving unintentional rudder inputs occurred on March 29, 1994, and involved a Southwest Airlines 737 on approach to its destination airport in Oakland, California. During postincident interviews with Safety Board personnel, the captain of the Southwest Airlines flight stated that the first officer 263 The Safety Board became aware of the first incident when a staff member read an account of the event in the January 1996 issue of Flying magazine. The captain of the Frontier Airlines flight told Safety Board investigators that he decided to write the article after the United Airlines flight 585 accident in March 1991 and that the article was accepted for publication in July 1994. After learning about this incident, Safety Board staff asked the FAA’s CAMI to search the Pilot Incapacitation Database for similar incidents. This search revealed a second incident, involving a Southwest Airlines 737.

Factual Information 184 Aircraft Accident Report was performing PF duties during the approach with the autopilot engaged in CWS mode. The captain stated that the airplane was in clouds and fog, about 1,500 feet agl, when the first officer “let out a blood curdling scream.” The captain reported that the first officer was staring out the forward cockpit window, his eyes were extremely large, and his back was arched. (These observations led the captain to wonder at first whether the first officer might have been shocked by the circuit breakers located behind his seat). The captain reported that, seconds later, the first officer screamed another time, his back went rigid, and he clutched at the control column. The captain noticed that the airplane began to roll right and felt the left rudder pedal hit his ankle. The captain stated that, when he placed his feet on the rudder pedals, he noted the left rudder pedal was displaced aft about 5 to 6 inches. The captain reported that he disconnected the autopilot, applied aileron in the direction opposite the roll, and physically struggled (against the rudder pressure applied by the first officer) to neutralize the rudder pedal position. The captain stated that he also tried to use differential engine thrust to counter the effects of the rudder pressure. When a flight attendant unlatched the first officer’s lap belt and shoulder harness, the pressure on the rudder pedals was released, and the captain landed the airplane without further incident. The captain stated that he was startled at the beginning of the incident, which delayed his action by no more than 2 to 3 seconds. The captain also stated that he later learned that the first officer had suffered a seizure and had no recollection of the incident. 1.18.6.2 Spatial Disorientation According to a book on flightdeck performance,264 spatial disorientation (a loss of correct perception of one’s orientation with respect to the ground—typically from a conflict between vestibular cues and those of visual and kinesthetic cues) can contribute to incorrect pilot control inputs. The book states that a pilot uses information from vestibular (inner ear) and visual (internal—flight instrumentation, external—horizon) cues to determine the airplane’s position in space, making disorientation more likely when fewer cues exist. The book further states that spatial disorientation is unlikely when strong external visual cues exist; however, abrupt, rapid aircraft movements and accelerations can lead to spatial disorientation if combined with a loss of external visual references (or the presence of misleading external visual references). At the request of the Safety Board, a research scientist from NASA’s Ames Research Center, who is an experimental psychologist specializing in human spatial orientation, reviewed the FDR information, the CVR transcript, and a description of the USAir flight 427 accident circumstances. The research scientist was also involved in the Safety Board’s wake encounter simulations in NASA-Ames’ VMS simulator (see section 1.16.3), which attempted to represent the conditions and forces experienced by the pilots of flight 427. 264 Roscoe, S., and O’Hare, D. 1990. Flightdeck Performance; The Human Factor. Ames, Iowa: Iowa State University Press, chapter 2.

Factual Information 185 Aircraft Accident Report During the series of wake encounter simulations, the NASA research scientist occupied either the right or left seat of the simulator, with a Safety Board, ALPA, USAir, or Boeing official occupying the other seat.265 The research scientist stated that the simulator was programmed so that he received motion cues alone (without any visual display) during several of the simulations and motion cues combined with simulated, but representative, external visual cues during other simulations. At one of the public hearing sessions related to the USAir flight 427 investigation, the research scientist described his impressions of the wake turbulence encounter (the initial portion of flight 427’s upset event) as follows: …I was surprised at how gentle it all was. I had thought that the upset would be more severe. It was a surprise, it did get my attention. But it was not a violent kind of an upset that would…have me fail to know where I was and what my orientation was…. The research scientist strongly believed that the simulator pilots were not spatially disoriented during the initial upset event because clear external visual cues (the sky, ground, and horizon cues provided by the VMS visual simulation) were available throughout the simulation and the motions of the simulator were gradual and not excessively violent. The scientist further stated that, during postsimulator ride interviews, the simulation pilots reported that they always knew the location and orientation of the airplane in relation to the ground and that they could have flown out of the wake turbulence portion of the upset event.266 With regard to the accident flight, the research scientist stated: I believe that the pilots probably would have experienced little difficulty in maintaining an accurate perception of their orientation, even during any brief periods when they may have lost sight of the visual horizon due to the pitch down attitude of the airplane. In addition, perturbations of the flight path generally appear to have been followed by verbal comments from the pilots, indicating that they were fully aware of their trajectory, and that they were not able to change it…it does not appear at all likely that pilot disorientation due to abnormal vestibular stimulation provided a major contribution to this accident. 1.18.7 Wake Turbulence/Upset Event Information 1.18.7.1 Previous Wake Turbulence Accidents The Safety Board’s Aviation Accident Database (which contains information regarding aviation accidents that occurred in the United States since 1962) revealed three air carrier accidents in which wake turbulence encounters were determined to be causal 265 The individuals who participated in these simulator sessions were passengers in the simulator and did not manipulate the simulator’s flight controls. 266 As previously discussed, although the VMS is better able to represent airplane motions than most simulators, even VMS motions do not realistically represent some airplane motions and accelerations (lateral and vertical).

Factual Information 186 Aircraft Accident Report factors in the accident. All three accidents occurred when the airplanes were at a low altitude in the vicinity of airports. • On March 8, 1964, a Douglas DC-3 crashed while landing at Chicago, Illinois. According to the accident report, the airplane was following a Boeing 707 jet aircraft. The probable cause of the accident was “the failure of the crew to utilize available de-icing equipment and engine power to maintain positive control of the aircraft under conditions of rapid airframe ice accretion and vortex induced turbulence.” 267 • On July 15, 1969, a deHavilland DHC-6 crashed while taking off at Jamaica, New York, behind a “recently departed jet.” 268 All other material regarding this accident was destroyed in 1984 (15 years after the accident). • On May 30, 1972, a Douglas DC-9 crashed while landing at Fort Worth, Texas, behind a DC-10. The DC-9 was being operated in the airport traffic pattern under VFR, which places the responsibility for ensuring adequate air traffic separation on the pilots. The DC-9 was following 53 to 54 seconds behind the preceding DC-10. Although this accident involved VFR traffic separation, the FAA increased ATC IFR separation standards 2 months after the accident; since this change, there have been no documented air carrier accidents in which wake turbulence encounters were determined to be causal factors. Review of FDR data from this accident airplane revealed that, during the wake vortex encounter, the airspeed decreased from about 130 to about 60 knots and then increased to about 300 knots. Further, the FDR-recorded altitude (which had been descending consistent with approach to landing) changed from about 600 to 6,300 feet. These variations are consistent in direction and scale with FDR data from other rotor encounters.269 1.18.7.2 Aviation Safety Reporting System Reports of Uncommanded Upsets/Wake Turbulence Encounters To support the Safety Board’s investigation of the USAir flight 427 accident, NASA personnel reviewed the agency’s ASRS pilot report database270 and produced reports in several subject areas, including 737-type reports, 737-type rudder trim/control reports, Pittsburgh terminal area conflicts, and wake turbulence encounter/uncommanded upset/loss of control events in multiengine turbojet aircraft. These reports assisted the Safety Board in conducting a thorough review of previous yaw/roll events (as discussed in section 1.18.1.1.) ASRS personnel also accomplished “structured callback” studies in 267 See Civil Aeronautics Board. 1965. Hansen Air Activities, Douglas DC-3A, N410D, near Chicago- O’Hare International Airport, Chicago, Illinois, March 8, 1964. CAB File 2-0002. Washington, DC. 268 See National Transportation Safety Board. Brief of Accident. New York Airways, Inc., deHavilland DHC-6, N558MA, at JFK International Airport, Jamaica, New York, July 15, 1969. NTSB File 1-0020. Washington, DC. 269 See National Transportation Safety Board. 1973. Delta Air Lines, Inc., McDonnell Douglas DC-9-14, N3305L, Greater Southwest International Airport, Fort Worth, Texas, May 30, 1972. Aircraft Accident Report NTSB/AAR-73/03. Washington, DC.

Factual Information 187 Aircraft Accident Report which they interviewed the pilots who provided the original reports. (After preliminary processing, ASRS personnel typically deidentify all incoming ASRS reports to protect the identity of the reporting individuals; however, the pilots who were interviewed on a voluntary basis as part of the structured callback studies waived that anonymity.) Data from the “Multi-Engine Turbojet Uncommanded Upsets Structured Callback Summary” (a project conducted to support the USAir flight 427 investigation) revealed that wake turbulence was the most common cause of the upset/loss of control events reported by pilots between January 1987 and May 1995, cited in 96 of 297 cases. Pilots reported using rudder during recovery efforts in one-third (11 events) of the 33 upset events reported by airline pilots to ASRS between May 1 and October 31, 1995 (and examined in depth through structured callback efforts).271 Data from the ASRS “Wake Turbulence Structured Callback Project” (a project conducted by the FAA in response to a Safety Board recommendation) 272 revealed that 166 wake turbulence events were reported between April 1995 and August 1997, of which 101 were from pilots of multiengine turbojet airplanes (including 33 from 737 pilots).273 Review of the ASRS reports and comments obtained from the pilots during followup interviews revealed that flight crews were frequently surprised by the suddenness and severity of the wake turbulence encounters.274 The pilots’ comments included the following: “The severity of this encounter surprised me…. I could have very easily ended up on my back, and this was from another 737!” “[The pilots] encountered a violent roll [to the left] 25 [degrees] and then a violent roll back to [the right] into a 25 [degree] bank.” “It took almost full aileron input to keep from rolling past 45 degrees…. The wake I encountered was considerably more than normal.” “During that time we experienced very rapid roll rates…rolling 45 degrees left and right, and full aileron often required to keep…right side up.” “[An uncommanded upset that produced aircraft roll of] at least 45 [degrees],” and that the “[aircraft] felt out of control, very mushy…didn’t think…could control the [aircraft].” “We were rolled into an approx[imately] 45-50 [degree] bank from wake turbulence…. Such encounters…are highly distracting and require immediate attention.” 270 ASRS is a national repository for reports regarding aviation safety-related issues and events. ASRS reports are voluntarily submitted by pilots, air traffic controllers, air carrier personnel, and other aviation professionals when they want to make known a potentially unsafe condition or event. The Director of NASA’s ASRS program cautions that the existence of reports pertaining to any subject area should not be considered a statistically valid indication of the prevalence of that problem within the aviation system; however, the ASRS database may provide some indication of the number of aviation safety-related events that occur in any given subject area, and the reports are a useful source of narrative descriptions of in-flight events.

Factual Information 188 Aircraft Accident Report The Safety Board’s review also revealed that, among pilots of multiengine turbojet airplanes, 30 percent reported that the wake turbulence encounter occurred at night, and 7 percent reported that the encounter occurred in IFR conditions.275 Of the reported encounters, 55 percent occurred at altitudes at or below 6,000 feet msl (the altitude of USAir flight 427 at the time of the initial upset); 18 percent occurred at altitudes at or below 500 feet. In addition, 25 percent of the pilots reported that the autopilot remained engaged during the turbulence encounter. In all the cases examined through the ASRS reports, the pilot(s) maintained or regained control of the airplane and landed without further incident. 271 To obtain additional data regarding rudder use during air carrier operations, the Safety Board reviewed more than 100 references to accidents and incidents that were provided by Boeing (in its “Human Factors Supplement, Submission to the National Transportation Safety Board for the USAir 427 Investigation,” September 30, 1997), the Board’s own records of 737 accidents and incidents, and additional 737 incident data and QAR information obtained from accident investigation authorities worldwide. Examination of the available data revealed that cross-control conditions (rudder pedal input opposing control wheel input) occurred occasionally in response to an unexpected anomaly or wake turbulence. One such event occurred on October 27, 1986, and involved a Trans Australia Airlines 737 during its approach to land at Canberra, Australia. The airplane’s FDR data indicated that a cross-control condition existed for about 21 seconds during the airplane’s right turn to align with the runway. FDR data indicated that the extent of the cross-control varied during the event; at its most severe, the cross-control consisted of about 60° of left control wheel input and 12° of right rudder pedal input. The pilots stated that they perceived an airframe vibration and performed a go-around, during which coordinated control was maintained. Throughout the cross-control event, the airplane’s right bank remained stable at 20° to 25°. FDR records indicate that a similar cross-control situation occurred during the airplane’s second approach to the runway. That cross- control condition was less severe; the pilots resumed coordinated flight and an uneventful landing ensued. Another cross-control condition occurred on April 23, 1993, and involved a United Airlines 737 that encountered wake turbulence at 6,500 feet msl during its approach to its destination airport. FDR data indicated that the incident involved about 9 seconds of rudder activity, during which moments of cross- control occurred. Maximum rudder input during this event was less than 7°. On July 25, 1995, a USAir 737 was approaching to land at Richmond, Virginia. Pilot statements and incident airplane FDR data indicated that the pilots responded to an uncommanded roll event appropriately with coordinated left aileron and rudder. However, after the uncommanded roll event subsided, moments of cross-control occurred when several degrees of left rudder input remained while the aileron position varied, providing mostly right aileron input until the airplane landed. The pilots’ statements indicated that they made rudder and aileron inputs “as necessary throughout the approach and landing to maintain directional control of the aircraft.” Maximum rudder input during this event was about 7°. In June 1997, a 737 encountered wake turbulence at 10,000 feet msl behind a 747. FDR data from the incident airplane indicated that the pilots had commanded right aileron and right rudder as the airplane began to roll left at the beginning of the wake encounter; the right rudder input remained (although reducing gradually) for about 14 seconds, but moments of cross- control occurred when the aileron input varied during the recovery. Maximum rudder input was less than 7°. Although not a wake turbulence event, an example of an accident resulting from improper rudder input occurred on September 6, 1985, and involved a Midwest Express Airlines DC-9 that crashed after experiencing a loss of engine power shortly after liftoff (see National Transportation Safety Board. 1987. Accident Involving Midwest Express Airlines, Inc., Flight 105, Douglas DC-9-14, N100ME, Milwaukee, Wisconsin, September 6, 1985. Aircraft Accident Report NTSB/AAR-87/01. Washington, DC.) The Safety Board’s accident report indicated that, because of the airplane’s nose-high pitch attitude, the pilots were operating with reduced external visual cues. Although the pilots initially applied correct rudder in response to the loss of engine power, incorrect rudder was applied about 4 to 5 seconds later.

Factual Information 189 Aircraft Accident Report 1.18.8 Ergonomics—Study of Maximum Pilot Rudder Pedal Force As previously discussed, one of the variables in the Safety Board’s computer simulations was pilot rudder pedal force. Because pilot rudder pedal force was not recorded by the FDRs in the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes, the Safety Board conducted a study, using ergonomic research and other data, to estimate the rudder pedal forces that the pilots might have applied during the upset events. A researcher at the USAF’s Armstrong Laboratory studied strength capability for operating aircraft controls in a study often used as a standard for aircraft design.276 The data reported in this study represent the maximum isometric strength demonstrated by USAF subjects operating the aircraft controls of a laboratory simulator. Subjects were healthy volunteers, either from the Air Force Academy (AFA) or Officer’s Training School (OTS), who were instructed to push forward on the rudder pedal with as much force as they could exert and hold that force for 5 seconds. Among 199 of the subjects (male AFA students between 19 and 25 years old), median strength output of the left leg against the left rudder pedal was 624 pounds, and median strength output of the right leg against the right rudder pedal was 623 pounds. Among 249 other subjects (male OTS students between 21 and 34 years old), median strength output of the right and left legs was 510 pounds each. These results were some of the highest leg force outputs obtained in a laboratory setting and cited in the available ergonomic literature,277 even when the results were compared with other studies using USAF subjects.278 The results from the USAF study involving OTS subjects were considered to be more representative of the airline pilot population for two reasons: the OTS subjects (although physically fit) were not subject to the rigorous physical selection and exercise 272 See National Transportation Safety Board. 1994. Safety Issues Related to Wake Vortex Encounters During Visual Approach to Landing. Special Investigative Report NTSB/SIR-94/01. Washington, DC. 273ASRS reports of wake turbulence encounters by general aviation and air carrier pilots increased after NASA began its Wake Turbulence Project in April 1995, which was publicized in the piloting community. Before 1995, ASRS received an average of 55 wake turbulence reports annually. In 1995, 109 reports of wake turbulence encounters were received. In 1996, 60 reports were filed, and 87 reports were filed in 1997. 274 In many cases, review of the FDR data revealed that the flight crews overestimated the degree of bank experienced as a result of the wake turbulence encounters. The flight crew of Eastwind flight 517 overestimated the degree of bank experienced during the incident. 275 The data reported here were extracted by ASRS staff at the request of the Safety Board to focus on reports from pilots of multi-engine turbojets. 276 McDaniel, J.W. 1995. “Strength capability for operating aircraft controls.” SAFE Journal, 25, pp. 28-34. 277 Weimer, J. 1993. Handbook of ergonomic and human factors tables. Englewood Cliffs, New Jersey: Prentice Hall, pp. 90-91. 278 Hertzberg, H.T.E., and Burke, F.E. 1971. “Foot forces exerted at various aircraft brake-pedal angles.” Human Factors, 13, pp. 445-56.

Factual Information 190 Aircraft Accident Report requirements that were applied to the AFA students, and the OTS students, on average, were older than the AFA subjects. Therefore, the Safety Board used the results of the USAF studies involving OTS subjects as a baseline for its ergonomic study; an output of 510 pounds, sustained for a short period of time, was deemed as a reasonable estimate for the maximum leg force output of an airline transport pilot. In evaluating the leg force that could have been applied during the three upset events, the Safety Board also considered the effect that seat position and knee angle would have on that force. Ergonomic studies indicate that an individual’s maximum potential leg thrust varies dramatically with knee angle, with an optimal knee angle range of between 140 and 160° (180° corresponds to a straight leg).279 (The knee angles of the subjects in the USAF studies were between 130 and 140° for a neutral pedal position, which provided for adequate leg extension to obtain a full rudder input with the most effective knee angles.) The Safety Board also considered the effect that age might have on a pilot’s ability to exert leg forces approaching those demonstrated in the USAF studies. Research indicates a loss of strength in leg extension forces among subjects older than those in the USAF studies (about a 6 percent reduction in strength per decade in individuals older than 30 years old).280 However, studies also indicate that general muscle loss can be prevented or reversed as a result of regular exercise.281 Further, the Safety Board researched the correlation between physical size (such as height) and leg strength and found that the correlation between the two was low. In other words, the research showed that a shorter person may be extremely strong, whereas a taller person may be comparatively weak. The Safety Board recognizes that a pilot’s leg force output in a real cockpit emergency (such as those that occurred on USAir flight 427, United flight 585, and Eastwind flight 517) may also depend on the motivation and perception of the pilots about their situation. Thus, laboratory results may not necessarily replicate actual flight situations. 279 Woodson, W.E., Tillman, B., and Tillman, P. 1993. Human Factors Design Handbook. New York: McGraw Hill. Kroemer, K.H.E., Kroemer, H.B., and Kroemer-Elbert, K.E. 1994. Ergonomics: how to design for ease and efficiency. Englewood Cliffs, New Jersey: Prentice Hall, p. 379. 280 Hortob’agyi, T., Zheng, D., Weidner, M., Lambert, N.J.; Westbrook, S.; and Houmard, J.A. 1995. “The influence of aging on muscle strength and muscle fiber characteristics with special reference to eccentric strength.” Journal of Gerontology, Biological Sciences, 50: B399-406. Bemben, M.G., Massey, B.H., Bemben, D.A., Misner, J.E., and Boileau, R.A. 1996. “Isometric intermittent endurance of four muscle groups in men aged 20-74 yr.” Medicine and Science in Sports and Exercise, 28 (1), pp. 145-54. Borges, O.

1. “Isometric and isokinetic knee extension and flexion torque in men and women aged 20-70.”

Scandinavian Journal of Rehabilitation Medicine, 21 (1), pp. 45-53 Sanders, M.S., and McCormick, E.J.

1. Human Factors in Engineering and Design. New York: McGraw Hill, Inc., p. 251.

281 Yukitoshi, A., and Shephard, R.J. 1992. “Aging and muscle function.” Sports Medicine, 14 (6), pp. 376-396. Sanders and McCormick, p. 251.

Factual Information 191 Aircraft Accident Report Therefore, in estimating the maximum rudder pedal force applied by the flying pilots in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident, the Safety Board used the available ergonomic and other data, including the leg strength results from the USAF OTS subject study and the pilot’s knee angle, age, physical fitness, physical size, motivation, and perception of the situation. In the case of the Eastwind flight 517 incident, the Safety Board also used the flight crew’s statements, the flying pilot’s actual knee angle, and pilot rudder pedal force measurements. USAir Flight 427 The Safety Board modeled the pedal forces exerted by the first officer of USAir flight 427 based on the pilot rudder pedal force norms identified in the USAF OTS study. The first officer, who was 6 feet 3 inches tall, was reported to be healthy and, at 38 years old, might have been subject to a small degradation in leg extension strength (perhaps 6 percent) compared with the younger USAF OTS subjects. The CVR indicated physical straining sounds over a period of less than 5 seconds at the beginning of the upset period, which was consistent with the period of maximum effort exerted by the subjects in the USAF study. Thus, on the basis of his age (and the assumption of an optimal knee angle), the first officer could be expected to have been able to exert about 480 pounds of force on a single rudder pedal (510 pounds minus 6 percent, or about 30 pounds). To estimate the first officer’s probable seat position and knee angle during the upset, postaccident ergonomic measurements were conducted in a 737 cockpit using a Safety Board employee who was similar to the first officer in height, weight, and inseam measurement.282 The Safety Board employee found it necessary to place the right-hand cockpit seat in its farthest aft position and the rudder pedal adjustment in its farthest forward position for optimal flight control usability and leg room comfort. He adjusted the seat height to the correct eye reference position, according to guidance in the USAir Operations manual.283 In this position, the Safety Board employee’s right knee angle was 133° when his foot was pushing on the right rudder pedal in its neutral position. When the right rudder pedal was displaced 1¼ inches aft (toward the Safety Board employee), his right knee angle was 122°. Ergonomic research indicates that a pilot’s maximum leg thrust with a 122° knee angle would be further degraded by about 28 percent (compared with the 130 to 140° range in the USAF study). The Safety Board used the blowdown limit for USAir flight 427 to calculate that the right rudder pedal would likely have moved about 1 inch aft of its neutral position, causing the first officer’s knee angle to diverge from the optimum range. On the basis of this information and the results of measurements of the Safety Board 282 Information about the first officer’s height and weight was based on his most recent flight physical. The first officer’s inseam measurement was provided by his wife. 283 According to US Airways personnel, no eye reference adjustment device was in the cockpit of the accident airplane. The company 737 Pilot’s Handbook directed pilots to adjust the seat for the correct eye reference position, which is established when the top-most flight mode annunciators are just in view below the glareshield and, at the same time, a slight amount of the aircraft nose structure is visible above the forward lower window sill.

Factual Information 192 Aircraft Accident Report employee’s seat position and knee angle, the Safety Board assumed that the USAir flight 427 first officer’s right rudder pedal force was reduced about 15 to 20 percent as the right rudder pedal moved aft during the upset event. Accordingly, on the basis of the available information, the Safety Board’s computer simulation studies (discussed in section 1.16.6.1) assumed that the first officer of USAir flight 427 would have applied an initial maximum force of about 400 pounds on the right rudder pedal in response to a rudder reversal. Further, the simulation studies assumed that the first officer reduced his leg force on the right rudder pedal by about 50 percent (to about 200 pounds) later in the upset sequence when he would have been maintaining rudder pedal pressure but making less than a maximum effort so he could attend to other aspects of the emergency. (See section 2.2.2 for more discussion of this rudder pedal force reduction.) United Flight 585 The captain of United flight 585 was 5 feet 7 inches tall, which permitted him to make seat adjustments that could have obtained an optimum knee angle for exerting force on the rudder pedals (unlike the first officer of USAir flight 427). The captain was assumed to have selected a seat and rudder pedal adjustment that resulted in the optimal (130 to 140°) knee angle with the rudder pedals in the neutral position and allowed for leg extension to command full rudder. (The CVR transcript indicates that the captain performed a rudder check before takeoff,284 which would have required the captain to adjust his seat position to allow for the full range of motion on the rudder pedals.) Although the captain’s age (52 years) might have resulted in some degradation in maximum leg force,285 postaccident interviews indicated that the captain was in excellent health and followed a rigorous exercise regimen. Because the captain’s personal health characteristics might have countered the normal age-related loss of strength, the Safety Board did not reduce its estimate of the captain’s leg force from the USAF norms based on his age. However, the United flight 585 circumstances indicated that, in a rudder reversal situation, the left rudder pedal could move as much as 3 inches aft (toward the captain) during the rudder’s movement to its blowdown limit (and within about 1 additional second as sideslip allowed the rudder to deflect more). This rudder pedal movement would have forced the captain to use a less effective knee angle than that of the USAF OTS subjects, which would have reduced his rudder pedal input force. Further, because of the suddenness of the United flight 585 upset and the airplane’s rapid departure from controlled flight, it is possible that the captain never reached his personal maximum leg force effort. In the short time available to recover from the upset, the captain may have pushed hard on the left rudder pedal only long enough to realize that 284 The CVR transcript indicates that, at 0914:20, before taxiing for takeoff, the captain warned the first officer to “watch your feet here comes the rudder.” 285 Research indicated that a loss of about 15 percent in pilot rudder pedal force might be expected in an individual the same age as the captain.

Factual Information 193 Aircraft Accident Report there was a serious problem in the flight control and then shifted his focus to attempt a go-around and stop the yaw/roll with control wheel inputs. Therefore, on the basis of the available information, the Safety Board’s simulation studies assumed that the captain applied a force of about 300 pounds during the brief period between pedal input and the go-around decision/control wheel input and that he subsequently reduced his rudder pedal force to about 200 pounds (see section 2.3.2 for more discussion of the force reduction).286 Eastwind Flight 517 The captain of Eastwind flight 517 was 5 feet 10 inches tall. Postincident measurements in a cockpit identical to that of the incident airplane showed that, when the seat and rudder pedals were adjusted to the positions the captain normally used in landing, his left knee angle was 130° when his left foot was pushing the left rudder pedal in its neutral position. The captain estimated that, during the incident, the left rudder pedal moved 1½ inches forward of its neutral position in response to his efforts to depress it.287 With the left rudder pedal in this position, the captain’s left knee angle was 140° when his left foot pushed the pedal. Further, when the captain demonstrated how he “stood on the pedal” during the incident to gain greater pushing force, he used a raised posture in which his body moved upward by 2 inches (as measured at the shoulder). In this posture, his left knee angle was 145° when he pushed on the left pedal, which was displaced 1½ inches forward of its neutral position. Ergonomic literature indicates that this posture may have increased the captain’s maximum leg force by as much as 35 percent compared with the USAF OTS subject norm. During postincident testing, the captain displayed a leg strength on a standard medical rehabilitation testing protocol that placed him below average compared with norms established by a sample of healthy, recreationally active adults. However, in allowing for the advantage that may have been provided by his effective knee angle, the Safety Board assumed that the captain could produce a maximum force in the 500-pound range when “standing” on the rudder pedal to oppose a rudder reversal. On the Eastwind flight 517 airplane, a force of about 300 pounds would have been required to move the rudder pedal beyond its neutral position in a rudder reversal situation. Therefore, the captain’s demonstration to investigators of the left rudder pedal position that he recalled obtaining during the incident (about 1½ inches forward of neutral) would correspond to an effort of about 450 pounds. This rudder pedal force is 286 This model of pilot rudder pedal force was considered the most appropriate, but a second model also provided a good fit of the data. In this second model, the captain was assumed to have initially input a rudder pedal force of about 500 pounds and then reduced this input force to 250 pounds. 287 During a June 14, 1996, interview, the captain stated that he stood hard on the rudder pedal and applied about 3 to 4 inches rudder displacement. During a June 17, 1998, interview, the captain stated that the rudder pedals moved no more than 1 or 2 inches. In a February 4, 1999, cockpit test, in which the captain moved actual rudder pedals, the left pedal moved downward by 1½ inches on his first demonstration and by 1-5/8 inches on his second demonstration (as measured by a Safety Board investigator seated in the opposite pilot seat). On the basis of all four estimates, and the simplicity of a pedal demonstration compared with a verbal description, the Safety Board employed a 1½-inch displacement as a representation of the captain's recall. (A 4-inch displacement would move the pedal down to its lower stop, which would contradict the captain's numerous reports that the pedal was stiff and would not go down to the floor.)

Factual Information 194 Aircraft Accident Report consistent with the Board’s estimates based on the USAF data, adjusted for the captain’s measured strength and knee angles. Accordingly, on the basis of the available information, the Safety Board’s simulation studies assumed that the captain’s initial rudder pedal force was about 500 pounds. The simulation studies further assumed that this rudder pedal force was reduced later in the incident sequence (see section 2.4.2 for more discussion of the force reduction). 1.18.9 Unusual Attitude Information and Training The FAA’s AC 61-27C, “Instrument Flying Handbook,” defines an unusual attitude as “…any airplane attitude not normally required for instrument flight.” The AC states that an unusual attitude may result from “a number of conditions, such as turbulence, disorientation…or lack of proficiency in aircraft control.” The Airplane Upset Recovery Training Aid (developed in 1997 and 1998 by a working group, as described in section 1.18.9.2) states that “while specific values may vary among airplane models, the following unintentional conditions generally describe an airplane upset [unusual attitude]: Pitch attitude greater than 25° nose up; pitch attitude greater than 10° nose down; bank angle greater than 45°; and within the above parameters, but flying at airspeeds inappropriate for the conditions.” 1.18.9.1 Preaccident Activity Before the USAir flight 427 accident, the Safety Board had issued three safety recommendations that addressed training flight crews involved in 14 CFR Part 121 operations in the recognition of and recovery from unusual flight attitudes. Safety Recommendation A-70-21, issued on May 1, 1970, referenced an accident that occurred on November 16, 1968, in which a flight crew lost control of a 737 near Detroit, Michigan, in poor weather conditions.288 The Safety Board recommended additional flight crew training in which pilots would be required to periodically demonstrate proficiency in recovery from unusual attitudes. The Safety Board also suggested that a simulator be utilized to provide flight crew familiarization with (1) the various instrument displays associated with and resulting from encounters with unusual meteorological conditions, (2) the proper flight crew response to the various displays, and (3) demonstration of and recovery from possible ensuing unusual attitudes. In its May 21, 1970, letter to the Safety Board, the FAA stated that airline training was now emphasizing the proper use of trim, attitude control, and thrust, which the FAA believed was far more effective than the practice of recovery from unusual attitude maneuvers. The FAA indicated that unusual attitude maneuvers had been deleted from the pilot proficiency check in 1965. The FAA also believed that it was inconceivable to require training maneuvers that would place a large jet airplane in a nose high, low airspeed, high angle-of-attack situation. 288 See National Transportation Safety Board. 1969. NTSB Log 69-0115, notation 413.

Factual Information 195 Aircraft Accident Report In a July 8, 1970, letter to the Safety Board, the FAA stated to the Safety Board that changes in airline training and operational procedures had resulted from this safety recommendation and cited a “marked decrease in upset events” as evidence that these actions had addressed the intent of the recommendation. The FAA further stated that it would discuss with industry representatives the feasibility of simulating large excursions from flightpath caused by abnormal meteorological conditions. Because no further action was taken by the FAA, the Safety Board classified Safety Recommendation A-70-21 “Closed—Unacceptable Action” on August 17, 1972. On March 31, 1971, a Boeing 720B yawed and crashed while the flight crew was attempting a three-engine missed approach. The Safety Board attributed the probable cause of the accident to a failure of the airplane’s rudder actuator and expressed concerns regarding the flight crew’s ability to rapidly assess the situation and recover. As a result of this accident, the Safety Board issued Safety Recommendation A-72-152, which asked the FAA to require pilots to demonstrate their ability to recover from abnormal regimes of flight and unusual attitudes solely by reference to flight instruments. The Board recommended the use of simulators for this demonstration and noted that current simulators should be modified if they were not capable of being used for this purpose. In its response, the FAA stated that it did not believe that simulators were capable of simulating certain regimes of flight that go beyond the normal flight envelope of the aircraft. Further, because an aircraft simulator is not required as part of an air carrier training program, the FAA stated that it could not require that a simulator be replaced or modified to simulate regimes of flight outside the flight envelope of the aircraft. On the basis of this response, Safety Recommendation A-72-152 was classified “Closed— Unacceptable Action” on January 16, 1973. The Safety Board issued Safety Recommendation A-92-20 as a result of a July 10, 1991, Beech C99 accident at Birmingham, Alabama.289 The recommendation asked the FAA to require that recurrent training and proficiency programs for instrument-rated pilots include techniques for recognizing and recovering from unusual attitudes. In its July 9, 1992, letter to the Safety Board, the FAA stated that pilots are already required to demonstrate recovery from unusual flight attitudes on their private pilot examination. In addition, the FAA noted that the instrument rating requires a pilot to be proficient in recovery from unusual attitudes. Therefore, the FAA believed that, by the time a pilot had the required experience to become part of a flight crew with a 14 CFR Part 121 or 135 air carrier, the pilot would have received extensive training and flight checks for procedures and techniques in recovery from unusual attitudes. The FAA further cited existing requirements for the ATP certificate and pilot training under Part 121, including recovery from “specific flight characteristics that are considered reasonably probable for the airplane (such as dutch roll recovery in the Boeing 727), steep turns, approaches to stalls, and the windshear escape maneuver.” 289 For more information, see National Transportation Safety Board. 1992. L’Express Airlines, Inc., Flight 508 Beech C99, N7217l, Weather Encounter and Crash Near Birmingham, Alabama, July 10, 1991. Aircraft Accident Report NTSB/AAR-92/01. Washington, DC.

Factual Information 196 Aircraft Accident Report In a January 26, 1993, letter to the FAA, the Safety Board stated that it continued to believe that instrument-rated pilots should receive recurrent training in techniques for recognizing and recovering from unusual attitudes and that proficiency programs should include this same training. The letter also stated the Board’s belief that requiring such training annually would greatly enhance a pilot’s ability to safely recover from an unusual attitude. Because the FAA planned no additional response, Safety Recommendation A-92-20 was classified “Closed—Unacceptable Action.” The Safety Board’s accident report of a DC-8-63, near Swanton, Ohio, on February 15, 1992,290 addressed the subject of airline pilots’ reluctance to aggressively apply flight controls. The report stated the following: …basic control manipulations by the first officer during the recovery attempt were in general accordance with accepted procedures in that he attempted to roll the wings level and then began pulling the nose up. If he had been more aggressive with both sets of controls, he might have succeeded. A larger, more rapid aileron input would have leveled the wings faster[,] and a more aggressive pullout could have been within the operating envelope of the aircraft…. Obviously, this situation called for extremely quick and aggressive control inputs. According to USAir flight training personnel, the flight training syllabus at the time of the USAir flight 427 accident included pilot training in the following maneuvers: • recovery from approaches to stalls, • recovery from a dutch roll, • high-speed buffet, • steep turns (45° bank), and • windshear escape. However, the Safety Board’s review of the USAir training syllabus that was in effect before the accident for both the ground and simulator training programs revealed that the training being conducted did not include recovery from unusual attitudes or upsets, as defined in AC 61-27C or in the Airplane Upset Recovery Training Aid. Additionally, the Safety Board surveyed the content of the flight training syllabi of six other major airlines at the time of the flight 427 accident. Of the six airlines surveyed, five had training syllabi similar to the USAir training syllabus. The sixth, United Airlines, had recently developed and implemented an Advanced Maneuvers Package291 for its Boeing 757 and 767 flight crew simulator training program. According to United Airlines 290 See National Transportation Safety Board. 1992. Air Transport International, Inc., Flight 805, DC-8-63, N794AL, Loss of Control and Crash, Swanton, Ohio, February 15, 1992. Aircraft Accident Report NTSB/AAR-92/05. Washington, DC. 291 United Airlines’ training captains developed the Advanced Maneuvers Package over a 2-year period, and it was incorporated into the 757 and 767 training program in July 1994. The program involves recognition and recovery from unusual flight attitudes, including nose high, nose low, and inverted.

Factual Information 197 Aircraft Accident Report flight training personnel, the Advanced Maneuvers Package received an “overwhelmingly positive” response from flight crews and instructors, and the airline was incorporating the training throughout its fleet. On July 13, 1993, Boeing published a Flight Operations Review article, which addressed the subject of unwanted roll tendencies, as follows: If aileron control is affected, rudder inputs can assist in countering unwanted roll tendencies. The reverse is also true if rudder control is affected. If both aileron and rudder control are affected, the use of asymmetrical engine thrust may aid roll and directional control. When encountering an event of the type described above, the flightcrew’s first consideration should be to maintain or regain full control of the airplane and establish an acceptable flight path. This may require the use of unusual techniques such as the application of full aileron or rudder. 1.18.9.2 Postaccident Activity On August 16, 1995, the FAA disseminated Flight Standards Handbook Bulletin for Air Transportation (HBAT) 95-10, entitled “Selected Events Training” (SET), to its principal operations inspectors (POI). The HBAT contains “…guidance and information on the approval and implementation of ‘Selected Events Training’ for operators training under 14 CFR Part 121, who use flight simulation devices as part of their flight training programs.” The HBAT states that the SET is “voluntary flight training in hazardous inflight situations which are not specifically identified in FAA regulations or directives.” Some of the examples of these selected events include false stall warning in rotation, excessive roll attitude (in excess of 90°), and high pitch attitude (in excess of 35°). The HBAT further states that the SET program was developed jointly by the FAA and the aviation industry in response to previously issued Safety Board recommendations addressing the need for unusual events and unusual attitude training for Part 121 and 135 air carrier pilots. In 1996, USAir implemented SET as a required recurrent training element for all of its pilots. The training program at USAir included simulator training in recovering from nose high, nose low, and inverted airplane attitudes. Also, many air carriers began implementing SET/Advanced Maneuvers Package programs patterned after the guidelines of the FAA’s HBAT 95-10 and United Airlines’ program, respectively. On October 18, 1996, the Safety Board issued Safety Recommendation A-96-120. This recommendation asked the FAA to require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements.

Factual Information 198 Aircraft Accident Report In a January 16, 1997, letter to the Safety Board, the FAA stated that it was considering an NPRM proposing to require that air carriers conduct training that will emphasize recognition, prevention, and recovery from aircraft attitudes that are normally not associated with air carrier flight operations. In its July 15, 1997, response, the Safety Board stated that it was not aware of any training programs that specifically addressed unusual attitudes that resulted from a control system failure or for which some flight controls would not be available, or would be counterproductive to, the recovery. (This recommendation is discussed more fully in section 1.18.11.5.) In a November 2, 1998, letter to the FAA, the Safety Board listed those safety recommendations, including A-96-120, for which no recent action had been taken by the FAA. In a January 13, 1999, letter to the Safety Board’s Director of the Office of Aviation Safety, the FAA’s Associate Administrator for Regulation and Certification stated that “14 CFR part 121, subparts N and O (Training Program and Crewmember Qualifications, respectively), are being extensively rewritten. The rulemaking is expected to contain specific requirements addressing the NTSB’s concerns.” (See section 2.7 for the Safety Board’s review and evaluation of the FAA’s action in response to Safety Recommendation A-96-120 and the recommendation’s current classification.) During 1997 and 1998, a working group composed of representatives of aircraft manufacturers, air carriers, pilot associations, training organizations, and government agencies (including the FAA) developed the Airplane Upset Recovery Training Aid. This publication and video program provided background information for air carrier pilots and managers on jet aerodynamics, stability, control, and upset recovery. The training aid also provided a model curriculum for classroom and flight simulator training in recovering from unusual flight attitudes. As of late 1998, the Airplane Upset Recovery Training Aid publication and video program were being distributed by two major air transport manufacturers (Boeing and Airbus) to their customers. This training aid, however, does not include simulator training in unusual attitudes resulting from flight control malfunctions and uncommanded flight control surface movements. 1.18.10 Procedural Information Available to Boeing 737 Flight Crews 1.18.10.1 Preaccident Information Available to 737 Pilots Regarding Abnormal Procedures (Flight Controls Malfunctions) The abnormal operations section of the USAir 737-300 Pilot’s Handbook that was in effect at the time of the flight 427 accident contained procedural guidance for abnormal flight control and hydraulic system conditions. Page 1-307-3 of the Pilot’s Handbook, dated May 8, 1992, listed abnormal checklist procedures for flight control low pressure and yaw damper anomalies. Page 1-307-6 of the Pilot’s Handbook, dated June 17, 1994, listed abnormal checklist procedures for “Jammed or Restricted Flight Controls.” Under “Flight Control Low Pressure,” the abnormal checklist procedures stated:

Factual Information 199 Aircraft Accident Report Flight Control Switch ............ STBY RUD [bold original to text] Placing a flight control switch to STBY RUD starts the standby hydraulic pump and arms the STANDBY LOW PRESSURE light. The FLT CONTROL LOW PRESSURE light extinguishes, indicating the standby rudder shutoff valve has opened. CAUTION: If flight control malfunctions are indicated, do not deactivate systems until the cause is established. If any flight control caution lights illuminate during flight, check position of corresponding switches, and monitor hydraulic system indications. CAUSE: The light indicates low hydraulic system pressure to ailerons, elevators, and rudder. Under “Yaw Damper,” the abnormal checklist procedures stated: Yaw Damper Switch....... OFF, THEN ON [bold original to text] If light remains illuminated: [bold original to text] Yaw Damper Switch........................... OFF [bold original to text] NOTE: Flying in turbulence with the yaw damper inoperative can be difficult, and uncomfortable for the passengers. Before commencing a flight with yaw damper inoperative, insure that turbulence (especially continuous turbulence of moderate or greater intensity) can be avoided. Under “Jammed or Restricted Flight Conditions,” the abnormal checklist procedures stated: This procedure is accomplished when jammed or restricted movement of flight controls in roll, pitch, or yaw control is experienced. Jammed or Restricted System ...........................OVERPOWER [bold original to text] Use maximum force, including a combined effort of both pilots, if necessary. Note: A maximum two-pilot effort on the control will not cause a cable or system failure. Do NOT turn off any flight control switches unless the faulty control is positively identified. [bold original to text] If the aileron or spoiler is jammed, force applied to the Captain’s and the First Officer’s control wheels identifies which lateral control system (aileron or spoiler) is usable, and which control wheel…provides roll control…. With a jammed elevator, manual or electric trim may be used to trim in either direction to offload control column forces….

Factual Information 200 Aircraft Accident Report Should the rudder control cable system fail, inputs to the rudder can be accomplished through the rudder trim control mechanism. If the rudder pedals are jammed, rudder control, rudder trim, and nose wheel pedal steering are inoperative. If freezing water is the suspected cause, consider descent to warmer air if conditions persist and re-attempt to override the jammed or restricted controls. If faulty system cannot be overpowered, use operative flight controls, trim and thrust, as required for airplane control. 1.18.10.2 Postaccident Changes/Information Available to 737 Pilots Regarding Abnormal Procedures (Flight Controls Malfunctions) 1.18.10.2.1 1994 Through 1995—Information and Changes Disseminated by Boeing On July 22, 1994, (less than 2 months before the USAir flight 427 accident) Boeing issued an internal document entitled “Change Proposal” (Flight Operations Review Board control No. 2247). The document recommended that the 737 Operations Manual include a procedure directing the flight crew to turn off the yaw damper if uncommanded yaw or rudder oscillations occurred in flight. The document also noted that the 737 AFM stated that “if directional hunting or rudder oscillations occur, turn the yaw damper off” but that the Operations Manual did not include a similar procedure. In addition, the document indicated that Air France had questioned the discrepancy between the manuals in 1993. On December 9, 1994, Boeing issued a revision to its 737 Operations Manual that established a procedure for uncommanded yaw. Page 03.10.08 of the manual stated: UNCOMMANDED YAW Accomplish this procedure if uncommanded yaw or rudder oscillations occur in flight: YAW DAMPER SWITCH....................................................... OFF The YAW DAMPER light illuminates when the yaw damper is disengaged. 1.18.10.2.2 1996 Through 1997—FAA Issuance of Airworthiness Directive 96-26-07 On December 23, 1996, the FAA issued AD 96-26-07, effective January 17, 1997. The AD required revising the FAA-approved AFM for all 737 series airplanes to include procedures that would enable the flight crew to take “appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition, and to correct a jammed or restricted flight control condition.” The FAA stated that the AD had been

Factual Information 201 Aircraft Accident Report prompted by its determination that such procedures were not adequately defined in the existing version of the 737 AFM. The AD established a “recall” procedure to be performed by flight crews immediately, from memory, in the event of an uncommanded yaw or roll. The recall procedure stated, “Maintain control of the airplane with all available flight controls. If roll is uncontrollable, immediately reduce angle of attack and increase airspeed. Do not attempt to maintain altitude until control is recovered. If engaged, disconnect autopilot and autothrottle.” The AD further required that the AFM section concerning procedures for jammed flight controls be modified to include in part the following: If the rudder pedals will not move to the pilot-commanded position, or if the pedals are deflected in one direction and jammed, maintain control of the airplane with all available flight controls. Disengage the autopilot and autothrottle. Use maximum force (combined effort by both pilots) to overpower the rudder system. After establishing control of the aircraft, check rudder pedal position. If the rudder pedals have centered, accomplish a normal descent, approach, and landing. If the rudder pedals remain jammed and are deflected to a degree that significantly affects the controllability of the airplane, select System B flight control switch to STBY RUD. If this action clears the jam/deflection, make a normal approach and landing, noting that rudder control may be limited. If moving the System B flight control switch to STBY RUD does not clear the jam, select System A flight control switch to OFF. If pedals do not center, select System B flight control switch to OFF…. The FAA specified that air carriers could comply with the AD by inserting a copy of it in the AFM. No flight crew training requirements were established by the FAA for the procedures that had been introduced or changed by the AD. On March 3, 1997, the Safety Board provided comments to the FAA about AD 96-26-07. The Board expressed concern that selecting the hydraulic system B flight control switch to standby rudder was specified by the FAA as a followup procedure rather than as an immediate action procedure. The Safety Board noted that, under certain failure conditions, if rudder system malfunctions were to occur at a relatively low altitude and airspeed, or if the flight crew’s recovery attempt were to be a delayed by only a few seconds, the flight crew might not be able to regain control of the airplane from the resulting extreme aircraft attitude and roll rate without immediately moving the system B flight control switch to the standby rudder position. The Safety Board recognized the potential for pilots to have difficulty identifying the hydraulic system B flight control switch among the several identically shaped and colored switches located nearby on the 737 overhead instrument panel. The Board noted the possibility of changing the shape and color of the system B flight control switch to provide greater conspicuity and distinctness.

Factual Information 202 Aircraft Accident Report 1.18.10.2.3 1997 Through 1998—Information and Changes Disseminated by Boeing On February 17, 1997, Boeing issued Operations Manual Bulletin for USAir, Inc., USA-17, “Uncommanded Yaw or Roll; Jammed or Restricted Rudder; Jammed or Restricted Elevator or Aileron.” This bulletin provided Boeing’s recommendations and suggestions on how to implement the FAA’s AD 96-26-07.292 With regard to uncommanded yaw or roll and jammed or restricted rudder, Boeing’s Operations Manual Bulletin stated the following: UNCOMMANDED YAW OR ROLL [bold original to text] Accomplish this procedure if uncommanded yaw or roll occurs in flight. Maintain control of the airplane with all available flight controls. If roll is uncontrollable, immediately reduce pitch/angle of attack and increase airspeed. Do not attempt to maintain altitude until control is recovered. AUTOPILOT (if engaged)........................................DISENGAGE AUTOTHROTTLE (if engaged) ..............................DISENGAGE Verify thrust is symmetrical. If yaw or roll continues: YAW DAMPER SWITCH....................................................... OFF If it is confirmed that the autopilot or autothrottle is not the cause of the uncommanded yaw or roll, the autopilot and autothrottle may be re-engaged at the pilot’s discretion. JAMMED OR RESTRICTED RUDDER [bold original to text] This procedure is accomplished only after establishing control of the airplane with all available flight controls and when the rudder pedals are jammed or deflected in one direction and will not move to the pilot’s commanded position. AUTOPILOT (if engaged)........................................DISENGAGE AUTOTHROTTLE (if engaged) ..............................DISENGAGE Verify thrust is symmetrical. RUDDER PEDALS................................................OVERPOWER 292 According to Boeing, similar bulletins were issued to other operators of the 737.

Factual Information 203 Aircraft Accident Report Identify rudder pedal position and then use maximum rudder pedal force, including a combined effort of both pilots on the corresponding rudder pedal, to free and/or center the rudder. If rudder pedals are centered: Accomplish Normal DESCENT-APPROACH and LANDING checklists. Note: Rudder authority may be limited. Crosswind capability may be reduced. Do not use auto brakes. Landing roll steering may require differential braking. If rudder pedals do not center and are verified to be jammed: SYSTEM B FLIGHT CONTROL SWITCH...............STBY RUD Apply pedal force to center the rudder. If rudder pedals can be centered: Accomplish Normal DESCENT-APPROACH and LANDING Checklists. Note: Rudder authority may be limited. Crosswind capability may be reduced. Do not use auto brakes. Landing roll steering may require differential braking. If rudder pedals will not center: SYSTEM A FLIGHT CONTROL SWITCH .......................... OFF If rudder pedals can be centered: ACCOMPLISH JAMMED OR RESTRICTED RUDDER DESCENT- APPROACH and LANDING Checklists. If rudder pedals will not center: SYSTEM B FLIGHT CONTROL SWITCH........................... OFF DESCENT-APPROACH [bold original to text] Ailerons and elevator are controlled manually. Rudder is inoperative if all flight control switches are off. Land at the nearest suitable airport. Use longest runway with minimum crosswind. Plan a flaps 15 landing. Set Vref 15 [reference airspeed for approach with flaps 15 setting]. ANTI-ICE ............................................................. AS REQUIRED

Factual Information 204 Aircraft Accident Report AIR CONDITIONING AND PRESSURIZATION ................ SET ALTIMETERS & INSTRUMENTS....SET & CROSSCHECKED N1 AND IAS [indicated airspeed] BUGS ....................CHECKED & SET, Vref 15 GND PROX SWITCH (As installed) ........FLAP/GEAR INHIBIT GO-AROUND PROCEDURE ........................................REVIEW Accomplish normal go-around procedure. Advance thrust to go-around smoothly and slowly to avoid excessive pitch-up. LANDING [bold original to text] ENGINE START SWITCHES ..................................................ON RECALL.......................................................................CHECKED SPEEDBRAKE.....................................ARMED, GREEN LIGHT LANDING GEAR ............................................DOWN, 3 GREEN FLAPS ............................................................ 15, GREEN LIGHT Ground and flight spoilers, nose steering wheel, wheel brakes and reverse thrust are still operative. Landing roll steering may require differential braking. Do not use auto brakes. Additionally, in July 1997, Boeing published a Flight Operations Review article, entitled “737 Directional Control.” The article indicated that Boeing continued to receive questions from pilots about the likelihood of 737 rudder malfunctions, the effect of potential rudder malfunctions on flightpath control, the meaning of crossover airspeed, and the benefit of increased flap maneuvering speeds on the crossover airspeed. Boeing stated that it published the article “to address these issues, to assure pilots that the 737 is controllable during a yaw and roll event and provide a recovery technique in case an uncommanded yaw or roll results in an airplane upset.” The article addressed likely and unlikely causes of 737 yaw and roll events, procedural revisions contained in the FAA’s AD 96-26-07, the FAA’s flight and ground validation testing for the AD-related revisions, procedures for recovery from 737 yaw and/or roll events, and crossover airspeed. The article stated that: …the vast majority [of yaw and/or roll events] were caused by external sources such as wake vortices, turbulence and wind shear, or internal airplane sources such as yaw damper, autopilot and autothrottle malfunctions, asymmetric flaps/slats, and pilot inputs. Additionally, analysis and testing have shown that it is hypothetically possible, although highly unlikely, that if one of the following rudder malfunctions occurs, yaw and then roll would result:

Factual Information 205 Aircraft Accident Report

1. Rudder Power Control Unit (PCU) valve secondary slide jam off-

neutral and a rudder pedal input causing full rudder reversal.

1. Jams of both primary and secondary slides in the rudder PCU valve.
2. Standby rudder actuator galling causing a rudder offset.
3. Linkage Jam causing blockage of the feedback loop of the main PCU,

resulting in uncommanded rudder motion.

1. A foreign object (e.g., screwdriver, wrench, nut or bolt) located

somewhere between the rudder pedals and the PCU causing a rudder system jam. Note: The rudder pedals will always follow the direction of the rudder during these conditions. Boeing’s article defined crossover airspeed as the speed below which the rolling moment created by a full lateral control input will not overcome the roll effect from full rudder displacement. The article stated that “while the airspeed at which this occurs is variable, cross-over speeds exist on all commercial airplanes. ...the [737] ‘cross-over speed’ is at or above [Boeing’s recommended] block maneuvering speeds293 at high gross weights and for flaps up through 10. For flaps 15, 25, 30, or 40, the ‘cross-over speed’ occurs significantly below recommended block maneuvering speeds and is near or below stick shaker speeds.” According to the article, some 737 operators had chosen to increase their maneuvering speeds for flaps up through flaps 10 configurations by adding 10 knots above the block maneuvering speeds. Boeing stated that it had no technical objection to such an increase and acknowledged that a block speed increase would provide a marginal increase in lateral (roll) control authority relative to directional control authority. However, the article cautioned operators that the crossover airspeeds “vary as a function of left and right sideslip, differences in thrust, and differences in trim.” The article also stated that “relying on speed additives…is simply not as effective” as executing a recovery procedure in which the angle-of-attack is reduced, airspeed is increased, and full control inputs are made “expeditiously.” Boeing’s article stressed prioritizing roll control during recovery from nose-down bank upsets unless the airplane was in a stall condition; if the airplane was stalled, Boeing 293 Boeing stated that it has published block maneuvering speeds for the 737 since the -100 model began service. The recommended maneuvering speeds for each flap configuration provided, for all airplane weights, adequate airspeed for maneuvering in at least a 40° bank without activation of the stickshaker. “Block” referred to the simplification of the airspeed schedule with regard to airplane’s weight. A single airspeed was specified for all airplane weights less than 117,000 pounds; thus, airplanes operating at weights less than 117,000 pounds (including the USAir 427 accident airplane) had a greater maneuvering margin. Alternative minimum maneuvering speed schedules were used by some air carriers at their option. These specified a minimum airspeed for each flap configuration and weight (in 10,000-pound increments). For airplanes operating at weights less than 117,000 pounds, these airspeeds were slower than the block maneuvering speeds. According to Boeing, even though block maneuvering speeds were recommended, it calculated and provided alternative minimum maneuvering speed schedules at air carriers’ request.

Factual Information 206 Aircraft Accident Report recommended recovering from the stall before recovering from the upset. The article described the nose-down upset recovery technique as follows: • Reduce angle of attack. This unloads the wing, allows the airplane to accelerate, which reduces rudder deflection and improves lateral control ability. • Roll wings level using all available flight controls. This significantly reduces the chance of accelerated stall. • Apply up elevator to recover toward the desired pitch attitude and airspeed. Always respect the stick shaker, even in a nose low situation. We do not suggest using asymmetric thrust to recover from a large bank angle upset. The article specifically stated that if roll was uncontrollable, the pilot should immediately reduce the airplane’s pitch attitude/angle-of-attack and increase airspeed; pilots were cautioned not to attempt to maintain altitude until control was recovered. In addition, Boeing’s article urged pilots to “use and hold” full lateral control input to counter the roll (with coordinated rudder for bank angles of 45° or greater). The article further stated that “under all situations, respect the stick shaker” [underscore original to text]. 1.18.10.2.3.1 Implementation of AD 96-26-07 and Boeing 737 Operations Manual Revision by U.S. 737 Air Carrier Operators During July 1998, the Safety Board assessed the implementation of AD 96-26-07 by U.S. 737 air carrier operators. Of the 13 air carriers contacted by the Safety Board, 12 provided the requested information. These 12 air carriers operated a total of 1,070 Boeing 737s. The assessment results indicated that six of the responding air carriers (accounting for 88 percent of the airplanes) were providing 737 flight crews with a flight simulator demonstration of crossover airspeed (the overpowering of roll flight controls by rudder input.) Four of these six air carriers (accounting for 72 percent of the airplanes) were providing flight crews a specific demonstration of the crossover airspeed in the flaps 1 configuration. However, six air carriers (accounting for 12 percent of the airplanes) had no documented simulator training on crossover airspeed. According to the assessment information, 8 of the 12 responding air carriers provided simulator training to flight crews on the jammed rudder procedure, but the remaining 4 (accounting for 20 percent of the airplanes) provided no simulator training on this procedure. Of the eight air carriers that trained crews on the jammed rudder procedure, five (accounting for 40 percent of the airplanes) required instructors to continue the procedure at least to the step of selecting the hydraulic system B flight control switch to the standby rudder position. The remaining three air carriers that trained crews on the jammed rudder procedure (accounting for 40 percent of the airplanes) did not specify the extent to which the procedure was to be performed or terminated the procedure to respond to a jammed rudder malfunction with disengagement of the yaw damper.

Factual Information 207 Aircraft Accident Report The assessment results also indicated that 10 of the 12 air carriers had implemented a minimum maneuvering airspeed for the flaps 1 configuration (110,000- pound airplane gross weight) of at least 190 knots. Four of these 10 air carriers (accounting for 66 percent of the airplanes) had increased Boeing’s recommended block maneuvering speeds by 10 knots and were requiring pilots to use at least 200 knots as the minimum airspeed for flaps 1. The remaining two air carriers were using slower minimum maneuvering speeds specified for each 10,000-pound increment of airplane weight. For flaps 1 and a 110,000-pound airplane gross weight, these two carriers (accounting for a combined total of 16 of the airplanes) were using minimum block maneuvering speeds of 158 and 164 knots. Further, the assessment indicated that all responding air carriers had modified the checklist for “Uncommanded Yaw and Roll” in accordance with AD 96-26-07 and the February 17, 1997, Boeing Operations Manual Bulletin. These modifications included the bulletin’s requirement for pilots to recall from memory the procedure to disengage the yaw damper in the event of an uncommanded yaw or roll. 1.18.10.2.4 Safety Board Recommendations Relating to Unusual Attitude Training During its investigation of the USAir flight 427 accident, the Safety Board issued Safety Recommendations A-96-118, A-96-120, and A-97-18 regarding unusual attitude procedures and training. In its February 2, 1999, letter to the FAA, the Safety Board indicated that Safety Recommendations A-96-118 and A-97-18 were classified “Open— Unacceptable Response” and that Safety Recommendation A-96-120 was classified “Open—Acceptable Response.” The letter also stated that the Board would further discuss and analyze these recommendations in the USAir flight 427 accident report. The histories of Safety Recommendations A-96-118, A-96-120, and A-97-18 are discussed in sections 1.18.11.5 and 1.18.11.6 and analyzed in section 2.7. 1.18.11 History of Safety Recommendations Resulting From the United Flight 585 and USAir Flight 427 Accidents and the Eastwind Flight 517 Incident The Safety Board made 27 safety recommendations as a result of its investigation of the United flight 585 and USAir flight 427 accidents, the Eastwind flight 517 incident, and other occurrences involving 737 series airplanes. A listing of these safety recommendations appears in sections 1.18.11.1 through 1.18.11.6. 1.18.11.1 Galling of Standby Rudder Actuator Bearings—United Flight 585 Accident (Safety Recommendation A-91-77) During its investigation of the accident involving United flight 585, the Safety Board became concerned about galled standby rudder actuator bearings on 737s and 727s. As a result, the Safety Board issued Safety Recommendation A-91-77 on August 20, 1991.

Factual Information 208 Aircraft Accident Report Safety Recommendation A-91-77 asked the FAA to Issue an airworthiness directive requiring a check on all Boeing 737 and 727 model airplanes with the part number (P/N) 1087-23 input shaft in the rudder auxiliary actuator unit for the force needed to rotate the input shaft lever relative to the P/N 1087-22 bearing of the auxiliary actuator unit. During this check, the bearing should be inspected to determine if it rotates relative to the housing. All shaft assemblies in which rotation of the bearing occurs, or in which excessive force is needed to move the input lever, should be removed from service on an expedited basis, and the assemblies should be replaced with a P/N 1087-21 shaft assembly that has a reduced diameter on the unlubricated portion of the shaft in accordance with revision G of the P/N 1087-23 engineering drawing. All assemblies meeting the force requirement should be rechecked at appropriate intervals until replaced with a P/N 1087-21 shaft assembly containing a P/N 1087-23 shaft that has a reduced diameter on the unlubricated portion of the shaft. On January 3, 1992, the FAA issued an NPRM (Docket No. 91-NM-257-AD) in response to this recommendation. The NPRM proposed to adopt an AD that would require inspecting the input shaft in the auxiliary (standby) rudder PCU on all 727 series and certain 737 series airplanes and reporting to the FAA on those units that failed the inspection test procedure. In a March 27, 1992, letter, the Safety Board expressed concern that an inspection of the standby rudder actuator bearings was not included in the NPRM. Because loose bearings can indicate a galling problem, the Safety Board believed that inspection of the bearings for rotation in the housing and for the integrity of the safety wire was essential. The Safety Board was also concerned that the proposed time for compliance for these inspections (4,000 flight hours) might be excessive. As the FAA indicated in the NPRM, the tests and inspections would only take about 6 hours. Because of the possibility that the components affected could cause an uncommanded rudder input, the Safety Board believed that these inspections should be performed as soon as possible or, at the very least, at the next available inspection of the airplane. After the NPRM was issued, the FAA determined that the condition addressed in the NPRM was not unsafe and did not warrant the issuance of an AD. Consequently, on April 19, 1993, the FAA issued a notice in the Federal Register to withdraw the NPRM. In an August 5, 1993, letter to the Safety Board, the FAA indicated that it withdrew the NPRM based on its reevaluation of the design of the rudder control system on the 727 and 737 series airplanes. The reevaluation determined that a flight crew would be capable of detecting a galling condition by (1) increased force necessary to move the rudder pedal, (2) erratic nose gear steering with the yaw damper engaged, (3) rudder yaw damper kick back or yaw damper back drives on the rudder pedals during flight, and (4) erratic operation of the rudder yaw damper or erratic rudder oscillations with the yaw damper engaged. The FAA concluded that none of these indications of galling represented a safety hazard. On November 15, 1993, the Safety Board acknowledged the results of the FAA’s reevaluation of the design of the rudder control system on 727 and 737 airplanes. The

Factual Information 209 Aircraft Accident Report Safety Board did express concern, however, that the galling could result in erratic flight control, distract a flight crew, and be potentially hazardous in certain circumstances. Because the Board stated that it had no further evidence that galling could result uncommanded rudder deflections of a significant magnitude, Safety Recommendation A-91-77 was classified “Closed—Acceptable Alternate Action.” 1.18.11.2 Weather-Related Recommendations—United Flight 585 Accident (Safety Recommendations A-92-57 and -58) As a result of information developed during the accident investigation of United Airlines flight 585, the Safety Board issued Safety Recommendations A-92-57 and -58 on July 20, 1992. Safety Recommendation A-92-57 asked the FAA to Develop and implement a meteorological program to observe, document, and analyze potential meteorological aircraft hazards in the area of Colorado Springs, Colorado, with a focus on the approach and departure paths of the Colorado Springs Municipal Airport. This program should be made operational by the winter of 1992. Safety Recommendation A-92-58 asked the FAA to Develop a broader meteorological aircraft hazard program, to include other airports in or near mountainous terrain, based on the results obtained in the Colorado Springs, Colorado, area. On October 8, 1992, the FAA stated that its Research and Development Service was planning to start a program in fiscal year 1995 to address potential aircraft hazards resulting from mountain-induced meteorological phenomena. On March 26, 1993, the FAA indicated that the Research and Development Service was planning to accelerate program implementation to fiscal year 1994. On June 10, 1993, the Safety Board indicated that it was pleased with the FAA’s accelerated program because the Board was investigating four accidents in which mountain-induced meteorological phenomena might have been a cause or factor. On September 14, 1993, the FAA indicated that it had tasked NOAA’s Forecast Systems Laboratory to (1) formulate a plan to provide a definitive study of mountain-induced wind phenomena and their effect on aircraft in flight and (2) develop initiatives to define and implement a program to alert pilots of these hazards. On December 14, 1995, the FAA indicated that, in September 1995, the FAA/ NOAA program was redefined in scope because of reduced budget allocations and expected future funding constraints. As a result, the FAA planned to complete (1) a pilot training manual on the impact of mountain-induced aeronautical hazards on aircraft operations; (2) a Colorado Springs data collection and baseline experiment for a terminal area detection system for mountain-induced turbulence hazards; and (3) a final report with recommendations from this experiment on the viability of developing a prototype prediction, detection, and display system for these hazards in the terminal area. The FAA reported that it had drafted the training manual.

Factual Information 210 Aircraft Accident Report On March 20, 1996, the Safety Board indicated that the FAA’s draft pilot training manual was very comprehensive and detailed. However, the Safety Board expressed concern that funding constraints had reduced the scope, duration, and rigor of the originally proposed data collection experiment. The Board urged the FAA to increase funding for the program. On April 3, 1998, the FAA stated that it had completed several actions to improve the safety of flying in mountainous areas “by providing pilots, dispatchers, and others in aviation operations with a series of products that will detect, display, and forecast hazardous mountain winds.” The letter stated that the FAA had accomplished the following: • The FAA, NOAA, and NCAR published AC 00-57, "Hazardous Mountain Winds and Their Visual Indicators," to provide information on hazardous mountain winds and their effects on flight operations near mountainous regions. The primary purpose of the AC is to assist pilots involved in aviation operations in diagnosing the potential for severe wind events in the vicinity of mountainous areas and provide information on preflight planning techniques and in-flight evaluation strategies for avoiding destructive turbulence and loss of aircraft control. • NOAA and NCAR personnel collected data on the intensity and direction of wind flows at the Colorado Springs Airport during January through March 1997, when mountain-induced activity was known to be prevalent. A data set was developed through the use of one Doppler Light Distancing and Ranging (LIDAR) unit, three wind profilers with radio acoustic sounding system, anemometers, an instrumented King Air airplane that traversed the landing and takeoff flightpaths, six surface meteorological stations, an infrasonic laboratory, and pilot reports. NOAA and NCAR were expected to complete a report by September 1998 on a limited analysis of the Colorado Springs data. The analysis was to assess the turbulence-detection capabilities of the LIDAR and ground anemometers and determine the strengths of LIDAR-detected wind turbulence as a function of other factors that were recorded during the experiment. On January 20, 1999, the Safety Board stated that the data collected during the Colorado Springs meteorological program in early 1997 represented an important and somewhat unique data set that defined mountain-induced wind flows and the associated hazards. The Board urged the FAA to make every effort to ensure the complete and detailed analysis of these data and the timely publication of the results. Pending the issuance of a final report by NOAA and NCAR, Safety Recommendation A-92-57 was classified “Open—Acceptable Response.” However, the Safety Board still believed that the FAA should develop a broader meteorological aircraft hazard program to include airports (other than Colorado Springs) in or near mountainous areas. Pending receipt of information on such a program, Safety Recommendation A-92-58 was classified “Open— Unacceptable Response.”

Factual Information 211 Aircraft Accident Report 1.18.11.3 Recommendations Resulting From the July 1992 United Airlines Ground Check PCU Anomaly (Safety Recommendations A-92-118 Through -121) On July 16, 1992, during a preflight check of the flight controls in a United Airlines 737-300 that was taxiing to takeoff from ORD, the captain discovered that the airplane's rudder pedal stopped at around 25 percent left pedal travel. The airplane returned to the gate, and the main rudder PCU (S/N 2228A) was removed. Subsequent testing indicated that, when the input crank was fixed against the body stops (to simulate a jam of the primary slide to the secondary slide) and the yaw damper piston was in the extend position, the PCU servo valve exhibited anomalous actions, ranging from sluggish movement of the actuator piston to a full reversal in the direction of piston travel opposite to the direction being commanded. As a result of this and other incidents involving anomalies in the 737 rudder system, the Safety Board issued Safety Recommendations A-92-118 through -121 on November 10, 1992. Safety Recommendation A-92-118 asked the FAA to Require that Boeing develop a repetitive maintenance test procedure to be used by 737 operators to verify the proper operation of the main rudder power control unit servo valve until a design change is implemented that would preclude the possibility of anomalies attributed to overtravel of the secondary slide. On January 19, 1993, the FAA stated that Boeing would issue service information to inspect and retrofit all 737 series airplanes. The FAA also stated that it would issue an NPRM to mandate compliance with this information. On January 3, 1994, the FAA issued AD 94-01-07, which became effective on March 3, 1994. The AD required, within 750 flight hours after its effective date, (1) repetitive tests of the main rudder PCU of certain 737 series airplanes, in accordance with Boeing SL 737-SL-27-82-B, to detect excessive internal leakage of hydraulic fluid, stalling, or reversal and (2) the eventual replacement of the main rudder PCU with an improved model incorporating a redesigned servo valve. In an August 11, 1994, letter to the FAA, the Safety Board stated that, in the interest of safety, all 737 main rudder PCUs should be modified at the earliest possible date and that the compliance period in AD 94-01-07 appeared to be founded on reasonable estimates of equipment availability. Because the AD met the intent of the Safety Recommendation A-92-118, it was classified “Closed—Acceptable Action.” Safety Recommendation A-92-119 asked the FAA to Require that Boeing develop an approved preflight check of the rudder system to be used by operators to verify, to the extent possible, the proper operation of the main rudder power control unit servo valve until a design change is implemented that would preclude the possibility of rudder reversals attributed to the overtravel of the secondary slide.

Factual Information 212 Aircraft Accident Report On January 19, 1993, the FAA responded that it did not agree with this safety recommendation because it believed that the current preflight check procedures adequately ensured proper rudder operation. On June 10, 1993, the Safety Board indicated that rapid rudder pedal inputs were required to induce the lockup that occurred during the July 16, 1992, preflight check conducted by the captain of the United Airlines 737-300 and that a routine preflight check would not have uncovered the problem. In all test cases that resulted in the locked-up condition or reversal, the input control was moved at a rate faster than the rudder actuator could respond, thus forcing the secondary valve into the overtravel position. The Safety Board further stated that rapid movement of the rudder pedals on the ground could result in damage to the airplane. In a July 14, 1994, letter, the FAA reiterated its position that current preflight check procedures adequately ensure proper rudder operation. The FAA agreed that rapid rudder inputs were a factor in uncovering rudder control anomalies and that a rapid rudder input during every preflight check increased the possibility of structural rudder damage. The FAA also stated that it would be impossible to conduct this check with any degree of consistency because of variances among pilots. Finally, the FAA stated that not all rudder control anomalies resulting from secondary slide overtravel can be detected during preflight checks. Instead of incorporating rapid rudder movements in the preflight check, the FAA included specific requirements in AD 94-01-07 for a periodic (750 flight hours) inspection of the rudder system until the servo valve was redesigned. The AD required that the rudder pedals be cycled at the maximum rate and that special instrumentation and additional observers be available to properly detect any anomaly. According to the FAA, the requirements of the AD were intended to ensure the detection of high internal leakage within the main rudder PCU servo valve, which is a symptom of secondary slide overtravel. The inspection was expected to identify servo valves that performed marginally by measuring the internal leakage rate. The FAA stated that a servo valve with marginal performance would not be detected during a preflight check but would have a reduced hinge moment capability because of excessive internal leakage. This internal leakage rate cannot be measured during a preflight check. On August 11, 1994, the Safety Board notified the FAA that the requirement for repetitive inspections of the main rudder PCU at 750-hour intervals was sufficient. Because the FAA’s action addressed the intent of Safety Recommendation A-92-119, it was classified “Closed—Acceptable Alternate Action.” Safety Recommendation A-92-120 asked the FAA to Require operators, by airworthiness directive, to incorporate design changes for the 737 main rudder power control unit servo valve when these changes are made available by Boeing. These changes should preclude the possibility of rudder reversals attributed to the overtravel of the secondary slide.

Factual Information 213 Aircraft Accident Report On January 3, 1994, the FAA issued AD 94-01-07 (see A-92-118). On August 11, 1994, the Safety Board stated that, because the AD satisfied the intent of Safety Recommendation A-92-120, it was classified “Closed—Acceptable Action.” Safety Recommendation A-92-121 asked the FAA to Conduct a design review of servo valves manufactured by Parker Hannifin having a design similar to the 737 rudder power control unit servo valve that control essential flight control hydraulic power control units on transport-category airplanes certified by the Federal Aviation Administration to determine that the design is not susceptible to inducing flight control malfunctions or reversals due to overtravel of the servo slides. On January 19, 1993, the FAA stated that a design review of the servo valves manufactured by Parker Hannifin on all transport-category airplanes was completed. The problem was found to exist in the main rudder PCU only on 737 airplanes. On June 10, 1993, the Safety Board responded that, because this information met the intent of Safety Recommendation A-92-121, it was classified “Closed—Acceptable Action.” 1.18.11.4 Flight Data Recorder Recommendations (Safety Recommendations A-95-25 Through -27) The FDRs on the airplanes involved in the United flight 585 and USAir flight 427 accidents recorded very limited amounts of data. The FDR installed on the United airplane recorded data for five parameters. (For more information, see section 1.16.1.1.) The FDR installed on the USAir airplane recorded data for 13 parameters.294 (For more information, see section 1.11.2.) However, neither FDR recorded other parameters that would have been useful in these accident investigations, including control wheel position, rudder pedal position, flight control surface (rudder, aileron, and spoiler) positions, or lateral acceleration. As a result of its concerns about limited-parameter FDRs, the Safety Board issued Safety Recommendations A-95-25 through -27 on February 22, 1995. Safety Recommendation A-95-25, which was designated as urgent, asked the FAA to Require that each Boeing 737 airplane operated under 14 CFR Parts 121 or 125 be equipped, by December 31, 1995, with a flight data recorder system that records, at a minimum, the parameters required by current regulations applicable to that airplane plus the following parameters (recorded at the sampling rates specified in "Proposed Minimum FDR Parameter Requirements for Airplanes in Service”): lateral acceleration; flight control inputs for pitch, roll, and yaw; and primary flight control surface positions for pitch, roll, and yaw. 294 The existing regulations at the time of the USAir flight 427 accident (14 CFR Section 121.343) required that airplanes operated under Part 121 have FDRs that record 11 parameters. Title 14 Sections 125.225 and 135.152 contained a similar requirement for airplanes operated under Parts 125 and 135, respectively.

Factual Information 214 Aircraft Accident Report Safety Recommendation A-95-26 asked the FAA to Amend, by December 31 1995, 14 CFR Sections 121.343, 125.225, and 135.152 to require that Boeing 727 airplanes, Lockheed L-1011 airplanes, and all transport-category airplanes operated under 14 CFR Parts 121, 125, or 135, whose type certificate applies to airplanes still in production, be equipped to record on a flight data recorder system, at a minimum, the parameters listed in "Proposed Minimum FDR Parameter Requirements for Airplanes in Service" plus any other parameters required by current regulations applicable to each individual airplane. Specify that the airplanes be so equipped by January 1, 1998, or by the later date when they meet Stage 3 noise requirements but, regardless of Stage 3 compliance status, no later than December 31, 1999.” Safety Recommendation A-95-27 asked the FAA to Amend, by December 31, 1995, 14 CFR Sections 121.343, 125.225, and 135.152 to require that all airplanes operated under 14 CFR Parts 121, 125, or 135 (10 seats or larger), for which an original airworthiness certificate is received after December 31, 1996, record the parameters listed in “Proposed FDR Enhancements for Newly Manufactured Airplanes” on a flight data recorder having at least a 25-hour recording capacity. In issuing these safety recommendations, the Safety Board stated that information from FDRs with additional parameters substantially aided its investigations of two regional airline accidents. The first accident, on February 1, 1994, involved a dual-engine power loss in a Saab 340B at New Roads, Louisiana.295 The FDR installed on this airplane recorded 128 parameters. Because of the expanded FDR data, the Safety Board was able to rule out early in the investigation an airplane system anomaly as the initiating event and focus on operational and human performance issues. The second accident, on October 31, 1994, involved an uncommanded roll excursion of an Avions de Transport Regional Model 72-212 (ATR-72) near Roselawn, Indiana.296 The airplane’s FDR was configured to record approximately 115 parameters. The volume of data recorded by this enhanced FDR enabled the Board to narrow the focus of its investigation early on to possible explanations for aileron control surface movements. As a result, the Safety Board issued, within days of the accident, urgent safety recommendations to minimize the likelihood of similar occurrences. In a February 24, 1995, letter, the FAA stated that it would open a public docket and seek comments on these recommendations and that it planned to hold a public meeting to review the recommendations. On March 8, 1995, the Safety Board responded that these actions could create an unacceptable delay and urged the FAA to establish an accelerated schedule for adopting Safety Recommendation A-95-25. 295 For more information, see National Transportation Safety Board. 1994. Overspeed and Loss of Power on Both Engines During Descent and Power-off Emergency Landing, Simmons Airlines, Inc., d.b.a. American Eagle Flight 3641, N349SB, False River Air Park, New Roads, Louisiana, February 1, 1994. Aircraft Accident Report NTSB/AAR-94/06. Washington, DC. 296 For more information, see the discussion of Safety Recommendation A-96-120 in section 1.18.11.5.

Factual Information 215 Aircraft Accident Report On May 16, 1995, the FAA indicated that it agreed with the intent of the recommendations but that it could not meet the December 31, 1995, retrofit completion date in Safety Recommendation A-95-25. The FAA characterized the Safety Board’s timetable as “an extremely aggressive schedule which, if it were physically possible, would result in substantial airplane groundings and very high associated costs.” On July 17, 1995, the Safety Board indicated its disappointment that the recommended compliance date could not be met. The Board believed that the date of compliance for the recommendation must reflect the urgency associated with retrofitting 737s to record additional FDR parameters. In an April 29, 1996, letter to the FAA, the Safety Board pointed out that more than 1 year had elapsed since it issued urgent Safety Recommendation A-95-25 and that it had been almost 1 year since the FAA formally responded to this issue. Also, the Board said that FDR recordings from several other 737s that reported in-flight disturbances similar to those associated with the United flight 585 and USAir flight 427 accidents did not provide sufficient data to isolate rudder and pedal movement primarily because the flight control inputs or control surface positions were not recorded. The Board believed that, if the FAA and industry had begun to implement Safety Recommendation A-95-25 after it was issued, most 737s would have been retrofitted with an acceptable, short-term improved recording capability. The Safety Board concluded that the lack of FAA action was unacceptable. In addition, the Safety Board stated that, according to the FAA, the major impediment to the retrofit of 737s was cost. However, Board staff visited a maintenance facility to observe the installation of FDR sensors and associated wiring and found that industry cost estimates apparently did not seek innovative measures that might reduce cost. For example, in the installation observed, industry assumed that aft lavatories had to be removed to allow wires to be routed from the airplane’s tail to the FDR. Consultations with installation experts demonstrated that wiring could be routed through existing access ports on a lower portion of the aft pressure bulkhead, which could eliminate the need to remove the aft lavatory and save 150 hours of labor. On the basis of these consultations, Safety Board staff believed that adding rudder pedal and rudder position sensors to existing 737s could be accomplished without interrupting normal revenue service. The Board suggested that the work be performed on approximately four to five overnight visits or during a C maintenance check without extending the visit. In a July 1, 1996, letter to the FAA, the Safety Board addressed the Eastwind flight 517 incident that had occurred the previous month. The Board believed that, under slightly different circumstances, the Eastwind incident could have become the third fatal 737 upset accident for which there was inadequate FDR information to determine the cause. The Board also believed that, if the FAA had complied with the intent of Safety Recommendation A-95-25, the Eastwind airplane would have been fitted with an FDR that recorded the parameters necessary to better understand the events leading to the upset and develop corrective actions to prevent a future catastrophic 737 accident. In addition, the Board expressed its continued strong concern about the failure of the FAA to require the needed retrofit of the 737. The Board noted that more than 15 months had passed with

Factual Information 216 Aircraft Accident Report no action taken on this important safety issue. As a result, Safety Recommendation A-95-25 had been placed on the Safety Board’s Most Wanted Safety Improvements List.297 The Board once again urged the FAA to take the necessary actions to meet the intent of this safety recommendation. On July 9, 1996, the FAA issued an NPRM, “Revisions to Digital Flight Data Recorder Rules.” The proposed rule would require a 4-year retrofit of FDR systems, with parameter upgrade requirements based on when the aircraft was manufactured and whether the aircraft was equipped with a flight data acquisition unit (FDAU).298 The proposed rule would also mandate increases in the number of required FDR parameters for newly manufactured aircraft, with the first parameter increase occurring 3 years from the date of the final rule and the second increase 5 years after the date of the final rule. On August 15, 1996, the Safety Board commented on the NPRM. The Board recognized that the FAA’s proposed revisions attempted to increase the minimum number of FDR parameters and impose the minimum financial, operational, manufacturing, and purchase contract burdens on industry. However, the Board strongly disagreed with the FAA’s proposed compliance dates for newly manufactured and existing aircraft and with the minimum parameter requirements for existing aircraft. The Board also strongly disagreed with the FAA's decision not to require more expeditious flight control parameter upgrades for 737 airplanes. The Board strongly requested that the FAA act on the Board's comments to the NPRM and expedite issuance of a final rule. On October 7, 1996, the FAA reiterated the position presented in its May 16, 1995, letter. On December 12, 1996, the Safety Board stated that, although it had been verbally informed that the FAA hoped to issue a final rule by the end of December 1996, the October 7 letter made no mention of an issue date for the final rule. The Board also stated that, even if a final rule were issued by the end of 1996, all aircraft would not be required to be upgraded until December 2000, almost 6 years after Safety Recommendations A-95-25 through -27 were issued. Because of the FAA’s failure to take action to ensure timely upgrades of the 737 FDR parameters, Safety Recommendation A-95-25 was classified “Closed—Unacceptable Action.” On July 9, 1997, the FAA issued its final rule in response to the safety recommendations, which required in part that all existing transport-category airplanes operated under 14 CFR Parts 121, 125, and 135 be equipped with FDRs that record at least 18 parameters, instead of the previously required 11 parameters. Also in its final rule, the FAA indicated that the retrofit modification to existing airplane’s FDRs should be accomplished at the earliest practicable time but no later than the airplane’s first heavy maintenance check after August 18, 1999. In a July 22, 1997, letter, the FAA stated that 297 The Safety Board’s Most Wanted Safety Improvements List contains the agency’s 10 most urgent safety recommendation issues in the areas of aviation, highway, pipeline and hazardous materials, railroad, and marine safety. 298 A FDAU is external to the FDR and collects and digitizes data to be recorded by the FDR. The FDR on an airplane equipped with a FDAU can record additional parameters as modified.

Factual Information 217 Aircraft Accident Report the final rule requires all affected existing airplanes to “be equipped to record the parameters recommended by the Board” by August 19, 2001.299 Further, the FAA stated that the July 9, 1997, final rule also requires all airplanes operated under 14 CFR Parts 121, 125, or 135 (10 seats or more) for which an original airworthiness certification is received after December 31, 1996, to record the parameters listed in “Proposed Flight Data Recorder Enhancements for Newly Manufactured Airplanes” on an FDR having at least a 25-hour recording capacity. The new FDR rules call for parameters 1 through 57 to be recorded for airplanes manufactured after August 18, 2000, and parameters 1 through 88 to be recorded for airplanes manufactured after August 19, 2002. The FAA considered its action on the safety recommendations to be completed. On August 4, 1998, the Safety Board indicated that it was generally pleased that the FAA issued revised FDR rules because the changes in the FDR parameter requirements offered a major improvement over the former requirements. For example, the Safety Board agreed with the FAA’s decision to include flight control surface positions and flight control inputs as portions of the minimum number of parameters to be recorded by existing airplanes. However, the Board believed the final rulemaking fell short of the intent of Safety Recommendations A-95-26 and -27 in two critical areas: 299 The Safety Board is aware that some air carriers have not retrofitted their airplanes with the required FDR upgrades during scheduled heavy maintenance checks. For example, the Board’s investigation of the February 23, 1999, Metrojet upset event revealed that, although the incident airplane was scheduled for a heavy maintenance check in March 1999, it was not scheduled to receive the required FDR upgrade until its next heavy maintenance check in March 2001. In contrast, the Safety Board is aware of one air carrier (Southwest Airlines) that is retrofitting the FDRs in its fleet. Southwest’s fleet consisted of 248 Boeing 737s, 100 of which are already equipped with FDAUs and enhanced FDRs and thus do not require the upgrade. Southwest began to retrofit its remaining 148 Boeing 737s in July 1996 (about the same time that the FAA issued the NPRM regarding FDR upgrades and 1 year before the resultant final rule was issued). Although not required by the FAA’s final rule, Southwest also elected to install FDAUs on the 148 airplanes that were not so equipped (at a cost of $70,000 per airplane) to permit future expansion of FDR parameters. Southwest expected to have completed the retrofit all of its affected airplanes by December 1999.

Factual Information 218 Aircraft Accident Report • Although the new FDR rules would eventually mandate all of the Safety Board's recommended parameters for new airplanes, the parameter requirements for existing airplanes were less than those referenced in Safety Recommendation A-95-26.300 Therefore, the Board disagreed with the FAA's assertion that the rule required airplanes to "be equipped to record the parameters recommended by the Board.” The recommended minimum parameter requirements for existing airplanes were based on the Safety Board's investigative experience. The Board believed that all U.S.-registered airplanes should record these parameters. According to the Board, the FAA's reasoning for not including all the recommended parameters—that FDR requirements should be determined by the capabilities of the FDR system fitted to a specific airplane rather than by investigative requirements—placed far too much emphasis on cost. The Safety Board recognized that substantial costs would be associated with retrofitting all of the proposed minimum parameter requirements on existing airplanes not equipped with a FDAU or a digital data bus. However, all of the 88 parameters referenced in Safety Recommendation A-95-26 are potentially critical to future investigations. The Board maintained that the FAA’s final rule should have included all the recommended parameters for existing airplanes. • The compliance dates stated in the final rule for newly manufactured airplanes extended far beyond the recommended compliance dates, and the Board believed that the FAA's reasoning for the extended compliance dates was flawed. Although the final rule included all 88 recommended parameters for newly manufactured airplanes, the Board was disappointed that the recording of the 88 parameters would not be accomplished immediately. The new regulations will mandate an incremental increase in FDR capability, from 29 to 57 and then to 88 parameters. The Board did not believe that this incremental expansion was necessary and that there was not sufficient justification for airplanes manufactured between August 18, 2000, and August 19, 2002, to record only 57 parameters. According to the Safety Board, the FAA cited the needed development of control force sensors and availability of 256-word-per-second FDRs as explanations for the incremental increase of parameters for newly manufactured airplanes. On the basis of its conversations with airplane manufacturers, the Board determined that the necessary technology was already available and that a 5-year development time for all 88 parameters was unnecessary. In fact, the Board was aware that some operators and manufacturers had elected to record, or at least to make provisions to record, all 88 parameters (including the control force parameters) on airplanes 300 For example, the Safety Board recommended that FDRs installed on affected existing airplanes be upgraded to record pitch trim; thrust reverser position; angle-of-attack; outside and total air temperatures; and flap, leading edge slat, and ground spoiler positions in addition to the 18 parameters required by the FAA’s final rule. However, the FAA did not require these additional parameters.

Factual Information 219 Aircraft Accident Report manufactured after August 18, 2000, to provide commonality with airplanes manufactured after August 19, 2002. In addition, FDR manufacturers were already delivering FDRs that record at the higher data frame rate. Therefore, the Safety Board urged the FAA to change the 88-parameter compliance date for newly manufactured airplanes from August 19, 2002, to August 18, 2000. In addition, the Safety Board was disappointed that the FAA, with the issuance of its final rule, considered its action on these safety recommendations to be completed. The Safety Board believed that the FAA did not make every effort to ensure that the maximum number of parameters would be recorded within an achievable time period. Because all of the recommended retrofit parameters and the recommended compliance dates were not included in the FAA’s final rule, Safety Recommendations A-95-26 and -27 were classified "Closed—Unacceptable Action." 1.18.11.5 October 1996 Recommendations Issued as a Result of United Flight 585, USAir Flight 427, and Eastwind Flight 517 (Safety Recommendations A-96-107 Through -120) After the accident involving United Airlines flight 585, the Safety Board was informed of numerous uncommanded roll and yaw events involving the 737 series. Most of these incidents did not result in any damage to the airplane or injuries to those on board. As a result of these occurrences, the accident involving USAir flight 427, and the incident involving Eastwind flight 517, the Safety Board issued Safety Recommendations A-96-107 through -120 on October 18, 1996. Safety Recommendation A-96-107 asked the FAA to Require the Boeing Commercial Airplane Group, working with other interested parties, to develop immediate operational measures and long- term design changes for the 737 series airplane to preclude the potential for loss of control from an inadvertent rudder hardover. Once the operational measures and design changes have been developed, issue airworthiness directives to implement these actions. On January 16, 1997, the FAA stated that it intended to take final action on several proposed ADs, some of which would require the retrofit of four newly developed or redesigned components into the rudder system of existing 737 airplanes. The FAA further stated that the safety issues addressed in this recommendation would be resolved during the type certification of the new main rudder PCU servo valve and that it would propose a 2-year compliance timeframe for the retrofit of the servo valve. On July 15, 1997, the Safety Board noted that the FAA’s proposed design changes did not address (1) the development of operational measures and design changes to preclude the loss of control from an inadvertent rudder hardover, (2) the need to establish appropriate inspection intervals and a service life limit for the 737 main rudder PCU (addressed in Safety Recommendation A-96-112), or (3) a method to detect a jammed PCU servo valve slide (addressed in Safety Recommendation A-96-113). The Safety Board believed that operational measures, periodic inspections, and the detection and

Factual Information 220 Aircraft Accident Report annunciation of a jammed slide to the flight crew were needed to ensure flight safety. Because the proposed design did not address reliability or latent failure issues, Safety Recommendation A-96-107 was classified “Open—Unacceptable Response.” On May 13, 1998, the FAA stated that, along with Boeing, it had taken several measures to address the intent of this safety recommendation. These actions included the development and certification of modifications to the 737 main rudder PCU servo valve to prevent the potential for reverse rudder operation. The FAA cited its issuance of the following three ADs: • AD 96-26-07 was issued on December 23, 1996, and became effective on January 17, 1997. The AD required revising the AFM for all 737 series airplanes within 30 days to include procedures that would enable the flight crew to take “appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition” and “correct a jammed or restricted flight control condition.” The FAA stated that the AD had been prompted because such procedures were not defined adequately in the existing 737 AFM. The AD established a “recall” procedure to be performed by flight crews immediately, from memory, in the event of an uncommanded yaw or roll and required that the AFM section concerning procedures for jammed flight controls be modified. The FAA specified that air carriers could comply with the AD by inserting a copy of it in the AFM. No flight crew training requirements were established by the FAA for the procedures that had been introduced or changed by the AD. • AD 97-14-03 was issued on June 23, 1997, and became effective on August 1,

1. The AD mandated design changes to all 737 airplanes by August 1,
2. The AD required the installation of (1) a hydraulic pressure reducer to

limit the amount of rudder available to the flight crew during certain portions of flight and (2) a redesigned yaw damper system to improve reliability and fault monitoring capability. • AD 97-14-04, which superceded ADs-94-01-07 and 96-23-51, was also issued on June 23, 1997, and became effective on August 4, 1997. The AD mandated design changes to the main rudder PCU and servo valve on all 737 airplanes, within 2 years, to “prevent uncommanded movements of the rudder, and consequent reduced controllability of the airplane.” In addition, this AD mandated a periodic inspection to test the main rudder PCU for internal leakage and ensure that it is producing an acceptable hinge moment. According to the FAA, the internal leakage test will detect certain servo valve slide jams and provide greater safety margins than a hard-time replacement of the main rudder PCU because the test will ensure that the PCU is functioning within acceptable limits at more frequent intervals than a hard-time interval. The FAA also said that any design change to monitor the servo valve slides would increase the complexity of the servo valve and most likely increase the probability of jamming of a slide.

Factual Information 221 Aircraft Accident Report The FAA also stated in its May 13, 1998, letter that the Safety Board had expressed concern that, although the redesigned servo valve eliminated all known rudder reversal modes, unknown failures might still exist in the system. The FAA concluded that no evidence, either from in-service experience or testing, indicated that a rudder reversal event had actually occurred. The FAA noted that the main rudder PCU had been tested to evaluate chip shear capacity, fluid contamination, thermal jam conditions, input linkage jams, and linkage compliance. According to the FAA, all of these tests failed to create a sustained servo valve jam or any other reasonable failure that could cause erroneous rudder movement. In addition, the FAA’s letter included the Safety Board’s position that the detection and indication of a slide jam were necessary because, if a single slide jam was not recognized by the flight crew or mechanics, a second slide jam would cause an accident in some airplane configurations and flight conditions. The Board considered this event to be a catastrophic failure condition. However, the FAA stated that its regulations and policy define a catastrophic failure condition as one that will always result in an accident. According to the FAA, a dual slide jam in the rudder PCU will not always result in an accident and thus should not be considered a catastrophic condition. The FAA also stated that an airplane with a dual slide jam in the rudder PCU would be fully controllable in that configuration throughout much of its flight envelope. Furthermore, the FAA believed that, on the basis of 737 service history and number of hours of operation, a dual slide servo valve jam would be extremely improbable. On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-96-107 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-96-107 remained classified “Open—Unacceptable Response.” The Safety Board’s evaluation of Safety Recommendation A-96-107 and the recommendation’s current classification are discussed in section 2.6. Safety Recommendation A-96-108 asked the FAA to Revise 14 CFR Section 25.671 to account for the failure or jamming of any flight control surface at its design-limited deflection. Following this revision, reevaluate all transport-category aircraft and ensure compliance with the revised criteria. On January 16, 1997, the FAA stated that its aircraft certification offices were reviewing data from airplane manufacturers to determine which airplanes certified under 14 CFR Part 25 utilize PCU servo valves that could encounter valve jamming problems resulting from unexpected improper positioning of the servo slides. The FAA stated that it would take appropriate action based on the results of the review. On July 15, 1997, the Safety Board responded that, because the FAA had not specified its planned actions, Safety Recommendation A-96-108 was classified “Open—Await Response.” On May 13, 1998, the FAA indicated that it decided not to revise 14 CFR Section 25.671. The FAA did not concur with the Safety Board's position that it is necessary to

Factual Information 222 Aircraft Accident Report account for a jam in any flight control surface at its design-limited deflection. According to the FAA, a control surface jam at its design-limited deflection during flight would require an active system failure to cause the control surface to move to the extreme position and remain there. The FAA indicated that the last sentence of 14 CFR Section 25.671(c)(3) required that such a jam be accounted for unless such a jam can be shown to be extremely improbable. The FAA stated that an applicant can show compliance with the regulation by demonstrating, based on a probability analysis, that the runaway and jam condition is an extremely improbable event or that the condition can be alleviated. Because a jam condition is more likely to occur in a control position normally encountered, the FAA’s policy requires the applicant to demonstrate controllability for this condition. On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-96-108 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-96-108 remained classified “Open—Await Response.” The Safety Board’s evaluation of Safety Recommendation A-96-108 and the recommendation’s current classification are discussed in section 2.6. Safety Recommendation A-96-109 asked the FAA to Require the Boeing Commercial Airplane Group to develop and install on all new-production 737 airplanes a cockpit indicator system that indicates rudder surface position and movement. For existing 737 airplanes, when implementing the installation of an enhanced-parameter flight data recorder, require the installation of a cockpit indicator system that indicates rudder surface position and movement. On January 16, 1997, the FAA stated that an additional indicator in the cockpit would add no practical information to the pilot because all rudder movements on the 737, except those caused by the yaw damper, are directly apparent to the flight crew through the movement of the rudder pedals. The FAA further stated that a rudder position indicator will have very little value during the immediacy of a roll/yaw departure from controlled flight because such an event would require prompt and aggressive pilot response depending on the attitude, rate, and acceleration experienced. On July 15, 1997, the Safety Board responded that it agreed with the FAA’s assertion that a rudder position indicator would be of little value in the initial moments of an upset during which immediate pilot reaction may be needed to prevent a loss of control. However, the Safety Board disagreed with the FAA’s position that a rudder position indicator would provide no practical information to the pilot. The Safety Board's investigation of numerous yaw/roll upset events found that pilots, when trying to troubleshoot the problem, are often uncertain about the position of the rudder in the moments after regaining control. The Safety Board noted that recent testing had indicated the possibility for reverse rudder operation and that the installation of a rudder position indicator would provide a means for the pilot to understand that a rudder reversal had occurred. The Safety Board also noted that essentially all new-production 737s and other

Factual Information 223 Aircraft Accident Report transport-category airplanes are equipped with rudder position indicators. As a result, Safety Recommendation A-96-109 was classified “Open—Unacceptable Response.” On May 13, 1998, the FAA reiterated its position that it is not necessary to require the installation of a rudder indicator system in 737 airplanes. The FAA repeated that any rudder movement outside the small movement of the yaw damper system will back-drive the rudder pedals and be noted by the pilots if their feet are on the pedals. Further, the FAA believed that ADs 96-26-07, 97-14-03, and 97-14-04 preclude a rudder jam/reversal scenario and support the conclusion that a rudder surface position indicator should not be mandated. On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-96-109 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-96-109 remained classified “Open—Unacceptable Response.” The Safety Board’s evaluation of Safety Recommendation A-96-109 and the recommendation’s current classification are discussed in section 2.6. Safety Recommendation A-96-110 asked the FAA to Conduct a detailed engineering review of the 737 yaw damper system, and require the Boeing Commercial Airplane Group to redesign the yaw damper system, as necessary, to eliminate the potential for sustained uncommanded yaw damper control events. After the 737 yaw damper system is redesigned, issue an airworthiness directive to require the installation of the improved yaw damper system on all 737 series airplanes. On June 23, 1997, the FAA issued AD 97-14-03. In its May 13, 1998, letter, the FAA explained that Boeing was developing design changes to the rudder limiter and yaw damper system to comply with the requirements of the AD. The FAA indicated that the Manager of the Seattle Aircraft Certification Office was expected to approve the design changes by July 31, 1998. On February 2, 1999, the Safety Board stated that, pending the FAA’s certification of the proposed new yaw damper system, Safety Recommendation 96-110 was classified “Open—Acceptable Response.” Safety Recommendation A-96-111 asked the FAA to Require the Boeing Commercial Airplane Group and the operating airlines to eliminate the procedure for removal and replacement of the main rudder power control unit rudder position transducer from their respective 737 maintenance manuals unless the manual provides for testing to verify that the replacement transducer performs its intended function. According to the FAA’s August 7, 1997, letter, Boeing issued a revision to its 737 MM on November 27, 1996, to eliminate the removal and installation sections for the main rudder PCU rudder position transducer. This revision was applicable to 737-100 through -500 series airplanes. On November 4, 1997, the Safety Board stated that, because this revision met the intent of Safety Recommendation A-96-111, it was classified “Closed—Acceptable Action.”

Factual Information 224 Aircraft Accident Report Safety Recommendation A-96-112 asked the FAA to Require the Boeing Commercial Airplane Group to establish appropriate inspection intervals and a service life limit for the 737 main rudder power control unit. On January 16, 1997, the FAA stated that it intended to take final action on several proposed ADs, some of which would require the retrofit of four newly developed or redesigned components into the rudder system of existing 737 airplanes. The FAA stated that the safety issues addressed in this recommendation would be resolved during the type certification of the new main rudder PCU servo valve and that it would propose a 2-year compliance timeframe for the retrofit of the servo valve. On July 15, 1997, the Safety Board noted that the FAA’s proposed design changes did not address (1) the development of operational measures and design changes to preclude the loss of control from an inadvertent rudder hardover (addressed in Safety Recommendation A-96-107), (2) the need to establish appropriate inspection intervals and a service life limit for the 737 main rudder PCU, or (3) a method to detect a jammed PCU servo valve slide (addressed in Safety Recommendation A-96-113). The Safety Board believed that operational measures, periodic inspections, and the detection and annunciation of a jammed slide to the flight crew were needed to ensure flight safety. Because the proposed design did not address reliability or latent failure issues, Safety Recommendation A-96-112 was classified “Open—Unacceptable Response.” On May 13, 1998, the FAA stated that, along with Boeing, it had taken several measures to address the intent of this safety recommendation. These actions included the development and certification of modifications to the 737 main rudder PCU servo valve to prevent the potential for reverse rudder operation. Also, the FAA issued ADs 96-26-07, 97-14-03, and 97-14-04. In addition, the FAA’s letter noted the Safety Board’s concerns that unknown failures might still exist in the redesigned servo valve and that, if a single slide jam was not recognized by the flight crew or mechanics, a second slide jam would cause an accident in some airplane configurations and flight conditions. The FAA’s response included its position on what constitutes a catastrophic failure condition and whether a dual slide jam would be considered a catastrophic condition. On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-96-112 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-96-112 remained classified “Open—Unacceptable Response.” The Safety Board’s evaluation of Safety Recommendation A-96-112 and the recommendation’s current classification are discussed in section 2.6. Safety Recommendation A-96-113 asked the FAA to Require the Boeing Commercial Airplane Group to devise a method to detect a primary or a secondary jammed slide in the 737 main rudder power control unit servo valve and ensure appropriate communication of the information to mechanics and pilots.

Factual Information 225 Aircraft Accident Report On January 16, 1997, the FAA stated that it intended to take final action on several proposed ADs, some of which would require the retrofit of four newly developed or redesigned components into the rudder system of existing 737 airplanes. The FAA stated that the safety issues addressed in this recommendation would be resolved during the type certification of the new main rudder PCU servo valve and that it would propose a 2-year compliance timeframe for the retrofit of the servo valve. On July 15, 1997, the Safety Board noted that the FAA’s proposed design changes did not address (1) the development of operational measures and design changes to preclude the loss of control from an inadvertent rudder hardover (addressed in Safety Recommendation A-96-107), (2) the need to establish appropriate inspection intervals and a service life limit for the 737 main rudder PCU (addressed in Safety Recommendation A-96-112), or (3) a method to detect a jammed PCU servo valve slide. The Safety Board believed that operational measures, periodic inspections, and the detection and annunciation of a jammed slide to the flight crew were needed to ensure flight safety. Because the proposed design did not address reliability or latent failure issues, Safety Recommendation A-96-113 was classified “Open—Unacceptable Response.” On May 13, 1998, the FAA stated that, along with Boeing, it had taken several measures to address the intent of this safety recommendation. These actions included the development and certification of modifications to the 737 main rudder PCU servo valve to prevent the potential for reverse rudder operation. Also, the FAA issued ADs 96-26-07, 97-14-03, and 97-14-04. In addition, the FAA’s letter noted the Safety Board’s concerns that unknown failures might still exist in the redesigned servo valve and that, if a single slide jam was not recognized by the flight crew or mechanics, a second slide jam would cause an accident in some airplane configurations and flight conditions. The FAA’s response included its position on what constitutes a catastrophic failure condition and whether a dual slide jam would be considered a catastrophic condition. (For further information on the FAA’s response, see A-96-107.) On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-96-113 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-96-113 remained classified “Open—Unacceptable Response.” The Safety Board’s evaluation of Safety Recommendation A-96-113 and the recommendation’s current classification are discussed in section 2.6. Safety Recommendation A-96-114 asked the FAA to Evaluate the adequacy of the chip shearing capacity for all sliding spool control valves used in transport-category aircraft flight control systems, and take appropriate action to correct any problems identified to preclude the potential for actuator jamming, binding, or failure. On June 29, 1998, the FAA stated that its aircraft certification offices have evaluated the adequacy of the chip shearing capacity of sliding spool control valves for

Factual Information 226 Aircraft Accident Report certain airplanes. The criteria used in this evaluation were recommended by the SAE A-6 Committee and incorporated information from an August 12, 1997, letter by Boeing. The FAA concluded that all sliding spool control valves used in the following transport-category airplanes’ flight control systems met the evaluation criteria: • Boeing 707 (except the rudder system), 727, 737, 747, 757, 767, and 777; • McDonnell Douglas DC-9, DC-10, MD-11, MD-80, and MD-90; • Lockheed L-1011 and L-382 • Gulfstream V; • Saab 340 and 2000; • Dornier DO-328; • Fokker F.28 (all models); • Embraer EMB-120 and EMB-145; and • Cessna, Learjet, Raytheon, and Sabreliner (applicable models). The FAA planned no further action for these airplanes. However, the FAA was waiting for data from European and Canadian manufacturers, additional data for the 707 rudder system, and data for the Douglas DC-8 airplanes. These data were expected to be received by July 1998. On February 2, 1999, the Safety Board indicated that it would like to review the FAA’s evaluation criteria for determining the adequacy of the chip shearing capacity of sliding spool control valves. Pending the Board’s review of the criteria and the FAA’s completion of the evaluation project, Safety Recommendation A-96-114 was classified “Open—Acceptable Response.” Safety Recommendation A-96-115 asked the FAA to Require the modification of the input rod bearing on the 737 series standby rudder actuator, by August 1, 1997, to prevent galling and possible discrepant operation of the rudder system. The FAA issued AD 97-26-01, which became effective January 20, 1998, to require repetitive inspections to detect galling on the input shaft and bearing of the standby rudder PCU and replacement of the standby rudder actuator with a serviceable actuator, if necessary. The AD also required the installation of a newly designed standby PCU input shaft bearing within 3 years of the effective date of the AD. On February 2, 1999, the Safety Board stated that, because the FAA’s action complied with the intent of Safety Recommendation A-96-115, it was classified “Closed—Acceptable Action.”

Factual Information 227 Aircraft Accident Report Safety Recommendation A-96-116 asked the FAA to Define and implement standards for in-service hydraulic fluid cleanliness requirements and sampling intervals for all transport-category aircraft. On June 29, 1998, the FAA stated that it had reviewed a study by the SAE A-6 Committee Hydraulic Fluid Contamination Task Force. On the basis of the study’s findings, the FAA identified NAS 1638 as an industry standard that defines fluid cleanliness levels; defined NAS 1638 Class 9 as the in-service limit; and verified that manufacturers already included or are in the process of including this limit in their maintenance manuals, along with a sampling interval. The FAA added that it was participating in the development of an Aerospace Recommended Practice document for sampling and testing techniques. On February 2, 1999, the Safety Board stated that, because the FAA’s actions met the intent of Safety Recommendation A-96-116, it was classified “Closed—Acceptable Action.” Safety Recommendation A-96-117 asked the FAA to Conduct a detailed design review of all dual-concentric servo valves that control essential flight control system actuators on transport-category airplanes certificated by the Federal Aviation Administration to determine if the design is susceptible to inducing flight control malfunctions and/or reversals as a result of unexpected improper positioning of the servo slides. If the design is determined to be susceptible, mandate appropriate design changes. In a July 15, 1997, letter to the FAA, the Safety Board stated that recent tests had found that the 737 main rudder PCU could possibly cause reverse rudder operation if the servo valve secondary slide were to jam. This finding had not been indicated by numerous prior tests and research and was unknown at the time that the Board issued this safety recommendation. Thus, the Board believed that extra efforts needed to be taken to determine if any other dual-concentric servo valves are susceptible to flight control malfunctions as a result of unexpected improper positioning of the servo slides. On May 13, 1998, the FAA stated that its detailed design review of dual-concentric servo valves would address this recommendation. Also on May 13, 1998, and again on June 29, 1998, the FAA stated that its aircraft certification offices reviewed the data from airplane manufacturers under their geographic purview and determined that 12 dual-concentric servo valves, used on various transport-category airplane flight control systems, needed a detailed design review. Ten of these valves are used on Boeing 707, 727, 737, and 747 series airplanes; one is used on McDonnell Douglas DC-10 and MD-11 series airplanes; and one is used on the Lockheed L-1011 series airplane. The FAA further stated that the valve jam conditions, including those involving the secondary slide, and evaluation criteria had been identified. Also on June 29, 1998, the FAA stated that it had reviewed additional study results submitted by Boeing, its Douglas Products Division, and Lockheed Martin; however, Boeing was still reviewing the 707 rudder PCU. The FAA indicated that it would review

Factual Information 228 Aircraft Accident Report the results of the 707 rudder PCU evaluation as soon as it was completed. In addition, the FAA stated that it issued ADs for two servo valves and found nine servo valves to be acceptable. On February 2, 1999, the Safety Board noted that airplanes produced by Airbus were not mentioned as part of the FAA’s evaluation. Pending the Board’s review of the results of the FAA’s detailed design review, including a review of Airbus flight control systems, Safety Recommendation A-96-117 was classified “Open—Acceptable Response.” Safety Recommendation A-96-118 asked the FAA to Require the Boeing Commercial Airplane Group, working with other interested parties, to develop procedures that require 737 flight crews to disengage the yaw damper in the event of an uncommanded yaw upset as a memorized or learned action. Once the procedures are developed, require operators to implement these procedures. On January 16, 1997, the FAA stated that Boeing had taken appropriate action to address this issue. Specifically, Boeing revised its 737 Operations Manual and published an Operations Manual Bulletin to amend the “Uncommanded Yaw” procedure to “Uncommanded Yaw and Roll Procedure.” According to the FAA, the revised Operations Manual Bulletin addressed the three failure modes of the 737 yaw damper system and provided specific guidance to the flight crew on how to address each of the failure modes. The FAA stated that it planned no further action on this issue. On July 15, 1997, the Safety Board responded that the revision to Boeing’s Operations Manual does not advise flight crews to disengage the yaw damper as a memorized or learned item in the event of an uncommanded roll. Additionally, the Safety Board was aware that not all operators had adopted a procedure to disengage the yaw damper as a memorized or learned item. The Board requested that the FAA reconsider its position not to take further action on this issue. As a result, Safety Recommendation A-96-118 was classified “Open—Unacceptable Response.” On May 13, 1998, the FAA indicated that Boeing revised its 737 AFM to include procedures that enable the flight crew to take appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition and correct a jammed or restricted flight control condition. On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-96-118 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-96-118 remained classified “Open—Unacceptable Response.” The Safety Board’s evaluation of Safety Recommendation A-96-118 and the recommendation’s current classification are discussed in section 2.7.2.

Factual Information 229 Aircraft Accident Report Safety Recommendation A-96-119 asked the FAA to Require the Boeing Commercial Airplane Group to develop operational procedures for 737 flight crews that effectively deal with a sudden uncommanded movement of the rudder to the limit of its travel for any given flight condition in the airplane's operational envelope. Once the operational procedures have been developed, require 737 operators to provide this training to their pilots. On January 16, 1997, the FAA stated that it directed the Seattle Aircraft Evaluation Group, along with Boeing and the Seattle Aircraft Certification Office, to develop a pilot operating procedure for recovery techniques of sudden uncommanded movement of the rudder to its maximum limit. This new procedure would be incorporated into the 737 AFM. The FAA also stated that, once the procedure is developed and the AFM is revised, it would issue a FSIB directing POIs, whose carriers operate 737 airplanes, to inform pilots of the new procedure and ensure that they are trained during their next scheduled recurrent training. On July 15, 1997, the Safety Board responded that the potential for a rudder movement opposite from that commanded by pilot input on the rudder pedals was not included as part of this recommendation. Because Safety Recommendation A-97-18, which had been issued on February 20, 1997, superceded the earlier recommendation by addressing this rudder movement situation, Safety Recommendation A-96-119 was classified “Closed—Acceptable Action.” Safety Recommendation A-96-120 asked the FAA to Require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems, and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements. This recommendation expanded on the intent of Safety Recommendation A-96-66, which was issued on August 15, 1996, as a result of the Safety Board’s investigation into the accident involving American Eagle flight 4184, an ATR-72, near Roselawn, Indiana, on October 31, 1994.301 The airplane, which was operated by Simmons Airlines, had been in a holding pattern and was descending to a newly assigned altitude of 8,000 feet when the initial uncommanded roll excursion occurred. The airplane entered a rapid descent and crashed. All 68 people on board were killed, and the airplane was destroyed by impact forces. Safety Recommendation A-96-66 asked the FAA to amend the FARs to require operators to provide standardized training that adequately addresses the recovery from unusual events, including extreme flight attitudes in large transport-category airplanes. 301 See National Transportation Safety Board. 1996. In-Flight Icing Encounter and Loss of Control, Simmons Airlines, d.b.a. American Eagle Flight 4184, Avions de Transport Regional (ATR) Model 72-212, N401AM, Roselawn, Indiana, October 31, 1994. Aircraft Accident Report NTSB/AAR-96/01. Washington, DC.

Factual Information 230 Aircraft Accident Report In issuing Safety Recommendation A-96-120, the Safety Board recognized that pilots receive unusual attitude training when obtaining their private pilot and commercial pilot certificates as well as their instrument ratings. However, the Safety Board believed that the ability of pilots to recognize and recover from an unusual attitude could be severely diminished without additional or recurrent unusual attitude training. Therefore, Safety Recommendation A-96-66 was classified “Closed—No Longer Applicable/ Superceded.” On January 16, 1997, the FAA responded to Safety Recommendation A-96-120. The FAA stated that it was considering an NPRM proposing to require that air carriers conduct training that will emphasize recognition, prevention, and recovery from aircraft attitudes that are not normally associated with air carrier flight operations. On July 15, 1997, the Safety Board responded that it was not aware of any training in which the unusual attitude was the result of a control system failure or in which some flight controls would not be available for, or would be counterproductive to, the recovery. The Safety Board encouraged the FAA to address the full intent of this recommendation. Pending the Board’s review of the FAA’s final action, Safety Recommendation A-96-120 was classified “Open—Acceptable Response.” The Safety Board’s review and evaluation of the FAA’s actions in response to Safety Recommendation A-96-120 and the recommendation’s current classification are discussed in section 2.7.1. 1.18.11.6 February 1997 Recommendations Issued as a Result of United Flight 585, USAir Flight 427, and Eastwind Flight 517 (Safety Recommendations A-97-16 Through -18) As a result of the numerous occurrences of uncommanded roll and yaw events involving 737 series airplanes, the accidents involving United flight 585 and USAir flight 427, and the incident involving Eastwind flight 517, the Safety Board issued Safety Recommendations A-97-16 through -18 on February 20, 1997. Safety Recommendation A-97-16 asked the FAA to Require the expeditious installation of a redesigned main rudder power control unit on Boeing 737 series airplanes to preclude reverse operation of the rudder and ensure that the airplanes comply with the intent of the certification requirements. On June 23, 1997, the FAA issued AD 97-14-04, which requires, by August 1999, the installation of a newly redesigned main rudder PCU on all 737 series airplanes. Boeing indicated that the new PCU would preclude the rudder reversal scenarios that have been previously identified or hypothesized. On February 2, 1999, the Safety Board indicated that, because the FAA’s action complied with the intent of Safety Recommendation A-97-16, it was classified “Closed—Acceptable Action.”

Factual Information 231 Aircraft Accident Report Safety Recommendation A-97-17 asked the FAA to Advise 737 pilots of the potential hazard for a jammed secondary servo control valve slide in the main rudder power control unit to cause a reverse rudder response when a full or high-rate input is applied to the rudder pedals. On April 18, 1997, the FAA stated that AD 96-26-07, which was issued on December 23, 1996, and became effective on January 17, 1997, required Boeing to revise its AFM to include procedures that would enable a flight crew to take appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition and correct a jammed or restricted flight control condition. The FAA also stated that it was developing an FSIB to meet the intent of this recommendation. On January 29, 1998, the FAA issued FSIB 98-03, “Recognition of and Recovery From Unusual Attitudes and Upsets Caused by Reverse Rudder Response Involving Boeing 737s.” The FSIB directs, among other things, that POIs advise their air carriers to inform pilots of (1) the potential for a jammed servo valve secondary slide in the main rudder PCU when a full or high-rate input is applied to the rudder and (2) the procedures training necessary to cope with the hazards. On February 2, 1999, the Safety Board expressed concern about the amount of time that elapsed before the FAA issued FSIB 98-03; the FAA had anticipated issuing the bulletin in July 1997. Nonetheless, because the bulletin met the intent of Safety Recommendation A-97-17, it was classified “Closed—Acceptable Action.” Safety Recommendation A-97-18 asked the FAA to Require the Boeing Commercial Airplane Group to develop operational procedures for 737 flight crews that effectively deal with a sudden uncommanded movement of the rudder to the limit of its travel for any given flight condition in the airplane's operational envelope, including specific initial and periodic training in the recognition of and recovery from unusual attitudes and upsets caused by reverse rudder response. Once the procedures are developed, require 737 operators to provide this training to their pilots. On April 18, 1997, the FAA stated that AD 96-26-07, which was issued on December 23, 1996, and became effective on January 17, 1997, required Boeing to revise its AFM to include procedures that would enable a flight crew to take appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition and correct a jammed or restricted flight control condition. The FAA also stated that it was developing an FSIB to meet the intent of this recommendation. On July 15, 1997, the Safety Board stated that issuance of AD 96-26-07 partly responded to the intent of this recommendation but neglected a critical portion of the recommendation. Specifically, AD 96-26-07 did not address specific initial and periodic training in the recognition of and recovery from unusual attitudes and upsets caused by reverse rudder response or require 737 operators to provide this training to their pilots.

Factual Information 232 Aircraft Accident Report The Safety Board continued to believe that pilots must receive specific initial and periodic training if they are expected to recover the airplane if a reverse rudder response results in an unusual attitude. Therefore, pending further correspondence, Safety Recommendation was classified “Open—Unacceptable Response.” On January 29, 1998, the FAA issued FSIB 98-03, “Recognition of and Recovery From Unusual Attitudes and Upsets Caused by Reverse Rudder Response Involving Boeing 737s.” The FSIB directs, among other things, that FAA inspectors require 737 operators to amend their training programs to provide initial and recurrent training in the recognition of and recovery from unusual attitudes and upsets caused by reverse rudder response. On February 2, 1999, the Safety Board stated that it would further analyze and discuss Safety Recommendation A-97-18 in the USAir flight 427 accident report. The Board indicated that, pending the analysis and discussion, Safety Recommendation A-97-18 remained classified “Open—Unacceptable Response.” The Safety Board’s evaluation of Safety Recommendation A-97-18 and the recommendation’s current classification are discussed in section 2.7.2. 1.18.12 Party Submissions The Safety Board received party submissions that discussed possible scenarios and/or causes for the USAir flight 427 accident from the FAA, Boeing, Parker Hannifin, USAir, and ALPA. FAA Submission The FAA’s September 1997 submission stated: While the investigation has produced evidence which support the scenarios where the rudder moved to a full-left position after an encounter with wake turbulence, the cause of the movement is still at issue. The FAA upon review of the evidence, cannot conclude that a failure mode which resulted in an uncommanded rudder movement on Flight 427 has been identified. Any causal findings, to be legitimate, must have conclusive evidence to support findings of a hard over or reversal rudder. Such evidence has yet to be found. Consequently, a specific causal finding of this nature may not be appropriate. The rudder system abnormalities that have been discovered during this investigation have not been shown to have occurred on USAir flight 427. There is no evidence of any of these abnormalities being present during the accident sequence. While the FAA acknowledges the fact that some failure modes of the main rudder power control unit servo valve have been discovered during this accident investigation, it has not been substantiated that any of these failures occurred on the accident aircraft. The FAA also acknowledges that a secondary slide jam to the housing of the servo valve or interference with the rudder input link could provide both full rudder rate and full hinge moment. However, once again there is no direct evidence that this occurred.

Factual Information 233 Aircraft Accident Report The Boeing Aircraft Company and the FAA have reacted to the discovered failure modes with modifications of the rudder system, including some recommended by the National Transportation Safety Board that are designed to prevent future events of this type. However, the FAA does not believe sufficient evidence exists to establish a rudder system failure as the cause of the accident. Boeing Submissions During the investigation of the USAir flight 427 accident, Boeing provided the Safety Board with a formal submission and a human factors supplement (dated September 30, 1997), a supplemental submission (dated August 14, 1998), and numerous letters containing what might be considered submittal information. Portions of these submittals relating to Boeing’s proposed accident scenarios for the United flight 585 accident and the Eastwind flight 517 incident and Boeing’s kinematic and simulation studies are discussed in sections 1.16.1 and 1.16.6, respectively. Boeing’s September 30, 1997, submission concluded that the flight crew was startled by the severity of an unexpected wake encounter, a full rudder deflection occurred, the pilots applied aft pressure on the control column, and the airplane subsequently entered a stall and remained stalled for approximately 14 seconds as it descended to the ground. However, the submission stated that the events that led to the full rudder deflection were not clear. Boeing’s September 1997 submission stated, “there is no certain proof of airplane-caused full rudder deflection during the accident sequence. The previously unknown failure conditions that have been discovered in the 737 rudder PCU have been shown to not be applicable to Flight 427 or any other conditions experienced in commercial service.” Boeing’s September 1997 submission stated the following probable cause of the USAir flight 427 accident: …there is no evidence to support a conclusion that an uncommanded full rudder deflection occurred. While there is not conclusive evidence of a crew-commanded, sustained left-rudder input such a possibility is plausible and must be seriously considered, especially given the lack of evidence of an airplane-induced rudder deflection.” Boeing’s September 1997 submission also stated the investigation and the 737 design review identified “areas where the 737 rudder system could be improved. In addition, extremely unlikely failure modes were identified that could hypothetically result in unwanted rudder deflections.” The submission stated that, in accordance with the FAA’s ADs 97-14-03 and 97-14-04, Boeing pursued several rudder system design changes, including redesigns of the main rudder PCU servo valve and the yaw damper system, new PCU input rod fasteners, and the design and installation of a hydraulic pressure reducer. Boeing’s September 1997 submission further stated that the most significant findings from the investigation included the following:

Factual Information 234 Aircraft Accident Report • Commercial transport flight crews need to be specifically trained to handle large upsets. Transport pilot training widely used in the 1994 time frame did not prepare flight crews for recovery from the highly unusual roll rates and roll and pitch attitudes encountered by the crew of Flight 427. • 737 yaw damper reliability enhancements are needed to reduce potential airplane contribution to upsets. • Highly unlikely potential 737 failure modes can be eliminated: • Potential 737 rudder PCU failure modes. • Potential 737 rudder PCU input rod fastener failure mode. • We can reduce the impact of either airplane-related or crew-input-related rudder upsets by limiting 737 rudder control authority. • Research is needed on better ways to detect and avoid wake vortices. • Existing 737 flight control anomaly procedures could be improved. • The flight data recorder information from this accident was inadequate to prove definitive events. Additionally, Boeing’s submission recommended that “the appropriate organizations within the industry take steps to improve industry understanding of possible flight crew responses to wake vortex encounters and other upset events. Boeing believes that such an effort would be valuable to training organizations worldwide.” In its August 14, 1998, supplemental submission, Boeing stated the following regarding its analysis of the Eastwind flight 517 event: • Multiple scenarios have been identified that match at least some of the data and crew reports from the Eastwind 517 event. None of the scenarios fully match all the data, kinematic analysis, and crew reports. • Boeing believes that under the NTSB’s standard for identifying “probable cause,” there is insufficient data to find a “probable cause” for this event. • All parties generally agree that the initiation of the Eastwind event included some form of activity from the yaw damper system. • The most likely explanation for the Eastwind event involves a preexisting yaw damper fault that subsequently cleared itself. • There is no data to indicate that the Eastwind Flight 517 event, the United Flight 585 accident, and USAir Flight 427 accident were caused by a common airplane malfunction. Parker Hannifin Submission Parker Hannifin’s September 1997 submission stated that the postaccident examination of the USAir flight 427 PCU revealed no physical evidence of a jam or other anomaly. Further, the submission stated that “the conclusion reached by Boeing was that

Factual Information 235 Aircraft Accident Report the accident PCU would not seize if subject to thermal shocks or temperature differential consistent with those which could be encountered in realistic flight conditions.” Parker’s submission concluded A significant indication of the reliability of the main rudder PCU from Flight 427 is a comparison of the performance of the unit at the time of its original manufacture in 1987 as measured by the acceptance test, its performance at the time of its testing during removal from service in September 1992, its performance when tested immediately following the accident the September 1994, and finally, its performance when tested in August 1997 after having been subject to numerous tests and conditions outside the normal flight environment of the unit. In each of these instances, the PCU consistently operated normally and within specifications. In sum, after years of one of the most critical examinations in aviation history, there is no evidence that the main rudder PCU from Flight 427 malfunctioned or was other than fully operational. USAir Submissions USAir provided the Safety Board with a submission (dated September 30, 1997) and a supplemental submission (dated August 12, 1998). In its September 30, 1997 submission, USAir stated that “data demonstrates, and all parties seem to agree, that USAir flight 427’s rudder moved to a full-left position shortly after the aircraft encountered wake vortices generated by a preceding aircraft. It is also clear that the wake vortex encounter did not directly cause the accident.” The USAir submission described the background and experience of the pilots and their actions during the emergency and concluded the following: [The pilots] did not apply full-left rudder during the wake vortex encounter, oppose it with opposite aileron and spoiler, and hold these cross-controlled positions for 23 seconds as the aircraft spiraled into the ground. The investigation did, however, reveal several anomalies in the Boeing 737 rudder control system that may have caused the aircraft’s rudder to fully deflect without crew input or to move opposite to the crew’s input. The USAir submission concluded that the probable cause of the accident was “an uncommanded, full rudder deflection or rudder reversal that placed the aircraft in a flight regime from which recovery was not possible using known recovery procedures. A contributing cause of this accident was the manufacturer’s failure to advise operators that there was a speed below which the aircraft’s lateral control authority was insufficient to counteract a full rudder deflection.” In its August 12, 1998, supplemental submission, USAir supported the results of the Safety Board’s simulation studies. USAir’s supplemental submission indicated that “a mechanical malfunction of USAir flight 427 rudder PCU resulted in a rudder reversal or uncommanded deflection that caused USAir flight 427 to depart controlled flight and crash.” USAir also restated its previous conclusions.

Factual Information 236 Aircraft Accident Report ALPA Submissions ALPA provided the Safety Board with a submission (dated September 1997) and a supplemental submission (dated August 7, 1998) in which it offered its conclusions and recommendations. ALPA’s September 1997 submission stated that …aircraft performance analysis revealed that the maneuver of USAir 427 is consistent with full nose left rudder travel…. There is no evidence to support the hypothesis that the flightcrew mishandled the flight control following the upset event, or that this control mishandling led to the accident. As for the B737 rudder control system however, during the course of this investigation a number of failure modes have been identified which could result in an uncommanded full rudder input. It was also discovered that at least one failure mode, secondary valve jam resulting in primary valve overtravel, would not leave witness marks. In addition, this failure mode resulted in rudder movement that matched the rudder time history, in both magnitude and input rate, determined from the aircraft performance studies necessary to match the maneuver. ALPA’s submission concluded that …the airplane experienced an uncommanded full rudder deflection. This deflection was a result of a main rudder power control unit (PCU) secondary valve jam which resulted in a primary valve overstroke. This secondary valve jam and primary valve overstroke caused USAir 427 to roll uncontrollably and dive into the ground. Once the full rudder hardover occurred, the flight crew was unable to counter the resulting roll with aileron because the B737 does not have sufficient lateral control authority to balance a full rudder input in certain areas of the flight envelope. Additionally, ALPA’s submission offered the following recommendations for the Safety Board’s consideration: • Boeing and Parker should work diligently to replace existing B737 rudder PCUs with improved units as quick as possible without sacrificing quality. • The FAA should eliminate the current practice of derivative certification. Newly developed aircraft should be carefully evaluated against FAR criteria in place at the time of aircraft development. • For aircraft which were certificated as “Derivative” models, the FAA should evaluate those aircraft against existing FAR requirements and those aircraft, to the extent feasible, should be modified in order to be in compliance with the current FAR regulations. • The FAA should require all FAA certified repair stations to meet all standards of the original equipment manufacturer.

Factual Information 237 Aircraft Accident Report • In order to increase B737 lateral control margin to an acceptable level, the FAA should mandate the development of additional operational techniques such as increasing B737 minimum maneuvering speed to Boeing recommended “Block” speed plus 10 knots. • The industry should continue with the development and implementation of “Advanced Maneuver” or “Selected Event” training and that the FAA should require the inclusion of this training in every airline’s training program. In the August 7, 1998, supplemental submission, ALPA noted that a comparison of Boeing’s kinematic analysis and the Safety Board’s computer simulation of the Eastwind flight 517 event indicated that …both scenarios match the same recorded [FDR] data, demonstrating that it is possible to match the maneuver with different scenarios by varying the assumption and interpretation of the course data. However, ALPA believes that the Board is more accurate in their scenario since the rate of the rudder input required to match the maneuver is the same rate which would result from a PCU secondary valve jam. NTSB staff, using [its] simulation, has also been able to match both the USAir [flight] 427, and [United flight] 585 accident upsets by assuming a PCU secondary valve jam. In all three cases the rudder input rate needed to match flight recorder data is consistent with the rudder rate which would result from a secondary valve jam. It is extremely unlikely that three different pilots in three different B737s, on three different days would use the same rudder rate. Yet if the secondary valve were jammed in each case, it would result in the same rudder input rate. The supplemental submission concluded that “ALPA believes more strongly than ever that the cause of the accident was a rudder anomaly.” 1.19 New Investigative Techniques The extent of the destruction involved the USAir flight 427 accident and the complexity, depth, and duration of the accident investigation resulted in the use of some new techniques and practices. After its initial examination of the accident site, the Safety Board (in cooperation with local public safety officials) determined that the accident site and the airplane wreckage and components were a potential biological hazard. As a result, the Board required the use of personal protective equipment (PPE) and the implementation of safety procedures, as outlined in the Occupational Safety and Health Administration (OSHA) regulations contained in 29 CFR Part 1910. During the on-scene investigation, the Safety Board (with assistance from other emergency response authorities) established formal procedures for the large-scale provision, use, and disposition of PPE;302 the distribution of Hepatitis B inoculations to all noninoculated 302 The OSHA procedures for this type of environment required all investigative and emergency response personnel to wear PPE when they accessed those areas of the accident site containing biological hazards and undergo decontamination procedures after departing the biohazard area.

Factual Information 238 Aircraft Accident Report on-scene investigative/emergency response personnel; and the decontamination of every recovered piece of airplane wreckage. The monitoring of and access control to the accident site was initially the responsibility of the Hopewell Township emergency response personnel, with support from neighboring jurisdictions, the Beaver County Sheriff’s Office, and the Pennsylvania State Police. A Unified Command Post (UCP) was subsequently established, and the responsibility for control and coordination of site access, PPE, decontamination, and other site logistics came under the purview of UCP authorities. The UCP included representatives from the Safety Board, the U.S. Air National Guard, the USAF Reserve, Pennsylvania Emergency Management Agency, Pennsylvania Department of Environmental Resources, Pennsylvania State Police, Beaver County Sheriff’s and Coroner’s Offices, and Hopewell Township Fire and Police Departments. Other groups involved in the UCP were the American Red Cross, the Salvation Army, and a University of Pittsburgh Critical Incident Stress Debriefing team. Because of the catastrophic destruction of the airplane and occupants, the Safety Board sought assistance from the AFIP in positively identifying the flight crews’ remains. AFIP personnel used deoxyribonucleic acid (DNA) protocols to identify and differentiate the muscle tissue samples obtained from the cockpit area of the wreckage. With the use of DNA protocols and reference specimens from the first officer’s family, AFIP personnel were able to positively identify one set of tissue samples as the first officer’s remains. The Safety Board was unable to obtain reference specimens from the captain’s family. However, the FBI identified footprints from tissue specimens recovered from the cockpit area, and these footprints matched those of the captain’s USAF footprint records.303 With the use of the footprints and DNA tests, the captain’s remains were positively identified. Because the accident airplane impacted the ground at a high airspeed, the Safety Board became concerned that important airplane components might have penetrated the ground and might not be easily located and recovered. To locate any components under the surface, the U.S. Bureau of Mines provided Safety Board investigators with a GPR system, metal detectors, and researchers to operate the equipment. A GPR search of the area was conducted after most of the airplane wreckage had been removed from the accident site to the hangar at PIT. The GPR equipment detected pieces of wreckage that had penetrated up to 6 feet deep in the soil; these wreckage components were subsequently recovered and moved to the hangar. This accident was the first time that a GPR system was used during a Safety Board investigation; the system was subsequently used during the Safety Board’s on-scene investigation of the aircraft accident involving ValuJet flight 592, which occurred in the Everglades, near Miami, Florida, on May 11, 1996.304 303 The USAF documented the captain’s footprints when he was involved in its pilot training program. 304 National Transportation Safety Board. 1997. In-Flight Fire and Impact with Terrain, ValuJet Airlines Flight 592, DC-9-32, N904VJ, Everglades, Near Miami, Florida, May 11, 1996. Aircraft Accident Report NTSB/AAR-97/06. Washington, DC.

Factual Information 239 Aircraft Accident Report Another practice that the Safety Board used for the first time during an investigation was the establishment of an independent technical advisory panel (see section 1.18.2) to review the work performed by the Safety Board’s investigative team and propose additional tests and scenarios for investigation. This collaborative effort helped the Safety Board test for and identify the main rudder PCU thermal jam rudder reversal scenario.

Analysis 240 Aircraft Accident Report 2. Analysis 2.1 General The USAir flight 427 flight crew was properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. The USAir flight 427 accident airplane was equipped, maintained, and operated in accordance with applicable Federal regulations. The airplane was dispatched in accordance with FAA- and industry-approved practices. On the basis of postaccident examination of the wreckage and identification of all fuselage doors, door frames, and locking mechanisms, the Safety Board concludes that all of USAir flight 427’s doors were closed and locked at impact. The catastrophic impact with terrain, postimpact fire, and subsequent destruction of the airplane precluded a complete inventory of the airplane’s structure and components. However, all recovered structural pieces were examined thoroughly by fire and explosion experts from the Safety Board, FAA, FBI, and the United Kingdom’s Air Accidents Investigation Branch. Additionally, the Safety Board examined the CVR and FDR information from the accident airplane and compared it with FDR information obtained from the investigation into the accident involving Pan Am flight 103 over Lockerbie, Scotland, and other known in-flight fire, bomb, and explosion events. These examinations revealed no evidence of an in-flight fire, bomb, or explosion. Also, more than 100 witnesses on the ground were interviewed, and all but 1 reported that the airplane appeared to be intact during the accident sequence. The Safety Board nonetheless conducted a series of postaccident ground and helicopter searches. Although the search did not reveal any significant airplane components located away from the main wreckage, light-weight pieces from the airplane (for example, insulation and paper) were located as far as 2.5 miles downwind from the accident site. On the basis of witness statements, physical evidence from the wreckage, and the prevailing winds at the time of the accident, the Safety Board considers it likely that those light-weight airplane pieces became airborne as a result of the postimpact explosion and fire and then drifted downwind from the accident site. The extremities of the airplane and all flight control surfaces were found at the main wreckage site. Further, no evidence indicated that material fatigue or corrosion contributed to the accident. On the basis of the findings discussed in the previous two paragraphs, the Safety Board concludes that USAir flight 427 did not experience an in-flight fire, bomb, explosion, or structural failure.

Analysis 241 Aircraft Accident Report A review of ATC procedures and radar information revealed that the air traffic controllers followed applicable air traffic and wake turbulence separation rules and that the required air traffic separation was maintained during flight 427’s approach to the Pittsburgh International Airport (PIT). The accident airplane and the Boeing 727 airplane that preceded it inbound to PIT (Delta flight 1083) were separated by at least 4.1 miles when they were at the same altitude The Safety Board considered the possibility that a midair collision with an airplane or birds was involved in the accident scenario. However, examination of the airplane wreckage; CVR, FDR, and radar data; and statements from ATC personnel and witnesses on the ground revealed no evidence that an impact with other air traffic or a bird strike were involved in the accident. The Safety Board also considered the possible role of weather in the accident. However, weather and FDR information and statements from witnesses on the ground and the pilots of other airplanes operating in the area indicated that, at the time of the accident flight’s upset/loss of control, the weather in the Pittsburgh area was clear with light winds. No evidence indicated that clear air turbulence or other atmospheric phenomena were involved in the accident. Accordingly, the Safety Board concludes that a midair collision with other air traffic, a bird strike, clear air turbulence, or other atmospheric phenomena were not involved in the USAir flight 427 accident. 2.2 USAir Flight 427 Upset The accident flight was apparently routine until it neared PIT. FDR data indicated that, about 1902:54, the accident airplane was rolling out of a left bank to its assigned heading of 100°, after which it began to yaw and roll; about 1902:59, the airplane’s heading moved left past 100° at an increasing rate. By 1903:01, the airplane’s heading was moving left at a rate of at least 5° per second; the airplane’s heading continued to move left at least at this rate until the stickshaker activated about 1903:08. The airplane’s left roll angle was also increasing rapidly during this time; about 1903:01 the airplane’s left roll angle was about 28°, and 5 seconds later (at 1903:06) the airplane’s left roll angle exceeded 70°. The Safety Board therefore considered various scenarios that could have resulted in such a heading change, including the following: (1) asymmetric engine thrust reverser deployment, (2) asymmetrical spoiler/aileron activation, (3) transient electronic signals causing uncommanded flight control movements, (4) yaw damper malfunctions, and (5) a rudder cable break or pull. The Safety Board ruled out each of these scenarios as a possible factor or cause of the left yaw/roll and heading change for the following reasons:

Analysis 242 Aircraft Accident Report • Postaccident examination of the engine thrust reversers, including disassembly of the thrust reverser actuators, indicated that the engine thrust reversers were in the stowed position at impact. Further, the investigation revealed that, at the engine power settings recorded by the FDR during the upset event, a thrust reverser deployment would not have produced a heading change that would match the FDR heading data and would have produced longitudinal acceleration signatures that were not reflected by the FDR longitudinal acceleration data. • Simulator tests indicated that even the most adverse asymmetrical spoiler/ aileron extension condition could not create a heading change rate of the magnitude that was recorded by the accident airplane’s FDR. • The Safety Board examined the possibility that transient electronic signals, possibly caused by blue water contamination of components in the electrical/ electronic compartment (E/E bay),305 high-intensity radiated field (HIRF) interference, or electromagnetic interference (EMI) could result in an uncommanded flight control movement. Although the Boeing 737 flight controls are primarily hydromechanical (not electrical), there are electrical links to the flight control systems through the autopilot (which interfaces with the ailerons, spoilers, elevators, and stabilizer trim but not the rudder), the rudder trim, and the rudder system’s yaw damper. Therefore, EMI and/or HIRF could theoretically affect the autopilot, rudder trim, and/or yaw damper systems within the limits of those systems. Further, the autopilot and yaw damper systems have components located in the E/E bay and therefore could have been affected by fluid contamination. • The Safety Board’s flight tests and review of event histories demonstrated, however, that pilots could easily override uncommanded movements of the ailerons, spoilers, or elevators resulting from electronic signals influencing those flight controls. If such an uncommanded flight control movement persisted, a pilot could easily disengage the autopilot (as the pilots of USAir flight 427 ultimately did), thus likely eliminating the electrical/electronic influence on the flight controls. In addition, postaccident examination of the rudder trim system components indicated that the rudder trim actuator was in the neutral position at impact. If the rudder trim actuator were disturbed by a transient electrical input, it would have remained in its trimmed position until it was trimmed again by specific pilot action—unlike the rudder PCU, which would revert to its neutral position when pilot or yaw damper input ceased and was found in a near-neutral position at the accident site. Further, because the rudder trim system moves the rudder at a much slower rate than the rudder system or the yaw damper (0.5° versus 66 and 50° per second, respectively), 305 Although postaccident examination of recovered portions of the forward lavatory/galley and E/E bay revealed no evidence of blue water contamination, such contamination may have existed on portions of those structures that were not recovered or identified.

Analysis 243 Aircraft Accident Report it could not produce a rudder deflection rate that would result in the rapid yawing motion and heading change observed in the FDR and computer simulation data. • A review of the yaw damper system indicated that it could not produce a rudder deflection that would result in the yawing motion observed in the FDR data because the yaw damper system authority is limited to ± 3° (when properly rigged). Simulator tests confirmed that these limited rudder deflections could not result in the yawing motion observed in the accident airplane’s FDR data. Further, pilot statements describing uncommanded yaw excursions within the yaw damper system’s normal range (± 3°) indicated that such excursions are typically considered to be merely nuisance events and are easily controlled by the flight crew. Additionally, as with the autopilot, the pilots could have easily disengaged the yaw damper system if necessary, thus eliminating the yaw damper’s effect. • The Safety Board considered the possibility of a yaw damper failure in combination with a jam of the standby rudder PCU input bearing. Tests showed that such a combination could result in a rudder deflection of about 9°. However, this rudder deflection could not have produced the heading change recorded by the accident airplane’s FDR. Further, the Safety Board’s tests also showed that a pilot input on the rudder pedals could override this combined failure/jam and neutralize the rudder. • Testing examined the possibility that a rudder cable pull or break might have caused the heading change. However, the tests demonstrated that the effects of loads up to 250 pounds applied to the rudder cables could produce maximum rudder deflections of only 2.3° and that rudder cable separations could produce maximum rudder surface deflections of only 5°. Simulator tests indicated that such rudder deflections would not create a yawing motion or heading change of the magnitude that was recorded by the accident airplane’s FDR. In addition, when the rudder cables were cut during postaccident tests, the CVR recorded “bang” sounds that had energy distributed throughout the frequency spectrum, with multiple secondary signals that appeared to be the result of mechanical “ringing” of the rudder cable system. These sounds and frequencies did not resemble any of the sounds or frequencies recorded by the CVR during the upset/loss of control of USAir flight 427. Therefore, the Safety Board concludes that asymmetrical engine thrust reverser deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing uncommanded flight control movements, yaw damper malfunctions, and a rudder cable pull or break were not factors in the USAir flight 427 accident. The accident investigation revealed that, when the airplane began to yaw and roll left (as it penetrated the path of the descending wake of Delta flight 1083), the FDR began to record load factor fluctuations and an increase in airspeed. These airplane motions were consistent with the performance changes that were observed during the Safety Board’s wake turbulence flight tests. Further, the “thump” sounds recorded by the

Analysis 244 Aircraft Accident Report accident airplane’s CVR during the following 6 seconds (while the airplane was still likely passing through the 727’s wake vortices) were similar to the sounds recorded by the flight test airplane’s CVR when the wake vortices passed across the test airplane’s fuselage. (These sounds were described by flight test pilots as “whooshing” noise.)306 The Safety Board considered the possibility that the wake turbulence encounter alone resulted in the accident airplane’s heading change and the subsequent upset event and accident. However, wake turbulence flight test data and flight test pilot statements indicated that it was not difficult to recover from the wake vortex encounters, although some encounters resulted in rolling moments that were surprisingly intense (especially those in which the intercept angle was small and the vortex impacted the airplane’s fuselage, as most likely occurred with the accident airplane). Further review of the wake turbulence flight test data did not reveal any instances in which the wake vortex encounter resulted in a heading change resembling that recorded by the accident airplane’s FDR. In most of the flight test encounters, the airplane rapidly exited the wake vortex, thus ending the encounter. In fact, the wake turbulence flight tests indicated that wake vortices naturally tended to push the airplane out of the wake’s effects. Additionally, the Safety Board’s review of wake turbulence-related events in its accident and incident database307 and in NASA’s Aviation Safety Reporting System revealed that, although air carrier pilots frequently reported being surprised by the severity of wake vortex encounters, these encounters typically resulted in upsets that pilots were easily able to counter. The Safety Board’s database indicated that wake turbulence encounters were determined to be causal factors in three air carrier accidents. These three accidents, which occurred between 1964 and 1972, involved airplanes operating at low altitudes near airports (two airplanes were landing, and one was taking off). After the 1972 accident, ATC airplane separation standards were increased; since that time, no fatalities aboard air carrier airplanes have involved a wake turbulence encounter. Notably, no record exists of a catastrophic encounter with wake turbulence by an air carrier airplane when the airplane was operating at altitudes and/or airspeeds similar to those of USAir flight 427. Evidence of wake vortex-related airplane motions were detected in the accident airplane’s FDR data by about 1902:55. However, the results of the wake vortex flight tests and the Safety Board’s computer simulations indicate that the airplane would not have remained in the wake long enough to have produced the heading change and bank angles that occurred after 1903:00. On the basis of the results of wake turbulence flight tests and flight simulator sessions and review of available wake turbulence event information, the 306 Boeing’s flight test pilot reported that, during some of the wake vortex encounters, he heard a clicking sound that he attributed to the wake vortices causing the windshield wipers to slap against the windshield. At 1902:58.6, the USAir flight 427 CVR recorded a “clickety click” sound, the source of which could not be positively identified. Although the Safety Board reviewed the sounds recorded by the CVR on 50 of the 150 wake turbulence flight test conditions, it did not identify a case in which the CVR recorded such a clickety click sound. Therefore, no direct comparison was possible between the sounds heard on the flight test airplane and the accident airplane. 307 The Safety Board’s database contains information regarding aviation accidents beginning in 1962.

Analysis 245 Aircraft Accident Report Safety Board concludes that, although USAir flight 427 encountered turbulence from Delta flight 1083’s wake vortices, the wake vortex encounter alone would not have caused the continued heading change that occurred after 1903:00. Boeing and Safety Board flight and computer simulations (discussed in section 1.16.6.1) have demonstrated, however, that the heading change rates recorded by the FDR after 1903:00 were consistent with the rudder being deflected to its left aerodynamic blowdown limit. Accordingly, the Safety Board concludes that, about 1903:00, USAir flight 427’s rudder deflected rapidly to the left and reached its left aerodynamic blowdown limit shortly thereafter. This movement of the airplane’s rudder could only have been caused by a flight crew action or a mechanical rudder system anomaly. The potential for such a mechanical rudder anomaly was demonstrated during postaccident tests in which the secondary slide was intentionally jammed (pinned) to the servo valve housing and a rapid input was applied in a direction that would oppose the jam. These tests showed that the primary slide could overtravel,308 resulting in hydraulic fluid porting in such a way that the rudder moves to its aerodynamic blowdown position in the direction opposite to the rudder input (rudder reversal).309 Further, during the most severe postaccident thermal tests (a temperature difference of about 180° between the heated hydraulic fluid and the servo valve housing of the USAir flight 427 main rudder PCU), the secondary slide jammed to the servo valve housing, and hydraulic fluid flow data indicated that a momentary reversal of the rudder occurred during this jam. Although the USAir flight 427 servo valve jammed repeatedly during these extreme thermal tests, the new-production servo valve also subjected to these tests never jammed. Examination of the internal measurements of both servo valves indicated that the USAir flight 427 servo valve had significantly tighter diametrical clearances between the secondary slide and the servo valve housing than the new- production servo valve. The Safety Board considers it likely that the USAir flight 427 servo valve was more susceptible to a jam because of its tighter clearances. Although the USAir flight 427 main rudder PCU servo valve had been subjected to impact forces from the accident and extensive postaccident testing (including repeated thermal jams), internal examination of the servo valve revealed no evidence of physical marks that would indicate that a jam had existed. Further, the servo valve slides still moved freely, and the servo valve was still capable of successfully completing Parker Hannifin’s acceptance test procedure functional tests. The Safety Board recognizes that the temperature differential to which the accident PCU servo valve was exposed under the most severe thermal test conditions was greater than that expected in normal operation; the hydraulic fluid had not been circulating through the PCU before the tests began and was therefore not continuously warming the 308 This overtravel is the result of elastic deformation of the mechanical input mechanisms that allow the primary slide to move beyond its intended design limits. 309 Normally, if the secondary slide were to jam to the PCU servo valve housing, the primary slide would move to oppose the jam, neutralizing hydraulic flow.

Analysis 246 Aircraft Accident Report PCU servo valve housing as it would be in flight if the yaw damper were energized.310 Nonetheless, these thermal tests demonstrate that it is possible for the secondary slide of the servo valve to jam to the valve housing and leave no evidence of physical marks. These tests also demonstrate that, with the secondary slide thus jammed, it is possible for the primary slide to overtravel and cause a rudder hardover in the direction opposite to that commanded without leaving any physical evidence. 2.2.1 USAir Flight 427 Computer Simulation Analysis Kinematic analysis and workstation-based computer simulations were performed to determine the control wheel (ailerons and flight spoilers) and rudder inputs that could produce the motion of the airplane between the time of the initial upset and ground impact. During its investigation of this accident, the Safety Board evaluated many solutions, including the kinematic analysis presented by Boeing in its September 30, 1997, submission to the Board.311 Because the data available from the USAir flight 427 FDR was limited (in both the number of parameters recorded and the frequency with which the parameters were recorded)312 and investigators could not positively identify the characteristics of the wake, multiple control wheel and rudder solutions provided a reasonable match with the pertinent FDR data: the airplane’s vertical load factor (acceleration), pitch, roll, and (most importantly) heading. The Safety Board obtained an excellent match of the USAir flight 427 FDR data with a computer simulation in which, after a right rudder pedal input about 1903:00, the rudder reversed as a result of a jam of the secondary slide to the servo valve housing (about 100 percent off neutral) and moved to its left blowdown limit. This simulation (subsequently referred to as the Safety Board’s best-match simulation) included an estimation of the influence of the wake vortex during the upset event and resulted in a heading output that not only matched the FDR-recorded heading within less than 1° but also matched the character313 of the FDR-recorded heading data until about 1903:08, at 310 The amount of hydraulic fluid flow through the main rudder PCU directly affects the temperatures within the PCU (increased hydraulic fluid flow through the PCU results in increased temperatures within the PCU and vice versa). Although some hydraulic fluid continually flows through the PCU as a result of leakage around the primary slide permitted by the underlapped metering edge design, additional hydraulic fluid flow through the PCU occurs as a result of yaw damper activity or rudder pedal usage. Therefore, normal operations in smooth, calm air, with minimal yaw damper activity or pilot rudder pedal usage would result in minimal hydraulic fluid flow through the PCU, whereas operations in turbulent air with increased yaw damper/rudder activity would result in increased hydraulic fluid flow through the PCU. Conditions were quite calm before the USAir flight 427 upset, so there would have been little yaw damper activity or rudder usage and thus very little hydraulic fluid flowing through and warming the PCU. However, yaw damper activity upon encountering the wake vortex would have resulted in increased hydraulic fluid flow through the PCU. 311 During the Safety Board’s first technical review for the USAir flight 427 accident, which was held on October 31, 1997, in Pittsburgh, Boeing presented a refined version of the information contained in its September 30, 1997, submission. 312 For more information, see section 1.11.2.

Analysis 247 Aircraft Accident Report which time the stickshaker activated and the FDR data showed the beginning of an aerodynamic stall.314 In its September 30, 1997, submission to the Safety Board, Boeing presented a kinematic solution for the USAir flight 427 accident. This solution postulated that the pilot applied full left rudder about 1902:59, relaxed that rudder pressure momentarily, applied full left rudder once again beginning about 1903:01, and then sustained this input until ground contact, about 1903:23. A comparison of the heading, roll, and vertical acceleration results from the Safety Board’s best-match simulation with Boeing’s kinematic solution indicates that both solutions match the FDR data about equally well. The Safety Board then evaluated how well the rudder and control wheel time histories produced by the Safety Board computer simulations and Boeing’s kinematic solution comported with the human performance data obtained during this investigation. 2.2.2 USAir Flight 427 Human Performance Analysis A review of CVR, FDR, and ATC information indicated that the accident flight and flight crew performance were routine before the upset occurred. All required checklists were completed, communications with ATC and other crewmembers were appropriate, and the pilots were responsive and displayed no evidence of problems that would impede working together during an emergency. No evidence indicated any physiologic or ergonomic reason that either pilot would have been incapable of manipulating the airplane’s controls throughout their range of motion during the accident sequence. Although the Safety Board was unable to positively determine which pilot was manipulating the airplane’s flight controls during the initial upset and the early recovery attempts,315 the following indications showed that the first officer likely provided flight control inputs throughout the accident sequence: • The first officer was the flying pilot for the flight segment during which the accident occurred, and the CVR recorded no verbal transfer of command (as specified in USAir procedures) to indicate that the captain had assumed those responsibilities. • The first officer emitted straining and grunting sounds early in the upset period, which speech and communication experts stated were consistent with applying substantial physical loads; the CVR did not record any such sounds on the captain’s microphone channel until just before ground impact. 313 The “character of the data” is used in this report to refer to the shape of the curve that would be formed by connecting the FDR data points smoothly. 314 The Safety Board and Boeing were unable to analyze poststall/high sideslip events because the aerodynamic model of the airplane in that condition is unreliable and inaccurate. 315 Because the FDR did not record aileron and rudder flight control inputs at either pilot position, it was not possible to determine what flight control inputs were applied by the flight crew or which pilot applied such controls. The FDR recorded control column position but did not identify which pilot(s) applied control column pressure.

Analysis 248 Aircraft Accident Report • The first officer keyed the microphone (apparently inadvertently) on the air-to- ground radio channel repeatedly while the stickshaker activated between 1903:09.4 and the end of the recording, which would be consistent with gripping the control wheel and the vibrations of the stickshaker tripping his finger on and off the radio switch on the back of the yoke. The captain might have joined the first officer in manipulating the flight controls during the upset sequence; however, according to speech and communication experts, the captain’s breathing (rapid and shallow) and speech patterns (for example, “whoa,” “hang on,” and “what the hell is this”) did not indicate that he was exerting substantial physical loads during the initial upset. Further, speech experts stated that the captain’s “four twenty seven emergency” transmission, about 1903:15, was a reasonable attempt to communicate and an appropriate response for the situation, but the captain’s speech during the transmission did not indicate that the captain was exerting substantial physical loads. After about 1903:18 (about 5 seconds before ground impact), that the captain’s breathing and speech patterns recorded by the CVR indicated that he might have been exerting strong force on the controls (as he said “pull...pull...pull”). Therefore, the Safety Board concludes that analysis of the human performance data shows that it is likely that the first officer made the first pilot control response to the upset event and manipulated the flight controls during the early stages of the accident sequence; although it is likely that both pilots manipulated the flight controls later in the accident sequence, it is unlikely that the pilots simultaneously manipulated the controls (possibly opposing each other) during the critical period in which the airplane yawed and rolled to the left. As previously discussed, the accident airplane was returning to level flight under autopilot control from a shallow left turn to an ATC-assigned heading of 100° when it penetrated the wake vortex of the preceding 727 airplane (Delta flight 1083). The first officer was announcing that he had visual contact with the Jetstream traffic (Atlantic Coast flight 6425), of which ATC had advised the flight crew, when the accident airplane’s FDR began to record vertical loads consistent with a wake vortex encounter from the 727. The most severe perturbations resulting from the wake turbulence penetration occurred between about 1902:55 and about 1903:03. As the airplane’s bank angle (which had been rolling out of a commanded left bank toward a wings-level position) began accelerating to the left away from level flight, the turbulence apparently caused the captain to inadvertently activate the intercom button on his side console316 and caused both the captain and first officer to voice exclamations of surprise (“sheeez” and “zuh” at 1902:57.5 and 1902:57.6, respectively). The results of the Safety Board’s computer simulation and Boeing’s kinematics analysis showed a significant right control wheel input about 1902:58 in response to the left roll/yaw effects of the wake vortex. This input was likely the result of the first officer reacting to the wake turbulence, aggressively inputting right control wheel (initially about 65°, according to the Safety Board’s simulation) to keep the airplane level.317 The speed 316 The captain was likely touching the radio/intercom transmit button on his side console because he was preparing to advise ATC that he and the first officer had visual contact with the Jetstream traffic.

Analysis 249 Aircraft Accident Report of this pilot reaction, about 1 second after his first verbal reaction, suggested a reflexive action to counter the rolling motions of the wake. The timing of the first officer’s early control wheel response to the wake turbulence encounter indicated that the first officer quickly recognized the strength of the wake-induced roll event and acted accordingly. The Safety Board’s simulation (rudder jam/reversal scenario) and Boeing’s simulation (pilot input scenario) differ markedly as to what happened after the right control wheel input. 2.2.2.1 Rudder Jam/Reversal Scenario According to the Safety Board’s computer simulations, at about 1902:59, as the airplane responded to the right control wheel input and began rolling back toward level flight, the control wheel position moved from about 65° right to about 15° right. This movement indicates that the first officer had relaxed his input force on the control wheel. However, according to the FDR, between about 1902:58 and about 1903:00, the airplane’s heading moved quickly past the assigned 100° to about 94°. Both the Safety Board’s computer simulation and Boeing’s kinematic analysis indicated that this heading change was likely to have been associated with a significant yawing motion318 that would have caused a lateral acceleration at the pilots’ seats of more than 0.1 G to the left. The pilots would have likely felt this acceleration as a sustained, uncomfortable sideforce in the cockpit and would have observed the ground and sky moving sideways against the fixed reference of the airplane’s windshield area. Beginning with initial flight training and continuing throughout their careers, pilots are trained to minimize uncoordinated yawing motions and sideforces. At 1902:59.4, the captain stated “whoa” likely in response to the kinesthetic and visual sensations produced by the airplane’s yawing motion.319 It would have been reasonable for the first officer to respond to this yawing motion (and possibly to the captain’s statement) by applying right rudder pedal pressure about 1903:00. This right rudder input, intended to relieve the sideforce and return the airplane to its assigned heading, was instead followed by a rapid rudder deflection to the left (rudder reversal) that increased the left yawing motion and accelerated the airplane’s heading change to the left. As the rudder deflected to its initial blowdown position, the rudder pedals would have moved in a direction opposite to that commanded by the first officer. The first officer would likely have sensed the right rudder pedal rising underneath his right foot despite attempts to depress the pedal. During that time (between about 1903:00 and about 317 The control wheel and column inputs would have caused the autopilot to change to its control wheel steering mode for both the pitch and roll axes; as a result, the first officer’s control inputs would have positioned the flight controls through the autopilot servos. 318 According to the geometry of USAir flight 427’s wake vortex encounter, this yawing motion likely resulted from the entry of the airplane’s tail into the vortex field. The Safety Board’s computer simulation of the event models the wake vortex encounter in this way. 319 At the time of the captain’s statement, the left yawing motion would have been the most significant of the sensations being experienced in the cockpit. The airplane’s bank angle (19.5° left) and pitch angle (6.5° nose up) were within the parameters of normal flight. The vertical acceleration was relatively small. Although the airplane experienced a roll acceleration to the right, it remained in a left bank; thus, the roll acceleration would have been in the direction desired by the pilots.

Analysis 250 Aircraft Accident Report 1903:02), the CVR recorded the sounds of grunting on the first officer’s hot microphone channel. Two speech experts who examined these sounds indicated that they were signs of significant physical effort, greater than the sounds produced by the normal use of flight or cockpit controls. One speech expert concluded that the sounds indicated that the first officer was “struggling unusually hard…for example [as] if he was…experiencing an unusual resistance in the use of a control.” The Safety Board considers it likely that the soft grunting sound recorded on the CVR at 1903:00.3, shortly after the start of the rudder reversal, is a manifestation of an involuntary physical reaction by the first officer to the beginning of the reversing motion of the rudder pedal. Without additional input pressure from the first officer, the right pedal would have tended to push his foot back from the neutral position. However, if the first officer resisted the reversal, the right rudder pedal would have yielded somewhat. Force on the right rudder pedal could have returned that pedal to about the neutral position. However, as the airplane entered a sideslip (resulting from the rudder deflection), the maximum rudder deflection at blowdown would have increased; thus, the rudder pedal would have tended to push the pilot’s foot farther aft. The CVR recorded louder grunting sounds by the first officer beginning at 1903:01.5, about 0.6 seconds after the rudder pedals would have reached their maximum uncommanded displacement. Few, if any, actions in the use of normally functioning 737 flight controls would cause a pilot to strain so hard as to grunt.320 The first officer could not have been grunting because of control column (pitch) inputs; the FDR shows that the column was moving freely and not against a stop. The possibility that the two pilots struggled against each other by making opposing inputs is unlikely because the CVR did not record any straining sounds or forced breathing from the captain or comments from the flight crew about conflicting inputs. If the autopilot is engaged in the control wheel steering (CWS) mode, a pilot might grunt while attempting aggressive control wheel inputs that exceeded the input rate of the autopilot.321 However, no grunting sounds were recorded about 1902:58, when the autopilot would have been in CWS mode while the first officer made his first rapid wheel input to the right. Further, both the Safety Board computer simulations and the Boeing kinematic studies showed the control wheel moving back toward neutral during the latter portion of the time that the grunting sounds were made by the first officer. Movement of the control wheel toward neutral would be associated with relaxation of the pilot’s input force on the wheel rather than the addition to or maintenance of input force that might have generated the grunting sound. 320 During the 30 minutes of pilot conversation previously recorded by the CVR, neither pilot had emitted grunting sounds before this time. 321 Information provided by Boeing indicated that the forces necessary to move the control wheel under the CWS mode would increase quickly from about 15 to about 40 pounds or more as a pilot exceeded the input rate of the autopilot. According to ergonomic research, such control wheel forces would be significant for many pilots controlling the wheel with one hand, but would not be significant for pilots controlling the wheel with two hands. See McDaniel, J.W. 1995. “Strength Capabilities for Operating Aircraft Controls.” SAFE Journal 25 (1), pages 28-34.

Analysis 251 Aircraft Accident Report The Safety Board was unable to find an explanation for the first officer’s louder grunting sounds other than his efforts to overcome a rudder system malfunction in which he was increasing the pressure on the rudder pedal with no apparent effect. Consequently, for the purposes of the computer simulation of the rudder jam/reversal scenario, the first officer’s reaction to the rudder reversal was modeled as the application of increasing force (400 pounds of force within 1 second of the beginning of the reversal) to the right rudder pedal to oppose the direction of the airplane’s yaw and roll.322 From a human performance standpoint, a rudder reversal malfunction can explain how a full rudder deflection could have continued despite efforts by the first officer to correct the situation. The unexpected rudder pedal reversal, combined with the rapid left roll and yaw of the airplane, would have undoubtedly confused and alarmed the first officer. Any pilot pushing on the rudder pedal in this situation would know that the pedal was not responding normally but would have difficulty comprehending, evaluating, and correcting the situation. A reversal malfunction runs counter to pilot experience, training, and knowledge. Depressing a rudder pedal during a reversal malfunction would have an effect contrary to a pilot’s understanding of the function of the rudder system. Increased pressure on the rudder pedal would not correct the problem.323 As long as the airplane continues to depart from controlled flight, a pilot reacting to a rudder reversal would likely maintain at least some pedal pressure in a continued attempt to oppose the uncommanded yawing and rolling moments. During the few seconds after the left rudder deflection that occurred about 1903:00, the accident airplane’s control wheel position was adjusted several times, eventually reaching nearly full right control wheel, in response to the airplane’s left rolling and yawing motions. Any pilot faced with an acceleration away from the desired flightpath could be expected to make an initial control input (about 65° right control wheel in this case) to assess the effects of the control input; remove some, or all, of the input when the airplane began to respond (so as not to overcontrol); and converge on the appropriate input (almost full right wheel in this case). Thus, the Safety Board considered that the flight crew’s control wheel inputs in response to the initial wake turbulence encounter and rudder reversal were reasonable pilot reactions to the evolving situation. Therefore, the flight control inputs used in the Safety Board’s best-match computer simulation of the USAir flight 427 upset are consistent with the pilot responses that might be expected during a rudder reversal. Further, the CVR information from the period of the initial upset is consistent with rudder reversal. 322 Although the Safety Board’s best-match simulation used 400 pounds of force reducing to 200 pounds, based on ergonomic and other research data (as discussed in section 1.18.8), the Safety Board was also able to obtain an excellent match using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds). 323 As previously indicated, the Safety Board has investigated aviation accidents that have been caused by flight control reversals (see section 1.16.5.4.8). The Board notes that such reversals are often fatal because few pilots (even test pilots) are able to absorb the information, analyze it, and apply inputs to correct the situation in the moments available before the airplane attains an unrecoverable attitude.

Analysis 252 Aircraft Accident Report The grunting sounds ended at 1903:02.1, when the CVR also recorded the sound of the autopilot disengaging. According to the Safety Board’s computer simulation, the wheel was briefly returned to near neutral at that time. The CVR did not record any more grunting or straining sounds until a few seconds before ground impact. This evidence is consistent with the first officer slightly relaxing his control wheel and rudder pedal inputs—perhaps because he thought that he was contending with a malfunctioning autopilot, in which case autopilot disengagement would restore normal control. After disengaging the autopilot, the first officer likely focused his attention on modulating the control wheel inputs or attempting to raise the airplane’s nose and, in the quickly changing situation, did not return his attention to overpowering the rudder pedal anomaly. On the basis of the cessation of grunting sounds and the control wheel inputs that followed, the Safety Board’s computer simulation of the rudder jam/reversal scenario incorporated a reduction in the pilot’s right rudder pedal pressure to 200 pounds at that time. Because the rudder feel and centering unit would combine with the pilot’s foot pressure in applying force to the PCU during a rudder reversal, the rudder reversal could have continued with a minimum rudder pedal pressure by the pilot of only about 50 pounds. 2.2.2.2 Pilot Input Scenario According to the Boeing kinematic solution, the pilots of USAir flight 427 applied full right control wheel about 1902:58 in response to the left roll and yaw from the airplane’s encounter with the wake vortex. Boeing proposed that the pilots then applied left rudder input from about 1902:58 to about 1903:01 in response to a right roll acceleration (shown in Boeing’s kinematic analysis from about 1902:58 to about 1902:59) from the control wheel input, which momentarily reversed the airplane’s left rolling motion. However, such a right roll acceleration would have helped the pilots stop the left roll and regain a level bank attitude; thus there would be little reason for the pilots to have opposed the right roll acceleration. (In fact, Boeing’s scenario indicated that, at the time of the proposed full left rudder pedal input, the right control wheel input had just stopped the airplane’s left roll.) Although the right roll acceleration toward level flight might have prompted the flight crew to remove some, or all, of the existing right control wheel input, it is unlikely that the flight crew would have responded to this right roll acceleration by applying full left rudder before using the airplane’s roll control authority to the left. Moreover, both the Safety Board’s computer simulation and Boeing’s kinematic analysis of this period indicated that the pilots were experiencing the sideload from a yaw acceleration to the left (caused by the wake vortex). The sideload would logically have prompted the pilots to apply right, rather than left, rudder. Therefore, the Safety Board considers it highly unlikely that the flight crew of USAir flight 427 applied full left rudder, as specified in the pilot input scenario proposed by Boeing. Further, Boeing’s pilot input scenario requires the flight crew to have sustained the full left rudder input for at least 10 seconds. In its September 30, 1997, submission and Human Factors Supplement Submission, Boeing cited four 737 incidents (in October 1986, April 1993, July 1995, and June 1997) in which the FDR data indicated that flight

Analysis 253 Aircraft Accident Report crew responses to unexpected upsets resulted in momentary cross-control situations. However, FDR information also showed that the flight crews maintained control of the airplane. The airplanes’ flight attitudes never exceeded reasonable levels, and the airplanes never diverged from controlled flight. The control inputs, bank angles, and headings all converged on stable values, and all of the flights landed safely. During the USAir flight 427 upset, the airplane’s increasingly extreme left bank attitude would have provided the pilots with a consistent and powerful cue to remove any left control inputs they may have applied. Further, the Safety Board’s review of available data from previous accidents and incidents obtained from Boeing, the Board’s database, and accident investigation authorities worldwide indicated that momentary, incorrect rudder applications by air carrier pilots have occasionally occurred in response to an unexpected anomaly during a critical phase of flight. However, those events often occurred in conditions of reduced external visual cues or during abrupt, rapid aircraft movements and accelerations. Some pilots reported being startled by the in-flight upset, but no case was found in which a pilot responded to an in-flight upset involving a sustained yaw or roll by continuing to hold extreme rudder input in a direction opposite to that required to recover the airplane. To further evaluate the possibility of a sustained, inappropriate rudder input, the Safety Board examined numerous possible explanations for the flight crew to have applied and sustained a full left rudder input until a loss of control occurred. These possibilities included pilot incapacitation, deliberate pilot action, disorientation, and unintended rudder pedal activation. The Safety Board reviewed documentation from two incidents in which pilot (specifically, first officer) incapacitation adversely affected the controllability of a 737. In both cases, the incapacitation occurred suddenly; the first officers stiffened and applied pressure to a rudder pedal, resulting in a large rudder deflection as the airplanes descended during the approach to their destination airports. Although both captains reported that they were startled by the unexpected event, both responded appropriately and were capable of compensating for inputs made by the incapacitated first officers. Neither of these cases resulted in a significant loss of control. Further, a review of the available data from previous accidents and incidents revealed no evidence of pilot incapacitation that had resulted in a loss of control in other air carrier airplanes. In the case of USAir flight 427, no evidence indicated that pilot incapacitation was involved in the accident sequence because • neither pilot had a medical history that indicated a risk of incapacitation, • CVR evidence indicated that both pilots were alert and appropriately responsive during the accident sequence, and • CVR evidence indicated that neither pilot was alarmed by the behavior of the pilot or that any medical emergency was occurring. The Safety Board considered whether either pilot deliberately applied an incorrect rudder input. However, the remarks and sounds recorded by the CVR during the initial

Analysis 254 Aircraft Accident Report upset and loss of control indicated that both pilots were surprised by the event and did not understand its nature or cause. Further, the Safety Board carefully examined aspects of the pilots’ personal and professional lives and found both pilots to be stable. Moreover, analysis of the communications and sounds recorded by the CVR indicated that the pilots expended extraordinary effort in their attempts to recover from the upset throughout the accident sequence. Therefore, no evidence supports a deliberate action by either pilot to apply the rudder incorrectly. The Safety Board also considered the possibility that one or both of the pilots became disoriented during the loss of control and was therefore unable to take actions to recover control of the airplane. The accident and incident records, expert opinions, and literature regarding spatial disorientation (a phenomenon that occurs when visual and kinesthetic/vestibular cues are in conflict) indicate that spatial disorientation resulting in a loss of airplane control is extremely improbable in air carrier operations when strong external visual cues exist, even if abrupt, rapid airplane movements and accelerations occur. Witnesses on the ground and the pilots of other airplanes in the area reported that the sky was clear with a visible horizon when the USAir flight 427 accident occurred. The accident airplane was operating in a cruise flight attitude, and the pilots would have had no obstructions to visual cues. The horizon would have been visible to both pilots when, according to Boeing’s proposed scenario, the first officer made and held a left rudder input. Thus, the pilots of USAir flight 427 had ample visual cues available to maintain an accurate awareness of the airplane’s orientation. To illustrate a vehicle operator’s persistence in making an inappropriate control input, Boeing’s September 30, 1997, Human Factors Supplement Submission suggested the phenomenon of “unintended acceleration” from automotive safety literature.324 This phenomenon refers to evidence from automobile accidents that drivers may inadvertently press the accelerator pedal when they believe that they are applying the brake pedal, which can lead to the driver pressing even harder on the accelerator pedal in the belief that this action will slow the motion of the automobile. However, unlike automobile drivers, pilots use a different foot to activate each rudder pedal. Further, the 737 cockpit layout locates the stem of the control column and a large rudder pedal adjustment mechanism between each pilot’s legs, making it physically difficult or impossible to push a rudder pedal with the wrong leg. Therefore, the possibility that a pilot would activate the wrong rudder pedal on a 737 is much less than the possibility that an automobile driver would confuse the accelerator and brake pedals. In addition, an important factor in an automobile driver’s persistence in pressing down the accelerator pedal in such events is the driver’s perception that the brake is being applied; hence, the driver believes that the more pedal pressure applied, the better chance 324 Schmidt, R.A. 1989. “Unintended acceleration: A review of human factors contributions.” Human Factors, 31, pp. 345-64. Also, Reinhart, W. “The effect of countermeasures to reduce the incidence of unintended acceleration accidents.” Proceedings From the Fourteenth International Technical Conference on Enhanced Safety of Vehicles, Munich, Germany, 1994.

Analysis 255 Aircraft Accident Report there is for recovery. In this respect, the phenomenon of unintended acceleration in automobiles may be more instructive with regard to pilot actions and frame of mind in a rudder reversal scenario than in a pilot input scenario. The Safety Board analyzed the CVR for possible indications of a left rudder input by the pilots. The grunting sounds recorded on the first officer’s hot microphone channel were not well correlated in time with any of the pilot control actions proposed by Boeing’s scenario that might have resulted in such sounds. According to Boeing, the grunting sounds occurred after the first officer made a full right control wheel input and the first of two postulated left rudder inputs. However, neither of the two postulated rudder inputs would have required more than 70 pounds of force on a normally operating left rudder pedal. This relatively mild force should not cause a pilot to grunt. Although a pilot could exert more than 70 pounds of force in holding a rudder at full deflection, there would be no reason to do so once full left rudder deflection was achieved. Also, it is unreasonable that both pilots would have allowed a sustained incorrect rudder input to continue in the presence of salient cues without one of them recognizing the error and commenting and/or attempting to correct the rudder’s position. The CVR did not record any evidence of one pilot being alarmed or struggling against the control inputs of the other pilot (as might be expected if a pilot made an abrupt and counterproductive flight control input). Rather, the CVR recorded sounds indicating that both pilots were surprised by and did not understand the event as it developed from a wake turbulence encounter into a more critical situation. 2.2.2.3 USAir Flight 427 Scenario Summary No evidence indicates that an air carrier pilot has ever responded to an in-flight upset by applying and holding full rudder in the incorrect direction to the extent that control was lost. Also, the circumstances of this accident are inconsistent with the pilots applying and sustaining a left rudder input because of pilot incapacitation, deliberate pilot action, unintended rudder pedal activation, or spatial disorientation. Further, CVR information does not support pilot left rudder pedal input as the explanation for the left rudder deflection in this accident.325 Consequently, the Safety Board concludes that analysis of the human performance data (including operational factors), does not support a scenario in which the flight crew of USAir flight 427 applied and held a full left rudder input until ground impact more than 20 seconds later. The Safety Board further concludes that analysis of the CVR, Safety Board computer simulation, and human performance data (including operational factors) from the USAir flight 427 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide. 325 Although the rudder pedal pivot lugs on both the captain’s and first officer’s rudder pedal assemblies were damaged, (see section 1.16.5.1), this damage provided no useful evidence of pilot rudder pedal activation during the upset.

Analysis 256 Aircraft Accident Report 2.2.2.4 Likelihood of Recovery From a Rudder Reversal FDR data and Safety Board computer simulations indicated that, about 1902:59, the airplane began to roll to the left and pitch slightly nose down, and the control column position began to move slightly aft. Although the airplane’s left bank continued to increase by about 1903:02, the nose-down pitch rate had been temporarily arrested by the aft control column inputs. The airplane’s motions and the aft control column pressure resulted in a slight increase in vertical load (to about 1.2 Gs). On the basis of the existing airspeed and the increase in vertical G load, by about 1903:02 the airplane would have been below the airspeed at which the roll controls (aileron and spoilers) could counter the effects of the fully deflected rudder (crossover airspeed). Thus, from that time onward, it would have been impossible for the flight crew to regain roll control without increasing airspeed and/or decreasing the airplane’s vertical G load. After the autopilot was disengaged about 1903:02, the airplane’s left bank angle continued to increase and the control column position continued to move farther aft. As a result, by about 1903:03, the vertical load had increased to about 1.55 Gs. At that time, aft control column input would have been an instinctive pilot reaction to try to prevent the airplane from pitching nose down in a steep bank and maintain the ATC-assigned (and pilot-selected) altitude. During the early seconds of the upset event, the pilots did not likely suspect that the event was anything other than a strong, but otherwise routine, wake turbulence encounter. They had no foreknowledge of a rudder reversal or rudder hardover or of the crossover airspeed phenomenon. Therefore, it is understandable that the pilots of USAir flight 427 would have, at least momentarily, attempted to maintain their assigned altitude by increasing control column back pressure. Further, it is extremely unlikely that the pilots would have been able to diagnose the relationship between airspeed, vertical G load, and the loss of control in the few seconds available to them after this back pressure brought the airplane below the crossover airspeed.326 The accident airplane’s FDR data indicated that the control column position generally continued to move farther aft as the event continued; the airplane continued to roll left and pitch farther nose down, decelerated a few knots, and began to lose altitude. About 1903:08, as the airplane descended through about 5,700 feet msl, the stall warning stickshaker activated, indicating to the pilots that the aft column input was commanding an angle-of-attack near stall. However, by that time the airplane had attained an extreme attitude (about 70° left bank and more than 20° nose down), which would have been well beyond any attitude that the pilots would have experienced in air carrier operations. About 3 seconds later, when the control column reached its full aft position, the airplane’s bank angle had gone beyond vertical (90°), and its pitch attitude had exceeded 50° below the horizon. 326 Boeing pilots who were evaluating the 737’s handling characteristics during postaccident flight tests identified a stronger-than-expected relationship between vertical G load and the ability to overpower the roll induced by a full rudder deflection with full wheel input. The pilots reported that “there is some technique [required] between the G and the roll.”

Analysis 257 Aircraft Accident Report The Safety Board notes that pilots are trained to respond to the stickshaker warning by decreasing pitch (column forward). In some previous air carrier accidents involving stalls, the Board has cited the flight crew as a causal factor in the accident for failing to take the necessary actions to recover from the stall.327 However, in a rudder reversal scenario, the pilots of USAir flight 427 would have been struggling to cope with the rudder’s anomalous movements (in addition to the airplane’s extreme roll and pitch attitudes) when they also would have been surprised to discover that full left control wheel input was ineffective in countering the airplane’s steepening left roll. These factors combined to produce a flight situation and control problems that the pilots of USAir flight 427 had never before encountered in flight or training, including during stickshaker/stall recovery training. With this series of problems in the course of a few seconds, it is understandable that the crew was no longer responding in a manner that might have allowed recovery.328 During postaccident simulator tests,329 test subjects were able to recover from the USAir flight 427 upset, or at least stabilize the roll to the point at which a continued loss of control would most likely not have occurred, when they applied a specific recovery technique (full right control wheel maintained throughout the duration of the event and forward control column pressure sufficient to reduce G load and maintain a speed above the crossover airspeed) promptly when the event began. However, unlike the pilots of USAir flight 427, the simulator test subjects were aware of the circumstances of the accident, prepared for and expecting the upset event as it occurred, and coached through the recovery procedure. When the simulator test subjects varied their responses from the specific techniques that they were told to apply (for example, when they modified their control wheel input in anticipation of the simulator’s responses to their inputs), a successful recovery from the upset event became much less likely. Further, when the simulator test subjects tried to maintain altitude at the outset of the event, the simulator’s speed decreased below the crossover airspeed, and recovery became unlikely. Therefore, although it was possible to recover from the upset event during its early stages, such a recovery would have required the pilots to immediately abandon their normal pitch control criterion (maintaining altitude) and hold full control wheel inputs against the roll. These actions may be successful with prior awareness of the effects of a 327 See, for example, National Transportation Safety Board. 1997. Uncontrolled Flight Into Terrain, ABX Air Inc. (Airborne Express), Douglas DC-8-63, N827AX, Narrows, Virginia, December 22, 1996. Aircraft Accident Report NTSB/AAR-97/05. Washington, DC. 328 No reliable aerodynamic model exists for the 737’s flight characteristics in a stall; consequently, the Safety Board could not evaluate the possibility of recovery after activation of the stickshaker. The Safety Board notes, however, that if the pilots had reacted to the stickshaker by reducing aft control column pressure only enough to silence the stickshaker (as air carrier pilots are trained to do in a minimum altitude loss stall recovery), the airplane would have remained below the crossover airspeed for the existing vertical G load, and the pilots would not have regained control of the airplane. 329 These simulator tests were conducted in Boeing’s M-CAB simulator using the accident airplane’s FDR data and a rudder hardover (induced either manually or electronically) to represent the USAir flight 427 upset condition.

Analysis 258 Aircraft Accident Report rudder reversal and the crossover airspeed, as shown by the simulator tests. The Safety Board concludes that the flight crew of USAir flight 427 recognized the initial upset in a timely manner and took immediate action to attempt a recovery but did not successfully regain control of the airplane. However, because the pilots did not have foreknowledge of the problem, immediate awareness of its onset, and prior training and experience with the crossover airspeed phenomenon, the Safety Board concludes that the flight crew of USAir flight 427 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight. 2.3 United Flight 585 Upset 2.3.1 United Flight 585 Computer Simulation Analysis FDR330 and radar data, the accident location, and wreckage orientation were used as data points in the Safety Board’s computer simulation studies of United flight 585. Because the FDR did not record roll or sideload information, it was not possible to positively determine whether the recorded heading changes were the result of a roll or a sideslip followed by a roll.331 Other variables had to be factored into the simulation studies. The winds and turbulence encountered by United flight 585 during the approach undoubtedly acted on the airplane during the upset and descent. Because the exact winds encountered by the airplane were not known, the winds could be reasonably varied during the simulations, resulting in a number of possible scenarios that would be consistent with the radar data and the limited FDR data. Pilot pedal input force was another variable that was incorporated in the simulations. The Safety Board employed several computer simulation scenarios in which the resulting heading data matched the available FDR data. These simulations used rudder position time histories that assumed jams of the secondary slide to the valve housing at various positions from the neutral position (100, 71, 50, 40, and 30 percent), and a concomitant rudder reversal. (Each of the rudder-related solutions required a control wheel response opposing the roll). The Safety Board’s best-match computer simulation was one in which the secondary slide jammed at 100 percent off its neutral position and, about 0943:32,332 the rudder reversed in response to the pilot’s attempt to make a left rudder input. In this simulation, the airplane’s right yaw rate had reached 4.7° per second just before the rudder reversal because of the effects of a wind gust (a 17-knot decrease in the wind velocity for 3 seconds as the airplane descended on its approach). The Safety Board incorporated this 330 United flight 585 was equipped with a five-parameter FDR, which recorded microphone keying, airspeed, altitude, and heading at once-per-second intervals and vertical Gs at 8 times per second. 331 Simulations using a control wheel input could produce a scenario involving only a roll, whereas simulations using a rudder movement could produce a scenario involving a sideslip followed by a roll, both of which could be consistent with the recorded data. 332 All times in this section and section 2.3.2 are mountain standard time, based on a 24-hour clock.

Analysis 259 Aircraft Accident Report wind velocity change with decreased altitude into its computer simulation to match the heading data recorded by the FDR from about 0943:28 to about 0943:31. The heading output from the Safety Board’s best-match simulation matched the FDR heading data within 1° or less and matched the character of the data. The Safety Board’s computer simulations that used right control wheel input alone (and no rudder movement) also produced heading results that matched the available FDR data. However, that solution was not considered to be realistic because it required the pilots to fly the airplane into the ground when simple wheel corrections could prevent this occurrence. The Safety Board has no evidence that the pilots of United flight 585 would have deliberately flown the airplane into the ground.333 The Safety Board could also match the FDR data by assuming that the increasing roll was the result of a rotational external wind, such as a mountain rotor. The Safety Board considered the possibility that a mountain rotor forced the airplane along the accident flightpath.334 With the weather conditions present in the area on the day of the accident (strong westerly winds flowing over the mountains located west of the accident site), rotors could have been generated, rotating in a clockwise direction (from United flight 585’s perspective on the approach). These rotors would have likely been moving to the east (pilots’ left to right) with the wind at an unknown altitude; however, it is possible for a mountain wave to trap a rotor, resulting in a “standing” rotor, which would not move with the wind. In a June 23, 1997, letter to the Safety Board, Boeing indicated that a “rudder hardover scenario” did not fit the United flight 585 FDR data but that a “new rotor model” it developed did fit the data. This Boeing model proposed an encounter with a rotor that followed the flightpath of the accident airplane and increased in strength to about 1.8 radians (103°) per second as the airplane descended to the ground. However, according to NOAA scientists, the strongest rotors ever documented in the Colorado Springs area had a strength of about 0.05 radians per second. Further, a NOAA/National Center for Atmospheric Research (NCAR) report335 indicated that researchers have not documented rotors that would descend to the ground in increasing strength, such as the one proposed by Boeing. The Safety Board evaluated the accident airplane’s FDR information for signatures that would be expected if the airplane encountered a rotor. In addition to changes in 333 Reports from other pilots who had flown with the captain (the flying pilot on United flight 585 indicate that he was a very conservative and conscientious pilot. These reports are consistent with the captain’s conduct on the accident flight, as documented on the CVR. 334 The Safety Board considered several mountain rotor scenarios, including moving rotors above, below and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s flightpath; and horizontal rotors that transition to vertical rotors along the airplane’s flightpath. 335 The NOAA/NCAR interim report (prepared in response to Safety Recommendation A-92-57) was entitled A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs Area: Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997). The NOAA/NCAR final report has not been completed; however, the Safety Board has reviewed a draft of the final report and reflected its content in this analysis.

Analysis 260 Aircraft Accident Report heading, the signatures would have included changes in indicated airspeed and altitude resulting from the effects of the low ambient pressure within the rotor. None of these expected pressure signatures were found. Although encounters with translating rotors at certain angles might not produce these pressure signatures, the masking of the FDR signatures would occur only while an airplane was entering such a rotor. United flight 585 could not have penetrated a rotor’s low pressure core and remained there for 8 seconds (the time that the airplane would have had to remain in the rotor for the heading output and the flightpath to match the FDR data) without pressure changes from the rotor producing changes in airspeed and altitude. Further, none of the sounds that are normally characteristic of intense rotors were recorded by the accident airplane’s CVR, and witnesses on the ground did not report such sounds at the time and location of the accident. On the basis of the absence of the signatures of a rotor penetration on the FDR, the absence of recorded/reported characteristic rotor sounds, and the small likelihood that a rotor of the necessary strength and orientation would have matched the airplane’s flightpath to the point of ground contact, the Safety Board concludes that it is very unlikely that the loss of control in the United flight 585 accident was the result of an encounter with a mountain rotor. 2.3.2 United Flight 585 Human Performance Analysis On the day of the United flight 585 accident, pilots flying in the area of the Colorado Springs airport had reported moderate to severe turbulence, gusty winds, and windshear. Information recorded by the CVR and FDR indicated that, as the captain (who was the flying pilot) maneuvered the airplane in the traffic pattern, the airplane encountered wind gusts and windshear that resulted in 10-knot airspeed changes. Because of the turbulence and wind gusts, and because he was preparing for a crosswind landing, the Safety Board considers it likely that the captain had his feet on the rudder pedals as he aligned the airplane on its final approach. According to the Safety Board’s best-match computer simulation, about 0943:20, the airplane rolled rapidly (about 10° per second) to the right to a bank angle of about 27° and returned to approximately a level flight attitude. This bank was entered more rapidly and was steeper than the bank a pilot would likely have commanded for a heading adjustment to track the extended centerline of the runway. Consequently, the Safety Board assumed that the right roll was caused by an eddy or rotational wind component. (The recovery from this right roll, however, was presumed to have been a result of control wheel inputs made by the captain beginning about 1 second after the airplane’s roll accelerated to the right.) The Safety Board’s review of the CVR, FDR and radar information revealed that, about 0943:28 (8 seconds after the 27° uncommanded right roll), the airplane was flying at 160 knots with 30° of flaps and the landing gear extended and was nearly aligned on the final approach for the runway. According to the CVR, at 0943:28.2, the first officer advised “we’re at a thousand feet [above the ground].” The FDR indicated that, about

Analysis 261 Aircraft Accident Report 0943:30, another right heading change began and continued at a rate of 4.7° per second. In its computer simulation, the Safety Board matched this heading change by introducing a crosswind gust component, resulting in right yaw. The yaw rate was sustained for more than 3 seconds before a rapid right roll developed. This sustained yaw would have been apparent to the captain as motion of the ground and sky features relative to the fixed reference of the airplane’s windshield area. This heading change would have been especially salient to the captain because the runway, with which he was trying to maintain alignment, would have been visible ahead. The Safety Board’s simulation scenario assumed that the captain responded to the sudden, rapid, and sustained heading change by applying left rudder pedal input about 0943:32. The timing of this input (about 3 seconds after the peak yaw rate was attained) would be consistent with the time required for the pilot to perceive the yaw, wait a moment for the effect of the turbulence to subside (to avoid overcontrolling), decide that a left rudder input was required, and then apply the left rudder pedal input. The Safety Board’s simulation postulated that this left rudder input initiated a rudder reversal to the right. According to the Safety Board’s simulation, at 0943:33.5 (about 1.5 seconds after the rudder reversal began), when the captain signaled his decision to abandon the approach by stating “fifteen flaps,” the bank angle had not exceeded 20°, and the pitch angle was 8° nose down (approximately what it had been during the normal descent in the period leading up to the upset). However, speech analysis indicated that the captain’s “fifteen flaps” statement displayed a heightened level of speech fundamental frequency that was consistent with a sense of urgency. This sense of urgency was also indicated by the captain’s omission of a call-out item in the normal go-around procedure.336 Although many factors may have precipitated a go-around decision by the captain, a flight control difficulty, such as that produced by a rudder reversal, would have been consistent with the captain’s speed and urgency in making this decision. If the captain applied force to the left rudder pedal, he would have felt the pedal push strongly back against his foot pressure. Further, the Safety Board assumed that the captain would have acted to oppose a continuing uncommanded right yaw that was being sustained by a reversing rudder; thus, the Safety Board’s computer simulation of the event increased the captain’s force on the left rudder pedal to 300 pounds within 1 second.337 During postaccident simulator exercises, the Safety Board determined that an immediate full left control wheel response during a right rudder reversal in the airspeed and flap configuration of United flight 585 could have allowed the flight crew to maintain control of the airplane. However, during a rudder jam and reversal, the captain of United flight 585 would have been contending with the distraction of the malfunctioning rudder and thus would have been devoting his physical effort to overpowering the rudder pedals. Further, the airplane’s yawing motion and heading changes (derived from the Board’s 336 The captain did not state aloud “go-around thrust,” as specified in United’s go-around procedure. 337 Although the Safety Board’s best-match simulation used 300 pounds of force reducing to 200 pounds, based on ergonomic and other research data (as discussed in section 1.18.8), the Safety Board was also able to obtain an excellent match with the FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds) and using 500 pounds of force.

Analysis 262 Aircraft Accident Report computer simulations) would have produced stronger cues than those produced by the rolling motion during the first few seconds of the upset, so the captain was likely focusing his attention on the rapid yaw acceleration that he could not control with the rudder. These circumstances would have been extremely confusing and distracting and would have been unknown to the flight crew based on previous experience. Thus, it would be understandable for the captain to have initially made a partial wheel input while contending with the powerful physical and mental demands of the problem with the rudder. The CVR evidence of increasing engine thrust indicated that the captain would have been using his right hand to advance the thrust levers for an attempted go-around. Thus, the captain would have had only his left hand available to rotate the wheel to the left, which would have made it difficult to achieve large left control wheel deflections. (This motion would have required the captain to pull his left arm down and across his body while twisting his left wrist.) Further, at the time of the left rudder input in the Safety Board’s simulation, the airplane was in about a 5° right bank. According to the Board’s assumption that the captain applied moderate left wheel (about one-third of the available control wheel) about 2 seconds later, the airplane would have been in a right bank of about 30°. On the basis of the time required for the captain to perceive the need for and execute his control input (about ¾ second), the bank angle that the captain would have been responding to with this moderate control wheel input was about 15°. With this relatively shallow roll angle, it would be normal for a pilot (especially an air carrier pilot) to first apply a moderate control input and then gauge the airplane’s response before making an extreme control input. (The Safety Board considers it likely that the first officer’s statement “Oh God” at 0943:32.6 referred to her concerns about the abrupt, sustained yaw rate and heading change resulting from the rudder’s reversal movement to its right blowdown limit and not about the airplane’s roll attitude or rate of change because the roll attitude was not excessive at that time.) The Safety Board’s computer simulation further indicated that the captain applied full control wheel to the left about 2 seconds later. The computer simulation results also indicated that, within 2 seconds of rudder reversal, the pilots were experiencing as much as 0.44 G of sideforce from the right yaw acceleration. This sideforce would have made a left wheel input even more difficult for the captain because his body would have been pulled to the left and away from the control wheel, causing a tendency to level the wheel unless he quickly returned his right hand to the controls. Therefore, because of the unknown nature of a rudder reversal, the initially shallow roll angle, and the physical limitations that would have hindered an immediate full left control wheel input, the Safety Board considers it understandable that the captain might not have immediately applied a full left control wheel input to counter a reversing rudder. The Safety Board’s computer simulation showed that, about 0943:34, the bank angle of the airplane transitioned suddenly; by about 0943:35, only 3 seconds after the reversal, the right bank angle had increased to more than 80°. The Safety Board’s

Analysis 263 Aircraft Accident Report simulation also showed that the captain, at that time, rapidly moved the control wheel fully to the left. The airplane’s pitch angle had decreased to almost 30° nose down, and the pilots would have been able to see only the ground through the windshield. The Safety Board would expect that the captain would no longer be applying as much force to the left rudder pedal because he was likely focusing on holding a full left wheel input and attempting a go-around and the left rudder pedal would have forced him to a less efficient knee angle. Consequently, the Board’s computer simulation of the event moderated the captain’s force on the left rudder pedal to 200 pounds at that time. Shortly thereafter (perhaps in response to the loss of attitude reference), the captain apparently removed some of his left wheel inputs, possibly because he was concentrating on aft control column pressure in an attempt to raise the airplane’s nose. By about 0943:36, the airplane rolled into an inverted attitude and the captain said “no” very loudly. Ground impact occurred about 5 seconds later, only 9 seconds after the rudder reversal began. The Safety Board concludes that analysis of the CVR, Safety Board computer simulation, and human performance data (including operational factors) from the United flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide. Also, because the United flight 585 upset occurred when the airplane was less than 1,000 feet above the ground, the pilots had very little time to react to or recover from the event. Thus, the Safety Board concludes that the flight crew of United flight 585 recognized the initial upset in a timely manner and took immediate action to attempt a recovery but did not successfully regain control of the airplane. The Safety Board further concludes that the flight crew of United flight 585 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight. The Safety Board also concludes that the training and pilot techniques developed as a result of the USAir flight 427 accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions of the flight envelope; such training was not yet developed and available to the flight crews of USAir flight 427 and United flight 585. 2.4 Eastwind Flight 517 Upset The logbook records for the Eastwind flight 517 airplane indicated that a series of flight crew-reported rudder-related anomalies (uncommanded rudder movements and rudder pedal “bumps”) occurred during the month before the upset event. As a result of these anomalies, the main rudder PCU was removed and replaced on May 14, 1996, and the yaw damper transfer valve and yaw damper position transducer were removed and replaced on June 8, 1996.338 The captain of the incident flight, who had experienced some of the previous rudder pedal bumps, conducted the postmaintenance flight test on the 338 On June 2, 1996, Eastwind issued a bulletin to all flight crews advising them to report any “unexplained” yaw events.

Analysis 264 Aircraft Accident Report morning of the incident flight. The captain noted no rudder system anomalies during the test flight or the incident flight until the upset event began. The Safety Board’s postincident examination of the incident airplane’s rudder system components revealed several anomalous conditions, including a misadjusted yaw damper linear variable displacement transducer (LVDT) and chafed wiring between the yaw damper coupler and the main rudder PCU. Either of these conditions might have resulted in anomalous rudder behaviors. The misadjusted LVDT would have changed the yaw damper’s authority over the rudder from the specified 3° left or right of neutral to 1.5° left of neutral to 4.5° right of neutral with no aerodynamic loads on the rudder. Chafed wiring could cause a short circuit, which could result in a yaw damper hardover command. Although the Safety Board was unable to positively identify the source of the rudder- related anomalies, a short circuit related to the chafed wiring may have caused a yaw damper hardover during the incident.339 Safety Board simulations and Boeing kinematics studies revealed that the heading change observed in the Eastwind airplane’s FDR data required a right rudder deflection of about 6 to 6.5°. This rudder movement is larger than the yaw damper could command (even allowing for the misrigged LVDT and compliance in the system, the yaw damper could only command 3.95° of right rudder movement in flight).340 Further, although examination of the Eastwind flight 517 PCU components revealed a higher-than-normal hydraulic fluid leakage at the bypass valve (resulting in a reduced hinge moment, which would result in a reduced blowdown rudder deflection),341 the aerodynamic blowdown limit for the Eastwind flight 517 incident airplane, assuming normal (unreversed) operation, far exceeded the 6 to 6.5° rudder deflection that was apparently involved in the incident.342 Examination of internal measurements of the Eastwind flight 517 PCU servo valve revealed that it had relatively tight clearances, similar to those measured in the USAir flight 427 PCU servo valve. Thus, the Eastwind servo valve (similar to the USAir servo 339 The postincident removal and replacement of all components and wiring associated with the incident airplane’s yaw damper system apparently eliminated the source of the rudder bumps; since then, there have been no pilot complaints or maintenance writeups regarding rudder bumps or other anomalous rudder behavior. 340 Although the misadjusted LVDT allowed for 4.5° of movement to the left on the ground, the rudder movement with aerodynamic loads in flight would have been 3.7°. This estimate has an error band of ± 0.25°, yielding an estimated maximum right rudder deflection (caused by the yaw damper) of 3.95°. 341 Although the bypass valve allowed higher-than-normal leakage, which affected the rudder’s blowdown deflection, the leakage was not significant enough to prevent the Eastwind PCU from successfully completing Parker’s acceptance test procedure functional tests at the full PCU level. However, when the bypass valve was removed from the PCU package and tested independently, it did not successfully complete the bypass valve functional tests. 342 According to Boeing, the rudder blowdown limits for the Eastwind flight 517 incident airplane (including the reduced hinge moment from the PCU’s excessive leakage at the bypass valve) would have been about 9° when operating at 250 knots under normal (unreversed) pilot command, with the variation depending on the sideslip value.

Analysis 265 Aircraft Accident Report valve) would be more likely to jam than a servo valve with greater clearances (such as the new-production PCU servo valve also subjected to these tests). 2.4.1 Eastwind Flight 517 Computer Simulation Analysis Eastwind flight 517 was equipped with an 11-parameter FDR that included vertical acceleration, pitch, roll, and heading. Because heading data were recorded only once per second, several computer simulations resulted in reasonable matches of the FDR heading data (and vertical acceleration, pitch, and roll data). (FDR heading data sampled at more frequent intervals would have likely resulted in fewer computer simulations that match the data reasonably well.) The Safety Board’s best-match simulation assumes that the rudder surface was trimmed to neutral to compensate for the offset yaw damper. This scenario also assumes that, about 2210:31, the pilot stepped on the left rudder pedal to counter a yaw damper hardover of 3.95° to the right that had occurred about 2 seconds earlier; the yaw damper hardover created a yaw acceleration that peaked at more than 7°/sec2 and a lateral acceleration in the cockpit above 0.1 G. This scenario further assumes that the secondary slide was jammed to the servo valve housing about 55 percent off neutral and that, when the pilot applied force to the left rudder pedal, the rudder moved in a direction opposite that commanded to about 6.5° right (the blowdown limit with the leaking bypass valve and the reduced rudder hinge moment from the secondary slide jam at 55 percent from neutral). The Safety Board’s simulation results matched each FDR heading and roll data point within about 1°. The results also matched well with the FDR recorded vertical acceleration data. Boeing proposed a scenario in which a yaw damper hardover of 3° right (from 1.5° left because of the misrigged LVDT) occurred during the ground roll. Boeing further proposed that the pilots added 3° of left rudder trim to compensate for the yaw damper input.343 According to Boeing’s scenario, the fault that initially moved the yaw damper to 3° right cleared just before 2210:28, and the rudder then moved rapidly 3.7° to the left, resulting in a left yaw about 2210:28. Boeing’s scenario indicated that the pilot responded with right rudder pedal, commanding the rudder to about 6° right and causing the airplane to yaw right. In Boeing’s scenario, the pilot maintained the right rudder pedal input, and the yaw damper remained active and responded appropriately.344 Boeing used its kinematic analysis to derive flight control surface position time histories (particularly the rudder position time history). This effort required Boeing to curve fit the once-per-second FDR heading data, which Boeing accomplished with a manual, nonlinear fit of the heading data, as shown in figure 32. To justify a right rudder 343 The Eastwind pilots’ statements indicated that the yaw damper behaved normally during the maintenance test flight that occurred before the incident flight and was observed in the neutral position during the ground operations before takeoff of the incident flight. 344 The Boeing scenario was described in its August 14, 1998, Submissions Supplement to the USAir flight 427 accident investigation. In a document dated February 24, 1999, Boeing provided updated data in support of its scenario.

Analysis 266 Aircraft Accident Report input by the pilot about 2210:29, Boeing introduced a left heading change between 2210:28 and 2210:29 (in response to the postulated left rudder movement from the release of the yaw damper hardover about 2210:28) through its manual nonlinear curve fit of the FDR heading data, even though the FDR data did not reflect a left heading change. (Further, both the flight crew and the lead flight attendant recalled a yaw to the right as the initiating event.). When this manual curve fit of the heading data was used in Boeing’s kinematic analysis, the results indicated a left rudder movement about 2210:28 that was consistent with Boeing’s scenario of the release of the yaw damper hardover at that time. Boeing then used this rudder surface time history (and other control surface time histories) as input data in its computer simulation to produce airplane motion parameters, including heading. Boeing asserted that its analysis demonstrated rudder activity during the event, which it considered evidence of the yaw damper activity during the event (and therefore evidence that the rudder was not jammed and did not reverse). However, the basis for this assertion that the yaw damper was active during the event is the rudder activity resulting from Boeing’s kinematic analysis, which in turn resulted from Boeing’s manual, nonlinear curve fit of the FDR heading data. Although the Safety Board cannot prove that the left heading change introduced into Boeing’s curve fit about 2210:28 did not exist, no evidence indicates that it did. Further, the heading change does not match the character of the heading data between about 2210:27 and about 2210:30. Further, Boeing used the rudder time history resulting from its kinematic analysis and the concomitant rudder activity to conclude that the yaw damper was active. However, because of the noise inherent in the curve-fitting process, these results do not prove that the yaw damper was active but only allow for this possibility. The Safety Figure 32. Boeing’s curve fit of the FDR heading data from Eastwind flight 517. 22:10:25.00 22:10:30.00 22:10:35.00 233 234 235 236 237 238 239 240 241 Eastwind Event Boeing Solution from fig 16 of August 14, 1998 submittal FDR data Boeing Heading Curve fit Boeing Simulator Heading Heading (deg) Time (hr:min:sec)

Analysis 267 Aircraft Accident Report Board’s computer simulations, which assumed that the secondary slide jammed to the servo valve housing about 55 percent from its neutral position after the pilot input left rudder (about 2210:30) in response to a right yaw damper hardover (about 2210:28), did not require yaw damper activity to achieve its match. Boeing’s computer simulation results and the Safety Board’s results matched the FDR data well, with the resulting heading data from both simulations matching the FDR heading data within 1°. Further, within the approximately 12 seconds of significance (about 2210:28 to about 2210:40), the character of the resulting heading data from both the Boeing and Safety Board simulations is generally consistent with the character of the FDR heading, except for the hump in the heading data between 2210:28 to 2210:29 introduced by Boeing’s curve fit for its kinematic analysis. Boeing’s simulation, however, suffers from a timing deficiency: its simulation presumes a right pedal input by the pilot about ¼ second after the postulated clearing of the yaw damper hardover in reaction to a heading change of less than 0.5° and a peak heading change rate of only 1.4° per second. Further, Boeing’s simulation results in a 6° right rudder deflection. However, the blowdown limit for Eastwind flight 517 at that time (without a reversal scenario)345 would have been about 9°, even with the higher bypass leakage rate. Thus, the Boeing scenario requires that the pilot only partially depress the right rudder pedal to move the rudder surface to match the simulation deflection. 2.4.2 Eastwind Flight 517 Human Performance Analysis The captain of Eastwind flight 517 had adopted a personal technique of routinely disengaging the autopilot as his airplane descended through 10,000 feet mean sea level (msl). Consequently, when Eastwind flight 517 approached Richmond on the night of the incident, the captain was hand flying the airplane with his feet on the rudder pedals. The weather on the night of the incident was reported to be clear with relatively calm winds. The airplane was descending through 4,300 feet msl when the captain felt a motion that he later described as a “bump” on the right rudder pedal. The captain reported that, almost immediately afterward, he felt a sharp yaw to the right followed by a right roll. The captain stated that the rudder pedals displayed little, if any, displacement. This report is consistent with the 3.95° nose right yaw damper hardover about 2210:29 in the Safety Board’s computer simulation scenario. In postincident interviews with Safety Board investigators, the captain stated that he immediately applied “opposite [left] rudder and stood pretty hard on the pedal.” He said that the “rudder moved, but felt stiffer than normal.” The first officer told investigators that he observed the captain “fighting, trying to regain control” and “standing on the left rudder [pedal].” The captain further stated that the rudder pedal moved but did not depress to the floor. He believed that these actions slowed the event but that the airplane was still trying to roll. 345 In a reversal scenario, the leaking bypass valve and the reduced hinge moment caused by a secondary slide jam would have reduced the blowdown limit to 6.5º.

Analysis 268 Aircraft Accident Report These pilot statements are consistent with the Safety Board’s computer simulation scenario in which the main rudder PCU servo valve’s secondary slide jammed and the rudder moved in the direction opposite to that commanded by the pilot. The Safety Board’s simulation studies indicated that, after the rudder initially deflected 3.95° to the right, it increased its deflection to about 6.5° to the right within the next 2 seconds. This 2-second period from yaw damper hardover to reversal of the rudder was adequate time for the captain to perceive the effects of the yaw damper hardover as a sideload upon his body and react with left rudder input. The Safety Board’s computer simulation assumed that this left rudder input initiated a rudder reversal by causing the primary slide of the servo valve to overtravel. Thus, as the captain added left rudder pedal input, under the Safety Board’s rudder reversal scenario, the rudder would have moved the remainder of the distance to its right blowdown limit (to about 6.5° right) with little movement of the left rudder pedal back against the captain’s foot. Under the assumption that the captain continued to apply an increasing amount of force to the left rudder pedal to counter the right yaw/roll (from the reversing rudder), the left rudder pedal would have moved slightly forward without removing the uncommanded right rudder deflection. The rudder pedal motion and force required to move the pedal are consistent with the captain’s report of rudder pedals that moved but felt “stiffer than normal.” Further, because both pilots reported that the captain exerted substantial force on the left rudder pedal (by “standing on” it), the Safety Board’s computer simulation of the jam/reversal scenario modeled the captain’s rudder pedal force as an increase to 500 pounds within 1 second.346 The captain stated that, as the event continued, his wheel inputs appeared to stop the roll but did not correct the condition. The captain increased the right engine’s power, hoping that differential engine thrust would counter the airplane’s right yaw/roll. According to the FDR, when the right engine’s thrust increased, the captain’s initial control inputs had recovered the airplane from its right rolling moment and rolled the airplane back through level flight to a stable left bank attitude of about 5 to 15°. The Safety Board’s computer simulation shows the captain relaxing both control wheel and rudder inputs about 2210:34 as differential engine thrust became effective and as the captain attempted to restore a level bank attitude. According to the Safety Board’s scenario and the captain’s recollection, the captain had achieved a stable, though uncoordinated (cross-controlled), flight condition with only moderate control wheel inputs required. Given the stability of the situation, particularly with the airplane already in a left bank, it would have been reasonable for the captain to have relaxed some of his rudder pedal and control wheel inputs. At this time, the Safety Board’s computer simulation shows the captain relaxing his rudder pedal force to 250 pounds. 346 Although the Safety Board’s best-match simulation used 500 pounds of force reducing to 250 pounds, based on ergonomic and other research data (as discussed in section 1.18.8), the Safety Board was also able to obtain excellent matches with the FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds) and using 300 pounds of force.

Analysis 269 Aircraft Accident Report The captain stated that, when the uncommanded event continued, he reached for the yaw damper switch (located on the overhead panel above the captain’s head) and disengaged the yaw damper. Seconds later, the yaw/roll event ended (about 12 seconds after it began, according to FDR data). The captain stated that he did not believe the end of the event was directly related to the yaw damper disengagement. However, the Safety Board considers it possible that the captain may have (unknowingly) eased his pressure on the left rudder pedal when he reached for the yaw damper switch or afterward as he assessed the effect that the yaw damper disengagement had on the yaw/roll event. (The Safety Board modeled this scenario in its computer simulation of the event with a further reduction in left rudder pedal pressure about 2210:40.) If the captain relaxed his force on the left rudder pedal to less than about 50 pounds, a rudder reversal resulting from a secondary slide jam to the servo valve housing might have ended (that is, the primary slide might have returned to neutral from its overtravel position). Unlike United flight 585 and USAir flight 427, Eastwind flight 517 was moving throughout the event at a speed that remained well above the crossover airspeed. Thus, the flight crew of Eastwind flight 517 had sufficient roll control authority to overcome the effects of a full rudder deflection. This roll control authority was clearly a factor in the ability of the flight crew to recover from the event. In addition to the human performance aspects of the Eastwind flight 517 reversal scenario, the Safety Board reviewed the human performance aspects of the pilot input scenario proposed by Boeing. As discussed in section 2.4.1, Boeing’s scenario proposed that a yaw damper hardover, which had occurred while on the ground before departure, resulted in a constant 3.7° right rudder input at the beginning of the flight. The scenario further proposed that the pilots then applied an equal and opposite amount of left rudder trim so that the rudder surface was about neutral with respect to the vertical fin. During interviews with investigators, the captain of Eastwind flight 517 did not recall having trimmed the rudder at any time before the beginning of the yaw/roll incident. Further, the captain indicated that he never used more than ½ unit of rudder trim during routine flight operations. Therefore, the need to trim the rudder by more than 3 units (as indicated in Boeing’s scenario) would most likely have been salient and memorable to the captain. Further, the pilots of Eastwind flight 517 had been aware of previous rudder anomalies with the incident airplane, and they had test flown the airplane immediately before the incident flight to verify the proper function of the rudder system. Therefore, the pilots would have been more likely to note and recall a requirement for 3 units of rudder trim if it had occurred. Boeing’s pilot input scenario also proposes that the yaw damper hardover released between 2210:28 and 2210:29 and that the pilots immediately responded to the resulting left yaw with right rudder input. This scenario postulates that the pilots reacted within less than ¼ second after the beginning of the rudder’s leftward motion. (The scenario must include such a rapid pilot response to the postulated release of the yaw damper hardover because the entire initiating event—release of the yaw damper hardover and pilot right rudder input—must take place within the 1-second interval between the FDR heading data

Analysis 270 Aircraft Accident Report points at 2210:28 and 2210:29, or the Boeing simulation heading time history would not match these FDR heading data.) According to human factors literature on reaction time,347 it is unlikely that a pilot could detect an unusual situation, recognize what was happening, decide how to respond, and make a motor response in a time period as little as ¼ second. At the beginning of the postulated yaw damper hardover release, no substantial cues would have signaled the Eastwind pilots to respond with an immediate rudder input. The motion of the rudder from the yaw damper hardover release would have provided no feedback to the rudder pedals. Although yaw acceleration (perceived by the pilots as sideload) would have begun almost immediately after the rudder movement started, it would not have reached 0.05 G until about 1/3 second after rudder movement began and its peak of approximately 0.1 G until about ½ second after rudder movement began.348 Airplane heading, which could have been apparent to the pilots during the night flight as motion of lights on the ground relative to the airplane, would have changed less than 1° during the ¼-second period after the yaw damper hardover release. Consequently, the cues that might have alerted the flight crew to a yaw damper hardover release would not have developed until most, or all, of the ¼-second period had elapsed. Finally, the pilot would have been required to make a foot response, which can be 20 percent slower than a hand response.349 When the captain of Eastwind flight 517 was subjected to a yaw damper hardover in the test flight conducted after the event, he took 3/5 second to initiate a rudder pedal input in response to the hardover. This reaction time is probably less than the captain’s reaction time would have been during the incident flight because he knew the test flight would involve a sudden rudder event and he knew exactly how to respond. Therefore, on the basis of these human reaction time capabilities, the flight crew of Eastwind flight 517 would not have likely been able to react to the cues from an unexpected yaw damper hardover release in less than ¼ second. To match the FDR data from the Eastwind flight 517 incident, Boeing’s pilot input scenario also required the pilots to have applied and held about 6° of right rudder for 10 seconds or more after the postulated yaw damper hardover release.350 However, the scenario’s requirement for pilot right rudder input is inconsistent with the statements of the captain and first officer: both recalled that the captain applied left rudder. Further, both pilots recalled that the captain made a substantial rudder input (describing his actions 347 See Sens, M.J., Cheng, P.H., Wiechel, J.F., and Guenther, D.A. 1989. Perception/reaction time values for accident reconstruction. Warrendale, Pennsylvania: Society of Automotive Engineers, Paper

1. Woodson, W.E., and Tillman, B. and P. 1992. Human factors design handbook. 2nd edition. New

York: McGraw-Hill, Inc. Also, Boff, K.R., and Lincoln, J.E. 1988 Engineering data compendium: Human perception and performance. Wright-Patterson Air Force Base, Ohio: Armstrong Aerospace Medical Research Laboratory. 348 This finding was based on Safety Board simulations of a 3.7° rudder step input under the existing flight conditions. 349 Woodson and Tillman, p. 631. 350 Slight variations in the rudder’s position during this time period were proposed by Boeing to indicate variations in pilot inputs and/or the operation of the yaw damper. See section 2.4.1 for more information.

Analysis 271 Aircraft Accident Report as “standing on the left rudder [pedal]” and “push[ing] quite hard”). In contrast, if the pilots had made an inappropriate right rudder input to a properly functioning rudder system (as the Boeing scenario proposes) to achieve a 6° right rudder, the captain would have had to apply only 54 pounds of pressure to the right rudder pedal, depressing the pedal no more than 1 inch, or about one-quarter of the available pedal travel. A forceful full right rudder input with a normally functioning rudder system (based on postincident testing of the Eastwind flight 517 main rudder PCU without a jam and reversal) would have resulted in the right rudder pedal depressing to its forward quadrant stops (about 4.2 inches) and the rudder surface moving to its normal blowdown limit of about 9° right. However, simulations of the Eastwind flight 517 incident performed by both the Safety Board and Boeing indicate that a 9° rudder deflection does not match the FDR data. The Safety Board considers it highly unlikely that the pilots of Eastwind flight 517 would have forgotten about having trimmed the rudder by more than 3 units before the incident began, reported applying left rudder when they had actually applied right rudder, and (perhaps least likely) recalled “standing on the left rudder” when the captain had actually applied only a light touch on the pedal. The Safety Board also considers it very unlikely that the pilots could have reacted to the postulated yaw damper hardover release in less than ¼ second. Therefore, the Safety Board does not consider the scenario proposed by Boeing for the Eastwind flight 517 incident to be consistent with the available evidence from the FDR and the flight crew. On the basis of the results of its computer simulation (including reduced hinge moment) and analysis of the human performance data (including postincident flight crew statements), the Safety Board concludes that, during the Eastwind flight 517 incident, the rudder reversed, moving to its right blowdown limit when the captain commanded left rudder, consistent with a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide. 2.5 Rudder System Jam Scenarios In its examinations of the rudder systems of the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes, the Safety Board was unable to identify any obvious physical evidence that a jam occurred within the servo valve. Further, the investigation has not revealed how the secondary slide could jam to the servo valve housing under conditions that would normally be encountered by an airplane in air carrier operations and not leave any physical evidence that the jam occurred. However, the Safety Board demonstrated that, in servo valves with tight clearances,351 the secondary slide could jam to the servo valve housing and leave no physical evidence of that jam (albeit under thermal conditions that would not normally be encountered by an airplane in 351 The Safety Board’s dimensional examination of the main rudder PCU servo valves from the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident revealed that the USAir and Eastwind servo valves had relatively tight clearances. The United servo valve was damaged so severely that accurate internal measurements could not be obtained.

Analysis 272 Aircraft Accident Report air carrier operations). Further, small particulate matter in the hydraulic fluid could reduce the already tight clearances in the servo valve, requiring less of a thermal differential for the valve to jam. In addition, it is possible for a large amount of small particles to provide the jamming potential of a larger stronger piece of metal without leaving a mark.352 Further, testing showed that, when the secondary slide was jammed to the servo valve housing and a sufficiently high-rate force was applied on the input crank, compliance within the rudder system could allow the primary slide to overtravel and result in a reverse rudder command. Therefore, the Safety Board concludes that it is possible that, in the main rudder PCUs from the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid, or other unknown factors), the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position without leaving any obvious physical evidence and that, combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input. In one or more of the three upset events, the main rudder PCU system could have malfunctioned in some way other than the rudder reversal scenario previously described such that the rudder moved uncommanded by a pilot to its aerodynamic blowdown limit, without leaving any physical evidence, just before the pilot commanded opposite rudder. However, the Safety Board is unaware of any mechanism by which this possibility could have occurred. Such a malfunction scenario would need to include an explanation for the reduction in the rudder hinge moment on Eastwind flight 517 to be consistent with the rudder movement during that upset event. To summarize, the Safety Board’s analysis indicates that the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident involved rudder deflections that could have only been the result of inappropriate pilot input or a malfunction of the rudder system (or possibly a rotor in the case of United flight 585). The Board and Boeing were able to perform computer simulations and kinematic analyses involving these explanations that resulted in good matches of the available FDR data. Further, Safety Board testing showed that the main rudder PCU servo valve could jam, without leaving a physical mark, in a way that could lead to rudder reversal. Additionally, in all three upset events, the available human performance data comported well with a rudder system malfunction but were inconsistent with an inappropriate pilot input (or a rotor in the case of United flight 585). The statements of the Eastwind flight 517 flight crew were fully consistent with an uncommanded rudder input. In addition, the Safety Board’s and Boeing’s computer simulation and kinematic studies both indicated that, in the Eastwind flight 517 incident, the rudder moved to a position consistent with rudder reversal but inconsistent with a normally operating rudder system (given the pilots’ consistent recollections of the captain applying great force to the rudder pedals). Therefore, the Safety Board concludes that the 352 Safety Board tests found that pieces of high-strength material could jam the servo valve but that they would leave a mark as a result of the jam.

Analysis 273 Aircraft Accident Report upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides. In addition to this reversal potential, the Safety Board’s investigation revealed two other potential failure mechanisms353 within the 737 rudder control system that could result in a deflection to the rudder’s blowdown limit. One of these potential failure mechanisms is a physical jam in the rudder system input linkage (between the PCU’s input crank and body stop), preventing the main rudder PCU control valve from closing; the other is a jam of the primary to the secondary slide of the main rudder PCU servo valve combined with a jam of the secondary slide to the servo valve housing at positions other than neutral (known as a dual jam). These failure mechanisms probably did not play a role in the USAir flight 427, United flight 585, and Eastwind 517 upsets.354 Nonetheless, the failure mechanisms are cause for concern because they further illustrate the vulnerability of the 737 rudder system to jams that could produce rudder deflections and result in catastrophic consequences. 2.6 Adequacy of the Boeing 737 Rudder System Design Boeing has recently made significant design changes in the 737 rudder system, especially on the 737-NG. (The design changes on the NG series airplanes include a redesigned main rudder PCU servo valve in which the hydraulic fluid ports are spread, thus eliminating the reversal mechanism identified in the thermal tests; a redesigned yaw damper system; a hydraulic pressure limiter; a rudder input force transducer; and a new standby rudder PCU input bearing.) The 737-100 through -500 series airplanes are being retrofitted with the redesigned servo valve and a hydraulic pressure reducer designed to limit the extent to which the airplanes would be vulnerable to the rudder overpowering the roll authority of the ailerons and spoilers. As a result of ADs issued by the FAA, the redesigned main rudder PCU servo valve should eliminate the possibility of a rudder reversal from the specific circumstances 353 A third potential failure mechanism—a jam of the primary to the secondary slide with overtravel of the secondary slide—was identified as a result of testing after the July 1992 United Airlines rudder anomaly that occurred during a ground check. Although the testing determined that this mechanism could cause a rudder reversal, Boeing indicated that subsequent design changes in the servo valve eliminated this possibility. 354 The Safety Board’s postaccident examination of the USAir flight 427 rudder components revealed that the rudder system feedback control loop was probably not jammed during the accident sequence because there was no evidence of foreign material to cause such a jam and there were no nicks or gouges on the input linkage to indicate that a jamming material might have been present at impact. Further, the main rudder PCU’s external input linkage effectively covers (blocks) the opening between the input crank and the PCU body stop for the left rudder command direction, preventing jamming material from entering the area. The Safety Board considers that a dual slide jam is a less likely accident scenario than a jam of the secondary slide to the servo valve housing because the dual jam would require two extremely rare failures to exist in the servo valve at the same time.

Analysis 274 Aircraft Accident Report of a secondary slide jam to the servo valve housing combined with overtravel of the primary slide. Other ADs issued by the FAA should result in improved operational procedures and pilot training programs for addressing the more general problem of uncommanded movement of the rudder, including rudder reversal. The Safety Board concludes that, when completed, the rudder design changes to the 737 should preclude the rudder reversal failure mode that most likely occurred in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident. However, even with these changes, the 737 series airplanes (including the NG) remain susceptible to rudder system malfunctions that could be catastrophic. In its October 1997 briefings to the FAA, Boeing acknowledged that a rudder hardover on the 737-NG during the most critical phases of flight—takeoff and/or landing (which Boeing estimated as 60 to 90 seconds per flight)—would be catastrophic. Although this period of vulnerability appears limited, the takeoff and landing phases are when the pilot is most likely to use the rudder, particularly to apply a high-rate rudder input. Pilots can apply rudder inputs during the takeoff or landing ground roll as they use the rudder pedals for nosewheel steering; these inputs can occur at low altitude with a loss of engine power or during a turbulence encounter. Any malfunction resulting in uncommanded rudder motion during an engine failure or in turbulence at low altitude may be catastrophic because of the limited time, altitude, and roll control authority to regain control of the airplane. The Board is also concerned that the limited period of vulnerability to rudder malfunction is based on the assumption that a pilot will perform perfectly and that all airplane systems will perform normally. For example, according to Boeing’s fault tree analysis for the 737-NG, the combination of a jammed servo valve with a loss of engine power during takeoff would be catastrophic only during a 7-second window from V1 through liftoff, at which point roll controls could be used to help control the airplane in the event of a loss of engine power. However, Boeing’s analyses apparently assumed that a pilot would always react immediately and correctly and that the hydraulic pressure limiter would not fail. Such assumptions may not be fully warranted. The Safety Board recognizes that the potential for the specific rudder malfunction that was most likely involved in the accidents of USAir flight 427 and United flight 585 and the incident involving Eastwind flight 517 appears to be have been eliminated by the redesigned servo valve. However, the Board remains concerned that other rudder system malfunctions might potentially lead to rudder reversal or hardover conditions in the 737. The 737 has a history of rudder system-related anomalies, including numerous instances of jamming. Examples of jamming events355 include the following: • a shotpeen ball lodged in a servo valve, causing the rudder to move full right on landing; • shotpeen balls found in a servo valve during a PCU examination; 355 See section 1.18.1.1 for more details about these events.

Analysis 275 Aircraft Accident Report • contamination of a PCU by metal particles, causing the rudder pedals to jam during taxi; • internal PCU contamination and worn seals, causing the rudder to lock up on approach; • internal PCU corrosion found during a PCU overhaul; • a loose servo valve retaining nut, causing rudder binding during a flight check and reduced rates, stall, and reversals during testing; • corrosion of a standby rudder PCU, causing full left rudder deflection during taxi; • installation of an incorrect servo valve spring guide, allowing for rudder reversal when the primary slide was jammed to the secondary slide and a rapid rudder input was applied; • fluid contamination of a yaw damper coupler, causing rapid full yaw damper inputs and a severe oscillatory roll; • installation of an incorrect fastener in the summing lever bearing, resulting in a cracked bearing race; and • a jammed or restricted input arm, causing full rudder to move to its full deflection. The Safety Board is concerned that the new features of the redesigned main rudder PCU do not address all of these malfunctions, some of which are related to improper maintenance, installation, or modification. These malfunctions demonstrate that some jamming conditions resulted in a loss of rudder control. Other jamming conditions were fortuitously found during maintenance. However, because the main and standby rudder actuators receive maintenance only “on condition,” possible jamming conditions could exist and not be discovered until they result in an in-flight failure. Further, the Safety Board is concerned that, in three events during the 1980s, rudder system anomalies occurred in flight but remained unresolved during followup component testing. These events, two reports of in-flight “rudder lockup” (in 1982) and a rudder “hardover condition” (in 1984), indicated that potentially serious problems could exist and cause anomalous behavior without leaving evidence. (These events were first reported to the Safety Board by Parker in January 1999.) It is significant that the 1984 event involved a PCU that produced an in-flight hardover condition on two different aircraft within the operator’s fleet. (According to Parker, the PCU was removed and tested after the first upset event. When no fault was found, the PCU was installed on another aircraft but subsequently failed another time. Once again, no fault was found during followup testing.) The most troubling anomalies are those that could result in reverse rudder movement. During the investigation of the United flight 585 accident, many technical experts indicated that it was not possible to jam the main rudder PCU in such a way as to generate a reversal of the rudder movement. However, since that time, two such failure

Analysis 276 Aircraft Accident Report modes have been identified in the original servo valve design. The first failure mode was discovered in tests after the July 1992 main rudder PCU jam during a flight control ground check. The tests demonstrated that, when the primary slide was jammed to the secondary slide, a jam/reversal scenario was possible. (The servo valve was subsequently redesigned to preclude the possibility of this reversal failure mechanism.) The second identified failure mode was discovered during the USAir flight 427 accident investigation. Thermal tests revealed the existence of a jam/reversal scenario (which prompted another redesign of the servo valve to address this potential reversal failure mechanism.) The Safety Board notes that the two failure modes associated with reversal were identified only after many years of 737 operation and only after extensive tests and examination during the investigation of the United flight 585 and USAir flight 427 catastrophic accidents. The difficulty that was encountered in identifying these two reversal failure modes is not surprising, given the complexity of the 737 rudder system. The entire rudder system assembly—the standby rudder actuator, main rudder PCU servo valve, yaw damper, feel and centering mechanism, rudder trim actuator, torque tube, input rods, cranks, links, and summing levers—is an extremely complicated design. Further, each main rudder PCU servo valve must be individually hand-finished to pass the manufacturer’s acceptance test procedures, so no one valve is exactly the same as another. In addition to the failure modes and malfunctions of the 737 rudder system that have already been identified, the Safety Board is concerned that the causes of certain other reported 737 anomalies remain unresolved. For example, the Safety Board has reviewed many reports of 737 pilots feeling “bumps” on the rudder pedals, yet in several cases the cause has not been determined. The Safety Board’s concerns about the possibility that additional failures or malfunctions may result in uncommanded rudder motion are supported by the early service history of the redesigned servo valve currently being installed in the 737-NG and retrofitted in all other 737 series airplanes. For example, on February 19, 1999, an anomalous rudder response was noted during a rudder ground check in Seattle on a United Airlines 737 equipped with the redesigned servo valve. Both the flight crew and maintenance personnel found that greater force than usual was necessary to move the right rudder pedal. Preliminary investigative findings indicate that the anomalous rudder response was the result of a mispositioned servo valve spring guide. Maintenance records indicated that, 71 flight hours earlier, the servo valve was tested for indications of cracking of the secondary slide. (The test for cracking was performed twice on this valve. The PCU passed the acceptance test procedure after the first test. The acceptance test procedure was not performed after the second test.) This event raises concern because it suggests that it is possible to successfully install a servo valve in a PCU when the spring guide is out of place. Although such a mispositioning would have been detected if an acceptance test procedure had been performed after the second cracking test, it is troubling that the mispositioned spring guide was not detected during postmaintenance systems tests after the PCU was reinstalled on the airplane. Further, the mispositioned spring guide was not detected during the numerous flight control checks and flights that occurred before the ground check during

Analysis 277 Aircraft Accident Report which the anomalous rudder response was noted. Another troubling scenario is the possibility that the spring guide may only have been partially mispositioned at the time the PCU was reinstalled and became further mispositioned sometime later while the airplane was operating in service. A second incident involving the redesigned servo valve occurred on February 23,

1. A USAirways Metrojet 737 apparently experienced an unexplained rudder

hardover in flight. The flight crew regained normal rudder control only after it activated the standby rudder system, as prescribed in USAirways’ “Jammed or Restricted Rudder” abnormal procedure. The flight crew then made a successful emergency landing at Baltimore-Washington International Airport. This event could have resulted in an unrecoverable loss of control if it had occurred at a lower altitude or airspeed. Preliminary results of kinematic analysis and computer simulations of the Metrojet incident using FDR data indicate that the rudder traveled slowly to its blowdown limit. Examination of the rudder system (including the servo valve) to date has found no evidence of a failure or jam either in the servo valve or outside the servo valve (such as a blockage in the rudder system feedback loop) that would explain an uncommanded rudder hardover. In addition to its concern about these recent in-service events involving the redesigned servo valve, the Safety Board is also concerned that cracks have been found in the secondary slide legs of several of the redesigned servo valves and that one slide was found to be chipped.356 Boeing indicated that metal chips liberated from a crack are not likely to cause uncommanded rudder motion. However, Boeing’s conclusions are based on preliminary analyses and testing. Little is known about the initiation or progression of the cracking or the migration of chips, and there is no long-term operational experience with the redesigned servo valve to identify with certainty how this cracking is, or will be, affected by in-service conditions. The Safety Board recognizes that 737s have flown for over 92 million flight hours since the 737-100 was certificated in December 1967 and that the airplane’s accident rate is comparable to that of similar-type airplanes. Nonetheless, the Safety Board concludes that, rudder design changes to 737-NG series airplanes and the changes currently being retrofitted on the remainder of the 737 fleet do not eliminate the possibility of other potential failure modes and malfunctions in the 737 rudder system that could lead to a loss of control. Redundancy in critical flight control systems is a basic tenet in the design of commercial transport aircraft. It serves to reduce, to acceptably low levels, the probability of catastrophic outcomes from flight control malfunctions. Redundancy is especially important in the 737 rudder system because of the size and control power of the rudder (necessitated by the twin wing-mounted engine configuration of the airplane). 356 The chipped slide was found on a servo valve awaiting installation on an Olympic Airways airplane. Boeing stated that it believed the chip was caused by a rigging tool that was used to calibrate the servo valve.

Analysis 278 Aircraft Accident Report The 737 is the only air carrier airplane with two wing-mounted engines that was designed with a single-panel rudder controlled by a single actuator, albeit with a dual- concentric servo valve design. Other rudder system designs use multiple rudder surfaces and/or multiple rudder actuators. For example, the rudder system designs of the Boeing 757 and 767, which were certificated in 1982 (2 years before certification of the 737-300 series), use three actuators and do not rely on dual-concentric servo valves. In the event of a jammed or failed valve, the three-actuator design permits the failed actuator to be immediately overpowered, or “broken out,” by pilot input using the other two actuators so that the jammed or failed PCU no longer controls the movement of the flight control surface. Although Boeing has indicated that three actuators were incorporated in the 757 and 767 design to allow for features such as autopilot control of the rudder during autolanding and removal or reduction of the mass used to balance the rudder, the multiple- actuator design clearly provides an increased level of safety. Because the three actuators are fully independent (such that a valve jam would not have an adverse effect on another valve), they provide true redundancy to the 757 and 767 rudder system. It is noteworthy that the 757 and 767 have not experienced the rudder-related anomalies, incidents, or accidents that have occurred in the 737 series. Although dual-concentric servo valves are used in some other aircraft control systems for activation of ailerons or elevators, the multiple control surfaces and breakout features in those systems were designed to ensure that a jam of one control surface does not affect other control surfaces. However, these redundant systems or breakout features do not exist in the design of the 737 rudder system. Further, although the 737 rudder system has a standby rudder PCU that is independent of the main rudder PCU, that system would have to be manually activated by the flight crew in the event of a servo valve jam. If a jam were to occur close to the ground or result in an unusual attitude, the pilots could lose control of the airplane before they were able to diagnose the problem and engage the standby rudder. Therefore, redundancy in the current 737 rudder system is limited to the dual-concentric design of the main rudder PCU servo valve (and the dual load path design of the linkages in the rudder system). The October 7, 1993, incident involving a British Airways 747-400, G-BNLY, illustrates the need for greater redundancy in flight control systems that include a dual- concentric servo valve. Shortly after takeoff, about 100 feet above ground level, the airplane’s right elevator PCU reversed travel when a hydraulic pressure surge, resulting from retraction of the landing gear, caused the dual-concentric servo valve secondary slide to overtravel to the internal retract stop and the primary slide to move to the limit of the extend linkage stop. The flight crew was able to maintain control because the 747’s elevators are operated by separate PCUs and are not interconnected. As a result, the flight crew was able to move the left-side elevators upward to counter the right-side downward deflection. Given the low altitude of the occurrence, the airplane would likely have crashed if the 747’s elevators had been a single-control surface, single-actuator design.

Analysis 279 Aircraft Accident Report The Safety Board’s review of the dual-concentric servo valve design indicates that redundancy is compromised in the existing 737 main rudder PCU for several reasons. First, no method may exist by which a pilot can reliably detect the presence of a jammed primary or secondary slide within the main rudder PCU servo valve that drives the actuator.357 Second, the dual-concentric servo valve design allows for failure modes in which one slide can directly affect the operation of the other slide. Third, recent design changes do not eliminate the possibility that a maintenance error (such as the shotpeen balls that were discovered in main rudder PCU servo valves) could result in a servo valve anomaly. Last, although the dual load path is structurally redundant, it does not provide functional redundancy. The mechanical elements of the main rudder PCU external to the servo valve may be subject to jams (such as blockage between the input crank and the external body stops), possibly leading to uncommanded rudder motion that the dual- concentric design of the servo valve cannot overcome. These failure modes markedly reduce the redundancy that was intended to be provided by the dual-concentric design of the servo valve and, in effect, could result in a single-point failure in the 737 rudder PCU actuation system. Because no other full-time actuator could oppose an uncommanded rudder motion, an airplane operating with such a latent failure would require only a single additional event, such as a rapid rudder input or an additional jam, to potentially cause a rudder hardover. The Safety Board considers it important that, if a failure/anomaly were to occur within a critical flight control system (such as the 737 rudder system), the transition to a backup system should occur automatically and immediately, making the system reliably redundant. A system in which the transition to a backup system depends on the pilots’ prompt and proper perception of and reaction to the system anomaly is not reliably redundant. Accordingly, the Safety Board concludes that the dual-concentric servo valve used in all 737 main rudder PCUs is not reliably redundant. During the initial certification of the 737-100 series, FAA certification officials expressed concern about the airplane’s single-panel, single-actuator rudder system and recognized the possibility of undetected latent failures in the servo valve, thereby negating the system’s redundancy. The rudder system’s history of service difficulties (some of which still remain unresolved), particularly the servo valve’s history of jamming, validates those concerns. In October 1996, the Safety Board issued several safety recommendations to improve the existing 737 rudder system. Specifically, Safety Recommendations A-96-107, -109, -112, and -113 asked the FAA to Require the Boeing Commercial Airplane Group, working with other interested parties, to develop immediate operational measures and long- term design changes for the 737 series airplane to preclude the potential for loss of control from an inadvertent rudder hardover. Once the operational 357 Although the Safety Board considers it critical that the main rudder PCU be inspected at regular intervals, such inspections do not guarantee the detection of latent failures within the main rudder system that occur between inspections.

Analysis 280 Aircraft Accident Report measures and design changes have been developed, issue respective airworthiness directives to implement these actions. (A-96-107) Require the Boeing Commercial Airplane Group to develop and install on all new-production 737 airplanes a cockpit indicator system that indicates rudder surface position and movement. For existing 737 airplanes, when implementing the installation of an enhanced-parameter flight data recorder, require the installation of a cockpit indicator system that indicates rudder surface position and movement. (A-96-109) Require the Boeing Commercial Airplane Group to establish appropriate inspection intervals and a service life limit for the 737 main rudder power control unit. (A-96-112) Require the Boeing Commercial Airplane Group to devise a method to detect a primary or a secondary jammed slide in the 737 main rudder power control unit servo valve and ensure appropriate communication of the information to mechanics and pilots. (A-96-113) The Safety Board is disappointed that the FAA has taken no action to establish inspection intervals or a service life limit for the main rudder PCU or a method for detecting and annunciating a jammed servo valve slide to flight crews. The Board is also disappointed that the FAA has stated that a rudder position indicator would provide no practical information to the pilots. On July 15, 1997, Safety Recommendations A-96-107, -109, -112, and -113 were classified “Open—Unacceptable Response.” (See section 1.18.11 for a full discussion of the FAA’s actions and the Safety Board’s comments on those actions.) A more direct and fundamental approach to correcting the deficiencies in the 737 rudder system is necessary. Because of the complexity of the 737 rudder system (and the potential for unforeseen failure mechanisms), its lack of redundancy in the event of a single-point failure or a latent failure, and the continued absence of cues to help alert flight crews to latent failures, the Safety Board concludes that a reliably redundant rudder actuation system is needed for the 737, despite the significant improvements that have been made in the system’s design. Accordingly, the Safety Board believes that the FAA should require that all existing and future 737s have a reliably redundant rudder actuation system. This redundancy could be achieved by developing a multiple-panel rudder surface or providing multiple actuators for a single-panel rudder surface. Further, Safety Recommendations A-96-107, -109, -112, and -113 are classified “Closed—Unacceptable Action/ Superseded.” One possible way of incorporating multiple actuators into the 737 without extensive structural modification would be to modify the standby rudder system so that its actuator could be used as a second rudder actuator. Under the current 737 design, the standby rudder actuator powers the rudder by a separate hydraulic system that activates manually or automatically in the event of a hydraulic system failure. The standby rudder actuator was not intended to be used as a full-time actuator. However, design modifications might be possible to make the standby actuator an integral part of the main rudder control system. Although it is not clear whether the standby rudder system could

Analysis 281 Aircraft Accident Report be modified to provide a truly redundant rudder system on all 737 series airplanes, it is possible that such a modification might provide the needed redundancy. Another possible way to achieve redundancy in the rudder control system would be to modify it so that the standby rudder PCU would be automatically activated and the main rudder PCU would be automatically deactivated if the main rudder PCU actuator system moves the rudder without a pilot command. This redundancy could be achieved by monitoring the rudder position and comparing this position with the one being commanded by the pilot rudder pedal input. Mismatches between the two positions could then trigger a logic circuit that would command a hydraulic valve unit to automatically shift hydraulic control of the rudder from the main rudder PCU (that is, depressurize its hydraulics) to the standby rudder PCU. This action would allow the flight crew to resume normal control of the rudder using the standby rudder PCU. (The Safety Board recognizes that additional design issues must be considered so that the main rudder PCU is not deactivated when it should not be.) Further, to gain a better understanding of the potential failure modes in the 737 rudder system, the Safety Board believes that the FAA should convene an engineering test and evaluation board to conduct a failure analysis to identify potential failure modes, a component and subsystem test to isolate particular failure modes found during the failure analysis, and a full-scale integrated systems test of the 737 rudder actuation and control system to identify potential latent failures and validate operation of the system without regard to minimum certification standards and requirements in 14 CFR Part 25. Participants in the engineering test and evaluation board should include the FAA; Safety Board technical advisors; the Boeing Company; other appropriate manufacturers; and experts from other government agencies, the aviation industry, and academia. A test plan should be prepared that includes installation of original and redesigned 737 main rudder PCUs and related equipment and exercises all potential factors that could initiate anomalous behavior (such as thermal effects, fluid contamination, maintenance errors, mechanical failure, system compliance, and structural flexure). The engineering board’s work should be completed by March 31, 2000, and published by the FAA. 2.6.1 FAA Certification System In light of the safety concerns about the 737 rudder system design, the Safety Board is concerned about the FAA’s regulatory process that resulted in the certification of that system. The Safety Board concludes that, on the basis of the results of this investigation, the 737 rudder system design certificated by the FAA is not reliably redundant. Therefore, the Safety Board believes that the FAA should ensure that future transport-category airplanes certificated by the FAA provide a reliably redundant rudder actuation system. The Safety Board also questions the FAA’s interpretation of the term “normally encountered” in the context of 14 CFR Section 25.671(c)(3). Section 25.671(c)(3) states the following:

Analysis 282 Aircraft Accident Report (c) The airplane must be shown by analysis, tests, or both, to be capable of continued safe flight and landing after any of the following failures or jamming in the flight control system and surfaces (including trim, lift, drag, and feel systems), within the normal flight envelope, without requiring exceptional piloting skill or strength. Probable malfunctions must have only minor effects on control system operation and must be capable of being readily counteracted by the pilot.

(3) Any jam in a control position normally encountered during takeoff, climb, cruise, normal turns, descent, and landing unless the jam is shown to be extremely improbable, or can be alleviated. A runaway of a flight control to an adverse position and jam must be accounted for if such runaway and subsequent jamming is not extremely improbable. During certification of the 737-NG series airplanes, the FAA concluded that a normally encountered control position for the rudder would be a maximum of 2.5°. However, this interpretation seems unrealistic in light of the rudder’s ability to travel as much as 26° in either direction and its criticality in countering a loss of engine power or crosswind gust on takeoff or landing. (It is unclear how a different interpretation would have affected the outcome of the 737-NG certification process.) Such a narrow interpretation may well reduce the level of protection that should be provided by a showing of compliance with this rule. Although the rudder may operate for much of the time in a narrow range, a jam could become critical during those times when deflections beyond this narrow range are necessary. The Safety Board questions whether it is appropriate to define “normally encountered” so narrowly and even whether it is appropriate to include that phrase in 14 CFR Section 25.671. The Board agrees with the Critical Design Review team’s position on this issue. The team stated that “if a control position is possible, it is there for a purpose, and the pilot can use that control authority.” In October 1996, the Safety Board issued Safety Recommendation A-96-108, which asked the FAA to Revise 14 CFR Section 25.671 to account for the failure or jamming of any flight control surface at its design-limited deflection. Following this revision, reevaluate all transport-category aircraft and ensure compliance with the revised criteria. In response, the FAA indicated that the last sentence of 14 CFR Section 25.671(c)(3) already required that a jam of a flight control surface at its design-limited deflection be accounted for unless such a jam is extremely improbable. However, the Safety Board is concerned that the rule does not appear to require any analysis of failure or jamming of flight controls in positions beyond those normally encountered but short of a full deflection. For example, the FAA’s finding that the 737-NG series airplanes complied with this rule was apparently based on Boeing’s assertion that rudder position jams in a normally encountered position were controllable and that rate jams resulting in a rudder hardover were extremely improbable. There is no indication that Boeing or the FAA considered jams in any intermediate position.

Analysis 283 Aircraft Accident Report The Safety Board concludes that transport-category airplanes should be shown to be capable of continued safe flight and landing after a jammed flight control in any position unless the jam can be shown to be extremely improbable. Accordingly, the Safety Board believes that the FAA should amend 14 CFR Section 25.671(c)(3) to require that transport-category airplanes be shown to be capable of continued safe flight and landing after jamming of a flight control at any deflection possible, up to and including its full deflection, unless such a jam is shown to be extremely improbable. Because the Safety Board recognizes that the language of Safety Recommendation A-96-108 may not have adequately expressed this concern, that recommendation is classified “Closed— Reconsidered/Superseded.” 2.7 Flight Crew Procedures and Training 2.7.1 Unusual Attitude Training for Air Carrier Pilots Before the USAir flight 427 accident, the Safety Board had issued a series of safety recommendations over a 24-year period, asking the FAA to require air carriers to train pilots in recoveries from unusual flight attitudes. Throughout this period, the Safety Board was generally not satisfied with the FAA’s responses to these recommendations; specifically, the Board disagreed with the FAA’s responses that cited the inadequacy of flight simulators as a reason for not providing pilots with the requested training. However, after the USAir flight 427 accident and the October 31, 1994, ATR-72 accident involving Simmons Airlines flight 4184 near Roselawn, Indiana,358 the FAA issued guidance to air carriers, acknowledging the value of flight simulator training in unusual attitude recoveries and encouraging air carriers to voluntarily provide this training to their pilots. The voluntary training programs that were implemented by many air carriers (including USAir) have been excellent. In October 1996, the Safety Board issued Safety Recommendation A-96-120, asking the FAA to Require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems, and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements. The Safety Board’s concerns about the role of automatic flight control systems in unusual attitude situations were validated when Comair flight 3272, an Embraer 120RT, crashed on January 9, 1997, near Monroe, Michigan. The investigation determined that an engaged autopilot masked the most salient cues to the flight crew of a developing uncommanded rolling moment.359 Similarly, the challenge posed to pilots by flight 358 For more information on this accident, see the discussion of Safety Recommendation A-96-120 in section 1.18.11.5. 359 National Transportation Safety Board. 1998. In-Flight Icing Encounter and Uncontrolled Collision with Terrain, Comair Flight 3272, Embraer EMB-120RT, N265CA, Monroe, Michigan, January 9, 1997. Aircraft Accident Report NTSB/AAR-98/04. Washington, DC.

Analysis 284 Aircraft Accident Report control malfunctions was demonstrated by the circumstances of the accidents involving USAir flight 427 and United flight 585, the incident involving Eastwind Airlines flight 517 (which involved uncommanded rudder movement), and the accident involving Simmons Airlines flight 4184 (which involved uncommanded aileron movement). The Safety Board recognizes the value of air carrier voluntary unusual attitude training programs. However, all air carriers may not be implementing such a program.360 Further, the FAA has not addressed flight control malfunctions (such as uncommanded rudder surface movements) in its guidance material for air carrier unusual attitude training programs. In addition, the unusual attitude training tool developed in 1998 by industry, labor unions, and the FAA does not include guidance on flight control malfunctions. In January 1997, the FAA informed the Safety Board that it was considering issuance of a notice of proposed rulemaking (NPRM) to require air carriers to conduct unusual attitude training. However, as of March 1999, the FAA had not issued the NPRM. The FAA indicated, in informal correspondence with the Safety Board, that it might include an unusual attitude training requirement as part of a planned general revision to the regulations governing air carrier pilot training (14 CFR Part 121, Subparts N and O). The Safety Board is concerned that the FAA has not yet taken the necessary regulatory action to require unusual attitude training for air carrier pilots. The Board is also concerned that the guidance and programs developed to date do not include scenarios involving flight control malfunctions. Accordingly, because of the lack of progress toward requiring for air carrier pilots unusual attitude training that addresses flight control malfunctions, such as uncommanded flight control surface movements, Safety Recommendation is classified A-96-120 “Open—Unacceptable Response.” The Safety Board urges the FAA to take expeditious action to require such unusual attitude training. 2.7.2 Unusual Attitude Training for Boeing 737 Pilots At the time of the USAir flight 427 accident, no air carrier training programs were specifically aimed at training 737 pilots to recognize and address a rudder jam or reversal. The guidance available at that time from Boeing advised pilots, as a first consideration, to maintain or regain full control of the airplane. Specifically, the guidance advised pilots to counter unwanted roll tendencies from a malfunctioning rudder with the application of up to full aileron control inputs. However, the guidance did not advise pilots that, at some airspeeds, an uncommanded full rudder input could not be successfully opposed by full wheel (aileron and spoiler) inputs and that a reduction in the airplane’s angle-of-attack could improve the effectiveness of the roll controls relative to the effectiveness of the rudder. Boeing’s guidance for relieving a jammed rudder informed pilots only that they should use maximum force to overpower the jam and specifically warned pilots against turning off flight control switches “unless the faulty control was positively identified.” 360 According to the FAA’s January 13, 1999, letter to the Safety Board’s Director of the Office of Aviation Safety, at least 13 U.S.-based air carriers (including USAir) had implemented special events training (SET) programs by mid-1996. The letter indicated that “other carriers…as well as training center operators…were initiating SET programs.”

Analysis 285 Aircraft Accident Report No additional guidance was provided about the effects of flight control switch selections on rudder jam conditions. The Safety Board recognizes that, even if unusual attitude training specifically targeted at the rudder reversal situation were provided to pilots on a recurrent basis, a rudder reversal is such a confusing and distracting event that no training could completely prepare pilots to diagnose and respond to (in the few seconds that would be available) a rudder reversal that occurred without warning. Consequently, the Safety Board cannot be certain that the pilots of USAir flight 427 would have recovered control of the airplane if they had received such training. However, the Safety Board concludes that pilots would be more likely to recover successfully from an uncommanded rudder reversal if they were provided the necessary knowledge, procedures, and training to counter such an event. In December 1996, the FAA issued AD 96-26-07, requiring that the 737 Airplane Flight Manual be revised to include procedures for maintaining control of an airplane during an uncommanded yaw or roll or a jammed or restricted rudder condition. In response to this AD, Boeing established procedures in February 1997 to provide an effective means of regaining control of the airplane under most (but not all) flight conditions.361 The “Uncommanded Yaw or Roll” procedure establishes the actions to be performed by pilots immediately, from memory, to halt the uncommanded motion of the airplane. The “Jammed or Restricted Rudder” procedure establishes a means of handling a variety of rudder malfunctions (including rudder reversal) in a systematic manner. These procedures were subsequently added to Boeing’s 737 Operations Manual and adopted by U.S. air carriers. The Safety Board recognizes that the hydraulic pressure reducer that is being retrofitted on earlier series 737 models, and the hydraulic pressure limiter being installed in the NG models, should provide 737 flight crews with a greater margin of controllability and additional response time for executing these required procedures. However, the ability to recover from an uncommanded yaw or roll or a jammed or restricted rudder (including a rudder reversal), within the time that would be available, requires training and practice in executing the specific procedures. In October 1996, the Safety Board issued Safety Recommendation A-96-118, asking the FAA to Require the Boeing Commercial Airplane Group, working with other interested parties, to develop procedures that require 737 flight crews to disengage the yaw damper in the event of an uncommanded yaw upset as a memorized or learned action. Once the procedures are developed, require operators to implement these procedures. The Safety Board had been concerned that the procedures described in AD 96-26-07 did not include disengagement of the yaw damper as an action to be performed immediately from memory. The Board’s concern was based on the relatively 361 During the comment period for AD 96-26-07, the Safety Board expressed its concerns to the FAA that these procedures might not be adequate if a rudder reversal were to occur at a low altitude, especially with an engine failure during takeoff. See section 2.5 for a discussion of the flight regimes in which flight crew action could not prevent an accident in the event of a rudder jam/reversal malfunction.

Analysis 286 Aircraft Accident Report frequent occurrence (compared with other rudder system malfunctions) of yaw damper malfunctions in the 737, which might lead pilots to unnecessarily perform the actions in the “Jammed or Restricted Rudder” procedure. The Safety Board’s review of the February 1997 changes to Boeing’s 737 Operations Manual, and air carriers’ adoption of those provisions, indicate that U.S. air carriers are currently providing flight crews with an immediate action procedure that should effectively handle yaw damper system malfunctions. Therefore, Safety Recommendation A-96-118 is classified “Closed— Acceptable Action.” The Safety Board is concerned that the “Jammed or Restricted Rudder” procedure established a pilot’s ability to “center” the rudder pedals (that is, achieve a neutral rudder pedal position) as the criterion for successful resolution of a rudder malfunction. Specifically, the Board is concerned that, in a rudder reversal situation, compliance in the rudder system could allow the rudder pedals to reach the neutral position while the rudder surface remains deflected to the blowdown limit. As a result, the Safety Board concludes that a neutral rudder pedal position is not a valid indicator that a rudder reversal in the 737 has been relieved. Therefore, the Safety Board believes that the FAA should revise AD 96-26-07 so that procedures for addressing a jammed or restricted rudder do not rely on the pilots’ ability to center the rudder pedals as an indication that the rudder malfunction has been successfully resolved, and require Boeing and U.S. operators of 737s to amend their Airplane Flight Manuals and Operations Manuals accordingly. Although the procedures specified by AD 96-26-07 did not establish a requirement for air carriers to provide training to flight crews, Flight Standards Information Bulletin (FSIB) 98-03, issued in January 1998, directed the FAA’s principal operations inspectors to require air carriers to “amend their training programs to provide initial and recurrent training in the recognition of and recovery from unusual attitudes and upsets caused by reverse rudder response.” However, neither AD 96-26-07 nor FSIB 98-03 provided specific guidance on how training for these procedures was to be accomplished. In its comments on the NPRM for AD 96-26-07, the Safety Board expressed its concerns that 737 pilots needed to be explicitly trained on a regular basis in the execution of the new procedures. In February 1997, the Safety Board issued Safety Recommendation A-97-18, asking the FAA to Require the Boeing Commercial Airplane Group to develop operational procedures for 737 flight crews that effectively deal with a sudden uncommanded movement of the rudder to the limit of its travel for any given flight condition in the airplane’s operational envelope, including specific initial and periodic training in the recognition of and recovery from unusual attitudes and upsets caused by reverse rudder response. Once the procedures are developed, require 737 operators to provide this training to their pilots. Although the new procedures are well documented in FAA, Boeing, and air carrier publications, 3 of 12 U.S. air carrier operators of the 737 contacted by the Safety Board in July 1998 were not providing any simulator training to their pilots on these procedures. (These 3 air carriers accounted for about 20 percent of the 1,070 total 737 airplanes operated by the 12 air carriers). Further, of the nine air carriers that were providing such

Analysis 287 Aircraft Accident Report training, only five had specified in their training manuals that the procedures should be performed by students during simulator training at least to the point of selecting the hydraulic system B flight control switch to the standby rudder position. (These 5 air carriers accounted for about 40 percent of the total 737 airplanes operated by the air carriers.) Thus, pilots for more than one-half of U.S. air carrier operators of the 737 airplanes (7 of the 12 air carriers included in the Board’s survey) were not being provided the opportunity to practice the responses to a jammed or restricted rudder (including a rudder reversal) that might be most effective in relieving or overcoming the effects of a jammed main rudder PCU servo valve. Further, although Boeing has published and disseminated information about the crossover airspeed phenomenon,362 only one-half of the 12 air carriers contacted by the Safety Board in July 1998 were providing 737 flight crews with a demonstration of crossover airspeed in a flight simulator. Moreover, the training materials for only one- third of the 12 air carriers (accounting for about 72 percent of the 737 airplanes) required a demonstration of the crossover airspeed to pilots in the flaps 1 configuration (in which the airplane can reach the crossover airspeed before the 1 G stickshaker speed). Thus, pilots for as many as two-thirds of the U.S. air carrier operators of the 737 were not being provided experience that demonstrated the inability to control the airplane at some speeds and configurations by using only the roll controls during a rudder hardover condition. The Safety Board is also concerned that flight tests conducted as part of the USAir flight 427 investigation showed that the simulator package developed by Boeing and implemented in the air carriers’ training simulators did not adequately simulate the crossover airspeed phenomenon. In addition, the Safety Board is concerned that Boeing has not updated its existing simulator package, even though the data needed to do so is readily available as a result of these flight tests. The Safety Board concludes that the training being provided to many 737 flight crews on the procedures for recovering from a jammed or restricted rudder (including a rudder reversal) is inadequate. Therefore, the Safety Board believes that the FAA should require all 14 CFR Part 121 air carrier operators of the 737 to provide their flight crews with initial and recurrent flight simulator training in the “Uncommanded Yaw or Roll” and “Jammed or Restricted Rudder” procedures in Boeing’s 737 Operations Manual. The training should demonstrate the inability to control the airplane at some speeds and configurations by using the roll controls (the crossover airspeed phenomenon) and include performance of both procedures in their entirety. Because of this new safety recommendation and the FAA’s failure to fully address Safety Recommendation A-97-18, the earlier recommendation is classified “Closed—Unacceptable Response/Superceded.” In addition, the Safety Board believes that the FAA should require Boeing to update its 737 simulator package to reflect flight test data on crossover airspeed and then require all operators of the 737 to incorporate these changes in their simulators used for 737 pilot training. 362 Boeing discussed crossover airspeed extensively in the July 1997 Flight Operations Review article entitled “737 Directional Control.” (See section 1.18.10.2.3.)

Analysis 288 Aircraft Accident Report Finally, the Safety Board is extremely concerned that, more than 4 years after the USAir flight 427 accident, two smaller U.S. 737 operators (accounting for 16 of the 1,070 total 737 airplanes operated by the 12 air carriers) were continuing to use minimum maneuvering speed schedules that permit operation of the 737 in the flaps 1 configuration at airspeeds (158 and 164 knots) that are as much as 30 knots slower than the 1 G crossover airspeed. (The FAA had accepted the use of these minimum maneuvering speed schedules.) In addition, the Board is concerned that the Boeing-recommended block maneuvering speeds schedule specifies 190 knots, which only slightly exceeds the 1 G crossover airspeed, as the minimum speed for a 737 operating at a gross weight of 110,000 pounds in the flaps 1 configuration. Only one-third of the 12 U.S. 737 air carrier operators contacted by the Safety Board in July 1998 (accounting for 66 percent of the 737 airplanes) actively promoted the practice of adding 10 knots to the 737 block maneuvering speeds (for which Boeing has expressed neither support nor disapproval). The Safety Board concludes that the continued use by air carriers of airspeeds below the existing block maneuvering speed schedule presents an unacceptable hazard and that the existing block maneuvering speed for the flaps 1 configuration provides an inadequate margin of controllability in the event of a rudder hardover. Therefore, the Safety Board believes that the FAA should evaluate the 737’s block maneuvering speed schedule to ensure the adequacy of airspeed margins above crossover airspeed for each flap configuration, provide the results of the evaluation to air carrier operators of the 737 and the Safety Board, and require Boeing to revise block maneuvering speeds to ensure a safe airspeed margin above crossover airspeed. 2.8 Flight Data Recorder Capabilities The airplanes involved in the United flight 585 and USAir flight 427 accidents were required by existing regulations (14 CFR Section 121.343) to have FDRs that recorded 5 and 11 parameters, respectively.363 If these airplanes had been equipped with FDRs with additional parameters, that information would have undoubtedly allowed quick identification of critical control surface movements and their sources and other airplane system conditions that could have been involved in the loss of airplane control. Thus, investigators would have been able to more quickly rule out certain factors, when warranted, and focus on other areas. The Safety Board has addressed the importance of improving the quality and amount of data recorded by FDRs in several recent aviation accident reports and safety recommendations. In February 1995, the Safety Board issued urgent Safety Recommendation A-95-25, urging the FAA to Require that each Boeing 737 airplane operated under 14 CFR Parts 121 or 125 be equipped, by December 31, 1995, with a flight data recorder system that records, at a minimum, the parameters required by current regulations 363 As previously discussed (see section 1.11.2), although existing regulations required the FDR that was installed on the USAir flight 427 airplane to record 11 parameters, the accident airplane’s FDR recorded 13 parameters.

Analysis 289 Aircraft Accident Report applicable to that airplane plus the following parameters (recorded at the sampling rates specified in "Proposed Minimum FDR Parameter Requirements for Airplanes in Service”): lateral acceleration; flight control inputs for pitch, roll, and yaw; and primary flight control surface positions for pitch, roll, and yaw.364 The FAA indicated that it agreed with the intent of the Safety Board’s recommendation. However, the FAA did not meet the recommendation’s proposed December 31, 1995, retrofit completion date, characterizing it as “an extremely aggressive schedule.” The Safety Board repeatedly expressed its disappointment with the FAA’s lack of action and urged the FAA to act promptly because of the criticality of the issue and the persisting reports of unexplained 737 in-flight disturbances. More than 1 year after the FAA’s response to Safety Recommendation A-95-25 (and almost 6 months after the recommended December 31, 1995, FDR retrofit completion date), the Eastwind flight 517 incident occurred. The Safety Board’s July 1, 1996, letter to the FAA indicated the Board’s belief that the Eastwind incident could have become the third fatal 737 upset accident for which inadequate FDR information would have hampered an investigation. Because the FAA had not acted in the time frame proposed by the Safety Board in its urgent safety recommendation, the FDR recordings from the Eastwind incident airplane did not provide sufficient data to identify rudder surface and rudder pedal movements. If this information had been available, investigators would have been better able to understand the Eastwind incident and, more importantly, would likely have gained significant additional insight into previous upset events, such as the USAir flight 427 and United flight 585 accidents. In 1996, Safety Recommendation A-95-25 was placed on the Safety Board’s list of Most Wanted Safety Improvements. In its July 9, 1997, final rule, the FAA required that new and existing transport- category airplanes “be equipped to record the parameters recommended by the Board” with final compliance required by August 19, 2002. Although the Safety Board considered the FAA’s action a major improvement over the former FDR requirements, the Board disagreed that the FAA’s requirements for retrofitting existing airplanes included all parameters recommended by the Board in its urgent safety recommendation.365 Further, the Safety Board was disappointed with the extended time frame and incremental increases allowed for compliance with the new FDR requirements, especially for 737 airplanes. In its July 22, 1997, letter to the Safety Board, the FAA stated that the retrofit modification should be accomplished “at the earliest practicable time” but no later than the next heavy maintenance check after August 18, 1999. During the Safety Board’s investigation of the February 23, 1999, Metrojet upset event, the Board learned that the incident airplane was scheduled for a heavy maintenance check in March 1999 but was 364 See section 1.18.11.4 for more information on previous FDR safety recommendations. 365 The Safety Board recommended (but the FAA did not require) that airplanes manufactured before 1991 record data for the following parameters: pitch trim; thrust reverser position; flaps, leading edge slats, and ground spoiler positions; angle-of-attack; and outside and total air temperatures.

Analysis 290 Aircraft Accident Report not scheduled to receive the required FDR upgrade until its heavy maintenance check in March 2001. Therefore, the Safety Board is concerned that some air carriers may have disregarded the directive to accomplish the upgrade at the earliest practicable time and may have interpreted the rule to require no action until after August 18, 1999. However, the Safety Board notes that at least one U.S. 737 operator (Southwest Airlines) has aggressively pursued the FDR upgrade within its fleet and anticipates having all its airplanes’ FDRs upgraded by December 1999 (about 1½ years before the modification completion date mandated by the FAA). As previously discussed, several 737 rudder-related events have been associated with the yaw damper system, which moves the rudder without any corresponding movement of the flight crew’s rudder pedals. To adequately monitor this system, FDRs would have to record several parameters that are not required by the FAA’s July 1997 final rule regarding upgraded FDRs. By documenting the yaw damper’s operation (command voltage to the rudder and on/off discrete indication) and the resultant rudder surface movement, a yaw damper event could quickly be distinguished from a flight crew input or a rudder anomaly. Additionally, upgraded FDRs are expected to record the pilots’ flight control inputs and the flight control surface movements. However, the FAA is not requiring the FDRs on existing airplanes, including 737s,366 and those manufactured before August 2002 to be upgraded to record the pilots’ flight control input forces. The Safety Board considers documentation of pilot flight control input forces to be critical in determining the pilots’ role in a flight control-related event and notes that such documentation appears especially critical in the case of the 737. If pilot flight control input forces had been recorded for the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes, these investigations would have been resolved more promptly, and actions to prevent future similar events would have been hastened. Parameters such as pitch trim, thrust reverser position, and leading and trailing edge flap positions would also provide potentially valuable information to accident investigators. The Safety Board issued Safety Recommendations A-95-26 and A-95-27 in February 1995, stating that FDRs installed on all airplanes operated under 14 CFR Parts 121, 125, or 135 should be upgraded to record these parameters. Although such an upgrade would be easily accomplished on airplanes equipped with flight data acquisition units (FDAU), the FAA, to date, has not required that affected airplanes be upgraded accordingly. The Safety Board concludes that the FDR upgrade modifications required by the FAA for existing airplanes are inadequate because they do not require the FDR to be modified to record yaw damper command voltage; yaw damper and standby rudder on/off 366 Title 14 CFR Section 25.1459(e) states that “any novel or unique design or operational characteristics of the aircraft shall be evaluated to determine if any dedicated parameters must be recorded on flight recorders in addition to or in place of existing requirements.” The Safety Board notes that the 737’s unique rudder actuation system design and rudder system service history justify the recording of additional parameters on 737 FDRs.

Analysis 291 Aircraft Accident Report discrete indications; pitch trim; thrust reverser position; leading and trailing edge flap positions; and pilot flight control input forces for control wheel, control column, and rudder pedals. Further, the Safety Board concludes that, on the basis of the rudder-related anomalies discussed in this report, FDR documentation of yaw damper command voltage; yaw damper and standby rudder on/off discrete indications; and pilot flight control input forces for control wheel, control column, and rudder pedals is especially important in the case of the 737, and these parameters should be sampled on 737 airplanes at frequent intervals to provide optimal documentation. Therefore, the Safety Board believes that the FAA should require that all 737 airplanes operated under 14 CFR Parts 121 or 125 that currently have a FDAU be equipped, by July 31, 2000, with an FDR system that records, at a minimum, the parameters required by FAA Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). Further, the Safety Board believes that the FAA should require that all 737 airplanes operated under 14 CFR Parts 121 or 125 that are not equipped with a FDAU be equipped, at the earliest time practicable but no later than August 1, 2001, with an FDR system that records, at a minimum, the parameters required by FAA Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). The Safety Board notes that 737 flight crews continue to report anomalous rudder behaviors, and it is possible that another catastrophic 737 upset-related accident could occur. If such an accident occurs before August 19, 2001, it is likely that the data recorded by the accident airplane’s FDR will not be sufficient for investigators to readily identify the events leading to the upset and develop corrective actions to prevent future similar accidents. Therefore, the Safety Board concludes that the FAA’s failure to require timely and aggressive action regarding enhanced FDR recording capabilities, especially on 737 airplanes, has significantly hampered the prompt identification of potentially critical safety-of-flight conditions and the development of safety recommendations to prevent future catastrophic accidents.

Conclusions 292 Aircraft Accident Report 3. Conclusions 3.1 Findings Note: Because the Safety Board’s analysis of the USAir flight 427 accident also included analysis of the United flight 585 accident and the Eastwind flight 517 incident, some of the findings pertain to these two events. 1. The USAir flight 427 flight crew was properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. 2. The USAir flight 427 accident airplane was equipped, maintained, and operated in accordance with applicable Federal regulations. The airplane was dispatched in accordance with Federal Aviation Administration- and industry-approved practices. 3. All of USAir flight 427’s doors were closed and locked at impact. 4. USAir flight 427 did not experience an in-flight fire, bomb, explosion, or structural failure. 5. A midair collision with other air traffic, a bird strike, clear air turbulence, or other atmospheric phenomena were not involved in the USAir flight 427 accident. 6. Asymmetrical engine thrust reverser deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing uncommanded flight control movements, yaw damper malfunctions, and a rudder cable pull or break were not factors in the USAir flight 427 accident. 7. Although USAir flight 427 encountered turbulence from Delta flight 1083’s wake vortices, the wake vortex encounter alone would not have caused the continued heading change that occurred after 1903:00. 8. About 1903:00, USAir flight 427’s rudder deflected rapidly to the left and reached its left aerodynamic blowdown limit shortly thereafter. 9. Analysis of the human performance data shows that it is likely that the first officer made the first pilot control response to the upset event and manipulated the flight controls during the early stages of the accident sequence; although it is likely that both pilots manipulated the flight controls later in the accident sequence, it is unlikely that the pilots simultaneously manipulated the controls (possibly opposing each other) during the critical period in which the airplane yawed and rolled to the left.

Conclusions 293 Aircraft Accident Report

1. Analysis of the human performance data (including operational factors) does not

support a scenario in which the flight crew of USAir flight 427 applied and held a full left rudder input until ground impact more than 20 seconds later.

1. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors) from the USAir flight 427 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

1. The flight crew of USAir flight 427 recognized the initial upset in a timely manner

and took immediate action to attempt a recovery but did not successfully regain control of the airplane.

1. The flight crew of USAir flight 427 could not be expected to have assessed the flight

control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.

1. It is very unlikely that the loss of control in the United flight 585 accident was the

result of an encounter with a mountain rotor.

1. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors) from the United Airlines flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

1. The flight crew of United flight 585 recognized the initial upset in a timely manner

and took immediate action to attempt a recovery but did not successfully regain control of the airplane.

1. The flight crew of United flight 585 could not be expected to have assessed the flight

control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.

1. Training and piloting techniques developed as a result of the USAir flight 427

accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions of the flight envelope; such training was not yet developed and available to the flight crews of USAir flight 427 or United flight 585.

1. During the Eastwind flight 517 incident, the rudder reversed, moving to its right

blowdown limit when the captain commanded left rudder, consistent with a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

Conclusions 294 Aircraft Accident Report

1. It is possible that, in the main rudder power control units from the USAir flight 427,

United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid, or other unknown factors), the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position without leaving any obvious physical evidence and that, combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input.

1. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most

likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides.

1. When completed, the rudder system design changes to the Boeing 737 should

preclude the rudder reversal failure mode that most likely occurred in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident.

1. Rudder design changes to Boeing 737-next-generation series airplanes and the

changes currently being retrofitted on the remainder of the Boeing 737 fleet do not eliminate the possibility of other potential failure modes and malfunctions in the Boeing 737 rudder system that could lead to a loss of control.

1. The dual-concentric servo valve used in all Boeing 737 main rudder power control

units is not reliably redundant.

1. A reliably redundant rudder actuation system is needed for the Boeing 737, despite

significant improvements made in the system’s design.

1. The results of this investigation have disclosed that the Boeing 737 rudder system

design certificated by the Federal Aviation Administration is not reliably redundant.

1. Transport-category airplanes should be shown to be capable of continued safe flight

and landing after a jammed flight control in any position unless the jam can be shown to be extremely improbable.

1. Pilots would be more likely to recover successfully from an uncommanded rudder

reversal if they were provided the necessary knowledge, procedures, and training to counter such an event.

1. A neutral rudder pedal position is not a valid indicator that a rudder reversal in the

Boeing 737 has been relieved.

1. The training being provided to many Boeing 737 flight crews on the procedures for

recovering from a jammed or restricted rudder (including a rudder reversal) is inadequate.

Conclusions 295 Aircraft Accident Report

1. The continued use by air carriers of airspeeds below the existing block maneuvering

speed schedule presents an unacceptable hazard, and the existing block maneuvering speed for the flaps 1 configuration provides an inadequate margin of controllability in the event of a rudder hardover.

1. The flight data recorder (FDR) upgrade modifications required by the Federal

Aviation Administration for existing airplanes are inadequate because they do not require the FDR to be modified to record yaw damper command voltage; yaw damper and standby rudder on/off discrete indications; pitch trim; thrust reverser position; leading and trailing edge flap positions; and pilot flight control input forces for control wheel, control column, and rudder pedals.

1. On the basis of the rudder-related anomalies discussed in this report, flight data

recorder documentation of yaw damper command voltage; yaw damper and standby rudder on/off discrete indications; and pilot flight control input forces for control wheel, control column, and rudder pedals is especially important in the case of the 737, and these parameters should be sampled on 737 airplanes at frequent intervals to provide optimal documentation.

1. The Federal Aviation Administration’s failure to require timely and aggressive action

regarding enhanced flight data recorder recording capabilities, especially on Boeing 737 airplanes, has significantly hampered investigators in the prompt identification of potentially critical safety-of-flight conditions and in the development of recommendations to prevent future catastrophic accidents. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the USAir flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

Recommendations 296 Aircraft Accident Report 4. Recommendations As a result of the investigation of the USAir flight 427 accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Require that all existing and future Boeing 737s have a reliably redundant rudder actuation system. (A-99-20) Convene an engineering test and evaluation board to conduct a failure analysis to identify potential failure modes, a component and subsystem test to isolate particular failure modes found during the failure analysis, and a full-scale integrated systems test of the Boeing 737 rudder actuation and control system to identify potential latent failures and validate operation of the system without regard to minimum certification standards and requirements in 14 Code of Federal Regulations Part 25. Participants in the engineering test and evaluation board should include the Federal Aviation Administration (FAA); National Transportation Safety Board technical advisors; the Boeing Company; other appropriate manufacturers; and experts from other government agencies, the aviation industry, and academia. A test plan should be prepared that includes installation of original and redesigned Boeing 737 main rudder power control units and related equipment and exercises all potential factors that could initiate anomalous behavior (such as thermal effects, fluid contamination, maintenance errors, mechanical failure, system compliance, and structural flexure). The engineering board’s work should be completed by March 31, 2000, and published by the FAA. (A-99-21) Ensure that future transport-category airplanes certificated by the Federal Aviation Administration provide a reliably redundant rudder actuation system. (A-99-22) Amend 14 Code of Federal Regulations Section 25.671(c)(3) to require that transport-category airplanes be shown to be capable of continued safe flight and landing after jamming of a flight control at any deflection possible, up to and including its full deflection, unless such a jam is shown to be extremely improbable. (A-99-23) Revise Airworthiness Directive 96-26-07 so that procedures for addressing a jammed or restricted rudder do not rely on the pilots’ ability to center the rudder pedals as an indication that the rudder malfunction has been successfully resolved, and require Boeing and U.S. operators of Boeing 737s to amend their Airplane Flight Manuals and Operations Manuals accordingly. (A-99-24)

Recommendations 297 Aircraft Accident Report Require all 14 Code of Federal Regulations Part 121 air carrier operators of the Boeing 737 to provide their flight crews with initial and recurrent flight simulator training in the “Uncommanded Yaw or Roll” and “Jammed or Restricted Rudder” procedures in Boeing’s 737 Operations Manual. The training should demonstrate the inability to control the airplane at some speeds and configurations by using the roll controls (the crossover airspeed phenomenon) and include performance of both procedures in their entirety. (A-99-25) Require Boeing to update its Boeing 737 simulator package to reflect flight test data on crossover airspeed and then require all operators of the Boeing 737 to incorporate these changes in their simulators used for Boeing 737 pilot training. (A-99-26) Evaluate the Boeing 737’s block maneuvering speed schedule to ensure the adequacy of airspeed margins above crossover airspeed for each flap configuration, provide the results of the evaluation to air carrier operators of the Boeing 737 and the National Transportation Safety Board, and require Boeing to revise block maneuvering speeds to ensure a safe airspeed margin above crossover airspeed. (A-99-27) Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations Parts 121 or 125 that currently have a flight data acquisition unit be equipped, by July 31, 2000, with a flight data recorder system that records, at a minimum, the parameters required by Federal Aviation Administration Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-28) Require that all Boeing 737 airplanes operated under 14 Code of Federal Regulations Parts 121 or 125 that are not equipped with a flight data acquisition unit be equipped, at the earliest time practicable but no later than August 1, 2001, with a flight data recorder system that records, at a minimum, the parameters required by Federal Aviation Administration Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off discrete; and control wheel, control column, and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice per second). (A-99-29)

298 Aircraft Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD Member John J. Goglia did not participate. March 24, 1999 James E. Hall Chairman Robert T. Francis Vice Chairman John A. Hammerschmidt Member George W. Black Member

Appendixes 299 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing Investigation The National Transportation Safety Board was initially notified of this accident about 1920 on September 8, 1994. A full go-team was assembled that evening, but because of the lack of availability of a Federal Aviation Administration (FAA) airplane or commercial flights, the team did not depart the Washington, D.C., area until the morning of September 9, 1994. The team arrived at the accident site about 0730. The following investigative teams were formed: Operations, Human Performance, Aircraft Structures, Aircraft Systems, Powerplants, Maintenance Records, Air Traffic Control, Survival Factors, Aircraft Performance, Meteorology, and Witnesses. Specialists were also assigned to stand by in the Safety Board laboratories for the cockpit voice recorder and flight data recorder. Because of the magnitude of the accident, two Safety Board investigators were assigned to most groups on scene. Accompanying the team were Board Member Carl Vogt, his special assistant, the Deputy Managing Director, and a representative of the Safety Board’s Public Affairs office. Parties to the investigation included the FAA; Boeing Commercial Airplane Group; Air Line Pilots Association; USAir, Inc.; National Air Traffic Controllers Association; CFM International; AVIALL; International Association of Machinists and Aerospace Workers; Transportation Workers Union No. 545; the Association of Flight Attendants; Parker Berta Aerospace/Parker Hannifin Corporation; and Monsanto Company. Assistance was also provided by the Federal Bureau of Investigation, Armed Forces Institute of Pathology, Hopewell Township, Pennsylvania State Police, Pennsylvania Emergency Management Agency, the Beaver County Coroner’s Office, and emergency response personnel from Beaver and Allegheny Counties. Additionally, air safety investigators from the aircraft accident investigation authorities from the United Kingdom, France, Denmark, Australia, and Canada participated in the investigation as technical observers in accordance with prior arrangements for such participation. Public Hearing Two sessions of a public hearing were conducted for this accident. The first session was held on January 23 through 27, 1995. The second session was held on November 15 through 17, 1995. Parties to the public hearing were the FAA, Boeing, Air Line Pilots Association, USAir, International Association of Machinists and Aerospace Workers, Parker Berta Aerospace/Parker Hannifin Corporation, and Monsanto Company.

Appendixes 300 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is a transcript of the Fairchild A-100 cockpit voice recorder (CVR) installed on the Boeing 737-300, N513AU, that crashed while approaching Pittsburgh International Airport, Pittsburgh, Pennsylvania, on September 8, 1994. RDO Radio transmission from accident aircraft CAM Voice or sound source recorded through cockpit area microphone HOT Voice or sound source recorded through cockpit hot microphone PA Voice or sound source recorded through public address system JSAP Voice or sound source recorded through jumpseat audio panel -1 Voice identified as captain -2 Voice identified as first officer -3 Voice identified as female flight attendant -4 Voice identified as male flight attendant CTR-? Radio transmission from unidentified Center controller CLE1 Radio transmission from 1st Cleveland Center controller CLE2 Radio transmission from 2nd Cleveland Center controller CLE3 Radio transmission from 3rd Cleveland Center controller CLE4 Radio transmission from 4th Cleveland Center controller ATIS Radio transmission from Pittsburgh automatic terminal information service APR1 Radio transmission from 1st Pittsburgh approach controller APR2 Radio transmission from 2nd Pittsburgh approach controller US1417 Radio transmission from USAir flight 1417 US1499 Radio transmission from USAir flight 1499 US1874 Radio transmission from USAir flight 1874 US1462 Radio transmission from USAir flight 1462 US1674 Radio transmission from USAir flight 1674 DL1083 Radio transmission from Delta flight 1083 US374 Radio transmission from USAir flight 374 LEGEND

Appendixes 301 Aircraft Accident Report 285LM Radio transmission from aircraft 285 LM US309 Radio transmission from USAir flight 309 * Unintelligible word @ Nonpertinent word # Expletive % Break in continuity ( ) Questionable insertion [ ] Editorial insertion .... Pause Note: The CVR transcript reflects the final 30 minutes 56 seconds of the accident flight. Times are expressed in eastern daylight time, based on a 24-hour clock.

Appendixes 302 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT START of RECORDING START of TRANSCRIPT 1832:29 CTR-? ... contact Chicago's Cleveland center one two six point niner seven. 1832:33 RDO-1 twenty six ninety seven, USAir four twenty seven, good day. 1833:08 RDO-1 center USAir four twenty seven at two nine oh. 1833:14 CLE2 USAir four twenty seven, Cleveland center roger. 1833:32 CLE2 USAir four twenty seven, cleared direct to uh, Akron, rest of route unchanged give me the best forward airspeed in-trail spacing. 1833:37 RDO-1 direct Akron, best forward, you got it, four twenty seven USAir. 1835:04 HOT-1 [sound similar to person yawning] 1837:46 CAM [interruption in CVR audio similar to passing of CVR tape splice]

Appendixes 303 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1838:00 RDO-1 blocked. 1840:38 CLE2 USAir four twenty seven, contact Cleveland center one one niner point eight seven. 1840:43 RDO-1 nineteen eighty seven, USAir four twenty seven, good day. 1840:50 RDO-1 Cleveland, USAir four twenty seven at two niner zero. 1840:54 CLE3 USAir four twenty seven Cleveland center roger and what is the indicated airspeed now? 1840:57 RDO-1 uh, we're indicating uh, 'bout uh, three hundred uh, assigned. 1843:23 CLE3 USAir fourteen seventeen, contact Cleveland center one three three point three seven. 1843:27 US1417 three three three seven, USAir's uh, fourteen seventeen. good day. 1843:32 HOT-1 had a four and a seven in it. 1843:34 HOT-2 ha ha ha.

Appendixes 304 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1843:37 HOT-1 do you wanta let 'em up for a while? 1843:42 CAM [sound of single chime similar to seat belt switch being moved] 1845:31 CLE3 USAir four twenty seven, descend and maintain flight level two four zero. 1845:35 RDO-1 out of two nine oh for two four oh, USAir four twenty seven. 1845:55 HOT-2 ah you piece of #. 1845:56 HOT-1 what? 1845:58 HOT-2 I said, aw c'mon, you piece of #, this damn thing is so # slow. 1846:07 HOT-2 there it is. 1847:23 CLE3 USAir four twenty seven contact Cleveland center one two eight point one five. 1847:27 RDO-1 twenty eight fifteen, USAir four twenty seven. good

Appendixes 305 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT day. 1847:35 RDO-1 center, USAir four twenty seven descending two four oh. 1847:38 CLE4 USAir four twenty seven Cleveland center roger. 1850:11 DL1083 and center, Delta ten eighty three's with you leaving seventeen five going down to one one thousand. 1850:15 CLE4 Delta ten eighty three Cleveland center, roger. cross CUTTA at one zero thousand. Pit altimeter three zero one one. 1850:18 CAM [aural tone similar to altitude alert] 1850:21 DL1083 CUTTA at ten thousand, Delta ten eighty three. 1850:56 CLE4 USAir four twenty seven cross CUTTA at and maintain one zero thousand Pit altimeter three zero one one. 1851:01 RDO-1 CUTTA at ten, thirty eleven, USAir four twenty seven. 1851:08 HOT-2 ten, CUTTA. 1851:11 HOT-1 it's true.

Appendixes 306 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1851:18 HOT-1 I'm off. 1851:18 HOT-2 alright. 1851:22 ATIS ..Pittsburgh tower arrival information Yankee. two one five two Zulu weather. two five thousand scattered. visibility one five. temperature seven five. dew point five one. wind, two seven zero at one zero. altimeter three zero one zero. multiple approaches ILS runway three two and ILS runway two eight right in use. notams, runway two eight right middle marker decommissioned. south entrance Air Force Reserve ramp closed. Morgantown vortac out of service. advise on initial contact you have information Yankee. 1851:54 HOT-1 three two and two eight right. 1851:57 HOT-2 three two and two eight right? 1851:58 HOT-1 yep. 1851:59 HOT-? *. 1852:18 HOT-2 oh why did it *? 1853:15

Appendixes 307 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT CAM [sound similar to cockpit door being opened and closed] 1853:26 CAM-3 um, they didn't give us connecting flight information or anything. do you know what gate we're coming in on? 1853:29 CAM-1 not yet. 1853:30 CAM-3 any idea *. 1853:31 CAM-1 no. 1853:32 CAM-3 doya' know what I'm thinkin' about? pretzels. 1853:34 HOT-1 pretzels. 1853:37 CAM-3 you guys need drinks here? 1853:38 CAM-1 uh, I could use a glass of somethin', whatever's open. water uh, water, a juice.. 1853:44 CAM-2 I'll splita yeah. a water, a juice, whatever's back there I'll split one with 'im. 1853:48 CAM-3 OKedoky.

Appendixes 308 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1853:51 CAM-3 do you want me to make you my special fruity juice cocktail? (you wanna try it?) 1853:56 CAM-1 how fruity is it? 1853:57 CAM-3 (try it?) 1853:58 HOT-2 alright, I'll be a guinea pig. 1854:02 CAM [sound similar to cockpit door being closed] 1854:07 HOT-1 [sound similar to person taking a deep breath] 1854:19 CLE4 Delta ten eighty three, reduce speed to two ten. contact Pit approach one two one point two five. 1854:24 DL1083 twenty one twenty five, good day. 1854:27 CLE4 USAir four twenty seven cross CUTTA one zero thousand two five zero knots now. 1854:30 RDO-1 ten two fifty over CUTTA, USAir four twenty seven. 1854:36 HOT-2 this thing's gonna scream and holler. I can't do that.

Appendixes 309 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1854:42 HOT-1 thirty eleven. 1854:43 HOT-2 thirty eleven set. 1854:44 HOT-1 you can't make it? 1854:45 HOT-2 it's gonna say it can't. 1854:49 HOT-2 because its .... it it uh, it'll do it. I'll make it do it. 1854:53 CAM [sound of unidentified click] 1854:55 HOT-2 see, it's callin' me names like it did you. 1856:16 CLE4 USAir four twenty seven reduce speed to two one zero now that's at the request of Pit approach I'll take the speed first. 1856:22 RDO-1 OK speed back to two ten USAir four twenty seven. uh, we'll do our best to make the restriction. 1856:27 CLE4 don't have to now. just uh, speed first uh, pd to ten. 1856:31 RDO-1 you got it.

Appendixes 310 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1856:32 CLE4 USAir four twenty seven, contact Pit approach one two one point two five. 1856:36 RDO-1 twenty one twenty five, USAir four twenty seven, good day. 1856:43 HOT-1 two ten, he said. 1856:45 HOT-2 two ten? oh, I heard two fifty, #. 1856:49 HOT-1 I may have misunderstood him. 1856:52 RDO-1 approach, USAir four twenty seven is descending to ten. 1856:55 APR Shuttle twenty nine zero eight, turn right heading zero niner zero. contact approach one two three point niner five. 1857:05 APR USAir fourteen ninety nine, turn left heading one zero zero. contact approach one two four point one five. 1857:07 CAM [sound similar to cockpit door being opened] 1857:08

Appendixes 311 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT CAM-3 here it is. 1857:09 HOT-1 alright. 1857:09 HOT-2 alright. thank you, thank you. 1857:10 CAM-3 (now ** be fooled) if you don't like, I didn't taste 'em so I don't know if they came out right. 1857:11 US1499 one hundred degrees and twenty four fifteen, US fourteen ninety nine. 1857:14 APR USAir eighteen seventy four, descend and maintain six thousand. 1857:14 HOT-1 that's good [simultaneous with previous ATC transmission] 1857:15 CAM-3 *. 1857:16 HOT-2 that is good .. 1857:17 CAM-3 it's good. 1857:17 HOT-2 ..that is different. be real, be real good with some dark

Appendixes 312 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT rum in it. 1857:20 CAM-3 yeah right. (can I get you something else?) 1857:23 APR USAir four twenty seven, Pittsburgh approach. heading one six zero vector ILS runway two eight right final approach course. speed two one zero. 1857:26 HOT-2 what kind of speed? OK. 1857:29 RDO-1 we're, comin' back to two ten and uh, one sixty heading down to ten, USAir four twenty seven, and uh, we have Yankee. 1857:40 HOT-1 what runway did he say? OK. 1857:43 APR USAir fourteen sixty two, Pittsburgh approach heading zero four zero vector ILS three two final approach course. 1857:43 HOT-2 ***. 1857:45 HOT-1 it tastes like a ** 1857:46 HOT-2 good.

Appendixes 313 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1857:47 HOT-1 there's little grapefruit in it. 1857:49 CAM-3 no. [sound of laughter] 1857:54 APR USAir sixteen seventy four turn left heading one zero zero. contact approach one two four point one five. 1857:54 HOT-2 ** cranberry. 1857:55 CAM-3 yeah. you saw that from the color. 1858:00 US1674 twenty four fifteen and a hundred on the heading US sixteen seventy four. 1858:02 CAM-1 how else is in it? 1858:03 CAM-2 uh, sprite? 1858:03 APR Delta ten eighty three, descend and maintain six thousand. 1858:04 CAM-3 diet sprite. 1858:06 CAM-2 huh.

Appendixes 314 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1858:07 DL1083 six thousand, ten eighty three. 1858:08 CAM-3 and I guess you could do it with sprite. prob'ly be a little better if you do. 1858:10 CAM-1 yeah, there's more? 1858:11 CAM-3 one more. 1858:13 CAM-2 ah. 1858:13 HOT-2 oh jay? 1858:14 APR USAir three seventy four, turn right heading one one zero. 1858:14 CAM-3 you got it. 1858:17 HOT-2 huh. 1858:17 CAM-3 cranberry orange and diet sprite. 1858:17 CAM-2 really nice.

Appendixes 315 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1858:18 CAM-3 it's different. could ya keep comin' out aaah, whataya' got different and .. 1858:20 CAM-1 I always mix the cranberry and the grapefruit, I like that. 1858:21 APR USAir eighteen seventy four, reduce speed please to one niner zero then continue the descent to maintain six thousand. 1858:24 CAM [sound of aural tone similar to altitude alert] 1858:25 CAM-3 ** OK, back to work. 1858:26 CAM-2 OK. 1858:29 CAM [sound similar to cockpit door opening and closing] 1858:29 HOT-2 I suspect we're gonna get the right side. 1858:33 APR USAir four twenty seven, descend and maintain six thousand. 1858:36 RDO-1 cleared to six, USAir four twenty seven.

Appendixes 316 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1858:36 HOT-1 [intermittent static sound (heard on captain's channel only) lasting for three seconds] 1858:48 CAM [sound of click similar to approach plate clip being snapped] 1858:50 HOT-2 oh my wife would like that [non-pertinent comment] 1858:56 HOT-1 cranberry orange and sprite. 1858:57 APR USAir sixteen seventy four, contact approach one two four point one five. 1858:58 HOT-2 yeah. 1859:04 HOT-2 I guess we ought to do a preliminary Pete. 1859:06 HOT-1 altimeters and flight instruments thirty eleven? 1859:08 HOT-2 my side. 1859:11 HOT-1 aah, where are we .... landing data is ... 1859:12 285LM Pit, two eight five Lima Mike is thirteen for uhh, ten with

Appendixes 317 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT Allegheny's Hotel. 1859:14 HOT-2 posted on my side for a hundred and nine. 1859:15 APR November two eight five Lima Mike, Pittsburgh approach. direct Montour vector ILS runway two eight final approach course. 1859:16 HOT-1 thirty three, forty three an two hundred. 1859:21 285LM Montour on the vectors, Lima Mike... 1859:22 HOT-1 shoulder harness? 1859:24 APR USAir fourteen sixty two, descend and maintain six thousand. 1859:25 HOT-2 on. 1859:28 CAM [sound of clicks similar to shoulder harness being fastened] 1859:28 HOT-1 approach brief? 1859:30 APR USAir three seventy four, contact approach one two

Appendixes 318 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT three point niner five, good day. 1859:31 HOT-2 plan two eight right. two seventy nine inbound, one eleven seven. 1859:36 HOT-2 [sound similar to deep inhale and exhale] 1859:41 APR USAir three zero nine, Pittsburgh approach, heading zero five zero vector ILS runway three two final approach course. 1859:54 HOT-1 ah, don't do this to me. 1859:56 HOT-2 [sound of chuckle] froze up did it? 1900:08 APR Delta ten eighty three, turn left heading one three zero. reduce speed to one niner zero. 1900:12 HOT-1 [intermittent static sound (heard on captain's channel only) for seventeen seconds] 1900:12 HOT-1 I hate it when you don't hear the other transmissions. 1900:13 DL1083 one thirty one ninety speed, Delta ten eighty three. 1900:14

Appendixes 319 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT HOT-2 [chuckle] yeah. 1900:15 APR USAir four twenty seven turn left heading one four zero, reduce speed to one niner zero. 1900:20 RDO-1 OK, one four zero heading and one ninety on the speed, USAir four twenty seven. 1900:24 CAM [sound of three clicks similar to flap handle being moved] 1900:26 CAM [sound of single chime similar to seat belt chime] 1900:26 HOT-2 oops, I didn't kiss 'em 'bye. 1900:28 CAM [clicking sound similar to trim wheel turning at auto-pilot trim speed] 1900:31 HOT-2 what was the temperature, 'member? 1900:33 APR five Lima Mike contact Pittsburgh departure one two four point seven five. 1900:34 HOT-1 seventy five. 1900:35 HOT-2 seventy five?

Appendixes 320 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1900:37 CAM [clicking sound similar to trim wheel turning at auto-pilot trim speed] 1900:40 285LM twenty four seventy five, Lima Mike. 1900:43 PA-4 ... seatbelts and remain seated for the duration of the flight. 1900:44 PA-2 folks, from the flight deck we should be on the ground in 'bout ten more minutes. uh, sunny skies, little hazy. temperature, temperature's ah, seventy five degrees. wind's out of the west around ten miles per hour. certainly 'preciate you choosing USAir for your travel needs this evening, hope you've enjoyed the flight. hope you come back and travel with us again. this time we'd like to ask our flight attendants please prepare the cabin for arrival. ask you to check the security of your seatbelts. thank you. 1900:46 APR Delta ten eighty three, turn left heading one zero zero. 1900:48 DL1083 one zero zero, ten eighty three. 1901:04 RDO-1 did you say two eight left for USAir four twenty seven? 1901:06 CAM [chime similar to seatbelt chime]

Appendixes 321 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1901:06 APR uh, USAir four twenty seven, it'll be two eight right. 1901:08 RDO-1 two eight right, thank you. 1901:10 HOT-1 two eight right. 1901:11 HOT-2 right, two eight right. that's what we planned on. autobrakes on one for it. 1901:18 APR Delta ten eighty three contact approach one two four point one five. 1901:22 DL1083 twenty four fifteen, good day. 1901:26 APR USAir fourteen sixty two at six thousand, reduce speed to one niner zero. 1901:35 HOT-1 I can't ***. 1901:36 APR USAir three zero niner, descend and maintain six thousand then reduce speed to one niner zero. 1901:42 HOT-2 Bravo thirty nine .... that's not too bad that's ...

Appendixes 322 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1901:47 APR USAir eighteen seventy four turn right heading one zero zero. contact approach one two three point niner five. 1901:48 HOT-2 .. 'bout half way. 1901:50 CAM [aural tone similar to altitude alert] 1901:51 HOT-2 (then) ... (works) 1901:56 HOT-1 seven for six. 1901:57 APR USAir fourteen sixty two turn right heading zero eight zero. 1901:58 HOT-2 seven for six. 1902:06 HOT-1 boy, they always slow you up so bad here. 1902:08 HOT-2 that sun is gonna be just like it was takin' off in Cleveland yesterday too. I'm just gonna close my eyes. [sound of laughter] you holler when it looks like we're close. [sound of laughter] 1902:24 HOT-1 [sound of chuckle] OK.

Appendixes 323 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1902:24 APR USAir four twenty seven, turn left heading one zero zero. traffic will be one to two o'clock, six miles, northbound Jetstream, climbing out of thirty three for five thousand. 1902:32.0 RDO-1 we're looking for the traffic, turning to one zero zero, USAir four twenty seven. 1902:32.9 CAM [sound similar to aircraft engines increasing in RPM to a steady value] 1902:34.8 CAM [clicking sound similar to trim wheel turning at auto-pilot trim speed] 1902:54.3 HOT-2 oh ya, I see zuh Jetstream. 1902:57.0 HOT-1 [sound similar to three thumps] 1902:57.3 HOT-1 sheeez. 1902:57.5 HOT-2 zuh. 1902:58.0 CAM [sound of thump]

Appendixes 324 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1902:58.5 HOT-1 [sound similar to person inhaling/exhaling quickly one time] 1902:58.6 CAM [sound of "clickety click"] 1902:59.1 CAM [sound of thump of less magnitude than the first thump] 1902:59.3 HOT-1 whoa. 1902:59.5 CAM [sound of "clickety click"] 1903:00.3 HOT-2 [sound similar to pilot soft grunting 1903:00.7 CAM [sound of unknown click] 1903:01.1 HOT-1 hang on. 1903:01.1 CAM [sound similar to aircraft engines increasing in RPM] 1903:01.5 HOT-2 [sound similar to pilot loud grunting] 1903:01.9 HOT-1 hang on.

Appendixes 325 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1903:02.1 CAM [sound of click and wailing horn similar to auto-pilot disconnect] 1903:03.6 HOT-1 hang on. 1903:04.4 HOT-2 oh #. 1903:05.2 HOT-1 hang on. 1903:07.5 CAM [sound of increasing amplitude similar to onset of stall buffet] 1903:07.9 CAM [vibrating sound similar to aircraft stick shaker starts and continues to end of recording] 1903:08.0 HOT-1 what the hell is this? 1903:08.3 CAM [sound of aural tone similar to altitude alert] 1903:09.4 JSAP traffic traffic 1903:09.4 CAM traffic traffic 1903:09.6 HOT-1 what the ...

Appendixes 326 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1903:09.9 HOT-2 oh... 1903:10.6 HOT-1 oh God.. oh God. 1903:13.3 APR USAir.... 1903:15.0 RDO-1 four twenty seven emergency. 1903:17.4 HOT-2 #. 1903:18.1 HOT-1 pull 1903:18.5 HOT-2 oh #. 1903:19.1 HOT-1 pull 1903:19.7 HOT-1 (pull) 1903:20.8 HOT-2 God. 1903:21.1 HOT-1 [sound of screaming] 1903:22.5 HOT-2 no.

Appendixes 327 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1903:22.8 END of RECORDING END of TRANSCRIPT

Appendixes 328 Aircraft Accident Report Appendix C History of Federal Aviation Administration Airworthiness Directives Related to the Boeing 737 Rudder System FAA records indicate that 10 airworthiness directives (AD) related to the Boeing 737 rudder system have been issued since 1980. Each of these ADs is described below and summarized in the table that follows. On April 21, 1980, AD 80-07-02 became effective. It required a test on Boeing 737 airplanes within 3 days to determine if the main rudder power control unit (PCU) and other flight components could fail. The AD was prompted by a finding that components manufactured by a company other then Parker were installed in the PCU by a repair station or operator. On March 3, 1994, AD 94-01-07 became effective. It required a test of the main rudder PCU every 750 flight hours until the PCU was replaced with a PCU incorporating a redesigned servo valve. This test was used to determine if the PCU servo valve was in proper operating condition by evaluating rudder system hydraulic flow or internal leakage within the servo valve resulting from improperly positioned servo valve slides. The 750-hour test requirement was removed when the PCU was replaced with a redesigned servo valve. The USAir flight 427 aircraft had been tested for compliance with the AD on March 21, June 18, and August 8, 1994. AD 94-01-07 was superceded by AD 97-14-04 (which became effective on August 4, 1997. On March 14, 1995, telegraphic AD 95-06-53 was issued regarding certain 737s that had PCUs serviced by a repair station. The FAA determined that assembly methods for the PCU servo valve did not guarantee that the servo valve primary and secondary slides would be properly set, which could result in the servo valve not functioning properly. The AD required removing or testing of the suspect parts within the next five flights. This action affected approximately 50 airplanes. On November 27, 1996, AD 96-23-51 became effective. It required all 737 series airplanes to be inspected within 10 days and every 250 flight hours afterward. This AD was the result of findings related to testing of the main rudder PCU during the USAir flight 427 accident investigation. These findings indicated that a jam of the secondary slide to the servo valve housing and subsequent rudder input could result in the rudder moving opposite of its intended direction. The AD required that a full rudder pedal displacement be made to the travel limit of the rudder and then a sudden full pedal command be made to the opposing direction. If the pedals moved normally, the test was successful; if they did not, the rudder PCU was required to be replaced immediately. The 250-hour test requirement was removed when the PCU was replaced with one that incorporated a redesigned servo valve. AD 96-23-51 was superceded by AD 97-14-04 (which became effective on August 4, 1997).

Appendixes 329 Aircraft Accident Report On January 17, 1997, AD 96-26-07 became effective. The AD required revising the airplane flight manual (AFM) for all 737 series airplanes within 30 days to include procedures that would enable the flight crew to take “appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition” and “correct a jammed or restricted flight control condition.” The FAA stated that the AD had been prompted because such procedures were not defined adequately in the existing version of the 737 AFM. The AD established a “recall” procedure to be performed by flight crews immediately, from memory, in the event of an uncommanded yaw or roll. The FAA specified that air carriers could comply with the AD by inserting a copy of it in the AFM. On March 19, 1997, AD 97-05-10 became effective. It required certain 737 main rudder PCUs to be removed or tested within 90 days to determine if they had been assembled by a repair station with an incorrect fastener used to retain the summing levers. This anomaly was discovered when an operator noted cracking of the summing lever bearing. The FAA found that the fastener installed by the repair station caused the bearing to crack. This AD affected approximately 200 PCUs. On June 9, 1997, AD 97-09-15 became effective. It required an inspection of the yaw damper engage solenoid. If the solenoid part number was within a specified range, the solenoid valve was required to be replaced with a redesigned valve. This AD resulted from Safety Board’s test findings in connection with the investigation of USAir flight 427 accident, which indicated that hydraulic fluid was contaminating the coils of the valve and causing it to fail. The redesigned valve utilized sealed coils that were impervious to hydraulic fluid. The AD required that the valves be replaced within 5 years or 15,000 flight hours after the AD’s effective date or the next time the PCU was sent to a repair facility, whichever was earlier. On August 1, 1997, AD 97-14-03 became effective. It requires the installation, within 3 years, of a newly designed rudder surface limiting device that reduces the rudder authority at flight conditions in which full rudder authority is not required. It also required the installation of a redesigned yaw damper system with improved reliability and fault monitoring capabilities. These actions were the result of Safety Recommendations A-96-107 and -110, which were issued on October 18, 1996, in connection with the USAir flight 427 accident investigation. On August 4, 1997, AD 97-14-04 became effective. It required that all actions included in ADs 94-01-07 and 96-23-51 be implemented and that, within 2 years, all main rudder PCUs be replaced with a PCU that has a redesigned servo valve. The AD also required that the PCU’s vernier control rod bolts be replaced with bolts that are less likely to fail and that a leak test be performed on the PCU within 4,000 to 6,000 flight hours of the AD’s effective date and at 6,400 hour intervals thereafter. This leak test was designed to detect latent jams of the servo valve slides. On January 20, 1998, AD 97-26-01 became effective. It required an inspection to detect galling on the standby rudder actuator input bearing and shaft within 18 months or 4,500 flight hours. The shaft and bearing are to be replaced with a redesigned shaft and bearing within 3 years of the AD’s effective date. This AD, which affected approximately

Appendixes 330 Aircraft Accident Report 2,800 airplanes, was the result of findings related to the investigation of the United Airlines flight 585 accident and Safety Recommendation A-96-115, issued on October 18, 1996, in connection with the USAir flight 427 accident investigation. AD number Title Affected airplanes Effective date Compliance deadline Description 80-07-02 Flight Control Systems All model 707, 720, 727, 737, and 747 series airplanes that contain specific hydraulic components manufactured by Fortner Engineering and Manufacturing. 04/21/80 3 days after the AD’s effective date. Conduct a one-time manual input hardover test on the flight control systems (including the rudder, elevators, and ailerons). 94-01-07 Main Rudder PCU Model 737 series airplanes, line positions 1 through 2453 (inclusive). 03/03/94 Within 750 flight hours after the AD’s effective date. Perform a test of the main rudder PCU to detect internal leakage of hydraulic fluid. Repeat test at 750-hour intervals unless replaced with new main rudder PCU. Superseded by AD 97-14-04. 95-06-53 Rudder Actuator Piston All model 737 series airplanes. 03/14/95 Within 5 flights after the AD’s effective date. Compare part and serial numbers of the main rudder PCU with those on a list of suspect parts. If applicable, remove and replace PCU with serviceable part or perform specified testing. 96-23-51 Main Rudder PCU All model 737 series airplanes. 11/27/96 Within 10 days after the AD’s effective date. Perform testing of the main rudder PCU in accordance with Boeing Alert Service Bulletin 737-27A1202. Repeat test at 250-hour intervals unless replaced with new main rudder PCU. Superseded by AD 97-14-04. 96-26-07 737 AFM Revision All model 737 series airplanes. 01/17/97 Within 30 days after the AD’s effective date. Revise the AFM to include procedures that would enable the flight crew to take appropriate action to maintain control of the airplane during an uncommanded yaw or roll and correct a jammed/ restricted flight control condition.

Appendixes 331 Aircraft Accident Report AD number Title Affected airplanes Effective date Compliance deadline Description 97-05-10 Main Rudder PCU Model 737 series airplanes with a main rudder PCU identified in Boeing Service Letter 737-SL- 27-112-B, dated 02/06/97. 03/19/97 90 days after the AD’s effective date. Remove the main rudder PCU and replace the improper fastener with a correct fastener or perform specified testing. 97-09-15 Engage Solenoid Valve Inspection All model 737- 100 through -500 series airplanes. 06/09/97 5 years or 15,000 flight hours after the AD’s effective date or the next time the PCU is sent to a repair facility. Perform a one-time inspection of the engage solenoid valve of the yaw damper to determine the part number (P/N) of the valve. If the valve P/N falls within the range specified, replace the valve with a new one. 97-14-03 Rudder Authority and Yaw Damper System All model 737- 100 through -500 series airplanes. 08/01/97 Within 3 years of the AD’s effective date. Install a newly designed rudder limiting device that reduces the rudder authority during flight conditions for which full rudder authority is not required. Install a newly designed yaw damper system that improves reliability and fault monitoring capability. 97-14-04 Main Rudder PCU All model 737- 100 through -500 series airplanes. 08/04/97 Within 2 years after the AD’s effective date. Perform all actions required by ADs 94-01-07 and 96-23-51. Replace any main rudder PCU having Boeing P/N 65-44861 or P/N 65C37052 with a new main rudder PCU. Replace the vernier control rod bolts having Boeing P/N 69-27229 with new bolts. Perform a leak test of the main rudder PCU within 4,000 to 6,000 hours of the AD’s effective date. Repeat the leak tests at 6,400-hour intervals.

Appendixes 332 Aircraft Accident Report AD number Title Affected airplanes Effective date Compliance deadline Description 97-26-01 Standby Rudder PCU Input Shaft and Bearing Inspection Model 737-100 through -500 series airplanes, line numbers 1 through 2814 (inclusive). 01/20/98 Within 18 months or 4,500 hours after the AD’s effective date. Perform an inspection to detect galling on the input shaft and bearing of the standby rudder PCU within 18 months or 4,500 hours after the AD’s effective date, whichever occurs later. Replace the input bearing of the standby rudder PCU with an improved bearing within 3 years after the AD’s effective date.

Appendixes 333 Aircraft Accident Report Appendix D Critical Design Review Recommendations and Federal Aviation Administration Responses Because the USAir flight 427 accident and other 737 accidents and incidents raised questions regarding the 737’s flight control systems, on October 20, 1994, the FAA initiated a Critical Design Review (CDR) of the 737 flight control systems with emphasis on the roll control and directional flight control systems. The CDR team included seven flight control specialists from the FAA, Transport Canada, and the U.S. Air Force. The team’s final report, entitled B-737 Flight Control System Critical Design Review, was issued on May 3, 1995. The FAA’s responses to the CDR team’s 27 recommendations were presented in an August 27, 1998, letter to the Safety Board. The CDR team’s recommendations and the FAA’s responses were described in the FAA’s letter as follows: CDR Recommendation 1: Develop national policy and/or rulemaking as necessary and applicable to transport-category airplanes that defines “normal” with respect to jams. This definition should include consideration of a jam of a control surface at any position up to its full deflection as limited by design. CDR Recommendation 2: Develop national policy requiring that, when alternate means for flying an airplane are employed, those means shall not require exceptional pilot skill and strength and that the pilot can endure the forces for a sufficient period of time to ensure a safe landing. CDR Recommendation 3: Formally establish the transport-category airplane requirement for redundancy in the directional control system to maintain control in the event of a rotor burst for the most critical phase of flight. Determine whether this requirement should be applied to new type- certificate applications, derivative applications, or aircraft in production. FAA Response to CDR Recommendations 1, 2, and 3: Public meeting on 12/03/96 held to discuss flight control jam “normally encountered” condition. Issue will go to new working group in ARAC [Aviation Rulemaking Advisory Committee]. Terms of reference for the harmonization of requirements has been developed to guide the effort. Schedule for completion to be determined. CDR Recommendation 4: Develop national policy for transport-category airplanes requiring the determination of critical hydraulic flight control system and component sensitivity (jam potential and actuator performance) to contamination, requirements for sampling hydraulic fluid, and requirements for actuator components to eliminate or pass (shear) particulate contamination. FAA Response to CDR Recommendation 4: SAE [Society of Automotive Engineers] A-6 Committee has made recommendations on

Appendixes 334 Aircraft Accident Report chip shear requirements; FAA review of requirements to be completed April 1998. SAE A-6 recommendations made on contamination to be completed October 1998. CDR Recommendation 5: Develop and provide additional guidance in AC [Advisory Circular] 1309-1A confirming that transport-category airplane failure analysis action items are required flight procedures in response to the failure condition. CDR Recommendation 6: Require the action items be practical. FAA Response to CDR Recommendations 5 and 6: ARAC working group activity. CDR Recommendation 7: Establish process in cooperation with AFS [the FAA’s Flight Standards Service] to require flight crew action items be implemented or require revision of failure analysis to not require action item. FAA Response to CDR Recommendation 7: Process for reviewing engineering determination of flight crew action following failure is under review. CDR Recommendation 8: Review the adequacy of the 737 aileron transfer mechanism throughout the airplane operating envelope in the event of a sustained jam of the ailerons up to their limit deflection. Pilot skill and strength requirements should be consistent with the results of [CDR] Recommendation 2. Control margins from this condition should be sufficient to allow continued safe flight and landing, including necessary maneuvers such as a crosswind landing or go-around. CDR Recommendation 9: Ensure that the capability of the 737 lateral [roll] control system to provide adequate directional control is clearly demonstrated throughout the airplane operating envelope after these failures, unless they are shown to be extremely improbable by the most rigorous methodology available. FAA Response to CDR Recommendations 8 and 9: Aileron transfer mechanism data reviewed and approved 11/30/95. AD 96-26-07 addresses adequacy of lateral [roll] control to provide directional control. No further action planned. CDR Recommendation 10: Determine the requirement for and the feasibility of incorporating additional means to protect these components [as addressed in Recommendations 8 and] in the main wheel well of the 737 from the effects of environmental debris. CDR Recommendation 11: Ensure the incorporation of wheels based on TSO-C26 Revision C or later revision. FAA Response to CDR Recommendations 10 and 11: AD 97-01-10 issued 08/12/97, and AD 97-18-06 issued 10/08/97. No further action planned.

Appendixes 335 Aircraft Accident Report CDR Recommendation 12: Require failure analysis of the 737 yaw damper identified components and any relevant tests be conducted to identify all failure modes, malfunctions, and potential jam conditions of these vital elements. CDR Recommendation 13: Require corrective action(s) for those failure modes or malfunctions [as addressed in Recommendation 12] not shown to be extremely improbable. FAA Response to CDR Recommendations 12 and 13: Analysis completed by the FAA on 11/30/95. No further action planned. CDR Recommendation 14: Require appropriate action be taken to reduce the number of 737 yaw damper failure occurrences to an acceptable level. FAA Response to CDR Recommendation 14: AD 98-02-01 in Federal Register 02/17/98; AD 97-14-03 issued 06/23/97; AD 97-09-15 issued 04/24/97 (currently being revised—NPRM for revision in Federal Register 11/13/97, docket number 97-NM157AD). CDR Recommendation 15: Require appropriate action be taken to correct the referenced galling condition of the standby rudder on the 737. FAA Response to CDR Recommendation 15: AD 97-26-01 was issued on 12/08/97; no further action planned. CDR Recommendation 16: Review and revise, as appropriate, the 737 inspection tasks associated with the latent failures identified in Tables 3 and 4 in Section 10 [of the final CDR report] in accordance with MSG-3 [Maintenance Steering Group 3]. CDR Recommendation 17: Require that the identified latent failures have fixed-interval inspection frequencies, as provided by ACs 25.1309-1A and 25-19. Consideration should be given to interval ranges flexible enough to allow normal inspection schedules. CDR Recommendation 18: Revise the 737 MRB/MPD [Maintenance Review Board/Maintenance Planning Document] inspection task description and interval for the following latent failures: Latent failure Recommended inspection interval Tasks Aileron transfer mechanism ≤ 1C ≤ 3C Operational check Measure forces at wheel Aileron spring cartridge ≤ 1C Operational check conducted with the transfer mechanism inspection Standby hydraulic system, including rudder function ≤ 1A Operational check

Appendixes 336 Aircraft Accident Report FAA Response to CDR Recommendations 16, 17, and 18: MRB review completed, and corrections incorporated. CDR Recommendation 19: Revise 737 flight crew training programs to ensure the use of the proper procedures for recovery from flightpath upsets and flight crew awareness regarding the loss of airplane performance due to a flight control system malfunction. Consideration should be given to flight crew action items as a consequence of the failure analysis developed for the relevant flight control system and the failure conditions/ malfunctions examined in Appendix 5 [of the CDR final report]. (This may require Airplane Flight Manual or Operations Manual revision.) FAA Response to CDR Recommendation 19: AD-96-26-07 addresses issue for the 737. CDR Recommendation 20: Require that only PC- [production certificate] or PMA- [parts manufacturing approval] approved replacement parts be used when overhauling primary elements in the flight control system (hydraulic servos and bypass valves) of the 737 airplanes. Ensure replacement parts, as provided by a non-original equipment manufacturer (OEM) or fabricated under SFAR [Special Federal Aviation Regulation] 36 authority, that are used when overhauling primary elements in the flight control system have had their designs approved and processed through the ACO [Aircraft Certification Office] that originally approved the OEM parts. This means that the replacement parts will have undergone qualification in terms of design (including material, heat treat, dimensions, tolerances, and geometric controls), analysis, and tests (qualification and acceptance) equivalent to the OEM certified part. An analysis is necessary to verify that the replacement part will mate properly with the next assembly under all design tolerance conditions. FAA Response to CDR Recommendation 20: Flight Standards Information Bulletin dated 02/13/96 provides guidance. CDR Recommendation 21: Require any issuance of PMA for primary flight control servo and bypass valves be concurred with the Aircraft Certification Office that certified the original parts or assembly. FAA Response to CDR Recommendation 21: Under review. CDR Recommendation 22: Form a team composed of a systems engineer, a manufacturing inspector, and an airworthiness maintenance inspector to assess the repair procedures, process, and tooling used in every repair station approved by the FAA to overhaul the 737 PCU and its components. In addition, this team should reassess all 737 PCU PMAs and SFAR 36 data (design, manufacturing, and fabrication) approvals for adequacy in consideration of [CDR] Recommendations 20 and 21. FAA Response to CDR Recommendation 22: Flight Standards Information Bulletin dated 02/13/96 provides guidance. CDR Recommendation 23: Evaluate the adequacy of the 737 maintenance manual actions addressing flight control cable inspection, rigging procedures, and replacement criteria.

Appendixes 337 Aircraft Accident Report CDR Recommendation 24: Require control cable service life limits unless acceptable inspection and/or test procedures are developed and utilized to determine the continuing serviceability of the control cables. FAA Response to CDR Recommendations 23 and 24: Cable maintenance practice revised during period of 11/95 through 12/96. Boeing Maintenance Manuals revised to provide for comprehensive control cable inspection. These two recommendations are completed. CDR Recommendation 25: Determine the degree of incorporation of the following list of Service Bulletins (includes In-Service Activities Report) in the 737 fleet and, in consideration of the recommendations in Section 15 [of the CDR final report], reassess their safety impact and, as appropriate, require their incorporation on applicable models of the 737. 737 Service Bulletins No. Title Date B737-27-1060 Rudder Pressure Reducer and Relief Valve Inspection/Removal Oct. 3, 1972 B737-27-1033 Improvement of Lateral Control Transfer Mechanism Feb. 13, 1970 B737-27-1081 Inspection of Ground Spoiler Shutoff Valve Control Cable Assembly Dec. 10, 1976 B737-27-1125 Flight Controls, Cable Guard Modification (Pitch) Mar. 8, 1985 B737-27-1134 Flight Controls, Aileron Centering and Trim Mechanism Modification July 11, 1986 B737-27-1152 Flight Controls, Aileron Trim Bracket Replacement May 12,1988; Dec. 22,1988 (rev. 2) B737-27-1154 Flight Controls, Aileron Pulley Bracket Inspection/ Replacement Aug. 25, 1988 B737-27-1155 Flight Controls, Aileron Centering Spring and Trim Mechanism Modification Oct. 26, 1989 B737-29-1062 Hydraulic Power, Main and Auxiliary, Standby and Ground Service Pressure Filter Modification Feb. 14, 1991 737 In-Service Activities Report No. Title Date 95-04-2725-10 Rudder Power Control Unit (PCU) Yaw Damper Solenoid Valve configuration for use on Rudder PCU Spec. No. 10-60881-8 and -13 Feb. 24, 1995

Appendixes 338 Aircraft Accident Report FAA Response to CDR Recommendation 25: AD 97-01-10 issued 01/03/97; AD 97-03-14 issued 01/29/97; AD 97-04-01 issued 02/04/97. No further action planned. CDR Recommendation 26: Determine the degree of incorporation of the following list of Service Letters in the 737 fleet and, in consideration of the recommendations in Section 15 [of the CDR final report], reassess their safety impact and, as appropriate, require their incorporation on applicable models of the 737. FAA Response to CDR Recommendation 26: AD 97-05-09 issued 02/25/97, and AD 97-09-14 issued 04/24/97. No further action planned. CDR Recommendation 27: Request that the NTSB form a special accident investigation team to begin a new combined investigation of both the 737 Colorado Springs and the Pittsburgh accidents. The accident investigation team should include an FAA representative from the CDR team and the NTSB aviation safety investigator that worked with the CDR team. This will ensure that all of the data from the CDR is available for review by the accident investigation team. It is further recommended that NTSB personnel on the team not be from the original accident investigation teams and that the NTSB include at least two accident investigators (one each— airplane systems and flight operation) from another competent aviation authority of the world who has experience with 737 airplanes. FAA Response to CDR Recommendation 27: NTSB has formed a special group of consultants in support of the ongoing accident investigation. Letter No. Title Date B737-SL-27-16 Rudder Trim Control Actuator Lubrication Aug. 25, 1980 B737-SL-27-24 Rudder Centering Unit Lubrication June 28, 1983 B737-SL-27-30 Aileron/Elevator and Rudder Power Control Unit Cylinder Bore Rework Apr. 1, 1985 B737-SL-27-57 Rudder Feel and Centering Unit Lubrication Dec. 5, 1989 B737-SL-27-71-A Aileron/Elevator PCU Flow Restrictor Filter Screen Contamination June 19, 1992

Appendixes 339 Aircraft Accident Report Appendix E List of Documented Boeing 737 Events In addition to the USAir flight 427 accident, the Safety Board has investigated more than 100 events since 1980 involving the Boeing 737. The table below documents the date and location of these events and provides a brief description for each. (Abbreviations are defined at the end of the table.) Additional details for some of these events can be found in the factual information section of this report. This list should not be considered a complete list of every 737 rudder-related event that has occurred. Date Location 737 series Carrier Comment/event 06/11/80 Cheyenne, Wyoming -200 Frontier First officer incapacitation 09/24/89 LaGuardia Airport, New York -400 USAir Rudder trim mis-set; rejected takeoff 02/25/91 N/A -200 United Yaw anomalies on 585 airplane 03/03/91 Colorado Springs, Colorado -200 United Flight 585 accident 07/16/92 Chicago-O'Hare Airport, Illinois -300 United Rudder PCU anomaly during ground check 12/14/92 San Diego, California -300 USAir Rudder PCU malfunction 01/04/93 Seattle-Tacoma, Washington -300 United Hydraulic block/binding 04/16/93 Near Auckland, New Zealand -200 Air New Zealand Yaw damper anomaly 04/23/93 Stapleton, Denver, Colorado -500 United Wake vortex encounter with a 757 06/24/93 Orly Airport, Paris, France -300 Air France Descent rudder deflection 08/20/93 France -300 Air France Takeoff roll rudder deflection 08/22/93 Oklahoma City, Oklahoma -200 Southwest Yaw damper anomaly 08/24/93 France -300 Air France Two rudder deflections in flight 11/02/93 Manila, Philippines -300 Philippine Airlines Yaw damper anomaly 03/08/94 New Delhi, India -200 Sahara Airlines Loss of control during training flight 03/29/94 Oakland, California -300 Southwest First officer incapacitation

Appendixes 340 Aircraft Accident Report Date Location 737 series Carrier Comment/event 03/31/94 Las Vegas, Nevada -300 America West Yaw damper anomaly 04/12/94 San Pedro Sula, Honduras -300 Continental Yaw damper anomaly 05/23/94 Phoenix, Arizona -200 America West Yaw damper anomaly 08/31/94 London, England -200 British Airways Yaw damper anomaly 09/02/94 Melbourne, Australia -300 Ansett Yaw damper anomaly 09/08/94 Aliquippa, Pennsylvania -300 USAir Flight 427 accident 09/21/94 Los Angeles, California. -200 Canadian Air Possible wake vortex encounter 10/24/94 Phoenix, Arizona -300 Southwest Wake vortex encounter with a 727 11/24/94 Philadelphia, Pennsylvania -300 USAir Yaw damper anomaly 12/02/94 Sacramento, California -300 Southwest “Pull to left” on takeoff roll 12/20/94 Raleigh-Durham, North Carolina -300 USAir Yaw damper anomaly 12/21/94 Coventry, England -200 Air Algeria CFIT; mis-set instrument 12/29/94 Van, Turkey -400 Turkish Airways CFIT 01/02/95 Houston, Texas N/A Southwest Wake vortex encounter with MD-80 01/13/95 Jogjakarta, Indonesia -300 Garuda Airlines Landing, runway overrun 01/17/95 Yogyakarta, Indonesia -200 N/A Runway overrun 01/20/95 Atlanta, Georgia -200 Air South Runway overrun on landing 01/25/95 Albuquerque, New Mexico -300 America West Roll-off on takeoff 02/21/95 Australia -400 Qantas Wake vortex encounter with a 747 03/29/95 En route ONT to SJC -300 Southwest Yaw damper anomaly

Appendixes 341 Aircraft Accident Report Date Location 737 series Carrier Comment/event 04/08/95 Vittoria, Brazil -300 Trans Brasil Off side of runway 04/13/95 Denver International, Colorado -400 Mark Air Hard landing 05/05/95 Dublin, Republic of Ireland -400 Aer Lingus Yaw damper anomaly 06/26/95 National Airport, Washington, D.C. -300 USAir Uncommanded roll 07/18/95 Ormond Beach, Florida -300 USAir Uncommanded roll 07/25/95 Charlotte, North Carolina -300 USAir Uncommanded roll 07/25/95 Richmond, Virginia -400 USAir Uncommanded roll 07/25/95 Mexico City, Mexico -300 Continental Yaw damper anomaly 07/28/95 London-Heathrow, United Kingdom -400 British Airways Rudder on hard landing 07/29/95 Love Field, Dallas, Texas -300 Southwest Ground collision 08/05/95 Charlotte, North Carolina -300 USAir Uncommanded roll 08/09/95 San Salvador, El Salvador -200 AVIATECA CFIT 08/10/95 New Orleans, Louisiana -200 USAir Uncommanded roll 08/17/95 Phoenix, Arizona -400 USAir Rudder after initial touchdown 08/20/95 Toronto, Ontario, Canada -200 Canadian Airlines Yaw damper anomaly 08/25/95 Fort Lauderdale, Florida -300 USAir Uncommanded roll 08/30/95 Cleveland, Ohio -300 Continental Uncommanded roll 09/12/95 Dallas-Fort Worth, Texas -200 USAir Uncommanded pitch-up 09/25/95 Denver International, Colorado -200 United Takeoff roll rudder deflection 09/29/95 Dayton, Ohio -300 USAir Rudder trim runaway 09/29/95 Charlotte, North Carolina -300 USAir Wake vortex encounter with a 757 10/14/95 Dallas-Fort Worth, Texas -300 Delta Yaw damper anomaly 10/15/95 Boscombe Down, England -200 British Airways Roll oscillations; maintenance flight

Appendixes 342 Aircraft Accident Report Date Location 737 series Carrier Comment/event 10/22/95 San Francisco, California -500 United Pitch-up during maintenance flight 10/22/95 Pittsburgh, Pennsylvania -300 USAir Unexpected roll on approach 10/26/95 Dusseldorf, Germany -300 Deutsche BA Uncommanded roll 10/27/95 Munich, Germany -300 Deutsche BA Uncommanded roll 10/14/95 En route DFW to HSV -300 Delta Uncommanded rudder input 10/29/95 Portland, Maine -300 USAir Bird strike during takeoff 10/30/95 Las Vegas, Nevada -500 Southwest First officer eye struck by laser beam 10/31/95 En route PBI to PIT -300 USAir Uncommanded rolls 11/02/95 Charlotte, North Carolina -400 USAir Uncommanded roll 11/06/95 Sydney, Australia -300 Ansett Wake vortex encounter with a 747 11/13/95 Kaduna, Nigeria -200 Nigerian Airlines Runway overrun 11/25/95 Portland, Oregon N/A United Turbulence on approach 11/29/95 DeGaulle Airport, Paris, France -200 British Airways Gear failure on landing rollout 12/02/95 New Delhi, India -200 Indian Airlines Runway overrun 12/03/95 Douale, Cameroon -200 Cameroon CFIT; landed in a swamp 12/28/95 Toulouse, France -200 Euralair No. 1 engine failure 01/02/96 Honolulu, Hawaii -200 Aloha Uncommanded lateral oscillations 01/18/96 Melbourne, Australia -400 Qantas Uncommanded roll 01/29/96 Stavanger, Norway -400 Braathens BRT Rudder failsafe bolt break 02/09/96 Chicago, Illinois -200 United Wake vortex encounter with a 727 02/22/96 National Airport, Washington, D.C. -100 Continental Runway overrun

Appendixes 343 Aircraft Accident Report Date Location 737 series Carrier Comment/event 02/23/96 Colorado Springs, Colorado N/A America West Clear air turbulence on approach 03/06/96 Arequipa, Peru -200 Faucett CFIT; impacted hill on final 03/13/96 Philadelphia, Pennsylvania N/A USAir Wake turbulence 04/01/96 Chicago, Illinois -300 Continental Wake vortex encounter with a 777 04/07/96 Approach to San Francisco, California -300 United Vibration in rudder pedals 04/28/96 Denver, Colorado -300 United Engine failure after takeoff 05/14/96 Trenton, New Jersey -200 Eastwind Yaw “bumps” on climbout 05/25/96 N/A -500 United Yaw damper transfer valve jam 05/25/96 N/A -300 United Bent pin on yaw damper coupler 05/25/96 N/A -300 United Yaw damper trip/replace A/P access 06/09/96 Richmond, Virginia -200 Eastwind Flight 517 incident 06/22/96 Granite, Colorado -200 Frontier Clear air turbulence encounter 06/29/96 Phoenix, Arizona -300 America West Uncommanded roll 07/07/96 Nashville, Tennessee -200 Southwest Aborted takeoff; bird ingestion 07/10/96 Seattle, Washington -300 Southwest Rudder kick on takeoff 07/14/96 El Salvador -200 TACA Lateral oscillations after takeoff 08/29/96 Chattanooga, Tennessee N/A USAir Clear air turbulence encounter 11/16/96 Phoenix, Arizona -300 Southwest Uncommanded yaw 12/12/96 Frankfurt, Germany -400 Lufthansa Rudder oscillations with PCU test 01/21/97 Boston, Massachusetts -200 Delta Yaw damper anomaly 03/02/97 Carajas, Brazil -200 Varig Hard landing and runway overrun 12/19/97 Palembang, Indonesia -300 SilkAir Loss of control; flight 185 accident

Appendixes 344 Aircraft Accident Report Note: CFIT, controlled flight into terrain; A/P, autopilot; ONT, Ontario International Airport, California; SJC, San Jose International Airport, California; DFW, Dallas-Fort Worth International Airport, Texas; HSV, Huntsville International Airport, Alabama; PBI, West Palm Beach International Airport, Florida; PIT, Pittsburgh International Airport, Pennsylvania; PHL, Philadelphia International Airport, Pennsylvania; LAS, Las Vegas International Airport, Nevada; CVG, Cincinnati/Northern Kentucky International Airport, Covington, Kentucky; and GSO, Piedmont Triad International Airport, Greensboro, North Carolina. Date Location 737 series Carrier Comment/event 03/11/98 Anchorage, Alaska -200 Arco Alaska Yaw damper anomaly 03/11/98 Spokane, Washington -300 Southwest Yaw damper anomaly 07/02/98 Brazil -400 Trans Brasil Yaw damper anomaly 08/07/98 En route PHL to LAS -300 USAirways Possible wake vortex encounter 08/12/98 En route CVG to GSO -200 Delta Yaw damper anomaly 08/98 N/A -700 Southwest Yaw excursion during takeoff roll 08/14/98 Juneau, Alaska -400 Alaskan Hard landing 11/01/98 Atlanta, Georgia -200 AirTran Hydraulic leak; maintenance flight 02/19/99 Seattle, Washington -300 United Anomalous rudder response 02/23/99 Salisbury, Maryland -200 Metrojet Rudder hardover in flight

Appendixes 345 Aircraft Accident Report Appendix F Boeing’s “Blue Water” Assessment Team Since the introduction of the Boeing 737 series airplane, there have been maintenance reports of fluid in the electrical/electronic compartment (E/E bay). Occasionally, pilot reports of system problems were later determined to be caused by short circuiting of electrical components in the E/E bay as a result of the presence of fluids. Because of these events, Boeing established an assessment team (which included an FAA engineer) in 1995 to investigate fluid contamination of electrical and electrical boxes and the interfacing with electrical wiring and connectors within the 737 E/E bay. The team reviewed equipment designs, maintenance practices, service data, operator fleet campaign results, and E/E bay component overhaul data and performed inspections of in-service airplanes. The team reviewed 653 Boeing 737 operator E/E bay service reports from January 1984 to February 1996. Fluid contamination was documented in 111 of these reports. The team also reviewed 13,905 service/repair station records pertaining to the maintenance of electrical boxes. Fluid-related contamination was documented in 366 of these reports. The team found that the position of a electrical box did not necessarily protect it from contamination. The team also found that forward lavatory waste water was the primary fluid source for E/E bay contamination. The assessment found that overservicing of the lavatory, cracked toilet tanks, failed gaskets, and damaged dump valves were the primary source of the leaks. The 737 series is equipped with fluid barrier systems that are designed to contain or prevent fluids from reaching the E/E bay. These barriers include the floor panel moisture barrier, shrouds, and airstair drip pan. However, the assessment team found that the barriers can be damaged during service, allowing fluids to enter the E/E bay. The examination of several airplanes found that some shroud installations were completely missing; some were damaged, contaminated, or torn; and some were improperly installed. The assessment team identified improvements aimed at preventing fluid leakage and contaminated electrical and electronic equipment. The team reported that it did not identify any substantial design deficiencies or common problems; however, it found that operator-specific maintenance and service practices may compromise the effectiveness of the moisture barrier systems. The team’s October 1996 final report indicated that the team did not uncover any evidence that a specific fluid leakage event would produce a near-term, unexpected, aircraft flightpath departure. However, the team made several recommendation to reduce the potential for fluid leakage into the E/E bay in 737 airplanes and noted any pertinent corrective actions. These recommendations included the following:

Appendixes 346 Aircraft Accident Report • Installation of a forward waste system flush/fill line shutoff valve and fluid sensor. • Installation of an improved airstair drip pan access hatch gasket. (Addressed by Boeing Service Letter 737-SL-53-23, dated June 28, 1993.) • Elimination of the E/E rack moisture shroud lack of coverage by verifying that the shroud is properly installed and incorporating an improved moisture shroud. (Boeing Service Bulletin 737-25-1317 was released to all operators, providing information regarding the replacement of the cloth moisture shroud with one manufactured from aluminum. Boeing determined that an improvement to the aluminum moisture shroud would increase the protection; therefore, once the improved moisture shroud parts are available, Service Bulletin 737-25-1317 will be superceded.) • Incorporation of an improved floor moisture barrier system. (Boeing Service Letter 737-SL-53-034-B, dated February 21, 1997, provides for the modification of airplanes manufactured before January 1996.) • Periodic inspection of the E/E bay moisture shrouds and drip pans. (Temporary revisions to sections 25-51-01 of the Boeing Maintenance Manual were released in July 1998 for 737-300, -400, and -500 series airplanes and in August 1998 for the -100 and -200 series airplanes. In November 1997, a revision to the maintenance planning document was released for the 737-300, -400, and -500 series airplanes, including a task to visually check the moisture shrouds and drip pans for obvious damage at every “1C” maintenance interval (MPD item B25-51-00-6A). The document is no longer being revised by Boeing for the -100 and -200 airplanes; however, operators of these airplanes were asked to incorporate the intent of the subject task item into their maintenance programs. • Periodic inspection of lavatory system for signs of leakage. (Inspection procedures were added to section 38-32-0 of the Boeing Maintenance Manual.)

FD07213 ｜ 1999_美国_NTSB_HZM0101_Rupture_of_a_Railroad_Tank_Car_Containing_Hazardous_Waste.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HAZARDOUS MATERIALS ACCIDENT REPORT PB2001-917002 NTSB/HZM-01/01 DCA99MZ004 RUPTURE OF A RAILROAD TANK CAR CONTAINING HAZARDOUS WASTE NEAR CLYMERS, INDIANA FEBRUARY 18, 1999 7329

this page intentionally left blank

Hazardous Materials Accident Report RUPTURE OF A RAILROAD TANK CAR CONTAINING HAZARDOUS WASTE NEAR CLYMERS, INDIANA FEBRUARY 18, 1999

NTSB/HZM-01/01 DCA99MZ004 PB2001-917002 Notation 7329 Adopted March 5, 2001 National Transportation Safety Board 490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2001. Rupture of a Railroad Tank Car Containing Hazardous Waste Near Clymers, Indiana, February 18, 1999. Hazardous Materials Accident Report NTSB/ HZM-01/01. Washington, DC. Abstract: About 12:05 a.m. on February 18, 1999, railroad tank car UTLX 643593, which was on the west unloading rack at the Essroc Cement Corporation plant near Clymers, Indiana, sustained a sudden and catastrophic rupture that propelled the tank of the tank car an estimated 750 feet and over multistory storage tanks. The 20,000-gallon tank car initially contained about 161,700 pounds (14,185 gallons) of a toxic and flammable hazardous waste that was used as a fuel for the plant’s kilns. There were no injuries or fatalities. Total damages, including property damage and costs from lost production, were estimated at nearly $8.2 million. The safety issues discussed in the report are: sufficiency of safety requirements addressing the procedures used for loading and offloading railroad tank cars and other bulk containers used to transport hazardous materials; adequacy of inspection and testing requirements for pressure relief devices on railroad tank cars; adequacy of provisions addressing changes in product service for railroad tank cars; and adequacy of the U.S. Department of Transportation Hazardous Materials Regulations pertaining to the notification and reporting of hazardous materials incidents. As a result of its investigation, the Safety Board made recommendations to the Federal Railroad Administration, the Research and Special Programs Administration, the Association of American Railroads, the Railway Progress Institute, the Lyondell Chemical Company, the Olin Corporation, the Essroc Cement Corporation, and CP Recycling, Inc., and Affiliated Companies. The Safety Board also reiterated one recommendation to the Research and Special Programs Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-917002 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Hazardous Materials Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1993 Loading and 1998 Shipment of Tank Car . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Heating and Offloading Attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 UTLX 643593 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Tank Car Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 TDI Waste Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Lake Charles Plant Shipments of TDI Waste . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Operations Under Olin Ownership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Operations Under Arco/Lyondell Ownership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Lake Charles TDI Waste Offloading and Processing Procedures . . . . . . . . . . . . . . . . . . . . . . 21 Olin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Arco/Lyondell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Essroc TDI Waste Disposal Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Guidance on Processing TDI Waste Mixtures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Operational Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Configuration of Essroc Offloading Station . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Essroc Offloading Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 FRA-Ordered Inspections and Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Disposition of TDI Wastes in Other Tank Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Postaccident TDI Matter Waste Offloading Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Inspections and Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Metallurgical Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Examination of the Pressure Relief Valve and Other Fittings . . . . . . . . . . . . . . . . . . . . . . 32 Pressure Tests and Teardown of Pressure Relief Valve . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Chemical Analyses and Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Approved Cargoes and Components for DOT Specification Tank Cars . . . . . . . . . . . . . . . . 38 Federal Regulations and Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Compatibility of Pressure Relief Device Components with TDI Waste Mixtures . . . . . 39 Change of Authorized Cargoes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Hazardous Materials Incident Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Notification of Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Notification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Contents iv Hazardous Materials Accident Report Regulatory Initiatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Rupture of UTLX 643593 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Overpressure Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Product Expansion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Hazardous Materials Loading and Offloading Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 TDI Waste Shipments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Recent Safety Board Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 DOT Hazardous Materials Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Pressure Relief Valves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Inspection Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Changes in Product Service for Railroad Tank Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Notification and Reporting of Hazardous Materials Incidents . . . . . . . . . . . . . . . . . . . . . . . . . 62 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Previously Issued Recommendation Reiterated in this Report . . . . . . . . . . . . . . . . . . . . . . . . . 67 Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 B: U.S. Department of Transportation Hazardous Materials Incident Report Form . . . . . . . 70

v Hazardous Materials Accident Report Acronyms and Abbreviations AAR -- Association of American Railroads ANPRM -- advance notice of proposed rulemaking Arco -- Arco Chemical Company ASTM -- American Society of Testing and Materials Btu -- British thermal unit cfm -- cubic feet per minute CFR -- Code of Federal Regulations cp -- centipoise CPRIN -- CP Recycling of Indiana EPA -- Environmental Protection Agency Essroc -- Essroc Cement Corporation FRA -- Federal Railroad Administration ksi -- thousand pounds per square inch MCB -- monochlorobenzene Midland -- Midland Manufacturing Corporation MSHA -- Mine Safety and Health Administration NPRM -- notice of proposed rulemaking NRC -- National Response Center Olin -- Olin Corporation psia -- pounds per square inch, absolute psig --pounds per square inch, gauge RSPA -- Research and Special Programs Administration RSST -- reactive system screening tool TDI -- toluene diisocyanate TSD -- transfer, storage, and disposal

vi Hazardous Materials Accident Report Executive Summary About 12:05 a.m. on February 18, 1999, railroad tank car UTLX 643593, which was on the west unloading rack at the Essroc Cement Corporation (Essroc) Logansport cement plant near Clymers, Indiana, sustained a sudden and catastrophic rupture that propelled the tank of the tank car an estimated 750 feet and over multistory storage tanks. The 20,000-gallon tank car initially contained about 161,700 pounds (14,185 gallons) of a toxic and flammable hazardous waste that was used as a fuel for the plant’s kilns. There were no injuries or fatalities. Total damages, including property damage and costs from lost production, were estimated at nearly $8.2 million. The National Transportation Safety Board determines that the probable cause of the accident was the failure of Essroc Cement Corporation and CP Recycling of Indiana management to develop and implement safe procedures for offloading toluene diisocyanate matter wastes, resulting in the overpressurization of the tank car from chemical self-reaction and expansion of the toluene diisocyanate matter wastes. This report discusses the following safety issues: • Sufficiency of safety requirements addressing the procedures used for loading and offloading railroad tank cars and other bulk containers used to transport hazardous materials; • Adequacy of inspection and testing requirements for pressure relief devices on railroad tank cars; • Adequacy of provisions addressing changes in product service for railroad tank cars; and • Adequacy of the U.S. Department of Transportation Hazardous Materials Regulations pertaining to the notification and reporting of hazardous materials incidents. As a result of its investigation of this accident, the Safety Board makes recommendations to the Federal Railroad Administration, the Research and Special Programs Administration, the Association of American Railroads, the Railway Progress Institute, the Lyondell Chemical Company, the Olin Corporation, the Essroc Cement Corporation, and CP Recycling, Inc., and Affiliated Companies. The Safety Board also reiterates one recommendation to the Research and Special Programs Administration.

1 Hazardous Materials Accident Report Factual Information Accident Summary About 12:05 a.m.1 on February 18, 1999, railroad tank car UTLX 643593, which was on the west unloading rack at the Essroc Cement Corporation (Essroc) Logansport cement plant near Clymers, Indiana, sustained a sudden and catastrophic rupture that propelled the tank of the tank car an estimated 750 feet and over multistory storage tanks. (See figure 1.) The 20,000-gallon tank car initially contained about 161,700 pounds (14,185 gallons) of a toxic and flammable hazardous waste generated from the production of toluene diisocyanate (TDI). TDI is an intermediate product used in the manufacture of polyurethane foam, a material commonly used to produce seat cushions. TDI matter waste was used as a fuel for the Essroc plant’s kilns. In the 5 days before the accident, employees or contract personnel for the hazardous material disposal firm CP Recycling of Indiana (CPRIN)2 had applied steam to heat the tank car for a total of 28.5 hours. Their goal was to make the material in the tank sufficiently liquid to transfer to the plant piping and kilns for burning. (See figure 2 for an aerial view of the Essroc plant layout.) The attempts to offload the TDI matter waste were unsuccessful due to solidification of the waste in the plant piping to the kilns. There were no injuries or fatalities. Total damages, including property damage and costs from lost production, were estimated at about $8.2 million. Preaccident Events 1993 Loading and 1998 Shipment of Tank Car Railroad tank car UTLX 643593 (see figure 3) was loaded on October 1, 1993, with approximately 161,700 pounds (14,185 gallons) of a TDI mixture designated as “TDI matter waste” at the then-Olin Corporation (Olin) plant in Lake Charles, Louisiana. The loaded tank car remained in storage at the Lake Charles plant until March 31 or April 1, 1998, when it was shipped to the Essroc cement plant, near the towns of Clymers and Logansport in north-central Indiana.3 At Essroc, the TDI matter waste was to be used as a fuel for the plant’s kilns. UTLX 643593 was interchanged at the rail yard in Logansport on April 20, 1998. 1 All times are eastern standard time. 2 CPRIN is a subsidiary of CP Recycling, Inc., and Affiliated Companies. 3 The TDI matter waste stored in UTLX 643593 was classified as a hazardous waste when it was shipped in April 1998 from the Lake Charles plant to Essroc.

Factual Information 2 Hazardous Materials Accident Report Figure 1. Accident location [not to scale]. (NTSB) KENTUCKY MICHIGAN ILLINOIS I N D I A N A Indianapolis Lafayette Logansport OHIO Accident Site Clymers

Factual Information 3 Hazardous Materials Accident Report Figure 2. Aerial view of Essroc plant (preaccident); areas of interest cited in report are labeled. (Photo provided by Essroc)

Factual Information 4 Hazardous Materials Accident Report Figure 3. Photo and diagram showing tank cars of same design as UTLX 643593. (NTSB) External Heating Coils Dome Manway Coverplate (within dome) Jacket A-end B-end Hand Brake

Factual Information 5 Hazardous Materials Accident Report UTLX 643593 remained in the Logansport rail yard until December 7, 1998, when it was delivered to the Essroc plant. UTLX 643593 was positioned on the west offloading rack at the Essroc plant about 2:00 p.m. on February 12, 1999. The A-end of the tank car was in the direction of “plant north.”4 Essroc daily rail car inspection records from December 7, 1998, through February 17, 1999, show no problems with the tank car. Heating and Offloading Attempts Before the TDI matter waste could be offloaded from UTLX 643593, it had to be heated by circulating steam through the tank car’s external heating coils to ensure that the waste mixture was sufficiently fluid to be pumped to the plant’s kilns, where it was to be burned. (Essroc used the TDI matter waste and other hazardous wastes to fuel the plant’s kilns for cement production.) On February 13, 1999, the Essroc transfer, storage, and disposal (TSD) facility5 supervisor, who supervised the plant’s waste fuel technicians (the Essroc employees who offload waste fuels) and oversaw the transfer of all waste fuels to the plant’s kilns, met with the customer service manager for CPRIN at the plant to discuss the steam heating of the tank car. CPRIN was Essroc’s on-site contractor for steam heating tank cars containing waste fuels. In that capacity, either the CPRIN service manager or CPRIN contract employees made the steam connections to the tank car and operated the boiler system that produced the steam. Essroc employees made all the offloading connections to the valves on the tank car and operated the pumps, valves, and other equipment to physically offload the tank car and pump the waste to the kilns. The connections for steam heating UTLX 643593 were completed about 5:00 p.m. on February 13, and steam heating began about 6:00 p.m. At the time the steam connections were made, internal tank pressure was reported to be 0 pounds per square inch, gauge, (psig) and the ambient air temperature was about 30° F.6 As a standard practice and quality control measure, Essroc technicians would draw a sample of the TDI matter waste before offloading any tank car. A contract laboratory with on-site facilities would then analyze the sample to ensure that the waste was within prescribed parameters before offloading commenced. One technician stated that he and a second technician drew the quality control sample from UTLX 643593 before the end of their shift at 11:30 p.m. on February 13. They left the sample with the facility supervisor. The technician described the waste sample as being “somewhat thicker” than normal. The sample was taken to the contract laboratory with on-site facilities at 12:20 a.m. on February 14. The analysis was completed and the results reported to Essroc at 1:23 a.m. on February 14. 4 The true direction of “plant north” is north to northwest. Directional references in this report will be referenced to “plant north” rather than true directions unless otherwise specified. 5 A TSD facility transfers, stores, or disposes of hazardous wastes. 6 Essroc stated that its waste fuel technicians monitored the internal pressure of the tank car and the temperature of the matter waste in the tank car between February 13 and the accident, but internal tank pressures and temperatures of the waste mixture were not, as a matter of practice, measured at regular intervals or required to be documented. Consequently, the internal tank pressures and cargo temperatures cited in this report are those recalled by the facility supervisor and the waste fuel technicians.

Factual Information 6 Hazardous Materials Accident Report The lab tested the sample for the presence of specific constituents, including chlorine and water, and measured the heating value and density of the waste mixture. It did not indicate the waste’s viscosity.7 The testing indicated that no water was present. The sample had a density of 11.4 pounds per gallon and a heating value of 119,880 British thermal units (Btu) per gallon. About the time the sample was drawn, the internal tank pressure was 0 psig. The temperature of the matter waste mixture was 80° F at 12:30 a.m. As the steam heating continued, the temperature of samples drawn from the tank car increased to about 120 to 150° F, at about 2:30 a.m., to 202° F at 6:00 a.m., when the steam heating ended. About 9:00 a.m. on February 14, the Essroc facility supervisor spoke with a waste fuel technician who was on duty. The technician advised the facility supervisor that the steam heating of UTLX 643593 had ended about 6:00 a.m. that morning. The facility supervisor and the waste fuel technician reviewed the procedures to finish offloading operations from a just-emptied tank car, GATX 42585, on the east offloading rack adjacent to UTLX 643593. The facility supervisor told the waste fuel technician to call him if any problems developed in the offloading. The waste fuel technician notified the Essroc facility supervisor about 11:00 a.m. that he had attempted to begin offloading UTLX 643593 but was unable to do so because the TDI matter waste was too thick. The waste had plugged the fixed plant piping between the offloading rack and the kilns.8 The facility supervisor directed the technician to shut down the pumping and piping system and to flush the piping from the kilns back to the loading rack.9 The internal tank pressure was about 10 psig at 11:00 a.m.; it was 40 psig at 1:00 p.m. About 4:30 p.m., the Essroc facility supervisor received a telephone call from another waste fuel technician on duty. This technician advised the facility supervisor that the on-duty technicians had again tried to offload UTLX 643593 and pump the TDI matter waste to the kilns, but the waste was too thick and had again plugged the piping. The facility supervisor told the technician to flush the piping to the kilns and to shut down the offloading effort. An on-duty product supervisor at the plant notified the facility supervisor before 6:00 p.m. that it had been shut down. No further attempts to heat or offload UTLX 643593 were made on February 14. The facility supervisor arrived at the Essroc plant between 6:30 and 6:45 a.m. on February 15. About 6:45 a.m., the internal tank pressure in UTLX 643593 was between 20 and 25 psig, and the temperature of a waste sample was 70° F. The facility supervisor 7 Viscosity is a measure of the resistance of a fluid to deformation or flow. A fluid with a high viscosity, such as heavy syrup, tends to be thick and slow flowing. A fluid with a low viscosity, such as water, is thin and flows easily. 8 The system of piping and pumps that fed the TDI waste directly from the tank car to the kilns was designated as the TDI direct burn system. 9 Essroc personnel indicated that toluene, a solvent for TDI, was used to flush and unplug the piping to the kilns.

Factual Information 7 Hazardous Materials Accident Report determined that the TDI matter waste was too thick to pump. (After the accident, the facility supervisor stated no temperature was prescribed for offloading; he said the waste product was considered ready for offloading when it was “thin” enough to flow.) The facility supervisor then contacted the CPRIN manager, told him the temperature of the TDI waste sample, and said that the waste was much too thick to pump from the tank car. The CPRIN manager responded that he would reheat the tank car. The second round of steam heating UTLX 643593 began about noon on February 15 and ended about 4:30 a.m. on February 16. The facility supervisor told the waste fuel technicians to draw samples from the tank car every 30 to 60 minutes to check the waste’s temperature and visually monitor its viscosity. The facility supervisor left it to the Essroc technicians to advise the CPRIN personnel when the TDI matter waste was fluid enough to pump. The Essroc facility supervisor checked the status of UTLX 643593 upon arriving at the plant between 6:30 and 6:45 a.m. on February 16. The waste samples drawn from the tank car at that time were 173° F and were thin and fluid. The facility supervisor also noted that the pressure gauge on the nitrogen line used to measure internal pressure in the tank car read 45 psig, which was higher than Essroc’s desired pressure of 20 to 25 psig. To relieve excess pressure in the tank car, Essroc technicians manually opened the vapor valve on top of the tank car that was connected to a “tee” fitting that allowed the injecting of nitrogen into, or the venting of vapors from, the tank car with the alignment of flow valves at the offloading station. The facility supervisor later told the Safety Board that when the technician went to open the vapor valve on the tank car to relieve the internal pressure, he found the pressure relief valve “whispering” or discharging slightly and not seating tightly. The facility supervisor attributed this condition to saturated carbon filters in the offloading station’s vapor emission system.10 He directed the technicians to clean the carbon filters so that they could absorb the pollutant vapors as intended.11 While the technicians cleaned the filters, vapors from the tank car were vented into a water bath, which would absorb any pollutants. A 3/4-inch vent hose (about 100 feet long) was connected to the vapor valve on the tank car and then run to a 300-gallon plastic “tote” tank filled with about 275 gallons of water. The end of the vent hose was resting underwater on the bottom of the tote tank so that vapors from the hose would be absorbed in the water rather than emitted to the atmosphere. According to the facility supervisor, Essroc technicians continued to clean the carbon filters throughout the day on February 16, and vapors from the tank car continued to trickle through the water bath. About 5:30 p.m. on February 16, the facility supervisor told the 3:30 to 11:30 p.m. shift about the problems with the vent system and the carbon filters and directed the shift to monitor the water bath and the internal pressure in UTLX 643593. He also told the 10 Saturation of the filters could have caused a back pressure in the tank car, which would have caused the pressure relief valve to open so that “whispering” could be heard. 11 The carbon filters were designed to absorb pollutants in the vapors from the tank car to satisfy air quality standards.

Factual Information 8 Hazardous Materials Accident Report technicians to reconnect the nitrogen line to the tank car when the internal tank pressure was between 20 and 25 psig and to try to offload the tank car. The facility supervisor also checked the internal pressure in UTLX 643593 and noted that the pressure gauge indicated 40 psig. The on-duty product supervisor notified the facility supervisor about 9:15 p.m. that the technicians had attempted to offload UTLX 643593, but the product was very thick, “like taffy.” The attempt to offload had begun about 7:30 p.m. but was stopped a “very short time” later, after a small amount of the TDI waste had been offloaded. The on-duty product supervisor told the facility supervisor that the technicians had been unable to flush the TDI waste from the pipeline to the kilns and that the TDI waste had “frozen” in the pipeline. They shut down the offloading effort. During a March 2, 1999, interview with officials from the Mine Safety and Health Administration (MSHA), an Essroc laborer who worked this shift stated that he had seen water bubbling and splashing in the tote tank after this last unsuccessful attempt to offload the tank car on February 16. He said that the pressure in the tank car had been holding at 50 psig. Essroc later estimated that about 750 gallons of the TDI matter waste were offloaded during the three attempts made to offload the tank car. The facility supervisor arrived at the plant between 6:30 and 6:45 a.m. on February 17, and, as he had the 2 previous days, he checked UTLX 643593. He noted that the pressure gauge measuring the internal pressure in the tank car indicated 40 psig. The facility supervisor opened a valve in the vent line to begin relieving the pressure in the tank car. The pressure was relieved until 10:00 a.m., when the pressure gauge indicated 3 to 5 psig. The vent line valve was closed at that time, and the nitrogen line was opened. Nitrogen was injected into the tank car until about 3:00 p.m., by which time it had increased the internal pressure to between 20 and 25 psig. The facility supervisor said that the tank car was not steam-heated further or otherwise worked on before the explosion. Accident The waste fuel technicians and other employees, whose shifts began at 11:30 p.m., February 17, were in an on-site building that housed the technicians’ office when UTLX 643593 ruptured. One of the waste fuel technicians was doing paperwork when the accident occurred. About 12:05 a.m. on February 18, the technician heard what he later described as a “small bang.” He stated that he was looking out the window, but he did not see any smoke, flame, or flash, and therefore was not sure where the sound originated. Following the bang, he saw an orange fireball, which he estimated was 40 feet high, moving toward the office and engulfing the entire area. According to the technician, the fireball hit the window and was gone. Following the fireball, he felt a concussion. After the fireball and concussion, the technician looked toward the tank car offloading area and

Factual Information 9 Hazardous Materials Accident Report saw the entire area in flames. He said that “clumps of fire” were raining down. The technician said he was certain that the source of the explosion was the TDI tank car. The technician said he heard three other explosions, but he could not estimate the interval between them. He did not know what the first and second explosions were, but he said that the third explosion was the cargo tank truck east of the diesel storage tanks. (See figure 4 for postaccident view of the Essroc plant site.) Emergency Response The Logansport Fire Department received the alarm from the Essroc plant at 12:06 a.m. on February 18. The first responding units arrived on the scene at 12:21 a.m. The Clymers Volunteer Fire Department, the Georgetown Fire Department, the Royal Center Fire Department, and the Grissom Air National Guard Base Fire Department also responded. Fire crews extinguished the fires without incident. Because of the potentially hazardous smoke and the loss of area electrical power, residents of about 100 homes were temporarily evacuated to shelters. The emergency had concluded by 7:30 a.m. on February 18. In addition to the fire departments, the following Federal, State, and local agencies responded to the accident: the Federal Railroad Administration (FRA), MSHA, the Indiana State Emergency Management Agency, the Indiana Department of Environmental Management, the Indiana State Fire Marshal, the Indiana State Police, the Cass County Office of Emergency Management, the Cass County Sheriff’s Department and Ambulance, the Carroll County Sheriff’s Department, the Logansport Police Department, and the local Red Cross. The Indiana Department of Environmental Management reported that the containment dike surrounding the offloading area and storage tanks was intact and held fire suppression materials. Solid chunks of TDI matter waste from UTLX 643593 were scattered as a debris field across the plant facility. Essroc confirmed that the following fuels and solvents were released from the damaged storage tanks in the offloading area: 17,000 gallons of diesel fuel; 1,000 gallons of gasoline; 15,000 gallons of HAN 906 solvent; and 2,000 gallons of toluene. In addition to the TDI matter waste remaining in UTLX 643593, the accident released about 4,200 gallons of a flammable and corrosive waste from the nearby cargo tank truck. The Indiana Department of Environmental Management monitored cleanup of the plant facility. Injuries No fatalities or injuries were reported.

Factual Information 10 Hazardous Materials Accident Report Figure 4. Essroc plant after the accident; #1 indicates preaccident position of UTLX 643593; #2 indicates location of bulk of tank car after the accident. (Photo courtesy of Logansport Pharos-Tribune newspaper)

Factual Information 11 Hazardous Materials Accident Report Damage General The Essroc plant is in a rural area with no residences in the immediate vicinity. The cement plant sustained significant property damage and suspended operations for nearly 4 weeks. UTLX 643593 and a cargo tank trailer were destroyed. Two other tank cars (GATX 42585 and UTLX 640738) in the offloading area were also damaged. Total damages and lost business costs were estimated at nearly $3.4 million and $4.8 million, respectively. At Essroc, two pairs of north-south train tracks led to the two offloading stations for tank cars. The offloading platforms for the two tank car stations, the pipe rack between the two sets of train tracks, and the offloading station for cargo tank trucks on the west side of UTLX 643593 were completely destroyed. Sections of what appeared to be structural steel from the offloading platforms were found on the far east side of the storage tanks and the kilns adjacent to the east side of the offloading area. Tank car GATX 42585, on the adjacent (east) loading rack, had been blown on its side, away from the west loading station. The cargo tank trailer that had been on the west side of UTLX 643593 had also been blown on its side, away from the west loading station. Fixed storage tanks along the east and west sides of the offloading area exhibited fire and heat damage, as well as impact damage from flying debris. The damaged areas on all these tanks were directly exposed to the offloading station where UTLX 643593 had been. The four tanks along the west side included two 12,000-gallon fuel oil tanks and two 7,500-gallon tanks containing a blending agent for the TDI matter waste. All four of these tanks were destroyed. A 2,000-gallon tank containing toluene was blown from its original position between UTLX 643593 and the cargo tank trailer into the fuel oil tanks on the west side of the offloading area. Fire had blackened 4 of a group of 10 storage tanks on the east side of the offloading area. The remaining six tanks, although partially shielded, also had some blackening and heat damage. (See figure 5.) UTLX 643593 Both truck (wheel) assemblies from the tank car had derailed adjacent to the west track in the offloading area, in the approximate location of UTLX 643593 at the time of the accident. Chemical debris and structural components from UTLX 643593 were scattered to the east and west of the offloading station. Investigators did not locate the dome lid from the tank car. Pieces from the metal jacket of the tank car were generally found in the large field west and north of the offloading station. Most of the UTLX 643593 tank was found in one piece, upside down on the west side of a plant building about 750 feet northeast of the offloading station, with the remaining attached section A-end head next to the building. (See figure 6.) The only section of the tank jacket with burned paint or indication of direct exposure to fire was the jacket section found at this location. A piece of burned rubber hose was found facing and next to the burned area on the jacket.

Factual Information 12 Hazardous Materials Accident Report Figure 5. Essroc loading rack area after accident. (NTSB)

Factual Information 13 Hazardous Materials Accident Report Figure 6. Remains of UTLX 643593 tank after accident. (NTSB)

Factual Information 14 Hazardous Materials Accident Report There were fractures along the bottom centerline of the tank that had propagated on a shear plane, typical of the shear-face tensile fractures in ductile materials.12 Toward both head ends of the tank, transverse tearing through the tank plate was observed, creating two sections of the tank barrel that appeared flattened. The fractures observed were not along welds in the tank. The bottom portion of the tank toward the B-end had crumpled and folded over on itself. Measurements of the plate thickness along the fracture surfaces showed that “necking down” deformation had reduced the wall thickness below the nominal thickness of 0.5625 inch. No pitting, corrosion, blistering, or other visual signs of deterioration were observed on the internal tank surface. No breaches or cracks were observed in the tank, including the area of the tank covered by the external heating coils. The outline of the external heating coils from discoloration of the tank metal was observed on the internal tank surface at both the A- and B-ends. The discoloration was more pronounced at the A-end. Pieces of solid chemical residue were observed on what had been the interior surface of the section of the A-end tank head. The chemical residue had a solid, glassy, and brittle appearance. Other than this residue, the interior surface of the tank head was clean. The tank head was deformed and dented. The eduction lines, gauging line, and thermometer well mounted on the manway coverplate were bent at a 45- to 60-degree angle toward the top of the tank, along the longitudinal centerline, and toward the B-end of the tank. Chemical residue that was dark brown in color and of a solid, glassy appearance filled about half of the dome nozzle. The residue had a top layer of loose chunks. Beneath the chunks, the residue conformed to the shape of the dome nozzle and manway coverplate as if poured into a mold. Numerous solid chunks of the TDI matter waste material were scattered throughout the large field to the west and north of the offloading station. (See figure 7.) Some pieces of these solids showed indications of burning while others did not. Samples of these solids were obtained for analysis. A retired Olin/Arco employee who had 34 years’ experience with the production and handling of TDI and who came to the accident scene as a consultant for Olin told the Safety Board that he was surprised by the number of small chunks of TDI waste on the ground. He identified these chunks as polymeric TDI. He stated that for the polymeric TDI to be in that form, it had to have been a solid block or slab in the tank car when the accident occurred. He further stated that if the polymeric TDI had been in a fluid state in the tank car at the time of the accident, he would have expected the polymeric TDI to have a “stringy” appearance or to be “sort of strung out like you’d throw something out and it’d freeze in the air.” He also observed that some of the polymeric TDI appeared to be burned and showed indications of exposure to water, which he attributed to moisture in the air. He stated that he found the offloading 12 National Transportation Safety Board Materials Laboratory Factual Report No. 99-113, dated May 12, 1999.

Factual Information 15 Hazardous Materials Accident Report lines to UTLX 643593 and noted that they were elongated as “if they was hooked to something” at the time of the accident. He believed that the elongation of these lines indicated they were attached to the tank car when it ruptured. Meteorological Information The National Climatic Data Center provided weather data for Lafayette, Indiana, which is about 35 miles southwest of Logansport/Clymers. (Lafayette was the closest weather reporting station to the accident site.) Between February 12 (the date UTLX 643593 was positioned at the loading rack) and February 18 (the accident date), the high temperatures ranged from 32° F on February 13 to 57° F on February 15. The low temperatures ranged from 13° F on February 13 to 35° F on February 16. The average daily temperatures ranged from 23° F on February 13 to 45° F on February 15. No measurable precipitation was recorded in the 7-day period. The Essroc waste fuel technician who witnessed the February 18 accident said it was cool at the time of the accident, and there was no rain, thunder, or lightning. Figure 7. Solid TDI matter waste gathered from debris field after accident. (NTSB)

Factual Information 16 Hazardous Materials Accident Report Tank Car Information Union Tank Car Company built UTLX 643593, a U.S. Department of Transportation (DOT) specification 111J100W1 tank car, in late 1992 or early 1993. It was 1 of 52 tank cars (UTLX 643546 through 643597, inclusive) ordered by Olin and designed for TDI product transportation. The certificate of construction for UTLX 643593 and its sister tank cars indicates that these cars were approved for carriage of TDI and Non-regulated commodities and commodities authorized in DOT Part 173 [49 Code of Federal Regulations (CFR) 173] for which there are no other requirements and which are compatible with this design and class of car. Each of these tank cars had a capacity of 20,000 gallons. They were approved to carry a maximum of 181,400 pounds of cargo each. The tank was constructed of American Society of Testing and Materials (ASTM) A-516-70 carbon steel. The thickness of the tank shell was 0.563 inch and of the tank heads was 0.603 inch. Under sections 49 CFR 179.201-1 and 179.201-2 of the DOT Hazardous Materials Regulations, the minimum required thickness of the tank shell and tank heads for this class of tank car are both 0.438 inch. Union Tank Car calculated the burst pressure of the tank to be between 813 and 844 psia.13 The tank car’s external heating coils14 were on the bottom half of the tank and ran the tank’s full length. The heating area of the external coils was about 274 square feet of the tank’s surface area. The inlet and outlet connections for the heating coils were just to the A-end side of the blind flange covering the sump at the bottom center of the tank. The tank was covered by 6 inches of insulation (1/2 inch of fiberfrax and 5 1/2 inches of fiberglass), a 1/8-inch carbon steel jacket, and 1/2-inch-thick head shields. All seven valves/fittings on the top of the tank car were mounted on a pressure manway plate, which was bolted to the tank and enclosed in the type of housing used on pressure tank cars that transport liquefied compressed gases. The seven fittings mounted on the manway plate comprised a valve for each of the two liquid loading/offloading lines, the valve to the tank’s vapor space, the pressure relief valve, the vacuum relief valve, the gauging device, and the thermometer well. (See figure 8.) The valves to the two liquid loading/offloading lines were 2-inch Union Tank Car stainless steel ball valves. The vapor valve was a 1-inch stainless steel Jamesbury ball valve. 13 Psia stands for pounds per square inch, absolute. For purposes of comparison, 0 psig = 14.696 psia = 1.0 atmosphere. 14 The external heating coils were welded to the exterior of the tank. The coils were hidden from view by insulation and the metal jacket, which held the insulation in place. (Refer to the figure 3 diagram cutaway.)

Factual Information 17 Hazardous Materials Accident Report The pressure relief valve had been made by the Midland Manufacturing Corporation (Midland). The Midland model A-1479 pressure relief valve had a start-to-discharge pressure of 75 psig. The rated flow capacity of the pressure relief valve was 2,027 cubic feet per minute (cfm). (The DOT minimum flow capacity for this design of tank car was 166 cfm.) The O-rings and gaskets for the pressure relief valve were of ethylene propylene rubber and Teflon, respectively. The vacuum relief valve was a Midland model A-222W flanged valve made of stainless steel with a standard set point15 of 0.75 psi vacuum. Midland found no record indicating that the vacuum relief valve on the tank car had a nonstandard set point. Figure 8. Fittings on UTLX 643593 manway coverplate. (NTSB)

Factual Information 18 Hazardous Materials Accident Report TDI Waste Information Over the years, the Lake Charles plant shipped to Essroc (and other waste disposal companies) two types of wastes generated from TDI production. The first type, designated as “solvent blend waste,” was generated during the final purification and distillation of the TDI product. The second type, designated as “TDI matter waste,” was generated from an intermediate product stream removed during the TDI production process. (Generation and shipment of the solvent blend and TDI matter wastes from the Lake Charles plant are discussed in the next section.) The solvent blend wastes and the TDI matter wastes contained comparable percentages of TDI and TDI polymers. For example, the TDI matter waste mixture in UTLX 643593 (the accident tank car) was approximately (by weight) 42 percent monomeric TDI and 38 percent polymeric TDI.16 Monomeric TDI is a clear to slightly yellow liquid, and polymeric TDI is a dark brown to black liquid or a glass-like black solid. Both the monomeric and polymeric forms of TDI present high ingestion and inhalation hazards and are combustible, with flash points17 of 270° F. Monomeric and polymeric TDI are stable at temperatures below 104° F. At higher temperatures, monomeric TDI can “self-react”18 in two ways, either by combining to generate polymeric TDI or by reacting to produce carbon dioxide gas and a type of chemical compound known as a carbodiimide. At higher temperatures, the polymeric TDI can decompose and release gaseous byproducts such as carbon dioxide, carbon monoxide, and oxides of nitrogen. Both monomeric and polymeric TDI are reactive with water. TDI will react slowly with water under 122° F; the reaction with water will accelerate rapidly in the presence of alkaline materials and at higher temperatures. Olin’s information concerning “TDI product” (TDI in its monomeric form) noted that TDI should not be stored at temperatures above 104° F. Solvent blend wastes and TDI matter wastes differ with respect to the blending agent present in each that formed the balance of the waste mixture and served to reduce its viscosity. The blending agent typically used for solvent blend wastes was HAN 906, a mixture of flammable petroleum hydrocarbons, such as naphthalene and trimethylbenzene. HAN 906 is combustible and has a flash point of 145° F. Monochlorobenzene (MCB), the blending agent used in the TDI production process and found in the TDI matter wastes, is also a flammable liquid and has a flash point of 82° F. Both HAN 906 and MCB are chemically stable. 15 The term set point applies to the pressure at which a device, such as the pressure relief valve, which is designed to open at some specific pressure, opens. 16 A monomer is a relatively simple molecule or compound of low molecular weight and simple structure. A polymer is a relatively complex compound formed from the combination of some number of molecules or groups of molecules to create a chainlike macromolecule. 17 A flash point is the temperature at which a liquid gives off a vapor sufficient to form an ignitable mixture with the air near the surface of the liquid or within the test vessel. 18 Self-reaction occurs when molecules of a chemical interact with each other (often because of increased temperature) and combine to form a molecular chain.

Factual Information 19 Hazardous Materials Accident Report Lake Charles Plant Shipments of TDI Waste When UTLX 643593 was loaded in 1993, Olin owned and operated the Lake Charles, Louisiana, plant where the company produced TDI (and generated TDI waste). In December 1996, Olin sold its TDI production business, including the Lake Charles plant, to Arco Chemical Company (Arco). In July 1998, Lyondell Chemical Company (Lyondell) acquired Arco and its assets. Lyondell assumed Arco’s responsibilities under the 1996 Olin/Arco purchase agreement and took ownership and operational control of the Lake Charles plant. Operations Under Olin Ownership Olin used tank cars to transport and store two distinct chemical streams generated from the production of TDI — solvent blend waste and TDI matter waste. Solvent Blend Waste. The first stream, solvent blend waste, was generated by the distillation and purification of the TDI product. The waste stream from the distillation process contained monomeric TDI and polymeric TDI that were normally routed to an incinerator on the plant site. When the incinerator’s capacity was exceeded or the incinerator was not operable, this waste stream would be pumped into a fixed storage tank where it was mixed (blended) with HAN 906 solvent to reduce its viscosity. According to the waste profiles for solvent blend waste, after the blending with the HAN 906 solvent, the viscosity of the solvent blend waste was about 150 centipoise (cp).19 Periodically, when the storage tank was filled, the solvent blend wastes in the fixed storage tank were pumped into rail tank cars or highway cargo tanks for transportation to an off-plant disposal site for thermal destruction. Olin contracted Chemical Waste Management, a waste management contractor, to handle the transportation and disposal of its solvent blend waste. In late 1995, Chemical Waste Management, on Olin’s behalf, approached CPRIN and Essroc about burning solvent blend waste at Essroc’s Logansport cement plant. In a June 5, 1996, letter, CPRIN advised Olin that the solvent blend wastes were acceptable for incineration at the Essroc Logansport plant. Records of tank car shipments and offloading submitted by Olin and Essroc indicate that 70 tank carloads of solvent blend waste were shipped from Olin to Essroc between July 11, 1996, and April 29, 1998.20 Between July 31, 1996, and July 21, 1998, 67 of these 70 tank cars were successfully offloaded at the Essroc plant, and the solvent blend wastes were burned without incident. According to Essroc records, the company rejected the three remaining tank cars in January and February 1998 because the wastes they contained did not meet Essroc specifications. One of these three cars (GATX 25412) was in the Logansport yard at the time of the February 1999 accident. 19 Centipoise is the metric measurement unit for viscosity. 20 Comparison of the shipping records from Olin and Essroc showed minor inconsistencies in the shipment and offloading data. The figures cited in this report are the most accurate numbers that could be obtained from the available data.

Factual Information 20 Hazardous Materials Accident Report TDI Matter Waste. TDI matter waste was an intermediate product stream from Olin’s production of TDI. TDI matter waste was a mixture of monomeric TDI, polymeric TDI, and MCB. The MCB in the TDI matter waste acted as a solvent for the substance, which reduced its viscosity. Through reprocessing, Olin could recover both MCB and monomeric TDI from the TDI matter waste. Beginning in October 1988, at various times, Olin stored the TDI matter waste in tank cars rather than halting the production process when it experienced problems with the processing equipment or the incinerator. Under this practice, Olin would later reintroduce the TDI matter waste stored in the tank cars to the production process to recover the monomeric TDI and MCB. Eventually, Olin’s efforts to maximize production resulted in the on-site accumulation of a growing number of tank cars that stored TDI matter waste. In early 1996, Olin increased its efforts to either reprocess the stored TDI matter waste on-site or ship the tank cars to disposal sites where the TDI matter waste could be incinerated. Olin continued to use tank cars for storing TDI matter waste until late 1996. Olin loaded the last tank car carrying TDI matter waste on November 30, 1996. Olin indicated that it used 144 tank cars for storing TDI matter waste and that it reused an unspecified number of these tank cars for storage after loads of TDI matter waste had been reprocessed at the plant. According to Lyondell, 234 tank carloads of TDI matter waste were stored at the Lake Charles plant during the 8 years Olin followed this practice. Olin and Lyondell both confirmed that the TDI matter waste was stored in tank cars only at the Lake Charles plant. Operations Under Arco/Lyondell Ownership On October 9, 1996, Olin and Arco signed a purchase agreement for the Lake Charles plant. Under the terms of the purchase, Arco agreed to assume control and ownership of the TDI matter waste then stored in 128 tank cars at the Lake Charles plant, if the Louisiana Department of Environmental Quality determined that the stored TDI matter waste was in-process material and not a hazardous waste. When this condition was satisfied, on or about December 6, 1996, the sale of the plant was completed. While purchasing the plant, Arco decided to discontinue the practice of using tank cars for interim storage of the TDI matter waste when the company encountered operation problems with the TDI production equipment. Arco elected to reduce the TDI production rate or shut down production rather than continue to use tank cars for storage. Consequently, the Olin-Arco purchase agreement included terms for processing the 128 tank cars then in storage at the Lake Charles plant. Under these terms, Arco was to either reprocess the TDI matter waste stored in the tank cars at the plant or ship it offsite for thermal destruction by June 30, 1998. This deadline was subsequently extended to October 1, 1998. After October 1, 1998, any remaining tank cars were to be declared “excess TDI matter rail cars.” Arco had two options for handling such tank cars. Arco could either (1) ship the tank cars to an off-site disposal facility for thermal destruction of the waste at Olin’s expense, subject to monetary conditions, or (2) require Olin to take possession of the tank cars, assume their leases, transport them to an off-site facility for disposal of the waste, and permanently remove the tank cars from the Lake Charles site.

Factual Information 21 Hazardous Materials Accident Report (Olin later indicated that Essroc and two waste disposal companies incinerated the excess TDI matter waste.) In early 1998, on behalf of Arco, Chemical Waste Management approached CPRIN and Essroc about disposing of TDI matter wastes from the Lake Charles facility at Essroc’s Logansport plant. Initial shipment of tank cars carrying the TDI matter wastes to Essroc began in early March 1998, and acceptance of the TDI matter wastes at Essroc was approved in a June 10, 1998, letter from CPRIN to Arco. The waste profile sheet that accompanied CPRIN’s June 10 letter stated that the viscosity of the TDI matter waste at 70° F “varies.” Between early March 1998 and early November 1998, Arco/Lyondell shipped 40 tank cars containing TDI matter wastes from the Lake Charles plant to Essroc. Between July 31, 1998, and the date of the accident, 14 of the 40 tank cars were offloaded at the Essroc plant. The wastes from four tank cars were offloaded, blended in a fixed tank, and pumped to the kilns and burned. The wastes from 10 tank cars were offloaded and pumped directly to the kilns, without any blending. (This was termed the “direct injection” process.) The accident tank car, UTLX 643593, would have been the fifteenth tank car to be offloaded at Essroc, and the eleventh offloaded by direct injection. Of the remaining 25 of the 40 tank cars, Essroc was unsuccessful in blending the wastes from 1 tank car; this car was shipped to a transfer facility in Deer Park (Houston), Texas, before the accident. Twenty-four of the original 40 tank cars remaining at Essroc were shipped to the Deer Park facility after the accident.21 Lake Charles TDI Waste Offloading and Processing Procedures Olin Olin told the Safety Board that it heated the TDI matter waste at the Lake Charles plant by slowly passing low-pressure (around 10 psig) steam through the coils in the rail car. At times, heating the TDI matter waste in this manner took 2 to 3 days. Olin said its procedure was to make sure that there was no back pressure on the steam coil and that the exit line continued to produce warm water and a small amount of steam, ensuring that the steam was not trapped. Olin stated that during the steam heating, it mixed the TDI matter waste by a process known as “nitrogen sparging” to facilitate even heating. In this process, nitrogen gas was injected through the eduction line at the top of the tank car. When the nitrogen exited the end of the eduction line at the bottom of the tank car, the nitrogen would mix the TDI matter waste, facilitating its even heating. Olin maintained the nitrogen line at a slight positive pressure to avoid suctioning the TDI material from the railcar. Vapors and gases 21 Olin revised this accounting in August 2000. Thirteen tank cars were shipped directly from Lake Charles and arrived in Deer Park between December 15, 1998, and April 1, 1999. A fourteenth tank car was also shipped from Essroc to Deer Park about 2 weeks before the accident.

Factual Information 22 Hazardous Materials Accident Report vented from the tank car flowed to a vapor emissions system and/or an incinerator. Typically, Olin gradually heated the TDI matter waste in the tank car to 90 to 100° F during the sparging process until the mixture was pumpable. Olin indicated that it never heated the TDI matter waste above 110° F because of possible degradation of the recoverable monomeric TDI. Olin said it monitored the temperature and pressure on at least an hourly basis during the heating and nitrogen sparging processes. Through nitrogen sparging, the contents of the tank car were gradually heated, mixed, and made less viscous. Olin also added additional MCB to the tank car, if needed, to reduce the viscosity of the TDI matter waste. During this process, Olin drew samples of the TDI matter waste to determine the viscosity of the mixture. When the viscosity of the TDI matter waste was sufficiently reduced, Olin would offload the waste from the tank car and reintroduce it into the TDI production stream. Olin stated that the on-site blending process with the HAN 906 solvent at the Lake Charles plant for TDI matter waste to be shipped off-site for disposal followed the same procedures for low-pressure steam heating and nitrogen sparging as were followed when the TDI matter waste was offloaded from the tank cars and reintroduced into the plant production stream. The one difference in the procedures was that the TDI matter waste to be shipped off-site was occasionally heated to around 130 to 140° F. The higher temperatures were permitted under the blending procedure because recovery of monomeric TDI was no longer an objective; so heat-caused damage to the substance was not a consideration. Olin also indicated that the temperature of the TDI matter waste in the tank cars never exceeded 140° F. Olin added HAN 906 solvent to the TDI matter waste in the tank cars until the TDI waste mixture met specifications for chlorine content of less than 3 percent and viscosity of 400 to 500 cp, as prescribed by Essroc. The tank cars containing the TDI matter waste were then shipped to Essroc for disposal. Arco/Lyondell When Arco assumed ownership of the Lake Charles plant, it determined that it would not reintroduce the TDI matter waste stored in tank cars to the TDI production stream but ship it all offsite for disposal. Arco said it typically blended the TDI matter waste stored in the tank cars with HAN 906 solvent before shipping the waste to a disposal site. According to Lyondell, contractors for Olin blended the stored TDI matter waste with HAN 906 solvent. Lyondell stated that Arco/Lyondell did not have specific written procedures for on-site blending of the TDI waste mixtures and offloading them from tank cars because Olin or Olin contractors blended and disposed of this TDI waste. Arco/Lyondell said it had written procedures for producing solvent blend wastes in a fixed blending tank at the Lake Charles plant site and then transferring the solvent blend wastes from the blending tank into tank cars. These procedures set the temperature and viscosity limits for the solvent blend wastes in the fixed blending tank. The viscosity of the solvent blend wastes in the blending tank was to be less than 200 cp at a reference temperature of 78° F. The temperature of the solvent blend wastes in the blending tank was to be maintained at

Factual Information 23 Hazardous Materials Accident Report 125° F (± 5° F). Further, if the ambient air temperature were below 45° F, the temperature of the solvent blend wastes was to be increased to 145 to 155° F before the solvent blend wastes were transferred to a tank car, to prevent the wastes from plugging the transfer piping. Apart from these procedures, neither Olin nor Arco/Lyondell had written operating procedures or limitations that addressed the potential for gas generation or product expansion, the maximum temperature and time for heating the TDI wastes, or the maximum product viscosity for offloading tank cars. Lyondell also noted that the company did not conduct any tests on the effects of heating the TDI wastes. Essroc TDI Waste Disposal Operations Guidance on Processing TDI Waste Mixtures Solvent Blend Wastes. During the evaluation of the 1996 proposal to burn solvent blend wastes at Essroc’s Logansport plant, Essroc and CPRIN personnel visited the Lake Charles plant to observe Olin’s process for handling and incinerating the solvent blend wastes. According to CPRIN, most of the information discussed addressed the risks from exposure to the solvent blend wastes and the necessary equipment to protect Essroc and CPRIN employees who would be involved in processing the solvent blend waste mixtures. Olin also discussed with Essroc and CPRIN the reactivity of the solvent blend wastes with water. CPRIN stated that it advised Chemical Waste Management that the viscosity of the solvent blend wastes had to be less than 500 cp before they could be shipped to Essroc. According to CPRIN, Olin indicated that, to meet this standard for viscosity, the solvent blend wastes would only have to be heated to about 90 to 100° F for Essroc to offload and pump the wastes directly to the kilns. Essroc stated that because CPRIN was responsible for heating and delivering the solvent blend wastes in sufficiently fluid states, any operational procedures or limits for heating the waste mixtures were directed toward CPRIN. CPRIN indicated to the Safety Board that Essroc retained ultimate authority over heating, handling, and offloading the wastes; therefore, any change in procedures for heating the wastes would require Essroc approval. TDI Matter Wastes. In early 1998, Chemical Waste Management approached CPRIN and Essroc about incinerating TDI matter wastes at the Logansport plant. Between March and June 1998, Olin, Chemical Waste Management, CPRIN, and Essroc evaluated the proposal and determined that TDI matter wastes could be processed and incinerated at the Essroc plant. Under this plan, the TDI matter wastes would be offloaded from the tank car to a fixed tank where the wastes were to be blended with HAN 906 solvent. The blended TDI matter wastes would then be pumped to Essroc’s kilns and burned.

Factual Information 24 Hazardous Materials Accident Report Before Essroc agreed to accept the TDI matter wastes in spring 1998, a TDI expert who worked at the Lake Charles plant22 visited the Essroc plant to meet with Essroc and CPRIN personnel and to instruct them about handling and processing the TDI matter wastes. According to the Lake Charles TDI expert, he told the Essroc and CPRIN personnel that the TDI matter wastes would have to be heated to 125° F before they could be offloaded from the tank car and transferred to the blending tank. In response, Essroc and CPRIN expressed concerns about the generation of the poisonous chemical phosgene and the heating of the TDI matter wastes above 110° F, which was the maximum recommended temperature for pure TDI cited in Olin’s product literature. According to CPRIN, the Lake Charles TDI expert advised that the 110° F temperature limit applied only to the pure monomeric TDI product, which, if heated above that temperature, could not be sold as a usable product. Because Essroc never intended to recover the monomeric TDI from the waste materials in the tank cars sent it for disposal, degradation of the monomeric TDI in the wastes was no longer a concern. Essroc and CPRIN both indicated that the Lake Charles TDI expert said that the TDI matter was heated to temperatures as high as 350° F at the Lake Charles plant, and that the concentration of phosgene in the TDI matter at elevated temperatures was not sufficient to present a hazard. As a result, CPRIN stated it was “given the impression that we should not be concerned about how hot we heated the TDI material.” CPRIN further stated that Olin provided no guidance or information about the potential for gas generation and/or product expansion during heating, nor did Olin provide a recommended viscosity for offloading. According to Essroc, Olin advised Essroc personnel that expansion of the TDI matter wastes during heating was “normal” and that phosgene gas would not likely be generated if the wastes were heated over 125° F. Essroc said that the Lake Charles TDI expert also told its personnel that heating the wastes before offloading them was intended to make the wastes sufficiently fluid to be transferred, not to enable the wastes to meet an established viscosity threshold. Essroc acknowledged that the Lake Charles TDI expert said that a long, slow heating process, possibly taking 2 to 3 days, would sometimes be necessary before the TDI matter wastes would flow. During a December 1999 Safety Board interview, the Lake Charles TDI expert who had met with Essroc and CPRIN personnel stated that he had discussed the various handling and offloading procedures with them. He said that the procedures discussed had included heating the tank car with low-pressure steam, using nitrogen sparging to facilitate even heating of the TDI matter wastes, and keeping the temperature of the TDI matter wastes below 130 to 140° F. The Lake Charles TDI expert also stated that he discussed the chemical properties of the TDI matter waste, including its reactivity with water and the possible generation of phosgene and carbon dioxide, with Essroc and CPRIN personnel. 22 This employee worked at the Lake Charles TDI plant under the successive managements of Olin, Arco, and Lyondell as the TDI production facility changed ownership between 1993 and 1999. This report will refer to this employee as the “Lake Charles TDI expert.”

Factual Information 25 Hazardous Materials Accident Report In response to Safety Board inquiries about the guidance it provided to Essroc and CPRIN, Olin said that it told Essroc and CPRIN (through its company expert) about using low-pressure steam and nitrogen sparging to evenly heat the TDI matter wastes in the tank cars. Olin also stated that it told Essroc and CPRIN to keep the temperature of the wastes from exceeding 130 to 140° F. Responding to a Safety Board request for copies of any written guidance provided to Essroc and CPRIN, Olin stated in a January 14, 2000, letter that “to the extent that a written policy or procedure exists for heating TDI matter, it was turned over to Arco as part of the business sold to Arco.” In response to the same Safety Board request, Lyondell stated in a January 24, 2000, letter that “since Olin interfaced with Essroc, Arco or Lyondell recommended no guidance or operational limits for heating railcars for unloading.” Operational Problems Soon after Essroc began accepting the TDI matter wastes in May 1998, the company began to experience problems with the on-site blending process. Sediment from the unblended wastes built up in the fixed blending tank. In addition, Essroc was unable to pump the blended waste from the blending tank to the kilns because the blended waste was solidifying in the pipelines that ran from the blending tank to the kilns. According to the Essroc facility supervisor, Essroc stopped using the storage tank for blending in September or October 1998. In November 1998, the Lake Charles TDI expert again visited the Essroc plant to determine the cause of the problem with the blending system, but he could not pinpoint it. According to the Essroc facility supervisor, the Lake Charles TDI expert advised Essroc during this visit that the TDI matter wastes could be burned by direct injection from the tank cars to the kilns rather than blending the wastes before feeding them to the kilns. The Lake Charles TDI expert told the Safety Board that, as part of his November 1998 visit to the Essroc plant, he and two CPRIN employees checked the fluidity of the TDI matter wastes in UTLX 643593 (the accident car), UTLX 643560, and possibly one other tank car. They checked the fluidity by lowering a rod into the tank cars and sensing the resistance to withdrawing the rod. The Lake Charles TDI expert stated that UTLX 643593 had retained a “slight” positive pressure in the tank. He described the condition of the wastes in the three tank cars as “pretty stiff.” He stated that a sample of the TDI matter waste was normally drawn from each tank car at the Lake Charles plant before the car was shipped from the plant. The viscosity of the sample was routinely measured to ensure that it was within customer specifications. If the viscosity were too high, HAN 906 solvent would be added to bring it within specifications before the tank car was shipped. The Lake Charles TDI expert acknowledged that, for some unknown reason, the three tank cars he examined at Logansport in November 1998 had been shipped from the Lake Charles plant without samples being drawn or verification being made that the viscosities were within Essroc specifications (400 to 500 cp). Lyondell later confirmed

Factual Information 26 Hazardous Materials Accident Report that tank cars UTLX 643593 (the accident car), UTLX 643560, and UTLX 643562 were shipped on the same date from Lake Charles. (Shipping records from Olin and Essroc indicate that UTLX 643562 was offloaded by late September 1998.) In response to Safety Board inquiries about how this occurred, Olin responded that it was their understanding that “Arco decided not to add HAN 906 solvent,” based on the original analysis of the TDI matter waste in each tank car at the time of loading. Lyondell responded that 28 tank cars containing TDI matter waste were shipped to Essroc between March and September 1998, including UTLX 643593, UTLX 643560, and UTLX 643562, because blending of the wastes was to be performed on-site at Essroc. Lyondell stated that the tank cars were shipped “unblended at the request of Olin.” Configuration of Essroc Offloading Station The Essroc plant’s offloading area had two stations for tank cars, one on the west side of the kilns and one near the fixed storage tanks. The offloading area also included a station west of the tank car stations; this western station was used to offload cargo tank trucks. To offload a tank car, connections to the fixed plant piping were made at the tank car’s vapor valve and one of its two loading line valves. The connection to the vapor valve on the tank car controlled the nitrogen system and the vapor emissions system. Nitrogen gas was injected into the tank car’s vapor space to maintain a positive pressure of 20 to 25 psig and to provide a nonflammable mixture in the vapor space. The vapor emissions system passed the vapors vented from the tank car through a series of filters before any vapors were released to the atmosphere.23 The single line from the vapor valve on the tank car contained a shutoff valve and a coupler to the tee fitting that was connected to a coupler for the nitrogen system and a coupler for the vapor emissions system. The nitrogen supply line and the vapor emissions line were also equipped with isolation valves. With this configuration, nitrogen could be injected into the tank car or vapors vented from the tank car through the vapor emissions system. (Nitrogen could not be injected while vapors were being vented.) The nitrogen was stored in a bulk tank located in the offloading area. The nitrogen was cycled through two heaters before it flowed into the tank car. According to the vendor that supplied the nitrogen to Essroc, the specifications for the nitrogen stipulated a purity of 99.999 percent and a maximum water content of 1.5 parts per million (0.00015 percent by volume). The Essroc TSD facility supervisor indicated during a postaccident interview that Essroc had had no problems with the nitrogen system before the accident. A section of flexible hose equipped with a coupler and a valve was connected to one of two loading line valves on the tank car. The coupler on this flexible hose could be connected to one of three fixed pipelines: (1) a pipeline serving as a direct feed to the kilns, (2) a pipeline from the storage tanks containing HAN 906 solvent, and (3) a pipeline from the storage tanks containing toluene. Cross-connections between the three pipelines and the placement of pumps and valves enabled Essroc to blend the TDI matter wastes 23 To ensure compliance with air quality standards.

Factual Information 27 Hazardous Materials Accident Report with the HAN 906 solvent in a fixed tank and to flush the plant piping from the kilns back to the tank car. The facility supervisor also said, in a postaccident interview, that the offloading stations had no water lines. An air line led to the offloading station; the air line could not be cross-connected to the nitrogen line. The boiler used to generate the steam to heat the wastes in the tank cars was in a truck trailer north of the tank car offloading station. The CPRIN service manager at the Essroc plant said that the boiler was automatic. The main valve on the boiler controlled the amount of steam delivered to the tank car; it was the only valve manipulated in the steam-heating process. The valve was normally open about halfway. The steam flowed through a 75-foot-long feed line from the boiler to the inlet connection on the bottom center of the tank car. The pressure of the steam discharged from the boiler was between 100 and 125 psig; the maximum design pressure of the boiler was 150 psig. After the steam circulated through the heating coils on the tank car, it flowed through a return line to a steam trap or condensate tank located in the same trailer as the boiler. According to the CPRIN manager, the water in the return line was about 180° F. Essroc Offloading Procedures Essroc’s plant procedures manual contained written instructions for moving and unloading any tank car containing any type of waste fuel and standard operating guidelines that applied specifically to the tank cars carrying TDI wastes. The guidelines addressed receiving and positioning such cars, drawing samples from them, offloading the TDI wastes to a fixed tank, and purging the flow lines after the offloading was complete. The Essroc facility supervisor said that Essroc developed these written procedures in 1995 before the company began to burn standard solvent blend wastes. The facility supervisor also stated that Essroc had written procedures on how to blend TDI wastes in the fixed tank after they were offloaded from a tank car and before they were pumped to the kilns for incineration. The waste fuel technicians had no written procedures or checkoff lists for directly feeding TDI wastes from the tank car to the kilns (the process used for offloading UTLX 643593). The Essroc written procedures that applied to all tank cars and those specific to the tank cars carrying TDI wastes addressed subjects such as the sequence for opening and closing valves, the means of connecting and disconnecting nitrogen lines, and the ways of increasing and decreasing internal tank car pressures to specific limits. The procedures did not address heating the waste cargoes, limiting temperatures, or limiting maximum viscosities (to ensure the cargo was sufficiently fluid for offloading). The Essroc facility supervisor stated during postaccident interviews that Essroc personnel would not allow CPRIN to heat TDI wastes to more than 200° F because of a concern that phosgene might be released. The facility supervisor also stated that Essroc workers determined that the TDI wastes were ready for offloading when the wastes were thin enough to flow, rather than when they reached some specific temperature.

Factual Information 28 Hazardous Materials Accident Report The CPRIN manager stated that CPRIN had no written procedures or checkoff lists addressing the steam heating of rail tank cars containing TDI wastes or other waste cargoes. He said that the criteria that CPRIN used for steam heating the tank cars was to conduct steam heating until the viscosity of the TDI wastes was reduced and the waste was in a pumpable state. According to the CPRIN manager, it was not unusual to apply two steam cycles to a tank car containing TDI waste fuels. He also indicated that they applied more heat to UTLX 643593 than to other tank cars. Postaccident Actions FRA-Ordered Inspections and Tests When the accident occurred, 24 tank cars containing TDI matter waste either were stored in the Logansport rail yard or had been delivered to the Essroc plant. Olin advised the FRA on March 23, 1999, that an additional 10 cars containing TDI wastes were at the Deer Park transfer facility in Houston, Texas. Following the rupture of UTLX 643593, Olin and Lyondell determined that the 24 tank cars in the Logansport area should be sent to Deer Park for offloading. Because of the possibility that UTLX 643593 had failed from overpressurization, the FRA ordered the testing of the pressure relief valves from a representative sample of four of the tank cars in the Logansport area to ensure the valves were functioning properly before the tank cars could be moved. The pressure relief valves from tank cars UTLX 643560, UTLX 643588, GATX 36571, and GATX 92907 were removed and tested at the Midland Manufacturing production facility in Skokie, Illinois, on March 18 and 25, 1999. Because UTLX 643560 and UTLX 643588 were sister tank cars of UTLX 643593, they were equipped with the same model pressure relief valve, a Midland model A-1479 ER relief valve. Tank cars GATX 36571 and GATX 92907 were equipped with Midland model A-1775-P and A-2085 (respectively) pressure relief valves. Federal regulations at 49 CFR 180.509 require that pressure tests be conducted every 10 years for the pressure relief valves on these tank cars. The pressure relief valves on UTLX 643560, UTLX 643588, and UTLX 643593 had last been tested in 1993 and were due for retesting in 2003. The pressure relief on GATX 36571 had last been tested in 1989 and was due for retesting in 1999. The pressure relief valve on GATX 92907 had last been tested in 1993 and was due for retesting in 2003. The four valves were pressure-tested on March 18, 1999, in accordance with the procedures in appendix D of the Association of American Railroads (AAR) Specifications for Tank Cars (M-1002).24 The FRA reported that all four valves, which were to have discharge pressures of 75 psig, failed to meet the tolerances for the start-to-discharge 24 Association of American Railroads, Specifications for Tank Cars, In: Manual of Standards and Recommended Practices, Section C - Part III, Specification M-1002, Washington, DC, 1996.

Factual Information 29 Hazardous Materials Accident Report pressure25 and vapor-tight pressures required under Federal regulations for tank cars transporting hazardous materials. Although the start-to-discharge pressures recorded for the valves from UTLX 643560 and UTLX 643588 ranged from 83 to 90 psig, each valve began leaking at 2 to 3 psig. Over three test cycles, the model A-2085 valve from GATX 92907 had a start-to-discharge pressure ranging from 84 to 94 psig, and a vaportight pressure of 20 psig. The model A-1775-P valve from GATX 36571 had a start-to-discharge pressure of 250 psig on its first test, and 120 and 130 psig on two subsequent tests. The vaportight pressure could not be determined. The O-rings from each valve were examined and tested for brittleness. According to Midland representatives, the O-rings should have durometer26 readings ranging from 70 to 75 for the relief valve to function properly. Durometer readings for the O-rings were generally in the mid-90s. (Durometer readings increase as a substance’s brittleness increases.) The O-rings also exhibited varying degrees of brittleness, swelling, hardness, and cracking. The condition of the metallic components varied widely: heavy rust, scale, pitting, and grit were observed on some valve components from GATX 36571 and GATX 92907. The valve components from UTLX 643560 and UTLX 643588 either had light scale and rust or exhibited no visible deterioration. Based on these test results, the FRA required that Olin and Lyondell either replace the pressure relief valves on the remaining tank cars in Logansport (24 cars) and Deer Park (10 cars) or prove that the pressure relief valves on the remaining tank cars complied with Federal regulations before any of the tank cars could be moved in commerce. Disposition of TDI Wastes in Other Tank Cars In response to the FRA directive, Olin and Lyondell had the pressure relief valves replaced on all 24 tank cars in the Logansport rail yard before moving any of the tank cars to Deer Park, Texas, where they were to be offloaded. By June 22, 1999, the 24 tank cars shipped from Logansport had arrived in Deer Park, where they were staged until they were individually offloaded at the terminal. Olin contracted a waste disposal firm to dispose of the TDI matter wastes in the 24 tank cars shipped from Logansport and the other tank cars sent to Deer Park. The waste disposal firm was to blend the TDI matter waste with HAN 906 solvent as needed to reduce the viscosity of the waste below a prescribed level before transloading the wastes from the tank cars to tank trucks. The blending agent was added to the TDI matter waste to reduce the waste’s viscosity to ensure that it would be sufficiently fluid to allow it to be offloaded into tank trucks. The tank trucks delivered the wastes to incineration sites in Houston, Texas, and Baton Rouge, Louisiana. 25 The start-to-discharge pressure is the pressure at which the spring-loaded valve begins to lift, allowing vapor to flow through the valve and vent from the tank. 26 Tool for measuring the degree of brittleness or hardness of a gasket.

Factual Information 30 Hazardous Materials Accident Report The blending and offloading of the wastes in these tank cars began on August 2,

1. Olin reported that by August 9, 2000, five cars remained to be offloaded. Since

August 2000, two tank cars have been successfully offloaded. In the three remaining cars, the TDI matter waste has solidified and cannot be successfully pumped from the tanks. An attempt to offload two of the three cars by mechanical extraction (grinding) is planned for

1. Experts believe that the final car may have to be cut apart to remove the solidified

waste. UTLX 643560, which had a loading history and waste composition most similar to UTLX 643593, had been offloaded on December 2, 1999. The initial viscosity of the TDI matter waste in UTLX 643560 was 2,160 cp at 75° F. Slightly more than 2,500 gallons of toluene were blended with the waste in UTLX 643560 to reduce the viscosity to 325 cp at 75° F. Because of the reduction in the viscosity from blending with the toluene, steam heating of the waste was not required before offloading UTLX 643560. Olin also stated that no problems were encountered with increased pressures or temperatures concerning any of the tank cars offloaded at Deer Park. Postaccident TDI Matter Waste Offloading Procedures Following the accident (and before offloading began), Olin, with the assistance of waste disposal companies, developed written offloading procedures for the 24 tank cars that contained TDI matter wastes and had been stored in Logansport and for the 10 tank cars stored at Deer Park. Under these procedures, a sample of the TDI matter waste would first be drawn to determine its viscosity, which had to be less than 400 cp at 120° F before offloading could begin. If the viscosity of the TDI matter waste in an individual tank car exceeded this limit, the amount of HAN 906 solvent needed to lower the viscosity below the 400 cp threshold was calculated.27 Before any TDI matter wastes were transferred from the tank car to a cargo tank truck, technicians were required to conduct the following sequence of operations: • (To prevent overheating from high-pressure steam) Use low-pressure steam to heat the TDI wastes by connecting the steam supply to the inlet pipe for the heating coils on the tank car, leaving the discharge pipeline for the heating coils open; • Sparge the TDI waste mixture by injecting nitrogen through the eduction line to agitate the TDI waste while heating; • Continuously steam heat and mix until the temperature of the TDI waste reaches 125° F, at which time the steam heating and sparging are stopped; • Inject the previously calculated amount of HAN 906 solvent through the eduction line; • Recommence sparging of the TDI waste with nitrogen for 1 hour; 27 Although these procedures specified the use of HAN 906, toluene (a hydrocarbon) could be used as a solvent to reduce the viscosity of the wastes. As noted earlier, toluene was used to reduce the viscosity of the wastes in UTLX 643560.

Factual Information 31 Hazardous Materials Accident Report • Draw a sample of the TDI waste from the tank car and measure its viscosity. (If the viscosity were less than 400 cp, the TDI wastes were to be offloaded from the tank car to cargo tank trucks. If the viscosity exceeded 400 cp, the cycle of steam heating, sparging, and adding HAN 906 solvent was to be repeated until the specifications for viscosity were met.) The written procedures also specified that the temperature of the TDI matter waste should be maintained at 125° F, ± 10° F. Inspections and Tests Metallurgical Examination After the accident, three sections were cut from UTLX 643593 and sent to the Safety Board’s materials laboratory for further examination. The sections were: (1) a 35-inch-long section of the fracture surface along the tank’s bottom center toward the A-end, (2) a section from the top center that appeared to be unaffected by the tank rupture, and (3) a section from the bottom center containing a tear in the exterior tank wall. The 35-inch-long section of the fracture surface was taken from a tank location with the lowest wall thickness, based on field measurements. Measurements of the wall thickness along the fracture face ranged from 0.285 to 0.338 inch. Plastic deformation (necking) of the tank wall along the fracture was observed. The fracture face in the area where the tank wall was thinnest contained shear lips on both the exterior and interior surfaces and a small flat fracture region between the shear lips. The fracture features were typical of ductile tensile overload fractures in low-carbon steels. X-ray energy dispersive analysis indicated that the chemical composition of the steel was consistent with the ASTM A516 grade 70 steel specified for the tank material. The tank wall in the section removed from the top center of the tank (which had appeared to be unaffected by the rupture) had an average thickness of 0.545 inch. According to Union Tank Car, the thickness of the shell plate before it was rolled into the tank cylinder ranged from 0.569 to 0.580 inch. The microstructure of the tank material was typical of ASTM A516 grade 70 steel in a hot-rolled condition. Based on hardness tests, the ultimate tensile strength was about 89,000 pounds per square inch (ksi). The specified tensile strength of the tank plate was 70 to 90 ksi. The reported tensile strength of the plate from which this tank was manufactured was 78.8 ksi. Plastic deformation was found on the section removed from the bottom of the tank car that had tearing damage on the exterior surface. Hardness tests indicated that this section had an ultimate tensile strength of 89 ksi.

Factual Information 32 Hazardous Materials Accident Report Examination of the Pressure Relief Valve and Other Fittings The dome assembly, including the manway cover, valves, piping, and surrounding tank shell, was cut from UTLX 643593’s tank on February 24, 1999. The dome assembly was taken in April 1999 to Marsh Railcar Services in St. Peters, Missouri. Testing and examination of the pressure relief valve and the other valves mounted on the manway were conducted on May 18, 1999. Solid TDI waste material filled about half of the interior of the dome nozzle. Loose pieces of the solid waste were removed to expose a portion of the manway coverplate. The remainder of the manway coverplate interior was covered with a layer of solid, glassy-looking TDI matter waste that was molded into the dome nozzle. The thickness of this layer was 4 to 5 inches. This layer was chipped out to expose the complete interior side of the manway coverplate. Some TDI waste residue was also on the exterior side of the manway coverplate, between the base of the pressure relief valve and the valve for the B-end loading line. An information card about the health hazards of pure TDI and a plastic bag containing an Olin rail car complaint form were also found within the dome housing. These two items had no apparent heat or thermal damage. The pressure relief valve, the vapor valve, the vacuum relief valve, and the two loading line valves were removed and examined. The Teflon gaskets used to seat these valves on the manway coverplate were clean and had no visible deterioration. The condition of each valve is detailed below. Pressure Relief Valve. The pressure relief valve was unbolted and removed from the manway coverplate. The orifice in the manway coverplate for the pressure relief valve was completely plugged with solid TDI waste. The solid TDI waste had also flowed onto the exterior of the manway coverplate below the base of the pressure relief valve, between the orifice opening and the Teflon seating gasket. TDI waste filled and plugged the throat of the pressure relief valve. (See figure 9.) The vertical alignment of the pressure relief valve was measured. No misalignment was noted or observed. Dirt, grease, and some corrosion were observed on the exterior surfaces. (The pressure tests and teardown are detailed in the next section.) Vapor Valve. The handle for the 1-inch vapor valve was not in the fully open position. The orifice through the manway coverplate was completely plugged with TDI waste. When investigators removed the valve, they noted that the inlet at the base of the valve was completely plugged with TDI waste. They disassembled the valve. TDI waste was molded to the interior of the valve; the waste completely plugged the valve from the inlet flange to the outlet flange. (See figure 10.) Vacuum Relief Valve. The orifice through the manway plate was plugged with TDI waste. The waste did not completely fill the orifice and came to within 1 inch of the exterior side of the manway coverplate. (Refer to bottom photo of figure 10.) No waste material was observed in the body of the valve.

Factual Information 33 Hazardous Materials Accident Report Figure 9. Top photo shows plugged opening in UTLX 643593 manway coverplate for pressure relief valve as viewed from the interior of the tank. Bottom photo shows view of plugged valve from the dome side of the manway cover. (NTSB)

Factual Information 34 Hazardous Materials Accident Report Figure 10. Top photo shows plugged opening in UTLX 643593 manway coverplate for vapor valve as viewed from the interior of the tank. Bottom photo shows plugged open- ings in manway coverplate for vapor (higher) and vacuum relief (lower) valves from the dome side of the manway cover. (NTSB)

Factual Information 35 Hazardous Materials Accident Report A-end Loading Line Valve. The valve handle was in the closed position. The threaded cap used to cover the valve outlet was in place and secure. When the valve was removed from the coverplate, it was seen to contain waste with a taffy-like consistency. B-end Loading Line Valve. The valve handle was in the closed position. The threaded cap used to cover the valve outlet was unscrewed and dangling from a chain attached to the valve. When the valve was removed from the coverplate, liquid trapped in the valve began to drip. During the inspection, one party representative remarked that the liquid had an odor similar to MCB. (The liquid and other viscous materials trapped in the valve were drained into a glass jar with a screw-on lid. These substances were subsequently sent to an independent laboratory for analysis. See section on “Chemical Analysis and Tests.”) The orifice in the manway coverplate was plugged to a depth of about 1 inch below the exterior surface of the coverplate with wet and very soft waste residue. After this residue was removed, a length of pipe was inserted to a depth of 14 inches through the manway plate opening into the loading line to determine whether TDI waste was in the loading line. No waste product was detected using the pipe probe. Thermometer Well. The cap was off. No other observations were noted. Pressure Tests and Teardown of Pressure Relief Valve The pressure relief valve was mounted on a test bench, and air pressure was applied to determine (1) if the start-to-discharge pressure was within the tolerance of ± 3 psi for the 75-psig set point and (2) if the valve, upon closing, was vaportight at not less than 80 percent of the start-to-discharge pressure. Five test runs were conducted. During the first two tests, the valve began to discharge at less than 10 psig and to continuously discharge as the air pressure was increased to 100 psig. For the third test, the TDI waste in the throat of the pressure relief valve was removed, and air pressure was again applied to the valve. The valve began to leak air at less than 10 psig. Before the fourth test, the pressure relief valve was disassembled without changing the spring setting. Debris on the valve seat was observed but left in place. (See figure 11.) After new O-rings were installed, the valve was reassembled, and, without cleaning the debris from the valve seat, air pressure was applied. The valve discharged at 3 psig. For the fifth test, the pressure relief valve was again disassembled and the debris was cleaned from the valve seat and all sealing surfaces. The new O-rings were lubricated, and air pressure was applied. The valve began to discharge at 73 psig, reseated when the air pressure was reduced, and was vaportight at 68 psig. This cycle was repeated twice more with comparable results. Following the pressure tests, the pressure relief valve was completely disassembled. The interiors of the valve and the spring were free of chemical debris and exhibited no indications of mechanical damage or corrosion. The two O-rings that had been removed from the pressure relief valve were examined and tested for brittleness. The large O-ring had a permanent set or deformation on the sealing surface with the valve. No set or deformation was noted on the small O-ring. Durometer measurements on the new O-rings and the two O-rings removed from the relief valve were taken and compared. Durometer readings for the new O-rings ranged from 70 to 74 (considered normal); the

Factual Information 36 Hazardous Materials Accident Report reading for the O-rings removed from the pressure relief valve ranged from 80 to 97 (indicating increased hardness and brittleness). Chemical Analyses and Tests Samples. Nine chemical samples, including a sample of the TDI waste matter drawn from UTLX 643593 before the accident, were recovered and shipped to the Lake Charles plant for analysis and testing. The other eight samples were recovered after the accident from the remnants of the tank car, debris on the plant grounds, and a cutout section of plugged pipe to the kilns. Heating tests were conducted on the preaccident sample drawn from UTLX 643593 (designated as the "retain" sample), the sample from the plugged pipe section (designated as the "pipe cutting" sample), and a waste sample from the Lake Charles plant. The tests were designed to analyze the effects of heating the samples similarly to the heating of the waste mixture that had been in UTLX 643593. Testing. The apparatus for the heating tests, known as the reactive system screening tool (RSST), monitored and recorded the temperature and pressure as a 10-cubic centimeter glass vial approximately 2/3 full of each test sample was heated in a closed chamber. The liberation or generation of gas would be indicated in a test run if there were a net increase in the pressure in the test chamber after the chamber had cooled to its initial temperature. The first four test runs were to be conducted following normal RSST methods of increasing the temperature at a controlled rate to the programmed cutoff temperature of 662° F. However, the sample in the first run could not be heated to the Figure 11. Pressure relief valve fitting. Arrows show debris on the valve seat. (NTSB)

Factual Information 37 Hazardous Materials Accident Report cutoff temperature because the glass vial shattered from expansion of the test sample. The sample was heated and held to a temperature range of 428 to 446° F for the maximum test time of 7.3 hours. In the fifth and final run, 10 grams of the preaccident sample drawn from UTLX 643593 were heated to 353° F and held at this temperature for 25.7 hours to approximate the maximum possible temperature of the steam used to heat UTLX 643593 and the total heating time of UTLX 643593. See table 1 for the results of the five test runs. The sample in each test run exhibited an increase in volume by the conclusion of the test run. The volume increase of the samples in two of the glass vials was sufficient to exceed the volume of the glass vial and cause the vial to break. The volume of the samples from the three remaining test runs expanded from 2/3 of the volume of the vial to fill the vial completely. The test results did not establish whether the volume increase was the result of the expansion of the sample or the entrapment of gas bubbles within the waste. Gas chromatographic analysis was conducted on the retain sample, the pipe cutting sample, and the typical waste sample to identify specific chemical compounds in each sample. The results of this analysis indicated that each sample contained TDI, chlorinated TDI impurities, and carbodiimides (byproduct of a self-reaction of the monomeric TDI). An independent laboratory conducted several analytical tests from December 1999 through February 2000 on the waste sample recovered from the B-end loading valve of UTLX 643593 during the inspections at Marsh Railcar Services in May 1999. The sample, when recovered, was a mixture of a viscous material and liquid. Although the sample had been placed in a glass jar and sealed, virtually all the liquid had evaporated when it was delivered to the laboratory for testing. The purpose of these tests was to identify the chemical components of the sample and to test specifically for the presence of toluene and amines. (Toluene was the solvent used by Essroc to flush the plugged piping to the kilns. Amines are a class of chemical compounds that would be byproducts of the reaction of TDI and water.) Infrared spectrometry and gas chromatography indicated the presence of toluene, amines, and MCB in the sample. Based on additional testing to determine the types of amines detected, the laboratory concluded that the amines present were “primary” amines that would be generated with the reaction of TDI and water. Table 1. Results of RSST runs on TDI waste matter samples Run Number Sample Source Net Pressure Increase (psi) 1 10.11 g of retain w/200 mg of water 9.4 2 10.10 g of retain 4.4 3 9.10 g of pipe cutting 20.0 4 10.00 g of typical waste 9.9 5 10.20 g of retain 3.5

Factual Information 38 Hazardous Materials Accident Report Approved Cargoes and Components for DOT Specification Tank Cars Federal Regulations and Oversight Under 49 CFR 179.15 of the DOT Hazardous Materials Regulations, the pressure relief device on a DOT class 111A tank car, such as UTLX 643593 and the four other tank cars tested at Midland in March 1999, must be made of materials that are compatible with the lading transported in the tank car. Paragraph A3.02 of appendix A of the AAR Manual of Standards for tank cars28 reads, “It is the shipper’s responsibility to assure that materials used for gaskets or valve seals are compatible with the lading and the service temperature.” The 49 CFR 179.15 compatibility requirement does not reference, or explicitly require conformance with, the AAR standard. In a February 9, 2000, response to Safety Board inquiries concerning the FRA hazardous materials safety program and issues involved in the Clymers accident,29 the FRA told the Safety Board that the DOT Hazardous Materials Regulations place the responsibility for ensuring that a package is appropriate for transportation on the “offeror” (typically the shipper) of the material. The FRA further stated that the selection should be made with input from the tank car owner, to ensure that the gasket configuration is appropriate for the device and that other entities have similar responsibilities in relation to the tank car’s maintenance. The FRA noted that the tank car manufacturer and tank car repair facilities each have a responsibility to ensure that the approved materials are used during the assembly of the tank car and for repairs or replacement. Nevertheless, the FRA stated that the DOT regulations require the offeror to ensure that the components on the tank car are correct before offering the tank car for transportation. The DOT Hazardous Materials Regulations also contain provisions regarding a change in the approved cargoes for a DOT specification tank car. Paragraph 49 CFR 173.31(a)(2) of the Hazardous Materials Regulations reads: Tank cars and appurtenances may be used for the transportation of any commodity for which they are authorized in this part and specified on the certificate of construction (AAR Form 4-2 or by addendum on Form R-1)... Transfer of a tank car from one specified service on its certificate of construction to another may be made only by the owner or with the owner’s authorization. A tank car proposed for a commodity service other than specified on its certificate of construction must be approved for such service by the AAR’s Tank Car Committee. The FRA, in response to Safety Board inquiries, indicated that, under the provisions of 49 CFR 173.31(a)(2), the offeror must secure approval from the tank car owner before making a change in product service. The offeror must also ensure, with the 28 Association of American Railroads, Specifications for Tank Cars. In: Manual of Standards and Recommended Practices, Section C - Part III, Specification M-1002. Washington, DC, 1996. 29 Letter from FRA Hazardous Materials Staff Director Edward W. Pritchard to the Safety Board, February 9, 2000.

Factual Information 39 Hazardous Materials Accident Report assistance of the tank car owner, that the materials and components that constitute the tank car are appropriate for carriage of a new product. In the case of UTLX 643593 and the other tank cars used to transport the TDI waste mixtures, the FRA stated that the addition of constituents other than TDI would comprise a change in service if the additional constituents substantially changed the chemical makeup of the material or changed its hazard class.30 The FRA further stated that no information or guidance regarding gasket and fitting compatibility in conjunction with changes in product service has been issued. The FRA noted, however, that, in an advance notice of proposed rulemaking (ANPRM) published under docket HM-175A in May 1990, the FRA and the Research and Special Programs Administration (RSPA) sought comments regarding performance standards for the gaskets used on tank cars. Because it received numerous comments citing the technical complexities in developing a performance standard for gaskets, RSPA removed the gasket issue from the docket. The FRA stated that it continues to participate in the AAR Tank Car Committee and the North American Non-accident Release Prevention Committee, which have addressed compatibility issues concerning gaskets and fittings in nonaccident releases. Compatibility of Pressure Relief Device Components with TDI Waste Mixtures Union Tank Car provided the Safety Board with excerpts from the Chemical Resistance Guide for Elastomers, which contains guidance about the resistance of available gasket, O-ring, and sealing materials to degradation upon exposure to various chemicals. According to this guide, ethylene propylene rubber, the material that constituted the O-rings in the pressure relief valves from UTLX 643593 and the four tank cars tested at Midland, offers good to excellent resistance to chemical attack from pure TDI at temperatures up to 70° F and should not exhibit more than minor swelling, softening, or surface deterioration. The guide recommends against using ethylene propylene rubber with either MCB or naphthalene, one of the primary components of the HAN 906 solvent. Teflon is rated as providing excellent resistance to degradation for TDI, MCB, and the naphthalene. Midland indicated that, because it is the manufacturer rather than the user of the pressure relief valves, the company does not recommend, prescribe, or influence the selection of valve materials. Midland further stated that it is rarely cognizant of the intended service of the valves and fittings it sells. The company provides its customers, in this instance the tank car builder Union Tank Car, with the valves, gaskets, and O-rings specified by the customer. (Olin’s construction order to Union Tank Car specified ethylene propylene rubber O-rings for the pressure relief valves on UTLX 643593 and its sister tank cars.) In response to Safety Board inquiries about the chemical compatibility of the TDI matter wastes with the components of the tank cars used to store them, Olin stated that, at various times since the 1970s, the company had had its tank cars evaluated to ensure their 30 FRA February 9, 2000, letter.

Factual Information 40 Hazardous Materials Accident Report suitability for storing and transporting TDI, TDI matter wastes, and solvent blend wastes. Olin stated that the results of such evaluations would have been turned over to Arco/Lyondell as part of the sale of the business. Olin indicated that the company has not been able to locate documentation on any such tests and could not provide any additional details. In response to the same inquiry, Lyondell responded that Arco and Lyondell did not conduct any evaluations of the chemical compatibility of the TDI waste mixtures with gaskets, O-rings, and other components on the tank cars used to store these wastes, but “typically” verified the compatibility of the gaskets and O-rings with “vendor-supplied information.” Lyondell stated that the company had no reason to investigate use of the gasket materials with the TDI wastes because no in-plant incidents or releases from tank cars had occurred. Change of Authorized Cargoes Because of concerns involving the chemical compatibility of the O-rings with the MCB and the HAN 906 solvent in the TDI waste cargoes, the Safety Board also asked Olin and Lyondell whether they considered that the storage and transportation of the TDI matter wastes in UTLX 643593 and the other tank cars constituted a change in product service from the transportation of pure TDI. Olin responded that it did not consider the storage and transportation of the TDI wastes in these tank cars to constitute a change in product service. Olin acknowledged that the TDI matter (blended and unblended) and the solvent blend wastes differed from pure TDI but considered that UTLX 643593’s and the other tank cars’ approval for carriage of pure TDI to be sufficient for carriage of the mixtures of monomeric and polymeric TDI, MCB, and HAN 906 solvent. Olin noted that, under the certificate of construction, UTLX 643593 and its sister tank cars were approved for the carriage of “non-regulated commodities and commodities authorized in DOT Part 173 (49 CFR 173) for which there are no other requirements and which are compatible with this design and class of car.” Olin considered that the MCB, the polymeric TDI, and the HAN 906 solvent were within the approved commodity service on the certificate of construction. Consequently, Olin did not seek AAR approval for a change in product service. Lyondell responded to the Safety Board’s inquiry that, although the TDI waste mixtures would have to be identified under a new DOT proper shipping name (hazardous waste, toxic liquid, flammable, organic n.o.s. [not otherwise specified]) rather than as pure TDI, the shipment of these TDI waste mixtures did not constitute a change of product service. Lyondell noted that, under the DOT Hazardous Materials Regulations, the bulk containers, such as tank cars, authorized to transport pure TDI were the same containers as those authorized to transport commodities under the new proper shipping name, and that no applicable special provisions in the DOT Hazardous Materials Regulations precluded the use of the same type of tank car. Consequently, Lyondell did not seek AAR authorization to change the approved cargoes.

Factual Information 41 Hazardous Materials Accident Report Hazardous Materials Incident Reporting Notification of Accident The Essroc plant manager notified the National Response Center (NRC) about the accident by telephone shortly after 3:00 a.m. on February 18, 1999, about 3 hours after the accident. The NRC report summarizing the telephonic notification indicated that a rail car containing “hazardous wastes” had ruptured and was on fire. The Essroc plant manager believed that, in providing telephonic notification to the NRC, he was complying with applicable Environmental Protection Agency (EPA) regulations.31 According to Essroc, the plant manager and other Essroc personnel are generally aware of applicable DOT requirements. Essroc further stated that the company is not a carrier and is not responsible for submitting a written DOT Hazardous Materials Incident Report. Essroc did not submit a written incident report to the DOT. The rail carrier that delivered UTLX 643593 to the Essroc plant was the Central Railroad of Indianapolis, which was managed by the Indiana and Ohio Rail Company. The parent company for both the Central Railroad of Indianapolis and the Indiana and Ohio Rail Company is Rail America. The general manager for the Central Railroad of Indianapolis and the Indiana and Ohio Rail Company indicated that the rail carrier did not submit a written incident report to RSPA because the tank car had been delivered to and left at the Essroc plant, the accident occurred on Essroc property, and the railroad was not involved in the accident. To date, no written incident report has been received by RSPA. Notification Requirements Immediate Notification. Under section 49 CFR 171.15 of the DOT Hazardous Materials Regulations, a carrier must notify the NRC by telephone “at the earliest practicable moment” about incidents that occur during “the course of transportation” in which the release of a hazardous material results in a fatality, injuries requiring hospitalization, property damage exceeding $50,000, evacuations of the general public, and other criteria. EPA regulations contain multiple requirements throughout 40 CFR for immediate notification following releases of those materials it designates as “hazardous substances,”32 “hazardous wastes,” and oil (both “used” and crude) from vessels, offshore and onshore facilities, and hazardous waste management facilities operating under EPA permits, as well as TSD facilities such as Essroc. Under DOT and EPA regulations, the telephonic or immediate notifications are made to the NRC, which then disseminates the report to the appropriate Federal agencies, including the EPA, RSPA, the FRA, and the 31 The EPA regulations for TSD facilities (40 CFR 264) include notification requirements in the event of a release of a hazardous waste. The regulations for emergency planning and community right-to-know programs (40 CFR 302) also have notification requirements for chemical releases. 32 Specific materials or chemicals designated under the Comprehensive Environmental Response, Compensation, and Liability Act (42 USC 9601) as harmful to the environment if released in a quantity exceeding the reportable quantity for the material.

Factual Information 42 Hazardous Materials Accident Report Safety Board. A single notification to the NRC often satisfies the notification requirements of several Federal agencies. The NRC, in processing all telephonic notifications, regardless of the nature of the release, collects information of a general nature necessary to understanding and responding to a current or recent emergency. The information sought by the NRC typically includes such information as the location of the incident, the date and time it occurred, the type of material released, the source of the release, the quantity of material released, the names of the parties involved, the damage to the area, and other information immediately obtainable. Such reports are preliminary in nature and are not designed to be comprehensive. Written Reports. Section 49 CFR 171.16 of the DOT regulations requires that each carrier that transports hazardous materials submit a written DOT Hazardous Materials Incident Report to RSPA within 30 days of discovery of each incident that occurs “during the course of transportation” in which there has been an unintentional release of a hazardous material. DOT regulations define a “hazardous material” as including both EPA-designated hazardous substances and hazardous wastes. Section 49 CFR 171.16 also requires that the carrier submit a DOT Hazardous Materials Incident Report for any incident that must be telephonically reported under section 49 CFR 171.15. Both 49 CFR 171.15 and 171.16 specify that “the course of transportation” includes loading, unloading, and temporary storage. The regulations define a carrier as “a person engaged in the transportation of passengers or property by land or water as a common, contract, or private carrier or by civil aircraft.” In response to Safety Board inquiries, the FRA stated that, in letters of clarification concerning these requirements, RSPA has indicated that a carrier has a duty to report releases of hazardous materials in accordance with 49 CFR 171.16 when it has knowledge of such releases. The FRA stated that a rail carrier must “report to the Department” within 30 days of the date of discovery. The DOT Hazardous Materials Incident Report form (see appendix B), contains 45 specific categories of information, including background facts about the incident (mode of transportation, date and time of incident, description of carrier and materials shipped, etc.) and specific details concerning the type of container involved, conditions at the incident site, packaging of the material released, and sources of packaging failures. RSPA uses the information obtained through these written incident reports as the input for its Hazardous Materials Information System, which serves as RSPA’s accident database, which RSPA uses to conduct accident analyses. The EPA requires the submission of written reports for certain types of hazardous waste and oil releases, under certain conditions. Under 40 CFR 264.56(j) and 279.52(b) the owner/operator of a TSD facility or a used-oil processing facility must file a written report to the EPA regional administrator within 15 days after a release, fire, or explosion involving a hazardous waste or used oil that could threaten human health or the environment outside of the facility. The written report must include seven categories of information:

Factual Information 43 Hazardous Materials Accident Report

1. The name, address, and telephone number of the owner or operator,
2. The name, address, and telephone number of the facility,
3. The date, time, and type of incident,
4. The name and quantity of hazardous waste or oil involved,
5. The extent of injuries (if any),
6. An assessment of the actual or potential hazards to human health or the

environment, where this is applicable, and

1. The estimated quantity and disposition of recovered hazardous waste or oil that

resulted from the incident. The EPA also requires a transporter of hazardous waste under 40 CFR 263.30 or used oil under 40 CFR 279.43 to file a DOT Hazardous Materials Incident Report in accordance with 49 CFR 171.16 when hazardous waste or used oil is released during transportation. With respect to those materials that the EPA designates as “hazardous substances,” the EPA does not require that a written report be submitted to the agency when a hazardous substance release occurs. Essroc submitted a report dated March 4, 1999, concerning the Clymers accident to the Indiana Department of Environmental Management. Essroc forwarded a copy of this report and cover letter to the EPA Region 5 office on March 4, 1999. Regulatory Initiatives RSPA issued an ANPRM on March 23, 1999, which concerned revising the incident reporting requirements (49 CFR 171) and the DOT Hazardous Materials Incident Report form.33 According to RSPA, the purpose of any revisions would be to increase the usefulness of the accident/incident data in evaluating the effectiveness of existing regulations, determining the need for regulatory changes to address changing transportation safety problems, and identifying major problem areas requiring additional DOT resources. The ANPRM sought comments and information about numerous issues, including: • Should the hazardous materials incident reporting requirements be extended to persons other than carriers (such as freight forwarders, warehouse operators, consignees, etc.)? • If an incident requiring immediate telephonic notification occurs at the location of an offeror or consignee, should the offeror or consignee be required to provide the notification? 33 RSPA. March 23, 1999. ANPRM “Revisions to the Incident Reporting Requirements and the Detailed Hazardous Materials Incident Report DOT Form F 5800.1.” Docket number RSPA-99-5013 (HM-229). 64 Federal Register 13943.

Factual Information 44 Hazardous Materials Accident Report The Safety Board commented on the ANPRM in a July 26, 1999, letter and urged RSPA to: Require that undeclared shipments of hazardous materials found in transportation be reported; telephonic and written notification be improved; a report be filed for any hazardous materials container failure; shippers be notified when a release involving their cargo occurs; and information be collected that will help identify patterns of container and equipment failure. In its comments, the Safety Board cited specific deficiencies in current reporting requirements. Among those problems the Safety Board detailed was that: …when failures of DOT specification containers or releases of hazardous materials from such containers occur at either the loading or unloading facility, a carrier may not be directly involved, as the Clymers accident demonstrates, thereby increasing the likelihood that such accidents will go unreported to RSPA. The FRA made no official comments on the ANPRM but stated that the agency addresses its concerns and recommendations through its participation as an active member of the rulemaking team.

45 Hazardous Materials Accident Report Analysis General About 12:05 a.m. on February 18, 1999, railroad tank car UTLX 643593, which was on the west unloading rack at the Essroc cement plant near Clymers, Indiana, sustained a sudden and catastrophic rupture that propelled the tank car’s tank about 750 feet and over multistory storage tanks. Essroc had been attempting to transfer the substance in the tank car, TDI matter waste, to its kilns, where it was to be burned as a fuel. TDI matter waste is a flammable, toxic, and hazardous substance that must be disposed of in accordance with EPA regulations. This tank car of TDI matter waste had been sent to Essroc by the Arco Chemical Company (later purchased by the Lyondell Chemical Company), which owned the Lake Charles, Louisiana, facility that had generated the TDI matter waste as a byproduct of TDI production. Lyondell had contracted with Essroc to dispose of the TDI matter waste. The TDI production facility already had a relationship with Essroc for the disposal of hazardous TDI waste, as Essroc had disposed of TDI solvent blend waste from the Lake Charles plant for 2 years before agreeing to take shipment of the TDI matter waste for disposal. When Essroc began accepting TDI matter waste for disposal in May 1998, it initially used a process by which the waste from the rail car tanks was first blended in a fixed tank with solvents (to reduce its viscosity) and then pumped to Essroc’s kilns from the fixed tank. When, in fall 1998, Essroc encountered problems with this process, it began using a new procedure to transfer the TDI matter waste from its shipping tank cars directly to the kilns. This was known as the direct injection process. Essroc did not develop, in cooperation with Lyondell, specific written instructions for unloading the waste or disposing of it safely using the direct injection process. Because of the complex circumstances and nature of the accident, the Safety Board considered several potential causes of the rupture during the investigation. The first section of this analysis will address each of the potential causes of the accident. The succeeding sections will address, in turn, the four major safety issues identified during the investigation, which are: • Sufficiency of safety requirements addressing the procedures used for loading and offloading railroad tank cars and other bulk containers used to transport hazardous materials; • Adequacy of inspection and testing requirements for pressure relief devices on railroad tank cars; • Adequacy of provisions addressing changes in product service for railroad tank cars; and

Analysis 46 Hazardous Materials Accident Report • Adequacy of the U.S. DOT Hazardous Materials Regulations pertaining to the notification and reporting of hazardous materials incidents. Accident Rupture of UTLX 643593 The catastrophic rupture of tank car UTLX 643593 was the result of pressurization that exceeded the burst pressure of the tank, which Union Tank Car calculated to be between 813 and 844 psia. The upright position and orientation of both tank car wheel assemblies at the loading station after the accident, the torsion damage to the rails at the loading station, the upward trajectory of the UTLX 643593 tank over the fixed storage tanks, the extended fracture along the bottom centerline of the tank, and the flattening of the tank were all consistent with a failure originating along the bottom centerline of the tank. Safety Board investigators observed “necking down” deformation in the tank wall at the fracture that extended along the bottom center of the tank. Laboratory measurements of the plate thickness along the fracture indicated that deformation of the plate from “necking” had reduced the plate thickness to as little as 0.285 inch, a 50 percent reduction in the original plate thickness of 0.5625 inch. In addition, metallurgical examination of a 35-inch long section of the fracture along the bottom center of the tank identified features on the fracture surface typical of ductile tensile overload in low-carbon steels. The deformation from necking and the presence of fracture features indicating tensile overload could have resulted only from an overpressurization of the tank. The absence of pitting, corrosion, and other visual signs of tank deterioration indicated that no structural defects or deficiencies might have caused the tank to rupture, or weakened the tank such that it would have ruptured at pressures within its design limits. Further, based on the results of the laboratory analysis of the steel plate’s microstructure and hardness tests, the steel used in the tank’s construction met the specifications for ASTM A516 grade 70 steel and had sufficient tensile strength and thickness for the tank car to easily withstand its maximum operating pressure of 100 psig. Consequently, the Safety Board concludes that no evidence indicates that the tank of railroad tank car UTLX 643593 had any structural or material defects that either caused or contributed to the rupture of the tank. Therefore, in the absence of any structural or material defects to weaken the tank, the Safety Board concludes that the internal pressure in tank car UTLX 643593 increased and eventually exceeded the burst pressure of the tank, resulting in the catastrophic rupture of the tank car. Overpressure Condition Given the offloading configuration that Essroc employed, internal pressure in UTLX 643593 could be relieved in two ways: (1) controlled venting through the vapor valve on the tank car to the vapor emissions system for the plant and (2) venting through

Analysis 47 Hazardous Materials Accident Report the pressure relief valve on the tank car. The pressure relief valve was designed to discharge when the internal pressure reached 75 psig, but during postaccident testing, it began to discharge at pressures below 5 psig. Consequently, an overpressure and eventual rupture of the tank could have occurred only if the flow of vapor or other material through the vapor valve/vapor emissions system or the pressure relief valve had been completely stopped or if the pressure in the tank had increased at a rate that exceeded the flow capacity of the pressure relief valve to vent. The Safety Board examined whether the generation of pressure at a rate that exceeded the flow capacity of the pressure relief valve to vent could have caused the overpressure and rupture of UTLX 643593. Essroc employees noted that the pressure relief valve was “whispering” or discharging slightly on the morning of February 16. The Essroc employees attributed the whispering to the saturation of the filters in the vapor emissions system, which prompted them to use a water bath for venting the vapors from the tank car. The facility supervisor described the vapors from the tank car as “trickling” through the water bath on February 16, and a second Essroc employee observed water “bubbling” and splashing in the tote tank on the night of February 16. The Essroc facility supervisor stated that on the morning of February 17, he reduced the pressure in the tank car and then injected nitrogen until the pressure was 25 psig. According to Essroc personnel, no other work was performed on the tank car before the accident. The trickling of vapors through the water bath and the bubbling of the water bath indicate that only low-pressure venting of vapors was occurring. If pressure in the tank car had been increasing at a rate exceeding the pressure relief valve’s capacity to vent, the venting vapors would have severely agitated the water bath, and such agitation would have been conspicuous. Also, the pressure relief valve would have been fully open, and the vapors passing through the relief valve would have made a loud and noticeable noise. Further, if the capacity of the pressure relief valve had been exceeded, the valve would have remained open, so noise from any escaping vapors would have been continuous and particularly loud. Under such conditions, it would have been virtually impossible for plant employees to fail to notice the severe agitation of the water bath and the continuous noise from the pressure relief valve. However, no Essroc employee mentioned noticing either condition before the accident. Therefore, the overpressure in UTLX 643593 did not result from the pressure’s rate of increase exceeding the flow capacity of the pressure relief valve to vent the tank. During postaccident examination of the valves and fittings of ULTX 643593, however, investigators found TDI matter waste molded to the interior of the car’s manway coverplate. The TDI matter waste completely plugged the openings through the manway coverplate for the pressure relief, vacuum relief, and vapor valves. The inlet to each of these three valves opens to the vapor space at the top of the tank car. Further, the TDI matter waste was molded into the bodies of the pressure relief and vapor valves. For the TDI matter waste to completely plug and fill these openings and valves in this manner, it must have flowed into them through expansion of the waste before the tank car ruptured. If the TDI matter waste had been blasted into these openings in the manway coverplate and the valve bodies when the tank ruptured, it would not have been molded to

Analysis 48 Hazardous Materials Accident Report the contours of the openings and valve bodies. Rather, the TDI matter waste would have left void spaces in the openings through the manway coverplate and the valve bodies. Consequently, the Safety Board concludes that the expansion of TDI matter waste that occurred before the accident blocked the vapor and pressure relief valves of tank car UTLX 643593, which effectively removed any means of relieving the build-up of internal pressure. The Safety Board cannot determine exactly when the vapor and pressure relief valves became plugged. On the morning of February 16, Essroc employees noted that the pressure relief valve was “whispering” (discharging vapors at a low pressure), which they attributed to saturation of the carbon filters in the plant’s vapor emissions system. Following the final attempt to offload the tank car on the night of February 16, an Essroc laborer observed water bubbling from the end of the submerged hose in the tote tank. The bubbling indicated that vapors were venting from the tank car at that time. Although the Essroc facility supervisor and other Essroc employees checked and adjusted the internal pressure on UTLX 643593 throughout the 5 days that UTLX 643593 was at the offloading station, the reliability of these pressures is suspect. The whispering of the pressure relief valve, which was first noted by Essroc personnel on the morning of February 16 and later replicated during postaccident testing of the valve in May 1999, indicates that the pressure relief valve very likely was continuously discharging vapors from the tank until it became plugged by TDI matter waste. Product Expansion The initial volume of TDI matter waste in the 20,000-gallon tank car after loading was 14,185 gallons, which was about 71 percent of tank capacity. Therefore, between the loading date in March 1993 and the accident date in February 1999, the TDI matter waste must have expanded to fill the remaining 29 percent of the tank, leading to the rupture. The Safety Board considered several possible causes for the expansion of the TDI matter waste. These included exposure of the tank car to fire from an unknown external source; gradual instability in the waste material over the 6-year period it was stored in the tank car; chemical reactions initiated from the steam heating of the tank car, resulting in the liberation and entrapment of gaseous byproducts in the waste mixture; and chemical reaction with water that would have liberated gases within the tank. The Safety Board was able to discount the possibility of the tank car’s experiencing direct exposure to fire. The external jacket from UTLX 643593 did not exhibit any evidence of flames affecting it, other than an isolated section found on top of a burned rubber hose. The Board found no significant evidence that the TDI matter waste’s stability had gradually degraded (causing expansion) while the tank car was stored between 1993 and

1. Essroc personnel working around and with the tank car did not report any usual

events or problems with it, apart from the plugging of the plant piping to the kilns. The waste had been stored in the tank car for nearly 6 years with no problems. In addition,

Analysis 49 Hazardous Materials Accident Report chemical data for the monomeric TDI, polymeric TDI, and MCB found in the TDI waste do not indicate that any of these materials were unstable. Nevertheless, the tank car catastrophically ruptured 5 to 6 days after it had been heated with steam on two occasions for a total of 28.5 hours and three attempts to offload the TDI matter waste from it had been made. Therefore, some aspect of the offloading operation most likely led to the rupture. Heating tests conducted in April 1999 on the TDI matter waste samples drawn from UTLX 643593 before the accident demonstrated that significant expansion of the waste occurred when a waste sample was heated under conditions similar to those experienced by the accident tank car in the days before the accident. Expansion also occurred when a sample was heated and exposed to water. Both these test conditions resulted in the generation of sufficient quantities of carbon dioxide gas to have theoretically increased the pressure in the tank car above its burst pressure. The most likely means of introducing water into the tank car would have been from the tote tank that was being used as a temporary measure to provide a vapor emissions system while the carbon filters were being cleaned or replaced. No other likely source of water was identified. Essroc employees noted water bubbling in the tote tank throughout the day on February 16, indicating that vapors were venting from the tank car. One Essroc employee also observed water bubbling in the tote tank following the final attempt to offload UTLX 643593 on the evening of February 16. However, no Essroc employee commented on the condition of the tote tank from that time forward. Based on engineering calculations, water from the tote tank could have been siphoned into the tank car only if a vacuum of 4 to 5 psi (equivalent to a total internal pressure of 10 to 11 psi) had developed in the vapor space within the tank car because of the cooling of the vapors and/or the contraction of the TDI matter waste mixture. The heating tests on samples from UTLX 643593 clearly demonstrate that the waste expanded when it was heated, but it did not contract after cooling. Therefore, the generation of any vacuum would have to have been caused by the vapors cooling in the air space at the top of the tank car. Engineering calculations indicate that vapors initially at 150° F would have to have been cooled to less than -30° F to create a sufficient vacuum in the tank car. More importantly, water drawn into the tank car from the tote tank would have spilled into the TDI matter waste at the point of liquid/vapor interface within the tank car. Any gases from a reaction occurring at the liquid/vapor interface would have entered the vapor space within the tank car and readily been vented. Such venting would have precluded overpressurization of the tank car. Chemical analyses conducted between December 1999 and February 2000 on the TDI matter waste sample recovered from the B-end loading valve detected the presence of chemical byproducts from the reaction of TDI and water. The analysis could not quantify the amounts of these byproducts. Although the presence of these chemical byproducts suggests that the waste sample from the loading valve reacted with water, it cannot be determined when or how much water came into contact with this sample. Between the accident date and the recovery of the sample in May 1999, the dome assembly from UTLX 643593, including the B-end valve, was kept in indoor storage at Essroc and then at

Analysis 50 Hazardous Materials Accident Report the St. Louis testing facility. After the recovery of the sample in May 1999, the sample was in a glass jar, which, although sealed, proved not to be airtight, as evidenced by the evaporation of the liquid portion of the sample. The waste sample may have been exposed to moist air between the time it was recovered and analyzed, which might have caused the formation of the chemical byproducts detected in the analysis. Nevertheless, the other evidence (as previously discussed) does not support the theory that the overpressurization was the result of a sufficient quantity of water being introduced into the tank car. Therefore, the overpressurization of the tank car from product expansion and the plugging of the pressure relief and vapor valves most likely occurred as a result of the steam heating of the waste mixture before offloading was attempted. The portion of the TDI matter waste mixture in contact with the tank wall in the bottom half of the tank received the heat from the steam circulating through the heating coils. Because the samples were drawn through one of the eduction lines that extended to the bottom of the tank car, the temperatures of samples drawn by Essroc personnel while the steam heating was performed are good indicators of the temperatures of the waste mixture that was in contact with the heating coils. According to Essroc employees, the temperatures of the samples drawn from UTLX 643593 ranged from 120 to 202° F early on February 14, at the end of the first steam-heating cycle, and reached at least 173° F during the second heating cycle on February 15 and 16. These temperatures are well above the maximum safe temperature range of 130 to 140° F that Olin used for processing the TDI matter wastes at the Lake Charles plant and reported to the Safety Board during the investigation. In the absence of any means to mix the wastes to facilitate uniform heating throughout the tank, localized overheating of the TDI matter waste in contact with or near the tank wall adjacent to the heating coils most likely caused the TDI to self-react, resulting in the generation of carbon dioxide gas at the bottom of the tank and eventual expansion of the waste. Additionally, because the tank was insulated (and would retain heat), the self-reaction and expansion of the TDI matter waste could have continued after the steam heating was completed. Thus, the TDI matter waste continued to expand until the dome was completely filled and the vapor and pressure relief valves were plugged. Because the tank did not have any room to accommodate continued expansion of the waste or any outlet by which it could relieve the increasing pressure, the tank’s burst pressure was exceeded, and the tank car ruptured. Consequently, the Safety Board concludes that tank car UTLX 643593 was overpressurized from the chemical self-reaction and expansion of the TDI matter waste that was initiated and sustained by localized overheating of the mixture at the bottom of the tank car.

Analysis 51 Hazardous Materials Accident Report Hazardous Materials Loading and Offloading Practices TDI Waste Shipments Essroc Plant Operations. In 1996, Essroc began to accept TDI solvent blend wastes as fuel for its Logansport plant. Blending agents, such as HAN 906 solvent, were added to the TDI solvent blend wastes at the Lake Charles plant before they were shipped to Essroc, to increase the fluidity of the wastes. However, beginning in spring 1998, nearly all the TDI wastes shipped to Essroc were TDI matter wastes. Unlike the solvent blend wastes that had been “thinned” before shipment to Essroc, the TDI matter wastes were to be heated and offloaded from the tank car to a blending tank at the Essroc plant, where the wastes would be mixed with solvents to “thin” them before they were pumped to the kilns and burned. However, problems with the blending tank operation led Essroc to resort to offloading the TDI matter wastes from the tank cars and pumping them directly to the kilns (direct injection process). Essroc was using the direct injection process to offload the TDI matter wastes from UTLX 643593. Whereas the waste profile for the solvent blend waste specified a maximum viscosity of 500 cp, the profile for the TDI matter waste indicated that its viscosity “varies.” Because the TDI matter wastes in UTLX 643593 and the other tank cars were to be blended at the Essroc plant, they typically were more viscous than the solvent blend wastes. Consequently, the TDI matter wastes probably had to be heated for longer periods and to higher temperatures than the solvent blend wastes, to make the TDI matter wastes sufficiently fluid for offloading from a tank car and pumping directly to the kilns. The heating standard jointly employed by Essroc and CPRIN personnel was to heat the TDI matter waste until it was sufficiently fluid to flow. While CPRIN conducted the steam-heating operation, Essroc personnel drew samples from UTLX 643593 to measure the temperature of the wastes and to determine if the waste mixture was sufficiently fluid for offloading. Although Essroc and CPRIN personnel said they knew that the TDI matter wastes had to be heated to higher temperatures than the solvent blend wastes, Essroc and CPRIN claim they were unaware that Olin recommended a maximum safe temperature range of 130 to 140° F for heating the TDI matter wastes. The Essroc facility supervisor said he was under the impression that the TDI matter wastes could safely be heated to 200° F; whereas CPRIN stated that, although the TDI product should not be heated above 110° F because of possible quality control problems, these concerns did not apply to the TDI matter wastes because no TDI product recovery would be attempted. Further, the offloading and steam-heating procedures used by Essroc and CPRIN did not include three critical heating and offloading practices that Olin used at the Lake Charles plant: steam heating with low-pressure steam, nitrogen sparging while steam heating, and keeping the temperature of the waste mixture below 140° F. Through steam heating with low-pressure steam, the waste mixtures could be heated more slowly and could more easily be maintained at a temperature below the 130 to 140° F threshold recommended by Olin. Performing nitrogen sparging during the steam-heating process would cause the waste mixture at the bottom of the tank car to agitate, which would

Analysis 52 Hazardous Materials Accident Report facilitate a more even distribution of heat throughout the entire waste mixture. The Safety Board concludes that, if Essroc and CPRIN had employed low-pressure steam to heat the wastes, used nitrogen sparging to facilitate even heating throughout the tank car, and maintained the temperature of the wastes below 140° F, the risk of localized overheating and expansion of the waste mixture would have been minimized, and the accident likely would not have occurred. Guidance and Instruction on Heating and Offloading Procedures. To determine why Essroc and CPRIN did not employ the procedures used at the Lake Charles plant, the Safety Board asked Olin, Lyondell, Essroc, and CPRIN to describe the information they exchanged about the heating of all TDI waste mixtures, the generation of gas from chemical self-reaction, the expansion of the wastes if overheated, nitrogen sparging, the establishment of temperature limits for the waste mixtures, and other special handling procedures. Each company provided a different account regarding its responsibilities and the information it either provided or requested. All agreed that the Lake Charles TDI expert met with Essroc and CPRIN personnel at the Essroc plant in spring 1998 to provide instruction on handling and processing TDI matter wastes. The Lake Charles operators, Essroc, and CPRIN agreed that the TDI matter wastes could safely be heated to 125° F, compared to the 90 to 100° F range for the TDI solvent blend wastes. Essroc also acknowledged that the Lake Charles TDI expert had stated that a long, slow heating process was sometimes required to heat the TDI matter wastes. However, neither Essroc nor CPRIN acknowledged that the Lake Charles operators had set a maximum temperature limit or that the Lake Charles operators had recommended using nitrogen sparging and low-pressure steam-heating procedures. The Lake Charles operators, however, maintained that their TDI expert discussed nitrogen sparging, heating with low-pressure steam, and heating limits with Essroc and CPRIN personnel. As can be seen from this diversity of opinion and recollection as to what was communicated between the producers and receivers in this instance regarding the appropriate procedures for offloading the TDI matter wastes, considerable confusion and misapprehension appears to have been prevalent among those parties that handled the waste mixtures. Given the potentially hazardous nature of TDI matter wastes, such ambiguity is unacceptable. The investigation also revealed other areas of imprecision. For instance, responsibility for offloading at the Essroc plant seems to have been unclear. Essroc stated that CPRIN was responsible for steam heating the TDI product so that it was sufficiently fluid that it could be pumped to the cement kilns. CPRIN, however, stated that Essroc retained operational authority over the heating and offloading process. Further, no one at the Essroc plant had comprehensive, written instructions on the offloading procedures to be used. Although Essroc had written procedures for offloading the TDI matter wastes to a fixed blending tank, these procedures did not include details about heating practices, nitrogen sparging, or maximum temperature limits. Then, when Essroc adopted the direct injection procedure in place of blending in a fixed tank, even

Analysis 53 Hazardous Materials Accident Report less information was available. Neither Essroc nor CPRIN had any written procedures for heating and offloading the TDI matter wastes for direct injection of these wastes to the kilns. Therefore, based on the discrepancies between Essroc’s and CPRIN’s accounts of their respective roles and responsibilities for handling and disposing of TDI matter wastes and the absence of specific, written procedures for heating and offloading these wastes by direct injection, the Safety Board concludes that Essroc and CPRIN failed to develop and implement appropriate heating and offloading procedures for the TDI matter wastes at the Logansport plant, which resulted in the use of unsafe offloading practices at the plant. With respect to the Lake Charles operation’s procedures, Olin stated, in its response to Safety Board inquiries about whether it had written procedures for heating and offloading TDI wastes, that any written procedures that might have existed had been turned over to Arco (later Lyondell). Lyondell stated that Arco/Lyondell did not have specific, written procedures for on-site blending of the TDI waste mixtures and offloading them from tank cars. Arco/Lyondell had written procedures for blending solvent blend wastes in a fixed tank and then transferring them from the fixed tank into tank cars. These procedures set the temperature and viscosity limits for the solvent blend wastes in the fixed blending tank. However, neither Olin nor Arco/Lyondell had written operating procedures or limitations that addressed the potential for gas generation or product expansion, the maximum temperature and time for heating the TDI wastes, or the maximum product viscosity for offloading tank cars. Therefore, no one at Lake Charles appears to have had comprehensive, written procedures for handling the TDI wastes. The Safety Board also considers that the implementation of comprehensive, written procedures for loading and offloading chemicals or waste materials exhibiting properties that require special handling must incorporate methods that will detect internal tank conditions and accurately reflect the thermophysical state of all of the material in the tank vessel. The written procedures should specify values or ranges for important material properties, such as melting temperature, flash point, maximum allowable product temperature, and viscosity. Further, offloading procedures developed and validated under certain environmental conditions may lead to or cause catastrophic failures or other potential problems in offloading the material when the environmental conditions vary from the baseline conditions. Partially because there is no written record to which it may refer, the Safety Board cannot decisively determine what information and guidance were provided by the Lake Charles operators to Essroc and CPRIN on heating and offloading TDI matter from tank cars or what consideration, if any, was given to detection of internal tank car conditions that were potentially catastrophic. Nor can the Safety Board be sure what guidance may have been provided by the Lake Charles operators but not implemented by Essroc and CPRIN. Nevertheless, given the differences between the accounts offered by these companies about the guidance given or requested and the lack of comprehensive, written procedures at Lake Charles for handling TDI wastes, the Safety Board concludes that Olin and Arco (now Lyondell) did not provide Essroc with comprehensive, written information about safe handling procedures for TDI matter wastes.

Analysis 54 Hazardous Materials Accident Report The Safety Board considers that the producer/shipper and the consignee/end-user of any chemical or waste material have joint responsibility for determining and implementing comprehensive, written procedures for the transfer of any chemical or waste material to and from a tank car, highway cargo tank, or other bulk container when the chemical or waste material exhibits properties that require special handling. Such properties would include those identified with the TDI matter wastes involved in this accident, such as temperature and heating effects, means of self-reaction, and the byproducts of reaction, including the generation of gases and product expansion. In the Safety Board’s view, both parties to the transport of a hazardous material have information vital to its safe transfer. The producer/shipper has detailed knowledge about the properties of the chemical or waste material, while the consignee/end-user has specific information about the transfer facilities at the destination. Ideally, the result of the collaboration between the producer/shipper and consignee/end-user should be the development and implementation of specific, written transfer procedures that address each unique property of the chemical or waste material in the context of the physical layout of a given plant or facility. The importance and effectiveness of such cooperation is evidenced by what happened when the TDI waste materials had to be moved after the Clymers accident took place. Following the accident at the Essroc plant, Olin and the waste disposal companies that were contracted to unload the remaining tank cars at a transfer facility in Deer Park, Texas, jointly developed comprehensive, written procedures that established viscosity and temperature limits and called for nitrogen sparging. Consequently, the transfer and offloading took place without incident. Therefore, the Safety Board believes that Essroc, CPRIN, Olin, and Lyondell should each collaborate with applicable producers, shippers, consignees, and end-users in the development and implementation of specific and written procedures for the loading or offloading of any chemical or waste material from a railroad tank car, highway cargo tank, or other bulk transportation vessel when the chemical or waste material exhibits properties that require special handling or processing during the loading or offloading operation. Recent Safety Board Actions The catastrophic rupture of UTLX 643593 in February 1999 at the Essroc plant is the fifth nonaviation accident investigated by the Safety Board since June 1998 in which deficient offloading procedures or operations caused or contributed to an accident and the release of hazardous materials. The first of the five accidents took place on June 29, 1998, at Stock Island, Key West, Florida.34 A Dion Oil Company driver was on top of a straight-truck cargo tank checking its contents and preparing to transfer cargo from a semitrailer cargo tank when explosive vapors ignited within the straight-truck cargo tank. The ignition caused an 34 National Transportation Safety Board, Fire and Explosion of Highway Cargo Tanks, Stock Island, Key West, Florida, June 29, 1998, Hazardous Materials Accident Report NTSB/HZM-99/01 (Washington, DC: NTSB, 1999).

Analysis 55 Hazardous Materials Accident Report explosion that threw the driver from the truck. The fire and a series of at least three explosions injured the driver and destroyed the straight truck, a tractor, the front of the semitrailer, and a second nearby straight-truck cargo tank. Damage was estimated at more than $185,000. The Safety Board concluded from its investigation that (1) the carrier did not have written procedures to ensure safe cargo handling, (2) the carrier did not adequately train its drivers to ensure safe cargo handling, and (3) Federal training programs for Federal and State motor carrier inspectors did not adequately address the need for inspectors to evaluate the training that motor carriers give their drivers on loading and unloading cargo tanks. Consequently, the Safety Board recommended on October 1, 1999, that the Federal Highway Administration’s (FHWA’s) Office of Motor Carrier Safety (now the Federal Motor Carrier Safety Administration [FMCSA]): 35 H-99-30 Add elements to training programs for Federal and State inspectors that include instruction on determining whether motor carriers have adequate written procedures for and driver training in loading and unloading cargo tanks. H-99-31 Evaluate the adequacy of cargo-tank loading and unloading procedures of and driver training for hazardous-materials motor carriers and require changes as appropriate. To date, the Safety Board has not received a response to either recommendation from the FMCSA. On December 14, 2000, the Safety Board sent a follow-up letter to the FMCSA requesting an update on the status of these two recommendations. Another accident concerning a transfer of hazardous materials took place on August 9, 1998, in Biloxi, Mississippi.36 A truckdriver was transferring gasoline from a highway cargo tank to underground storage tanks at a gasoline station-convenience store when an underground storage tank containing gasoline overflowed. An estimated 550 gallons of gasoline flowed from the storage tank, across the station lot, and into the adjacent highway and intersection. The gasoline ignited, and fire engulfed three vehicles near the intersection. Five occupants of the vehicles were killed, and one occupant was seriously injured. Property damages were estimated at $55,000. As a result of its Biloxi investigation, the Safety Board concluded that the carrier’s operating manuals for its new employees and driver-trainers lacked the specificity that employees need to ensure that they practice correct and safe cargo unloading procedures. 35 The December 9, 1999, enactment of the Motor Carrier Safety Improvement Act of 1999 established a new DOT agency, the FMCSA, to oversee and enforce motor carrier safety regulations, which had previously been handled by the FHWA. 36 National Transportation Safety Board, Overflow of Gasoline and Fire at a Service Station-Convenience Store, Biloxi, Mississippi, August 9, 1998, Hazardous Materials Accident Report NTSB/HZM-99/02 (Washington, DC: NTSB, 1999).

Analysis 56 Hazardous Materials Accident Report The Safety Board also concluded that to help drivers follow safe loading and unloading procedures, Federal regulations should require carriers that transport hazardous materials in cargo tanks to have specific, written procedures for loading and unloading. Consequently, the Safety Board recommended that RSPA: H-99-57 Promulgate regulations requiring motor carriers that transport hazardous materials in cargo tanks to develop and maintain specific written cargo loading and unloading procedures for their drivers. In a February 24, 2000, response to Safety Recommendation H-99-57, RSPA stated it is evaluating options to amend the general training requirements and the current specialized requirements for motor carriers in the DOT Hazardous Materials Regulations. On April 4, 2000, the Safety Board classified Safety Recommendation H-99-57 “Open– Acceptable Response,” pending RSPA’s development of regulations that meet the intent of the recommendation. On January 5, 2001, the Safety Board sent a letter to RSPA requesting an update on the actions RSPA has taken on this recommendation since February 2000. Following the Biloxi accident, the Safety Board also recommended that the FHWA: H-99-59 Once the Federal regulations requiring motor carriers that transport hazardous materials in cargo tanks to provide written cargo loading and unloading procedures are promulgated, ensure that the motor carriers are in compliance with the regulations. The FHWA’s Office of Motor Carrier Safety stated in a November 23, 1999, response to Safety Recommendation H-99-59 that it would develop procedures to ensure that motor carriers comply with regulations promulgated to address Safety Recommendation H-99-57. The Safety Board classified Safety Recommendation H-99-59 “Open–Acceptable Response” on February 22, 2000. On January 10, 2001, the Safety Board sent a letter to the FHWA requesting an update on the actions taken on this recommendation since February 2000. On November 19, 1998, at the Ford Motor Company truck plant in Louisville, Kentucky, a cargo tank truck arrived with a delivery of a liquid mixture of nickel nitrate and phosphoric acid. A plant employee inadvertently connected the truck’s transfer hose to the wrong connection and then departed the area, leaving the truckdriver to complete the delivery alone. The truckdriver did not check that the connection was correct and began unloading the product into a storage tank that contained a chemically incompatible material. The resulting chemical reaction generated a vapor cloud of toxic gases that forced the evacuation of 2,400 plant employees and caused $192,000 in damages.37

Analysis 57 Hazardous Materials Accident Report Another transfer-related accident occurred in Whitehall, Michigan, on June 4, 1999, after a cargo tank truck arrived at the Whitehall Leather Company with a delivery of sodium hydrosulfide solution. At the direction of a Whitehall shift supervisor, the truckdriver connected the transfer hose from the cargo tank truck to the wrong storage tank; the tank contained a chemical that reacted with the solution in the cargo tank truck. The resulting chemical reaction released hydrogen sulfide gas that resulted in the death of the truckdriver and $411,000 in damages. 38 The Safety Board’s investigation of both the Louisville and Whitehall accidents showed that the companies had significant problems with their loading and unloading processes for hazardous materials. The Whitehall Leather Company did not have written instructions and procedures for unloading hazardous materials from bulk cargo tanks and did not have a training program for those employees who might be involved in loading and unloading such materials. The Ford Motor Company had written instructions and procedures for unloading hazardous materials and maintained a training program on these procedures, but Ford failed to provide the plant employee involved in the Louisville accident with the latest unloading instructions for hazardous materials, which might have prevented the accident. As a result of its investigations of the Louisville and Whitehall accidents, the Safety Board determined that safety requirements were needed for loading and unloading hazardous materials involved in transport and recommended on June 29, 2000, that RSPA: I-00-06 Within 1 year of the issuance of this safety recommendation, complete rulemaking on Docket HM-223, “Applicability of the Hazardous Materials Regulations to Loading, Unloading, and Storage,” to establish, for all modes of transportation, safety requirements for loading and unloading hazardous materials. In its July 21, 2000, response to Safety Recommendation I-00-06, RSPA stated that it is drafting a notice of proposed rulemaking (NPRM) under Docket HM-223 and expects to publish the NPRM in early 2001. RSPA anticipates issuance of a final rule by the end of

1. The Safety Board wrote to RSPA on September 25, 2000, indicating its concern over

the slow progress of the rulemaking and urging that a final rule be issued by July 2001. In light of the continuing slow pace of action on this important safety issue indicated by RSPA’s letter, the Safety Board classified Safety Recommendation I-00-06 “Open–Unacceptable Response.” 37 National Transportation Safety Board, Chemical Reaction During Cargo Transfer, Louisville, Kentucky, November 19, 1998, Hazardous Materials Accident Brief HZB/00/02 (Washington, DC: NTSB, 2000). 38 National Transportation Safety Board, Chemical Reaction During Cargo Transfer, Whitehall, Michigan, June 4, 1999, Hazardous Materials Accident Brief HZB/00/03 (Washington, DC: NTSB, 2000).

Analysis 58 Hazardous Materials Accident Report DOT Hazardous Materials Regulations The rupture of UTLX 643593 at the Essroc plant near Clymers and the accidents in Stock Island, Biloxi, Louisville, and Whitehall can all be attributed to deficient unloading operations that occurred because of inadequate training, or a lack of comprehensive, specific, and written unloading procedures, or both. In the Clymers accident, the failure of the producer/shippers and end-users to collaborate in the development and implementation of comprehensive, written loading and offloading procedures, customized to the characteristics of the TDI matter wastes and the specific facility, resulted in the use of unsafe unloading practices that ultimately caused the tank car to rupture. Although the DOT Hazardous Materials Regulations include general and mode-specific requirements about the loading and unloading of bulk containers such as tank cars, highway cargo tanks, and intermodal tanks, the current requirements only address procedures common to most loading and offloading operations, such as which personnel must attend the transfer, when brakes must be set on the tank car, when tank car wheels must be blocked, and when and how warning signs must be placed. The DOT Hazardous Materials Regulations do not include requirements for loading and unloading procedures to be written based on any unique or particular properties of the hazardous materials that would necessitate the implementation of special handling requirements or on the conditions specific to an individual facility. As demonstrated in the Clymers accident, the use of unloading practices that are not based on such thorough and comprehensive standards can have catastrophic consequences. Therefore, the Safety Board concludes that the DOT Hazardous Materials Regulations are deficient because they fail to require the development and implementation of comprehensive, written loading and unloading procedures for hazardous materials. The Stock Island, Biloxi, Louisville, Whitehall, and Clymers accidents all involved the loading and unloading of transport containers carrying hazardous materials. Of the five accidents, however, only the Clymers accident involved rail rather than motor carrier transportation. Recently, therefore, the Safety Board’s safety recommendations concerning loading and unloading regulations have focused primarily on highway transportation. For instance, following the Biloxi accident involving the unloading of a motor carrier’s cargo tank containing a hazardous material, the Safety Board recommended that RSPA promulgate regulations requiring motor carriers that transport hazardous materials in highway cargo tanks to develop and maintain specific and written cargo loading and unloading procedures. The Safety Board also recommended that the FHWA ensure that motor carriers comply with the regulations once they are enacted. Both these safety recommendations (H-99-57 and H-99-59) are currently “Open–Acceptable Response.” The Clymers accident, however, showed that swift action is needed to improve the safety of hazardous material loading and unloading operations involving rail tank cars as well as highway cargo tanks. Therefore, to ensure that loading and unloading safety provisions are equivalent throughout transportation modes, the Safety Board considers that action is needed to address the deficiencies in the loading and unloading regulations

Analysis 59 Hazardous Materials Accident Report for rail transport of hazardous materials. Such multimodal action is implicit in Safety Recommendation I-00-06, which the Safety Board issued following the Whitehall and Louisville accidents, which called for RSPA: I-00-06 Within 1 year of the issuance of this safety recommendation, complete rulemaking on Docket HM-223, “Applicability of the Hazardous Materials Regulations to Loading, Unloading, and Storage,” to establish, for all modes of transportation, safety requirements for loading and unloading hazardous materials. (Emphasis added. ) Despite the need to carry out this recommendation promptly, as evidenced by the recent Stock Island, Biloxi, Louisville, Whitehall, and Clymers accidents, RSPA has not yet completed action on it or indicated that RSPA intends to accomplish the recommendation before the end of 2001. The Safety Board is concerned that such slow progress on Safety Recommendation I-00-06 could negatively affect the safety of hazardous materials transportation in all modes. Therefore, to ensure that comprehensive, written safety requirements are established without delay for all carriers, including rail carriers, that transport hazardous materials in cargo tanks, the Safety Board reiterates Safety Recommendation I-00-06. Pressure Relief Valves Performance After the Clymers accident, the FRA mandated that the pressure relief valves from 4 of the 24 tank cars containing the TDI matter wastes in storage at the Logansport rail yard be pressure-tested in accordance with the DOT Hazardous Materials Regulations before any of the tank cars could be transported for unloading. When these tests were performed in March 1999, three of the four valves were not due for retesting until 2003. Each valve had 4 years remaining of its 10-year test cycle. The fourth valve, also on a 10-year test cycle, was due for a retest in 1999. The pressure relief valve from UTLX 643593 was on a 10-year test cycle and not due for a retest until 2003. This valve was also examined and tested in May 1999. All five pressure relief valves failed to meet the tolerances for the start-to-discharge pressure and vapor-tight pressure as required under the regulations. Because the valve from UTLX 643593 began to discharge at pressures around 5 psig during the postaccident tests and Essroc personnel heard the valve discharging before the accident, the valve was likely venting vapors whenever a minimal positive pressure developed in the tank. The frequent discharging would have resulted in continual venting of harmful or flammable vapors to the atmosphere and possible exposure of personnel working near the tank car until the valve was plugged from expansion of the TDI matter waste.

Analysis 60 Hazardous Materials Accident Report Inspection Requirements The teardown and inspection of the pressure relief valves from these five tank cars (the four cars that the FRA required to be tested and UTLX 643593) demonstrated that the valves were in a deteriorated condition. The ethylene propylene rubber O-rings showed evidence of swelling, hardness, and brittleness, and the metallic components exhibited varying degrees of rust, scale, pitting, and grit. Replacement of the deteriorated O-rings in the pressure relief valve from UTLX 643593 with new O-rings did not, by itself, bring about proper operation of the valve. Even with the new O-rings, the pressure relief valve from UTLX 643953 was within the tolerances for the start-to-discharge and vapor-tight pressures only after all dirt, grit, and other debris had been removed from the sealing surfaces of the valve. Consequently, it appears that the accumulation of rust, scale, and dirt caused the five pressure relief valves to fail to meet the required start-to-discharge and vapor-pressure standards. Therefore, the Safety Board concludes that, based on the deteriorated condition of the pressure relief valves examined in this investigation and the failure of these valves to activate as required, the pressure relief valves on tank cars that transport hazardous materials may require more frequent and rigorous testing to ensure that they remain functional. The testing interval for a tank car and its components under the Hazardous Materials Regulations depends in part upon the types of products that are transported in the tank car. Tank cars that transport corrosive materials must be inspected and retested every 5 to 10 years, whereas tank cars that transport noncorrosive materials must be inspected and retested every 10 years. The regulations also require testing and inspection if there is evidence of damage, corrosion, cracks, dents, or deformation or if the tank car is involved in an accident and is repaired. However, the deterioration of the pressure relief valves from UTLX 643593 and the other four tank cars was only detected when the valves were disassembled and inspected. The Safety Board believes that RSPA and the FRA should, with the assistance of the AAR and the Railway Progress Institute, evaluate the deterioration of pressure relief devices through normal service and then develop inspection criteria to ensure that the pressure relief devices remain functional between regular inspection intervals. They should also incorporate these inspection criteria into the DOT Hazardous Materials Regulations. Changes in Product Service for Railroad Tank Cars Even when appropriate test intervals are established and followed, carriage of cargoes that chemically attack gaskets and O-rings in valves and fittings can undermine the integrity of valves and fittings. Data provided by Union Tank Car Company indicated that ethylene propylene rubber is subject to chemical attack when it is exposed to MCB and naphthalene, a primary constituent of the HAN 906 solvent. The swelling, hardness, and brittleness of the ethylene propylene rubber O-rings in the pressure relief valves from UTLX 643593 and the four other tank cars that were tested likely resulted from exposure to the MCB in the TDI matter waste.

Analysis 61 Hazardous Materials Accident Report The addition of a new chemical constituent to a commodity approved for transportation in a tank car changes the chemical composition of that commodity and results in the exposure of gaskets and seals on the tank car to a new mixture. The concentration of a newly added chemical constituent may be sufficiently diluted as to present little or no risk of chemical attack to gaskets and seals, but the risk level can best be ascertained by tests or verification through technical literature that the new chemical constituent is compatible with the gaskets and seals on the tank car. The AAR Manual of Standards for tank cars clearly places the responsibility on the shipper to ensure that the materials used for gaskets and valve seals are compatible with the lading and the service temperature. Under 49 CFR 173.31(a)(2), a tank car may be transferred from one specified commodity service (listed on the tank car’s certificate of construction) to another only by the owner or with the owner’s authorization. In addition, under 49 CFR 179.15, the pressure relief device on DOT class 111A tank cars must be made of materials that are compatible with the commodity being transported. Further, the FRA interprets the addition of new constituents to TDI to represent a change in service if the additional constituents substantially change the chemical makeup of the TDI or change the hazard class of the TDI. Olin and Lyondell did not consider that the presence of MCB and HAN 906 solvents in the TDI waste mixtures might adversely affect the O-rings in the pressure relief valves and other gaskets on the tank cars used to store and transport these wastes. Consequently, Olin and Lyondell did not find that the presence of these chemicals constituted a substantial change in product service from the transport of pure TDI. The investigation, however, showed that the presence of MCB and HAN 906 solvent in the TDI waste mixtures was sufficient to chemically attack the O-rings in the pressure relief valves on tank cars carrying TDI waste mixtures. Therefore, the Safety Board concludes that the transportation of the solvent blend wastes and TDI matter wastes in UTLX 643593 and the other tank cars approved for the transport of pure TDI constituted a change in product service that resulted in the transport of a commodity incompatible with components of the tank car. The FRA’s interpretation that a change in product service occurs when the chemical makeup is substantially changed is subjective and may account for the misinterpretations of Olin and Lyondell that the solvent blend wastes and TDI matter wastes were not “substantially different” from pure TDI. Although the criteria in the AAR Manual of Standards for tank cars and 49 CFR 179.15 seem clear that tank car valves and components must be compatible with the commodity being transported, the mistaken beliefs of Olin and Lyondell suggest that other producers that ship hazardous materials may hold similarly incorrect views regarding the interpretation of these criteria. The Safety Board knows, for example, that other tank cars used for shipping both solvent blend wastes and TDI matter wastes are equipped with pressure relief valves with ethylene propylene rubber O-rings. The Safety Board does not know, however, whether the shippers using these cars have considered that the MCB and HAN 906 solvents in the TDI waste mixtures might adversely affect the O-rings in the pressure relief valves. Therefore, the Safety Board believes that the FRA should issue an advisory bulletin reminding shippers of hazardous materials that any time a change is made in the chemical

Analysis 62 Hazardous Materials Accident Report constituents of hazardous materials shipped, they should verify the compatibility of all tank car components, such as valves and gaskets, with all of the commodities to be transported. Notification and Reporting of Hazardous Materials Incidents When the Clymers accident occurred, the Essroc plant manager immediately notified the NRC by telephone, in compliance with Federal regulations, about the releases of hazardous wastes. According to 40 CFR 264.56(j) the owner/operator of a TSD facility that experiences a hazardous waste incident must also submit a written report to the EPA regional administrator within 15 days of the incident. Essroc sent a report concerning the Clymers accident to the EPA Region 5 office on March 4, 1999. However, neither the written report to the EPA required under 40 CFR 264.56(j) nor the immediate telephone report to the NRC comprise the high level of detail regarding a hazardous materials incident reflected in the DOT Hazardous Materials Incident Report form. Neither would contain, as would the DOT Hazardous Materials Incident Report, detailed information concerning the container and packaging used to transport the hazardous material, the specific circumstances of the failure, or the transportation environment in which the incident occurred. Consequently, neither could provide the in-depth information that RSPA needs to maintain its Hazardous Materials Information System, which is crucial to RSPA’s ability to carry out meaningful analyses of reported accident data. The requirements in 49 CFR 171.16 of the DOT Hazardous Materials Regulations place the responsibility for submitting the written DOT Hazardous Materials Incident Report on the carrier. The requirements apply to releases of hazardous materials that occur during the course of transportation, which has been defined under 49 United States Code Section 5102 to include “the movement of property and the loading, unloading, or storage incidental to the movement.” In the case of the Clymers accident, it seems reasonable that the Central Railroad of Indianapolis, the carrier that delivered UTLX 643593 and the other tank cars to the Essroc plant, assumed it was not responsible for filing a written DOT Hazardous Materials Incident Report with RSPA. The railroad had delivered the tank car to the Essroc plant on December 7, 1998, more than 2 months before the accident took place. The accident occurred on the plant property, and the railroad was not involved in the accident. The Central Railroad of Indianapolis thus had good reason to suppose it was no longer responsible for filing a written report with RSPA. Essroc likewise did not provide a DOT Hazardous Materials Incident Report to RSPA because it is a TSD facility operator, not a carrier. Consequently, no DOT Hazardous Materials Incident Report has been filed for this accident with RSPA, even though a DOT specification tank car used in revenue service and containing a regulated hazardous waste catastrophically ruptured. The Safety Board concludes that, because the requirements of 49 CFR 171.16 place the responsibility for filing the written DOT Hazardous Materials Incident Report solely upon the carrier, the

Analysis 63 Hazardous Materials Accident Report current requirements do not ensure that RSPA receives the information the Safety Board believes it needs to develop safe practices. Of the parties involved, the carrier is least likely to have knowledge of or be involved in an accident or incident that occurs at a shipper or consignee facility where loading and unloading operations are carried out, and where hazardous materials containers are temporarily stored. As a result, many loading and unloading accidents may not be reported to the DOT. The written DOT Hazardous Materials Incident Reports provide the input for the Hazardous Materials Information System, which is RSPA’s accident database. Because this database is used (among other things) to carry out trend analyses, the failure to capture data about incidents at loading and offloading facilities may skew accident analyses conducted using these data and obscure industry performance and operational deficiencies. Further, a review of EPA regulations demonstrated that the comprehensive data required are collected only by the written DOT Hazardous Materials Incident Reports. The Safety Board has previously expressed its concern about this issue to RSPA, most recently through its July 26, 1999, comments on the March 23, 1999, ANPRM that RSPA issued on revising the incident reporting requirements and the DOT Hazardous Materials Incident Report form. Citing reporting deficiencies identified in the Clymers, Louisville, and Biloxi hazardous materials accidents, the Safety Board noted that when accidents involving releases of hazardous materials from DOT specification containers occur at loading or unloading facilities, a carrier may not be directly involved, increasing the likelihood that such accidents will go unreported to RSPA. The Safety Board stated that it believed that “…a complete and accurate accident database requires that incident reports be filed for any failure of hazardous material containers or the unintended release of a hazardous material during any transportation-related operation….” To repair this gap in the notification and reporting standards, the Safety Board believes that RSPA should develop and implement policies and procedures to ensure that comprehensive reports concerning all significant failures of DOT specification tank cars, highway cargo tanks, and intermodal bulk containers containing hazardous materials are provided in writing to RSPA.

64 Hazardous Materials Accident Report Conclusions Findings 1. No evidence indicates that the tank of railroad tank car UTLX 643593 had any structural or material defects that either caused or contributed to the rupture of the tank. 2. The internal pressure in tank car UTLX 643593 increased and eventually exceeded the burst pressure of the tank, resulting in the catastrophic rupture of the tank car. 3. The expansion of toluene diisocyanate matter waste that occurred before the accident blocked the vapor and pressure relief valves of tank car UTLX 643593, which effectively removed any means of relieving the build-up of internal pressure. 4. Tank car UTLX 643593 was overpressurized from the chemical self-reaction and expansion of the toluene diisocyanate matter waste that was initiated and sustained by localized overheating of the mixture at the bottom of the tank car. 5. If the Essroc Cement Corporation and CP Recycling of Indiana had employed low-pressure steam to heat the wastes, used nitrogen sparging to facilitate even heating throughout the tank car, and maintained the temperature of the wastes below 140° F, the risk of localized overheating and expansion of the waste mixture would have been minimized, and the accident likely would not have occurred. 6. The Essroc Cement Corporation and CP Recycling of Indiana failed to develop and implement appropriate heating and offloading procedures for the toluene diisocyanate matter wastes at the Logansport plant, which resulted in the use of unsafe offloading practices at the plant. 7. The Olin Corporation and the Arco Chemical Company (now the Lyondell Chemical Company) did not provide the Essroc Cement Corporation with comprehensive, written information about safe handling procedures for toluene diisocyanate matter wastes. 8. The U.S. Department of Transportation Hazardous Materials Regulations are deficient because they fail to require the development and implementation of comprehensive, written loading and unloading procedures for hazardous materials. 9. Based on the deteriorated condition of the pressure relief valves examined in this investigation and the failure of these valves to activate as required, the pressure relief valves on tank cars that transport hazardous materials may require more frequent and rigorous testing to ensure that they remain functional.

Conclusions 65 Hazardous Materials Accident Report

1. The transportation of the solvent blend wastes and toluene diisocyanate matter wastes

in UTLX 643593 and the other tank cars approved for the transport of pure toluene diisocyanate constituted a change in product service that resulted in the transport of a commodity incompatible with components of the tank car.

1. Because the requirements of 49 Code of Federal Regulations 171.16 place the

responsibility for filing the written U.S. Department of Transportation Hazardous Materials Incident Report solely upon the carrier, the current requirements do not ensure that the Research and Special Programs Administration (RSPA) receives the information the National Transportation Safety Board believes RSPA needs to develop safe practices. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the failure of Essroc Cement Corporation and CP Recycling of Indiana management to develop and implement safe procedures for offloading toluene diisocyanate matter wastes, resulting in the overpressurization of the tank car from chemical self-reaction and expansion of the toluene diisocyanate matter wastes.

66 Hazardous Materials Accident Report Recommendations New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the Federal Railroad Administration Issue an advisory bulletin reminding shippers of hazardous materials that any time a change is made in the chemical constituents of hazardous materials shipped, they should verify the compatibility of all tank car components, such as valves and gaskets, with all of the commodities to be transported. (R-01-01) Evaluate, with the assistance of the Research and Special Programs Administration, the Association of American Railroads, and the Railway Progress Institute, the deterioration of pressure relief devices through normal service and then develop inspection criteria to ensure that the pressure relief devices remain functional between regular inspection intervals. Incorporate these inspection criteria into the U.S. Department of Transportation Hazardous Materials Regulations. (R-01-02) To the Research and Special Programs Administration Evaluate, with the assistance of the Federal Railroad Administration, the Association of American Railroads, and the Railway Progress Institute, the deterioration of pressure relief devices through normal service and then develop inspection criteria to ensure that the pressure relief devices remain functional between regular inspection intervals. Incorporate these inspection criteria into the U.S. Department of Transportation Hazardous Materials Regulations. (R-01-03) Develop and implement policies and procedures to ensure that comprehensive reports concerning all significant failures of U.S. Department of Transportation specification tank cars, highway cargo tanks, and intermodal bulk containers containing hazardous materials are provided in writing to the Research and Special Programs Administration. (I-01-01)

Recommendations 67 Hazardous Materials Accident Report To the Association of American Railroads (R-01-04) To the Railway Progress Institute (R-01-05) Assist the Federal Railroad Administration and the Research and Special Programs Administration in the evaluation of the deterioration of pressure relief devices through normal service and the development of inspection criteria to ensure that the pressure relief devices remain functional between regular inspection intervals. To the Essroc Cement Corporation (I-01-02) To CP Recycling, Inc., and Affiliated Companies (I-01-03) To the Olin Corporation (I-01-04) To the Lyondell Chemical Company (I-01-05) Collaborate with applicable producers, shippers, consignees, and end-users in the development and implementation of specific and written procedures for the loading or offloading of any chemical or waste material from a railroad tank car, highway cargo tank, or other bulk transportation vessel when the chemical or waste material exhibits properties that require special handling or processing during the loading or offloading operation. Previously Issued Recommendation Reiterated in this Report To the Research and Special Programs Administration I-00-06 Within 1 year of the issuance of this safety recommendation, complete rulemaking on Docket HM-223, “Applicability of the Hazardous Materials Regulations to Loading, Unloading, and Storage,” to establish, for all modes of transportation, safety requirements for loading and unloading hazardous materials. BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN J. GOGLIA Member JOHN A. HAMMERSCHMIDT Member GEORGE W. BLACK, JR. Member March 5, 2001

this page intentionally left blank

69 Hazardous Materials Accident Report Appendix A Investigation The National Response Center notified the Safety Board of the accident at 8:30 a.m., February 18, 1999. The Safety Board immediately dispatched a team of two hazardous materials investigators from Washington, D.C., to the scene. A metallurgist from the Safety Board’s D.C. office joined the on-scene investigation several days after the accident occurred. No Board Member participated in the on-scene investigation. No hearings were held on the accident, and no depositions were filed concerning it. The Federal Railroad Administration, the Lyondell Chemical Company, the Olin Corporation, the Essroc Cement Corporation, CP Recycling of Indiana, Union Tank Car Company, and Midland Manufacturing Corporation were all parties to the investigation. (The Safety Board also provided information about the investigation on an ongoing basis to the Mine Safety and Health Administration.)

70 Hazardous Materials Accident Report Appendix B U.S. Department of Transportation Hazardous Materials Incident Report Form

Appendix B 71 Hazardous Materials Accident Report

FD07214 ｜ 1999_美国_NTSB_MAR0201_Sinking_of_the_Amphibious_Passenger_Vessel_Miss_Majestic.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Sinking of the Amphibious Passenger Vehicle Miss Majestic, Lake Hamilton, Near Hot Springs, Arkansas, May 1, 1999 NTSB/MAR-02/01 PB2002-916401 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

Marine Accident Report

this page intentionally left blank

Marine Accident Report Sinking of the Amphibious Passenger Vehicle Miss Majestic, Lake Hamilton, Near Hot Springs, Arkansas, May 1, 1999 NTSB/MAR-02/01 PB2002-916401 National Transportation Safety Board Notation 7222B 490 L’Enfant Plaza, S.W. Adopted April 2, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Sinking of the Amphibious Passenger Vehicle Miss Majestic, Lake Hamilton, Near Hot Springs, Arkansas, May 1, 1999 Includes Marine Accident Brief Reports Sinking of the Alvis Stalwart M/V Minnow, Milwaukee Harbor, Milwaukee, Wisconsin, September 18, 2000, and Sinking of the M/V DUKW No. 1, Lake Union, Seattle, Washington, December 8, 2001. Marine Accident Report NTSB/MAR-02/01. Washington, DC. Abstract: This report discusses the sinking of the amphibious passenger vehicle Miss Majestic during an excursion tour of Lake Hamilton near Hot Springs, Arkansas, on May 1, 1999. Of the 21 people on board, 13 passengers, including 3 children, died. The vehicle damage was estimated at $100,000. The Safety Board’s investigation of this accident identified safety issues in the following areas: vehicle maintenance, Coast Guard inspections of the Miss Majestic, Coast Guard inspection guidance, reserve buoyancy, and survivability. Based on its findings, the Safety Board made recommendations to the U.S. Coast Guard and the Governors of the States of New York and Wisconsin. Following this sinking accident, the Safety Board investigated two other accidents involving amphibious passenger vehicles, which are the subjects of brief reports published in an appendix of the Miss Majestic report. The first brief discusses the September 18, 2000, sinking of the Minnow, a 21-foot-long Alvis Stalwart-type amphibious passenger vehicle in the Milwaukee, Wisconsin, harbor. No deaths or injuries resulted from this accident, and the vehicle damage was estimated at $170,000.The second brief discusses the December 8, 2001, sinking of the DUKW No. 1, a 33-foot-long amphibious passenger vehicle, in Lake Union, in Seattle, Washington. No deaths or injuries resulted from this accident, and the vehicle damage was estimated at $100,000. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 The Sinking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Vehicle Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Coast Guard Inspections of the Miss Majestic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Coast Guard Inspection Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Reserve Buoyancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Survivability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Actions Of The Operator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Previously Issued Recommendation Classified in this Report . . . . . . . . . . . . . . . . . . . . . . . 54 Concurring Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 A: Investigation And Public Forum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 B: Minnow and DUKW No. 1 Accident Briefs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

iv Marine Accident Report Acronyms and Abbreviations CFR Code of Federal Regulations COI Certificate of Inspection EMS Emergency Medical Service gpm gallons per minute ICAO International Civil Aviation Organization MSO Marine Safety Office NVIC Navigation and Vessel Inspection Circular OCMI Officer in Charge, Marine Inspection RHIB Rigid Hull Inflatable Boat UTB utility boat

v Marine Accident Report Executive Summary On May 1, 1999, the amphibious passenger vehicle Miss Majestic, with an operator and 20 passengers on board, entered Lake Hamilton near Hot Springs, Arkansas, on a regular excursion tour. About 7 minutes after entering the water, the vehicle listed to port and rapidly sank by the stern in 60 feet of water. One passenger escaped before the vehicle submerged but the remaining passengers and the operator were trapped by the vehicle’s canopy roof and drawn under water. During the vehicle’s descent to the bottom of the lake, 6 passengers and the operator were able to escape and, upon their reaching the water’s surface, were rescued by pleasure boaters in the area. The remaining 13 passengers, including 3 children, lost their lives. The vehicle damage was estimated at $100,000. The Safety Board’s investigation of this accident identified the following major safety issues: • Vehicle maintenance, • Coast Guard inspections of the Miss Majestic, • Coast Guard inspection guidance, • Reserve buoyancy, and • Survivability. The National Transportation Safety Board determines that the probable cause of the uncontrolled flooding and sinking of the Miss Majestic was the failure of Land and Lakes Tours, Inc., to adequately repair and maintain the DUKW. Contributing to the sinking was a flaw in the design of DUKWs as converted for passenger service, that is, the lack of adequate reserve buoyancy1 that would have allowed the vehicle to remain afloat in a flooded condition. Contributing to the unsafe condition of the Miss Majestic was the lack of adequate oversight by the Coast Guard. Contributing to the high loss of life was a continuous canopy roof that entrapped passengers within the sinking vehicle. As a result of this investigation, the Safety Board makes recommendations to the U.S. Coast Guard and the Governors of the States of New York and Wisconsin. 1 Reserve buoyancy is the internal volume of a vessel that is not flooded or capable of being flooded.

1 Marine Accident Report Factual Information Events Preceding the Accident On Thursday, April 29, 1999, the Miss Majestic, an amphibious commercial passenger vehicle that had been converted from a U.S. Army DUKW,2 was nearing the end of the waterborne portion of a tour in Lake Hamilton, Arkansas. (See figure 1.) As the vehicle approached the shore, the operator said she saw that the Higgins pump, a dewatering pump in the bilge system, was intermittently discharging water. In addition, the forward electric bilge pump that automatically activated when water accumulated amidships in the hull was continuously discharging water from the vehicle. The operator radioed a report of her observations to Land and Lakes, Inc., (Land and Lakes) the owner/operator of White and Yellow Duck Tours, before arriving at the usual return ramp, where she drove the Miss Majestic out of the water. 2 A DUKW (pronounced “duck”) is an amphibious landing vehicle that was designed to transport military personnel and supplies for the U.S. Army (Army) during World War II. The Army acronym DUKW indicates that the vehicle model was designed in 1942 (D) and that the vehicle is amphibious (U) and has both front-wheel drive and rear-wheel drive capability (K and W, respectively). Records indicate that more than 21,000 DUKWs were built. After the war, many DUKWs were sold as surplus and, like the Miss Majestic, were converted to commercial excursion passenger vehicles that are in operation today. Figure 1. The Miss Majestic. When the DUKW was converted for commercial passenger service, a steel frame was installed around and over the passenger compartment. The Miss Majestic had a vinyl canopy over the frame to protect passengers from the weather.

Factual Information 2 Marine Accident Report In the meantime, Land and Lakes dispatched its senior mechanic, who arrived at the exit ramp while the Miss Majestic was still in the lake. He, too, observed that the water was discharging from the Higgins pump’s outflow point in a brief and intermittent manner rather than in a steady stream. The operator said that after she drove the Miss Majestic up the ramp and onto dry land, water continually leaked from the hull for about 10 minutes. During the same time, water continuously discharged from the forward electric bilge pump. After the mechanic examined the vehicle and determined that the source of the leak was a tear in the forward rubber boot3 on the rear driveshaft housing (figure 2), the operator drove the Miss Majestic to Hot Springs, where she completed the land tour and dropped off passengers. She then drove the Miss Majestic to the company garage for repairs. On April 30, at the garage, the maintenance mechanic began work after 12004 on the Miss Majestic after conducting daily checks on three other DUKWs that were being used for tours that day. To repair the leak, he replaced the forward boot with a rubber boot that had been obtained from sources such as Army surplus. In the course of making the repair, he discovered a small tear in the aft boot for the rear driveshaft housing; however, he did not have time to replace the aft boot before the end of his workday. The next morning, the day of the accident, the mechanic replaced the aft boot with a previously used boot. The Miss Majestic was then returned to service. Accident Narrative About 1130 on May 1, 1999, the operator of the Miss Majestic first picked up 18 passengers at the White and Yellow Duck Tours ticket office in Hot Springs and then two passengers at a regular White and Yellow Ducks stop at a nearby park, for a total of 20 passengers. The operator served not only as the operator of the vehicle but also as the narrator for the tour. After conducting a land tour of Hot Springs, the operator drove the DUKW south on U.S. Route 7 to Lake Hamilton for the waterborne portion of the tour. On the northwest side of Saint John’s Island, the operator arrived at the boat ramp owned by Land and Lakes and, in preparation for entering the water, turned on the toggle switch to power the three electric bilge pumps.5 The operator then stood up, faced the passengers, and briefed them on the water tour sights and safety instructions. She warned them that smoking was prohibited by the U.S. Coast Guard (Coast Guard) and was punishable by a fine. The operator pointed out that the lifejackets were stowed on wooden 3 The driveshafts for the wheels penetrated the hull and were protected by cylindrical steel housings. The housings were fitted with rubber boots to maintain the watertight integrity of the hull. The boots were held in place by hose clamps. If the boots had holes or were dislodged, water could freely enter the hull. 4 All times are central daylight times, based on a 24-hour clock. 5 The forward electric pump operated only when its float switch was activated by the presence of water. The aft electric pumps were activated by the operator turning on a toggle switch on the dashboard.

Factual Information 3 Marine Accident Report Figure 2. Top illustration shows the Miss Majestic’s assembly and the approximate locations of the Higgins pump and the three electric bilge pumps. Bottom illustration shows a side view of the driveshaft housing and components as designed by the Army. Transmission Transfer Water Propeller Guardian Bilge Pump Higgins Pump Proline Bilge Pump Proline Bilge Pump Aft Rubber Boot Drive Shaft Housing Forward Rubber Boot Transfer Case Hull FWD Plan view of the Miss Majestic's drive shaft and chassis assembly. The area indicated by a dotted line includes the drive shaft and its rubber boots, which were designed to provide a waterproof seal for the drive shaft's penetration into the hull. Retaining Ring Forward Rubber Boot Shaft Housing Clamp Rings Hinge Pin Hinge Assembly Drain Plug Aft Rubber Boot Above is the drive shaft housing and hinge pin assembly as shown in the Army technical manual for DUKWs. The hinge pin assembly, which holds the housing in position relative to the hull, was missing from the Miss Majestic.

Factual Information 4 Marine Accident Report shelving underneath the overhead canopy covering the passenger compartment of the vehicle. While briefing the passengers about the lifejackets, the operator tried to pull one out of the storage rack (see figure 3) to demonstrate how to don it. When she could not pull a lifejacket free, the operator gave up trying.6 According to passengers, as the operator retook her seat at the forward part of the vehicle, she pointed to the lifejackets and said, “They’re up there.” The passengers said that the operator neither offered lifejackets to anyone nor explained how to get off the vehicle in case of an emergency on the water. The operator then put the DUKW’s transmission into neutral, engaged the vehicle’s propeller, and let the vehicle roll down the ramp into the water. The DUKW followed along the shore of Saint John’s Island, traveling about 4 knots. While she had been driving on land, the operator had raised the windshield and secured the curtains on the corner windows on either side of the windshield. She left the windshield up for the lake tour. 6 Safety Board investigators examined other DUKWs belonging to the company and found the lifejackets jammed tightly into the storage racks. Figure 3. Postaccident view of the Miss Majestic’s main passenger compartment looking forward from the aft seating area. The lifejackets were stored in open racks above the passengers’ seats.

Factual Information 5 Marine Accident Report During an interview with Safety Board investigators, a 15-year old boy who had been sitting in the third row on the port side stated that shortly after the DUKW entered Lake Hamilton, he took off his shoes. After the DUKW had been on the lake about 4 to 5 minutes, he felt his feet getting wet and, upon looking down, saw that the deck area near his seat was filled with water a little less than a ½-inch deep. The DUKW was riding so low that, from his seat, he could reach down and touch the surface of the lake. He said that he observed a stream of water pouring out of a plastic hose near the operator’s seat. The boy likened the water discharge to that of a water stream from a 1-inch garden hose. Two other passengers sitting on the port side also recalled seeing water discharging overboard near the operator’s seat. The boy in the third row said that he thought the condition was normal and that the operator did not notice the discharging water. The operator later stated that, about 5 to 7 minutes after the Miss Majestic entered the lake, she noticed that the DUKW was handling sluggishly and had a small list to port. She looked back at the passengers and asked a large man (6 feet 6 inches tall and 260 pounds) who was sitting in the sixth row on the port side to move to the starboard side of the vehicle. (See figure 4.) As he got up to change seats, the man saw water enter the vehicle over the stern and realized the danger. He started pulling lifejackets from the overhead stowage area and throwing them to other passengers, shouting at them to “get out.” He said that passengers in the row across from him initially remained in their seats and did not move. At that time, the operator, who had been busy narrating the tour, looked aft and saw water pouring over the stern into the passenger compartment. Upon seeing the inrush of water, she immediately turned the Miss Majestic to port and headed towards shore. The operator later stated that she had not observed discharges from either the Higgins pump or the forward electric bilge pump during the tour; the discharge pipes were to her left. She had been turned to her right, to narrate the tour to the passengers, when the vehicle had begun to flood. She had also throttled the engine down while narrating. The operator stated that she radioed Land and Lakes on the designated VHF channel. The owner stated that he and his employees were by their radios, but no one heard a call. The operator and the passengers provided different time estimates of how long it took the Miss Majestic to sink below the surface of the lake after the DUKW began to take on water over the stern. Some individuals said that the DUKW sank within 15 seconds; others stated that the Miss Majestic took up to about 1 minute to sink. A boater in the area who had noticed that the Miss Majestic was riding very low in the water said that, as he attempted to approach the vehicle to warn the operator, the Miss Majestic sank by the stern and quickly disappeared below the surface. In the meantime, the 15-year-old male in the third row tried to assist other passengers by providing lifejackets. He later stated that he was able to pull a few lifejackets from the stowage area but said that doing so “was kind of hard.” Before the vehicle submerged, he exited the port side window and crawled on top of the canopy as the vehicle quickly slipped beneath the water’s surface.

Factual Information 6 Marine Accident Report Figure 4. Passenger seating arrangement on the Miss Majestic.

!

"# $

%

&'

!

$%&

! %

$ !()% )

%%

&

!

Factual Information 7 Marine Accident Report The large male passenger who had been tossing lifejackets to others said that water rushing into the vehicle swept him forward and pinned him against the windshield. He could not recall how he exited the vehicle. He said that he considered himself a strong swimmer but that the water’s force overcame him. He said that his wife, one of the accident fatalities, did not know how to swim. A passenger in the second row said that, when he realized that the Miss Majestic was submerging, he jumped out the port side window. His wife, at first, tried to use the aisle to move to the front of the vehicle; however, upon observing other passengers beginning to panic and seeing that the windshield blocked any exit from the forward part of the vehicle, she returned to the portside opening where her husband had exited. As the woman moved toward the opening, a child who had been in the sixth row grabbed and held onto her. The woman said that she initially swam downward to free herself from the vehicle before beginning her ascent to the surface. She said that her ascent took a long time and that her nose was bleeding when she reached the surface of the lake. She later stated that she was not aware that a child had grabbed hold of her until she surfaced and people assisted the two of them into a recreational vessel. In the meantime, a woman in the seventh row had her feet propped up on the seat across from her when water began pouring into the stern. The woman said that she had hardly had time to put her feet on the deck when the incoming water was over her head. The woman said that she was not a swimmer. As the vehicle sank deeper, she could see nothing in the murky green, increasingly dark water. She said that she held on tightly to the metal frame at the aft edge of the canopy; however, she was unable to overcome the force of the water and was swept out the stern window opening. She floated to the surface, where she was rescued. On the starboard side of the vehicle, a man and woman in the seventh and eighth rows were attempting to place a lifejacket on a child when the incoming water poured over them. The man said that he attempted to swim in what he thought was a forward direction; however, he felt something in his way. He did not know through which opening he exited the vehicle; he stated that it took him a while to get to the surface. The operator stated that she felt along the line of the roof and, upon finding an area where the windscreen had become detached, pulled herself through the opening. She stated that the water was dark. Although she was a strong and practiced swimmer, she struggled to reach the surface of the lake. Upon surfacing, she noted that her clothing was covered with dirt, which she thought was silt, indicating she had been on the lake bottom. The operators of at least six pleasure boats that happened to be in the area responded to assist the Miss Majestic’s eight survivors as they surfaced. One of the responders used a cellular telephone to call 911. The call was relayed to State and area response agencies, including the Lake Hamilton Fire Department Emergency Medical Services (EMS), the Garland County Sheriff’s Department, the St. Joseph’s Regional Health Center, the National Park Service, the Hot Springs Police Department, the Arkansas State Police, and area representatives of the U.S. Red Cross.

Factual Information 8 Marine Accident Report The eight survivors advised responders that they were not injured physically. Divers from the Garland County Sheriff’s Department recovered the bodies of all of the remaining passengers, 13 victims, over a 2-day period. Injuries The injuries sustained in the Miss Majestic accident, shown in table 1, are categorized according to the injury criteria of the International Civil Aviation Organization (ICAO). The Safety Board uses the ICAO injury criteria in all its accident reports, regardless of transportation mode. Damage Examination of the vehicle after it was salvaged revealed that the DUKW did not suffer any structural damage or failure and that all hull plugs were in place. Damages from the accident were estimated at $100,000. The Safety Board’s observations of the DUKW’s condition during postaccident examinations are included in the section below, “Vehicle Information.” Table 1: Injuries sustained in the Miss Majestic accident. Injuries Passengers Crew Total Fatal 13 0 13 Serious 0 0 0 Minor 0 0 0 None 7 1 8 Totals 20 1 21 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as: any injury that results in death within 30 days of the accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns, or any burn affecting more than 5 percent of the body surface.

Factual Information 9 Marine Accident Report Personnel Information Vehicle Operator The Miss Majestic’s operator was hired by Land and Lakes in August 1998. Before joining the tour company, she had worked as a substitute school bus driver in Mount Ida, Arkansas, from 1997 though 1998, and as a school bus driver in Rockford, Illinois, from 1996 through 1997.7 She had also worked as a machinist in Rockford from 1988 until August 1995. She stated she had operated a motorboat and had 2 to 3 years experience helping aboard “party barges” and fishing craft. The operator stated that, in preparation for her Coast Guard examination to become certified to operate a DUKW, she had accompanied and observed licensed DUKW operators for perhaps 3 to 4 months. On December 11, 1998, she was issued a license as master of steam or motor vessels measuring less than 25 gross tons upon inland waters that limited her to operating DUKW vehicles no more than 250 yards offshore in Lake Hamilton.8 The license was valid for 5 years. The operator stated that, after receiving her license, she drove various DUKWs under the supervision of more experienced operators for “probably a week or two.” She was then permanently assigned by Land and Lakes as operator of the Miss Majestic and, unless the vehicle was not available, normally drove that DUKW. The operator described herself as being in generally good health, with a history of arthritis. She stated that she had been taking Motrin before the accident. Contract Employees Land and Lakes contracted with a senior mechanic9 to perform maintenance and repairs on its DUKWs. The senior mechanic, in turn, employed a maintenance mechanic to assist him. The senior mechanic had been associated with Land and Lakes for 1 1/2 years. Before then, he had worked as a mechanic on automobiles, boats, and motorcycles, and had done part-time maintenance for another DUKW company. His training included 2 years at a vocational school, where his instruction focused primarily on small engine mechanics. 7 The operator held an Arkansas State Commercial Driver’s License (CDL) that was valid through March 16, 2002. The Class B license included motorcycle and passenger endorsements and was restricted to vehicles without air brakes. She had previously held an Illinois CDL. 8 The Coast Guard requirements for issuing an operator’s license for steam or motor vessels measuring less than 25 gross tons, which are contained in 46 CFR Subchapter B, Part 10, Subpart D, include minimum age, citizenship, physical suitability (including drug and alcohol testing), character (including criminal history and driving record), training in first aid and CPR, successful completion of a written examination, and vessel experience. 9 Because he served in a supervisory capacity, this report will refer to the contract mechanic as the senior mechanic.

Factual Information 10 Marine Accident Report The maintenance mechanic had been employed by the senior mechanic to assist him with the Land and Lakes contract work for about 2 months. Before this contract job, he had worked for 2 years for a company where he drove and performed maintenance on dump trucks. The maintenance mechanic had previously worked for Land and Lakes for 11 years as a DUKW driver. During that time, he also had performed some maintenance work on the DUKWs. As assistant to the senior mechanic, the maintenance mechanic said he performed general work on DUKWs, including testing lights, checking fluid levels and pumps, repairing brakes, and replacing starters, alternators, universal joints, and worn or damaged boots. Work and Rest Schedules The Miss Majestic’s operator regularly worked Tuesdays through Saturdays and was off Sundays and Mondays. She provided a summary of her work and rest schedule during the 3 days before the accident, which is shown in table 2. The maintenance mechanic provided a brief account of his 72-hour history before the accident, which is also included in table 2. Table 2: Seventy-two hour history of the operator and mechanic Day Miss Majestic’s Operator Maintenance Mechanic Thursday, April 29 0600—Arose, fed horses, had breakfast, showered, and went to work. Had coffee and took a 1-hour nap. 1100—Gave first tour of day. Had two additional tours, the last of which was at 1800. During the last tour, noted and reported atypical bilge-pump operations. 1915—Left work and went home. Went to bed about 2100. Not scheduled for work. Performed light work at home. 2200—Went to bed. Friday, April 30 0600—Arose and prepared for work. 1100—Drove the Miss Andrea DUKW because the Miss Majestic was being repaired. 1600—Drove the Miss Sands DUKW because of gear shift problems experienced with the Miss Andrea. Went home after 1600 tour. 2130—Went to bed after riding horses and having supper. 0630—Arose. 0730—Reported to work. Performed routine daily maintenance on the DUKWs, including the Miss Majestic. Time went to bed not provided. Saturday, May 1 0530—Arose and prepared for work. Dropped off daughter at the Little Rock, Arkansas, airport and reported to work about 0815. 1130—Departed with tour group. Shortly before noon—Miss Majestic sinks. Time arose not provided. Performed maintenance on the Miss Majestic.

Factual Information 11 Marine Accident Report Vessel Information The DUKW that was converted to passenger use and became the Miss Majestic was built in 1944 as an amphibious landing vehicle designed to transport Army military personnel. According to the Coast Guard’s Navigation and Vessel Inspection Circular10 (NVIC) No. 1-01, Inspection of Amphibious Passenger Carrying Vehicles, the Army DUKWs were designed: …for the purpose of making beach landings and then proceeding onshore to provide limited troop transportation away from the beachhead. These vehicles were built with a life expectancy of only a few months. Although mechanically rugged, hull construction was simplified for the sake of the accelerated production schedule and the vehicle’s anticipated short life expectancy. The Miss Majestic was inspected and certificated by the Coast Guard as a small passenger vessel11 meeting the requirements of 46 CFR Parts 175-185 (Subchapter T). The Coast Guard Certificate of Inspection (COI) permitted the Miss Majestic to operate voyages not exceeding 30 minutes on Lake Hamilton no more than 250 yards from shore. The characteristics of the Miss Majestic are summarized below. The Miss Majestic’s hull was constructed of 7/64 (0.109)- and 5/64 (0.078)-inch steel sheet metal with welded stiffeners. The vehicle had no internal watertight subdivision bulkheads; except for minor structural interferences such as tunnels and hull stiffeners, the vehicle’s internal hull was open forward to aft. The DUKW had a three- bladed, right-hand-turning propeller in a half tunnel at the stern. When fully loaded, the Miss Majestic trimmed by the stern with a freeboard of about 2 feet forward and 8 to 12 inches aft. 10 The Coast Guard Headquarters issues NVICs to disseminate recommended [emphasis added] policy, requirements, procedures, or guidance for Coast Guard marine safety personnel and the marine industry. 11 A vessel of less than 100 gross tons carrying more than six passengers for hire. Length: 31 feet Beam: 8 feet 2 inches Gross Tonnage: 5 Crew: 1 (operator) Passenger capacity: 32 (24 in the main area, 8 in the raised rear platform) Propulsion: 140 hp V-8 Chevrolet 350 gasoline engine, radiator cooled Transmission: Turbo Hydromatic 400 automatic 4 speed

Factual Information 12 Marine Accident Report As part of the Miss Majestic’s conversion for commercial use, the following passenger accommodations were added: • At the centerline of the stern, a hinge-mounted ladder was added for passenger entry from and exit to land. After boarding, the ladder was hinged up and secured. (See figure 1.) • Eight rows of passenger seats were added, with the last two rows on a raised deck aft. Each row had two seats on each side of the centerline aisle. (See figures 2 and 3.) The aisle width in both the main passenger compartment and the after deck area was 12 inches. The distance from seat front to seat front in the main passenger compartment was 26 inches. The after deck area contained two rows of seats that faced each other. The distance between the two facing seat fronts was 14 inches. • A steel frame was installed around and over the passenger compartment. The vertical members of the frame created 28-inch-high “windows” at the seat rows. From forward to aft, the six windows in the main compartment had a clearance width of 33, 18, 33, 33, 33, and 40 inches, respectively. The width of the window at the seat row on the raised deck was 51 inches. • A vinyl canopy was installed over the steel frame of the passenger compartment to protect passengers from the weather. • Clear, roll-up, vinyl side curtains were added along both sides of the passenger compartment. When the curtains were rolled up, the window clearance was 21 inches. The aisle in the main passenger compartment was 14 feet long; on the after deck, the aisle was 4 feet, 4 inches long. Thus, the entire length of the Miss Majestic’s centerline aisle was 18 feet, 4 inches. Federal regulations contained in 46 CFR 177.30-1 stipulate that the width of aisles more than 15 feet long should be no less than 30 inches and the distance from seat front to seat front should not be less than 30 inches. According to the Coast Guard, the Miss Majestic had been granted a waiver for meeting the aisle width and seat separation requirements. Coast Guard files for the Miss Majestic contained no record indicating how the acceptable dimensions were determined. According to Coast Guard documents, the Miss Majestic met regulations in Subchapter T, which require that a vessel pass an intact stability test to demonstrate that its freeboard will not immerse should passengers move from one side of the vessel to the other. Design and Components Driveshaft Housing and Boot System. The aft driveshaft that ran from the transfer case to the rear differential and drive wheels of the Miss Majestic had a housing for watertight protection. In the DUKW design, the shaft housing was supported and held

Factual Information 13 Marine Accident Report in position, relative to the hull, by a hinge assembly and, relative to the differential, by a support bracket. The hinge prevented the shaft housing from shifting forward and aft. Each end of the aft shaft housing had an accordion rubber boot. The aft rubber boot was attached to the aft end of the shaft housing and the differential using hose clamps. The forward rubber boot was clamped onto the housing using a hose clamp and bolted to a cutout in the chassis. The two rubber boots together with the shaft housing were to provide a watertight barrier where the drive axle penetrated the hull. The Miss Majestic had a similarly configured forward shaft housing to protect the front wheel driveshaft. Bilge Pump System. Federal regulations contained in 46 CFR 182.520 stipulate that vessels must be equipped with bilge pumps. The number of the required pumps and their minimum capacity depends upon the length of the vessel and the number of passengers that it carries. The Miss Majestic was required to have two bilge pumps: one with a pumping capacity of 10 gallons per minute (gpm) and a second with a pumping capacity of 5 gpm. The Miss Majestic had three electric pumps, one Guardian model 1100 and two Proline model 22702s. The Guardian 1100, manufactured by Attwood Corporation, was a submersible- style, 12-volt electric pump that automatically float-activated when water accumulated amidships in the hull. The Guardian pump was equipped with a 1-inch diameter plastic discharge hose and had a maximum discharge capacity of 18 gpm. On the Miss Majestic, the Guardian pump was located on the hull bottom, immediately forward of the Higgins pump. The Guardian’s hose discharged athwartships to port at the port gunwale, immediately to the left of the operator’s station. The Proline Model No. 22702, manufactured by Mayfair Marine, was a submersible-style, 12-volt electric pump that activated when the operator turned on a toggle switch. The Proline Model No. 22702 pump had a maximum discharge capacity of 12.5 gpm. On the Miss Majestic, the two Proline pumps were installed near the stern, where water usually collected because of the vehicle’s trim. One Proline pump was located behind the port rear wheel well and the other Proline pump was behind the starboard rear wheel well. The discharge points for the Proline pumps were at the stern deck, on either side of the passenger embarkation step; the pump discharge hoses were directed aft. A single toggle switch on the dashboard provided power to the three electric bilge pumps. The operators’ practice was to turn on the switch before entering the water and to turn it off when exiting the water to prevent the Proline pumps from running dry and failing prematurely while the vehicle traveled on land. A red light on the control console indicated when the switch was on. As with most amphibious vehicles converted from Army DUKWs, the Miss Majestic had a Higgins pump, which was not required by Federal regulation. The Higgins pump had a maximum capacity of 250 gpm. The pump was chain-driven from the water

Factual Information 14 Marine Accident Report propeller driveshaft through a keyed sprocket on the pump shaft and operated whenever the propeller’s driveshaft was engaged. (See figure 5.) The Higgins pump discharged straight upward and overboard through an opening on the port side gunwale, near the second row of seats. Figure 5. The Higgins pump arrangement. The centrifugal-type, bronze pump had a 4-bolt mounting bracket, which, in the case of the Miss Majestic, attached the pump onto the port longitudinal girder (channel) under the passenger compartment. The face of the pump’s intake (suction) strainer was about 1 1/2 inches above the bottom of the vehicle. The 2 1/2-inch-diameter discharge pipe extending upward from the pump had three sections: a lower discharge tube, a center discharge tube, and an upper discharge tube. A short section of hose with clamps connected the lower discharge tube to the pump discharge.

Factual Information 15 Marine Accident Report Bilge Alarm. In 1996, Subchapter T was revised to require that vessels at least 26 feet long be equipped with high-level bilge alarms. The regulations stated that existing vessels, such as the Miss Majestic, had until March 11, 1999, to comply with the high- level alarm requirement. On the day of the accident, the Miss Majestic was not equipped with a bilge alarm. Hull Plugs. For ease of maintenance, the Miss Majestic had three 4-inch screw- type access plugs on the hull bottom: one plug was under the transmission, one was under the propeller transfer box, and one was under the main drive transfer casing. The vehicle had five 1-inch screw-type drain plugs, including a plug at the differential end of each of the forward and aft shaft housings, a plug on the hull centerline just forward of the front axle chase tunnel, and a plug in each of the pods aft of the aft wheel wells. All plugs were secured in place at the time of the accident. Postaccident Examination of the Vehicle Driveshaft Boots. Shortly after the Miss Majestic was salvaged from Lake Hamilton, Safety Board investigators found that the aft rubber boot had separated from the rear shaft housing. (See figure 6.) Upon attempting to replace the boot on the housing, investigators found that the hose clamp holding the rubber boot onto the aft shaft housing was sufficiently loose to enable them to turn the boot by hand. Investigators were able to reclamp the boot onto the housing by tightening the hose clamp screw with two to two and a half turns of a screwdriver. The hose clamp securing the boot on to the differential was tight. Figure 6. Postaccident view of the rear driveshaft boot.

Factual Information 16 Marine Accident Report Investigators found that the hinge pin assembly bracket at the forward end of the shaft housing had been removed. Hull. During the on-scene examination of the vehicle, Safety Board investigators visually examined the hull and found an irregularly shaped 14-inch-long by 6-inch-wide silicone rubber repair patch covering a corroded area above the right rear wheel leaf spring support. The hull area below the waterline, near the vehicle centerline, had a ½-inch by ¼- inch hole about 2 feet forward of where the propeller shaft entered the hull. The area around the hole was corroded. Investigators also found a pinhole in the right rear wheel well, about 1 foot from the rear end of the well. Higgins Pump. Safety Board investigators found that the key attaching the pump shaft to its drive chain sprocket was missing. The sprocket appeared old and had excess play on the pump shaft. Investigators noted that the play in the sprocket allowed the drive chain to rub against the hull frame; they also observed several abrasion marks on the frame. The pump impeller turned freely at the time of the examination. Investigators found that a 1 ½-inch portion of an impeller blade’s leading edge was sheared off. The intake strainer was found detached from the pump suction and lying on the vehicle’s bottom inside the hull. The overboard discharge pipe had separated from the hose connecting it to the pump discharge. The hose was rotted. The U-clamp that secured the discharge pipe to the chassis girder was missing. (See figure 7.) A description of the Safety Board’s laboratory examination of the Higgins pump and other components appears under the “Tests and Research” section. Electrical pumps. Investigators tested the three electrical pumps on scene. The Proline pump on the aft port side was inoperable; the other two pumps were operable. Waterway Information The accident occurred in Lake Hamilton, an 18.5-mile-long man-made lake located in the southwestern part of Arkansas, near the city of Hot Springs. The water depth was about 60 feet where the Miss Majestic sank, about 200 yards from shore. Lake Hamilton was created by the construction of the Carpenter Dam on the Ouachita River in 1932. After the dam was constructed, the created lake was regarded locally as a State waterway. In 1976, the Coast Guard assumed authority over the waterway. In 1982, Land and Lakes, the owner of the Miss Majestic and other DUKWs, successfully contested in Federal District Court the Coast Guard’s authority over the lake. In 1988, the U.S. Court of Appeals reversed the previous ruling stating that Lake Hamilton was a navigable waterway because it had been formed from a portion of the Ouachita River, which is a navigable river of the United States, and, therefore, was under the jurisdiction of the Coast Guard.

Factual Information 17 Marine Accident Report Operations Company Information The owner/president of Land and Lakes stated that he had operated DUKWs in Hot Springs for 40 years. He had operated under State regulations for the first 20 years and under Coast Guard regulations for the remaining time. Land and Lakes operated under the business title “White and Yellow Ducks.” Seven of the company’s 12 vehicles were licensed for passenger operations. Four of the seven were in service at the time of this accident. The company employed three operators who were assigned to specific DUKWs. Tours were scheduled to start at 0900, 1100, 1230, 1400, 1600, and 1800 (plus 2000 in summer), depending upon the availability of at least six passengers, and lasted about 90 minutes. The owner had no written instructions or operational policies for the operators and the mechanics. He stated that he believed frequent verbal instructions were sufficient for Figure 7. The discharge hose of the Higgins pump was broken and missing the U-clamp that connected the pump to a chassis girder of the vehicle.

Factual Information 18 Marine Accident Report the operators and mechanics to know what was expected of them. He said that he frequently asked the operators about the daily checks they made of their assigned vehicles. Further, he said he was frequently present when the DUKWs arrived at the office, at which time he would listen for noises that might indicate a mechanical problem. He also said that he often asked the operators whether they had heard any new sounds or noises from their DUKWs or whether they had experienced any problems. He stressed his opinion that it was important for each driver to be assigned to a specific DUKW because each one had its own characteristics and this knowledge aided the operators in recognizing any change in noise or operation of their DUKW. The owner stated that he relied on the Coast Guard inspectors to provide guidance regarding Coast Guard requirements and what he needed to do to be in compliance with Federal regulations. Vehicle Maintenance According to the senior mechanic, the daily maintenance practice was for the mechanics to visually inspect under the DUKWs’ hoods each morning for leaks, turn on the electric pumps and listen to them work, check the brakes, start the engines, and check the fluid levels. The company did not have a preventive maintenance program. With the exception of routine oil and seasonal antifreeze changes and periodic lubrication of joints, the maintenance mechanics made repairs only after problems, including leaky boots, were reported or discovered. The company also had no preventive maintenance schedule for the Higgins pump. The company had no written procedures for conducting vehicle maintenance or for testing or checking to verify the effectiveness of repairs, such as testing the boots while the vehicle was in the water. The senior mechanic stated that the band clamp attaching the rubber seal to the shaft housing could have been inadvertently installed in a cocked position because of the difficulty of working under the vehicle, and that a cocked clamp could have caused the boot to come loose. The senior mechanic said that he did not check the maintenance mechanic’s installation of the boot on the day of the accident. The senior mechanic stated that the company did not have a policy of keeping regular written maintenance or repair records or logs. He stated that the maintenance mechanic occasionally filled in maintenance logs on his own. The senior mechanic provided logs to Safety Board investigators for work performed on December 31, 1997, April 26, 1999, and May 1, 1999. No maintenance records for 1998 and for the period preceding April 26, 1999, were available. The senior mechanic stated that the records were stored in a file cabinet, but he was not aware of any follow-up process for reviewing or taking action on the maintenance records. He stated that driveshaft universal joints (U-joints) on all DUKWs were greased weekly; however, no records of the work were kept.

Factual Information 19 Marine Accident Report The maintenance log dated May 1, 1999, indicates only minor maintenance on the Miss Majestic. It states that the bilge pumps were working, boots were installed on the aft shaft housing, new caps were put on the U-joints, and the brakes were adjusted. The maintenance sheet for April 26, 1999, indicates that the U-joints were greased, the brakes were adjusted, and the bilge pumps were working; no other problems were noted. The maintenance record for December 31, 1997, which is unsigned, shows that more significant repairs were made, including installation of a new carburetor and fuel pump, replacement of alternator wiring, and repair of the cooling system, the bushing in the rudder shaft, and the front end bearing and seals. Although technical manuals that provide maintenance guidance for the DUKWs are still available from the Army, neither the company nor its mechanics had technical manuals or drawings providing information about the DUKWs’ special features. Some portions of the manuals, however, do not apply to passenger DUKWs because of the modifications made when they were converted to commercial service. The mechanics stated that they did not know the purpose of the hinge pin assembly (which had been removed earlier). The senior mechanic stated that the hinge assembly rattled and its presence made accessing the U-joints for greasing more difficult. Further, he had seen the hinge assembly removed from other DUKWs. He said that he did not know when the hinge assembly had been removed from the Miss Majestic. The senior mechanic stated that it was difficult to obtain replacement rubber boots as they were no longer manufactured.12 Land and Lakes generally used Army surplus rubber boots. He further stated that often these boots had clamp marks, indicating previous usage, and fine surface cracks. The senior mechanic stated that he performed major repairs and overhauls for engines, transmissions, and Higgins pumps at Land and Lakes; however, he was unable to provide maintenance records, repair dates, or receipts for major overhauls or repairs. He said that he represented the company during Coast Guard inspections. He usually performed repairs that the owner directed. The maintenance mechanic said he performed general maintenance work on DUKWs, including testing lights, checking fluid levels and pumps, repairing brakes, and replacing starters, alternators, U-joints, and worn or damaged boots. He said he also performed a weekly greasing of the U-joints in the driveshafts, a procedure that involved loosening the clamps on the boots and sliding the boots and housing back to gain access to the U-joints. He said he usually performed repairs and maintenance at the direction of the senior mechanic. His work was not checked or inspected by the senior mechanic. He had never repaired a Higgins pump. He said that the leaking forward rubber boot that he replaced before the accident had dry-rotted and cracked. While replacing it, he noticed that the aft boot was also torn, so he replaced that as well. He stated that, during his current and previous period of work 12 In discussions with other DUKW owners, Safety Board investigators determined that a few larger companies either make their own rubber boots or have them made.

Factual Information 20 Marine Accident Report with Land and Lakes, he had replaced numerous boots. He had found that most boot leaks and failures had resulted from dry rot and cracking from age. Meteorological Information The May 1, 1999, National Weather Service report issued for Hot Springs at 1150 stated that the weather was clear and sunny with a 25-mile visibility. The wind was southeasterly at 6 knots, and the air temperature was 72° F. Medical and Pathological Information Medical Findings The eight survivors advised EMS personnel that they had no physical injuries. Divers retrieved the bodies of the 13 fatality victims inside and outside of the sunken vehicle and transported them to the Garland County Coroner’s Office in Hot Springs on May 1 and 2. The results of the postmortem examination determined that the cause of death in each instance was fresh water drowning. The 13 victims, 7 female and 6 male, varied in age from 3 to 50. Three of the victims were minor children ages 3, 4, and 5. One adult victim was disabled. Toxicological Testing The operator provided a blood sample at 1550 on May 1, within 4 hours of the accident. The employer told the Safety Board that he did not realize that a urine sample also was required until he was so advised by the Coast Guard. He then contacted the operator about 2215 advising her that she had to provide a urine sample. She immediately reported for testing and provided a sample about midnight. The results of the urinalysis testing conducted pursuant to 46 CFR 4 (amphetamines, cocaine, marijuana, opiates, phencyclidine) were negative. The blood sample analysis was negative for ethyl alcohol and positive for Ibuprofen (< 5 m/ml) and the sedative Lidocaine. Although the concentration of Lidocaine was unspecified, the Safety Board’s medical officer determined from discussions with the forensic laboratory technicians conducting the test that the quantity was within the trace-to-therapeutic range and was not indicative of excessive use. The operator advised Safety Board investigators that she normally did not take sedatives, but did so that evening about 2030 in an attempt to calm herself after the accident.

Factual Information 21 Marine Accident Report Survival Aspects Emergency Response First Responders. The first responders to this accident were pleasure boaters who happened to be operating their boats in the area at the time of the accident. About 1200, a pleasure boater left a waterfront restaurant and boarded his boat. He stated that he was “idling along” and saw the Miss Majestic about 60 to 80 yards ahead of his boat. He watched the Miss Majestic as it turned and noticed that the vehicle’s stern appeared to be riding low in the water. He said that within 6 or 7 seconds, he saw the Miss Majestic stop and begin to sink by the stern. He did not see whether any of the occupants got off the vehicle before it sank. The boater immediately went to the area where the vehicle sank, where another boater joined him. They started throwing lifejackets into the water as people began surfacing and then pulled the people into their boats. The operators of other boats joined the first two responders and pulled people out of the water. One responder used a cellular telephone to call 911. Area Response Agencies. The 911 operator notified the Lake Hamilton Fire Department, which dispatched EMS personnel at 1158 to the accident site. In turn, the Garland County Sheriff’s Department (sheriff’s department) was notified of the accident at 1159, and immediately responded to the scene. The marine patrol supervisor from the sheriff’s department arrived on scene about 1204 and, after speaking with the first responders, radioed for ambulances and additional emergency responders to be dispatched to the accident site. St. Joseph’s Regional Health Center (St. Joseph’s) dispatched a Lifemobile ambulance, and the National Park Service dispatched its area EMS personnel. In addition, the Hot Springs Police Department and the Arkansas State Police responded to assist. About 1300, personnel from the Red Cross and a grief counselor were sent to the scene to provide comfort to the survivors. In the meantime, the marine patrol supervisor served as the incident commander overseeing the diving operations. A fireboat was sent to the scene for divers to use as a recovery platform. Divers reported that the average water depth was 57 feet and the maximum water depth was 60 feet in the search area. The water temperature was 68° F at the surface and 59° F at the lake bottom; visibility was no more than 2 feet. When divers located the DUWK, it was sitting in an upright position. The stern was in deeper water than the bow. The DUWK appeared to have rolled backward for several feet leaving tire track ruts behind. Over a 2-day period, divers from the Garland County Sheriff’s Department recovered the bodies of 13 victims. Seven bodies were found within the main passenger compartment, including five near the forward bulkhead. Three victims were still in their seats or on the deck; four victims were found floating in the canopy. The bodies of six

Factual Information 22 Marine Accident Report victims were found on the lake bottom 45 to 105 feet from the vehicle. The diving operations were completed at 1030 on May 2, 1999. Tests and Research JMS Flooding Calculations After the accident, the Safety Board contracted with JMS Naval Architects and Salvage Engineers (JMS) of Groton, Connecticut, to calculate the flooding rate of a DUKW in various scenarios. JMS calculated that a DUKW having the same number and placement of passengers as the Miss Majestic would sink in about 6 to 7 minutes after entering the water if the aft boot was loose and the Higgins pump was inoperative. The contractor was asked to explore the feasibility of making a DUKW capable of staying afloat when flooded by equipping the vehicle with bulkheads or flotation material. JMS determined that a DUKW carrying up to 28 passengers and an operator could be kept afloat when flooded if watertight bulkheads were added aft of the main engine at the firewall and aft of the rear wheel well and if buoyant foam were added between the fore and aft wheel wells along the sides of the vehicle. The Safety Board did not contract JMS to perform detailed engineering to implement the concept. Laboratory Examination Investigators sent several of the Miss Majestic’s parts that were involved in the accident to the Safety Board’s Materials Laboratory in Washington, D.C., for examination. The findings are summarized below. Electric Pumps. A test in the laboratory confirmed field test results that one of the Proline pumps at the vehicle stern functioned sporadically and shut down soon after starting. The other Proline pump and the Guardian pump functioned normally. Higgins Pump: The pump suction strainer is attached to the intake flange of the pump’s housing by a setscrew. The intake flange of the housing for mounting the suction strainer showed two sets of setscrew marks, about 90 degrees apart. Each set of marks contained multiple circular impressions from multiple contacts with the setscrew. The strainer body showed a brazed repair around the square headed setscrew. The filter element of the strainer was missing a triangular section with sides 2.5 inches by 4 inches. The pump’s driving sprocket is attached to the pump shaft by 2 screws: one that screws down on a key between the sprocket and shaft and another that screws down on the shaft. The socket screw heads were cracked or rounded from over tightening.

Factual Information 23 Marine Accident Report The pump shaft was not of uniform diameter along its length and had necked down in the area of the sprocket. Much of the surface of the shaft contained circumferential rubbing marks. The shaft surface also had impressions consistent with contact from a set screw. The driving sprocket was found to be installed with the sprocket hub facing toward the pump. The Army Maintenance Manual TM-9-803 shows that the sprocket should have been installed with its hub facing away from the pump. One side of the sprocket teeth was discolored compared to the other, suggesting that one side was kept clean by the chain due to misalignment of the sprocket. A section of an impeller blade was found missing, and the tips of the two remaining ones were damaged. The roots of the blades were cracked. The inside of the impeller housing showed discolored rub markings. Rubber Boots. The Safety Board also examined the rubber boots and observed that the rear boot that slipped off the housing had patches of dull green paint with a pattern of cracks. Multiple circumferential lines adjacent to the clamp suggest numerous installations of a hose clamp on this seal. The forward seal for the housing also showed imprints of numerous previous installations of a hose clamp. Other Information U.S. Coast Guard Inspection Policy According to senior Coast Guard officials, the local Officer in Charge, Marine Inspection (OCMI) reviews and approves the plans and design of DUKWs for conversion to passenger service. Subchapter T vessels typically receive local reviews as opposed to plan review by Coast Guard Headquarters. The approval of DUKWs is usually based on a 5-year history of successful service and compliance with Subchapter T regulations. The local OCMI’s review for initial certification involves the review of plans required to be submitted by regulations, inspections during the conversion process, and the final inspection of the hull and all systems before the vehicle is granted a COI. Under the Coast Guard inspection program, after an inspector determines that the vehicle passes an inspection for certification, it is issued an initial COI, which is valid for 3 years. For the two anniversary dates following the issuance of the COI, the vehicle was required to undergo annual reinspections. The COI would be reissued every third year, upon satisfactory completion of a subsequent inspection. This inspection for certification includes examining and testing the vehicle’s structure, machinery, and equipment, including lifesaving and firefighting equipment. The scope for inspection for certification is defined in 46 CFR 176.404, which states:

Factual Information 24 Marine Accident Report The owner or managing operator shall conduct all tests as required by the marine inspector….In addition, the OCMI may require the vessel to get underway as part of the inspection for certification. The inspection is conducted to determine if the vessel is in satisfactory condition, fit for the service intended, and complies with the applicable regulations in this subchapter. The scope of the reinspection is the same as the inspection for certification but in less detail unless a major change has occurred since the last inspection. According to Coast Guard officials, at the time of the Miss Majestic accident, about 63 DUKWs were under Coast Guard jurisdiction. The vehicles operated in 12 different marine inspection zones throughout the nation. Also at the time of the accident, the Coast Guard had not developed uniform nationwide DUKW inspection policies. Marine Safety Office (MSO) Memphis, Tennessee, which was the local Coast Guard office in charge of inspecting the Miss Majestic, had no written policy for DUKW inspections. However, MSO Chicago, Illinois, and MSO St Louis, Missouri, had independently developed inspection policies addressing different inspection issues that had arisen in their respective areas. These policies were not coordinated through Headquarters for dissemination to other MSOs. MSO Chicago had issued “DUKW Inspection Procedures,” dated April 14, 1998, for inspectors in its local inspection zone, while MSO St. Louis had issued Policy File Memo 1-89, Change 1 (2-91) on “Waivers/Equivalencies” for DUKW inspections, for inspectors in its local zone. These policies did not address inspecting the integrity of rubber boots and clamps or testing the bilge pumps with water. Coast Guard Inspections of the Miss Majestic The Safety Board reviewed the Coast Guard inspection records for the Miss Majestic for the past 6 years and interviewed the inspector who conducted the last annual inspection, which was on February 23, 1999. Table 3 summarizes the Coast Guard findings for the inspections conducted between March 23, 1994, and February 23, 1999. The inspector who examined and who determined the Miss Majestic’s fitness for duty on February 23, 1999, said that he inspected the bottom of the vehicle from the side, without getting under it. He stated he saw no deficiencies with the condition of the hull, boots, or clamps. He reminded Land and Lakes to install a high-level bilge alarm by March 11, 1999, and noted that the owner was making arrangements to obtain the alarm. The inspector later testified that, because he had been assured by the senior mechanic that the alarm would be installed by the March deadline, he did not follow up to ensure the installation had taken place. After the Miss Majestic was salvaged, Safety Board investigators found that the alarm had not been installed.

Factual Information 25 Marine Accident Report None of the inspections during the 6-year period were conducted in the water; all inspections were conducted at the owner’s garage. The operation of the Higgins pump was never tested with water13 during the 6 years. The Coast Guard policy required “operational checks” for bilge pumps. According to Coast Guard officials, this did not mean that pumps needed to be tested with water. The inspector who conducted the February 23, 1999, annual examination of the Miss Majestic said that he believed that checking a pump implied “just an overall visual” examination of the pump and turning the operating switch on and off. Table 3. Coast Guard inspections of the Miss Majestic for 1994 through 1999 Date Inspection Type Comments February 23, 1999 Annual Inspection book states, “Boarded vessel parked at the owner’s shop…The engine compartment, mid-body void, and the fuel tank compartment were entered and all areas of the hull interior and exterior were accessible and examined during this inspection. All drive shaft boots and clamps were found to be satisfactory…Visually examined the steering cable, main propulsion, bilge, ventilation, and electrical systems. Owner is in the process of installing the required high-level bilge alarms required by 11 Mar 99. Owner is also researching availability of flammable vapor detection system required by 11 Mar 99 iaw [in accordance with] CFR 182.480; issued CG-835 [‘Notice of Merchant Marine Inspection Requirements’]. “ March 5, 1998 Annual No deficiencies noted. Inspection records states, “The engine compartment, mid-body void, and the fuel tank compartment were entered, and all areas of the hull interior and exterior were accessible and examined during this inspection. All driveshaft boots and clamps were found to be satisfactory.” March 11, 1997 Recertification No deficiencies noted. The inspection record states that all driveshaft boots and clamps were in satisfactory condition, and that the inspector witnessed the satisfactory operation of the bilge pumps, the main propulsion, and the steering. March 13, 1996 Annual No deficiencies noted. March 15, 1995 Annual Inspection book states, “Repair the chain driven bilge pump and prove operation prior to carrying passengers, but not later than 15 April 1995,” and “replace all driveshaft tube rubber boots, all were checked and dry rotted.”

These deficiencies were subsequently rectified. March 23, 1994 Recertification No deficiencies noted 13 Participants at the Safety Board forum and other inspectors stated that testing a 250-gpm Higgins pump with water had practical difficulties. They indicated that a special testing arrangement would have to be developed.

Factual Information 26 Marine Accident Report Inspector’s Experience and Training The Coast Guard inspector who had last inspected the Miss Majestic before the accident had previously conducted a total of four inspections on two DUKWs about 5 years earlier, on his previous tour at MSO New Orleans. He had not received any special training in inspecting DUKWs, and was not aware of any Coast Guard inspection policies specific to DUKWs. He stated that he had talked to other inspectors to come up to speed on DUKWs. In addition, the OCMI and the supervisor of marine inspectors at MSO Memphis had never personally inspected a DUKW or were aware of any Coast Guard inspection policy specific to DUKWs. The inspector was a qualified marine inspector for small passenger vessels, barges and ships (hull and machinery), with 6 years of marine inspection experience. Postaccident Actions by the U.S. Coast Guard Following the Miss Majestic accident, on December 11, 2000, the Coast Guard issued NVIC No. 1-01, Inspection of Amphibious Passenger Carrying Vehicles, which had been developed in concert with the amphibious vehicle industry. The NVIC discusses lessons learned from the sinking of the Miss Majestic, which were the basis for the guidance for improving the safety of DUKWs in order to prevent similar accidents. The NVIC discusses DUKWs only, and does not describe other types of amphibious vehicles such as Stalwarts, Lighters, Amphibious Resupply, Cargo (LARCs), and Hydra-Terras. This document sets forth guidance for local Coast Guard authorities to follow for conducting a plan review and inspection and certification of DUKWs. The stated purpose of the NVIC is to: • Summarize and consolidate technical information pertaining to the design and inspection of amphibious DUKW vehicles; • Promote uniformity in the approach to certification requirements among various Coast Guard marine inspection offices; and • Consolidate best practices currently being used in the DUKW industry. Further, the NVIC states that certification of DUKWs should be through a systems approach that results in an equivalent level of safety to that of other conventional Subchapter T vessels. Equivalencies or operational controls would be considered where appropriate. Some examples of the inspection guidance contained in the NVIC are summarized below: • The external and internal hull should be inspected with special attention to areas that are vulnerable to corrosion. • The vehicle should be operated in the water and all through hull penetrations checked for watertightness.

Factual Information 27 Marine Accident Report • The condition and function of all bilge pumps and all other mechanical equipment should be operationally tested or simulated. • The shaft housing rubber boots, clamps, and housing brackets should be examined. • The drain plugs should be examined to verify proper fit and function. • High-level bilge alarms should be installed. • A vehicle’s regulatory history, including waivers and equivalencies, should be documented. • The OCMIs should ensure that marine inspectors have proper training regarding the operation and inspection of these vessels. Postaccident Actions by the Safety Board As a result of the Miss Majestic accident and recognizing that more than 1 million passengers are carried each year on board more than 250 amphibious passenger vehicles in the United States, the Safety Board conducted a public forum on amphibious passenger vehicle safety December 8–9, 1999, in Memphis, Tennessee. The forum brought together representatives of the Coast Guard, State governments, amphibious passenger vehicle operators and refurbishers, and the public to discuss safety issues relating to the design, regulation, maintenance, and operation of the vehicles. Forum participants considered the following issues: • Conversion from military to civilian amphibious passenger vehicles, • Passenger egress and survival, • Lifesaving equipment, • Design and stability, • Maintenance and inspection policies and certification, • Operational safety, and • Operator qualifications. At the forum, a JMS representative made a presentation on the flooding characteristics of DUKWs and stated that he estimated that the cost of installing the bulkheads and foam would be about $2,000 per DUKW plus about $10,000 for detailed engineering of the installations. Based on its investigation of the Miss Majestic accident and the information presented at the forum about the vulnerability of amphibious passenger vehicles to flooding and sinking, and recognizing that the regulatory process addressing the deficiencies is time-consuming, on February 18, 2000, the Safety Board issued the following safety recommendation to 30 operators and refurbishers of amphibious passenger vehicles in the United States:

Factual Information 28 Marine Accident Report M-00-5 Without delay, alter your amphibious passenger vessels to provide reserve buoyancy through passive means, such as watertight compartmentalization, built- in flotation, or equivalent measures, so that they will remain afloat and upright in the event of flooding, even when carrying a full complement of passengers and crew. To date, the Safety Board has received responses or information from 16 amphibious passenger vehicle companies. Most of the responses expressed the opinion that installing watertight bulkheads and flotation foam would be difficult and would require detailed engineering. Some of the responses detailed other actions that companies were taking such as installing flow restrictor plates, additional bilge pumps, and high water bilge alarms. Only three companies indicated that they were trying to install reserve buoyancy into their vehicles. A Missouri company, Ride the Ducks, stated that it was building a prototype aluminum DUKW that incorporated foam buoyancy into the design in accordance with the recommended action. A South Carolina company, Cool Stuff, advised the Safety Board that it had built a new type of amphibious vehicle called the Hydra-Terra, which was designed especially for commercial passenger service. The vehicle’s aluminum hull has foam-filled compartments that provide sufficient flotation certified by the manufacturer to remain afloat even with the drain plugs removed and the engine compartment flooded. The Coast Guard has approved the Hydra-Terra for the carriage of up to 49 passengers and a two-person crew. Several amphibious vehicle operators in Alaska, California, and Maine have purchased these vehicles and have placed them in commercial passenger operations. A company in Massachusetts, Boston Ducks, stated that it had retrofitted a single watertight bulkhead on one of its DUKWs on a trial basis; however, the company has not had a naval architect evaluate the effectiveness of the bulkhead. In its correspondence with these three safety recommendation recipients, the Safety Board stressed that Safety Recommendation M-00-5 did not limit companies to using foam or watertight bulkheads as the only means for achieving passive flotation; the recommendation states that other “equivalent measures” would be acceptable. The Safety Board stated that equivalent measures would include adding buoyancy chambers, known as sponsons, to the hull or installing inflatable buoyant bladders. Such inflatable bladders are used on skids of helicopters that operate over water. On March 23, 2001, Safety Board staff met with the operator of another Massachusetts amphibious passenger vehicle company, Moby Ducks, and his naval architect regarding Safety Recommendation M-00-5. During the meeting, the naval architect stated that the company’s LARCs vehicles did not have the requisite internal volume to add sufficient flotation foam so that the vehicles would remain afloat and upright in the event of flooding. Further, watertight bulkheads could not be installed in the

Factual Information 29 Marine Accident Report LARCs because their engineering systems relied on unobstructed airflow that would be compromised by the barriers. In a June 13, 2001, follow-up letter to Moby Ducks, the Safety Board stated that the underlying premise of asking for “stay afloat” measures was to ensure the survivability of the passengers and crew by preventing them from being trapped in the event of flooding, as occurred with the Miss Majestic. The Safety Board stated that the intent of the recommendation could be achieved by the owner having his naval architect attest that either the LARCs operated in water so shallow that they would not sink if they were holed or they were designed in such a way to prevent occupants from being trapped in the event of flooding. The Safety Board stated that the design arrangement could be achieved by the LARCs not having a canopy and by their having a seating arrangement that did not hinder emergency egress. In addition, to ensure passenger safety, the company would have to require that all passengers wear lifejackets. Based on information received, the Safety Board classified Safety Recommendation M-00-5 “Open—Acceptable Response” to five companies (Boston Ducks, Cape Cod Duck Mobile, Dells Duck Tours, Moby Duck Tours, and Ride the Ducks) and “Closed—No Longer Applicable” to two companies (Peter Pan Bus Tours and to White and Yellow Ducks) that are no longer in business. The Safety Board classified Safety Recommendation M-00-5 “Open— Unacceptable Response” to Original Wisconsin Ducks, which indicated that filling the hull with foam or installing a watertight bulkhead was not possible. The Safety Board received responses from five companies (Chicago Duck Corporation, D.C. Duck Tours, Just Ducky Tours, Metro Ducks, and Ride the Ducks- Seattle.14) The information provided, however, did not include how they planned to provide reserve buoyancy. Accordingly, the Safety Board classified Safety Recommendation M-00-5 “Open—Await Response” to the five companies. On August 17, 2000, the Safety Board sent a follow-up letter to the recipients who had not responded asking what action they had taken or were planning to take to implement the recommendation. At the time of this report, responses from Lowcountry Duck Tours and Plymouth Amphibious Tours are being reviewed. The recommendation is classified “Open—Response Received” to these two companies. Information was also received during the course of the investigation from Cool Stuff. As of the date of this report, 14 companies have not provided information to the Safety Board.15 14 Correspondence from Ride the Ducks-Seattle was received after the Safety Board mailed its August 17, 2000, follow-up letter. 15 The 14 companies that have not provided information to the Safety Board are Aqua Traks, Inc; Austin Ducks; Buffalo Point; Chattanooga Ducks; Chicago Duck Tours; Ducks Amphibious Renovation/Sales; Land and Sea Tours; Maui Duck Tours; Naples Land and Sea Tours; National Park Duck Tours; Outfitter Kauai; Ozark Mountain Ducks; Sterling Equipment; and South Padre Water Sports/Breakaway.

Factual Information 30 Marine Accident Report Other Amphibious Passenger Vehicle Accidents After the Miss Majestic accident, the Safety Board investigated two other amphibious passenger vehicle accidents, neither of which resulted in injuries to the passengers or crews. The complete marine accident brief reports are contained in appendix B. The Minnow. On September 18, 2000, the Minnow, a 21-foot-long Stalwart-type amphibious sightseeing vehicle, with 2 crewmembers and 17 passengers on board, was proceeding through the Milwaukee, Wisconsin, harbor when the operator heard a “mechanical noise” and felt the vehicle “shudder.” Shortly thereafter, the bilge alarm sounded. The operator turned back to shore; however, the vehicle’s engine stopped, flooded and the operator had to radio for assistance. The marine police and Coast Guard personnel responded and safely transferred all of the Minnow’s passengers to their vessels. The Minnow then sank in 25 feet of water. The investigators observed that the blade of the port waterjet impeller had cut through the waterjet tunnel housing the impeller, leaving a 1/8-inch-wide circumferential gap through which water from the port waterjet tunnel could enter the amphibious vehicle. Investigators sent components of the vehicle to the Safety Board materials laboratory for examination. The Safety Board’s laboratory determined that the port propulsion unit failed because its aft shaft bearing failed from inadequate lubrication. Severe corrosion on the shaft bearing retaining nut indicated that the integrity of the bearing and oil cavity had been compromised for a significant period before the accident, allowing water to enter the oil chamber, corrode the nut, and degrade the lubricating oil. The laboratory determined that severe degradation of the bearing had occurred for a long time before the accident voyage, during which the bearing finally broke up. The DUKW No. 1. On December 8, 2001, DUKW No. 1, a 33-foot-long amphibious sightseeing vehicle, with an operator and 11 passengers on board, began flooding when it entered the water for a tour of Lake Union in Seattle, Washington. About 5 minutes into the tour, the bilge alarm sounded and the Higgins pump began discharging water, whereupon the operator immediately headed for shore. After the DUKW’s wheels touched ground, a passing boat transferred all passengers ashore without injury. Later, the DUKW sank when the Harbor Patrol attempted to tow it across the lake. After the vessel was salvaged, investigators determined that a 4 ½-inch access plug was missing from its hull, which had allowed water to flood the hull. The Safety Board calculated the flooding rate through the opening at about 330 gpm, which exceeds the maximum capacity of a Higgins pump. DUKW No. 1 had features recommended in NVIC 1-01, including a restrictor plate installed over the driveshaft hull penetration, double-clamped boot assemblies, bilge alarms, and an intact hinge pin assembly. In addition, the company’s operator and maintenance personnel used a maintenance checklist as recommended in the NVIC.

31 Marine Accident Report Analysis General This analysis first identifies factors that can be readily eliminated as causal or contributory to the accident and determines why the Miss Majestic sank. The report then discusses the following major safety issues, which were identified during the investigation: • Vehicle maintenance, • Coast Guard inspections of the Miss Majestic, • Coast Guard inspection guidance, • Reserve buoyancy, and • Survivability. The analysis also considers the actions of the Miss Majestic’s operator in this accident. Exclusions The weather was clear and mild on the day of the accident. Toxicological testing of the operator was negative for alcohol and showed no evidence of illicit drug use. The 72- hour history provided by the operator revealed that she had maintained a fairly regular schedule and had obtained ample nighttime sleep. Moreover, her work schedule allowed her time to rest before her tours. The amount of sleep and rest that she received, together with the short length of the DUKW tours and the limited demands of her work, suggest that fatigue was not a factor in the operator’s performance. Therefore, the Safety Board concludes that the weather, drug and alcohol use, and operator fatigue were not factors in the sinking of the Miss Majestic. The maintenance mechanic’s potential involvement in the accident was not identified until after the Safety Board investigators examined the Miss Majestic. Accordingly, no toxicological test was requested or available on this individual. According to his supervisor, he did not exhibit any behavior that might suggest he was impaired. Based on the maintenance mechanic’s testimony, he had a comparatively light work and rest schedule and did not deviate from his normal routine before the accident occurred. However, because drug and alcohol testing of the maintenance mechanic was not conducted and because a complete 72-hour history of his activities and sleep could not be reconstructed, the effect of these factors on his performance cannot be determined.

Analysis 32 Marine Accident Report The Sinking When the vehicle was salvaged from the water and examined, Safety Board investigators found that the hull was wasted through in some areas, but the holes were not large enough to allow the massive flooding experienced by the Miss Majestic. The leakage through these holes would have been relatively light. Detailed examination of the vehicle’s hull and plugs did not reveal a structural failure through which massive flooding could have occurred. However, the aft boot, which was supposed to maintain the watertight integrity of the driveshaft housing, had separated from the housing at one end. An annular opening existed between the 3-inch-diameter driveshaft and the 4 7/8-inch housing around it. With the boot off its housing, water could freely enter the vehicle’s hull through this annular opening. When investigators fit the rubber boot back on the housing, they found that the clamp used to attach the boot to the housing was loose. Upon further examination, investigators found that the hose clamp setscrew needed an additional 2 ½ turns to tighten the clamp so that the boot would be securely attached to the housing. On the morning of the accident, the maintenance mechanic replaced the aft boot because the original boot had a tear and was leaking water into the vehicle. After replacing the boot, he reattached the clamps. The senior mechanic testified that, although replacing boots was not a complex task, it was possible to install a clamp improperly because working in the cramped conditions underneath the DUKW was difficult. No one checked the maintenance mechanic’s work, and no checks were conducted with the vehicle in the water after the repairs were completed. Thus, on the day of the accident, movements or vibrations of the Miss Majestic after it left the repair shop, such as the drive to the lake or the downward movement of the vehicle’s rear axle and wheels as the DUKW entered the water from the ramp, could have caused the unsecured rubber boot to slip off its housing. The Safety Board, therefore, concludes that water initially entered the Miss Majestic through the gap between the driveshaft and its housing because the securing clamp for the watertight rubber boot had not been adequately secured by the maintenance mechanic. As the Miss Majestic entered Lake Hamilton, water began to enter the vehicle and progressed throughout its underdeck. The DUKW had no bulkheads to contain the water within an interior division or other means of restricting the amount of water flooding the vehicle. The Miss Majestic trimmed by the stern with a small aft freeboard of 8 to 12 inches; thus, the floodwater accumulated at the stern. The DUKW had no built-in flotation or other reserve buoyancy to counter the flooding. The Higgins pump, which was the primary dewatering pump, and one of the electric bilge pumps were inoperable. Although the other two electric pumps were operating, their combined pumping capacity was considerably less than the capacity of the Higgins pump. Thus, there was no active means of eliminating the water build-up nor bilge alarm or Higgins pump discharge to alert the operator to the vehicle’s condition. The vehicle, therefore, sank deeper by the stern. The Safety Board made calculations to simulate the time for the Miss Majestic to sink and estimated that the rate of water inflow through the annular opening between the

Analysis 33 Marine Accident Report 3-inch driveshaft and the 4 7/8-inch housing was at least 170 gpm. At this rate of ingress, the stern deck would have been awash within about 7 minutes. Once the stern slipped below the surface of the lake, water poured into the passenger compartment and swamped the vehicle, causing it to sink. To verify the accuracy of its estimates, the Safety Board contracted with JMS, a recognized naval architectural firm, to perform detailed calculations. JMS confirmed that a vehicle such as the Miss Majestic carrying 20 passengers would sink from uncontrolled flooding in as little as 6.4 minutes after water started entering the vehicle. These estimates reasonably agree with the operator’s estimate of about 7 minutes between the time the vehicle entered the lake and water began to swamp it. The Safety Board, therefore, concludes that the Miss Majestic sank because the DUKW had no watertight bulkheads and no reserve buoyancy and because its Higgins pump, which had been designed for significant dewatering capacity, did not operate. Vehicle Maintenance The number and nature of deficiencies found during the on-scene investigation and the laboratory examination prompted Safety Board investigators to take a close look at the maintenance and repair policies and procedures used by Land and Lakes. The Safety Board’s laboratory examination of the rubber boots from the Miss Majestic’s shaft housing revealed cracks that indicated the boots were old. The boots had been installed immediately before the accident. The Land and Lakes senior mechanic confirmed that, because obtaining new boots was difficult, the company normally used Army surplus stock, which showed signs of previous use. Portions of the underwater hull, near the rear axle, were severely corroded in easily visible locations. A ½-inch by ¼-inch hole had wasted through the hull below the waterline near the vehicle’s centerline about 2 feet forward of the point where the propeller shaft entered the hull. The area around the hole appeared weak when tested with a mallet16 and was corroded. A pinhole was noted (daylight shining through) in the right rear wheel well. Of even greater concern was an approximately 14-inch-long silicone rubber repair patch that was used to seal a corroded area in the starboard hull. When investigators removed the patch, it exposed a severely corroded area of hull plating. The use of silicone rubber patches on a steel hull is not an acceptable method of making permanent repairs to steel plating and would likely exacerbate corrosion and jeopardize hull integrity. Corrosion of a steel hull in fresh water is a long-term degradation process. The degree of wastage on the Miss Majestic indicated that these conditions had existed for a long time. 16 Striking a steel hull with a hammer is a standard testing procedure used by Coast Guard inspectors to determine the integrity of the area.

Analysis 34 Marine Accident Report Not only was the vehicle’s hull in poor condition, but the vehicle’s equipment was as well. A review of the undercarriage determined that an essential hinge pin assembly was missing. Without the hinge pin assembly, the housing’s rubber boots would carry higher stresses than intended, making them more vulnerable to failure. The Safety Board’s examination of the bilge pumps on board the Miss Majestic showed multiple deficiencies. One of the Proline bilge pumps was practically inoperative, operating sporadically for only about 20 seconds before shutting off. The Higgins dewatering pump had so many deficiencies that it was inoperative. The discharge hose was broken and rotted, the strainer had a large hole and was detached, rendering it useless, and one of the pump’s impeller blades was badly damaged. Further, the driving sprocket was loose and had been installed backwards; the key attaching the sprocket to the shaft was missing. A setscrew had been used to attach the sprocket to the pump shaft. Without a key, however, the sprocket could rotate freely on the pump shaft. The pump’s impeller was missing a bolt, which was never found, indicating that it probably had fallen out some time before this accident. After observing the poor condition of the Miss Majestic’s hull and equipment, the Safety Board endeavored to determine the depth of understanding that the company and its mechanics possessed concerning DUKWs. When investigators sought to review the maintenance records for the Miss Majestic, they discovered that the company did not routinely maintain such records. Investigators further discovered that the mechanics did not have the technical manuals and drawings needed to understand the safety purpose of special features of DUKWs, such as hinge pin assemblies, and to properly conduct maintenance and repair. An effective preventative maintenance program should establish and implement, among other things, procedures and schedules for planned maintenance; daily, weekly, and annual inspections; postrepair testing and verification, retention of maintenance and repair records; tracking of maintenance and repair trends; and verification that maintenance and repairs were promptly and effectively conducted. However Land and Lakes did not have an effective preventive maintenance program and did not routinely keep maintenance records. According to the mechanics, the company only conducted repairs after breakdowns or when leaks developed. After examining the condition of the Miss Majestic and reviewing the company’s maintenance practices, the Safety Board is convinced that the threat to passenger safety had existed for a long time. The problems described above could only have manifested themselves after a long period of inadequate maintenance and repair. Had the rubber boot not failed, it was only a matter of time before one of the aforementioned problems probably would have manifested itself. Therefore, the Safety Board concludes that Land and Lakes long-term vehicle maintenance was inadequate and directly compromised the safety of the Miss Majestic and its passengers. Since this accident, Land and Lakes has gone out of business. Thus, the remedial action on the part of the company is no longer possible.

Analysis 35 Marine Accident Report Coast Guard Inspections of the Miss Majestic After reviewing the Coast Guard inspection records for the Miss Majestic, examining the physical condition of the vehicle, and interviewing the inspector who last examined the vehicle, the Safety Board found deficiencies with the Coast Guard inspections. The Coast Guard inspector who conducted the last examination of the Miss Majestic, which was on February 23, 1999, said that he inspected the bottom of the Miss Majestic by looking underneath the vehicle from its side. He did not get under the vehicle. The Coast Guard inspector noted that the Miss Majestic did not have a high-level bilge alarm. He later testified that he advised Land and Lakes’ senior mechanic of the regulatory requirement for existing T-boats to be equipped with high-level bilge alarms no later than March 11, 1999. The inspector said that because the senior mechanic assured him that the alarm would be installed by the March 11, 1999, deadline, he did not follow up to ensure the installation had taken place. After the Miss Majestic was salvaged, Safety Board investigators found that the alarm had not been installed. Had the Miss Majestic been equipped with a high-level bilge alarm, the operator might have had positive early warning that the vehicle was flooding. As it was, the operator remained unaware of the flooding until it was too late for her to do anything about it. Because she was not aware of the emergency until the very end, the operator could not inform passengers that an emergency had developed and that they should don lifejackets and prepare to abandon the vehicle. Survivors stated that the lifejackets on board the Miss Majestic were packed so tightly into their stowage area beneath the canopy that the operator could not even pull one out for demonstration. The Coast Guard inspection record for the Miss Majestic does not indicate any problems related to the stowage of lifejackets. The Land and Lakes owner testified that, for each Coast Guard inspection, company personnel laid out the lifejackets on the garage floor for examination. This procedure might enable the inspector to examine each lifejacket for compliance, but it does not reveal problems with stowage. An effective inspection should include looking not only at the lifejackets, but also their stowage arrangements. The Safety Board determined that the last inspector’s lack of attention to detail was not unique to him. None of the inspectors had noted any deficiencies regarding the hull plating of the Miss Majestic since 1994. Safety Board investigators found pinholes in the hull resulting from severe corrosion and a repair using a rubber patch to conceal a large wasted area of the hull. Hull corrosion is a slow process, especially in fresh water where the Miss Majestic operated. The hull, therefore, probably had been corroding for several years. Although the corrosion was easy to see, none of the inspection records indicate that the Coast Guard inspectors had either noted any difficulties with or required any repairs to be made to the corroded areas. The identification of such obvious areas of corrosion, improper patching, and degradation of hull integrity is rudimentary to Coast Guard inspections of all steel vehicles and vessels. In the case of the Miss Majestic and other

Analysis 36 Marine Accident Report DUKWs, the hull plating is so thin that it is susceptible to quicker holing through wastage and harder to repair. The Safety Board found that none of the inspections during the last 6 years had been conducted in the water. Coast Guard regulations do not require that inspections be conducted in the water; however, examining the vehicle while it is in the water can identify safety problems, especially those related to the watertight integrity of the hull, that inspections on land do not necessarily reveal. Coast Guard regulation 46 CFR 182.520 requires that small passenger vessels like the Miss Majestic carry one fixed bilge pump with a capacity of 10 gallons per minute and a portable hand pump with a capacity of 5 gallons per minute. The Miss Majestic also had a dewatering pump known as the Higgins pump, which was not required by regulation. According to the March 15, 1995, Coast Guard inspection records, the inspector identified deficiencies affecting its operation. The operation of the bilge pumps had not been tested with water. The Coast Guard policy required “operational checks” for bilge pumps. At the Safety Board’s forum in December 1999, a representative from the Coast Guard’s Inspection Division said that he interpreted this to mean that bilge pumps need not be tested with water. The inspector who last examined the Miss Majestic said that he believed that testing of pumps implied visually checking the pump and turning the operating switch on and off. Although the pumps passed inspections, the Safety Board’s on-scene and laboratory analysis found that one of the Proline pumps was practically inoperative and the Higgins pump and its discharge piping showed evidence of longstanding poor maintenance. The Safety Board concludes that the Coast Guard’s inspections of the vehicle were inadequate and cursory. Coast Guard Inspection Guidance A number of different Coast Guard inspectors conducted inadequate inspections of the Miss Majestic over several years. While these inspectors should have been able to identify corrosion of the hull and problems with bilge pumps and lifejacket stowage, some safety deficiencies relate to the unique features of the vehicle that require specialized guidance for inspectors to understand and detect the problems. Although Coast Guard regulations place DUKWs in the same category as conventional small passenger vessels, DUKWs are uniquely designed and pose safety concerns that are different from those of conventional vessels. The Safety Board finds it significant that the Coast Guard’s report of the Miss Majestic sinking concluded, and the Coast Guard Commandant concurred with, the following: DUKWs have features which [sic] make them inherently less safe than conventional commercial passenger vessels.

Analysis 37 Marine Accident Report In support of this conclusion, the Coast Guard report cited the following features, among other items: • Heavy metal chassis and heavy wheel drive systems, with minimal buoyancy; • Multiple external appendages with moving parts that are part of the watertight envelope; • Use of a single band clamp on the smooth sealing surface of shaft housings; • Thin hull plating, susceptible to quicker holing through wastage and harder to repair; and • Manufactured parts not readily available, largely due to the 54-years lapse in DUKW production. The Safety Board agrees with the Coast Guard that these features make DUKWs inherently less safe than conventional commercial small passenger vessels, not only for the reasons cited in the Coast Guard report. In addition, DUKWs have hull penetrations for driveshafts that are made watertight by rubber boots and clamps, which are unconventional sealing methods by standards for traditional small passenger vessels. These boots require special attention for safety oversight. Similarly, the DUKW relies on a high capacity Higgins pump in the event the vehicle is flooded, which in turn requires that the pump be carefully maintained and inspected. However, neither the Subchapter T regulations nor other Coast Guard guidance documents for Coast Guard field inspectors mention how to inspect these vital items. Before the Miss Majestic accident, the Coast Guard had not developed any nationwide guidance to field inspectors for inspecting DUKWs; the Marine Safety Manual only addressed radiator cooling of DUKW engines. Although a few Coast Guard MSOs had independently developed local policies for their inspectors, these policies did not address or emphasize several critical areas, such as inspecting the integrity of seals, clamps, or the need for operational testing of dewatering and bilge pumps. The local policies addressed different inspection issues that had arisen in each MSO. These policies were not disseminated to other MSOs. DUKWs are old vehicles that have been certificated for service by various local Coast Guard officials over the years through waivers and equivalencies to Subchapter T regulations. The waivers and rulings of equivalencies were not granted based on uniform national criteria for DUKWs, but on various opinions and experiences of individual local officials. The supporting rationale for the waivers and equivalencies were not documented at MSO Memphis, the Coast Guard office with jurisdiction over the Miss Majestic, and were not available to individual inspectors. Consequently, inspectors assumed that any discrepancies from Subchapter T regulations, for example seat spacing and aisle widths, had been previously accepted and they did not need to revisit those issues. An inspection guidance document, coordinated and disseminated by Coast Guard Headquarters, would have made plan review for DUKWs consistent among MSOs and would have clarified the scope of work to field inspectors.

Analysis 38 Marine Accident Report Coast Guard inspection guidance for DUKWs would have been especially useful to the inspector who last examined the Miss Majestic because his experience with inspecting DUKWs was limited. He had received no special training in inspecting these vehicles. He had only inspected two DUKWs about 5 years earlier during his previous tour at MSO New Orleans. He told Safety Board investigators that he was unaware of any Coast Guard inspection policies or procedures for DUKWs. He stated that he had only talked to other inspectors to come up to speed on DUKWs. Neither the OCMI nor the supervisor of inspectors at MSO Memphis had ever inspected a DUKW or were aware of any Coast Guard inspection procedures for DUKWs. The Safety Board concludes that the lack of Coast Guard guidance and training for the inspection of DUKWs contributed to the inadequate inspections of the Miss Majestic. While investigating the Minnow accident, the Safety Board found that, as in the case with the principals in the Miss Majestic accident, the operators, refurbishers, and inspectors had an inadequate understanding of the risks posed by amphibious passenger vehicles. Following the Miss Majestic accident, the Coast Guard issued NVIC 1-01, which is titled Inspection of Amphibious Passenger Carrying Vehicles, to provide its inspectors and industry with necessary background information and guidance about DUKWs. In reviewing the NVIC, the Safety Board found that it does not address the inspection issues of other types of amphibious passenger vehicles such as Stalwarts. Thus, guidance and background information relating to maintenance, inspection, and operation of Stalwarts is not readily available for use by owners, operators, refurbishers, and inspectors. The Safety Board concludes that industry and Coast Guard inspectors need to become familiar with the unique safety issues and general background for all types of amphibious vehicles, including Stalwarts, to improve the maintenance, inspection, and operation of specialized amphibious vehicles. The Safety Board, therefore, believes that the Coast Guard should develop and promulgate guidance for all amphibious passenger vehicles similar in purpose to the NVIC 1-01. Reserve Buoyancy After its on-scene investigation of the Miss Majestic accident, the Safety Board researched the available accident history of amphibious passenger vehicles. Coast Guard data show that between March 6, 1991, and May 1, 1999, at least 18 amphibious passenger vehicles had been involved in accidents, and that six of the accidents had resulted in some degree of flooding. As a result, the Safety Board decided to hold a public forum in December 1999 on amphibious passenger vehicle safety to bring together the Coast Guard, the amphibious passenger vehicle industry, and technical experts to discuss amphibious passenger vehicle safety.

Analysis 39 Marine Accident Report As the Safety Board opened its forum, the Coast Guard issued its final report on the sinking of the Miss Majestic, which concludes, in part: Had the Miss Majestic been fitted with watertight compartmentation or flotation materials, the vehicle would not have sunk or would have sunk so slowly that passengers would have had ample time to escape the vehicle. During the Safety Board forum, participants considered the following issues: • Conversion of amphibious vehicles from military to civilian use, • Passenger egress and survival, • Lifesaving equipment, • Vehicle design and stability, • Maintenance and inspection policies and certification, • Operational safety, and • Amphibious vehicle operator qualifications. The forum produced important insights into the operation of such vehicles, safety issues unique to them, passenger accommodations design, and industry practices. One major outcome of the forum was the realization by participants that amphibious vehicles pose unique and unresolved safety risks to the public, but that the vehicles could be made safe by installing safety features that would prevent them from sinking when flooded. JMS, the naval architect contracted by the Safety Board, evaluated whether retrofitting DUKWs with foam and bulkheads would provide adequate reserve buoyancy to keep a DUKW afloat when it was flooded and fully loaded with passengers. JMS found such retrofitting to be feasible. On February 18, 2000, the Safety Board issued an advance safety recommendation (M-00-5) calling for amphibious passenger vehicles to be altered to provide reserve buoyancy through passive means so that they would remain afloat and upright in the event of flooding, even when carrying a full complement of passengers and crew. In support of this recommendation, the Safety Board stated that a passive safety system is more reliable than active systems because it requires no deliberate action or operation to deploy and generally facilitates fail-safe performance of the vehicle. For example, a DUKW is equipped with a Higgins pump that is powered by the DUKW’s propeller shaft. Reliable operation of the pump cannot be assured because so many factors affect its proper performance, including, but not limited to, the operating condition of the pump, the operating condition of the main engine, and the vehicle operator’s continuous depression of the gas pedal, which keeps the propeller shaft turning and the pump operating. Any shortcomings in maintenance of either the pump or the main engine, failure to identify a problem, use of poor repair techniques, or other causes can render the active system useless in an emergency. In addition, realistically, operators cannot be

Analysis 40 Marine Accident Report expected to remain seated and depressing the gas pedal during an emergency, when they probably would have to move to instruct or assist passengers. In contrast, a passive safety system requires no deliberate action or operation to deploy and generally facilitates fail-safe performance of the vehicle. Some examples of passive safety systems that can prevent a vehicle from sinking include compartmentalization with watertight bulkheads, installation of buoyant material inside the hull, and incorporation of buoyant sponsons exterior to the hull. Only the inherent reliability and fail-safe nature of a passive safety system can ensure the level of dependability essential to safeguarding the lives of passengers. The Safety Board was pleased that the Coast Guard, in its final report on the sinking of the Miss Majestic, agreed with the Safety Board’s position on the need for adequate reserve buoyancy. With summer coming and the likelihood of a large number of passengers being put at risk, the Safety Board issued Safety Recommendation M-00-5 asking that amphibious passenger vehicle operators and refurbishers take voluntary action to ensure that their vehicles remain afloat and upright in the event of flooding by altering them to provide reserve buoyancy through passive means such as built-in flotation, watertight compartmentalization, or equivalent measures. In the interim, the Coast Guard initiated action to address some of the safety deficiencies identified at the Safety Board’s amphibious passenger vehicle forum and in the Coast Guard’s own investigation of the Miss Majestic accident. The Coast Guard met for 2 days in February 2000 with representatives of the amphibious passenger vehicle industry to develop comprehensive guidelines containing best practices on the inspection and operation of these vehicles. In December 2000, when the Coast Guard issued NVIC No. 1-01, agency officials stated that the NVIC was developed using the information gleaned from this meeting. The NVIC contains 40 pages of information and guidance on such items as unique design features, inspection and certification, construction and arrangement, intact stability and seaworthiness, watertight integrity, lifesaving equipment and arrangements, and fire protection equipment. The NVIC contains a short history segment, numerous pictures, diagrams, and charts. The circular also provides inspectors with a list of 19 modifications that might have been made to a DUKW when it was converted to passenger service. Further, the NVIC offers sample calculations for flooding, as well as expected scantlings. In the Safety Board’s opinion, the document is very well done as far as it goes; however, it does not adequately address passenger egress and survivability. For further discussion, see the analysis section entitled “Survivability.” The response to Safety Recommendation M-00-5 by the amphibious passenger vehicle industry has been disappointing. The Safety Board sent the recommendation to 30 different amphibious passenger vehicle companies and received responses or information from only 16. Most of the responses expressed the opinion that installing watertight bulkheads and flotation foam would be difficult and would require detailed engineering. Some of the responses detailed other actions that companies were taking such as installing flow restrictor plates, additional bilge pumps, and high water bilge alarms. Only three

Analysis 41 Marine Accident Report companies indicated that they had done or were doing anything to provide reserve buoyancy to their vehicles as requested in the safety recommendation. Cool Stuff advised the Safety Board that it had built a new type of amphibious vehicle called the Hydra-Terra, which is designed especially for commercial passenger service. The vehicle’s aluminum hull has foam-filled compartments that provide sufficient flotation certified by the manufacturer to remain afloat even with the drain plugs removed and the engine compartment flooded. The Coast Guard has approved the Hydra-Terra for the carriage of up to 49 passengers and a 2-person crew. Several amphibious vehicle operators in Alaska, California, and Maine have purchased these vehicles and have placed them in commercial passenger operation. The Safety Board is please that the Hydra-Terra shows that it is practical and feasible to design an amphibious passenger vehicle to meet the Safety Board’s reserve buoyancy criterion. Accordingly, Safety Recommendation M- 00-5 is classified “Closed—Acceptable Action” for Cool Stuff. Ride the Ducks, a Missouri company, stated that it was building a prototype aluminum DUKW that incorporates foam buoyancy into the design. Once completed, this prototype is expected to meet the reserve buoyancy criterion specified in recommendation M-00-5, but it will not affect the other amphibious passenger vehicles in service nationwide that do not meet the criterion. Boston Ducks, a Massachusetts company, stated that it had retrofitted a single watertight bulkhead on one of its DUKWs on a trial basis; however, the company has not had a naval architect evaluate the effectiveness of the bulkhead. Thus, with the exception of the Hydra-Terra, the Safety Board is not aware of any other production model amphibious passenger vehicles that currently meet the intent of Safety Recommendation M-00-5 or any effective retrofit to improve the reserve buoyancy of existing DUKWs. The Safety Board notes that 14 companies have never responded to the Board’s February 18, 2000, initial letter or the August 17, 2000, follow-up letter. Based on the lack of information provided, the Safety Board classifies Safety Recommendation M-00-5 “Open—Unacceptable Response” to the following: Aqua Traks, Inc.; Austin Ducks; Buffalo Point; Chattanooga Ducks; Chicago Duck Tours; Ducks Amphibious Renovation/Sales; Land and Sea Tours; Maui Duck Tours; Naples Land and Sea Tours; National Park Duck Tours; Outfitter Kauai; Ozark Mountain Ducks; Sterling Equipment; and South Padre Water Sports/Breakaway. In its correspondence with the safety recommendation recipients, the Board stressed that Safety Recommendation M-00-5 did not limit companies to using foam or watertight bulkheads as the only means for achieving passive flotation; the recommendation stated that other “equivalent measures” would be acceptable. Equivalent measures would include, but not be limited to, adding buoyancy chambers, known as sponsons, to the hull or installing inflatable buoyant bladders. Such inflatable bladders are used on skids of helicopters that operate over water.

Analysis 42 Marine Accident Report Because NVIC 1-01 is only an advisory document, it is not certain whether all amphibious passenger vehicle operators have incorporated the circular’s advice into their vehicles or vehicle operations. Furthermore, the OCMIs and inspectors need additional training to interpret the NVIC, and because OCMIs rotate, the continuity in its application is not assured. Safety Recommendation M-00-5 was under consideration by the industry when the Safety Board learned of another amphibious passenger vehicle accident. On September 18, 2000, the Minnow, a 21-foot Stalwart-type amphibious sightseeing vehicle, with 2 crewmembers and 17 passengers on board, was proceeding through the Milwaukee, Wisconsin, harbor, when the bilge alarm sounded. The vehicle operator turned back to shore; however, the vehicle’s engine stopped when water entered the engine compartment. Fortunately, the accident occurred within sight of Coast Guard personnel and the Marine Police, who both dispatched boats to the scene and transferred all Minnow passengers to their vessels. All passengers were taken ashore; no injuries resulted from this accident. About 30 minutes after the flooding started, the Minnow sank in 25 feet of water. Postaccident examination showed that the bearings for the port waterjet impeller had failed, causing the impeller blades to cut a 1/8-inch gap in the waterjet tunnel housing through which water entered the vehicle. This was another means of water ingress that had not been previously identified, and it prompted the Safety Board to include information on this accident when writing to recommendation recipients. NVIC 1-01 had been in effect for a year when, on December 8, 2001, DUKW No. 1, with an operator and 11 passengers on board, began flooding during a tour of Lake Union in Seattle. When the bilge alarm sounded repeatedly and the vehicle’s Higgins pump began discharging water, the operator headed for shore. After the DUKW’s wheels touched ground, a passing boat transferred all passengers ashore without injury. The local harbor patrol, not knowing that the problem was the result of a missing 4 ½ inch-diameter access plug, attempted to tow the DUKW No. 1 back across the lake. The harbor patrol asked the operator to turn off the engine and to leave the DUKW. Because the engine was not operating and, in turn, the Higgins pump was not operating to dewater the vehicle, the DUKW sank when water continued to flood the hull through the access plug opening. The Safety Board calculated that the flooding rate through the opening was about 330 gpm (a greater rate than a failed rubber boot), which exceeds the maximum dewatering capacity of a Higgins pump. Therefore, the vessel might have sunk even if the Higgins pump had been operating. The Safety Board investigated the sinking of the DUKW No. 1 and determined that the vehicle owner had made improvements suggested in the Coast Guard’s NVIC, including installing a restrictor plate over the driveshaft hull penetration, double-clamped boot assemblies, bilge alarms, and hinge pin assembly. The vehicle also had a structurally sound hull and a working Higgins pump. Despite these attributes, the DUKW No. 1 sank because of a simple human error that occurred during routine maintenance. For a DUKW hull to have watertight integrity, perfect maintenance and operation is essential. In the case of the DUKW No. 1, company procedures required that, before a tour is conducted, both the mechanic and the operator sign the daily maintenance checklist attesting that they have

Analysis 43 Marine Accident Report checked 55 items, including engine fluid levels, tires, brakes, driveshaft rubber boots and clamps, and hull plugs. On the day of the accident, however, because the operator was in a hurry to pick up waiting passengers, he did not take the time to examine all the items listed on the safety checksheet; however, he told Safety Board investigators that he thought the maintenance access plug had been in place. A review of the daily maintenance checklist for DUKW No. 1 shows not only that all items were checked, but also that both the operator and the mechanic had attested that the items had been checked. Therefore, a checksheet is no guarantee that necessary maintenance will be performed. If the DUKW No. 1 had been provided with sufficient reserve buoyancy through passive means, the vehicle would not have sunk regardless of whether the plug had been replaced. Consequently, the Safety Board concludes that flooding from failed boots, open hull plugs, hull damage, collisions, groundings, mechanical failures, improperly preformed maintenance, and other scenarios continue to present serious risks of rapid flooding and sinking in amphibious vehicles lacking reserve buoyancy. While three amphibious vehicle owners have attempted to comply with the intent of Safety Recommendation M-00-5, most amphibious passenger vehicle operators have either not responded to the Safety Board’s requested action or have taken other measures, such as installing flow restrictor plates and carrier bearings, additional bilge pumps, and high-water bilge alarm systems. The Safety Board does not consider the installation of such devices to be equivalent to the safety measures stated in Safety Recommendation M- 00-5 and remains concerned about the safety of amphibious passenger vehicle operations nationwide. While restrictor plates reduce the rate of water ingress and the carrier bearings close the hull penetration at the shaft seal, these devices do not increase the vehicle’s reserve buoyancy. Further, while additional bilge pumps increase pumping capacity and alarms provide warning of flooding, they are subject to malfunction and do not provide the same level of safety as built-in sufficient reserve buoyancy. Despite the negative response from amphibious passenger vehicle owners concerning the practicality of providing reserve buoyancy to DUKWs, they have not disputed the concept. Owner comments have focused on the detailed engineering required. Owners and manufacturers, however, have used and can use various methods to increase the survivability of amphibious vehicles in the event of flooding. In addition to the installation of transverse watertight bulkheads and the addition of built-in flotation materials to the hull, owners could take equivalent measures. It is clear, however, from the responses received from the industry, that with the exception of a few owners, voluntary action will not be taken by the rest of the industry to address the need for adequate reserve buoyancy on amphibious passenger vehicles. As a result, an unacceptable level of risk to passenger safety continues to exist on these vehicles. Because the industry has, by and large, refused to take voluntary action to address this risk, the Safety Board considers it imperative that the Coast Guard takes steps to ensure that all amphibious passenger vehicles will not sink in the event of an uncontrolled flooding event. The Safety Board believes that the Coast Guard should require amphibious passenger vehicle operators to provide reserve buoyancy through passive means, such as watertight compartmentalization, built-in flotation, or equivalent

Analysis 44 Marine Accident Report measures, so that the vehicles will remain afloat and upright in the event of flooding, even when carrying a full complement of passengers and crew. The Safety Board is aware that Wisconsin and New York have commercial amphibious vehicle operations that are not subject to Coast Guard jurisdiction and whose vehicles carry thousands of passengers annually. The amphibious vehicles under State jurisdiction in Wisconsin and New York pose the same risks as the amphibious vehicles under Coast Guard authority. The Safety Board, therefore, believes that the States of Wisconsin and New York should require the amphibious passenger vehicle operators under their jurisdiction to provide their vehicles with reserve buoyancy through passive means, such as watertight compartmentalization, built-in flotation, or equivalent measures, so that the vehicles will remain afloat and upright in the event of flooding, even when carrying a full complement of passengers and crew. Survivability The Miss Majestic was certificated by the Coast Guard under a set of regulations that required the Coast Guard to review the design and construction features of the vehicle before it was placed into passenger service. The Miss Majestic, like similar amphibious vehicles, was originally designed for landing military cargoes during wartime and not for commercial passenger service. When the seats were retrofitted, the seating arrangement did not comply with the regulations under which the vehicle was certificated. The width of the aisle was 60 percent less than required (12 inches versus 30 inches) and space between seats was about 12 percent less than required (26 inches versus 30 inches). Coast Guard officials stated that they must have granted the Miss Majestic a waiver for the dimensions of these spaces, although the agency had no documentation on the waiver. Further, agency officials could provide no rationale for how the dimensions were determined. Although the survivors did not state that the reduced aisle width or space between seats hindered their escape, the reduced spacing would have made seating cramped and restricted their movement. In the circumstances of this accident, the impact of these features on the egress of the passengers who did not survive cannot be definitively determined. Following the Miss Majestic accident, the Coast Guard issued NVIC 1-01, which provided new dimensions for fixed seating arrangements on DUKWs. Regarding aisle width and seat separation, NVIC 1-01 states: Because of the limiting design and construction of DUKWs and relatively short in-water operations on protected waters, these vehicles should be granted special consideration from the aisle width and fixed seating criteria. Aisle widths may be allowed to be reduced to no less than 14 inches and the fixed seating criteria to no less than 17 inches per passenger. In addition, the distance from seat back to seat back may be reduced from 30 inches to 28 inches.

Analysis 45 Marine Accident Report While the proposed “special consideration” cited above for minimum aisle width and fixed seating criteria for DUKWs exceeds those found on the Miss Majestic, the Safety Board questions whether “limiting design and construction” and “relatively short in-water operations” justify a departure from regulatory requirements. There is no basis provided for the waiver to show that the minimum criteria will not impede emergency egress. Be that as it may, the Safety Board considers that the major consideration in assessing the ability of passengers to escape from a sinking DUKW is the overhead canopy. All but one of the survivors stated that the canopy was an impediment to their escape. One man said, …if you had the cover [canopy] off, everybody would have had a chance. With that cover on, there’s too many people didn’t have a chance because that thing [the Miss Majestic] sank so quick [sic]. In the case of the Miss Majestic accident, the force of the water rushing in over the stern was strong enough to sweep a 6-foot 6-inch, 260-pound man standing near the sixth row forward and pin him against the windshield. As the Miss Majestic sank, the metal framework on both sides of the passengers and the continuous canopy over their heads essentially caged them, making escape in the limited available time extremely difficult. As the vehicle sank to the bottom of the lake, the natural buoyancy of the passengers’ bodies forced them into the overhead canopy, which acted like a net to entrap them and to prevent their vertical escape. Of the seven fatalities found inside the vehicle, four were found trapped in the canopy. At least two survivors testified that they had to swim downward in order to escape from the canopy. Most of the survivors could not explain how they were able to get out of the vehicle. Six victims were recovered from the lake bottom at various distances from the vehicle. These six people might have been able to escape the vehicle but drowned before they could reach the lake’s surface. If the vehicle had not had a canopy, the passengers would not have had a barrier to vertical escape. They would not have been trapped inside the vehicle, and fewer passengers might have been killed. The Safety Board therefore concludes that the canopy on the Miss Majestic was a major impediment to the survival of the passengers. The canopy on the Miss Majestic is a common feature in amphibious passenger vehicles. The Safety Board notes that, while the Coast Guard’s NVIC 1-01 recognizes canopies as an impediment to passenger egress, it does not address the safety implications of canopies over the passenger seating areas or their negative impact on passenger survival in the event of sinking. Regarding canopies, the NVIC states: Canopies and canopy supports can impede the egress of passengers. Again, the primary egress on these vehicles is over the side. Canopy supports should be positioned to allow the majority of passengers unobstructed egress. If a canopy support is located directly adjacent to a passenger’s seat it should be shown, through a practical test, that the passenger can adequately egress the vehicle. The window framing vertical distance should be sufficient for a passenger to exit while wearing a lifejacket. A vertical distance of 32 inches from gunwale to

Analysis 46 Marine Accident Report canopy appears sufficient for most installations. Overhead storage of lifejackets should not impede the egress of passengers. Once again, however, the Coast Guard provides no basis to show that the minimum dimensions will not impede emergency egress. The Safety Board issued Safety Recommendation M-00-5 not only because of concern for the vulnerability of amphibious vehicles to rapid sinking but also in recognition of the extreme difficulty that passengers would have trying to escape such vehicles, as demonstrated by the Miss Majestic’s sinking. Following this accident, almost all survivors stated that the canopy on the Miss Majestic was an impediment to escape. In the Safety Board’s opinion, canopies present major safety risks that need to be addressed, especially in light of the fact that amphibious passenger vehicles in service in this country carry more than 1 million passengers each year, including a great many children. This unique vehicle is often promoted to and used by school groups. Typically, such groups of children are accompanied by a limited number of adults. Each of the four children under age 15 on the Miss Majestic was accompanied by at least one adult. Of these children, three did not survive and the fourth survived by mere happenstance. Children are particularly vulnerable when traveling as passengers on amphibious passenger vehicles and, even if an adult accompanies them, their survival can be jeopardized. If children are permitted to board a DUKW without donning lifejackets, adults will probably have insufficient time to help the children don lifejackets in the event of an emergency. If the children don the lifejackets upon boarding and the canopy is retained, the adults traveling with the children likely will not have time to help the children egress the vehicle before it sinks. If the adults are not successful in placing the children or themselves outside the vehicle before it sinks, all could likely become trapped in the overhead canopy. The Safety Board is particularly concerned that both adults and children wearing lifejackets are at risk of being drowned if entrapped by the overhead canopy. A more realistic approach to ensure passenger safety would be to afford passengers a reasonable opportunity to escape by removing the canopy. The Safety Board therefore concludes that, on amphibious passenger vehicles that cannot remain afloat when flooded, canopies can represent an unacceptable risk to passenger safety. In looking at the operation of DUKWs, the Safety Board recognizes that the removal of the canopy, by itself, is not adequate to ensure survivability of passengers in the event of sinking. Even though passengers would not be trapped inside the vessel when it sank because the canopy was removed, they could still drown after they entered the water. As shown by the Miss Majestic accident, DUKWs without adequate reserve buoyancy will sink rapidly once water begins to flood into the hull, leaving little or no time for passengers to retrieve and don lifejackets or to assist children in donning lifejackets. Consequently the Safety Board concludes that wearing lifejackets before the vehicle enters the water would enhance the safety of passengers on board DUKWs without adequate reserve buoyancy where canopies have been removed. Therefore the Safety Board believes that, where canopies have been removed on amphibious passenger

Analysis 47 Marine Accident Report vehicles for which there is not adequate reserve buoyancy, the Coast Guard should require that all passengers don lifejackets before beginning waterborne operations. Some of the owners of existing amphibious passenger vehicles have stated that the installation of adequate reserve buoyancy through passive means to existing vehicles is not practical. In the Safety Board’s opinion, if providing existing amphibious passenger vehicles with sufficient reserve buoyancy through passive means to remain afloat and upright in the event of flooding is not practical, then alternative action that prevents passengers from being trapped inside the vehicle in the event of sinking should be taken. Such action should include removing the roof canopy before water operations so that passengers will float clear of the vehicle in the event of sinking and requiring passengers to don lifejackets. In addition, owners should be required to reduce through-hull penetrations. For example, some access holes used to perform maintenance inside the hull could be sealed. Following the DUKW No. 1 accident, the owner of the vehicle decided to seal the larger access plugs17 in all his DUKWs to reduce the likelihood of flooding. The change required some reengineering. Instead of using the forwardmost access plug to access the engine oil sump and filter, the plug was sealed and a portable pump is used to drain the sump. The oil filter has been relocated to be accessible through the vehicle’s hood. Other amphibious passenger vehicle owners should be able to modify their vehicles to eliminate the risk to passenger safety. As shown earlier in this report, Higgins pumps require maintenance and are subject to multiple failure modes. If a Higgins pump malfunctions and the DUKW vehicle lacks sufficient reserve buoyancy to remain afloat, it can rapidly sink, risking serious injury or death to passengers, as shown by the Miss Majestic accident. Further, the operation of the pump is contingent upon the operation of the engine. The sinking of the DUKW No. 1 in Seattle clearly demonstrates what can happen to a vehicle without sufficient reserve buoyancy if it experiences flooding and if it relies on the Higgins pump for dewatering. The Coast Guard NVIC 1-01 recognizes the need for an independent backup for the Higgins pump sufficient to provide enough dewatering capacity to offset flooding through the largest penetration of the vehicle’s hull. In the Safety Board’s opinion, dewatering capacity is essential to at least partially compensate for the lack of installed reserve buoyancy. While such capacity is not the equivalent to built-in reserve buoyancy sufficient to keep the vehicle afloat in the event of unrestricted flooding, dewatering at least provides some measure of additional protection that may help to keep the vehicle afloat longer, giving passengers more time to escape before the vehicle sinks. The Coast Guard NVIC 1-01 acknowledges the critical role dewatering pumps play in the safety of DUKWs. The circular states: The methodology to be used in calculating the bilge pump capacity should be similar to that of the original military methodology. Provide bilge pumps for normal operations and for emergency operations, which can offset uncontrolled flooding of the largest penetration in the hull until the vehicle can be safely beached…Hence an originally equipped DUKW should have a bilge pumps or 17 The small (¾-inch-diameter) plugs used to drain the hull after the vehicle leaves the water were not sealed.

Analysis 48 Marine Accident Report pumps with a combined capacity of over 220 gpm to control flooding or it could sink in approximately 8 minutes if left unchecked. While the Coast Guard NVIC 1-01 recommends the installation of such additional pumps, the document is advisory in nature and not mandatory. Thus, compliance by DUKW operators is more or less voluntary. In the Safety Board’s opinion, until such time as reserve buoyancy requirements come into effect for DUKW passenger vehicles, a provision for dewatering capacity should be made mandatory. As discussed above, the means exist to eliminate or reduce hull penetrations by welding access plugs closed, installing restrictor plates or carrier bearings, and using double clamped boots. An in-water inspection on each occasion that a through hull penetration has been removed or uncovered would assure the maintenance of watertight conditions before the amphibious vehicle was returned to service. Verifying the vehicle’s watertight condition before each waterborne departure would further reduce risks to passengers in amphibious passenger vehicles. Consequently, the Safety Board believes that, until such time as an amphibious vehicle owner establishes sufficient reserve buoyancy to remain upright and afloat in a fully flooded condition, the Coast Guard and the States of New York and Wisconsin should require the following (1) removal of canopies for waterborne operations or installation of a Coast Guard-approved canopy that does not restrict either horizontal or vertical escape by passengers in the event of sinking, (2) reengineering of each amphibious vehicle to permanently close all unnecessary access plugs and to reduce all necessary through-hull penetrations to the minimum size necessary for operation, (3) installation of independently powered electric bilge pumps that are capable of dewatering the craft at the volume of the largest remaining penetration to supplement either an operable Higgins pump or a dewatering pump of equivalent or greater capacity, (4) installation of four independently powered bilge alarms, (5) inspection of the vehicle in water after each time a through-hull penetration has been removed or uncovered, (6) verification of a vehicle’s watertight condition in the water at the outset of each waterborne departure, and (7) compliance with all remaining provisions of NVIC 1-01. Actions of the Operator In addition to evaluating the design and maintenance of the vehicle, the Safety Board also evaluated the operator’s performance to determine the impact, if any, of her actions upon the outcome of this accident. The Miss Majestic operator was required by Coast Guard regulations to provide passengers with a safety briefing before the waterborne portion of the tour. The briefing that she gave did not cover some safety issues. For example, she did not demonstrate how to don lifejackets and did not mention procedures for abandoning the vehicle. Land and Lakes did not have any formal policies or procedures for its vehicle operators to follow in providing safety briefings to passengers. The Safety Board clearly recognizes the

Analysis 49 Marine Accident Report importance of safety briefings and has made several recommendations for requiring such briefings as a result of past accident investigations. Under the circumstances of this accident, however, the operator and passengers had insufficient time between their first recognition of danger and the vehicle’s sinking to take any emergency actions. From the time that they recognized a problem until the time that the Miss Majestic completely sank was a matter of seconds. Although survivors indicated that a passenger had distributed lifejackets when he first saw the flooding, the vehicle sank so rapidly that no one was able to don a lifejacket before the vehicle completely submerged. The adult passengers did not have time to put lifejackets on the children. The father of one surviving child said that his wife had tried to put a lifejacket on their daughter, with no success. He said that he was convinced that if his wife had been successful, the daughter would have perished. As it was, the child grabbed hold of another passenger who was able to escape the vehicle. While the safety briefing provided by the operator of the Miss Majestic was not comprehensive, the lack of instructions to the passengers regarding emergency egress most likely did not affect the survival of the passengers in this accident. After her safety briefing, the operator turned on the electric bilge pumps and entered the lake to begin the waterborne portion of the tour. She provided a continuous commentary as part of her routine duties. In order to do this, she turned to her right, in the direction of the passengers, as she proceeded along the lake. While her attention was focused on steering the vehicle and narrating the tour, she did not notice that the forward electric bilge pump, which was to her left, was discharging water over the side. As the tour progressed, the vehicle began to list and to maneuver sluggishly, which was the operator’s first indication of anything out of the ordinary. Moments later, as she was instructing a passenger to move from the port to the starboard side, water began to flood over the stern and the vehicle sank. Thus, between the time that the operator first recognized a problem and the time that the vehicle sank was only a matter of seconds. In the Safety Board’s opinion, the time factor precluded the operator from taking any action that might have been effective in altering the outcome of the accident. Earlier warning that the vehicle was flooding would have provided the operator with the opportunity to head for shore and to at least alert the passengers to the emergency. Two days before this accident, the actions of the operator demonstrated that she recognized the safety implications of water being discharged by the Higgins pump and an electric bilge pump. Upon seeing the water streams, she immediately cut short the water tour and exited to the safety of land. On May 1, however, she did not receive any such warning because the Higgins pump was inoperative and the required high-level bilge alarms had not been installed. The Safety Board concludes that given the circumstances of this accident, the operator could not have taken any meaningful action to avert or mitigate its fatal outcome.

50 Marine Accident Report Conclusions Findings 1. Water initially entered the Miss Majestic through the gap between the driveshaft and its housing because the securing clamp for the watertight rubber boot had not been adequately secured by the maintenance mechanic. 2. The Miss Majestic sank because the DUKW had no watertight bulkheads and no reserve buoyancy and because its Higgins pump, which had been designed for significant dewatering capacity, did not operate. 3. The canopy on the Miss Majestic was a major impediment to the survival of the passengers. 4. Land and Lakes Tours, Inc.’s long-term vessel maintenance was inadequate and directly compromised the safety of the Miss Majestic and its passengers. 5. The Coast Guard’s inspection program for the Miss Majestic was inadequate and cursory. 6. The lack of Coast Guard guidance and training for the inspection of DUKWs contributed to the inadequate inspections of the Miss Majestic. 7. Industry and Coast Guard inspectors need to become familiar with the general background and unique safety issues of all types of amphibious vehicles to improve the maintenance, inspection, and operation of specialized amphibious vehicles. 8. Flooding from failed boots, open hull plugs, hull damage, collisions, groundings, mechanical failures, improperly performed maintenance, and other scenarios continue to present serious risks of rapid flooding and sinking in amphibious vehicles lacking reserve buoyancy. 9. On amphibious passenger vehicles that cannot remain afloat when flooded, canopies can represent an unacceptable risk to passenger safety.

1. Wearing lifejackets before the vehicle enters the water would enhance the safety of

passengers on board DUKWs without adequate reserve buoyancy where canopies have been removed

1. Weather, drug and alcohol use, and operator fatigue were not factors in the sinking of

the Miss Majestic.

Conclusions 51 Marine Accident Report

1. Given the circumstances of this accident, the operator could not have taken any action

to avert or mitigate its fatal outcome. Probable Cause The National Transportation Safety Board determines that the probable cause of the uncontrolled flooding and sinking of the Miss Majestic was the failure of Land and Lakes Tours, Inc., to adequately repair and maintain the DUKW. Contributing to the sinking was a flaw in the design of DUKWs as converted for passenger service, that is, the lack of adequate reserve buoyancy that would have allowed the vehicle to remain afloat in a flooded condition. Contributing to the unsafe condition of the Miss Majestic was the lack of adequate oversight by the Coast Guard. Contributing to the high loss of life was a continuous canopy roof that entrapped passengers within the sinking vehicle.

52 Marine Accident Report Recommendations New Recommendations To the U.S. Coast Guard and the Governors of the States of New York and Wisconsin: Require that amphibious passenger vehicle operators provide reserve buoyancy through passive means, such as watertight compartmentalization, built-in flotation, or equivalent measures, so that the vehicles will remain afloat and upright in the event of flooding, even when carrying a full complement of passengers and crew. (M-02-1) Until such time that owners provide sufficient reserve buoyancy in their amphibious passenger vehicles so that they will remain upright and afloat in a fully flooded condition (by M-02-1), require the following: removal of canopies for waterborne operations or installation of a Coast Guard-approved canopy that does not restrict either horizontal or vertical escape by passengers in the event of sinking, reengineering of each amphibious vehicle to permanently close all unnecessary access plugs and to reduce all necessary through-hull penetrations to the minimum size necessary for operation, installation of independently powered electric bilge pumps that are capable of dewatering the craft at the volume of the largest remaining penetration to supplement either an operable Higgins pump or a dewatering pump of equivalent or greater capacity, installation of four independently powered bilge alarms, inspection of the vehicle in water after each time a through-hull penetration has been removed or uncovered, verification of a vehicle’s watertight condition in the water at the outset of each waterborne departure, and compliance with all remaining provisions of Navigation and Vessel Inspection Circular1-01. (M-02-2) Where canopies have been removed on amphibious passenger vehicles for which there is not adequate reserve buoyancy, require that all passengers don lifejackets before the onset of waterborne operations. (M-02-3)

Recommendations 53 Marine Accident Report To the U.S. Coast Guard Develop and promulgate guidance for all amphibious passenger vehicles similar in purpose to the Navigation and Vessel Inspection Circular 1-01. (M-02-4) Previously Issued Recommendation Classified in this Report The following Safety Recommendation was issued to 30 operators and refurbishers of amphibious passenger vehicles in the United States: M-00-5 Without delay, alter your amphibious passenger vessels to provide reserve buoyancy through passive means, such as watertight compartmentalization, built- in flotation, or equivalent measures, so that they will remain afloat and upright in the event of flooding, even when carrying a full complement of passengers and crew. Based on information received, the Safety Board classifies, in this report, Safety Recommendation M-00-5 (previously classified “Open—Acceptable Response”) “Closed—Acceptable Action” for the following company: Cool Stuff. Based on the lack of response to its February 18, 2000, initial letter and its August 17, 2000, follow-up letter, the Safety Board classifies Safety Recommendation M-00-5 “Open—Unacceptable Response” to the following companies: Aqua Traks, Inc; Austin Ducks; Buffalo Point; Chattanooga Ducks; Chicago Duck Tours; Ducks Amphibious Renovation/Sales; Land and Sea Tours; Maui Duck Tours; Naples Land and Sea Tours; National Park Duck Tours; Outfitter Kauai; Ozark Mountain Ducks; Sterling Equipment; and South Padre Water Sports/Breakaway. BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman JOHN A. HAMMERSCHMIDT Member CAROL J. CARMODY Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: April 2, 2002

Recommendations 54 Marine Accident Report Concurring Statement John J. Goglia, Member, filed the following concurring statement on April 9, 2002. Member Goglia was joined in the following concurring statement by Members John A. Hammerschmidt and George W. Black, Jr. Notation 7222B Member GOGLIA concurring: The Board makes several important recommendations in its report. However, this accident was initiated by a maintenance failure and the recommendations fail to fully address the maintenance shortcomings that initiated this tragic accident. More needs to be done to ensure the safety of the public on vessels within the jurisdiction of the Coast Guard. The NTSB report could provide helpful guidance on the maintenance aspects. There was improper maintenance performed on this vessel. There were no requirements that the technicians were capable or qualified. There was no oversight of the contract maintenance performed on this vessel by the operator. There was no supervision to ensure that the maintenance was properly performed. There were few or no records of what maintenance was accomplished, or any documentation of proper maintenance procedures and whether such procedures were followed. The Coast Guard has maintenance standards and requirements for maintenance incidental to the operation of its own vessels. The Coast Guard would improve public safety if it required the operators of vessels carrying the pubic for hire to have maintenance standards and requirements similar to what they require of themselves. It should also be noted that there was disagreement among staff regarding recommendation number 1 to the Coast Guard. Some staff believe it is improbable that the passive measures as proposed in the Board’s early recommendation and the report can be readily incorporated into existing DUKW vehicles. These staff point out that the Board previously issued a similar recommendation to the industry and that no company has managed to achieve this goal for existing vehicles to date. Rather, these staff believe the remedial actions proposed by the Coast Guard NVIC such as the installation of restrictor plated and carrier bearings over the drive shaft opening, the use of double clamps on drive shaft boots, and the installation of additional high level bilge alarms, are sufficient to prevent the recurrence of Miss Majestic type accidents in the future. These same staff do not completely agree with conclusion number 9 and the recommendation to remove canopies. They have requested the conclusion state, “On amphibious passenger vehicles that cannot remain afloat when flooded canopies can represent a grave risk to passenger safety” because they do not agree that canopies represent an unacceptable risk to passenger safety.

55 Marine Accident Report Appendix A Investigation And Public Forum The National Transportation Safety Board was notified of the Miss Majestic accident at 1700, on May 1, 1999. An eight-person investigative team, consisting of an investigator-in-charge, the technical branch chief, and human performance and survival factors investigators, arrived in Hot Springs at 0130, May 2, 1999, and began the investigation later that morning. Representatives from the Safety Board’s Office of Government, Public, and Family Affairs supported the team. A Board Member arrived with the team on scene the same day. The Safety Board investigated the accident under the authority of the Independent Safety Board Act of 1997, according to the Safety Board’s rules. Team members conducted witness interviews and examined the vessel after it was raised from the bottom of Lake Hamilton. On December 8–9, 1999, in Memphis, Tennessee, the Safety Board sponsored a public forum on amphibious passenger vessel safety, which brought together representatives of the U.S. Coast Guard, State governments, amphibious passenger vessel operators, other private sector organizations, and the public to explore safety matters relating to the design, regulation, maintenance, and operation of these vessels. The designated parties to the Safety Board’s on-scene investigation were the Garland County Sheriff Department and Land and Lakes Tours, the owner of the Miss Majestic. Although offered party status, the U.S. Coast Guard declined to participate in the Safety Board’s investigation.

56 Marine Accident Report Appendix B Minnow and DUKW No. 1 Accident Briefs

Appendix B 57 Marine Accident Report NTSB/MAB-02/01 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, DC 20594

Marine Accident Brief

Sinking of the Alvis Stalwart M/V Minnow in Milwaukee Harbor on September 18, 2000 Accident No. DCA-00-MM-042 Vessel: 20-foot 10-inch long, 8-foot 7-inch wide, steel-hull amphibious passenger vehicle of Alvis Stalwart design, built in 1967 in the United Kingdom Accident Type: Flooding and sinking Location: Milwaukee Harbor, Lake Michigan Date: September 18, 2000 Time: 11:55 a.m. Central Daylight Time Owner: Minnow Tours LLC, 3775 S. Packard Avenue, St. Francis, Wisconsin Property Damage: $ 170,000 (approximate) Complement: Nineteen people, including a licensed operator,1 and an unlicensed deckhand. The Minnow was certificated by the U.S. Coast Guard to carry 1 operator, 1 deckhand, and up to 28 passengers. Injuries: None Vessel History The previous owner of the M/V Minnow, a 21-foot-long Alvis Stalwart amphibious passenger vehicle, contracted with Land and Sea Tours of Apopka, Florida, to refurbish and to sell the vehicle on his behalf. To prepare the Stalwart for sale, the refurbisher did some topside finishing work, such as replacing the canopy and seats, painting the vehicle, and making other aesthetic changes. He also rebuilt the main engine. The vehicle remained on the market and was not operated for about a year, when the owner of Minnow Tours, based in St. Francis, Wisconsin, bought it in May 2000. Before taking possession of the vehicle, the Minnow Tours owner visited the refurbisher to obtain a set of manuals and information about Stalwart operations and maintenance. The refurbisher did not

1 The operator, age 26, held a Coast Guard license for “Master of not more than 50 Gross Tons upon Great Lakes and Inland Waters” that was issued June 5, 1998, and that expired on June 5, 2003.

Appendix B 58 Marine Accident Report

NTSB/MAB-02/01 2 provide formal training or an orientation program about the Stalwart; rather, he answered questions that the owner posed. Accident Narrative About 1130 on September 18, 2000, the Minnow departed on a tour of Milwaukee, Wisconsin, with 19 people on board, including an operator, a deckhand, and 17 passengers. After an 8-minute road trip, the Minnow entered the waters of Milwaukee Harbor from a boat launch at the South Shore Yacht Club. The deckhand gave the passengers a safety orientation that included instructions on how to don lifejackets and what actions to take in the event of an emergency. The deckhand’s other duties included narrating the sightseeing tour. The Minnow followed its normal water tour route, hugging the shoreward side of the harbor breakwater. The operator said that, as he cruised at a speed of about 3 knots, he heard no unusual mechanical noises and had no operational problems. About 15 minutes after the water tour began, however, he heard a sudden “mechanical” noise on the port side of the vessel and felt the vessel “shudder.” The operator said that the engine speed then dropped 400 rpm. After a few seconds, the shuddering lessened somewhat but did not cease. The operator said that, at this time, the jet wash appeared normal, the gage readings were normal, and no alarms sounded. He said that, at the time, he thought a foreign object had been sucked in and out of the jet. About 1200, the high-water bilge alarm sounded. The operator said that he immediately turned on the two bilge pumps and headed the vessel back toward the dock. He said that he saw water issuing from the forward bilge pump discharge point on the starboard bow. From the driver’s position, he could not see whether water was issuing from the stern bilge pump discharge point. To avoid panic among the passengers, the operator silenced the bilge alarm. About 1202, the operator noted that the engine temperature was dropping and wondered whether the gage had an electrical problem.2 He said the vessel was handling normally. When the mechanical noise and mild shuddering suddenly ceased, the operator observed in the rearview mirror that the left propulsion jet wash was mixed with air while the right jet wash was normal. As the Minnow came into view of the Coast Guard base, the vessel’s engine began to sputter. The operator steered the Minnow toward the concrete pier embankment. About 1206, the engine stopped just as the operator reached the last ladder on the embankment. The operator then observed that, from the vessel’s deck, the ladder was too high for the passengers to grasp. About this time, the deckhand pointed out to the operator that the vessel’s stern was low in the water, with a freeboard of 1 to 1 ½ feet.3 Meanwhile, two marine police officers and a Coast Guardsman were eating lunch in the Coast Guard base mess when one of the police officers noticed a tour boat (the Minnow) heading toward the embankment and its operator reaching out toward a ladder on the embankment. The

2 At the time, the operator did not realize that water was flooding the vessel and that the engine was becoming submerged. 3 The Minnow normally had a freeboard of 4 feet.

Appendix B 59 Marine Accident Report

NTSB/MAB-02/01 3 Coast Guardsman immediately left to notify the Coast Guard Station of the situation. The police officers immediately proceeded to their boat, which was moored at the pier outside the mess. At 1207, as they were casting off, they overheard the Minnow’s operator radio the Coast Guard, whereupon the marine police radioed the Stalwart operator, advising him that they were en route. The Minnow’s operator told the police that the Minnow was taking on water and needed assistance. The police relayed the information about the Minnow’s distress situation to the Coast Guard, which immediately dispatched response personnel in a rigid hull inflatable boat (RHIB). The operator stated that, upon receiving an immediate response from the marine police and observing that a police boat was within 200 yards of the Minnow, he did not think it necessary to ask the passengers to don lifejackets. Rather, he told passengers that they would have to board the police boat when it came alongside. Soon after the police boat had moored port to port with the Minnow, the Coast Guard RHIB arrived and moored on the Minnow’s starboard side. According to the responders, no problems occurred during the evacuation. The marine policemen described the passengers as “very calm” and characterized their demeanor as “almost festive” during the transfer. Twelve people from the Minnow evacuated to the police boat. The remaining 7 people originally evacuated to the RHIB but subsequently transferred to the police boat, which took all the passengers and crew of the Minnow back to shore. No injuries requiring medical treatment occurred during the transfers. The marine police reported that the operator’s behavior seemed normal and that he did not seem to be impaired from drugs or alcohol. Within 2 hours of the accident, the Coast Guard gave the Minnow operator a Breathalyzer test; the test results were negative. After dropping off the Minnow’s passengers and crew, the Coast Guard crewmen returned in a 41-foot UTB with a dewatering pump to prevent the Stalwart from sinking. The effort was unsuccessful; the Minnow drifted around the embankment and sank in 25 feet of water. Postaccident On-Scene Examination After the Minnow was salvaged, Safety Board investigators found no evidence of blockage from debris in the intake and discharges for the port and starboard waterjets and no abnormalities in the starboard waterjet tunnel. They observed that the blade of the port waterjet impeller had cut through the waterjet tunnel housing the impeller, leaving a 1/8-inch-wide circumferential gap through which water from the port waterjet tunnel could enter the amphibious vehicle. When the port and starboard waterjets were disassembled, investigators observed that the port impeller shaft inside the stator bearing was severely damaged, and that the bearings inside the port stator were broken into fragments and discolored. Neither the stator bearing nor the conical fairwater at the end of the port stator had any lubricant. Investigators found that the lubricating fitting (spigot) for the port stator had broken off. The bearing’s retaining nut on the port impeller shaft was severely corroded.

Appendix B 60 Marine Accident Report

NTSB/MAB-02/01 4 The underwater area of the hull was in good condition and showed no evidence of leaks. The three drain plugs on the hull were secured in place. No other sources that potentially could have resulted in a significant flooding of the hull were identified. Investigators tested the Stalwart’s two 12-volt positive-displacement bilge pumps and found that one of the pumps was inoperative. Two of the six impeller vanes were broken and were blocking the suction and discharge openings inside the pump casing. Laboratory Tests The on-scene investigators sent components to the Safety Board’s Materials Laboratory in Washington, D.C., for further examination and analysis. The laboratory report states that the high temperature deformation of the bearing rollers indicated inadequate lubrication, which caused the failure of the aft shaft bearing, which, in turn, resulted in the failure of the port propulsion unit. Severe corrosion on the shaft bearing retaining nut indicated that the integrity of the bearing and oil cavity had been compromised for a significant period before the accident, allowing water to enter the oil chamber, corrode the nut, and degrade the lubricating oil. Over a period of time, water had entered through either a bad shaft seal or the fractured spigot. Laboratory analysis could not conclusively determine when the spigot had fractured. The report found that, although the final breakup of the bearing occurred during the Minnow’s final voyage, severe degradation of the bearing had occurred for a long time before the accident voyage. Follow-up Interviews The owner stated he could not remember whether the refurbisher had told him about servicing recommendations for the rear bearing that malfunctioned in this accident. The refurbisher said he could not recall whether the oil level or the condition of the bearing that broke had been checked before the sale. Both the owner and refurbisher stated that the refurbisher had repaired the main bearing forward of the propulsion plenum because water had entered the bearing and caused it to seize. According to the owner of Minnow Tours, he and the vehicle operator had performed the maintenance on the Stalwart. Both men had previous experience with automobile repairs. The company owner provided Safety Board investigators with a maintenance guide, Servicing Schedule Condensed Summary, which outlined daily, weekly, monthly, bimonthly, and annual maintenance schedules for the vehicle. Item 12 A under “weekly inspection and servicing” recommended that the rear hub bearing oil level be checked for the propulsion shafts. According to the company owner, the oil level for the rear bearings for the propulsion shafts had not been checked since he purchased the Stalwart. He had repaired the bevel gearing on the port power transmission shaft when mechanical problems occurred soon after purchase. He had made other minor repairs in the 4 months between purchase and the accident, including changing the lubricant in the wheel hubs because water in the lubricant had resulted in the hubs’ overheating. He had changed the distributor points “because of problems” and had had to replenish the engine oil frequently because the vehicle “blows a little engine oil.”

Appendix B 61 Marine Accident Report Coast Guard Inspections At the refurbisher’s Minnow was being modified for sale, a Coast Guard inspector from MSO Jacksonville, Florida, examined the vehicle. The Coast Guard inspector did not conduct a detailed plan review of the refurbished Stalwart; he approved the design of the Minnow based on the Coast Guard’s be successful in 5 years of service. The Coast Guard inspector in Milwaukee, who was tasked with certificating the Minnow, had never inspected a Stalwart. He said that, after receiving 2 years of training, he had been qualified in 1990 to inspect small passenger vessels, oceangoing ships, large passenger ferries, and tank barges. He was qualified as both a machinery and hull inspector. He said that he had inspected two DUKWs in 1988; however, he considered a Stalwart more complex mechanically than a DUKW. He stated that MSO Jacksonville provided him with very limited background information on the Minnow, merely an electrical diagram and stability information. He was not provided with manuals or other Coast Guard guidance for inspecting Stalwarts. He had never inspected waterjet propulsors before and, based on his lack of experience with Stalwarts, stated that he would likely not have thought of inspecting the area where the mechanical failure occurred. He stated that he considered checking the grease and oil levels in bearings a servicing and maintenance procedure that was the responsibility of the owner. Before issuing the COI, the inspector checked the operation of the bilge alarm, the bilge pumps, and the firefighting system. He also examined the hull condition and took the vessel for a test ride in the water. Based on his inspection, he required that repairs be made to the electrical wiring. As part of the requirements for issuing the COI, the Coast Guard inspector observed the crew while they conducted man-overboard drills. He explained the responsibilities for distributing lifejackets, firefighting, briefing passengers, and posting emergency placards. He gave the company a mannequin for practicing man-overboard drills and made several suggestions on how to improve passenger briefings. He stated he visited the company several times to ensure that it satisfactorily completed these requirements. During the COI inspection, the company owner and the operator of the Minnow were present. The deckhand who was on board the Minnow on the day of the accident was a new employee who had not been present at the COI inspection. The company is required to train its new employees in safety procedures and log its crew training. The Coast Guard witnesses drills only during its annual inspections. Probable Cause The National Transportation Safety Board determines that the probable cause of the flooding and sinking of the Minnow was the inadequate prepurchase mechanical evaluation and subsequent inadequate maintenance by Minnow Tours before placing the vessel in passenger service. 5 NTSB/MAB-02/01

Appendix B 62 Marine Accident Report NTSB/MAB-02/02 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, DC 20594

Marine Accident Brief

Sinking of the DUKW No. 1 Lake Union, Seattle, Washington, December 8, 2001 Accident No.: DCA-02-MM-002 Vessel: 33-foot long, 8-foot 2-inch wide, steel-hulled amphibious passenger vehicle DUKW No. 1, built in 1945 for the U.S. Army1 Accident Type: Flooding and sinking Location: Lake Union, Seattle, Washington Date: December 8, 2001 Time: 1430 Pacific Standard Time Owner: Ride the Ducks of Seattle, Seattle, Washington Property Damage: $100,000 (approximate) Complement: 1 operator, 11 passengers. Certificated for 36 passengers maximum Injuries: None Preaccident Events On December 8, 2001, the junior mechanic for Ride the Ducks of Seattle, Washington, arrived at the company’s garage about 0730 to perform maintenance on the DUKW that was to be used for the tours that day. For the winter months, the company had cut back operations, conducting tours only on weekends using one of its four DUKWs. In case problems arose with the first DUKW, the company maintained another DUKW on standby. The work hours of the company’s staff had been reduced commensurate with the operating demand. The senior mechanic and supervisor of the junior mechanic did not come into the garage that week. The junior mechanic worked part time between 0700 and 1000.

1 During the DUKW’s modification from Army cargo vehicle to civilian passenger vehicle, DUKW No. 1 was lengthened.

Appendix B 63 Marine Accident Report About 1000, the operator arrived, checked DUKW No. 2, which had been scheduled for use that day, and departed to pick up passengers at the 1100 tour. The junior mechanic then left for the day. According to the operator, the 1100 tour was completed without incident. During a walk- around inspection of the DUKW after the tour, however, the operator noted that a tire was low. He drove the DUKW to a nearby automotive service station to inflate the tire where, coincidentally, he met the junior mechanic who had stopped there on his way home. The tire would not hold air and, rather than undertake the time-consuming process of changing the DUKW’s tire, the operator asked mechanic told him that DUKW No. 1 had been serviced. The senior mechanic later advised the Safety Board that DUKW No. 1 was not originally scheduled to be the standby vehicle. DUKW No. 4, the standby DUKW, had developed engine problems about a week before this accident. As a result, about December 5, the company transferred its insurance to DUKW No. 1 and placed it in a standby status. The junior mechanic said that he last changed the oil and completed a maintenance checklist for DUKW No. 1 on November 28; however, the Safety Board investigators were not provided a copy of the checklist. The Accident Company procedures required that, before a tour is conducted, both the mechanic and the operator sign the daily maintenance checklist attesting that they have checked 55 items, including engine fluid levels, tires, brakes, driveshaft rubber boots and clamps, and hull plugs. On the day of the accident, the operator said that he arrived at the company garage about 1300 and spent about 5 to 10 minutes inspecting DUKW No. 1. He said that because he was in a hurry to pick up waiting passengers, he was unable to examine all the items listed on the safety checksheet; however, he told Safety Board investigators that he thought the maintenance access plug had been in place. A review of the daily maintenance checklist for DUKW No. 1 shows all items were checked. The operator arrived about 1320 at the ticket booth, where 11 passengers boarded. The operator stated that he gave a safety briefing, which included information about the location of and donning procedures for lifejackets as well as procedures for exiting the vehicle in the event of an emergency. After completing the land portion of the tour, the DUKW No. 1 entered the water and proceeded on its normal route across Lake Union. The operator said that, about half way across the lake, he felt the boat vibrating and thought that, because all the passengers were seated in the forward area of the DUKW, the propeller was not completely immersed. He therefore asked several passengers to move aft in the vehicle. The DUKW No. 1 had been in the water about 5 minutes when the bilge alarm sounded briefly. About a minute later, the bilge alarm began sounding steadily, and the Higgins pump began discharging water. In accordance with company safety procedures, which stipulated that an operator proceed to the nearest open beach area if the Higgins pump discharged water, the 2 NTSB/MAB-02/02

Appendix B 64 Marine Accident Report DUKW No. 1 operator headed towards Good Turn Park. The DUKW No. 1 operator later stated that he did not order the passengers to don lifejackets2 because the vehicle was so close to the park. The operator of a nearby boat noticed the Higgins pump discharge and followed the DUKW No. 1 to see if it needed assistance. About 2-3 minutes elapsed from the time that the bilge alarm began sounding steadily to the time that the DUKW’s wheels loose gravel bottom, and the vehicle’s onto the beach. The DUKW No. 1 operator then asked the operator of the Good Samaritan boat to shuttle the DUKW No. 1’s passengers had to enter the water or were injured during the transfer. The DUKW No. 1 operator contacted the tour company, which arranged for taxis to pick up the passengers from Good Turn Park and return them to the ticket booth. The operator also contacted the Seattle Harbor Patrol, which dispatched a patrol vessel that arrived on the scene after all the passengers had safely disembarked. The Harbor Patrol vessel attempted to tow the stalled DUKW No. 1 back across the lake; however, before reaching its destination, the DUKW No. 1 sank by the bow in 27 feet of water. Postaccident Findings Divers sent down to the vehicle found that a 4 ½-inch hull access plug 3 was missing, which had allowed water to flood the hull and sink the DUKW No. 1.4 The company initially could not find the spare access plug. To close the hole in the DUKW No. 1 before salvaging the vehicle, the company installed a plug from another vehicle. The company later accounted for the access plugs and the single spare plug for all four DUKWs. The company’s stated that, before the accident, the company had moved to apresident and larger garage. The DUKW No. 1 plug and the spare plug were found in a vehicle used for the garage move; thus, the plug had not become loose in the vehicle but had been previously removed and not replaced by a mechanic. After the accident, the junior mechanic stated that he was puzzled by the absence of the plug in DUKW No. 1 because he thought he had replaced the access plug when he had last changed the oil. He said that, as an obvious reminder to himself, he had placed the plug on the nose of the DUKW during the oil change. He stated, Something apparently went wrong with this reminder system. While I had believed I had put the plug back in, I do also believe that the DUKW left the shop

2 The DUKW No. 1 was equipped with 36 adult lifejackets, which were stored in the overhead above the passenger seats and near the operator’s station. Ten child-size lifejackets were stowed under the seats.

3 The access plug is located under the engine, forward of the front axle, on the centerline of the vessel. When removed, the plug provides access to the engine’s oil filter and drain plug from below the hull. 4 Safety Board investigators calculated that the DUKW’s dewatering pumps would not have had sufficient capacity to keep up with the ingress of water through the missing access plug hole. 3 NTSB/MAB-02/02

Appendix B 65 Marine Accident Report

NTSB/MAB-02/02 4 on December 8, 2001, without the drain plug in place. It is not likely that someone took the plug out after I had put it in. DUKW No. 1 had a fixed overhead canopy made of solid sheet metal. Each side of the DUKW had a roller side curtain assembly that extended the length of the vehicle. In normal operation, the curtain on each side was moved up or down on a roller mounted on the canopy. In an emergency, the operator could use a lever at his station to release the entire roller assembly, allowing it fall away from the vehicle to facilitate emergency egress. The vehicle’s windshield was also hinged at the bottom, allowing it to open outward for egress. Probable Cause The National Transportation Safety Board determines that the probable cause of the flooding and sinking of the DUKW No.1 was a missing access plug, which, in turn, was caused by inadequate supervision of company personnel and inadequate management oversight of amphibious passenger vehicle maintenance. Contributing to the sinking was a flaw in the design of DUKWs, that is, the lack of adequate reserve buoyancy that would have allowed the vehicle to remain afloat in a flooded condition.

FD07215 ｜ 1999_美国_NTSB_PAB0001_Natural_Gas_Service_Line_and_Rupture_and_Subsequent_Explosio.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/PAB-00/01 E

P L U R IB U S UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N National Transportation Safety Board Washington, D.C. 20594 Pipeline Accident Brief Accident No.: DCA-99-MP-004 Type of System: Natural gas service line Type of Accident: Rupture, explosion, and fire Location: Bridgeport, Alabama Date and Time: January 22, 1999, 10:02 a.m. CST Owner/Operator: Utilities Board of the City of Bridgeport Property Damage and Losses: $1.4 million Fatalities: 3 Injuries: 6 Material Released: Natural gas Pressure: 35 psig Type of Failure: Excavation damage Component Affected: ¾-inch steel gas service line The Accident On January 22, 1999, while digging a trench behind a building at 406 Alabama Avenue, a backhoe operator damaged a ¾-inch steel natural gas service line and a 1-inch water service line. This resulted in two leaks in the natural gas service line, which was operated at 35 psig. One leak occurred where the backhoe bucket had contacted and pulled the natural gas service line. (See figure 1.) The other was a physical separation of the gas service line at an underground joint near the meter, which was close to the building. Gas migrated into the building at 406 Alabama Avenue, where it ignited about 10:02 a.m. An explosion followed, destroying three buildings: 404, 406, and 408 Alabama Avenue (see figure 2). Other buildings within a two-block area of the explosion sustained significant damage. Three fatalities, five serious injuries,1 and one minor injury resulted from this accident.

1 According to the Jackson County Coroner, on March 23, 2000, 14 months and 1 day after the accident, one of the seriously injured persons died as a result of injuries sustained in the explosion. In accordance with 49 Code of Federal Regulations (CFR) 830.2, his injuries continue to be classified as “serious” for reporting purposes. Title 49 CFR 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident.”

2 NTSB/PAB-00/01 Figure 1. Damaged section of the gas service line to 406 Alabama Avenue. (Arrow shows leak location. Note how the bowed area corresponds with the width of a backhoe bucket.) Figure 2. Damage to 404, 406, and 408 Alabama Avenue

3 NTSB/PAB-00/01 Preaccident Events The owner of R&B Construction (R&B) told investigators that the owner of 408 Alabama Avenue had hired R&B to dig a trench from an electric pole behind 404 Alabama Avenue to his building for an underground electric service cable. (See figure 3.) The owner of R&B told investigators that he had not planned beforehand to dig the trench to 408 Alabama Avenue on the morning of the accident and that he did not call the Alabama Line Location Center, Inc.2 However, when a part-time employee, who had operated a backhoe for R&B in the past, arrived at the R&B office the morning of January 22 looking for work, the owner of R&B decided to have the employee dig the trench that day. Figure 3. Schematic of accident area The owner of R&B was a full-time employee of the Utilities Board of the City of Bridgeport (Utilities Board) at the time of the accident.3 He and a Utilities Board coworker, who was the acting supervisor of the Utilities Board field personnel on the morning of the accident, told Safety Board investigators that on the way to work that morning, they located and marked the gas and water service lines for the trenching

2 Since the accident, the Alabama Line Location Center has been redesignated Alabama One Call. 3 The Utilities Board owns and operates Bridgeport’s water and natural gas distribution systems.

4 NTSB/PAB-00/01 activity. The owner of R&B told investigators that blue paint was used to mark both service lines because that was the only paint that they had.4 Upon their arrival the day after the explosion, Safety Board investigators could not find any blue or other line markings on the ground at the accident scene. Representatives from the Alabama Public Service Commission and the Alabama State Fire Marshals Office also did not observe any markings on the ground when they arrived at the accident scene within hours of the explosion. The owner of R&B and the acting supervisor left the excavation site about 8:15 a.m. to go to the Utilities Board shop. They told investigators that, before they left, they had asked the owner of 408 Alabama Avenue to watch the backhoe operator. The R&B backhoe operator arrived at the excavation site some time after 8:15 a.m. While digging the trench, the backhoe operator damaged the underground gas and water service lines to 406 Alabama Avenue, resulting in leaks in the water and gas service lines. About 9:15 a.m., the owner of 408 Alabama Avenue went to the Utilities Board office at 513 Alabama Avenue and reported the excavation damage. He then returned to the excavation site. The General Manager of the Utilities Board said the owner of 408 Alabama Avenue reported that the water line and possibly the gas line were damaged. The Utilities Board paged its field personnel between 9:18 and 9:22 a.m. Shortly afterward, five Utilities Board employees responded to the excavation site from three locations to locate and repair the leaks. One of the Utilities Board employees told Safety Board investigators that upon his arrival at the accident scene, the R&B backhoe operator showed him where he had wrapped black tape over the leak in the gas service line. In addition, he and other Utilities Board employees noticed that water was running on the ground. They could hear the hissing of leaking gas and smell a strong natural gas odor in the general area. The Utilities Board employee who was the acting supervisor turned the water off so that field personnel could excavate and locate the leak. The acting supervisor could see a portion of the pulled gas service line above ground and said that he suspected that the gas service line was severed at some point. Though the acting supervisor could hear the gas blowing and see the gas bubbling from the water in the excavated ditch, he did not know the direction in which the gas was blowing. He told investigators that he “was hoping” that the line was pulled off at the main and that the gas was blowing up into the air. He added that he believed the leak was routine and the situation was safe. The Utilities Board employees did not check for gas migrating underground or accumulating in buildings and did not stop the flow of gas. After the acting supervisor turned off the water, a Utilities Board employee started digging to remove water and soil from the trench with a backhoe. By this time, the owner of R&B, because he was a Utilities Board employee and was paged, had arrived at the excavation site.

4 The Superintendent of the Utilities Board told Safety Board investigators that the Utilities Board uses yellow paint to mark gas lines and blue paint to mark water lines.

5 NTSB/PAB-00/01 Shortly after the Utilities Board backhoe operator started digging, the building at 406 Alabama Avenue exploded. The owner of 408 Alabama Avenue, the R&B backhoe operator, and a Utilities Board employee received fatal injuries. Five other people, including a bystander, received serious injuries, and one person received a minor injury. The Alabama State Fire Marshals Office determined that the likely source of ignition for the accumulated natural gas was a gas-fired heater at 406 Alabama Avenue, which had an active pilot light at the time of explosion.5 The Superintendent of the Utilities Board estimated that within 5 to 10 minutes after the explosion he had closed two valves on the 4-inch natural gas main feeding the natural gas to the broken service line. R&B Construction R&B is a small construction company that employs part-time employees. At the time of the accident, it did not have employee qualification and training records or written procedures for excavating near underground utility lines. Recognizing that damages to underground facilities are usually preventable, and most frequently occur due to a breakdown in the damage prevention process, Government and industry have been working to identify and validate existing best practices for preventing damage to underground facilities. The resulting Common Ground study of one-call systems and damage prevention best practices6 discusses, among other best practices, the need to “call before you dig.” The study recommends, “Unless otherwise specified in state law, the excavator calls the one-call center at least two working days and no more than ten working days prior to beginning excavation.”7 It also recommends that an excavator observe a “tolerance zone” that includes the width of the facility plus 18 inches on either side and asks that excavators exercise reasonable care when excavating within the tolerance zone to protect the underground facilities.

5 Although the gas line had separated underground, the compacted earth surrounding the line would have provided a path that allowed continued gas flow sufficient to have fueled the pilot light. 6 Common Ground: Study of One-Call Systems and Damage Prevention Best Practices, U.S. Department of Transportation, Research and Special Programs Administration, Office of Pipeline Safety, Washington, D.C., August 1999. The Common Ground study, as authorized by the Transportation Equity Act for the 21st Century (TEA 21), was prepared by more than 160 individuals representing a wide range of interests, organizations, and viewpoints on preventing damage to underground utilities. A nonprofit organization, the Common Ground Alliance, has been formed to implement the best practices discussed in the Common Ground study. 7 Alabama State law is similar to this recommendation.

6 NTSB/PAB-00/01 Bridgeport Utilities Board Procedures for Responding to Pipeline Emergencies The Utilities Board’s written emergency procedures in effect at the time of the January 22, 1999, accident instruct service personnel to “…evaluate the extent of the emergency, request assistance as needed, and inform the manager if necessary.” The procedures further direct service personnel to: Evacuate and secure the area if necessary. Actions should be directed towards protecting people first and then property. …If, in the opinion of the person in charge, the emergency is so severe that immediate shutdown is imperative, he may do so without clearance from the Manager. However, the procedures do not instruct employees responding to a reported leak to consider the possibility of multiple leaks, check for gas accumulation in nearby buildings, and, if necessary, to take steps to promptly stop the flow of gas. During its annual inspections of the Utilities Board, the Alabama Public Service Commission did not identify any deficiencies in the Utility Board’s emergency procedures. Since the accident, the emergency procedures have been changed only to update the names, addresses, and phone numbers of contact persons and employees. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the failure of R&B Construction to establish and follow safe procedures for excavation activities, resulting in damage to a ¾-inch natural gas service line, and the failure of the Utilities Board of the City of Bridgeport to provide appropriate emergency response to the resulting natural gas leak. Adopted: November 28, 2000

FD07216 ｜ 1999_美国_NTSB_PAB0101_Hazardous_Liquid_Petroleum_Products_Pipeline_Rupture_Colonia.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/PAB-01/01 Accident Number: DCA99-MP005 Owner/Operator: Colonial Pipeline Company Type of System: Hazardous liquid petroleum products pipeline Accident Type: Pipe rupture Location: Knoxville, Tennessee Product Released: Diesel fuel, high sulfur, 86 Grade Time: 11:58 p.m. EST Date: February 9, 1999 Fatalities/Injuries: None Property Damage: $7 million Quantity Released: About 53,550 gallons (1,275 barrels) Pipeline Pressure: Approximately 91 psig Component Affected: 10-inch-diameter, Grade 5L X-42, 0.250-inch wall thickness, electric resistance weld steel pipe The Accident On the afternoon of February 9, 1999, Colonial Pipeline Company (Colonial) successfully completed a delivery of diesel fuel to the East Knoxville delivery facility (East Knoxville) in Knoxville, Tennessee, using its Atlanta Junction/Knoxville stubline.1 To initiate the delivery, an operator at Colonial’s Knoxville Terminal began operating valves that directed product into a 10-inch-diameter steel pipeline leading to the East Knoxville facility, about 8 miles away. At about the same time, a valve was opened at the other end of that line to allow the product to flow into the East Knoxville facility tanks. At the completion of the delivery, the valves were closed, which left the pipeline filled with diesel fuel at a pressure of about 91 psig. About 11:58 p.m. on February 9, the supervisory control and data acquisition (SCADA) system2 at Colonial’s Atlanta control center registered and recorded a sudden drop in pressure from 91 to 72 psig at East Knoxville. After several minutes of oscillation, the pressure stabilized at 73 to 74 psig. The controller on duty in the Atlanta control center at the time of the accident stated that he normally displays the SCADA pressure strip charts3 across the two CRT screens at the top of his operating console. The SCADA

National Transportation Safety Board Washington, D.C. 20594 Pipeline Accident Brief 1 A Colonial stubline is a smaller diameter, lateral pipeline system that emanates from one of the company’s larger mainline pipelines that run from Texas to New York. 2 Pipeline controllers use the SCADA system to remotely control and monitor movement of product through the pipeline. Controllers can monitor flow rates and pressures along the lines and control valves and pipeline pumps to adjust the flow and make product deliveries. E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

NTSB/PAB-01/01

system did not alarm in response to the decrease in pressure, and the controller said he was not aware of the pressure drop. As determined later, the pressure drop occurred when the pipeline leading to East Knoxville ruptured on a Pitner Place residential property near Knoxville’s Goose Creek. On the east side of the Tennessee River, Colonial’s pipeline crosses Scottish Pike and then Pitner Place. Between midnight and 12:15 a.m. on February 10, a Scottish Pike resident walking outside his home smelled a kerosene odor, but he said he took no action in regard to the smell. At 1:02 a.m. on February 10, a resident of Pitner Place called 911 to report a very strong diesel or gasoline odor in the area. The Knoxville Fire Department responded and concluded that the reported odors came from an asphalt plant across the river from the community. Thus believing this odor did not pose any further concern but was merely a nuisance odor, the firefighters cancelled the fire call and left the scene. About 2:05 a.m., another Pitner Place resident closer to the pipe rupture, called 911 to report a very strong petroleum gas odor in the area. The fire department returned to the scene to investigate. Again, the fire company attributed the odor to the nearby asphalt plant. At 2:17 a.m., a Knoxville area resident called 911 to report oil on the Tennessee River. Meanwhile, the Atlanta controller (still unaware of the drop in the pipeline pressure) called the Knoxville operator to start another product delivery to East Knoxville. About 2:31 a.m., the Knoxville operator began operating valves to send product to the East Knoxville delivery facility. The Atlanta controller observed that the East Knoxville meter indicated no flow rate and that the pressure did not rise as expected at Knoxville. The Knoxville operator said that after waiting 4 to 5 minutes for the flow rate to register on his CRT screen, he called the Atlanta controller about the situation. The Atlanta controller called the senior controller for his shift over to the console to discuss the pipeline data, at which point the senior controller decided to terminate the delivery on the East Knoxville line. About 2:39 a.m., the Knoxville operator began shutting down the East Knoxville pipeline section and resumed using the stubline to make a delivery to another Knoxville terminal. After shutting down the line, about 2:44 a.m., the Knoxville operator called another Colonial employee at home and asked him to check out the East Knoxville delivery facility. In a discussion with the Knoxville operator at 3:01 a.m., the Atlanta controller suggested that the pipeline might have been in a slack condition (only partially filled with product) when the delivery started, but he added that the pipeline pressure should have increased faster at that time. In that discussion, he also said that the pipeline was 600 to 700 barrels short. The hourly over/short calculation shown on the controller’s log for the line showed a shortage of 725 barrels at 3:00 a.m. After the accident, the Atlanta controller said he considered the shortage “high.” He also said that 300 barrels is “getting high,” although he believed that 300 barrels could be explained as a characteristic of the opening of a delivery. According to Colonial procedures, a sudden loss of pressure and/or a change in 3 The SCADA system provides pressure data on a strip chart graphical display on a CRT screen, which displays the pressure history for about the previous hour.

NTSB/PAB-01/01

flow rate are to be interpreted as conclusive evidence of a leak. As part of Colonial’s leak detection strategy, controllers are to immediately investigate and correct any shortage calculation. At 3:45 a.m., Knoxville Fire Department responders found fuel running into Goose Creek, which discharges into the Tennessee River about 1/2 mile downstream. Noting a nearby Colonial pipeline marker with contact information, the incident commander directed a Knoxville Fire Department dispatcher trainee to contact Colonial about the leak; however, Colonial was not notified at that time. Meanwhile, the Colonial employee who had been asked to check the East Knoxville facility had driven by the site where an internal inspection tool had been removed from the pipeline on February 9 (discussed below in the “Pipeline Information” section). About 4:00 a.m., he reported that he saw no evidence of a failure in the pipeline at that location, nor did he find any problem at the East Knoxville facility. Still unaware of the nature of the problem, the Knoxville operator and the called- out Colonial employee discussed the situation with the Atlanta controller. At the end of the discussion, the Atlanta controller decided that the Knoxville operator should attempt another delivery to East Knoxville. The senior controller was not involved in the decision to restart delivery. This time, the called-out operator would be observing at East Knoxville. About 4:03 a.m., the operator attempted to pressure up the line between Knoxville and East Knoxville, but the pressure did not rise as expected. About 4:20 a.m., he again opened the East Knoxville valve to operate this pipeline section, and initially no flow was noted at East Knoxville. After a few minutes, the pressure began to fluctuate and a lower-than-expected flow rate was indicated. The hourly flow rate was expected to be more than 3,000 barrels per hour (bph); however, it peaked at approximately 2,000 bph. About 4:30 a.m., the Knoxville Fire Department found diesel fuel spraying from a pipeline onto a Pitner Place residence and running downhill into Goose Creek, which was about 170 feet from the rupture site. The incident commander asked the fire department communications center dispatcher to contact Colonial and have the company shut down the pipeline. The fire department dispatcher, who was talking to Colonial’s senior controller in Atlanta at that time, notified him of the leak and asked that the pipeline be shut down. The senior controller immediately ordered that the Knoxville stubline be shut down. The East Knoxville segment shutdown was completed at 4:35 a.m. At 4:46 a.m., the East Knoxville delivery valve was opened, and the pipeline segment was then allowed to drain into the East Knoxville terminal. According to Colonial records, the temperature of the product was approximately 61° F at East Knoxville. The ruptured pipeline released approximately 53,550 gallons (1,275 barrels) of diesel fuel. Fifteen people were reported to have voluntarily evacuated the immediate area of the leak. During the first 24 hours, the leading edge of the oil slick on the Tennessee River advanced about 6 miles downstream from Goose Creek. For the next several days, the Tennessee River in the Knoxville area was closed to navigation as containment booms were placed downriver. Nine collection points for escaped petroleum product were placed downstream of the accident site. Colonial estimated that 44,016 gallons (1,048 barrels) of product have been recovered. No fire resulted, and no injuries were reported.

NTSB/PAB-01/01

On March 3, 1999, Colonial submitted a Corrective Action Plan for Impacted Soils and Groundwater at the Goose Creek Knoxville, Tennessee, Release Site to the Tennessee Division of Solid Waste Management and Tennessee Division of Water Pollution Control. The intent of the action plan was to determine the extent of the underground diesel fuel plume and the further action needed to ensure site remediation acceptable to the State. The corrective action plan called for the excavation of all contaminated soils at the leak site that exceeded 500 parts per million, in accordance with Tennessee underground storage tank guidance cleanup guidelines. Approximately 18,000 tons of contaminated soil were excavated at the leak site area during March and April 1999. The excavated soil was transported to Waste Management’s Chestnut Ridge Landfill for disposal under the approval of the Tennessee Division of Solid Waste Management. A well survey conducted shortly after the release found no residential wells in the leak site area. The limited amount of affected groundwater encountered was treated on site. The March 3 plan stated that because the affected groundwater immediately discharges to Goose Creek, it would not contaminate other portions of the shallow groundwater system and would not affect deeper groundwater. It was therefore determined that it was not necessary to install monitoring wells at the leak site. Community Awareness At the time of the spill, Colonial had in place a 14-point public education program that it had designed to meet the requirements of 49 Code of Federal Regulations (CFR) Part 195.440, which requires oil pipelines to conduct public educational programs.4 Colonial’s public education program included mailing safety flyers to a targeted audience, including apartment dwellers, living within 1/8 mile of a pipeline. The company also provided direct mail pieces to those individuals who owned property where Colonial held easements. These materials included an annual wall calendar and a Colonial road atlas with a companion booklet that contained general information about the company. The atlas and booklet were distributed every 5 years. In areas where Colonial deemed excavator risk particularly high, company representatives participated in meetings to educate public officials, emergency responders, and excavators. Additionally, the company distributed its atlas and companion booklet to some public officials and contractors. In both 1997 and 1998, Colonial had pipeline maps available for review at its tank farm during the emergency response coordination drills it held with the Knoxville Fire Department. A review conducted in the immediate area of the pipeline failure disclosed that Colonial pipeline easements crossed five residential properties. Colonial records indicate that various public education items were mailed to two of these residences in November and December 1997. These items addressed questions such as how to detect a pipeline accident, what to do in case of an accident, and how to report an accident. Thirteen 4 Under 49 CFR 195.440, each operator shall establish a continuing education program to enable the public, appropriate government organizations, and persons engaged in excavation-related activities to recognize a hazardous liquid pipeline emergency and to report it to the operator or the fire, police, or other appropriate public officials.

NTSB/PAB-01/01

residents were interviewed. Of those, residents from two households stated that they were aware of a pipeline in the immediate area. One resident recalled receiving a pamphlet explaining Colonial’s brush-clearing operation; however, no one was aware of any specific reporting action or personal protection measures to take in the event of a pipeline release, nor could they recall any safety awareness mailings from Colonial. The Knoxville Fire Department hazardous materials emergency response procedures were last revised and approved in January 1999 by the Knoxville County Emergency Management Agency. Fire department personnel have received training in hazardous materials team operations provided by the Tennessee Emergency Management Agency. These training courses cover hazardous materials incident response (incident command system, hazardous material identification, notification, protective equipment, etc.) at the responder, operations specialist, and technician levels. According to fire department officials, the department conducts disaster drills annually. The most recent disaster drill before the accident was on September 9, 1998. The scenario involved a joint multiagency response to an aircraft crash at the Knoxville Airport. The last chemical transportation accident drill was conducted in November 1998. This simulated an accident that involved a highway cargo tank containing acid and the release of a toxic cloud that caused two injuries. In November 1997, the Knoxville Fire Department and Colonial conducted a joint training drill at a petroleum products terminal in Knoxville. The scenario involved a pipeline rupture at a storage tank and a 1,000-gallon gasoline spill. During a tour of its facility during December 1998, Colonial discussed with Knoxville Fire Department personnel its pipeline delivery system, spill response procedures, and pipeline location maps for the city of Knoxville. In its review of this accident, the Knoxville Fire Department identified internal operations problems in its response, including the use of trainees and the fact that some of the communications channels monitored by the fire department were not recorded. Also, fire department officials identified an issue regarding the lack of pipeline location maps during the early stage of the emergency, which might have helped them locate pipelines in the complaint area. Pipeline Information The pipeline was constructed in 1962 and put into service in early 1963. The pipe installed was 10-inch-diameter, Grade 5L X-42, 0.250-inch wall thickness, electric resistance weld (ERW) steel pipe. At the rupture site, the pipeline was installed on a slope and had a slight side bend to the left below the rupture (figure 1) in the downstream flow direction. Colonial records indicate that the pipe had asphalt enamel coating. A coating defect (wrinkled coating) was also evident 2 to 3 feet upstream of the rupture (figure 2). Safety Board investigators and Colonial personnel observed no visible damage to the pipe coating that remained immediately adjacent to the rupture area before the pipe was removed for examination. Colonial did not have a toughness requirement5 for pipe when it was purchased for this pipeline, and no pipeline industry standards had been established at that time. Since July 13, 1990, Colonial’s line pipe purchasing specifications have had minimum toughness requirements that include, among other factors, a minimum acceptance criteria of 25 ft/lbs of absorbed energy at 32° F for Charpy V-Notch (Charpy) impact tests.6

NTSB/PAB-01/01

5 As a result of its investigation of a March 23, 1994, pipeline accident in Edison, New Jersey, the Safety Board issued the following safety recommendation to the U.S. Department of Transportation’s Research and Special Programs Administration (RSPA): P-95-2 Develop toughness standards for new pipe installed in gas and hazardous liquid pipelines, especially in urban areas. In June 1995, in response to a request from RSPA, the American Petroleum Institute (API) organized a task group to revise the specification for line pipe, API Specification 5L, to include minimum toughness requirements. In January 2000, the revised 42nd Edition of API Specification 5L was published. It contains two pipe product specification levels with Product Specification Level 2 (PSL-2) having a required minimum fracture toughness level for new pipe. Safety Recommendation P-95-2 remains “Open-Acceptable Response.” 6 Charpy V-Notch impact tests that measure the energy absorbed by a given thickness of material at a given temperature were used to evaluate the fracture toughness of materials. Figure 1. Pipeline on slope showing side bend to the left beyond the rupture. Rupture Site

NTSB/PAB-01/01

A hydrostatic pressure test to 649 psig was completed on February 4, 1995, on the East Knoxville pipeline segment. The maximum operating pressure (MOP) for the pipeline was determined to be 519 psig at the Knoxville station, which calculates to 552 psig at the rupture location. The allowable surge pressure, based on pipeline Federal safety regulations (1.1 x MOP), is 571 psig at the Knoxville station and 607 psig at the rupture location. Colonial records indicate that the typical operating pressure at the rupture location ranges between 72 and 250 psig, and the number of operating cycles for that range is at least 144 per year for the East Knoxville section of the pipeline. Internal inspections with different types of “smart pigs” were performed in 1989 and 1999. The 1989 inspection was done using a conventional magnetic flux internal inspection tool. The internal inspection company graded the inspection log, and no defects were indicated at the rupture point. Colonial reported that repairs were made to other areas of the pipeline as a result of the 1989 inspection. The pipeline was internally inspected again using a high-resolution magnetic flux inspection tool on February 8, 1999. The inspection tool became stuck at one of several dents about 4,000 feet upstream of the East Knoxville station (about 1.7 miles downstream of the rupture site). The pipeline was pressurized a number of times to dislodge the inspection tool and push it ahead. SCADA logs indicate that the pressure on the pipeline reached 546 psig at the Knoxville station, which calculates to approximately 580 psig at the rupture location. The effort to dislodge the tool using pressure was unsuccessful, and on the afternoon before the rupture, the section of pipe containing the tool was cut from the pipeline and replaced with new pipe. Product was transported through the line after the Figure 2. Wrinkled coating 2 to 3 feet upstream of the circumferential crack that terminates at the 9 o’clock position. Rupture Wrinkled Coating

NTSB/PAB-01/01

repair. The high-resolution magnetic flux inspection indicated no defects such as dents, gouges, or significant corrosion at the failure location. Colonial uses an impressed current cathodic protection7 system to protect its pipelines. Company records indicate that the rectifier system was operating properly before the accident. Annual corrosion survey records for 3 years prior to the accident indicate the pipe-to-soil potential levels8 were –0.85 volt or more negative with reference to a copper-copper sulfate reference electrode.9 Materials Laboratory Examination When the pipe was exposed, a circumferential crack was found around the top half of the pipe’s diameter (figure 3), and no pipe coating remained in the area of the crack. The crack was not located in a girth weld, visible dent, or gouge; however, the crack ran through an area of surface corrosion. Close examination of the fracture surface established that the crack initiated at an area with at least nine separate darkly colored thumbnail- shaped corroded regions (thumbnails). The failure initiation region was centered at the 3 o’clock position (looking downstream, toward East Knoxville) in the area of the external surface corrosion. The thumbnail shape, dark coloration, and fracture surface features were consistent with corroded preexisting cracks that initiated on the external surface of the pipe and propagated radially inward. None of these preexisting cracks penetrated through the pipe wall, with 0.120-inch being the deepest penetration observed, which was 48 percent of the nominal pipe wall thickness. Similar corroded preexisting cracks were noted nearby in the surface corrosion area. The crack ran in both directions from its initiation point. The crack propagated clockwise past the longitudinal weld seam. In the clockwise direction, the brittle fracture extended less than 0.5 inch before changing to a ductile fracture. In the counterclockwise direction, the brittle fracture extended over the top of the pipe to approximately the 9 o’clock position, where it also terminated in a ductile fracture. (Refer to figure 2.) Scanning electron microscope examination of the fracture face revealed heavy oxide deposits on the thumbnails that obscured some and obliterated other fracture details; however, sufficient detail was visible to indicate that the thumbnails originated at shallow corrosion pits on the external surface. Each of the thumbnail regions was associated with surface corrosion damage and typically had one or two crack origin sites. In some 7 Cathodic protection is a corrosion mitigation method used by the pipeline industry to protect underground metal pipes. The system uses rectifier stations along the pipeline to supply protective electrical current. Cathodic protection current is forced to flow in the opposite direction of currents produced by corrosion cells. A rectifier converts alternating current from the utility service to direct current and supplies it to a ground bed that typically contains a string of suitable anodes, with soil as an electrolyte, to provide a path for the current from the rectifier to the pipeline. A cable connected to the pipeline provides the return path to complete the circuit. 8 The pipe-to-soil potential is defined as “the voltage difference between a buried metallic structure [pipe] and the electrolyte [soil], measured with a reference electrode in contact with the soil.” From H.L. Gordon, Cathodic Protection, Power Plant Electrical Reference Series, Project 2334, Electric Power Research Institute, Palo Alto, California, 1991, vol. 11, p. 11.2. 9 Pipeline companies perform pipe-to-soil potential surveys by measuring and recording the voltages and currents at test stations along the pipeline and at rectifiers. Measurement intervals vary widely from less than 100 feet in some locations to several miles in others.

NTSB/PAB-01/01

instances, crack arrest marks were visible within the thumbnail regions. The preexisting crack features in the failure initiating area were consistent with environment-induced cracking.10 After the accident, Colonial had an independent lab perform Charpy tests on specimens prepared from the failed pipe joint. Longitudinal pipe specimens were tested at temperatures ranging between 25° and 170° F. The full-size energy values11 for absorbed energy in the longitudinal direction were from 3.4 to 21.8 ft/lbs between 25° and 65° F, and 40.2 ft/lbs at 85° F. The results between 105° and 170° F were from 62 to 77.1 ft/lbs. The Safety Board also had Charpy testing performed on test specimens taken in proximity to the rupture. The tests were conducted in both the longitudinal and circumferential direction at a range of temperatures between 0° and 85° F. The test results in the longitudinal direction indicate absorbed energy values from 4.2 to 15 ft/lbs between 0° and 65° F, and 54 ft/lbs at 85° F. The results in the circumferential direction indicate values from 4.6 to 22 ft/lbs between 0° and 85° F. Figure 3. Circumferential crack on top half of pipe with failure initiation region at the 3 o’clock position. 10 Environment-induced cracking occurs due to the combined effects of tensile stress and a corrosive environment. If a susceptible material under static tensile stress is exposed to a specific corrosive medium, the failure is defined as stress corrosion cracking. If the material is exposed to cyclic tensile stresses in a corrosive environment, the failure is defined as corrosion fatigue. 11 Sub-size specimens were tested and full-size energy values were calculated in accordance with ASTM E23 for all Charpy absorbed energy data.

NTSB/PAB-01/01 10 Actions Taken Since the Accident Since the accident, Colonial has updated its public education program to reach a target audience within a minimum of 1/4 mile of its pipeline operating area, regardless of whether the property is traversed by a pipeline easement. Colonial has also updated the educational information in its safety pamphlet and upgraded the method by which the safety information is communicated to the target audience. Colonial has also updated its public education program mailings to better reach its target audience. The first paragraph of each educational mailing now encourages the initial reader to share the information with all members of the household. In addition, Colonial has upgraded its written procedures for establishing and maintaining liaison with fire, police, and other agencies that might respond to a hazardous liquid pipeline emergency. The procedures identify the methods to be used, the information to be shared, and the frequency of the contacts. Since the Knoxville accident, Colonial’s control center operations manual for abnormal and emergency operations has been amended to include the following: “Any time an unscheduled shutdown occurs, the line will only be re-started with the concurrence of a Senior Controller.” At the time of the accident, Colonial’s control center operations manual directed that for continuous minor hourly shortages, the controller would investigate by having all active facilities “prove” (verify the accuracy of) the meters. If proving meters did not correct the shortages, controllers were to contact the senior controller for a decision to possibly pressure-test the line or shut it down for inspection. Colonial’s control center operations manual for emergency operations involving leaks or suspected leaks has been amended to include the following: Any time a line is shut down to investigate a continuous minor hourly shortage, the line will only be re-started with the concurrence of a representative from the Engineering Services Team. Colonial is using the details surrounding this event in various training scenarios and has added the Knoxville accident scenario to its maximum critical event training. Colonial uses simulator training as part of its controller training. Colonial is continuing its efforts to install an automated leak detection system. Colonial is currently installing a batch tracking system on a Colonial stubline system similar to the one involved in this accident. This new system is expected to aid the pipeline controller in identifying variances in the amount of product shipped versus the amount of product delivered. Any discrepancies identified above a predetermined threshold will be investigated as a possible leak. Colonial has experienced some difficulty in completing the installation of this system but anticipates completion in the first half of 2001. Once the first system is successfully installed, Colonial anticipates installing the batch tracking system on other stublines. When all the stublines are addressed, Colonial anticipates attempting to apply the same batch tracking system to the company’s mainlines, although the company expressed some concern about the effect that the size and the complexity of the mainlines will have on the performance of the batch tracking system. Colonial is developing a formal, documented strategic plan on how to approach the identification, evaluation, and application of technology to leak detection on Colonial’s

NTSB/PAB-01/01 11 system. This plan is scheduled to be fully developed in 2001. The objective of the plan is to find and implement effective means of leak detection and to comply with the new Office of Pipeline Safety regulations on integrity management of pipelines that affect high-consequences areas. The Knoxville Fire Department incident commander held a postaccident debriefing with Knoxville communication center personnel, established new procedures for the communications center, and requested that Colonial provide maps for fire department use. Because of the delay in notifying Colonial that occurred in this accident, procedures have been changed so that (1) the communications center will not rely solely on dispatcher trainees during periods of heavy workload; (2) the supervisors will assist the dispatcher during periods of heavy workload; and (3) the communications center will record all communications channels to create a record of emergency response conversations. Also at the request of the Knoxville Fire Department, Colonial provided the department with pipeline location maps to be carried by fire department units responding to calls involving the possible release of hazardous materials. The department also uses the maps during annual fire department training sessions at the Colonial terminal facility. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was pipe rupture initiated by environment-induced cracking in an area of pipe coating failure. A contributing factor to the failure was the relatively low fracture toughness of the pipe. Contributing to the severity of the accident was Colonial Pipeline Company’s failure to determine from the supervisory control and data acquisition system that a leak had occurred, with the result that the pipeline controller started and restarted the pipeline, thereby increasing the amount of diesel fuel that was released. Approved: March 28, 2001

FD07217 ｜ 1999_美国_NTSB_PAR0202_Pipeline_Rupture_and_Release_of_Gasoline_Olympic_Pipeline_Co.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Pipeline Accident Report Pipeline Rupture and Subsequent Fire in Bellingham, Washington June 10, 1999 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/PAR-02/02 PB2002-916502

this page intentionally left blank

Pipeline Accident Report Pipeline Rupture and Subsequent Fire in Bellingham, Washington June 10, 1999 NTSB/PAR-02/02 PB2002-916502 National Transportation Safety Board Notation 7264A 490 L’Enfant Plaza, S.W. Adopted October 8, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Pipeline Rupture and Subsequent Fire in Bellingham, Washington, June 10, 1999. Pipeline Accident Report NTSB/PAR-02/02. Washington, DC. Abstract: About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-inch-diameter steel pipeline owned by Olympic Pipe Line Company ruptured and released about 237,000 gallons of gasoline into a creek that flowed through Whatcom Falls Park in Bellingham, Washington. About 1 1/2 hours after the rupture, the gasoline ignited and burned approximately 1 1/2 miles along the creek. Two 10-year-old boys and an 18-year-old young man died as a result of the accident. Eight additional injuries were documented. A single-family residence and the city of Bellingham’s water treatment plant were severely damaged. As of January 2002, Olympic estimated that total property damages were at least $45 million. The major safety issues identified during this investigation are excavations performed by IMCO General Construction, Inc., in the vicinity of Olympic’s pipeline during a major construction project and the adequacy of Olympic Pipe Line Company’s inspections thereof; the adequacy of Olympic Pipe Line Company’s interpretation of the results of in-line inspections of its pipeline and its evaluation of all pipeline data available to it to effectively manage system integrity; the adequacy of Olympic Pipe Line Company’s management of the construction and commissioning of the Bayview products terminal; the performance and security of Olympic Pipe Line Company’s supervisory control and data acquisition system; and the adequacy of Federal regulations regarding the testing of relief valves used in the protection of pipeline systems. As a result of this investigation, the National Transportation Safety Board issues safety recommendations to the Research and Special Programs Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916502 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Pipeline Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Accident Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 System Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Engineering Assistant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 The Accident Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Pipeline Operation and Control: The SCADA System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Excavations in Proximity to the Olympic Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Pipeline In-line Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Regularly Scheduled Magnetic Flux Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Washington Department of Ecology Administrative Order . . . . . . . . . . . . . . . . . . . . . . 26 Olympic Postinspection Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 The Bayview Products Terminal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Overpressure Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Valve Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Operations Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Postaccident Pipeline Excavation and Segment Retrieval . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Laboratory Examination of the Ruptured Pipeline Segment . . . . . . . . . . . . . . . . . . . . . 42 Laboratory Examination of the Second Damaged Pipeline Segment . . . . . . . . . . . . . . 44 Testing of Additional Material Samples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Testing of Relief Valve RV-1919 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Review of Computer Files and Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Postaccident Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Management Restructuring of Olympic Pipe Line Company . . . . . . . . . . . . . . . . . . . . 48 OPS Investigation and Corrective Action Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Evaluation of Bayview Products Terminal Design and Operation . . . . . . . . . . . . . . . . 49 Evaluation of Pipeline Valve Spacing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 SCADA System Performance and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Federal Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 OPS Preaccident Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Environmental Response and Remediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Damage to the Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Contents iv Pipeline Accident Report Excavations in the Area of the Eventual Rupture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Evaluation of In-line Inspection Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 SCADA System Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Actions of the Accident Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Company Oversight of Bayview Products Terminal Construction . . . . . . . . . . . . . . . . . . . 66 Control Valve CV-1904 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Relief Valve RV-1919 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 B: Office of Pipeline Safety Corrective Action Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

v Pipeline Accident Report Executive Summary About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-inch-diameter steel pipeline owned by Olympic Pipe Line Company ruptured and released about 237,000 gallons of gasoline into a creek that flowed through Whatcom Falls Park in Bellingham, Washington. About 1 1/2 hours after the rupture, the gasoline ignited and burned approximately 1 1/2 miles along the creek. Two 10-year-old boys and an 18-year-old young man died as a result of the accident. Eight additional injuries were documented. A single-family residence and the city of Bellingham’s water treatment plant were severely damaged. As of January 2002, Olympic estimated that total property damages were at least $45 million. The Safety Board determines that the probable cause of the June 10, 1999, rupture of the Olympic pipeline in Bellingham, Washington, was (1) damage done to the pipe by IMCO General Construction, Inc., during the 1994 Dakin-Yew water treatment plant modification project and Olympic Pipe Line Company’s inadequate inspection of IMCO’s work during the project; (2) Olympic Pipe Line Company’s inaccurate evaluation of in-line pipeline inspection results, which led to the company’s decision not to excavate and examine the damaged section of pipe; (3) Olympic Pipe Line Company’s failure to test, under approximate operating conditions, all safety devices associated with the Bayview products facility before activating the facility; (4) Olympic Pipe Line Company’s failure to investigate and correct the conditions leading to the repeated unintended closing of the Bayview inlet block valve; and (5) Olympic Pipe Line Company’s practice of performing database development work on the supervisory control and data acquisition system while the system was being used to operate the pipeline, which led to the system’s becoming non-responsive at a critical time during pipeline operations. The major safety issues identified during this investigation are as follows: • Excavations performed by IMCO General Construction, Inc., in the vicinity of Olympic’s pipeline during a major construction project and the adequacy of Olympic Pipe Line Company’s inspections thereof; • The adequacy of Olympic Pipe Line Company’s interpretation of the results of in- line inspections of its pipeline and its evaluation of all pipeline data available to it to effectively manage system integrity; • The adequacy of Olympic Pipe Line Company’s management of the construction and commissioning of the Bayview products terminal; • The performance and security of Olympic Pipe Line Company’s supervisory control and data acquisition system; and • The adequacy of Federal regulations regarding the testing of relief valves used in the protection of pipeline systems. As a result of this investigation, the National Transportation Safety Board issues safety recommendations to the Research and Special Programs Administration.

this page intentionally left blank

1 Pipeline Accident Report Factual Information Accident Synopsis About 3:28 p.m., Pacific daylight time, on June 10, 1999, a 16-inch-diameter steel pipeline owned by Olympic Pipe Line Company (Olympic)1 ruptured and released about 237,000 gallons of gasoline into a creek that flowed through Whatcom Falls Park in Bellingham, Washington. About 1 1/2 hours after the rupture, the gasoline ignited and burned approximately 1 1/2 miles along the creek. Two 10-year-old boys and an 18-year- old young man died as a result of the accident. Eight additional injuries were documented. A single-family residence and the city of Bellingham’s water treatment plant were severely damaged. As of January 2002, Olympic estimated that total property damages were at least $45 million. (See figure 1.) Accident Narrative On the afternoon of June 10, 1999, two pipeline controllers were on duty at Olympic’s control center at Renton, Washington, with each controller operating a different section of Olympic’s 400-mile pipeline system. One controller was operating that part of the system that included a 16-inch-diameter pipeline extending from Cherry Point south to Renton station. This was the pipeline that was involved in this accident. This controller (henceforth referred to as the “accident controller”) was controlling the movement of gasoline from an Atlantic Richfield Company (ARCO) refinery near the Cherry Point pumping station to a Tosco storage facility near Renton.2 The other controller was operating a separate pipeline system. (See figure 2.) 1 At the time of the accident, Olympic was a corporation consisting of three shareholders: Equilon Pipeline Company LLC (Equilon), Atlantic Richfield Company, and GATX Terminal Corporation, with Equilon under contract to manage operation of the pipeline for Olympic (This assertion is disputed by Equilon. For convenience, the Safety Board in this report will refer to Olympic as the pipeline operator.). Since the accident, several ownership and managerial changes have occurred within the Olympic organization with the overall result that British Petroleum (BP) is now the majority owner with responsibility for operation of the pipeline. At the time of the accident Equilon was wholly owned by Equilon Enterprises, Inc., which was owned jointly by affiliates of Texaco, Inc., and affiliates of Shell Oil Company. Since the accident, Shell has acquired the Texaco holdings, and the company is now Shell Pipeline Company, LP. 2 Because of a criminal investigation into the accident, neither the accident controller nor his immediate supervisor (the supervisor of products movement) would discuss the accident with Safety Board investigators. The information contained herein is based on interviews with other Olympic employees and on the event log recorded by the system computer. As the accident controller and his supervisor declined to be interviewed by the Safety Board, further details on what actions were performed by the controller, and the appropriateness of those actions, are unavailable.

Factual Information 2 Pipeline Accident Report Olympic operated its pipeline through use of a computerized supervisory control and data acquisition (SCADA) system.3 Olympic’s SCADA system used two identically configured computers, which the company had designated OLY01 and OLY02. One of the SCADA computers was used as the primary system, with the other available as a backup. Figure 1. Postaccident aerial view of portion of Whatcom Creek showing fire damage. 3 Pipeline controllers use the SCADA system to remotely control movement of product through the pipeline. Controllers can monitor flow rates and pressures along the lines and use equipment, such as control valves and mainline pumps, to adjust the flow and make product deliveries.

Factual Information 3 Pipeline Accident Report At the time of the accident, Olympic was using OLY02 as the primary control system, with OLY01 as the backup. Controllers had reported no problems with the SCADA system earlier in the day on June 10. (The Olympic SCADA control system is discussed in more detail later in this report.) Also on duty in the control center on June 10 was an Olympic pipeline controller who had been temporarily assigned as a computer system administrator. The system administrator told the Safety Board that beginning shortly before 3:00 p.m. on June 10, while working at a workstation in the computer room, he created new records for the SCADA historical database. The new records would be used to hold pump vibration data that could later be extracted and analyzed. He was working on the OLY02 system, which was the primary system in use at the time.4 He said that after he finished the new records and had entered them into the system, he began a check of the error logs to make sure the operation was going as intended. He said the error logs initially showed no errors, but about 3:10,5 they began to show errors related to the historical database. The SCADA administrator said he repeatedly checked the format of the new records and found no errors; thus, he believed something other than the new records was causing the problem. He said he then left the control center. Meanwhile, about 3:00, the accident controller, using the SCADA system, had begun preparing to discontinue product delivery to the Tosco facility and initiate delivery of gasoline to ARCO’s Harbor Island terminal in Seattle. According to the OLY02 event logger, delivery to Tosco was terminated at 3:17:43. At 3:20,6 the accident controller contacted personnel at ARCO’s Cherry Point refinery and asked them to begin transferring product from the refinery to the adjacent Cherry Point pumping station.7 As the delivery points were switched, pressure in the 16-inch pipeline began to build upstream from the delivery point. Controllers said such an increase was normal and that the initial response was usually to start a second pump at the unattended Woodinville station. The accident controller issued a command on OLY02 to start the second pump at Woodinville. At 3:18:58, the event log indicates that the system failed to execute the command. At the same time, the SCADA system displayed an alarm from Allen station because of a high discharge pressure of 1,444 pounds per square inch, gauge (psig). Almost simultaneously, the controller operating the other pipeline section noted that the OLY02 system had become unresponsive to his commands. He reported the condition to the system administrator, who had returned to the control center. 4 The SCADA system was designed so that the database of the primary computer would automatically be “mirrored” to the backup unit. In this case, the work being performed by the system administrator would automatically be captured on the database of both the OLY01 and OLY02 computers. The SCADA system was configured to allow new database records to be created while the system was on line. 5 Henceforth in this report, unless otherwise noted, all times are p.m., Pacific daylight time and were taken from the SCADA (OLY01 and 02) event log. 6 Times reported by ARCO were based on logs generated by their employees and are not synchronized with Olympic’s SCADA system clock. 7 The ARCO refinery had pumps that drew product from tanks and transferred it through approximately 1/2 to 3/4 mile of 16-inch-diameter pipeline to Olympic’s Cherry Point station, adjacent to the northwest corner of the refinery.

Factual Information 4 Pipeline Accident Report Figure 2. Olympic Pipe Line Company system. 16” 16” 20”

Factual Information 5 Pipeline Accident Report The system administrator said he returned to the computer room and noticed the computer was unresponsive at about the same time he was notified of it by the controller. He said he then attempted to delete from OLY01 (then the backup system) the new records he had created. He planned to bring OLY01 on line to take over for the unresponsive OLY02. An electrician on duty at the Allen pumping station at the time said that he was contacted by the accident controller, who asked him to shut down a pumping unit at Allen station because the controller had lost communications and was unable to do so remotely. The electrician shut down one of the units and reported back to the controller. The event log indicates that the first unit at Allen station was shut down at 3:23:34. The OLY02 system’s event logger continued to record events for several minutes after the system became unresponsive to controller input. At 3:22:59, the system recorded that a booster pump had shut down at the Bayview terminal (about 2 miles upstream of Allen station), followed a few minutes later, at 3:24:53, by the uncommanded shutdown of the Bayview terminal. As the station shut down and the pressure increased, the OLY02 system recorded a high pressure alarm at Bayview and the subsequent initiation of the closure of the inlet block valve (thus closing off the pipeline) upstream of Bayview terminal. These were the last events recorded by the OLY02 system before the administrator took the system off line. As the block valve closed and stopped product flow into Bayview, the SCADA system captured pressure data upstream of this inlet block valve that indicated a pressure increase from 215 psig at 3:27 to 1,494 psig at 3:28 (as the block valve closed). At 3:29, the system recorded the pressure at this location dropping back down to 230 psig. (It would later be determined that this pressure drop was the result of a rupture in the pipeline that occurred between the Ferndale and Bayview stations at about 3:28.)8 (See figure 3.) Because OLY02 was not responding to commands, the administrator was not able to effect the normal transfer from OLY02 to OLY01; instead, he said he had to halt OLY02 to initiate the change. OLY01 came on line about 3:28. At 3:28:05, the system recorded that the inlet block valve upstream of Bayview terminal was closed. Within seconds, the system also recorded the uncommanded shutdown of pumps at the Cherry Point and Ferndale stations. With the shutdown of the Cherry Point and Ferndale pumping stations, the 16-inch pipeline was essentially shut down from Cherry Point to Renton, with a single pumping unit at Woodinville the only remaining operating pump. The controller operating the other pipeline section told investigators that he noticed that the 16-inch line had gone down and that, because the accident controller had left the room, he issued an OLY01 command to shut down the pump at Woodinville. The event log indicates that commands were issued to shut down the remaining unit at 8 Because the SCADA system was slow or unresponsive between about 3:10, when the computer problems were first noted, and about 3:48, when OLY02 came back on line and stabilized, it could not be determined how much of the information recorded by the system during this period was available to the controllers at that time.

Factual Information 6 Pipeline Accident Report Woodinville at 3:29:35 and again at 3:30:41. The event log also records an uncommanded shutdown of the Woodinville unit at 3:31:04. When the accident controller returned a few minutes later, the other controller told him that the line was down and that he had shut down the Woodinville pump. At approximately 3:35, the accident controller contacted ARCO and asked that transfer of product from the refinery to the Cherry Point station be suspended. According to the system administrator, the OLY01 computer had never come up fully “healthy and alive,” so he decided to revert back to OLY02 as the primary. The last recorded SCADA entry for OLY01 was at 3:34:17, after which OLY01 was halted. The rebooted OLY02 came back on line at 3:44:30. The system administrator said that about that time, the control center supervisor (supervisor of product movement) came into the control center and then the computer room. He said he explained what had happened, after which the supervisor went into OLY02 and deleted the new records that had been mirrored Figure 3. Graph displaying pressure trend upstream of Bayview terminal at time of acci- dent. Note pressure spike and subsequent drop as pipe ruptured. (Graph generated by the Safety Board based on Olympic SCADA data. Such a display had not been developed for the controller to readily access on the day of the accident, and investiga- tors could not determine precisely when the information would have been available to the controller if he had attempted to display it.)

Factual Information 7 Pipeline Accident Report from one computer to the other. The system administrator said he noticed that the records now contained a typographical error that he said was not there when he created them. The system administrator said that at about 4:00, the accident controller came into the computer room and asked if the pipeline could be restarted. The administrator said the control center supervisor answered that it could. About 4:04, the system administrator restarted OLY01, allowing data from that computer’s database (which included data captured at the time of the rupture) to be transferred to the OLY02 system. According to the OLY02 data logger, the accident controller, at 4:11:22, reopened the inlet block valve at Bayview. The electrician at Allen station (downstream of Bayview) reported that he was again contacted by the accident controller and asked to verify the pressure (either suction or discharge, the electrician could not remember which) at the station. He said he reported the pressure to the controller and stated that the controller responded that that sounded “about right” to him. The electrician said he did not deem this activity abnormal and stated that the controller did not seem concerned. At approximately 4:15, the accident controller contacted the ARCO refinery and asked that product transfer be reinitiated. At 4:16:29, the accident controller started a pump at the Cherry Point station, followed at 4:17:34 by the starting of a pump at the Ferndale station. A computerized pipeline leak detection system software package was running on the Olympic system. The software used both volume balancing and real-time transient modeling based on pressure and other pipeline operating data collected through the SCADA system to detect, and alert controllers to, possible leaks.9At 4:29:22, a SCADA alarm indicated that the leak detection software issued an alert.10At 4:30:52, the accident controller issued a command to start another pump at Ferndale station. The pump started at 4:31:39. About this same time, an Olympic employee, who had been on his way home, called the Olympic control center to report smelling gasoline at a bridge over Whatcom Creek. This employee had already called 911 to report the gasoline odors. Shortly thereafter, pumps went down at the Cherry Point and Ferndale stations. At 4:32:18, the accident controller initiated the closing of mainline block valves to isolate the rupture location. Those valves were recorded as closed at 4:34:14, about 1 hour and 5 minutes after the rupture. At about 4:35, the accident controller again contacted ARCO and asked that the transfer be discontinued. ARCO personnel stated that it was not uncommon for shutdowns to occur and that they were given no reason for the shutdown request. They also stated that the conversations were brief and to the point. 9 Although the leak detection system software runs on its own computer, separate from the SCADA system, it requires a SCADA data feed and at least 15 minutes of baseline data upon which to run its analysis. 10 The leak detection system first issues an “alert.” If pipeline conditions are not reconciled, the system issues an alarm.

Factual Information 8 Pipeline Accident Report Meanwhile, ARCO personnel at the Harbor Island terminal had been told to expect delivery of product starting at about 4:20. When the delivery did not begin as expected, those personnel, at about 4:30, contacted the Renton control center and asked when delivery might be expected to begin. The Olympic controller who answered the call reported that there was a problem, but he did not elaborate, nor could he predict when delivery might be expected. Approximately 30 to 45 minutes later, after receiving a call from an ARCO employee who had witnessed a fireball ignition, ARCO personnel contacted Olympic to ask if the fire involved Olympic and whether the valves into the terminal should be closed. They were told that Olympic was involved and that the valves should be closed. After the accident, Olympic contracted with Stoner Associates to perform hydraulic modeling of its system to determine the pressure profile along the pipeline during the accident sequence. The Stoner modeling indicates that the pressure reached 1,433 psig at the rupture location. The model further predicted pressures of 1,402 psig at the Ferndale discharge and 1,515 psig at the inlet to Bayview. Pressures recorded during the accident reached a maximum of 1,500 psig at the Bayview inlet before the pipeline ruptured. The paper on the pressure-recording chart at Ferndale had run out the day before the accident. Emergency Response The rupture occurred within the Dakin-Yew water treatment plant, which is owned and operated by the city of Bellingham. The released product proceeded to flow from the subsurface to the surface and then into Hannah Creek, a tributary of Whatcom Creek. Once the product reached Hannah Creek, it flowed approximately 1,200 feet northwest to its confluence with Whatcom Creek.11 About 4:24,12 a 911 operator at the Bellingham Fire Department communication center received a telephone call from a citizen who reported that as she was driving across the bridge on Woburn Street, she smelled an “incredible odor” that made breathing difficult. A minute later, the first engine was dispatched to the area for an “outside odor investigation.” At 4:26, the crew of Bellingham Fire Department engine 54, which had just completed a training assignment, answered the call because the location was in the crew’s area of response. At 4:27, the resident of a dwelling near Whatcom Creek called 911 and reported a strong petroleum odor. He also reported that Whatcom Creek was discolored. A short time 11 Whatcom Creek’s headwater originates at Lake Whatcom. The creek flow is generally east to west for 1 mile within Whatcom Fall Park and then extends through residential and business areas in Bellingham before it empties into Bellingham Bay, a part of Puget Sound. The rupture location is approximately 3 miles inland (east) of Bellingham Bay. 12 Times in this section are from emergency response agency records.

Factual Information 9 Pipeline Accident Report later, the same resident made a second call to 911 and stated that his dog was convulsing and that he was evacuating his residence because the odor was overwhelming. The fire department dispatcher notified the responding fire captain that more calls about unusual odors were being received. The fire captain upgraded the response to a Hazmat 1 incident.13 As a result, additional resources were dispatched to respond to the incident. At 4:30, an employee of Olympic Pipeline Company who happened to be in the area called 911 on his cellular phone. He reported the presence of gasoline fumes, gave his location as the Woburn Street Bridge over Whatcom Creek, and said he would remain at that location until the fire department arrived. The Olympic employee then called the Olympic control room in Renton to alert personnel there to the situation. At 4:33, the fire captain upgraded the incident to a Hazmat 2 incident.14 He then advised the fire department dispatcher that gasoline was present in Whatcom Creek and asked that the Bellingham Police Department respond and close the bridges crossing Whatcom Creek and the streets adjacent to the creek. Four Bellingham Police Department units responded immediately and began to stop traffic and establish a perimeter around the area. The deputy director of the Whatcom County Division of Emergency Management was monitoring the Bellingham Fire Department radio. The deputy director called the Whatcom County Division of Emergency Management program specialist by mobile telephone to confirm that he had been monitoring the call for the “outside odor investigation.” When conditions were escalated to a Hazmat 2 incident, the deputy director and the program specialist agreed that the program specialist would respond to the incident command post and represent the Whatcom County Division of Emergency Management. At 4:37, the specialized emergency response program team15 was notified by page that the incident was presently a Hazmat 2 incident, and the public works department was notified that barricades would be needed to stop access to the Whatcom Creek area. The Bellingham Fire Department battalion chief 1, who was the incident commander, arrived on scene at 4:45 and established a command post. 13 A Hazmat 1 incident is defined as an incident or threat of a release that (1) may be controlled by the first response agencies, (2) may only require evacuation of the incident site, and (3) does not pose an immediate threat to life or property. 14 A Hazmat 2 incident is defined as an incident that involves a greater hazard or larger area than a Hazmat 1 incident and that poses a potential threat to life, property, or the environment and/or may require a limited evacuation of the area surrounding the incident or that may require expertise or resources of the State government or private organizations/individuals. 15 The specialized emergency response program team is a hazardous materials response team that is administered by the Bellingham Fire Department and that consists of members from professional and volunteer fire departments and from industries who have expertise in hazardous materials response. The supervisor activated the team at 4:42.

Factual Information 10 Pipeline Accident Report At 4:46, the fire department dispatcher called the Olympic emergency response number. The Olympic employee answering the call stated, “We got people on the way, and our line is shut down at this particular point.” The Olympic control center supervisor told the fire department dispatcher that Olympic had field personnel on site. The fire department dispatcher then notified the incident commander that personnel at the Whatcom Creek fish hatchery had been notified, that Olympic had personnel on site, and that the pipeline was shut down. The fire department dispatcher called a local radio station and asked that it alert the public of the incident and of the need to avoid the Whatcom Creek area. A Bellingham Police Department sergeant arrived at the command post at 4:55. The incident commander requested that the police department evacuate an area 150 to 200 feet on the north and south sides of Whatcom Creek. The incident commander asked that no traffic be allowed to cross Whatcom Creek. Shortly thereafter, a Bellingham Police Department lieutenant arrived and began to devise a plan to evacuate the Whatcom Creek area. The lieutenant requested assistance from the Washington State Patrol and the Whatcom County Sheriff’s Office. Olympic called the fire department dispatcher at 4:57 to report a possible release of product into Whatcom Creek. At 5:02, fire department personnel reported witnessing a fire igniting in Whatcom Creek. Bellingham Police Department personnel also witnessed the ignition. The police department lieutenant immediately requested all police units to patrol in their vehicles along the 200-foot evacuation area of Whatcom Creek and use the vehicles’ public address systems to warn residents and pedestrians to evacuate the area. The Bellingham Police Department lieutenant advised all responding police personnel who were not in the process of evacuating buildings to stop all traffic near the creek. At the same time, the Whatcom County disaster plan was implemented, and the deputy director activated the emergency operations center. The emergency operations center was staffed, and notifications of the incident were made to key personnel. The gasoline pool fires extended approximately 1 1/2 miles from the pipe break at the Dakin-Yew plant, approximately 1,200 feet down Hannah Creek to its confluence with Whatcom Creek, and through industrial and residential areas of Bellingham. The incident commander requested the full response of the Bellingham Fire Department and the response of mutual aid fire and police departments. The Whatcom County Sheriff’s Office responded with 15 deputies. The following police departments were on site to assist: Washington State Patrol, Western Washington University Police Department, and Ferndale Police Department. At 5:20, St. Joseph Hospital, Bellingham, issued a staff alert after the fire department dispatcher advised the hospital staff of the fire in Whatcom Creek. The hospital staff prepared to receive a large number of patients and made additional notifications to the staff at Harborview Medical Center Burn Center, Seattle, Washington. About 10 minutes later, the St. Joseph Hospital emergency room staff was notified that two 10-year-old patients were being transported by ambulance to the hospital. The two

Factual Information 11 Pipeline Accident Report patients arrived at 5:40 and were subsequently airlifted by helicopter to the Harborview Medical Center by 6:25. At 5:30, a Bellingham Police Department command post was established for the 29 police department personnel who had been involved in the incident. The Bellingham Mountain Search and Rescue team arrived and began a primary search of Whatcom Falls Park and Whatcom Creek. The search and rescue team subsequently located the body of the 18-year-old young man who had been fatally injured. The search and rescue team then conducted a secondary search for victims. The incident commander estimated that the gasoline in Whatcom Creek burned for approximately 1 hour. Small brush fires continued to burn along the creek banks and eventually were extinguished by Whatcom County Fire Protection Districts 1–8. On June 14, 1999, foam was applied to extinguish the last fire in the water treatment plant near the pipeline rupture. By this time, the extensive fires had burned 25 acres throughout the area. Olympic personnel had determined that the “initial worst-case spill estimate” was around 6,598 barrels of ARCO unleaded regular gasoline. The final loss calculation, made after measuring the remaining product displaced from the line, showed a release of 5,638 barrels (236,796 gallons) had occurred. Of this total, Olympic estimated that 1,890 barrels were released as the line was restarted, with the balance lost through drain down of the pipeline. (See the “Other Information” section of this report for detailed information on postaccident environmental remediation.) Injuries A police officer patrolling the accident area was alerted by residents that two boys needed medical assistance. The police officer immediately called for the assistance of a Bellingham Fire Department medic unit. The two 10-year-old boys were taken by ambulance from the 1900 block of Iowa Street to St. Joseph Hospital in Bellingham. Hospital staff stabilized them before each patient was flown by helicopter to the burn unit of Harborview Medical Center in Seattle. Each boy had received extensive second and third degree thermal burn injuries of the head, trunk, and extremities (80 to 90 percent total body surface area). Both boys died on June 11, 1999. The body of an 18-year-old man was found in Whatcom Creek by members of the Bellingham Mountain Search and Rescue team. Bellingham Police Department investigators arrived at the creek and documented the body as having been found partially submerged near the north bank of Whatcom Creek. According to the Whatcom County medical examiner, cause of death was chemical asphyxia from hydrocarbon inhalation poisoning. The death certificate does mention inhalation of hydrocarbons (gasoline) but states the cause of death as “asphyxia due to fresh water drowning.” The autopsy report notes that the victim was most likely “overcome by volatile hydrocarbon fumes, lost consciousness, and died from hypoxia by freshwater drowning.”

Factual Information 12 Pipeline Accident Report Eight other individuals transported themselves to the hospital with minor inhalation injuries. Damage The Dakin-Yew water treatment plant was damaged by the accident, and temporary facilities had to be constructed to ensure uninterrupted water service to the approximately 30,000 customers supplied by the system. A single-family dwelling was also destroyed. As of January 2002, Olympic estimated that the total property damages were at least $45 million. Fines from the applicable regulatory agencies and civil litigation for loss of pipeline use and other issues could bring the total damages for the accident into the hundreds of millions of dollars. Criminal charges involving Olympic, Equilon, and individual employees are pending. Personnel Information Accident Controller The accident controller satisfactorily completed the required course of study and internship and became certified as an operations controller on October 31, 1983. On his most recent performance and development review (covering the period from June 1996 to April 1998), he had received either “Outstanding” (the highest of seven performance ratings) or “Strong” (the second highest performance rating) on the majority of the performance factors. His overall performance rating was determined to be “Strong.” His performance during this rating period was a slight improvement from the previous rating period (June 1992 – June 1994), when he had received a “Good+” (the third highest rating possible). He had successfully completed pipeline simulator workshops and had passed the hydraulics class. System Administrator The individual identified in this report as the system administrator joined Olympic as a pipeline controller in 1994 after working for 5 years in the same capacity at another pipeline company. At Olympic, he worked as a relief pipeline controller, filling in for other controllers when necessary. His computer responsibilities were a “special assignment.” He said his primary computer responsibility had been building SCADA display screens, especially those associated with the new Bayview facility. Before the accident, he had received no formal training on the SCADA system, the SCADA software, or the SCADA computer operating system. He said experienced personnel provided him with on-the-job training and supervision in using the SCADA system to control the pipeline and in customizing the SCADA system displays.

Factual Information 13 Pipeline Accident Report Engineering Assistant The Olympic engineering assistant (who evaluated the results of in-line pipeline inspections as detailed in the “Olympic Postinspection Actions” section of this report) said he joined Olympic in February 1980 as a dispatcher. He remained in that position until February 1989, when he became a central area supervisor for operations. He became the engineering assistant in March 1991 and remained in that position until he resigned from the company in July 2000. The engineering assistant said that he had taken college courses but had not received a degree. Toxicological Information In accordance to U.S. Department of Transportation (DOT) regulations, within 2 hours of the accident, Olympic management ordered that the accident controller and the system administrator be tested for drugs and alcohol. According to documentation provided by Olympic, the controllers were directed to nearby Valley Medical Center because the facility that normally performed random drug and alcohol testing for Olympic, Renton Occupational Health, was closed for the day. According to the documentation, medical personnel at Valley Medical Center performed the drug tests, which were negative for all tested drugs. Those personnel were not aware of the requirement that tests be conducted for alcohol, and such tests were not conducted. A week passed before Olympic officials learned that tests for alcohol had not been done. As a result of this experience, Olympic subsequently made arrangements with another facility that could be used to conduct DOT-required drug and alcohol tests in the event of any future accident that occurs outside normal business hours. The Accident Pipeline The Olympic system consists of about 400 miles of pipelines transporting refined petroleum products from refineries in the northwest portion of Washington State to delivery locations as far south as Portland, Oregon. One 16-inch-diameter pipeline (the accident pipeline) originates adjacent to a refinery near Cherry Point, extends southward to a pumping station near Ferndale, Washington, that is adjacent to another refinery, and then extends farther southward through booster pumps at Bayview products terminal into another pumping station near Allen, Washington. A second 16-inch-diameter pipeline originates adjacent to two refineries near Anacortes, Washington, and extends eastward through pumping units at Bayview products terminal into Allen station. At Allen station, the two 16-inch-diameter pipelines interconnect. Extending southward from Allen station are a 16-inch-diameter pipeline and a 20-inch-diameter pipeline that run in parallel until reaching a pumping station in Renton, Washington. A single 14-inch-diameter pipeline extends from Renton station south to Portland. Additional lateral lines to various delivery locations form the balance of the Olympic pipeline system.

Factual Information 14 Pipeline Accident Report The following pumping facilities are located on the section of pipeline involved in this accident: Cherry Point, Ferndale, Bayview,16 Allen,17 Woodinville, and Renton. These facilities are at mileposts (MP) 0.0, 0.0,18 39.1, 41.4, 86.8, and 112.9, respectively. The rupture occurred at MP 15.9, which is between the Ferndale and Bayview terminals. Approximately 37.4 miles of the 16-inch steel pipeline from Ferndale station to Allen station were originally installed in 1964. In 1966, Olympic rerouted a 724-foot-long section of the pipeline to facilitate the construction of the Dakin-Yew water treatment plant by the city of Bellingham. This is the section of pipe in which the rupture occurred. The rerouted section of pipeline was constructed of externally coated, American Petroleum Institute (API) grade X52 steel line pipe with a wall thickness of 0.312 inch. At 2,028 psig, the pressure within the pipeline would produce a hoop stress19 of 100 percent of the steel’s specified minimum yield strength of 52,000 psi. The rerouted section of pipeline was hydrostatically tested to 1,820 psig on June 20, 1966, before being placed into service. The maximum design pressure for this section of pipeline, as defined in 49 Code of Federal Regulations (CFR) 195.106(a), was 1,460 psig. The maximum operating pressure, based upon 80 percent of the initial hydrostatic test pressure and calculated in accordance with 49 CFR 195.406(a), was 1,456 psig. In January 1985, Olympic established the maximum allowable operating pressure on the rerouted line section at 1,440 psig. After the accident, the maximum allowable operating pressure on this line section was restated as 1,456 psig based upon the original hydrostatic testing. At the time of the accident, the established maximum operating pressure listed for the 16-inch Ferndale-to-Allen segment of pipeline was 1,370 psig as measured at the Ferndale discharge. The pipeline safety regulations at 49 CFR 195.406(b) limit the allowable pipeline pressure to 110 percent of the maximum operating pressure during surges and other variations from normal operations. At the rupture location, the maximum allowable surge pressure was calculated after the accident to be 1,602 psig. At the Ferndale discharge and the inlet to Bayview, the maximum allowable surge pressures were calculated to be 1,507 and 1,584 psig, respectively. 16 Construction of the Bayview products terminal was completed in 1998, and operations at the facility commenced in December of that year. Construction and operation of the facility will be discussed in detail later in this report. 17 When the Bayview facility was installed, additional pipeline was tied in just upstream of Allen station, installed past Allen station to Bayview and then back to Allen, so the mileage increased by approximately 4 miles. Allen station was located at MP 37.3 before the Bayview pipeline extension was completed. All references in this report to downstream locations will use the original mileage stationing. 18 Ferndale was the original northern terminus of the pipeline and the initial starting point for the original pipeline mileage stationing. The 5.0 miles of pipe from Cherry Point to Ferndale were added later. 19 Hoop stress is tensile stress in the wall of a pipe in a circumferential orientation (hence the term “hoop”) due to internal pressure. Although hoop stress is expressed in pounds per square inch, it is a value quite different from the pipe’s internal pressure.

Factual Information 15 Pipeline Accident Report Pipeline Operation and Control: The SCADA System As do most major liquid pipeline operators, Olympic used a SCADA system to operate and control its pipeline. A SCADA system consists of field sensors and actuators, remote terminal units, a communications link, and the main SCADA computer. Field sensors and actuators include pumps, valves, pressure transducers, temperature monitors, flow meters, and other devices for the measurement of field data and the signal input/output to those devices. In a SCADA system, remote terminal units (RTUs) collect signals from the field hardware and convert them to digital signals for transmission to the control center. RTUs also receive control signals from the SCADA computer and relay them to the individual field sensors. Programmable logic controllers (PLCs) are often used in place of or in addition to RTUs; PLCs can be programmed to control some less critical local functions that do not need to communicate with the SCADA computer. A communications link transmits data to and from the host computer to the field hardware. Traditional SCADA communications methods include leased telephone lines, dial-up telephone lines, and cellular, satellite, and microwave circuits. Pipeline conditions are displayed to the operators, and alarms are generated when field conditions exceed preset levels. In addition to pipeline operators, data users can be accounting personnel, computer technicians monitoring the system, training classes, and computer personnel developing new modules or models. The Olympic Pipeline SCADA system consisted of Teledyne Brown Engineering20 SCADA Vector software, version 3.6.1., running on two Digital Equipment Corporation (DEC) VAX Model 4000-300 computers with VMS operating system Version 7.1. In addition to the two main SCADA computers (OLY01 and 02), a similarly configured DEC Alpha 300 computer running Alpha/VMS was used as a host for the separate Modisette Associates, Inc., pipeline leak detection system software package. The Olympic system was configured with both RTUs and PLCs for collection of field data. At the time of the accident, most of Olympic’s field units also had local controllers embedded in their hardware that were designed to protect the station equipment and downstream piping in the event contact was lost with the main SCADA computer. Olympic’s SCADA communication link between the main computer and the field sensors and controllers was a combination of leased telephone lines and more advanced frame relay service, both of which were provided by local utilities. The communications link did not experience any service problems on the day of the accident. A communications subprocess within the SCADA computer queried field devices every 3 to 7 seconds over the communications link. This subprocess stored the incoming data so that it could be accessed by different SCADA system users. This “working” database was in the physical memory of the SCADA computer as well as on the computer’s hard disk. In 20 Since the accident, Teledyne Brown has become part of METSO Automation, a SCADA system provider based in Calgary, Canada.

Factual Information 16 Pipeline Accident Report the event of a SCADA system failure, the SCADA computer could read the hard disk database and begin operations where it had left off before the failure. The display and control subprocesses routed the data to the controller’s screens and the commands the controllers sent to the field devices. Preprogrammed screens were available on any of the computer workstations to display pressure trends or other data in a variety of formats. More than 40 of these pre-programmed screens had been created for Olympic’s system, but each workstation was only capable of displaying one SCADA screen at a time. Not all features available in the SCADA software used by Olympic were implemented. In addition to the pre-programmed screens, which could be accessed via a mouse click, the controllers could issue commands to the system to construct custom displays if necessary. At the time of the accident, screens to display conditions at the Bayview terminal were being developed but were not available. Thus, a controller wishing to display pressure trends at Bayview (such as depicted in figure 3) would have had to create a custom display. Olympic’s SCADA system hosted a number of terminals and workstations other than those used by pipeline controllers. These terminals and workstations were connected to the SCADA system either through network connections or via modem using one of the several serial communications ports located on the two SCADA computer units. Most of the day-to-day system support and development work was done using one of these remote terminals. The system did not create a keystroke record of the commands entered via one of the remote terminals or workstations. Direct dial-in access to the VAX computer was available from the outside, provided the user knew the phone number and had an authorized dial-up account and system password. The SCADA host computers, the control room computers, and the leak detection computer where interconnected via an Ethernet backbone network. This means that each device was connected to one common connection point and that there was only one path from any one device to another. A bridge connected the Ethernet in the SCADA control room with the company’s administrative computer network. The bridge device offered some protection and isolation of the pipeline control from the administrative segments of the networks. This protection was primarily from hardware network failures and faults. Although it also offered some protection against a casual intruder into the network, it did not offer protection equivalent to that of a full-featured intrusion firewall. No virus protection or access monitoring was incorporated into the system. The VAX-VMS was designed to be a multi-user system and was capable of keeping track of hundreds of simultaneous users. Each user was allocated his share of system resources, and each user was only permitted to run or view files associated with that person’s user identification (login). Extensive operating system accountability and permission logs documented the resources used by any individual. Only one login was being used by all of the Olympic operators, which allowed all the operators to have system administrator privileges. This permitted any of the users to manipulate or delete any of the files contained on the system.

Factual Information 17 Pipeline Accident Report In the Olympic SCADA configuration, one computer functioned in a primary mode, the other as a backup. The primary computer constantly communicated with the backup to make sure that both computers had the same data. The backup computer was designed to function as a “hot spare” that could seamlessly assume the primary role (with a current database) if necessary. The two computers switched roles once a week, when the operating primary system was intentionally shut down to bring the backup on line for the next week. The Vector SCADA system made permanent disk records of data that were used by the system and of all the commands issued. At midnight each day, the system created a complete set of historical records for that day. As the system continued to operate, these files were appended with the new data until midnight, when the appended records became the historical record for that day. The Olympic system was set up with the default VMS system file attributes. This means that the system would not overwrite older versions of a file but would create a new file with a different version number. It kept a record of all files created or modified, and a file purge could only be accomplished by the creator of the file or by a user with the appropriate system privileges. The VMS system was designed to log all system operations, errors, and hardware failures. Each entry in the log contained a short descriptive message along with the system time and date. VMS also contained a security log that kept a record of who was logged into the system. The security log would contain an entry if someone had attempted to break into the operating system. Each time a user typed an incorrect user name or password, a break-in entry would be made in the security log. VMS, by default, allowed the user six attempts to enter the correct password. If a valid password was not entered in the six tries, that particular account was locked out for a period of time. The system was designed to thwart programs or users who randomly try likely passwords in an attempt to gain access to the system. The security log contained no evidence of an unauthorized attempt to access the system. Olympic made daily backup tapes of all new and modified files found in the SCADA system for both OLY01 and OLY02 computers. This backup was done at about 6:00 a.m. and was accomplished while the systems were operating. A weekly backup of the entire Vector system was made of both machines every Monday. This Monday backup coincided with the weekly alternating of primary and backup computers. Excavations in Proximity to the Olympic Pipeline The original Dakin-Yew water treatment plant was constructed after Olympic rerouted its pipeline in 1966. In the early 1990s, the city of Bellingham planned and initiated a project to modify the plant. The project involved installing a 17-million-gallon chlorine contact reservoir, a pumping station, and the ancillary piping. Phase I of the project involved the construction of the chlorine contact tank. In 1993 and 1994, Bellingham contracted with IMCO General Construction, Inc., to perform phase II of the planned modifications to the facility. Bellingham also

Factual Information 18 Pipeline Accident Report contracted with Barrett Consulting Group21 to design the modifications and inspect the construction. Phase II of the modifications consisted primarily of installing an underground vault containing a four-pump pumping station,22 several additional water lines ranging in diameter up to 72 inches, and the associated ancillary facilities necessary to support the plant additions. (See figure 4.) During the design of the plant modifications, Barrett contacted Olympic to obtain more information on the pipeline’s location and on Olympic’s requirements concerning the installation of facilities in proximity to the pipeline. On February 18, 1993, the city of Bellingham potholed23 its existing underground water facilities at several locations in the area of the proposed modification project to determine the exact elevations. On the same day, the crew also potholed Olympic’s pipeline at three locations. Records indicate that Olympic personnel were present during this activity and documented the potholing on a diagram-of-changes form. One of the Olympic inspectors noted on Olympic’s copy of the one-call24 report for this excavation: “2-18-93 Potholed OPL [Olympic] line in 3 places. Future 72" water line installation. Will notify O.P.L.” The Olympic inspector’s planner page also contains a notation that indicates he was present on February 18, 1993, for these excavations. The Olympic inspector reported that he had probed the Olympic pipeline with a steel bar so that he knew how deep it was as the excavation progressed. He reported that all the excavations within 2 feet above the pipeline were performed by hand, using shovels. In June 1993, the city of Bellingham again potholed its own underground facilities at several locations to verify the elevations used for the design of the plant modifications. City interoffice correspondence indicates that the request for the potholing activity was initiated on June 10, 1993. Even though a one-call was not placed for these excavations, Olympic was notified, and a notation on the Olympic inspector’s planner page indicates he was present on June 11, 1993, for the potholing work. The Olympic inspector who observed the potholing on both of these occasions reported that the pipeline was not hit while he was present. There are no records of any other potholing conducted near the water treatment plant. 21 Earth Tech is the successor in interest to Barrett Consulting Group. 22 A fifth pump was later added by the city of Bellingham. 23 Potholing is a method of positively locating a pipeline by exposing it. An Olympic inspector describes the process he used as follows: First, you locate the pipe with an electronic locator; that tells you about roughly where the pipe is within a foot or two. And then you start your hole with an iron bar [probe]. You probe that into the ground and then you take a smaller diameter probe and probe farther into the hole with that. [If]…you probe down 2 or 3 feet…[and] you…haven’t hit the line…you let the backhoe take off a foot of cover and you probe again. You keep going down a foot at a time, until you actually find the line. Once the pipeline is located with the probe, it is then excavated as necessary, using hand tools. 24 Anyone planning to perform excavations is required to use the one-call system so that any underground facilities in the proposed excavation area can be located and marked before the excavation begins.

Factual Information 19 Pipeline Accident Report CMV Vault 72” 60” 48” 24” 12” Treatment Plant 16” Dakin-Yew Service Line 16” TEMPORARY PUMP HOUSE Temporary 16” Plastic Water Main 12” Drain 12” Drain Air Gap Temporary 16” Plastic Water Main City Sewer 36” 48” 60” 36” 48” 24” TANK TANK Pipeline Rupture Dakin-Yew Service Line Whatcom Creek Hannah Creek Olympic Pipeline (approx.) LEGEND Air Valve Valve Water Main Approximate Location Olympic Pipeline Temporary Water Main 1993-94 Water Line Crossings N

Factual Information 20 Pipeline Accident Report During the design phase, Olympic personnel responded to three other one-call requests to the water treatment plant. Upon completion of the design phase of the project, Barrett provided a set of plans to Olympic for review by its engineering personnel on July 30, 1993. On August 11, 1993, Olympic responded to Barrett that the clearances between the new water plant facilities and its pipeline that were proposed in the plans met or exceeded Olympic’s requirements. On November 9, 1993, Barrett provided Olympic with further information regarding proposed cathodic protection facilities.25 On November 18, 1993, Olympic notified Barrett that it found no conflict between the Olympic pipeline and the proposed cathodic protection facilities. Records indicate that Olympic and IMCO personnel met on January 13, 1994, and completed an action memorandum documenting IMCO’s receipt of Olympic’s standard right-of-way stipulations and requirements. This document stipulates, in part, that “Developer’s contractors are to provide Olympic Pipe Line Company with forty-eight (48) hours prior notice of any grading or underground crossing over the pipeline.” Olympic personnel also obtained another set of plans for the project at this time. A planner notation made by one of the Olympic inspectors states that these plans were sent to the Renton office. The memorandum, under “Type of Work,” listed “72" waterline, 24" ductile, 12" ductile waterline installation.” IMCO placed one-calls for the excavation activities at the water treatment plant on March 23, April 25, and May 18, 1994.26 As a result of the first of these one-calls, Olympic completed a second action memorandum on March 25, 1994, again documenting IMCO’s receipt of Olympic’s standard right-of-way stipulations and requirements. This memorandum, under “Type of Work,” listed “New construction. Install water pipelines to new water tank.” Two Olympic employees (inspectors) shared responsibility for monitoring the Dakin-Yew water treatment plant modification project and responding to requests to locate Olympic pipelines in the area. Olympic’s right-of-way surveillance and pipeline safety procedures called for an Olympic inspector to be on site whenever a “contractor or property owner digs across our line(s).” For this project, both inspectors understood that one of them should be present whenever IMCO was working within 10 to 15 feet of the pipeline. The Olympic inspectors stated that they had notified IMCO of this requirement and had asked the company to notify Olympic in advance of any such excavation. The inspectors stated that they then relied primarily upon IMCO to let them know when excavation was to occur. Both Olympic inspectors stated that, perhaps as often as two to three times per week, they made unannounced visits to the site to check on the progress of the project. These site visits were not documented. Neither inspector noticed any evidence during 25 Cathodic protection systems are installed to mitigate corrosion of buried steel (and other metallic) structures. Because these systems can sometimes interact with other buried metallic structures and actually increase corrosion on those structures, installation of cathodic protection systems is routinely coordinated with other underground structure owners. 26 The next one-call placed for this project was on October 17, 1994, as discussed later in this report.

Factual Information 21 Pipeline Accident Report these visits that IMCO was excavating within 10 feet of the pipeline without notifying Olympic. Both Olympic inspectors stated that whenever they were on site witnessing the work, IMCO hand-excavated the pipeline when working within 2 feet above it, as required. Neither inspector was aware of any damage having been done to the Olympic pipeline by IMCO during the Dakin-Yew modification project. IMCO personnel also stated that Olympic representatives were on site whenever excavation was performed in the vicinity of the pipeline. IMCO personnel did not report any problems contacting Olympic personnel or with Olympic’s responsiveness when called to the site. Olympic’s inspectors did not retain a set of construction plans for their use while monitoring the Dakin-Yew project. IMCO maintained on site a complete working set of plans for the project that were kept updated to reflect as-built conditions. Neither Olympic inspector reported making inquiries during site visits to determine what activities were planned and how they might impact the pipeline, nor did they report reviewing the construction plans as the project progressed. An inspection report27 indicates that Olympic’s pipeline was exposed on May 9, 1994, during installation of a 72-inch-diameter steel water line that was to cross above the Olympic line. The inspection report notes that Olympic personnel were on site during the excavation.28 Meeting minutes from May 10, 1994, indicate that Olympic had been contacted about the placement of controlled density fill (CDF) material29 atop its pipeline and that the only concerns expressed by the company had to do with the cathodic protection and any re-excavation. Olympic’s pipeline was then covered with CDF material on May 12, 1994. According to a diagram-of-changes report prepared by Olympic personnel, dated May 19, 1994, the bottom of the water line was 36 inches above the top of the pipeline. (See figure 5.) An inspection report also indicates that Olympic’s pipeline was exposed northwest of the pump station, with Olympic personnel present, on July 6, 1994, during excavation to install a 24-inch-diameter ductile iron suction water line. Two PVC lines, one 2 inches and one 4 inches in diameter, were also to be installed in the same trench. Olympic’s pipeline remained exposed throughout the construction of the suction water line. Planner notes made by one of the Olympic inspectors indicates that additional site visits were probably made between July 6 and 13, 1994. The inspection report for July 18, 1994, indicates that additional excavation was performed to realign the ditch as necessary to accommodate the new lines, again with Olympic personnel present on site. A diagram of changes, dated August 11, 1994, indicates that the construction of the line crossings had been completed. The diagram of changes shows that the top of the new water line was 29 27 Barrett’s on-site inspector prepared daily inspection reports documenting the progress of the project. 28 Although the daily inspection report indicates that a “Cascade Pipeline inspector” was present, photographs confirm that it was Olympic’s pipeline that was being excavated, and the Barrett inspector confirmed that an Olympic inspector was present. 29 Controlled density fill is used in certain types of underground pipe installations to provide better support for the pipe than standard backfill. In a typical installation, this material, in a slurry form, is poured under and around the pipe to form a bed. After the CDF material hardens, regular backfill is applied to bring the fill up to grade.

Factual Information 22 Pipeline Accident Report inches below the bottom of Olympic’s pipeline. The diagram of changes further indicates that there was 18 inches of clearance to the 2-inch PVC line and 25 inches of clearance to the 4-inch PVC line. Olympic records indicate that the coating on the bottom of the pipeline at this location was repaired on August 12, 1994. Plans for phase II of the water plant modification project included the installation of a new 24-inch-diameter ductile iron discharge water line from the new pumping station. The original design called for this discharge line to cross beneath the new 72-inch water line and tie into an existing 16-inch water line southwest of the pumping station. Because of a realignment of the 72-inch water line and the presence of the (hardened) CDF material beneath it, IMCO asked that Barrett modify the design so that the new 24-inch discharge line would tie into the existing 16-inch water line north of the 72-inch water Figure 5. Excavation for installation of 72-inch-diameter water pipeline as part of water treatment plant modification.

Factual Information 23 Pipeline Accident Report line, thus eliminating the need to cross beneath it. Once modified, the tie-in, or “tee,” connecting the new 24-inch line to the existing 16-inch line was about 21 inches directly above the Olympic pipeline. The project plans were modified on May 13, 1994, to reflect the proposed design change in the discharge line’s location. The Barrett inspector stated that he thought he had given a plan showing the revisions to one of the Olympic inspectors. No documentation indicates that Olympic was provided with information concerning this design revision. None of the meeting minutes discussing the tee installation project mention providing Olympic with notice of the project or the scheduling changes. Both Olympic inspectors stated that they were unaware of the tee’s installation above the Olympic pipeline. A diagram-of-changes form documenting the tee’s installation was not located. (See figure 6.) Excavation of the existing 16-inch water line for installation of the new tee connection began on the afternoon of July 6, 1994, with completing of the tie-in anticipated for the following day. This excavation was approximately 100 feet south along Olympic’s pipeline from its crossing with the new suction water line. As noted previously, the daily inspection report prepared for July 6, 1994, indicates that an Olympic representative was on site for at least a portion of the day. On July 7, 1994, it was determined that the tie-in could not be made where planned because at that location, the CDF supporting the 72-inch water line would interfere with the necessary excavation. Efforts to complete the tie-in on July 7, 1994, were thus abandoned. After discussions, Figure 6. (Left) Planned location of “tee” connection joining new with existing water lines. (Right) Revised (actual) location of tee, which was installed above Olympic pipeline. (Not to scale.)

Factual Information 24 Pipeline Accident Report IMCO and Barrett revised the alignment of the 24-inch discharge line, shifting it and the associated tee connection 2 to 3 feet northward. This change necessitated enlarging the existing excavation. On July 8, 1994, the existing water line was drained and the tee connection installed. Once this was complete, the excavation remained open for several days until the discharge water line from the pumping station was constructed and connected and until the associated concrete thrust block (used to reinforce the connection) was poured. Photographs indicate that the thrust block had been completed by July 21, 1994. One of the valves on the tee connection was reportedly found to be inoperative because the riser installed to allow access to the underground valve stem had become misaligned during backfilling. Excavation to expose and realign the valve risers was reportedly performed in August 1994. During the last week in August 1994, a ductile iron pipeline was installed crossing beneath the Olympic pipeline. Photographs indicate that the Olympic pipeline was exposed during this installation. The daily inspection reports do not mention the presence of Olympic personnel on site during this activity. A diagram-of-changes form documenting this crossing was not located. A 12-inch PVC utility duct was also installed crossing above the Olympic pipeline approximately 17 feet north of the centerline of the tee connection. The inspection reports do not mention the presence of Olympic personnel on site as this duct was installed across the Olympic pipeline. A diagram-of-changes form documenting this crossing was not located. An electrician working for an electrical subcontractor to IMCO on the water treatment plant project told investigators that he heard the pipeline being struck by a backhoe being operated by an IMCO employee during the project. He stated that the damage occurred just south and west of the pump station entrance and that he was told that the excavation was being performed to realign the valve risers. He said that the same operator damaged buried telephone lines on the same day that the pipeline was struck. The daily inspection report for August 11, 1994, notes that excavation was occurring in the vicinity of the pump station. The inspection report further notes that “The telephone conduit in front of SW pump station corner, 15' from the 72" line was damaged severely by Imco loader…US West personnel on site repairing wires. 2 people from noon on working on wires.” Telephone company records do not document any repairs at the Dakin- Yew water treatment plant on August 11, 1994. The daily inspection report for August 18, 1994, notes that “Damage to the telephone cable occurred just before noon, near treated water meter man hole. The back- hoe struck it and took ~1/2 the wires.” Telephone company records indicate that telephone line repairs were performed at the Dakin-Yew water treatment plant location on August 18, 1994. The electrician who said he had heard the pipeline strike also said that he was present when IMCO personnel decided not to notify the Barrett inspector or Olympic

Factual Information 25 Pipeline Accident Report about the damage. He said that the IMCO personnel coated the area of the pipeline that had been struck with a mastic coating before backfilling over it. The electrician did not report witnessing any other occasions when the pipeline was struck. Certified payroll records for the job reported that the electrician had worked 4 hours on August 11, 1994. The electrician stated that he had worked on repairing the conduit for the telephone company after the telephone lines had been damaged and that it was possible his time was charged back to IMCO for the conduit repairs. A second electrician working at the site on the same day did not recall the events described by the first electrician and could not verify the accuracy of his statements. A laborer who was working for IMCO on the project also said he recalled IMCO hitting a pipeline on the project. He said he recoated the damaged pipeline with a primer and white vinyl tape coating material. The laborer stated that the pipeline he had recoated was a 24-inch ductile iron water pipeline. He had reviewed photographs of Olympic’s ruptured pipeline and stated that he was certain that it was not the pipeline that he had repaired. All of the other IMCO employees interviewed denied hitting or repairing a pipeline in the vicinity of the pumping station during the project. None of the Barrett or Olympic employees interviewed reported that they were aware of any damage done to Olympic’s pipeline during the project. On October 17, 1994, a one-call was placed for work at the water treatment plant to install fencing. On January 2, 1996, a one-call was placed for work at the water treatment plant to excavate a valve. According to the water treatment plant superintendent, the valve that was excavated was on a 36-inch water line that was not near Olympic’s pipeline. No other excavation activities were discovered to have occurred within the water treatment plant between 1991 and 1997. Pipeline In-line Inspections Olympic conducted three in-line inspections of the 16-inch segment of pipeline from Ferndale to Allen between 1991 and the day of the accident. The last two of these inspections revealed anomalies in the pipeline within the confines of the city of Bellingham’s Dakin-Yew water treatment plant and in the vicinity of the subsequent rupture. Regularly Scheduled Magnetic Flux Inspections On November 18, 1991, Olympic contracted with Tuboscope Linalog, Inc., to inspect its pipeline using a conventional resolution magnetic flux inspection tool.30 The 30 A magnetic flux internal inspection tool generates lines of magnetic flux and then analyzes them to find differences in pipe wall thickness.

Factual Information 26 Pipeline Accident Report Tuboscope inspection did not reveal any anomalies, either defects or features,31 in the area of the eventual rupture. After the accident, a consultant for the Office of Pipeline Safety (OPS) reviewed the original logs from the 1991 inspection and concluded that no anomalies were present that were missed by the Tuboscope personnel who reviewed the raw data. Olympic policy was to conduct magnetic flux in-line inspections on a 5-year cycle, and a second in-line inspection was performed on this section of pipeline on March 18, 1996, using the same type of Tuboscope tool. The report Tuboscope provided to Olympic states that because this was a repeat inspection, the data were compared to the previous in- line inspection data. Tuboscope reported three anomalies in the vicinity of the subsequent rupture that had not been detected by the 1991 inspection. One was a defect reported at Tuboscope wheel count 844+16, which was approximately 11 feet downstream of the rupture location. This anomaly was classified as a “possible mill/mechanical” defect that was 0.4 inch long with a 23-percent wall thickness loss. A feature, identified as a “possible mash,” was reported at the same Tuboscope wheel count as the defect. A second feature, identified as a “possible wrinkle bend,”32 was reported at wheel count 844+02. This was near the location of the subsequent rupture. To assist Olympic in prioritizing the physical investigation of the reported defects, Tuboscope also reported a pressure-related (PR) ratio to Olympic for each of the defects identified on the pipe. The PR ratio compares the strength of the pipe containing the defect to the strength of an undamaged pipe. A PR ratio greater than 1 indicates that the remaining strength of the pipe is sufficient for the maximum operating pressure. The PR ratio reported for the defect identified at wheel count 844+16 was 1.21.33 For these calculations, Tuboscope used the radial depth and axial length of each defect in the American Society of Mechanical Engineers (ASME)/American National Standards Institute (ANSI) B31G34 calculations, which were developed for corroded pipe. These calculations were not valid for non-corrosion defects such as mill/mechanical defects; however, Tuboscope still reported PR ratios for these defects. PR ratios were not calculated for features. Washington Department of Ecology Administrative Order As a result of a leak in a 20-inch Olympic pipeline in the Ebey Slough area that occurred at a buckle in the pipe, the Washington Department of Ecology (WDOE) issued an administrative order on September 17, 1996, that required Olympic to, among other actions, conduct a magnetic flux inspection of those pipeline sections for which magnetic 31 Defects are indications of metal loss or thinning of the pipe wall. Features are anomalies that do not involve metal loss or thinning. Anomalies identified as features are typically, though not always, determined to be valves, fittings, sleeves, etc. 32 A wrinkle bend is a bend in the pipe that contains one or more buckles. Wrinkle bends usually occur during the original installation of the pipeline. 33 The flaw list reported the PR ratio as 1.21. The defect report listed the PR ratio as 1.11. 34 American Society of Mechanical Engineers/American National Standards Institute B31G, Manual for Determining the Remaining Strength of Corroded Pipelines, 1991.

Factual Information 27 Pipeline Accident Report flux inspection data did not exist and to submit a report explaining the cause of all identified anomalies. The order further stated that any significant anomalies that could not be adequately evaluated by examination of the data must be verified by field inspection. Olympic was also required to run a caliper tool35 through those pipeline sections where caliper tool data did not exist and to prepare a comparative analysis identifying any discrepancies between the caliper tool data and construction drawings for the entire Olympic system. Olympic was again required to investigate, and verify by field inspection, which included excavation and examination of the anomaly, any significant discrepancies identified during this evaluation of the caliper tool data. In its response to the order, Olympic provided a list of the magnetic flux inspections that had previously been performed on its pipeline system and the proposed schedule of future inspections. Olympic stated that although the magnetic flux tool was very effective in pinpointing corrosion, scratches, gouges, and welds, it was not an effective technology for detecting anomalies, such as dents and buckled pipe, that do not involve metal loss. Based on this information and further discussions about the various inspection tool capabilities, the WDOE dropped its requirement for the magnetic flux inspection data review. Olympic also reported to the WDOE that its caliper tool inspection contractor, Enduro Pipeline Services, Inc., had improved its technology so that it could better identify buckles that were adjacent to bends and fittings. Olympic asked Enduro to review the data from its previous caliper tool inspections36 and provide an updated interpretation. Enduro’s review identified suspected buckling adjacent to four fittings. Upon excavating these anomalies, Olympic found and repaired buckles at three of the four locations. No other areas of suspected buckling were identified during Enduro’s review of the rest of the caliper tool data for the 20- and 14-inch lines. Because no previous data existed, Olympic had Enduro, on January 15, 1997, conduct a caliper tool inspection of the 16-inch accident pipeline from Ferndale to Allen. The purpose of the inspection was to determine the geometrical condition of the pipeline and to specifically detect buckles in accordance with the WDOE order. Within the confines of the water treatment plant, near the area of the future rupture, Enduro reported a 0.45-inch total sharp defect37 at the same area identified by Tuboscope as a possible wrinkle bend. This was at Enduro station 843+69. In its January 27, 1997, field report, Enduro did not report an anomaly at the same location previously identified by Tuboscope at wheel count 844+16 as a possible mill/mechanical defect having 23-percent wall thickness loss with a possible pipe mash feature.38 35 A caliper, or geometry, tool is designed to detect anomalies such as dents, buckles, ovality, weld penetration, etc., that change the internal diameter of the pipeline. 36 Caliper tool inspections had not been done on the accident pipeline. 37 According to Enduro evaluation criteria, a sharp defect is a reduction in pipe diameter within a 2-foot length of pipe. The reduction could be caused by, for example, pipe dents, bends, weld misalignment, or valves. 38 After the accident, an OPS consultant reviewed the log and found indications of deformation at both locations. At a log scale of 1 inch to 250 feet, however, one of these was missed by Enduro in its interpretation in 1997.

Factual Information 28 Pipeline Accident Report In April 1997, Olympic began exposing various locations on its pipeline where anomalies had been reported. On May 22, 1997, Olympic provided the WDOE with a letter describing the actions it planned and a schedule for completing the required inspection work. The schedule consisted of a chart summarizing the results of all of the anomaly excavations, including a comparison between what was shown by the caliper tool and what was actually found upon excavation. The 0.45-inch sharp defect at Enduro station 843+69 was scheduled to be investigated in May 1997. A footnote regarding this defect indicated that Olympic might excavate if justified by the risk as determined by its engineers. All of the anomalies listed in the summary were from the caliper tool inspection surveys. None of the magnetic flux indications were listed. The only anomaly listed on the 16-inch pipeline between Ferndale and Allen was the 0.45-inch sharp defect at 843+69. Olympic stated that it planned to submit a final table summarizing the investigation and disposition of the anomalies as soon as all the work was completed. Olympic planned to complete the excavations by August 1, 1997. On June 3, 1997, Olympic faxed a copy of an updated chart of field investigations to the WDOE. This updated summary still listed May 1997 as the scheduled time frame for investigating the sharp defect. No records were located to indicate that Olympic had provided any further update to the WDOE or that the WDOE had requested one. The latest completion date in Olympic’s final summary, which was dated March 1998, indicates that the field excavation inspections were completed by November 6, 1997, and that no field inspection of the pipeline had been made at the reported sharp defect. Olympic Postinspection Actions In its letter to the WDOE, Olympic indicated that it would use the ASME B31.439 piping code to analyze and repair pipeline anomalies, including gouges, grooves, dents, and corrosion. The B31.4 code requires that gouges and grooves having a depth greater than 12 1/2 percent of the nominal wall thickness be removed or repaired. The B31.4 code also requires that dents greater than 6 percent of the pipe diameter in pipelines with a diameter exceeding 4 inches and any dent containing a scratch, gouge, or groove be removed or repaired. The B31.4 code also contains calculations that can be used to analyze corrosion pitting to determine whether repairs are necessary. The Olympic operations and maintenance procedures relating to the repair of its pipelines, which were issued in July 1995 and provided to the OPS in August 1998, required that any dent with a depth exceeding 2 percent of the nominal pipe diameter on pipe sizes greater than 12 inches be removed or repaired.40 39 American Society of Mechanical Engineers/American National Standards Institute B31.4, Liquid Transportation Systems for Hydrocarbons, Liquid Petroleum Gas, Anhydrous Ammonia, and Alcohols, 1992 Edition. 40 Since the accident, Olympic has been unable to determine why this procedure adopted a 2-percent standard rather than the ASME B31.4 criteria of 6 percent for the repair of dents. Company officials stated their belief that correspondence from the vice president and general manager to WDOE clearly established that its company policy at the time of the 1997 evaluations was to use the ASME criteria.

Factual Information 29 Pipeline Accident Report The Olympic spill prevention plan that was provided to the WDOE on December 31, 1992, contained provisions specific to in-line inspections. The plan states that “Olympic Pipe Line will excavate and visually inspect all anomalies that are deeper than 20 percent of the original wall thickness.” Olympic also noted that it would take into consideration location, sharpness, and appearance of the defect; location of the seam or joint welds; and other factors that influence stress at the location of the defect when evaluating defects that did not meet the code’s criteria to determine whether those defects should also be repaired or removed. Olympic further stated that data obtained as the excavations were made would be used to determine whether to continue excavating these lesser defects. Olympic’s engineering assistant reviewed the results of the in-line inspections and created a dig sheet for the water treatment plant area where the rupture later occurred. Some general notes made by the engineering assistant on the dig sheet indicate that it was a difficult area to access and that this location was not inspected. The engineering assistant completing the evaluation noted the location of the Tuboscope 23-percent wall loss defect and possible mash at wheel count 844+16 (approximate station 843+83).41 Next to Tuboscope’s possible wrinkle bend feature at wheel count 844+02, he referenced Enduro’s 0.45-inch sharp defect located at station 843+69. In the general notes for the dig site, he indicated that it was not inspected. He further noted that Tuboscope’s 23-percent defect was “min. [minimum] risk” and that the Enduro sharp defect was “less than repairable.” 42 The engineering assistant provided a copy of the dig sheet to Olympic’s construction supervisor so that excavation and inspection of the anomalies in the vicinity of the water treatment plant could be scheduled. The construction supervisor stated that he had one of his employees go to the site to check the location in anticipation of performing the excavation. This employee reported back to him that the location was too wet to be excavated at that time. When the construction supervisor reported this to the engineering assistant, he was told they would go back and try again when the area was dry. The construction supervisor said that no further action was taken to excavate the pipeline in this vicinity before the accident. The engineering assistant stated that Olympic’s spill prevention plan had never been approved by the State, so he did not think that it was in effect at the time his evaluations were made. He did not recall any relevant operations and maintenance procedures applicable to in-line inspection runs. He further stated that he had used the ASME B31.4 guidelines for deformations. He also said that he used the B31G criteria for corrosion pitting because that was the best guidance available to him for metal loss anomalies. He said that he had compared the 1996 in-line inspection results to those found in 1991 and that he was aware that the 23-percent wall loss defect and pipe features 41 The Tuboscope wheel count did not correspond to Olympic’s stationing. Enduro’s reported stationing was, however, correlated to match Olympic’s. 42 An indentation of 0.45 inch in a pipe with a diameter of 16 inches is an approximately 3-percent dent.

Factual Information 30 Pipeline Accident Report identified in the 1996 magnetic flux in-line inspection were not shown on the 1991 results. But he said he had lost faith in Tuboscope’s ability to identify deformations with the magnetic flux in-line inspection tool because it had failed to find the buckle that had failed in the Ebey Slough. He therefore discounted the Tuboscope features called a “possible mash” or “possible wrinkle bend” and relied upon the data from Enduro to identify deformations in the pipeline. He said that he had reviewed the pipeline alignment sheets and determined that the water treatment plant area was congested with several foreign pipe crossings. The 72-inch water line, for example, had been installed at approximately station 843+85. He said that the dates that the line crossings were installed were not reflected on the alignment sheets and that he had not reviewed the diagram-of-changes forms to learn when each of the line crossings had been installed. The alignment sheets would not have depicted the water line tee since a diagram of changes for it had not been completed. The engineering assistant stated that after the company had excavated several locations during the spring of 1997, he reassessed the need to excavate the pipeline in the Dakin-Yew water treatment plant. He noted that the actual deformations found in the pipelines that were excavated were not as severe as had been indicated on the Enduro inspection results. He noted that the Enduro 0.45-inch sharp defect was only about 3 percent, which was less than the 6-percent dent specified in the ASME B31.4 guidelines. He said that when using B31G to evaluate the 23-percent metal loss anomaly, repairs were not required. Even though he used the calculations for corrosion pitting, he did not initiate an investigation into what might be causing the corrosion. He said that he might have forgotten that the listed defects and features were not identified in 1991 when he did the reassessment in July 1997. He acknowledged that had he known that construction had occurred in the area when the water treatment plant was expanded in 1994, or had he identified metal loss at the same location as the deformation, he would probably have excavated the pipeline at that location. He recalled that the “difficult to access” comment related to terrain. He thought that the pipeline was located in a steep area.43 He did not recall whether the area being wet was a consideration. He further noted that cost was not a factor in determining whether or not this location should be excavated. He stated that he had discussed and reviewed this potential excavation with Olympic management and that all concurred that it was not necessary to excavate and visually inspect the pipeline at the water treatment plant location. The Bayview Products Terminal In December 1998, Olympic completed construction of a new products terminal about 2 miles upstream of the existing Allen station. The Bayview products terminal consisted of five product tanks with a total storage capacity of 500,000 barrels and the 43 The area was actually level and accessible.

Factual Information 31 Pipeline Accident Report associated delivery and return piping. A 10,000-barrel transmix tank was also installed as a breakout tank at the facility.44 Three product transfer pumps were installed at Bayview. Two of these were capable of moving product along the accident pipeline. Overpressure Protection Olympic contracted with Jacobs Engineering Group, Inc., to design the facility and provide additional services during the construction of the terminal, including assistance with the procurement of its components. The system design called for ANSI 300#-rated components having a maximum design pressure of 740 psig. Because the accident pipeline entering the terminal could be operated at pressures considerably higher than 740 psig, three control devices were employed to protect station piping and components from overpressure. First, a control valve, CV-1904, was installed on the inlet side of the station and set at 600 psig to throttle back the flow of product into the station. Second, a relief valve, RV-1919, was installed just downstream of the control valve. The relief valve was designed to open and transfer excess product to the transmix tank if the pressure downstream of CV-1904 exceeded the set pressure of the relief valve. (The pressure settings for RV-1919 will be discussed in detail later in this report.) Finally, a receiver manifold arrangement, consisting of three motor-operated and remotely controlled block valves (MV-1902, MV-1903, and MV-1907) controlled product flow upstream of control valve CV-1904. Either MV-1902 or MV-1903, depending upon the selected configuration, was set to close in approximately 60 seconds and completely block the flow of product into the Bayview terminal if a set pressure of 700 psig was reached inside the facility. Although the information in this section refers to the pipeline involved in the accident, the parallel piping from Anacortes was configured in an identical fashion. (See figure 7.) Additional overpressure protection was provided by high discharge pressure limits placed on the pumps at Ferndale station. These pumps would shut down automatically if the discharge pressure reached approximately 1,400 psig. Valve Configuration Control Valves. As noted above, the inlet control valve, CV-1904, was intended to throttle product flow into the Bayview terminal and thus limit pressures entering the facility. An outlet control valve, CV-1963, was installed in the accident pipeline on the discharge side of the Bayview pumps to help maintain adequate pressure through the pumps. Specification sheets prepared by Jacobs indicate that the inlet control valves were to be rated to ANSI 600#, and the outlet control valves rated to ANSI 300#. According to correspondence initiated during the design and construction of the Bayview facility, a representative of Thunderco, Inc., the vendor supplying the inlet and outlet control valves, contacted Jacobs to determine whether Olympic wanted piston stops to be extended within the valves. Extended piston stops are used to limit piston travel within the valve and thus control whether the valve is capable of closing completely or only 44 When pressure in a pipeline exceeds established limits, relief valves open that direct product to breakout tanks, thus reducing pressure in the main pipeline.

Factual Information 32 Pipeline Accident Report partially. In the correspondence, Thunderco stated that piston stops are normally extended in outlet control valves to keep the valve from closing completely, thereby eliminating the possibility of accidentally pumping against a closed valve. Olympic responded that piston stops should be extended on the outlet control valves (CV-1963 and CV-1969), but that it would prefer full closure on the inlet control valves (CV-1904 and CV-1916). A Thunderco representative stated that piston stops are present in all the company’s control valves but that they are not extended to limit piston travel short of full closure unless requested by the customer. The representative further stated that the stops could be adjusted as necessary in the field without removing the valve from service. After the control valves were installed and Bayview terminal came on line, Olympic personnel discovered that the inlet control valves did not close completely. After the accident, it was determined that piston stops were extended in both the ANSI 600# inlet control valves to limit the travel of the valve to 90 percent of full closure,45 but they were not extended in either of the ANSI 300# outlet control valves. (Data recording the position of CV-1904 during the accident indicate that the valve closed to approximately 30 to 40 percent and that it never reached the stop setting.) Olympic took no action before the accident to adjust the stops on any of the control valves. Figure 7. Simplified schematic of Bayview products terminal showing relative locations of block, control, and relief valves. 45 Although the stop prevented the final 10 percent of piston travel, this does not correlate to a 90- percent reduction in product flow. Because of the internal configuration of the valve orifice, the reduction was potentially much greater than 90 percent. MV1902 MV1907 FERNDALE RECEIVER FROM FERNDALE 16" 16" 16" MV1903 10" CV1904 8" RV1919 TO TANK 209 INTO BAYVIEW PRODUCTS TERMINAL M M M

Factual Information 33 Pipeline Accident Report Relief Valves. As noted above, the relief valve on the inlet side of the accident pipeline was designated RV-1919. RV-1919, as were the other three relief valves on the two pipelines, was an 8-inch Brooks Model 760 pilot-operated control valve46 manufactured by Fisher-Rosemount.47 The valve is designed to remain closed until the pressure in the pipeline on the inlet side of the valve reaches a predetermined pilot set point. When this pressure is reached, the pilot opens, allowing the relief valve itself to open and permit product flow through the valve. When the pressure drops below the valve set point, the pilot closes, allowing the relief valve piston to reseat and shut off flow. According to the manufacturer’s specifications, a Model 760 is capable of regulating the inlet pressure to within ±2 psig of the set point. (See figures 8 and 9.) As noted, the pressure at which the Model 760 relief valve opens is determined by the pilot pressure set point. The Model 1760 pilot is available in either a low-pressure (0 to 180 psig) or a high-pressure (150 to 650 psig) configuration. The two configurations have different pistons, valve covers, and O-rings. Four different pilot springs are available to further refine the pressure ranges for each configuration. For the low-pressure configuration, the four springs can support pressure ranges of 0 to 20, 0 to 40, 30 to 80, and 70 to 180 psig, respectively. The spring used for the 30- to 80-psig range in the low- pressure configuration supports a pressure range of 150 to 350 psig when used with the high-pressure configuration. Similarly, the 70- to 180-psig low-pressure spring is the same spring that is used for a pressure range of 350 to 650 psig in the high-pressure configuration.48 Assuming the correct spring and valve component configuration, the pressure set point can be “fine-tuned” by turning an adjustment screw at the top of the pilot housing, which varies the compression on the pilot spring. According to design documents prepared by Jacobs during the design of the Bayview products terminal, the set pressure for RV-1919 and the three other relief valves intended to protect the ANSI 300# piping from pressure surges was to be 740 psig, the equivalent of the maximum allowable working pressure for this class of ANSI-rated components. Fisher-Rosemount provided the Safety Board with a copy of the Jacobs instrument specification sheet for RV-1919. The document specified a spring set pressure of 740 psig (which actually exceeded the maximum pressure of 650 psig for the Model 760 valve) at a temperature of 100° F. On the specification sheet, the 100° temperature was circled, and above it was written, by hand, “70-180.” 46 “Control valve” is the terminology used in the Brooks literature. Because RV-1919 functioned as a pressure relief valve, it will be described as such in this report. 47 Purchase orders and invoices for RV-1919 denote Brooks model valves offered through Fisher- Rosemount Petroleum, a division of Emerson Electric Company. Fisher-Rosemount Petroleum later became Daniel Measurement and Control Division, a division of Emerson. For this report, Fisher-Rosemount will be used to designate the company/facility that sold RV-1919 and other relief valves used by Olympic. 48 A Brooks (Fisher-Rosemount Petroleum) technical bulletin for control valve pilot springs (number V-9500-11, dated September 1984) notes that the proper spring and piston are needed to establish the desired set point range for the pilot valve. A Brooks part list (number PL-V7560-20, dated April 1992) also sets forth the various parts required to establish the desired rated pressure range for the pilot valve.

Factual Information 34 Pipeline Accident Report Figure 8. Relief valve schematic. From pipeline To breakout tank Pilot assembly Pilot spring Pressure set point adjusting screw = Inlet pressure = Outlet pressure A B A B From pipeline To breakout tank Pilot assembly Pilot spring Pressure set point adjusting screw = Inlet pressure = Outlet pressure B A Pressure sensing line Pressure sensing line (Above) Relief valve is fully closed. Because inlet pressure is below the pressure set point, pilot piston (A) is seated, and pressure on both sides of relief valve piston (B) is balanced. The main valve spring keeps the relief valve closed. (Below) Relief valve is fully open. Inlet pressure is greater than pressure set point, compressing pilot spring and lifting pilot piston (A) from seat. Liquid flow through pilot reduces pressure on back side of relief valve piston (B). Inlet pressure compresses relief valve spring and lifts piston from seat, allowing flow to breakout tank. When pressure drops below the pressure set point, pilot piston will reseat. Inlet pressure and spring force will close relief valve and cut off flow.

Factual Information 35 Pipeline Accident Report Representatives of Fisher-Rosemount told investigators that the handwritten notations on the specification sheet were probably made by an employee at the company’s Statesboro, Georgia, manufacturing facility and that the “70-180” likely referred to the spring used for a 100-psig setting for the Model 1760 pilot. In any event, RV-1919 and the three other ANSI 300# valves were manufactured with the low-pressure configuration and equipped with the 70- to 180-psig spring. Fisher-Rosemount documentation indicates that the pilots on the four relief valves were calibrated to a set point pressure of 100 psig before being shipped to Olympic. Various Fisher-Rosemount invoices and acknowledgements for the purchase order that it provided back to Jacobs and Olympic identify RV-1919 and the three other ANSI 300# valves as Model 760 relief valves equipped with Model 1760 pilot controls set at 100 psig. In addition, each pilot body was stamped with the 100-psig set point, and a tag affixed to the pilot identified the range of the pilot spring as 70 to 180. During construction of the Bayview products terminal, Olympic assigned its mechanic to act as a mechanical inspector on the project. The mechanic reported that he had compared the serial numbers of all four relief valves to either an equipment list or a construction drawing provided by the contractor to make sure that Olympic had received the proper materials. During the night from December 16 into December 17, 1998, Olympic personnel began filling the pipeline to bring the Bayview facility into operation. The employees Figure 9. Closeup of relief valve RV-1919 and pilot.

Factual Information 36 Pipeline Accident Report noted that as the accident pipeline filled and the pressure increased above 100 psig, RV- 1919 opened and diverted product to a breakout tank. The employees recalled that the engineering manager49 was on the site during this activity and that when he noticed that the relief valve was operating at a pressure lower than intended, he reviewed drawings and directed efforts to determine why this was happening. The employees were aware that the available pressure range adjustment on the relief valve was limited by the type of pilot spring. Without consulting the manufacturer’s literature on the valve, which was available, the employees decided that they could increase the set point by replacing the pilot spring. One of the mechanics had a spring in his truck that he gave to another of the mechanics who used it to replace the existing pilot spring in RV-1919. The set point was then increased, after which the employees were able to fill and pressurize the pipeline. On December 18, the mechanic reported to other Olympic employees, including those within the engineering group, that the set pressure of RV-1919 had been established at 700 psig. He said that after he increased the set point, he used a hydraulic pump to apply pressure to the pilot to determine the pressure at which the pilot operated.50 He said he tested the pilot several times and that it opened at the correct pressure each time. Hoffman Instrumentation Supply Company is a company that Olympic used to purchase replacement parts. A Hoffman employee based in Renton, Washington, recalled that an Olympic mechanic contacted him on December 17, 1998, and told him that the relief valve was discharging at only about 100 psig and that he needed to order four 350-to 650-psig pilot springs from Fisher-Rosemount because the springs he had were for the wrong pressure range. He passed this along to a second Hoffman employee in Portland, who looked up the part numbers for the springs and placed the order. On December 17, 1998, Fisher-Rosemount received and processed a rush order on behalf of Olympic for the four springs, and the springs were shipped on or about December 22, 1998. Olympic received the springs and used them to replace the springs that its personnel had used in the four relief valve pilots. Olympic was not aware that, because the same spring was used for either the 70- to 180-psig or the 350- to 650-psig pressure ranges, depending on the valve configuration (high or low pressure), the new springs were identical to the ones originally supplied in the pilot. At some point after these springs were delivered, the Hoffman employee based in Portland, Oregon, having heard that the springs were still not working for the intended set points, stated that he contacted Fisher-Rosemount’s Statesboro plant and learned that a new piston, pilot cover, and O-ring would be needed to convert the 100-psig valves to the high-pressure configuration. On January 11, 1999, he faxed this information to the Hoffman employee in Renton, Washington, who normally worked directly with 49 The engineering manager has refused to answer questions from Safety Board investigators. 50 To conduct the test, the mechanic isolates the pilot from the main relief valve and applies hydraulic pressure to the pilot through the sensing line. A gauge on the test unit registers (by showing a drop in pressure) the point at which the pilot operates. This is the same test the company used to perform annual valve tests required by Federal regulation.

Factual Information 37 Pipeline Accident Report Olympic.51 The fax included the parts list, with the required part numbers highlighted. The Hoffman employee in Renton stated that he was certain he had passed this information along to Olympic at that time, but he did not remember which Olympic mechanic he had talked to. The Olympic mechanic interviewed by the Safety Board stated that he had not received it. No additional parts for the relief valves were ordered at that time; however, after the accident, Olympic obtained the parts necessary to properly configure the pilots on its similar relief valves.52 Eighteen days after the accident, the pilot on valve RV-1919 was tested and found to operate at 440 psig. The next day, the valve was removed from the pipeline for subsequent Safety Board testing (discussed in detail later in this report). Between July and December 1999, a contractor working for Olympic conducted dynamic tests of the relief valves throughout Olympic’s pipeline system. The set points of the pilots and the actual pressures at which the relief valves opened and closed were recorded. In all tests for all these valves, the actual pressures at which the relief valves opened were greater than the set points, with the differences ranging from 8 to 130 psig. As a result of this testing, Olympic adjusted the set points of all the relief valves on its system to 30 psig below desired opening pressure. The pilot on RV-1923, a twin to RV-1919, was tested in place at the same time as RV-1919 and operated at 650–660 psig during both tests conducted. During the flow testing Olympic conducted after the accident, however, RV-1923 did not function. Olympic placed an order for the parts necessary to convert the pilot to a high-pressure configuration on the same day that RV-1923 was tested. Operations Issues A hydraulic surge analysis of the Olympic system was performed in 1991. No additional surge analysis was performed to predict the hydraulic behavior of the pipeline as a result of the addition of the Bayview facility in 1998. Bayview’s proximity to Allen pump station, according to a controller interviewed, created operational challenges. For example, because of the size of the pumps at Allen, product could be drawn away too quickly from Bayview. The controller said he believed that the proximity of the Bayview and Allen stations reduced the time that controllers had to react to such problems before protective devices at the Bayview terminal activated and caused an unintended shutdown of the pipeline. Between December 16, 1998, when Bayview went into operation, and the accident on June 10, the inlet block valve at Bayview closed 41 times because of high pressure within the Bayview terminal. On 13 of these occasions, the pressure on the pipeline upstream of the inlet block valve exceeded 1,000 psig, with a maximum pressure of 1,339 51 The fax noted that “the 1760 pilot they called out on the original sales order was set @ 100 psi and was the 70-180 spring” and that “it turns out you cannot simply change the spring to get a higher rating. You need to also change the piston, cover and piston O-ring.” The fax also listed the part number of the piston, cover, and O-ring that would be needed, in addition to the spring, to make this conversion. 52 RV-1919 was in the possession of the Safety Board.

Factual Information 38 Pipeline Accident Report psig on one occasion. Olympic’s mechanic stated that, on May 12, 1999, under the direction of “someone” in the engineering group, he reduced the set pressure of RV-1919 from 700 to 650 psig.53 Six of the 41 closings of the inlet block due to high pressure within the Bayview terminal occurred after the relief valve pressure set point was changed. The Federal pipeline safety regulations, in 49 CFR 195.402, require that a pipeline operator develop written procedures for handling abnormal operations that include “responding to, investigating, and correcting the cause of…unintended closure of valves or shutdowns” or the “operation of any safety device.” Olympic had developed procedures for addressing abnormal operations. The company’s Operations Manual for Controllers provided guidance for the pipeline controllers working in the Renton control center. The manual predates the installation of the Bayview products terminal. It was not updated with information on Bayview before operations were begun at the facility or before the accident. The foreword to this manual states that the prevention of releases and the minimization of the consequences should a release occur take priority over pipeline schedules and cost minimization. The foreword states that “If there is any reason to believe that a release might occur or has occurred, the pipeline system should be immediately shut down and promptly investigated.” Chapter 5 of the manual covers abnormal operations. Section 5.1 refers to unintended mainline block closures. In subsection 5.1.2, the controller is instructed to: Investigate the cause of the high pressure by using all information available to find the cause and determine the level and duration of the high pressure reported by the equipment. The Controller should then call his supervisor to discuss the situation. The Controller will not restart the pipeline without concurrence from his supervisor. Subsection 5.1.3 states: If conditions indicate that a loss of fluid from the pipeline might have occurred, the pipeline will remain down and appropriate employees will be sent to investigate. Subsection 5.1.4 also states: If a loss of fluid from the pipeline is not apparent a static pressure test by segment is required…. If pressure is not lost, the pipeline may be restarted with concurrence from the supervisor. Section 5.2 covers unintended shutdowns of a pump unit or pumping station. Section 5.2 states that: 53 Although Olympic’s engineering manager has refused to answer questions from Safety Board investigators, investigators did learn that an October 14, 1998, design document indicates that Olympic had revised the intended set pressure of RV-1919 to 650 psig.

Factual Information 39 Pipeline Accident Report A pump unit shutdown caused by pressure changes such as high discharge, high case or low suction should be investigated immediately by the Controller to determine the cause for the pressure change. Data such as computer trends, protective device settings, and computer alarm limits will provide needed information to determine probable cause. Chapter 7 of the manual provides more local information for handling abnormal operations. Section 7.20, which addresses unauthorized operation of valves, states that “Valve malfunctions are to be reported to the Supervisor of Products Movement and a Maintenance Log written regarding the malfunction.” Section 7.22 requires that: Any operation that deviates from the normal mode of operations must be documented by the Operations Controller and by the field personnel involved…. This information is invaluable to prevent the same situation from occurring again and to assist personnel in rectifying this event. Olympic did not document the block valve closures, nor did the company view them as abnormal operations because the block valve was closing as intended by the design of the facility. The General Abnormal Operating Procedures section of Olympic’s Operations and Maintenance Manual contains similar guidance material for handling and documenting abnormal operations as contained in the Operations Manual for Controllers. One controller interviewed said that other controllers were initially concerned when Bayview was first commissioned because it was a new and unfamiliar facility. He also stated that different operational issues had not had an opportunity to “mature and be formally worked out.” He further stated that, during the months after Bayview began operations, some of these issues did get worked out, essentially by trial and error, although the controllers had not had an opportunity to try out all the operations that would have better familiarized them with the Bayview facility. The Bayview products terminal problems, according to one controller, increased the workload of the controllers operating that segment of the pipeline. He further stated that “any time that the facility shuts down and then closes the valves, it interrupts the pipeline and the flow of work…it causes the controller extra work.” During an abnormal situation along the pipeline, the controller operating that line segment was expected to identify and remedy that situation while also continuing to monitor and operate the other segments along his pipeline. Olympic did not have procedures in place whereby another controller or supervisor is assigned to modify the abnormal situation or operate other portions of the line. Another controller expressed what he said was a general sense of frustration with the problems at Bayview. According to documents reviewed by Safety Board investigators, the controllers’ concerns with the Bayview products terminal were often expressed to supervisors and to members of the engineering department.

Factual Information 40 Pipeline Accident Report According to Olympic controllers, the company had not provided any structured or formal training to its operations controllers after the Bayview terminal became operational. They said that management believed that, because the Bayview terminal was not fundamentally different from any other delivery or pump station facility on the system, no special guidance or training for controllers was needed Olympic added a chapter to the facility index section of its Operations and Maintenance Manual, effective November 23, 1998, that applied to the Bayview terminal. It contained a description of the facility, a list of equipment, a list of local alarm and remote indications, a table of set points for the various protective devices, a list of valves with their associated functions, and a station inspection checklist. The remainder of the manual, including the miscellaneous operations and general abnormal operating procedures sections, was not updated to include any reference to the Bayview facility. Olympic officials have told the Safety Board that, since the accident, the company has updated its manuals to reflect the new equipment associated with Bayview products terminal and has posted a flow diagram of Bayview on its control room wall. Postaccident Pipeline Excavation and Segment Retrieval Excavation of the ruptured pipeline was delayed for several days because of safety concerns associated with the presence of gasoline vapors and ongoing fires. The excavation was further delayed while a temporary water pumping station and water line could be constructed to bypass the water treatment plant pumping station. Excavation began, under Safety Board supervision, on June 27, 1999. On June 30, 1999, a 10 1/2-foot-long section of the pipeline containing the rupture was removed, crated, and sent to the Safety Board’s Metallurgical Laboratory for further examination. Numerous gouges and dents were visible on the ruptured section of pipe. (See figures 10 and 11.) In addition to the ruptured section of pipe, a second section of pipeline that extended from the south (downstream) end of the ruptured section was also retrieved. Previous in-line inspections conducted by Olympic had identified this section of pipe as containing anomalies. On July 8, 1999, the second pipe section was removed, crated, and shipped to Safety Board headquarters for further examination. The pipe section, which was about 10 feet long, contained dents about 1 1/2 feet downstream of a girth weld. (See figure 12.) At the rupture point, the top of Olympic’s pipeline was about 10 feet underground. About 20 feet south of the rupture, a 72-inch-diameter water pipeline crossed Olympic’s pipeline. The centerline of the 72-inch line was about 68 inches above Olympic’s pipeline (because of the change in grade, the Olympic pipeline was about 14 feet below the surface at this location). Two water lines, one 24 and the other 16 inches in diameter, joined at a tee fitting that was about 21 inches above Olympic’s pipeline and approximately 8 feet south of the rupture. Adjacent to the tee, on its west side, was a large concrete thrust block.

Factual Information 41 Pipeline Accident Report Figure 10. Removal of ruptured pipe section. Figure 11. Inside view of ruptured pipe section.

Factual Information 42 Pipeline Accident Report A 12-inch-diameter PVC utility conduit crossed about 31 inches above Olympic’s pipeline, with its centerline approximately 9 feet north of the rupture. (See figure 13.) Tests and Research Laboratory Examination of the Ruptured Pipeline Segment54 The ruptured segment of pipe contained a fracture that extended over a longitudinal distance of approximately 27 inches and had a maximum separation of 7 inches. The fracture originated at an external gouge mark in the pipe that was approximately 8 1/2 inches long and oriented longitudinally along the axis of the pipe. The gouge reduced the wall thickness of the pipeline by approximately 20 percent from about 0.31 inch to between 0.24 and 0.25 inch. There was no evidence of deformation on the inside surface of the pipe coexistent with this gouge. The fracture origin area was on the top portion of the pipe at approximately the 11 o’clock position.55 The surface of this Figure 12. Inside view of second removed pipe section showing dent. 54 Substantial delays in the examination of the damaged pipeline segments and the testing of RV-1919 occurred because of a separate criminal investigation into the accident. 55 The clock positions are reported looking downstream along the pipeline, where 12 o’clock is at the top. Since flow was from north to south, the north end of the pipe segment is the upstream end.

Factual Information 43 Pipeline Accident Report gouge mark revealed metal flow consistent with an object moving upstream relative to the pipe. (See figure 14.) Figure 13. Rupture location before removal of pipe showing proximity of water line tee connection. Figure 14. Sketch (not to scale) of the two pipe sections removed after the accident showing rupture site in relation to gouge marks. Gouges at left were near the point at which 72-inch water line crossed over the pipeline. (Only a small number of the gouge marks found on the pipeline sections are shown.) Cut line Crack Fracture origin Gouges Gouges Upstream (north) Downstream (south) Girth weld 24' 3"

Factual Information 44 Pipeline Accident Report The 27-inch gaping fracture intersected two other gouge marks. These two gouge marks extended upstream from the upstream end of the origin gouge mark at an approximate orientation of 20 percent from the longitudinal axis. These two gouge marks were 4 1/2 and 5 inches long, respectively. An inward dent was evident on the inside surface of the pipe coexistent with one of these gouge marks. One of these gouges was slightly deeper than the gouge at the rupture origin, with a remaining wall thickness of approximately 0.23 inches. The three gouge marks were connected and followed the contour of the fracture. The combined lengths of the three gouge marks (18 inches) intersected a major portion of the fracture. No metallurgical anomalies (manufacturing defects) such as slag inclusions or laminations were noted at the fracture origin. The absence of evidence of fatigue cracking (crack arrest marks) on any portion of the fracture faces indicates that the rupture was an overstress fracture that occurred in one event. Tensile testing was performed on three specimens removed from the pipe. The ultimate tensile strength of the pipe was determined to be between 69,300 and 70,100 psi, and the yield strength was determined to be between 52,600 and 56,500 psi. These values are above the minimums specified for pipe manufactured at the time.56 The same specification also calls for a minimum elongation of 22 percent for the given pipe wall thickness of 0.312 inches. The elongation for the three specimens measured between 32.6 and 33.8 percent. The chemical composition of a sample of the pipe was also determined to be in accordance with the specification. Approximately 27 additional gouge marks were evident on this 10-foot-long pipe segment. The longest of these additional gouges was approximately 36 inches. Inward deformations were visible on the internal surface of the pipe that corresponded to many of the gouges. No evidence of any postinstallation coating material repairs or additions was observed on the ruptured segment of pipe. Laboratory Examination of the Second Damaged Pipeline Segment In order to examine all of the anomalies identified during the in-line inspections, Safety Board investigators retrieved and examined a second segment of pipe that was just downstream of the ruptured segment. This segment of pipe was 119.6 inches long. The inside diameter of this segment contained three dents, each consistent with the location of an external gouge. These gouges and dents were located on the bottom half of the pipeline at approximately the 3:30 to 4 o’clock positions. The deepest of these deformations was 0.69 inch as measured from the inside pipe wall. It was located approximately 136 inches downstream of the center of the fracture origin. No evidence of any postinstallation coating material repairs or additions was observed on the ruptured segment of pipe. 56 The March 1963 issue of the American Petroleum Institute Standard 5LX for line pipe specifies a minimum ultimate tensile strength and yield strength of 66,000 psi and 52,000 psi, respectively, for this X52 grade pipe.

Factual Information 45 Pipeline Accident Report Testing of Additional Material Samples Foreign material was removed from several of the gouges on the damaged pipeline for comparison with two concrete and one CDF sample collected at the scene of the accident. The material removed from the gouged dents on the downstream section of pipeline (the one that did not rupture) was found to be consistent with the CDF backfill material. Examination of a section of pipe through the gouge mark at the rupture origin revealed that a foreign metal had been transferred onto the surface of the gouge mark. The chemical composition of the transferred metal was found to be consistent with steel with a high chromium content. Testing of Relief Valve RV-1919 Under the direction of Safety Board investigators, relief valve RV-1919 was tested under contract with Stress Engineering Services, Inc., in Houston, Texas. The Safety Board obtained exemplar Model 1760 pilots, one configured for low pressure and the other for high pressure, and conducted pressure tests of them on the RV-1919 relief valve, comparing the results with the performance of the accident pilot. In all of the pressure tests conducted, a static pressure exceeding the measured set point of each pilot control valve was applied on the inlet, or upstream, side of the relief valve. With the accident pilot installed, the pilot did not operate and the relief valve did not open, even with inlet pressures approaching 800 psig, almost 150 psig greater than the pilot set point.57 (X-ray examination revealed that adjusting the set point of the accident relief valve to 650 psig had overcompressed the valve spring, thus rendering operation of the pilot unreliable.) When the low-pressure exemplar pilot was installed on the relief valve and adjusted to the same set point as the accident valve, the pilot and relief valve also failed to operate. When the high-pressure exemplar pilot was installed on the relief valve, the pilot and the relief valve operated as intended. (See figure 15.) Once the tests were complete, the pilot and relief valves were disassembled and examined. The examination revealed no broken parts or any evidence that debris or other obstruction was present in the sensing lines that might have affected the operation of the pilot. The pilot cover, piston, and O-ring in the accident pilot were found to be the same as those in the low-pressure exemplar pilot. The report of the valve testing contained the following findings: • The components in the relief valve and the accident pilot were in good condition. There was no damage to any of the components that would have prevented the valve from functioning. • No debris or blockages were found in any of the components that would have prevented the valve from functioning. 57 This pressure exceeds not only the intended set point but also the rated pressure at Bayview terminal.

Factual Information 46 Pipeline Accident Report • When fitted with an exemplar high-pressure pilot, the relief valve operated properly. In each test, the relief valve operated whenever the inlet pressure exceeded the set point of the high-pressure pilot. • The accident pilot was configured as a low-pressure pilot, but an attempt had been made to increase the set point to that of a high-pressure pilot. • Increasing the set point of the low-pressure pilot to that of a high-pressure pilot compresses the pilot spring such that the relief valve will not operate reliably. • It is possible that the accident pilot could have failed to operate when in service due to the attempt to increase a low-pressure pilot to that of a high-pressure pilot. The pilot must open in order for the relief valve to open. It is conceivable that the accident pilot would operate at some times but not at others, rendering the operation of the relief valve unpredictable. Figure 15. X-ray photograph showing that when the original low-pressure pilot for relief valve RV-1919 was set to 650 psig or higher, the pilot spring was fully compressed.

Factual Information 47 Pipeline Accident Report Review of Computer Files and Data Backup tapes from the Olympic system were reviewed to see if they contained information about the SCADA system slowdown. Tapes made on June 10 (after the accident), July 14, and July 26 were examined. The SCADA historical files contain sensor data from all of the field sensors on the pipeline. Field devices are queried, or scanned, at varying times by the communications subprocess. In general, the scanning rate is determined by the nature of the sensor and its criticality to the operation and management of the SCADA system. On any given day, the daily historic file from the Olympic system will contain more than 102,000 individual entries collected repeatedly from the several hundred physical pipeline sensors. The historical files showed that the scan rate was consistent, scanning for data at about 3-second intervals, up until 3:19. At that time, the scan rate changed to about 30 seconds. This lasted for 2 minutes, after which the scan rate changed again to more than 400 seconds. The system briefly recovered to a normal scan rate at 3:27 (as OLY01 was coming on line) for almost a minute, after which it virtually stopped scanning any new data. The scan rate briefly returned to normal at 3:42 (when OLY02 came on line again) before changing to about 100 seconds. At 3:48, the scan rate again returned to normal. The behavior of the scan rate was consistent with the controller and system administrator observations and was also consistent with the changeover times from OLY02 to OLY01 and back to OLY02. (See figure 16.) Figure 16. Changes in SCADA scan rate (for pipeline data) during period of slow response or non-response of the Olympic SCADA system on the day of the accident.

Factual Information 48 Pipeline Accident Report The slowing/stopping of the sensor scan pattern was the only abnormality found that indicated that there was a problem with the SCADA computer control system. None of the host VAX computer logs or any of the error logs associated with the SCADA system captured any data that indicated that the system was having a problem completing its assigned tasks. A listing of the VMS files showed that 10 versions of the Accounting.dat log files were missing, five each from OLY01 and OLY02. These files generally contain information that can be used for billing purposes, such as computer usage time, file usage, and processor job submissions. Ten Operator.log files were also missing, six from OLY01 and four from OLY02. These files are created each time the system boots and record the system operations that are being performed by the computer operator. They include tape backup information, information about print jobs, disk or tape mounts or dismounts, and the start and end times of user tasks. The missing Operator.log files included the OLY01 file from June 10 that included the SCADA slowdown period. The other missing files did not contain information from June 10. All of the information in the Accounting.dat and Operator.log files refers to computer operations only; they are not SCADA system files and do not contain pipeline information. No Olympic employee interviewed was able to explain the missing files. The processing and memory capacities of the VAX computers were evaluated to see if insufficient computer system resources may have contributed to the SCADA system slowdown on the day of the accident. Investigations conducted by Olympic determined that, on the average (over a long period of time), about 75 to 80 percent of the computer system resources were in use on the Olympic system, with the leak detection software accessing the database of the primary machine. After the accident, Olympic upgraded the VAX hardware. With the new system, about 20 percent of system resources are devoted to SCADA operations (with the leak detection software accessing the database of the primary machine), with the balance available for unanticipated demands. After the accident, Equilon and Teledyne Control Applications personnel conducted investigations to determine if the Teledyne Control Applications SCADA software contained errors that may have caused the SCADA system to become slow or unresponsive on the day of the accident. The Equilon analysts suggested that database errors in the form of corrupted records had been encountered by other users of the software, and that error-handling routines had not been upgraded. A line-by-line analysis of the source code by Equilon and Teledyne determined that the error-handling routines were appropriate and required no modification. Although a variety of errors were intentionally introduced into new records that were then added multiple times to the database, analysts were unable to replicate the SCADA slowdown that occurred on the day of the accident. The testing did not uncover any problems in the error-handling routines that would place demands on system resources in excess of the reserve processing capability.

Factual Information 49 Pipeline Accident Report Postaccident Activities Management Restructuring of Olympic Pipe Line Company At the time of the accident, Olympic was a corporation consisting of three shareholders: Equilon Pipeline Company LLC (37.5 percent), ARCO (37.5 percent), and GATX Terminal Corporation (25 percent). According to information provided by Olympic, Equilon was under contract to manage operation of the pipeline for Olympic. Equilon disputes that it was responsible for operating the pipeline, stating that it only loaned employees to Olympic. At the time of the accident, most of Olympic’s senior management, including the president, vice-president/general manager, operations manager, and engineering manager, were from Equilon. On the day of the accident, senior Olympic personnel were touring the pipeline with representatives of a potential new shareholder. After the accident, BP Pipelines (now designated simply BP) acquired the ARCO holdings. When the contract for operating the pipeline came up for renewal, Olympic selected BP to operate the pipeline system. BP then acquired the GATX holding and is now the majority owner of Olympic. Since the accident, BP has conducted additional training of Olympic’s personnel, revised all of the Olympic procedures and practices, instituted BP’s management systems, and formalized Olympic’s integrity management program. As part of that process, BP has replaced all of the Equilon managers with its own. OPS Investigation and Corrective Action Order As a result of its investigation into the June 10, 1999, accident, the OPS issued a notice of probable violation that cited Olympic and Equilon for violations of several of the pipeline safety regulations. The notice cited them for, among other things, not adequately inspecting the construction activity at the water treatment plant, not taking immediate corrective action when the anomalies were discovered during the in-line inspections conducted in 1996 and 1997, not testing RV-1919 before placing it into service, and not investigating the frequent closure of the incoming block valve at Bayview. The notice also cited inadequate training, procedures, and record-keeping. As a result of these probable violations, the OPS proposed that a civil penalty of $3,050,000 be assessed against Olympic and Equilon. This was the highest civil penalty ever proposed by the OPS. Olympic and Equilon have requested an administrative hearing on the matter that has not yet been held. On June 18, 1999, the OPS found that “the continued operation of this pipeline without corrective measures would be hazardous to life, property, and the environment,” and issued a corrective action order restricting Olympic’s operations and outlining specific actions that Olympic must complete before returning its pipeline to full operation. The OPS subsequently issued two amendments to the corrective action order. The cumulative requirements of the corrective action order are summarized at appendix B.

Factual Information 50 Pipeline Accident Report Evaluation of Bayview Products Terminal Design and Operation After the accident, and in accordance with the OPS corrective action order, Olympic contracted with MARMAC to review the design of the Bayview products terminal. MARMAC’s January 13, 2000, report, Bayview Terminal Design Review, proposed several changes to improve operations at the terminal. One of the changes directly involves relief valve RV-1919. The piping connection from the incoming pipeline to the relief valve was originally made to the bottom of the incoming pipeline. Because of the location of this connection, the MARMAC study concluded that trash and debris could accumulate in this interconnection, thus possibly impairing the operation of the valve. In fact, debris in the form of sludge and bristles from a pipeline in-line cleaning device (“cleaning pig”) was noted during the removal of RV- 1919 after the accident and during the postaccident testing of RV-1923 performed by Olympic. This piping has since been reconfigured so that the connection to the relief valve now comes off the top of the incoming pipeline. The interconnection from the incoming Anacortes pipeline to RV-1923 was similarly reconfigured. A second design change effected as a result of the MARMAC study indirectly involves RV-1919. As originally designed, a flow switch, FS-2099, was installed on the pipeline to the transmix tank P-209 that produced a SCADA alarm in the control center whenever product was flowing into the tank. The flow switch was triggered by product flow from one of several possible sources: the donut manifold relief valves, the tank header relief valves, the sump pump, or the incoming pipeline relief valves, such as RV-1919. As a result of the accident, individual flow switches have been installed on each of the incoming pipeline relief valves, including RV-1919. This is intended as a design improvement to provide the pipeline controllers with a better understanding of what is occurring within the facility. A second relief valve, RV-2229, was also added upstream of the inlet block valve to Bayview and is intended to protect the pipeline from overpressurization. To further protect the upstream pipeline, Bayview’s PLC is now programmed to send a signal to the Ferndale PLC to stage down any running Ferndale units 45 seconds after an alarm indicates flow through either RV-1919 or the newly added RV-2229. Two of the changes Olympic made to the Bayview facility as a result of the accident and the MARMAC study involved control valve CV-1904. The extended piston stops in CV-1904 (and in CV-1916) were retracted to allow the valve to close completely. The pressure-sensing control line tap downstream of CV-1904 was also relocated to provide for quicker pressure sensing. Since these actions were taken, Olympic has taken the Bayview terminal off line, and product flow now bypasses the station. Evaluation of Pipeline Valve Spacing After the accident, and in accordance with the corrective action order issued by the OPS, Olympic contracted with MARMAC Field Services, Inc., to perform a review and

Factual Information 51 Pipeline Accident Report analysis of its valve spacing across the Olympic system. MARMAC prepared two reports: 16" - Ferndale to Allen Block Valve and Check Valve Effectiveness Evaluation, and 16" - Bellingham and Vicinity Block Valve and Check Valve Effectiveness Evaluation. The two reports covered the portion of the Olympic system that was involved in the June 10, 1999, rupture and release. At the time of the accident, remotely operated block valves were located on the section of 16-inch pipeline from Ferndale to Allen at MP 0.0 (Ferndale), MP 6.8, MP 16.2, MP 39.4 (Bayview), and MP 41.4 (Allen). After the accident and in accordance with the OPS corrective action order, Olympic installed a check valve, (a one-way valve that prevents product flow back upstream) adjacent to the block valve at MP 16.2, just downstream of the rupture location. Although the MARMAC study concluded that the installation of this check valve did not reduce the static release volumes58 calculated at the accident site because the valve was installed at the same location as an existing remotely operated block valve, its quicker action would be expected to reduce release volumes in the event of an upstream failure. As a result of the MARMAC study, another remotely operated block valve was installed on the pipeline at MP 11.9. MARMAC concluded that the installation of this valve reduced the potential static release volume from selected locations on the pipeline between MP 11.9 and MP 16.2 (the rupture occurred at MP 15.9) by an average of 466 barrels. The greatest reduction of the static release volume, 1,108 barrels, was projected at MP 12.34. As a result of the MARMAC study and the valve revisions performed after the accident, the largest potential static release volume reduction on the 16-inch Ferndale to Allen pipeline occurred as a result of the conversion of a hand-operated block valve to a remotely operated block valve at MP 33.7. This reduced the predicted static release volume by 5,272 barrels (68 percent) from 7,733 barrels to 2,461 barrels at MP 35.3. As a result of the valve modifications made after the accident as recommended by the MARMAC study, the largest potential static release on the Ferndale to Allen segment of pipeline was reduced by slightly more than 50 percent, from 7,733 barrels to 3,943 barrels, and would now occur at MP 32.7 (Samish River crossing). SCADA System Performance and Security Since the accident, Olympic has upgraded the VAX computers. Processor speed was increased, and memory was purchased to match the speed of the new processor. Various VMS and Vector parameters were updated to optimize computer operations. Both physical security of the control center and electronic access security of the SCADA computers have been addressed. Dial-up modems and external terminal connections have been removed. All connections to the SCADA system are via encrypted virtual private 58 Static volumes are based entirely on drain-down due to elevation changes in the pipeline. The static volumes do not include product that is released before the leak is discovered and the pipeline is shut down.

Factual Information 52 Pipeline Accident Report networks. Administrative workstations have virus protection software that is automatically updated. SCADA and VMS security audit logs, which contain detailed information about users, are reviewed routinely. Network vulnerability assessments have been completed and are conducted quarterly. Also since the accident, Olympic has installed a separate stand-alone computer to develop and test changes to the Vector SCADA database. All changes are installed and tested on the developmental computer before they are installed on the operational SCADA system. Other Information Federal Oversight DOT regulations for pipelines transporting hazardous liquids are found at 49 CFR Part 195, including testing requirements for overpressure safety devices and overfill protection systems at 49 CFR 195.428. According to 49 CFR 195.428(a): • Each operator shall, at intervals not exceeding 15 months, but at least once each calendar year…, inspect and test each pressure limiting device, relief valve, pressure regulator, or other item of pressure control equipment to determine that it is functioning properly, is in good mechanical condition, and is adequate from the standpoint of capacity and reliability of operation for the service in which it is used. The Federal pipeline regulations for new construction, at 49 CFR 195.262(c), also state that: Each safety device must be tested under conditions approximating actual operations and found to function properly before the pumping station may be used. Title 49 CFR Part 195 does not otherwise address testing methods or performance standards for relief valves or other pressure control equipment. Olympic has told the Safety Board that the method it used to test the pilot, discussed earlier in this report, was consistent with industry practice and met Federal regulations. Since the accident, the OPS has issued its integrity management rule that has added requirements for the evaluation of defects identified during in-line inspections. Specifically, 49 CFR 192.452(h)(5)(ii) requires that an operator schedule for evaluation and repair within 60 days “all dents, regardless of size, located on the top of the pipeline (above 4 and 8 o’clock positions).” Title 49 CFR 192.452(h)(5)(iv) also requires that an operator schedule evaluations and any needed repairs of pipelines if (1) data reflect possible mechanical damage located on the top of the pipe, (2) data indicate a change from a previous inspection, and (3) data reflect the presence of an “abrupt” anomaly.

Factual Information 53 Pipeline Accident Report OPS Preaccident Inspection Before the accident, on March 15 through 19, 1999, OPS representatives conducted an inspection of the Olympic pipeline system to determine whether Olympic’s facilities and operations were in compliance with applicable pipeline safety regulations. As a result of the inspection, the OPS issued a letter of concern to Olympic citing four areas of concern. The OPS did not issue a notice of any probable violations of the pipeline safety regulations as a result of its inspection. The first concern was related to Olympic’s operations and maintenance procedures. The pipeline safety regulations at 49 CFR 195.402(a) require: Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies. This manual shall be reviewed at intervals not exceeding 15 months, but at least once each calendar year, and appropriate changes made as necessary to insure that the manual is effective. This manual shall be prepared before initial operations of a pipeline system commence, and appropriate parts shall be kept at locations where operations and maintenance activities are conducted. In its letter of concern, the OPS stated: OPL [Olympic] has recently adopted Texaco’s operations and maintenance manuals that were reviewed within the last couple of years by a team of OPS inspectors. These manuals were accepted in their entirety as being in compliance with 49 CFR Part 195. Also, in discussions with OPL personnel, it was discovered that OPL will more than likely adopt the Equilon manuals as soon as they are combined from the Texaco and Shell manuals. OPL has an ongoing plan to incorporate their site specific plans and procedures into these newly adopted manuals. Eventually, OPL will complete this manual transformation. Until that time, care must be taken to ensure compliance with current procedures contained within the applicable manuals by operations and maintenance personnel. The remaining three areas of concern involved clearing areas of the pipeline right- of-way to allow aerial patrols, corrosion of the flange bolts in a valve pit, and moving pipelines under pressure. The OPS did not identify abnormal operations on the Olympic system, since Olympic had not documented any such occurrences, nor did it note that the Bayview facility had been commissioned without the testing of RV-1919 under approximate operating conditions. Environmental Response and Remediation On June 10, 1999, U.S. Environmental Protection Agency (EPA) Region 10, Seattle, Washington, established the unified command in support of the Bellingham Fire Department and the Washington State Police. The unified command included the EPA, the WDOE, Washington State Police, the city of Bellingham, the Lummi Tribe, and Olympic. The unified command managed the incident response involving the Federal, State, and local agencies including the joint information center, and prepared daily incident action plans, which directed daily operational activities, and pollution reports, which provided updates on the operations.

Factual Information 54 Pipeline Accident Report Under the Olympic spill response plan, Olympic established a command center at its Renton office to handle notifications and initial response activities. Meanwhile, Olympic spill team members flew to the city of Bellingham command center, where they were integrated into the unified command with Federal, State, and local response agencies. The initial Olympic response resources included a helicopter, a spill trailer with equipment taken from Olympic’s Renton and Allen stations, the Equilon regional response team, and several spill and consulting contractors. Upon realizing that a release had occurred, Olympic personnel in the control center and in the Renton office began to contact and mobilize field employees. Personnel were sent to obtain boom materials and to proceed to Bellingham. Additional field personnel were sent to the block valves at MP 7 and MP 16 to verify that they were closed. During the initial response on June 10, 1999, efforts were underway to track downstream impacts and secure the mouth of the creek at the harbor with boom. Olympic environmental response activities initially included boom deployment at the mouth of Whatcom Creek in Bellingham Bay, along with mop-up of remaining product residues in the creeks using sorbents and vacuum trucks. Olympic field personnel moved trailers with sorbent materials and boom to Bellingham and its Allen station. Pockets of product remaining in Whatcom Creek near Iowa Street and in the vaults at the water treatment plant were removed by vacuum truck the morning of June 11. Also on June 11, Olympic’s emergency response team, Equiva Services, was mobilized from Houston, Texas, to Bellingham. A natural resource damage assessment team consisting of representatives from the National Oceanographic and Atmospheric Administration (NOAA), the National Marine Fisheries Service, the U.S. Fish and Wildlife Service, the city of Bellingham, and the WDOE initially met on June 12 to begin planning the damage assessment of the Whatcom Falls Park. Under the direction of the unified command as the principal decision-making body, Olympic implemented an emergency restoration plan for habitat restoration of the 25 burned acres on Whatcom and Hannah Creeks. The initial restoration of the creeks was completed in time for the August salmon run. More than 1,200 feet of the creek bed and banks were removed by excavator along the upper portion of Hannah Creek where the creek bed and banks were saturated with gasoline up to 5 feet into the creek face. In these areas, the creek was dammed and bypassed through a pump and an 8-inch-diameter PVC pipe to Whatcom Creek. Following its excavation, the creek was backfilled with glacial gravel tills. Trees, jute mats, gravels, and boulders were placed to groom the creek. Water was eventually rerouted back into the creek. Additionally, a 450-foot horizontal boring was installed for an interception trench 25 feet below grade between the subsurface gasoline source area at the Dakin-Yew pump station vault and Whatcom Creek. This trench successfully intercepted the gasoline moving north through the shallow bedrock prior to entering Whatcom Creek where seeps

Factual Information 55 Pipeline Accident Report had been observed in the first days of the incident. Finally, a pump and gasoline/water separation system was installed, which drew down the ground water and intercepted the gasoline that migrated toward Whatcom Creek. To address additional residual gasoline in surrounding areas that were not excavated, a vapor extraction system was designed and installed with a catalytic oxidation system. The system was completed under the emergency restoration plan, bypassing any potential permit delays related to construction, and began operation on December 15,

1. Future efforts will include the operation and maintenance of the systems for several

years until the site is remedied. It is anticipated that a long-term creek restoration plan will be developed to include the operation and maintenance of the vapor extraction and ground water interception systems. Excavation steps removed the majority of unburned gasoline. Soils were sampled and trucked to Tacoma, Washington, where they were incinerated. Contaminated soils near the pipeline break were excavated, and soils were incinerated off site. More than 9,500 cubic yards of contaminated soils were removed, of which 2,000 yards were removed from Hannah Creek, and 7,500 yards were removed from the pipeline rupture area and water pump vault area. As of October 7, 1999, a total of 16,717 gallons of gasoline were recovered, and Bellingham’s drinking water capacity was restored. Emergency source area remediation activities were completed in January 2000. The EPA concluded that: “The Whatcom Creek Incident was an excellent example of the incident command system being used as an effective management tool for a large, multi-jurisdictional emergency response and subsequent cleanup activities.” Before the accident, Olympic conducted tabletop and/or equipment deployment drills to test the readiness of response personnel and equipment on May 7, 1997, September 9, 1998, and April 7, 1999. Spill management team tabletop and deployment drills were conducted annually to review the response plan preparedness. In its evaluation of the May 1997 tabletop drill, the WDOE strongly encouraged Olympic personnel to get additional training in the incident command system before the upcoming worst-case spill drill in 1998. Olympic complied with the request, and WDOE evaluation of the company was that it performed well in the 1998 area exercise. The area exercise was conducted at the ARCO Cherry Point Refinery in Whatcom County in September 1998 under the direction of the OPS. This exercise was conducted as part of a continuing series of spill response training exercises aimed at improving the effectiveness of the Olympic spill management team. The focus of the drill included exercising the Northwest Area Contingency Plan, Olympic Oil Spill Response Plan, using the incident command system, as well as improving the ability of Olympic to work with Federal, State, and local spill response agencies and form a unified command. The response exercise involved a hypothetical 5,500-barrel spill of diesel fuel into the Nooksack River and Bellingham Bay.

56 Pipeline Accident Report Analysis The Accident A number of events and conditions set the stage for the June 10, 1999, rupture of the Olympic pipeline in Bellingham, Washington. First, chronologically, was excavation damage that was done to the pipeline in the vicinity of the eventual rupture. This damage weakened the pipeline and made it susceptible to failure under pressures that an undamaged pipe could probably have withstood. Although indications of this damage were detected during subsequent in-line inspections of the pipeline, Olympic did not excavate and inspect the pipeline to evaluate its condition. Second was the construction and startup of the Bayview products terminal. During construction of the terminal, pressure relief valves were installed that were found to be improperly configured or adjusted, and the actions taken by the company to test and correct the valve settings were ineffective. When the Bayview terminal came on line, about 6 months before the accident, controllers discovered operational issues that they believed resulted from the proximity of the Bayview terminal to a previously existing pumping station. The controllers said they did not believe they were adequately trained or otherwise prepared to deal with these operational issues. The controllers reported these issues, but they were never corrected, apparently because management did not recognize them as critical. Finally, on the day of the accident, the SCADA system that controllers used to operate the pipeline became unresponsive, making it difficult for controllers to analyze pipeline conditions and make timely responses to operational problems. This analysis will address these events and conditions and evaluate their respective contributions to the accident. Damage to the Pipeline About 20 feet of the 16-inch accident pipeline, which included the rupture location, were removed and taken to Safety Board headquarters for further examination. Laboratory examination revealed 33 gouges in the external pipe surface, almost all of them along the pipe’s upper surface. The 27-inch-long rupture originated at one of these gouges. Examination revealed that foreign metal consistent with high-chromium steel had been transferred to the surface of the pipe in the gouge at the rupture origin. The presence of high-chromium steel, which is typically used in excavation equipment, such as in the

Analysis 57 Pipeline Accident Report teeth of a backhoe bucket, indicates that the damage found on the ruptured pipeline occurred during excavation activities. Hydraulic modeling performed after the accident indicates that the pressure in the pipeline at the time and location of rupture reached approximately 1,433 psig. This was below the maximum operating pressure of 1,440 psig (revised to 1,456 psig after the accident) for this segment of the pipeline. At 100 percent of yield, the pipeline should have held 2,028 psig and, just after its installation, the pipe had been hydrostatically tested to 1,820 psig. Because laboratory testing of the tensile and yield strength for the pipe material showed that it met original specifications, the Safety Board concludes that had the accident pipeline not been weakened by external damage, it likely would have been able to withstand the pressure that occurred on the day of the rupture, and the accident would not have happened. Some of the external damage to the pipe resulted in metal loss or internal deformations that would be expected to register as anomalies during an in-line pipeline inspection with either a magnetic flux or caliper tool. No anomalies were detected at this location during a 1991 magnetic flux in-line inspection, but some were found during a similar inspection in 1996, suggesting that the damage occurred as a result of excavations performed between 1991 and 1996. One of these anomalies, an internal deformation near the rupture location, was also reported to Olympic after a caliper tool inspection was performed in 1997. Excavations in the Area of the Eventual Rupture The only excavation activity known to have occurred in the area of the rupture between 1991 and 1996 was that associated with the installation of the pumping station and the associated ancillary water lines during modifications to the Dakin-Yew water treatment plant in 1993-94. On two occasions in early 1993, during the design phase of the project, the Olympic pipeline and nearby water pipelines were positively located by potholing. An Olympic inspector was on site on both occasions. He reported that he had probed the Olympic pipeline with a steel bar and that all excavations within 2 feet above the pipeline were performed using shovels. He stated that he did not observe any damage to the pipe done during either potholing event. Given the nature of this type of excavationdigging down to locate the top of a pipeline that all present know is therethe Safety Board does not consider it reasonable that the extensive damage found on the Olympic pipeline occurred as a result of potholing. The Safety Board received a report from a witness on site who said that, while excavating to realign valve risers at a tee connection (about 8 feet south of the rupture), an equipment operator for IMCO, the city’s construction contractor, struck Olympic’s pipeline. The witness said the IMCO employees decided not to notify the project’s construction inspector or one of Olympic’s representatives but to repair the damage to the

Analysis 58 Pipeline Accident Report pipeline coating and continue with the work. This report could not be confirmed. Evidence of a coating repair was not found on the pipeline that ruptured, although it is possible that the mastic material dissolved after the accident while the pipeline was immersed in soil saturated with gasoline. Nevertheless, even if the report is accurate, it would explain only a small portion of the damage found on the pipe. The damage found on and near the rupture site could only have occurred as a result of mechanized excavation equipment contacting the pipeline. The excavations that occurred during the project were extensive and often involved locating and exposing the accident pipeline. Moreover, the damage to the pipeline had to have occurred between 1991, when in-line inspection revealed no anomalies in the area of the eventual rupture, and 1996, when another in-line inspection identified anomalies reflecting the damage. The water treatment plant excavations, which occurred in 1993 and 1994, were the only known excavations, other than initial potholing to locate the pipeline, that occurred in this area within that time frame. And, as noted previously, potholing would not account for damage of the nature or extent found on the pipeline. About 11 feet away from the rupture was a group of three gouged dents near the point at which a 72-inch water line crossed the Olympic pipeline. Photographs taken during IMCO’s installation of the water line show that the Olympic pipeline was exposed during the water line installation and that the gouged dents would be located near the north edge of the ditch excavated to install it. Further, the presence of CDF material in the gouged dents indicates that the gouges themselves must have been present when CDF was poured. The Safety Board therefore concludes that the damage to the Olympic pipeline that led to its failure on June 10, 1999, occurred during IMCO excavations associated with the Dakin-Yew water treatment plant modification project. The Safety Board documented at least four instances during the water plant modification project in which IMCO excavated in the immediate vicinity of Olympic’s pipeline without Olympic’s knowledge or without an Olympic employee being present, even though the action memorandum and on-site discussions with Olympic’s inspectors clearly required IMCO to notify Olympic in advance of such excavation. Two of these instances, the installation of the water line tee and the subsequent excavation of the valve at the tee to realign the risers, occurred near the rupture location. No documentation was produced to indicate that Olympic had been notified on either occasion or that its employees were on site during either excavation. Because Barrett had worked directly with Olympic during the design phase of the modifications, it should have ensured that Olympic was aware of the tee’s installation. IMCO, however, was clearly responsible for notifying Olympic before all excavation activities, yet it failed to do so. An Olympic inspector was on the site for a portion of the day on July 6, 1994, the day that excavation to install the tee was initiated, but the excavation was not started until the afternoon, and there is no evidence that the inspector was on scene at that time. The excavation for the tee did, however, remain open for several days, and although Olympic’s inspector made occasional visits to the site during this time, the inspector made no documented effort to investigate this excavation or question IMCO about it, even though it was only about 100 feet away from the excavation he was

Analysis 59 Pipeline Accident Report reportedly inspecting. In addition, even though Olympic was not notified of the design change that caused the tee to be installed above its pipeline, these changes would certainly have been reflected in the as-built drawings maintained by the contractor at the job site. But Olympic inspectors acknowledged that they did not make it a practice to check the drawings or routinely discuss planned activities with IMCO’s foreman. Had Olympic been more aggressive in its monitoring of the water treatment plant project, it is possible that the company would have realized that additional excavation was occurring that it was not aware of and may have taken action to ensure that the pipeline was exposed and inspected for damage. The Safety Board concludes that Olympic inadequately inspected excavation work performed by IMCO during the water treatment plant project and consequently failed to identify and repair the damage done to the pipeline. Evaluation of In-line Inspection Information To comply with a 1996 WDOE order, Olympic was required to review the results of its previous in-line caliper tool inspections and to run a caliper tool though its pipelines where caliper tool data did not exist. The purpose of the caliper tool run was to identify geometric anomalies such as dents and wrinkles, especially those similar to the Ebey Slough area failure that resulted from buckled pipe and that had prompted the WDOE order. A report was required to explain the cause of all anomalies identified, and any significant anomalies that could not be explained by an examination of the data were to be verified by field inspection. In early 1997, Olympic’s engineering assistant gathered all in-line inspection reports, including the 1991 and 1996 magnetic flux in-line inspection reports and the new 1997 caliper tool inspection report, and correlated the locations of the anomalies in the water treatment plant to the physical features along the pipeline so their exact locations could be pinpointed for excavation. Olympic’s engineering assistant noted that the 1996 magnetic flux inspection and the 1997 caliper inspections showed anomalies in the portion of pipeline that crossed through the water treatment plant. He was also aware that these anomalies were not identified during the 1991 magnetic flux inspection. Tuboscope, in its 1996 magnetic flux inspection report, identified a 23-percent wall loss defect as a possible mill/mechanical defect and one of the features as a possible wrinkle bend. But mill/mechanical defects are associated with the pipe’s manufacture, and wrinkle bends occur during installation of the pipeline. Thus, both these conditions should have been found and reported on the 1991 survey. Since they were not, the engineering assistant should have questioned this report and investigated further to identify the source of these anomalies. In order to ensure the integrity of a pipeline, the operator should assemble and evaluate all of the pertinent pipeline data available. The engineering assistant reviewed the pipeline alignment sheets and found that several foreign lines crossed the pipeline in the vicinity of the anomalies, including the 72-inch water line that crossed Olympic’s pipeline approximately 2 feet south of the reported 23-percent wall loss anomaly and the

Analysis 60 Pipeline Accident Report associated possible mash;59 however, he did not check the date of installation of these foreign lines. Had he done so, he would have realized that a major construction project had occurred in the area in 1994 that may have readily explained the presence of the anomalies in the 1996 and 1997 in-line inspections that were not present in 1991. Gouges cannot be evaluated in the same manner as corroded pipe. A gouge is considered to be a defect that is more severe than a corrosion defect of equivalent size because a gouge typically is associated with metal deformation that leaves a sharp edge. Such an edge acts as a stress concentrator. With the pipeline information available, the engineering assistant should have considered that the 23-percent wall loss defect could have been a gouge, possibly a gouge in a dent because of the reported mash associated with it. As such, it would exceed the ASME B31.4 criteria of 12 1/2 percent for the repair of gouges, and the anomaly should have been excavated and examined. In addition, any dent containing a gouge must be repaired per ASME B31.4, regardless of the depth of the gouge or the extent of the deformation. Instead, Tuboscope and the engineering assistant evaluated the anomaly using calculations intended to evaluate the remaining strength of corroded pipe, even though the anomaly was not identified as corrosion. Based on this evaluation, the engineering assistant determined that the defect posed a minimal risk. Even though this anomaly was 11 feet downstream of the eventual rupture, had Olympic excavated and identified the anomaly as a gouge in a dent, the company would have had sufficient information to justify further investigation of the other reported anomalies, including the defect near the rupture site. Based on the engineering assistant’s initial evaluation and its report to the WDOE, Olympic did plan, in early 1997, to excavate the area where the anomalies were found, but when company personnel first went to the area, they found that it was too wet to be excavated, and they postponed the work. Later, in July 1997, the engineering assistant reevaluated the anomalies and decided that they did not require further investigation. He said he had probably forgotten when he did his reassessment that these anomalies were not present in 1991. He also said he had lost confidence in the ability of magnetic flux inspection tools to locate deformations because Tuboscope did not report a pipe buckle that later resulted in a leak in another pipeline. But his doubts about the ability of a magnetic flux tool to find a deformation should have made him even more attentive to such indications when they were reported to him. He also said his concern about anomalies identified by the caliper inspection was lessened after several identified anomalies had been excavated previously and found to be less severe than reported. And because the dent reported by Enduro was only approximately 3 percent deep, he decided not to have the pipe visually inspected. But the data from this type caliper tool are insufficient to accurately characterize such an anomaly, and the ASME criteria relied on by the engineering assistant in making his decision are not intended to apply to such data but to data obtained during a visual inspection of the defect. Since Olympic was performing the caliper inspections under an order from a regulatory agency and as a result of a previous leak in a pipe buckle, the company should 59 It should be noted that the water line tee located south of the reported possible wrinkle bend and the associated 0.45-inch total sharp deformation was not shown on the alignment sheets because Olympic was not aware of its installation.

Analysis 61 Pipeline Accident Report have been particularly sensitive to the reports of any deformation. In this case, near the point of eventual rupture, Tuboscope originally reported indications of deformation as a possible wrinkle bend that was then confirmed by Enduro to be a sharp defect. Thus, two inspection companies, using different inspection tools, identified anomalies in the same general area where no anomaly had been found previously. This alone should have prompted Olympic to act. Even if the defect had been a wrinkle bend, as suggested by Tuboscope, Olympic should have known that this was an undesirable pipeline feature that is no longer allowed for new construction. Further, even though Tuboscope, because of limitations of the magnetic flux tool, did not report any metal loss at this location, deformations may mask indications of metal loss that would otherwise be found by a magnetic flux in-line inspection tool. To verify that there was not a gouge within the deformation, Olympic would have had to excavate and visually inspect the pipeline. Had Olympic done so, it would have found severe damage to the pipeline that it would have repaired. The Safety Board concludes that the in-line pipeline inspection data provided to Olympic, along with the excavation activity Olympic knew occurred in 1993 and 1994, were sufficient to justify the excavation and examination of the pipeline in the area of reported anomalies, but the company did not perform the work and thus did not identify the true extent of the damage. The OPS integrity management rule that was issued after the accident has added requirements for the evaluation of defects identified during in-line inspections, including the requirement that an operator schedule for evaluation and repair, within 60 days, dents of any size located on the top of the pipeline. Because the deformations found after the Bellingham accident fall within these criteria, Olympic would have been required to schedule repairs within 60 days. Additional provisions of the integrity management rule require that pipelines be evaluated and necessary repairs made if data reflect possible mechanical damage on the top of the pipe, or if data indicate a change from a previous inspection, or if data reflect the presence of an “abrupt” anomaly. Any of these provisions, had they been in effect at the time of the accident, would have applied to the Olympic pipeline. SCADA System Performance After the Bayview products terminal came on line in December 1998, controllers began to experience operational difficulties that often involved pressure increases within Bayview that caused the inlet block valve upstream of Bayview to close, essentially shutting down the pipeline. Between December 1998, when the Bayview terminal came on line, and June 1999, when the accident occurred, the inlet block valve closed 41 times because of high pressure at Bayview. On each occasion when the inlet block valve closed unexpectedly, controllers had been able to take some action that kept the pressure across the weakened section of pipeline below that which later caused the pipe to rupture. During 13 (32 percent) of these events, pressure upstream of the block valve exceeded 1,000 psig. The highest pressure recorded upstream of the closed valve was 1,339 psig, which was less than the 1,500 psig maximum pressure reached on the day of the rupture.

Analysis 62 Pipeline Accident Report On the day of the accident, however, the SCADA system was unresponsive to the commands of the controllers. Had the controller been able to start the pump at Woodinville, it is probable that the pressure backup would have been alleviated and the pipeline operated routinely for the balance of the fuel delivery. The controller was apparently attempting to systematically slow or shut down the line, as evidenced by his call to the electrician at Allen station to locally shut down one of the pumps. Even if the controller had been unable to prevent the pressure buildup and the subsequent closure of the inlet block valve at Bayview, had he had full SCADA control, he may have been able to slow down the pipeline sufficiently to reduce the severity of the pressure increase when the block valve did close. Higher than normal pressures and higher stress concentrations in the vicinity of gouges both increase the likelihood of deformations and cracking that can lead to a pipeline rupture. However, because the rupture was an overstress separation, with no indications of fatigue, it is likely that the pipeline would not have ruptured on the day of the accident had a pressure spike not occurred. The Safety Board concludes that if the SCADA system computers had remained responsive to the commands of the Olympic controllers, the controller operating the accident pipeline probably would have been able to initiate actions that would have prevented the pressure increase that ruptured the pipeline. Investigators attempted to determine why the SCADA system, which was not reported to have experienced operational problems before the accident, became slow or unresponsive on the day of the accident, and at a critical time during the pipeline operations. About the same time the accident controller was preparing to change delivery points on the 16-inch pipeline (about 3:00), the system administrator was in the control center computer room entering two new records into the SCADA historical database. The system administrator was working on the OLY02 computer, which was the primary SCADA computer at the time. (Had he been working on the backup OLY01 computer, the result would have been the same, because each computer mirrored changes made to the other.) At about 3:10, a few minutes after the new records were entered into the system, the SCADA computer began to generate error messages related to the historical database. At that point, the system administrator should have notified his supervisor and the controllers that the computer was acting abnormally. Instead, after checking the records he had entered and finding no problems with them, he left the computer room and did not return for about 15 minutes. If the accident controller had been notified promptly at 3:10 that the SCADA system appeared to be malfunctioning, he may have responded differently before initiating the switch of delivery points. Also, if the control center supervisor had been notified promptly, he may have been able to quickly restore the computers to normal operations (as he did 30 minutes later). The SCADA problems grew more pronounced over the next 20 minutes, during which, at one point, the system became completely unresponsive. This period of non- responsiveness coincided with the rupture of the pipeline at about 3:28. The SCADA

Analysis 63 Pipeline Accident Report problems encountered by the controllers occurred shortly after the system administrator inserted new records into the system computer and were resolved after the control center supervisor deleted the new records. Also, the system administrator said that as the new records were being deleted, he noticed a typographical error in the records that had not been there when the records were checked earlier. Because of this and the fact that the SCADA system had not previously exhibited a similar non-responsiveness, the Safety Board concludes that the degraded SCADA performance experienced by the pipeline controllers on the day of the accident likely resulted from the database development work that was done on the SCADA system. Analysis and testing performed by Olympic and Equilon, working in conjunction with the SCADA software vendor, failed to identify any coding within the SCADA software that would have caused the system anomalies encountered on the day of the accident. The testing data did not uncover any problems in the error-handling routines that would place demands on system resources in excess of the reserve processing capacity. Records with known errors were repeatedly input into the historical database, but the computer slowdown of June 10, 1999, could not be replicated. Because the problems the SCADA system experienced on the day of the accident could be neither explained nor replicated (the records entered just before the slowdown were deleted to stop the abnormal computer operations), the exact fault in the historical database that initiated the system’s failure on the day of the accident will probably never be known. For the same reason, what effect, if any, the processing capacity of the SCADA computers had on the slowdown cannot be determined. As noted earlier, the system administrator was working on the “live” system. And even though the SCADA system was configured to permit alterations to be made to the historical database while the system was on line, the Safety Board does not consider this to be prudent practice. Computer systems, while they have proven their worth in all modes of transportation, are not infallible, nor are their operators and administrators. Newly developed computer routines do not always work correctly at first and must be revised. Sometimes, seemingly simple mistakes can result in catastrophic consequences, even on the most robust of operating systems. Olympic personnel used the operational system as a test bed to develop changes and upgrades to the database without first testing the changes on a separate off-line system. SCADA developmental work or database modifications should be performed on a developmental workstation that allows any revisions to be thoroughly tested off line. Only after such tests have verified that the system works as intended and the testing has been reviewed by personnel trained in analyzing the test methods and results, should the changes be entered into the SCADA real-time computer. The Safety Board concludes that, had the SCADA database revisions that were performed shortly before the accident been performed and thoroughly tested on an off-line system instead of the primary on-line SCADA system, errors resulting from those revisions may have been identified and repaired before they could affect the operation of the pipeline.

Analysis 64 Pipeline Accident Report Even though, after the accident, Olympic installed a separate stand-alone computer to develop and test changes to its SCADA database before applying those changes to the on-line system, the Safety Board is concerned that other operators who use SCADA systems may still be performing SCADA developmental work on a live system. The Safety Board therefore believes that the Research and Special Programs Administration (RSPA) should issue an advisory bulletin to all pipeline operators who use SCADA systems advising them to implement an off-line workstation that can be used to modify their SCADA system database or to perform developmental and testing work independent of their on-line systems. Further, RSPA should advise operators to use the off-line system before any modifications are implemented to ensure that those modifications are error-free and that they create no ancillary problems for controllers responsible for operating the pipeline. The VAX-VMS system that was used as the platform for Olympic’s SCADA system is a multi-user system, but all authorized Olympic computer operators used the same login. Thus, even though the operating system could track individual users, the system had no means of distinguishing one user from another. This single-login policy severely limited the ability of the company to audit the system or to assign individual accountability for actions performed on the VAX or SCADA system. Furthermore, all authorized users had system administrator privileges, allowing them to manipulate or delete any and all of the files contained on the system. Because they all used the same login name, no record of exactly who performed what action was available. Another drawback of using one login account is that all users used one system resource setting for all of their activities. VMS has the ability to allocate its resources based on a login’s permissions. This feature is implemented in a multi-user system to keep one user from consuming all of the available system resources. The one account that the Olympic operators were using contained sufficient authority to allocate any and all available system resources for their task, taking all priority away from the operational pipeline system. Investigators examined backup tapes from the SCADA system and found a total of 20 missing files. No one available to be interviewed had a satisfactory explanation for the missing files. These files contained primarily accounting and computer operating system administrative data; they did not contain pipeline data, and their absence would have had no effect on SCADA operations. The SCADA system was connected via a bridge to the rest of the building network. It was also directly accessible via dial-in modem. No firewalls or access monitoring were incorporated into the system. These protections should have been installed to isolate the system from a “hacker” attack. Although no evidence was found to suggest that an intrusion by an unauthorized or unknown user caused the computer slowdown that occurred on the day of the accident, the lack of basic security features related to the SCADA system could allow such an intrusion in the future. The Safety Board concludes that Olympic did not adequately manage the development, implementation, and protection of its SCADA system.

Analysis 65 Pipeline Accident Report Since the accident, Olympic has taken a number of steps to improve its SCADA system performance, reliability, and security, including increasing computer processing speed and capacity and addressing both physical security of the control center and electronic access security of the SCADA computers. Actions of the Accident Controller Safety Board investigators evaluated the timeliness and appropriateness of the controller’s actions during the accident sequence. This evaluation was hampered by the fact that the controller declined to speak to Safety Board investigators. The accident controller had 16 years’ experience as a pipeline controller at the time of the accident. He had successfully completed the requisite training and had received the second-highest overall rating on his most recent performance appraisal. He had been fully qualified by Olympic to operate the pipeline. When the delivery points were switched, pressure in the pipeline began to build. According to other controllers interviewed, this was a normal occurrence, and the standard response was to start a second pump at the Woodinville station. This is what the accident controller attempted to do, but he could not start the pump because of the non- responsiveness of the SCADA system. Because the Woodinville station was unattended, he had no timely alternative means of starting a pump there. Without the extra Woodinville pump, pressure would continue to build upstream of that station. In an apparent attempt to systematically shut the pipeline down, he called an electrician at the upstream Allen station and asked that a pump there be shut down to slow the flow of product toward Woodinville. Meanwhile, the uncontrolled pressure buildup had begun to reach overpressure protection settings, thus shutting down pumping units along the pipeline and initiating the closure of the inlet block valve at Bayview. This chain reaction effect went virtually unchecked because of the slow response or non-response of the SCADA system. The computer system administrator then shut down the primary SCADA computer in preparation for bringing the backup computer on line. Approximately 1 minute after the backup OLY01 system was brought on line as the primary computer, the pipeline ruptured. At that point, the pipeline had been virtually shut down by the tripping of pumps and the closing of the valve. The accident controller, about 7 minutes after the rupture, called personnel at the ARCO refinery near Cherry Point and asked that they discontinue pumping product to the Cherry Point station. It is not clear what or how much information was available to the controllers between the time the SCADA system OLY02 was brought down and the time it was brought back up and stabilized about 20 minutes later, at about 3:48. But none of the readily available information indicated that the pipeline had ruptured. The inlet block valve upstream of the Bayview terminal had closed repeatedly in the preceding 6 months, and each time, the pipeline was restarted without incident.

Analysis 66 Pipeline Accident Report Olympic procedures called for the accident controller to determine the cause of a pressure change that shuts down a pump by reviewing such data as pressure trends. In the accident, the first pump that went down was one of the boosters at Bayview. Safety Board investigators could not determine whether the accident controller reviewed any pressure trends before restarting the pipeline. Because the SCADA screens for Bayview were still under development 6 months after the facility’s startup, no pressure trend SCADA screen for Bayview was readily available to the accident controller. Safety Board review of the data captured by the SCADA system in Renton indicated that the only data that would have indicated to the accident controller that a rupture had occurred was the pressure trend upstream of the inlet valve at Bayview that had been recorded on the OLY01 system. Although this pressure trend data was probably not available to the accident controller until 4:04, or shortly thereafter, when the OLY01 computer was restarted, had the accident controller reviewed this trend, and it is unclear whether he would have done so had it been available, he might have investigated the pressure indications and not restarted the pipeline. At 4:11, the accident controller restarted the pipeline by opening the inlet block valve for Bayview and, a few minutes later, notifying personnel at the ARCO refinery to resume delivery. By taking these actions, the accident controller significantly increased the amount of product released. The effect of the additional product release on the resulting fire cannot readily be quantified. The fact that the accident controller called the electrician at the Allen station to verify a pressure reading there indicates that the controller was watching pressures along the pipeline after he restarted it. He probably thought he had a slack line condition, since the only pump still operating after the line shut down was at Woodinville. This would have delayed his recognition that a release had occurred and lessened the perceived validity of any leak detection alert. In taking these actions, the controller was working under the direction of his supervisor, who had approved the restart and who thus also apparently did not believe additional actions to verify the integrity of the pipeline were necessary. About 4:30, approximately 13 minutes after the pipeline was restarted, the pipeline leak detection system issued an alert for a possible leak. About the same time, the control center received a call from an Olympic employee on his way home who reported the presence of gasoline in Whatcom Creek. Within minutes, the controller had initiated actions to close mainline block valves to isolate the rupture and to stop the transfer of product into the pipeline from ARCO. Company Oversight of Bayview Products Terminal Construction Control Valve CV-1904 Control valve CV-1904 was installed at the inlet to the Bayview products terminal to maintain pressure to the facility below about 600 psig. Although CV-1904 had extended piston stops that limited piston travel to within approximately 10 percent of full closure, the stop limit was never reached during the accident. The unintended presence of extended

Analysis 67 Pipeline Accident Report piston stops within the valve therefore did not contribute to the high pipeline pressure and subsequent pipeline rupture. When Olympic personnel discovered the presence of extended stops, they could have contacted the valve vendor or consulted the valve documentation. Had they done so, they would have found that the stops could be adjusted without taking the valve out of service. But Olympic made no effort to change the stop settings. It does not appear that either Olympic managers or engineers reviewed the configuration of the valve and compared it to the design specifications. If they had, they would have determined that the valve should not have had extended stops, and they could have initiated a coordinated effort to properly reconfigure this and similar valves. Also, they likely would have found that the outlet valves, which should have had extended stops, did not. As a result, the possibility existed of pumping product against a closed valve, although this did not occur during the accident sequence. Relief Valve RV-1919 A comparison of the documents submitted by Olympic with those obtained from Fisher-Rosemount indicates that a Fisher-Rosemount employee misinterpreted the specification for RV-1919 and the three other identical relief valves ordered at the same time. Fisher-Rosemount then manufactured and supplied relief valves with a low-pressure pilot configuration and a pressure set point of 100 psig rather than a high-pressure configuration set to relieve at 650 psig.60 All the documentation Fisher-Rosemount provided regarding the relief valves indicated that they were set to open at 100 psig. Because the first of this documentation was generated in January 1998 and the station was not actually commissioned until the following December, Olympic and/or Jacobs had ample opportunity to discover the mistake and to have the valves reconfigured by the manufacturer. Furthermore, the manufacturer stamped the set pressure into the body of the pilot and affixed a metal tag to it that clearly indicated the pressure range of the pilot spring; yet Olympic employees overseeing construction of the Bayview terminal did not note the incorrect setting when they inspected the valves during or after their installation. Olympic and/or Jacobs should have realized from the purchase order supplied with the valves, the order acknowledgements, the stamped pressure setting in the body of the pilot, or the tag affixed on the pilot that the relief valves were not set to the specified relief pressure. Olympic personnel did not discover that RV-1919 was set to relieve pressure at 100 psig until the tie-in to the Bayview facility was completed and they attempted to restart the pipeline. Even then, they did not consult the valve specifications or literature. Instead, they decided that they could correct the problem by replacing the pilot spring and adjusting the pressure setting to 700 psig. Although they were not aware of it at the time, they actually replaced the spring with an identical one. Further, by changing this low- pressure pilot to a high-pressure setting, they had rendered operation of the relief valve 60 The specification actually called for a pressure set point of 740 psig, but this was beyond the maximum range of the valve that was ordered.

Analysis 68 Pipeline Accident Report completely unreliable. Because the Bayview terminal was a new facility, Federal regulations required that each overpressure safety device at Bayview be tested in conditions approximating actual operations and found to function properly before the pumping station could be used. No such test was conducted on the relief valves to verify the pressures at which the valves would activate. After December 16, 1998, when Bayview went into operation, the inlet block valve at Bayview closed approximately 35 times because of high pressure within the Bayview terminal. During this time, relief valve RV-1919 was set to relieve at 700 psig, which was the same pressure at which the closing of the block valve would be triggered. Having the pressures set the same would mask the fact that RV-1919 was probably not operating reliably. Finally, in May 1999, in the company’s first documented action related to the inability of the relief valve to prevent the closing of the Bayview inlet valve, Olympic’s mechanic was dispatched to reduce the set pressure of RV-1919 to 650 psig. But even after this pressure set point adjustment, the block valve closed six more times before the accident. It does not appear that any additional effort was made before the accident to determine why the block valve continued to close when RV-1919 was set at 650 psig. Olympic did not consider the closing of the block valve to be an abnormal operation because the valve was operating as designed. But automatic closure of the inlet block valve was intended as a safety feature to protect the pipeline in the event of an abnormal condition, specifically, high pressure at the Bayview terminal; the valve was not designed to close automatically during routine operations. The company apparently never conducted a systematic investigation to determine why, despite the presence of a control valve and a relief valve intended to prevent it, pressures at Bayview regularly exceeded the pressure setting necessary to trigger the closure of the block valve. It was determined during the evaluation of the relief valve after the accident that the pilot spring had been compressed to the point that the rising inlet pressure could not lift the piston. Even though the mechanic who replaced the valve spring in RV-1919 and reset the pressure set point said he tested the pilot several times (using a hydraulic pump unit) and it opened correctly, later testing verified that the relief valve did not open at the intended set pressure. The Safety Board concludes that had Olympic investigated the failure of relief valve RV-1919 to operate consistently and prevent closure of the inlet block valve, it would have discovered that the valve was improperly configured, and it could have taken steps to correct the condition that may have prevented the pressure surge that ruptured the pipeline. The controllers reported that they expressed their concerns about problems they were experiencing with pipeline operations after the Bayview facility came on line. Management did not provide the controllers with any additional guidance, nor did they evaluate the operational difficulties and develop specific operating procedures for the pipeline that may have assisted the controllers working this pipeline and thus reduced the number of times that the pipeline shut down. Indeed, any improvements in pipeline operations between the Bayview commissioning and the accident were apparently the

Analysis 69 Pipeline Accident Report result of trial-and-error experiences of the controllers, not the result of effective management oversight. Given that Olympic (1) did not test the performance of all the Bayview safety devices under actual operating conditions before commissioning the terminal, (2) did not respond effectively or appropriately when it learned that the upstream control valves did not completely close and that the Bayview relief valves were configured and set for the wrong relief pressure, (3) did not investigate and correct the conditions leading to the repeated closings of the inlet block valve upstream of the Bayview terminal, and (4) did not develop procedures for use by controllers in meeting the additional operational challenges posed by the new facility, the Safety Board concludes that Olympic did not exercise effective management oversight of the construction and activation of the Bayview products terminal. After the accident, Olympic commissioned a number of studies and made changes designed to allow the pipeline to be operated more safely. Olympic has since removed the Bayview terminal from operation, with no projected date for bringing the facility back on line. The mechanic who, during the startup of the Bayview terminal, replaced the pilot spring in relief valve RV-1919 and adjusted the set point said he tested the pilot several times (using a hydraulic test rig) after the change and that the pilot operated correctly. He said he repeated the same test successfully after he adjusted the pressure set point on RV- 1919 from 700 to 650 psig in May 1999. But while, in each case, the pilot piston may have lifted enough to indicate that the pilot was working, this test did not indicate that the pilot would reliably operate or that it would ever cause the relief valve to open. When tested in place in an identical manner after the accident, the pilot on RV-1919 operated at about 440 psig. After the accident, flow testing performed on the relief valves throughout Olympic’s system indicated that they were relieving at pressures higher (in some cases considerably higher) than the set pressures of the pilots. More significantly, during controlled tests performed on RV-1919 after the valve was removed from the pipeline, neither the pilot nor the relief valve operated even with inlet pressures approaching 800 psig. Federal regulations at 49 CFR Part 195 require pipeline operators to test pressure limiting devices, relief valves, and other pressure control equipment once each calendar year at intervals not exceeding 15 months to determine that they are functioning properly, are in good mechanical condition, and are adequate from the standpoint of capacity and reliability of operation for the service in which they are used. These regulations do not identify specific testing procedures to be used to determine whether the relief valve is functioning properly. Although RV-1919 was a new valve and not yet subject to the requirement for periodic inspections, the annual inspections that Olympic performed on other relief valves within its system consisted of a visual inspection and a test to determine the set point of the pilot. The test used to check the set point was the same one used by the mechanic to test the operation of RV-1919. But, as observed during postaccident testing, the tests used by Olympic were inadequate to determine whether the pilot was configured properly or whether the relief valve was operating reliably. The Safety Board concludes that the Federal regulations establishing performance standards for the testing of relief

Analysis 70 Pipeline Accident Report valves and other safety devices installed on hazardous liquid pipelines provide insufficient guidance to ensure that test protocols and procedures will effectively indicate malfunctions of the relief valves and/or their pilot controls. Because the Bayview products terminal was a new pumping facility, Federal regulations required that RV-1919 and the other safety devices associated with the facility be tested under conditions approximating actual operations. Olympic asserts that the method it used to test the relief valve (that is, isolating the pilot and testing its set point) is common within the industry and that it meets Federal regulations. Nonetheless, this testing method did not reveal that the valve was improperly configured and that it could not be depended upon to operate reliably. The Safety Board notes that RSPA regulations do not provide adequate guidance to ensure that relief valves are tested under conditions approximating actual operations. The Safety Board is concerned that, like Olympic, other pipeline companies, during the commissioning of new pumping stations, may be conducting tests that do not identify unreliable relief valve operation. Further, operators may be performing similar annual relief valve tests that do not adequately test the performance of the valves to ensure that they will protect the pipeline from overpressurization. The Safety Board therefore believes that RSPA should develop and issue guidance to pipeline operators on specific testing procedures that can (1) be used to approximate actual operations during the commissioning of a new pumping station or the installation of a new relief valve, and (2) be used to determine, during annual tests, whether a relief valve is functioning properly. Emergency Response Bellingham responders, including the fire, police, and public works departments, responded promptly to the reports of gasoline odors, elevated the response to the incident, and began to evacuate the area and prevent people from entering the accident area. Personnel from additional local, State, and Federal agencies also responded promptly to the resultant fire and environmental damage. The incident command system was implemented and effectively managed. Based upon on-site observations of the incident command system, interviews with various responders, the rapid response to the initial reports of odors, the rapid and effective response to the fire and environmental damage, and the rapid restoration of the Hannah and Whatcom streambeds, the Safety Board concludes that the emergency and environmental response to the release was effective and well managed.

71 Pipeline Accident Report Conclusions Findings 1. Had the accident pipeline not been weakened by external damage, it likely would have been able to withstand the pressure that occurred on the day of the rupture, and the accident would not have happened. 2. The damage to the Olympic pipeline that led to its failure on June 10, 1999, occurred during IMCO General Construction, Inc., excavations associated with the Dakin-Yew water treatment plant modification project. 3. Olympic inadequately inspected excavation work performed by IMCO General Construction, Inc., during the water treatment plant project and consequently failed to identify and repair the damage done to the pipeline. 4. The in-line pipeline inspection data provided to Olympic, along with the excavation activity Olympic knew occurred in 1993 and 1994, were sufficient to justify the excavation and examination of the pipeline in the area of reported anomalies, but the company did not perform the work and thus did not identify the true extent of the damage. 5. If the supervisory control and data acquisition (SCADA) system computers had remained responsive to the commands of the Olympic controllers, the controller operating the accident pipeline probably would have been able to initiate actions that would have prevented the pressure increase that ruptured the pipeline. 6. The degraded SCADA performance experienced by the pipeline controllers on the day of the accident likely resulted from the database development work that was done on the SCADA system. 7. Had the SCADA database revisions that were performed shortly before the accident been performed and thoroughly tested on an off-line system instead of the primary on-line SCADA system, errors resulting from those revisions may have been identified and repaired before they could affect the operation of the pipeline. 8. Olympic did not adequately manage the development, implementation, and protection of its SCADA system. 9. Had Olympic investigated the failure of relief valve RV-1919 to operate consistently and prevent closure of the inlet block valve, it would have discovered that the valve was improperly configured, and it could have taken steps to correct the condition that may have prevented the pressure surge that ruptured the pipeline.

Conclusions 72 Pipeline Accident Report

1. Olympic did not exercise effective management oversight of the construction and

activation of the Bayview products terminal.

1. The Federal regulations establishing performance standards for the testing of relief

valves and other safety devices installed on hazardous liquid pipelines provide insufficient guidance to ensure that test protocols and procedures will effectively indicate malfunctions of the relief valves and/or their pilot controls.

1. The emergency and environmental response to the release was effective and well

managed. Probable Cause The Safety Board determines that the probable cause of the June 10, 1999, rupture of the Olympic pipeline in Bellingham, Washington, was (1) damage done to the pipe by IMCO General Construction, Inc., during the 1994 Dakin-Yew water treatment plant modification project and Olympic Pipe Line Company’s inadequate inspection of IMCO’s work during the project; (2) Olympic Pipe Line Company’s inaccurate evaluation of in- line pipeline inspection results, which led to the company’s decision not to excavate and examine the damaged section of pipe; (3) Olympic Pipe Line Company’s failure to test, under approximate operating conditions, all safety devices associated with the Bayview products facility before activating the facility (4) Olympic Pipe Line Company’s failure to investigate and correct the conditions leading to the repeated unintended closing of the Bayview inlet block valve, and (5) Olympic Pipe Line Company’s practice of performing database development work on the supervisory control and data acquisition system while the system was being used to operate the pipeline, which led to the system’s becoming non-responsive at a critical time during pipeline operations.

73 Pipeline Accident Report Recommendations As a result of its investigation of the June 10, 1999, rupture of an Olympic Pipe Line Company pipeline in Bellingham, Washington, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Develop and issue guidance to pipeline operators on specific testing procedures that can (1) be used to approximate actual operations during the commissioning of a new pumping station or the installation of a new relief valve, and (2) be used to determine, during annual tests, whether a relief valve is functioning properly. (P-02-4) Issue an advisory bulletin to all pipeline operators who use supervisory control and data acquisition (SCADA) systems advising them to implement an off-line workstation that can be used to modify their SCADA system database or to perform developmental and testing work independent of their on-line systems. Advise operators to use the off-line system before any modifications are implemented to ensure that those modifications are error-free and that they create no ancillary problems for controllers responsible for operating the pipeline. (P-02-5) BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: October 8, 2002

this page intentionally left blank

75 Pipeline Accident Report Appendix A Investigation The National Transportation Safety Board was notified on June 10, 1999, through the National Response Center, of a pipeline rupture and subsequent fire in Bellingham, Washington. The Safety Board dispatched an investigative team from its Washington, D.C., headquarters. The team comprised investigative groups in pipeline operations and survival factors. Board Member John Hammerschmidt accompanied the investigative team. No hearings or depositions were held in conjunction with the investigation. Representatives from the U.S. Environmental Protection Agency; the Washington State Department of Ecology; Olympic Pipe Line Company; the city of Bellingham; IMCO General Construction, Inc.; Fisher-Rosemount Petroleum; Earth Tech; the Washington State Fire Marshal’s Office, and the Office of Pipeline Safety participated in the Safety Board’s investigation. Teledyne-Brown Engineering also participated in the investigation until the company sold its supervisory control and data acquisition program product.

76 Pipeline Accident Report Appendix B Office of Pipeline Safety Corrective Action Order After the accident, on June 18, 1999, the Office of Pipeline Safety (OPS) found that “the continued operation of this pipeline without corrective measures would be hazardous to life, property, and the environment,” and issued a corrective action order restricting Olympic’s operations and outlining specific actions that Olympic must complete before returning its pipeline to full operation. The OPS subsequently issued two amendments to the order. The cumulative requirements of the items can be summarized as follows: With respect to the Ferndale to Allen, Washington, segment: • The first three items are to be completed before operating the pipeline segment. • Review the supervisory control and data acquisition (SCADA) system to determine the cause of the deficiencies that occurred on June 10, 1999, and correct these deficiencies. • Test mainline valves intended to isolate sections of the pipeline traversing populated and environmentally sensitive areas and take any needed remedial actions. • Install a check valve at milepost 16.22. • Develop a plan to address the following to the extent they are involved in the release: Review the existing mainline block valves and check valves and plan for additional installations as necessary to minimize the consequences of a pipeline release. Valves will have remote operation capability as deemed appropriate by the review. Review the SCADA system to detect any deficiencies and develop a schedule for modifications. Cathodic protection surveys with scheduled remediation. Pressure testing. Internal inspection tool surveys and remedial action to insure the integrity of the pipeline using the best available technology appropriate for assessing the system based on the type of failure that occurred on June 10.

Appendix B 77 Pipeline Accident Report • Restrict the maximum operating pressure (MOP) of the pipeline segment to 1,056 psig, which is 80 percent of the normal operating pressure or 80 percent of the surge pressure at the point of failure, whichever is lower. • Restrict the MOP of the 16-inch Allen to Renton pipeline segment to 80 percent of its normal operating pressure or 80 percent of the surge pressure at the point of failure, whichever is lower. • Include consideration of the Allen to Renton pipeline segment in the plan developed to address the Ferndale to Allen segment. • For a minimum period of one (1) year after the last modifications to the SCADA system are performed as a result of this Order, monitor the SCADA system’s operation and report any anomalies to the OPS within 2 weeks. • Within 3 months of the 1st amendment, perform the following with respect to personnel involved with controlling the operations of the pipeline through the SCADA system: Develop and implement a training program for controllers that includes responding to abnormal operations and starting up and shutting down any part of the pipeline system. In addition to the training, review the qualifications of each controller to recognize conditions that are likely to cause emergencies and be able to predict the consequences of facility malfunctions or failures such as those that occurred on June 10, 1999. Provide specific, specialized, technical training to controller personnel responsible for maintenance and operation of the hardware and software components of the SCADA system and review the qualifications of these personnel. Include classroom instruction, practical exercises, and the use of a pipeline simulator as appropriate in the training under this item. • Perform a design review of the Ferndale to Renton segment to ensure the station safety devices will shut the segment down within applicable parameters. The review should include at least the following: A surge analysis using the worst-case scenario. A test of the relief valves to determine that capacity is adequate and that they operate reliably. A design review of the physical piping in the Bayview products terminal that includes the interaction of all station safety devices. • In conducting any internal inspection, excavate and visually examine any anomaly that could be associated with excavation damage located on the top half of the pipe and take appropriate remedial action.

Appendix B 78 Pipeline Accident Report • In conducting any internal inspection, consider the possibility of internal corrosion in conducting the inspection and analyzing the results. • Review existing procedures for normal, abnormal, and emergency operations of the Ferndale to Allen pipeline segment and make any necessary changes to ensure that they address operations at the Bayview products terminal. • Notify the OPS before undertaking any testing, repairs, or construction needed to prepare for the return of the pipeline to service. • Restrict normal operating pressures to 80 percent of the previously established MOP on the 20-inch Allen to Renton segment, the 14-inch Renton to Portland segment, the 16-inch Anacortes to Allen segment, and the remaining various short delivery segments on the system. • Conduct hydrostatic pressure testing at a test pressure of 90 percent of specified minimum yield strength (SMYS) for a minimum period of 8 hours as follows: Pressure test the 16-inch Ferndale to Allen segment in its entirety. Pressure test any sections of the remainder of the Olympic system that are constructed of pre-1970 electrical resistance welded (ERW) pipe manufac- tured by Lone Star. Pressure test any remaining sections of the Olympic system if indicated by the evaluation and plan provided for in the next item. Metallurgically test any failure that occurs in a manner which will identify the cause of the failure. • If, during the pressure testing, a failure occurs on line pipe which is not manufactured by Lone Star, evaluate the need to pressure test the remainder of the Olympic system and plan any testing that the evaluation indicates is advisable. • A pressure test conducted pursuant to the Order may not be used to establish a higher MOP than that previously established for the segment without written approval of OPS. • In conducting internal inspections on the Olympic system, do the following: Select internal inspection devices that can accurately detect metal loss, pipe deformation and enable strain calculations. Complete the analysis of internal inspection data and any remedial actions for anomalies that affect pipeline integrity within six months of completion of the internal inspection. The analysis shall include a comparison of metal loss with pipe deformation.

Appendix B 79 Pipeline Accident Report Develop and follow written procedures for the conduct of the internal inspections that includes fitness for service criteria for identifying, prioritizing, and correcting defects. These shall include criteria for deciding on direct pipeline examination, further integrity assessment, and corrective measures including repair, replacement, or operational restrictions. At a minimum, the criteria established in American Society of Mechanical Engineers (ASME) B31.4 and ASME B31-G should be considered. • Within 6 months of completion of the management audit provided for in the City Agreement, implement any corrective measures that cover matters regulated under 49 CFR Part 195, and report progress on the implementation to the OPS no less frequently than every 3 months.

this page intentionally left blank

FD07218 ｜ 1999_美国_RAR9901.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB99-916301 NTSB/RAR-99/01 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT DERAILMENT OF CSX FREIGHT TRAIN Q316 AND SUBSEQUENT HAZARDOUS MATERIAL RELEASE AT COX LANDING, WEST VIRGINIA JUNE 20, 1998 7170

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is man- dated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety stud- ies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov/. Other information about avail- able publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 Safety Board publications may be purchased, by individual copy or by subscription, from the National Tech- nical Information Service. To purchase this publication, order report number PB99-916301 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 National Transportation Safety Board. 1999. Derailment of CSX Freight Train Q316 and Subsequent Hazardous Material Release at Cox Landing, West Virginia. Accident Report NTSB/RAR-99/01. Washington, DC. Abstract: About 12:37 p.m. eastern daylight time on Saturday, June 20, 1998, 30 of the 148 cars making up eastbound CSX Transportation, Inc., train Q316 derailed at Cox Landing, West Virginia. Of the derailed cars, three were loaded with hazardous material, and eight others contained hazardous material residue. Two of the loaded cars were damaged in the pileup and leaked a combined volume of about 21,500 gallons of formaldehyde solution. No one was injured during the derailment of the train; however, 15 persons reported minor injuries as a result of the release of formaldehyde. Total damages in the accident exceeded $2.6 mil- lion. The major safety issue identified in this investigation was inadequate roadbed drainage and resulting road- bed instability on a portion of the CSX Ohio River Subdivision. The analysis also addresses overall track conditions on this line and the likelihood that a particular railcar could have been at fault in the accident. Finally, the analysis addresses the emergency response to this accident, with particular emphasis on commu- nication and coordination within and among the responding agencies. As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the Federal Railroad Administration, to CSX Transportation, Inc., to Cabell and Wayne Counties’ Local Emergency Planning Committee, and to Mountaineer Gas Company.

Railroad Accident Report Derailment of CSX Freight Train Q316 and Subsequent Hazardous Material Release at Cox Landing, West Virginia June 20, 1998 NTSB/RAR-99/01 PB99-916301 National Transportation Safety Board Notation 7170 490 L’Enfant Plaza, S.W. Adopted June 29, 1999 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

this page intentionally left blank

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Track and Roadway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Train and Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Site Description and Track Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Speed Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Track Defects Noted During the Previous Year . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Track Inspections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Tests and Research. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Track and Roadbed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Rolling Stock. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Other Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Emergency Response Plans. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 CSX Hazardous Materials Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Operation Respond Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Other Accidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Accident Discussion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Examination of Car CCX 752 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Roadbed Instability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Availability and Use of OREIS Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Emergency Plans and Disaster Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Communication With the Natural Gas Pipeline Operator. . . . . . . . . . . . . . . . . . . . . . . . 25 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Probable Cause. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

this page intentionally left blank

v Railroad Accident Report Executive Summary About 12:37 p.m. eastern daylight time on Saturday, June 20, 1998, 30 of the 148 cars making up eastbound CSX Transportation, Inc., (CSX) train Q316 derailed at Cox Landing, West Virginia. Of the derailed cars, three were loaded with hazardous material, and eight others contained hazardous material residue. Two of the loaded cars were damaged in the pileup and leaked a combined volume of about 21,500 gallons of formaldehyde solution. No one was injured during the derailment of the train; however, 15 persons reported minor injuries as a result of the release of formaldehyde. Total damages in the accident exceeded $2.6 million. The National Transportation Safety Board determines that the probable cause of this derailment was an unstable roadbed that resulted from the inadequate or ineffective measures taken by CSX Transportation, Inc., to permanently correct known drainage problems in the accident area. The major safety issues identified in this investigation were the track and roadbed conditions on the CSX’s Ohio River Subdivision, the effectiveness of Cabell County’s emergency response procedures, the effective use of available hazardous materials information, and the coordination of safety-critical operations during wreckage-clearing operations. As a result of its investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, to CSX Transportation, Inc., to Cabell and Wayne Counties’ Local Emergency Planning Committee, and to Mountaineer Gas Company.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Narrative At 11 a.m. eastern daylight time on June 20, 1998, a two-person train crew consisting of an engineer and a conductor went on duty at Huntington, West Virginia, to take CSX Transportation, Inc., (CSX) freight train Q316 to Parkersburg, West Virginia. (See figure 1, top.) The crew received the train, consisting of 2 locomotives, 97 loads, and 51 empties, from the inbound crew at 11:30 a.m. The train contained several types of hazardous materials, including several carloads of formaldehyde and a 14-car block of liquefied petroleum gas. The conductor recorded a departure time from Huntington Yard of 12:01 p.m. The train proceeded through Huntington on the main track at about 12 mph and, at 12:30 p.m., diverged to the Ohio River Subdivision for the northbound (designated east by the timetable) trip to Parkersburg. The crew had been authorized to proceed at track speed, and the engineer stated he applied power steadily after the entire train was on the 30-mph track in order to bring the train quickly up to the timetable speed of 30 mph. The crewmembers told the Safety Board that other than the fact that their train was longer and heavier than normal, they considered the assignment a routine tour of duty. They said they observed nothing unusual about the track or equipment and experienced no irregularities in the handling of the train as they approached Cox Landing, West Virginia. According to locomotive event recorder data, the train brakes went into emergency application at 12:37 p.m.,1 when the train was traveling 27 mph. At this time, the locomotive throttle had been in the eighth notch, the maximum power position, for 7 minutes 19 seconds. The throttle remained in this position for 17 seconds after the emergency brake application. The engineer stated that he kept the throttle in this position in an effort to keep the train stretched during the brake application to reduce the possibility of jackknifing cars. The crewmembers said they felt no slack action on the head end of the train before, during, or after the train went into emergency and that the head end of the train came to a smooth stop. The crewmembers said they immediately contacted the CSX train dispatching center in Jacksonville, Florida, to inform the train dispatcher of the emergency brake application and the location of their train. The crewmembers stated that they did not know why the train went into emergency and that they discussed possible reasons as the conductor prepared to walk back along the train to find the cause. The engineer said he noticed that when he attempted 1 Train air brakes are applied in response to reductions in train line pressure. (See note 2.) In normal operations, the locomotive operator initiates the pressure reduction, but a broken or disconnected train line will result in an instantaneous loss of pressure that will cause an immediate full brake application.

Factual Information 2 Railroad Accident Report Parkersburg Huntington West Virginia State Line Figure 1.

Factual Information 3 Railroad Accident Report to recharge the train line after the emergency brake application, the telemetry device did not indicate an increase in air pressure at the rear.2 He suggested that the conductor take an air hose and a wrench with him in case an air hose had failed. The conductor said that he took the train’s consist, which included hazardous material shipping papers and emergency response information, with him as he dismounted the locomotive. He said that as he walked toward the rear of the train, he heard sirens and became concerned about the seriousness of the problem. He said that after walking about 3/4 mile, he came to the 74th car of the train and noticed that its rear trucks had derailed. He said he also noticed that the train had separated several cars behind the 74th car and that numerous other cars had derailed. About 12:58 p.m., he notified the CSX train dispatcher of the derailment. (See figure 2.) The engineer remained on the lead engine in case it became necessary to move the head end of the train and to have the use of the stronger radio transmitter located on the locomotive. Of the 30 cars that had derailed, 3 were loaded cars of hazardous material, and 8 others contained hazardous material residue. Two of the loaded cars were tank cars containing formaldehyde at a 37-percent solution. Both tank cars were damaged during the pileup and eventually leaked a combined volume of about 21,500 gallons of formaldehyde solution. The eight derailed residue tank cars were damaged but did not leak; two were chlorine cars, three were hydrochloric acid cars, and three were sodium hydroxide cars. A derailed loaded car of molten sulfur also did not leak. Additionally, 10 derailed cars contained petroleum coke, an oily and crusty material that is environmentally harmful. Much of this product was released during the derailment and was recovered later during cleanup operations. The pileup occurred near the front yards of two residences. During the derailment, a tank car struck a residential gas meter that was within 40 feet of the centerline of the track. A 2-inch gas line crossed under the tracks at this location, providing service to residential gas users on the west side of the railroad from the 6-inch gas main that paralleled the east side of State Route 2. (See figure 3.) Damage to the vertical riser of the meter caused a gas leak that lasted for several hours. No fire resulted. Emergency Response The initial call for emergency assistance came at 12:37 p.m. from local residents. Emergency services that were immediately dispatched to the scene included the West Virginia State Police, the Cabell County Sheriff’s Department, the Huntington Police Department, the Ohio River Road Volunteer Fire Department (ORVFD), and Cabell 2 Train line (sometimes referred to as the brake pipe) refers to the compressed-air line that extends from the locomotive, through each car, to the end of the train. The end-of-train device mounted on the last car on the train transmits the air pressure at the end of the train to telemetry devices located on the lead locomotive. After an emergency brake application, the train line must be recharged with air before the brakes can be released and the train can proceed.

Factual Information 4 Railroad Accident Report

!

" "

$

!

" "#

$ %& '

Figure 2. Final resting place and point of derailment

Factual Information 5 Railroad Accident Report

Approximate Scale: State Route 2 Hoppers of Petroleum Coke GATX 50487 Hydrochloric Acid Residue UTLX 82657 Chlorine Residue UTLX 11098 Hydrochloric Acid Residue UTLX 61054 Molten Sulfur ACFX 200204 Formaldehyde (Breached) ACFX 200191 Formaldehyde (Breached) UTLX 11276 Hydrochloric Acid Residue PPGX 2852 Sodium Hydroxide Residue PPGX 3299 Sodium Hydroxide Residue PPGX 1738 Chlorine Residue DLRX 11253 Scrap Steel Gas Meter Six-inch gas main parallels Rt. 2 Shut-off "T" Two-inch service line crosses under the road and track 0 50 ft. 100 ft. Figure 3. Overhead view of the primary pileup

Factual Information 6 Railroad Accident Report County Emergency Medical Services (EMS). About 12:41 p.m., the ORVFD fire captain arrived and assumed the duties of incident commander. He established a command post and set up a roadblock at the south end of the derailment site. At 12:43 p.m., other ORVFD units arrived and established a roadblock at the north end of the derailment site. At this time, emergency response personnel evacuated local residents from homes in the immediate area. Four other fire departments also responded to provide mutual aid assistance to the ORVFD. During the initial evacuation, responders reported to the incident commander that some residents were complaining of respiratory problems, indicating a “probable” release of hazardous materials. The incident commander then widened the evacuation area to a 1/2-mile radius of the site. About 500 residents were eventually evacuated. About 1:30 p.m., after walking the train and identifying the derailed cars, the train conductor reported to the command post. About this time, the ORVFD assistant fire chief arrived and assumed incident command from the fire captain. The train conductor, after identifying the contents of the derailed cars, remained at the accident scene for about 3 1/2 hours. During this time, he gave the emergency responders one of the two copies of the train consist, including the hazardous materials information, and also worked with them to confirm identification of the leaking chemical. While the emergency responders identified the hazards posed by the natural gas leak and the damaged hazardous materials tank cars, immediate emergency plans were being formulated. During this period, emergency responders monitored both the natural gas leak and the chemical leaking from the breached tank cars, as well as the hazards presented by the other derailed hazardous material tank cars. At 1:02 p.m., public safety officials contacted the pipeline operator and requested that a service crew shut off gas service in the immediate area of the site. Because the condition of the other damaged tank cars, particularly those containing chlorine residue, was being assessed by chemical safety specialists, the incident commander held the pipeline operator’s service crew away from the derailment area. During this time, according to gas company officials, the gas service crew attempted to isolate the site remotely using the gas main shutoff valves located about 1 1/2 miles north and 1/2 mile south of the derailment area. In consideration of the impact of shutting off service to more than 400 residents and 12 industrial customers, the service crew did not close the valves but returned to the site and met with the incident commander. The incident commander then decided to allow the service crew to access the damaged riser and determine whether the 2-inch service line could be repaired.3 Following the initial train crew notification to the CSX dispatcher, the centralized train dispatching office notified the division superintendent and the on-call CSX environmental engineer. CSX also dispatched its local emergency contractor, Weaverton Environmental Group (WEG), located in Charleston, West Virginia, to coordinate 3 Had the valves in the 6-inch line been closed, the residual gas would have continued to escape from the broken riser, at reduced pressure, for at least an hour.

Factual Information 7 Railroad Accident Report emergency abatement and site remediation. Since this accident occurred during nonbusiness hours, workers were contacted at home and responded to WEG headquarters to pick up equipment before continuing approximately 45 minutes to the scene. The WEG response team arrived on site about 3 p.m. Within several hours, the CSX environmental engineer arrived at the scene. The West Virginia Division of Environmental Protection (WVDEP) monitored the site remediation activities. The Cabell County EMS director, who was also community emergency coordinator for Cabell County, had arrived at the accident scene about 2:20 p.m. After conferring with the incident commander and conductor, the EMS director contacted Dupont’s hazardous materials group in Belle, West Virginia, to request technical assistance. About 3:30 p.m., the Dupont Chlorine Emergency Response Team arrived on scene and conducted an initial assessment. The team determined that: • The chlorine tank cars, although damaged, had not leaked and the formaldehyde cars were the only cars releasing product. • The released chemical appeared to be contained in a ditch beside the cars. • At least 20,000 to 25,000 gallons of formaldehyde had been released, and an additional 5,000 gallons would likely be released during the next several hours. About 5 p.m., the gas service crew capped the 2-inch service line at the damaged riser and marked the area to give the wrecking crews an indication of the service line location. The CSX manager of environmental hazardous materials, who was in charge of the wreckage-clearing operations, said he was aware that the gas service crew had been asked by the incident commander to shut down gas in the area, and he assumed that the 2-inch line was secured. Railroad personnel in charge of cleanup operations stated that they would not have conducted wreckage-clearing operations had they known that the service line had simply been capped and was not isolated. Under the environmental remediation protocol between the WVDEP and CSX, the entire site required extensive excavation because of the formaldehyde spill, and the service line needed to be removed as soon as possible. Also, emergency response personnel said soil conditions were causing heavy excavation equipment to sink at least 12 inches at some locations near the partially buried and damaged service line. Before leaving the site, the pipeline operator asked that the service crew be called back to the area when the tank car was removed from the riser so that they would be available in case the service line was broken. The next day, Sunday, June 21, the gas company was called as the wreckage-clearing activities moved to the area of the riser. A gas company employee reported to the command post about 5 p.m. to stand by in case he was needed. About 5:40 p.m., a formaldehyde tank was being lifted prior to removal. During the operation, the car tilted and some of the chemical from the car spilled onto the ground. In an attempt to contain the environmental damage, a wreckage-clearing contractor began immediately to use a front-end loader to scoop out the soil contaminated by the spill. In doing so, he struck and severed the gas service line. The gas employee at the command post was notified, and after determining the nature of the problem, he called a service crew to the site. By 7 p.m., the service crew had located and excavated the

Factual Information 8 Railroad Accident Report shut-off “tee” where the 2-inch service line branched from the 6-inch main. After cutting off the flow of gas at the tee, the service crew purged residual gas from the service line and then disconnected it. Injuries No one was injured during the derailment of the train; however, as a result of the release of formaldehyde, 15 persons reported minor injuries. Some of the symptoms included shortness of breath, tightness in the chest, headache, burning eyes, sore throat, and burning skin. Subsequently, 3 (2 local residents and a member of the environmental cleanup crew) of the 15 injured were treated by EMS personnel at the scene and were not transported to a medical facility. The remaining 12, including 9 emergency responders, the conductor, and 2 local residents, were taken by ambulance to two local hospitals. All patients were treated and released the same day. Damage Track and Roadway Forty-three track panels were required to replace 1,675 feet of heavily damaged or destroyed track. In addition, the track ballast and subballast had to be removed from the area of the formaldehyde spill. The general pileup of the cars destroyed all the track material in the vicinity of the private crossing at milepost (MP) 207.8. Track damage was $164,000. Equipment Equipment damage was almost $500,000. Of the 30 cars derailed, 13 were empty or contained only residue, and 17 were loaded. All 10 tank cars involved in the primary pileup, including the formaldehyde cars, were destroyed. Several tank car heads were struck during the derailment, but none of the heads were breached as a result of coupler impact. All the tank cars that were involved in the primary pileup were classified as destroyed because the estimated cost of repair exceeded the cars’ value. All of these cars contained hazardous material or hazardous material residue. Two of these cars released product; eight did not. Two loaded cars of formaldehyde, the 82nd and 83rd cars in the train, both leaked product. Car ACFX 200191, a tank car built in 1995 to DOT specification 111A, was struck on the right side by the coupler of the following tank car. The coupler punctured the middle of the car, creating a rectangular hole approximately 16 inches by 22 inches. The other formaldehyde car, ACFX 200204, also a tank car built in 1995 to DOT specification 111A, was severely damaged during the derailment and showed evidence of impact with other equipment, track material, and the ground. This car leaked product both from a puncture in the bottom of the car and through tears in the shell adjacent to the tank car head.

Factual Information 9 Railroad Accident Report Environment Formaldehyde mixes easily with water and is absorbed into soil rapidly. The CSX environmental contractor determined that no formaldehyde was carried away in surface water; therefore, none of it reached the Ohio River. Approximately 11,000 gallons of formaldehyde were recovered from pools on the ground. About 10,500 gallons were absorbed by the soil and had to be removed by excavation after re-railing operations were completed. About 4,750 cubic yards of formaldehyde-contaminated soil and petroleum coke were excavated, placed in roll-off boxes (large dumpster-like rubbish containers transported by truck), and temporarily staged at the CSX yard in Barbourville, West Virginia. Soil excavation was completed within the CSX right-of-way by June 23 and within the adjacent private properties by June 28. The cost of the environmental cleanup was $1.8 million. Wreckage-clearing and material-transfer activities damaged about 1/4 mile of State Route 2. The derailment also partially destroyed an access road and two private driveways. Residential lawns were damaged by contamination and the resultant environmental cleanup. The cost of paving roadways, landscaping, and repairing utilities was $155,000. Train and Operations Information The accident occurred on the CSX Ohio River Subdivision, which is the western edge of the CSX Cumberland Coal Business Unit. This business unit comprises 17 subdivisions and 713 miles of track. The Ohio River Subdivision consists of about 200 track miles extending from Wheeling to Huntington, West Virginia, where it joins a trunk line of the C&O Business Unit. Eight trains pass through Cox Landing on an average day: Q316 and Q317, three loaded coal trains, and three empty hopper trains. Several daily local trains service industrial customers to the north but turn back before reaching Cox Landing. No passenger trains operate on the Ohio River Subdivision. Train Q316 is a daily freight train that originates at the CSX Queensgate Yard near Cincinnati, Ohio, and terminates in Cumberland, Maryland. Between Queensgate and Cumberland, train Q316 changes crews at Huntington, Parkersburg, and Grafton, West Virginia. The counterpart to the eastbound train Q316 is train Q317, a daily westbound train originating at Cumberland and terminating at Queensgate. Trains Q316 and Q317 are the only miscellaneous through-freights that operate on this portion of the Ohio River Subdivision. The trains carry carloads of general mixed freight, a large proportion of which is hazardous material requiring the display of hazardous material placards. After being assembled in Queensgate Yard, accident train Q316 received an outbound inspection and brake test from the car department. The train was equipped with a two-way end-of-train device that was armed and tested at Queensgate. On the day of the derailment, Q316 carried 49 cars that required hazardous material placards. The 13,901-ton train was well within the locomotive tonnage ratings for the “river grade” territory as established by the Cumberland Coal Business Unit timetable.

Factual Information 10 Railroad Accident Report Trains operating on the Ohio River Subdivision are governed by the CSX rules manual that contains safety rules, operating rules, hazardous material rules, restricted equipment rules, and train handling rules. Special instructions4 are found in the CSX Cumberland Coal Business Unit Timetable No. 3. Additional special instructions are found in the current CSX system bulletin and CSX train bulletin. Supplemental information affecting the movement of trains or the safety of employees is given orally by the train dispatcher and is copied on a form attached to the train bulletin. On the day of the derailment, the crew of train Q316 had the current bulletin, No. 39651, which contained 11 itemized speed restrictions for the Ohio River Subdivision, none of which applied to the derailment location. Train Q316 had no supplemental instructions for the derailment area. The Ohio River Subdivision is controlled by direct traffic control (DTC), which is granted by the CSX train dispatcher in Jacksonville, Florida. Authority to occupy segments of main track are radioed by the dispatcher and recorded by the conductor or engineer on the prescribed DTC form. Before entering the main track of the Ohio River Subdivision, the crew of train Q316 was granted occupancy of three specific blocks, all of which were recorded as “clear,” meaning no opposing or preceding trains were present in those blocks. Site Description and Track Information Cox Landing (figure 1, bottom) is about 7 miles north of Huntington and about 2 miles south of the town of Lesage, West Virginia. In the area of the derailment, MP 207.9, the railroad is bounded by the Ohio River to the west and West Virginia State Route 2 to the east. The grade of the railroad is undulating, with slight, short, and varying grades. The average grade is nearly identical to that of the river. Curvature includes left and right curves of 1º to 3º, interspersed by tangent track in 1/4- to 1/2-mile increments. A small stream, Four Mile Creek, passes under the railroad through a 5-foot stone arch at MP 207.88. The railroad is maintained as Class III track, as specified in 49 Code of Federal Regulations Part 213, “Track Safety Standards.” Subpart 213.9 permits freight trains to operate on Class III track at a maximum speed of 40 mph. The rail is predominantly 112-and 115-pound welded rail, rolled in the mid-1940s. Double-shoulder tie plates are in place, and every other tie is box anchored.5 The rail is secured with four spikes per tie. Safety Board investigators noted that overall tie condition in the area was poor. CSX had scheduled a tie replacement program for October 1998. 4 Special instructions are issued by the railroad to provide specific operational information or instruc- tions that address or modify information contained in the operating manuals. 5 The term box anchored indicates that rail anchors are applied to both rails on both sides of the tie, resulting in a rectangular “box” pattern.

Factual Information 11 Railroad Accident Report Speed Restrictions According to CSX track inspector reports, the Ohio River Subdivision had been known to experience recurring surface defects.6 During such periods, speed restrictions were put in place until additional ballast could be brought in and until completion of surfacing and inspection, after which the speed restrictions were raised, then eliminated. At the time of the accident, speed restrictions were in place on 32 segments of Ohio River Subdivision track equal to a total of 4.9 track miles. Of these 4.9 miles, 0.9 miles were reduced from the timetable speed of 30 mph to 25 mph, and 4.0 miles were reduced to a speed of 10 mph. The nearest speed restriction to the location of the derailment was at MP 197, about 10.3 miles to the east. Track Defects Noted During the Previous Year Track inspection reports indicated that the area in and around MP 207.9 had experienced instances of subgrade and surface problems (see table 1), and speed restrictions had been in place at various times for the area in which the derailment occurred. Track inspection records indicated that several locations near the derailment site had had recurring surface defects, many of which the track inspectors were able to repair. If the track inspectors could not themselves repair track that they determined to be unsafe at the timetable speed of 30 mph, they lowered train speeds at that location until the repairs or improvements could be made. Company records showed that on February 3, 1998, a slow order was put in place at the accident location because of a surface defect in the spiral of the curve.7 The outside rail of the spiral was found to be lower than the inside rail, a condition commonly referred to as “reverse elevation.” Track inspection records indicated that this condition was corrected on March 20, 1998. On May 27, another surface defect in the curve at this location resulted in a slow order that was removed when the defect was corrected the next day. In the fall of 1997, according to CSX, two carloads of side dump material, consisting of large limestone rocks, were placed on the river side of the fill at the location of the derailment. According to a CSX track inspector, the material was added to make the fill “sturdier.” In the spring of 1998, about 1 1/2 car loads of track ballast was also distributed in the immediate area. After the track was lined and surfaced, the speed was returned to the timetable speed of 30 mph. The track was last lined and surfaced on June 9, 1998, 11 days before the derailment. The private crossing at MP 207.7 was also rebuilt at that time. New ties were 6 In railroad terms, surface refers to the vertical alignment of the rails with respect to one another. An imaginary plane can be formed on the top surface of railroad rails. This plane should be level for straight track and have the proper angle of elevation for curved track. Defects in track surface can result in one or both rails being below, or above, the intended height. 7 A spiral is the section of track at the end of the tangent and beginning of the curve. Its purpose is to provide a transition from zero curvature and zero elevation to full curvature and full elevation. The rate of change in curvature and elevation should be uniform.

Factual Information 12 Railroad Accident Report aApproximate location of initial derailment. Table 1. Track defects found in accident area during preceding year Date MP 208.2 MP 208.1 MP 208 MP 207.9a MP 207.8 MP 207.7 MP 207.6 Jul 1997 57.75" gage Aug 1997 1.75" surface deviation 1.75" surface deviation Two bolts missing Aug 1997 1.75" surface deviation Sep 1997 2" surface deviation 2" surface deviation 2" out of line Sep 1997 1.75" surface deviation Oct 1997 Needs ballast Needs ballast Needs ballast 1" reverse elevation Nov 1997 Needs ballast Needs ballast Needs ballast 1.75" surface deviation Dec 1997 1.75" surface deviation Jan 1998 1.875" surface deviation 2" surface deviation Pull-apart Jan 1998 1" surface deviation Feb 1998 1" reverse elevation 1" reverse elevation 1.875" surface deviation 1.875" surface deviation Mar 1998 Irregular surface Apr 1998 May 1998 1.75" surface deviation Missing bolt Jun 1998 2.125" surface deviation

Factual Information 13 Railroad Accident Report installed in the crossing, the track was lined and surfaced, and new blacktop was put in place. Track Inspections The main track of the Ohio River Subdivision was inspected twice weekly in compliance with the FRA track safety standards for Class III track. Although track inspectors sometimes worked alone, most inspections on this subdivision were carried out by two employees, a track inspector and an assistant track inspector, riding in a Hy-Rail vehicle. The track inspectors visually inspected the track and roadbed and recorded any deficiencies on a daily track inspection report. When two employees inspected track together, they were expected to correct minor track defects if they had the tools and the time to safely make repairs. The track inspectors were responsible for inspecting about 120 miles of track between Huntington and MP 90.7. According to CSX, the days of the week on which the inspections occur could vary depending on train traffic. The inspectors normally began their workday at 7 a.m., but this was often changed to 10 a.m. on days when a higher temperature was forecast, to enable the inspectors to inspect the rail as it is subjected to the heat of the day. CSX track inspection records indicated that the section of track on which the derailment occurred was inspected about noon on June 19, after the Friday Q316 had passed through. The track inspectors had gone on duty at 10 a.m. because of the forecast for relatively high temperatures. The inspection began at Huntington and proceeded eastward. The inspectors stopped at a crossing at MP 208.8, about 1 mile west of the derailment location, and corrected a 3 1/2-inch surface defect by raising a small section of track. No information about track exceptions or work performed near the derailment area was indicated on the track inspection report. The track inspector and assistant track inspector told the Safety Board that they had not taken exception to any track conditions in the derailment area. From the time that the track was inspected until the derailment of train Q316 the following day, two loaded coal trains, one empty train, and a train containing miscellaneous freight had passed over the track. CSX officials told the Safety Board that when planning for track or roadbed maintenance, or when establishing track inspection standards, the CSX does not differentiate between lines that carry hazardous materials and those that carry coal or other freight. They said track maintenance plans are based on traffic patterns, gross tons carried, and the condition of the line for which the maintenance is planned. Meteorological Information Records at the Huntington Tri-States Airport, about 10 miles from Cox Landing, showed that the lowest temperature recorded on June 20 was 62º F at 5 a.m. At 11 a.m., the temperature was 80º F. Skies were partly cloudy. Winds were calm. At 1 p.m., the temperature was 82º F; skies were partly cloudy.

Factual Information 14 Railroad Accident Report Local climatological data for the Huntington Tri-State Airport indicated that the area had received 6.89 inches of rain during June. Normal June rainfall for this area is 3.51 inches. The data also showed that 4.77 inches of rain fell during an 11-day period of thundershowers, rain showers, and fog that preceded the derailment. Tests and Research Track and Roadbed A major portion of the track structure at the accident site was destroyed in the derailment, hampering investigators’ efforts to reconstruct the accident scenario. In the intact section of track, distinctive wheel marks on the crossties were visible, beginning at the point of the initial derailment and continuing in a recognizable pattern to the final resting position of the 74th car on the train, an empty covered hopper, car CCX 752. The marks began at about MP 207.9 at a position on the outside of the spiral leading into the 3º left-hand curve. The first loaded car to derail and the 77th car in the train, NS 191050, carrying steel scrap, remained upright with the front portion of the train. It was observed to be derailed with all wheels on the ground between the rails. Both rails had been displaced outward by being rolled off the tie plates. Much of the rail that had been displaced from its position on the crossties was later arranged so that it could be examined in detail. No preaccident rail or joint defects were observed. Safety Board investigators reviewed materials documenting track conditions as noted by the CSX track inspectors for the section of track that included the accident location. In the 12 months preceding the derailment, inspectors noted track defects in cross level8 and curve elevation. When asked about the problem in maintaining the correct track surface in the area of the derailment, a track inspector said that “the track just goes down,” that is, the track, once surfaced, would not continue to support the weight of trains without surface degradation. Along its entire length, State Route 2 follows the Ohio River Subdivision, at some locations exactly paralleling the track for a distance of several miles. In the area of the derailment, the road is located on railroad property. This proximity of the highway to the railroad roadbed results in the shedding of rainwater from the highway to the railroad property between the road and the track. Before the accident, no culverts were located in the area between MP 208 and about MP 207.6.9 Water from rainfall and from highway runoff would collect in a ditch on the east side of the track where, according to a local resident, it would stand for extended 8 Cross level refers to the height of the top of one rail in relation to the opposite rail at the same location. The cross level of a section of tangent track should generally be zero. The cross level of main line curved track will normally indicate that the outer rail is higher than the inner rail. 9 Four Mile Creek is contained in a 5-foot stone arch at milepost 207.87; however, this is approximately 20 feet below grade and provides no drainage for ditches near the track structure.

Factual Information 15 Railroad Accident Report periods. A nearby resident told the Safety Board that the ditch between the road and the track held standing water “all the time” and that water stayed in the ditch “from one rain to the next.” This resident said she used the crossing daily and the water caused the crossing to be soft and muddy. After the June 20 derailment, CSX placed two lateral culverts under the track to provide an exit path for the water that accumulated in the area. The company also placed additional stone material to the west side (the river side) of the fill in the area of Four Mile Creek. A contoured drainage pattern was added to the fill material to help direct water away from track bed. In November 1998, a Safety Board team conducted a visual track survey of about 20 miles of Ohio River Subdivision track to gain an understanding of then-current track conditions. The team found that numerous bridges on the subdivision had been rebuilt or replaced, and scheduled tie and rail replacement programs had been carried out. During its inspection, Safety Board investigators found examples of relatively light rail that was worn and that, specifically in areas of curvature, had head-checks.10 Head-checks are not addressed in the current Federal track safety standards, and the rail is thus not in violation of Federal standards. CSX had been replacing this rail, particularly in areas of curvature, with 136-pound rail. Rolling Stock Four cars from train Q316 were examined by the Safety Board, the FRA, and CSX at the CSX Huntington car shop. Car CCX 752, as well as others immediately ahead of and behind it, were inspected to determine whether they had contributed to the derailment. Only the trailing truck of CCX 752 derailed. Wheel abrasions were visible on the car’s center sill that indicated that the first wheel to derail was the R-2 wheel (the leading wheel on the right rear truck of the car as seen when facing in the direction of travel). The top weld of the car’s B-end (the trailing end, in this case) coupler carrier was broken. The coupler and coupler carrier also showed deep scrape marks. The car immediately behind CCX 752, car CCX 672, was also an empty covered hopper. Only the leading truck of this car derailed. Car CCX 752 was built in 1972. It was equipped with 33-inch, curved plate wheels, and 6- by 11-inch roller bearings. Examination of the R-2 wheel did not reveal any defects likely to have caused the derailment. A small amount of tread buildup was present, but the buildup was determined to have existed for a number of years. 10 Head-checks are small defects in the running surface of the rail. They usually occur in curves and on rail that is, or has been, heavily traversed. Although usually superficial, head-checks in rail can be the source of transverse fissures that result in a sudden break in the rail. Head-checks can also inhibit the effectiveness of ultrasonic testing in detecting internal rail defects.

Factual Information 16 Railroad Accident Report Both side bearings11 from the derailed B-end of the car were missing. Marks on the side bearing cage and side bearing wear plate indicated that the side bearings were in place before the car derailed. Investigators determined that the side bearings were probably dislodged from the side bearing cage as the car bounced and vibrated along on the ballast and ties. Two side bearings of the same type and dimensions that would have been installed in this end of the car were found about 100 feet apart near the small crossing and about 400 feet from the point at which the car came to rest. Other side bearings of the correct size were used to test side bearing clearances. After the accident, CCX 752 was moved to the CSX repair facility in Huntington for mechanical inspection. This inspection included partial disassembly of the car and truck components for measurement and evaluation of critical components. The inspection was carried out by CSX personnel under the observation of Safety Board investigators and several FRA representatives. Inspectors gave special attention to wheel profiles, suspension components, and the ride control system. No mechanical defects were found during this inspection. Specifically: • wheel profiles were satisfactory; • friction castings were within specifications and without abnormal wear patterns; • springs were within tolerances; • side bearing clearances were within specifications; • side bearing wear plates were not defective; • truck bolster and side frames were in satisfactory condition, except where damaged in the derailment; and • center plate and center pin were found to be in good condition. This car was used to transport carbon black, a relatively light, powdery material. The interior of the car was examined to eliminate the possibility of instability caused by a partial load. The residue in the car was determined to be insufficient to have caused instability. After the inspection, and as required by Association of American Railroads (AAR) specifications, CSX replaced the wheels and axles of the truck that had derailed and performed other repairs to enable the car to be safely moved. Subsequently, the car owner directed that the car be moved to the National Railcar Company in Roscoe, Texas, for completion of repairs, including the installation of a new truck bolster and one side frame. On February 26, 1999, car CCX 752 was involved in another CSX derailment about 33 miles from Cox Landing. The Safety Board again examined CCX 752 in detail to determine if the mechanical condition of this car could have caused, or contributed to, that derailment. Safety Board examination of the car after the second accident revealed that the 11 Side bearings, located near each corner of a car, are placed between the lower frame members and the top of the truck bolster to control the longitudinal roll of the car.

Factual Information 17 Railroad Accident Report side bearing clearances at the time of the second derailment were out of tolerance, measuring 1/16 inch instead of the AAR’s recommended range of 2/16 to 4/16 inch. At the time of the second derailment, the car was loaded and was passing over an area with confirmed line and surface deviations. The derailment occurred at the entrance to the spiral of a right-hand curve with a left-hand turnout and guardrail. Other Information Emergency Response Plans The Cabell and Wayne Counties’ Local Emergency Planning Committee (C/WLEPC) had a comprehensive combined emergency response plan. Plan revision dates indicated that components of the plan had been updated at various times, with the most recent revision dated 1997. The plan provided a separate appendix that addressed hazardous materials response and included guidelines for emergency responders in managing incidents. One chapter in the plan addressed special hazardous materials emergency assistance, stating that while local emergency response organizations are receiving more and more hazardous materials emergency resolution training and are gradually equipping themselves with hazardous materials emergency resolution equipment, there are still limits to their capabilities in knowledge, clothing and equipment. Listed in the chapter were 13 resources that emergency management personnel and emergency response incident commanders could use if hazardous materials assistance was needed. The first resource provided was the Dupont Emergency Response Team, about which the plan stated: This team is based at DuPont’s Belle Plant. While it specializes in transportation type chemical emergencies involving DuPont products, it is available for other chemical emergencies through mutual aid requests and through the CMA Chemnet agreement. The response time normally would be within two hours depending upon the location within the [C/WLEP district] where the emergency incident occurs. One listed resource, Ashland Petroleum Hazardous Material Emergency Response Team, was said to have a response time that “normally would be within 1 hour.” The plan stated that there should be no hesitancy on the part of the Incident Commander to request the assistance of appropriate special hazardous materials emergency assistance resources through appropriate channels. Nowhere in the plan was information included about the availability or use of the Operation Respond Emergency Information System (OREIS) software. (See “Operation

Factual Information 18 Railroad Accident Report Respond Software” below.) According to C/WLEPC officials, the plan has not been updated since the accident to include this information. The C/WLEPC conducted an average of three disaster drills a year, the most recent (before the accident) involving hazardous materials (hydrofluoric acid). Although the ORVFD had not participated in Cabell County disaster drills because no drills had been conducted in the ORVFD’s jurisdiction, the ORVFD had taken steps to prepare for incidents by providing monthly in-house training for its members. Records indicated that before the derailment, the most recent drill was conducted on June 2, 1998, and 14 of the 24 members attended. This drill included the identification of hazardous materials using the North American Emergency Response Guide and Material Safety Data Sheets. The ORVFD maintained a copy of the C/WLEPC emergency response plan in the station. No evidence was found that the ORVFD used the plan in planning or conducting drills or that ORVFD officers were familiar with the contents of the plan. CSX Hazardous Materials Training CSX provided specialized training to all operating employees involved in transporting hazardous materials. The engineer and conductor had received this training as part of the required yearly instruction class, or interactive computer module system, or both. According to CSX records, the company also had a program of community outreach and emergency response training assistance for rail transportation accidents involving hazardous materials. As part of the CSX Hazardous Materials Emergency Response Plan, a basic training program was developed for local emergency responders (fire, EMS, and law enforcement) entitled, “Emergency Response to Railroad Incidents.” According to the course outline, this training consisted of a 6-hour course “to enhance the understanding of the transportation of hazardous materials by rail and the means for safely responding to emergencies involving railroad property and equipment.” When the accident occurred, CSX was in the process of developing a more advanced, 8-hour course for hazardous materials team members entitled, “Advanced Emergency Responders.” Company officials said this course, the development of which has been completed since the accident, will be provided to emergency responders on an “as-requested” basis. In October 1997, CSX offered to provide training to C/WLEPC emergency responders. In January 1998, CSX provided a “hazardous materials traffic density study” and a copy of the CSX emergency response training manual to the captain of the Huntington Police Department, who is also chairman of the C/WLEPC and community emergency coordinator for the city of Huntington, along with another offer to conduct emergency response training. According to CSX, “no reply either written or verbal” was received. The company gave no indication that any further efforts were made to ensure that CSX training was made available to local emergency responders. In April 1998, Cabell County officials contacted CSX and asked that railroad employees assist with an emergency exercise to be held in May. CSX agreed to provide assistance with planning and to participate in the exercise. Cabell County subsequently

Factual Information 19 Railroad Accident Report informed CSX that the scenario had been changed and that rail equipment would not be involved. CSX officials said they believed then that railroad employees were not needed, and CSX personnel did not participate in the exercise. According to CSX officials, since the accident, CSX and Cabell County representatives have met to discuss emergency response issues and to begin planning for a disaster drill, to be held in late summer or early fall 1999, that will involve a passenger/freight train accident. Operation Respond Software OREIS is a communications system developed by the Operation Respond Institute12 that can provide police and fire departments with a direct link to the databases of participating railroads and motor carriers. In the event of a railroad hazardous materials incident, emergency responders can enter the car numbers of the involved railcars to obtain detailed information about the types and amounts of hazardous materials the cars are carrying. According to the training and user manual that accompanies the software, the system’s principal features are the verification of contents and the formatting of hazardous materials emergency response information in a manner that is easy to use and understand by emergency personnel. The system also has stand-alone features utilizing placards, UN numbers and passenger train schematics to assist first responders. CSX donated OREIS software to Cabell County in October 1997. The Cabell County emergency response center installed the initial OREIS program and maintained the latest versions. The C/WLEPC had not conducted disaster drills involving the use of the OREIS software, nor have drills conducted since the accident included use of the system. Before the train conductor arrived at the command post and provided the train consist and emergency response information to responders, one of the fire officers on scene compiled car numbers and UN placard numbers from those derailed cars he could see while maintaining a “safe distance.” The placard numbers were used to access hazardous materials information contained in the North American Emergency Response Guide. The incident commander did not request the more detailed and specific hazardous materials information that would have been available from the OREIS software. As 12 According to a summer 1998 Operation Respond White Paper, Operation Respond is a program to improve information available to first responders at hazardous material and passenger train accidents. The program began in November 1992 as a cooperative effort of the FRA and the Port Terminal Railroad of Houston, Texas. Operation Respond became a not-for-profit institute in 1995. The Federal Highway Admin- istration, the Research and Special Programs Administration, and the National Institute for Occupational Safety and Health have since joined the FRA in funding the project. In addition to hazardous materials infor- mation, the system also provides schematics for Amtrak passenger cars and locomotives, including seat con- figuration, emergency doors and windows, and the locations of electric and fuel sources. Participating rail and motor carriers provide funding support for Operation Respond through programming, donated computer equipment, training assistance, and printing support.

Factual Information 20 Railroad Accident Report evacuation of the immediate area was concluded, the conductor met with the incident commander, making available to him information about the contents of the cars and the hazardous materials involved, as well as emergency response guidance for those materials. Other Accidents Several other derailments occurred on the CSX Ohio River Subdivision in the years and months preceding and following the Cox Landing accident. The Safety Board is investigating a derailment that occurred on November 5, 1998, near the town of Point Pleasant, West Virginia, some 33 miles north of Cox Landing. This accident resulted in the release of hydrochloric acid, although no one was injured. During its investigation, the Safety Board found an internal rail defect in a section of 112-pound rail that was rolled in

1. This rail was found to be seriously head-checked. As noted previously, on February

26, 1999, a derailment occurred about 35 miles from Cox Landing involving the same car as that involved in the Cox Landing accident. A total of 11 FRA-reportable derailments other than the Cox Landing accident occurred on the Ohio River Subdivision between February 1994 and February 1999. Seven of these derailments involved either train Q316 or its westbound counterpart, Q317.

21 Railroad Accident Report Analysis This analysis is divided into three sections. In the first, the Safety Board identifies factors that can readily be eliminated as causal or contributory to the accident. The second reviews the accident itself, highlighting the actions and events that resulted in problem conditions. The balance of the analysis discusses the safety issues identified in this investigation. The major safety issue identified in this investigation was inadequate roadbed drainage and resulting roadbed instability on a portion of the CSX Ohio River Subdivision. The analysis also addresses overall track conditions on this line and the likelihood that a particular railcar could have been at fault in the accident. Finally, the analysis addresses the emergency response to this accident, with particular emphasis on communication and coordination within and among the responding agencies. Exclusions The investigation determined that the derailment of train Q316 was not caused by a deficiency in the operation of the train. The train crew had received proper authority to proceed into the section of track where the accident occurred, and event recorder and other data indicated that the train was being operated in accordance with procedures appropriate to the circumstances. Accident Discussion The investigation determined that the first wheel of train Q316 to derail was on the leading axle of the trailing truck of the 74th car on the train, car CCX 752. This determination was based on the fact that all wheels of the first 73 cars were on the track when the front portion of the train came to rest. Additionally, wheel marks visible on the crossties and on the center sill of CCX 752 indicated that this car had derailed first, as did the break in the top weld of the coupler carrier, which indicated that the car had dropped off the rails and continued, at least momentarily, while the following car remained on the rails. The first wheel to derail climbed the east rail, which was the outside rail of the beginning of a 3º left-hand curve at MP 207.9. Following cars then derailed, and the train separated between the 77th and 78th cars. As the 78th car left the roadbed and plowed into a ditch, the cars following it, many of them containing hazardous materials, left the tracks and became involved in the general pileup. Examination of Car CCX 752 Car CCX 752 was carefully examined after the accident to determine if a mechanical defect in the car had caused the derailment. CSX inspectors partially disassembled the car and performed a detailed examination of car components in the

Analysis 22 Railroad Accident Report presence of Safety Board and FRA representatives. The detailed inspection revealed no mechanical defect in the car. On February 26, 1999, CCX 752 was involved in a second derailment about 33 miles from the first. Although the same car derailing twice in less than a year in the same relative area raises questions about the mechanical condition of the car, several important attributes of the car were different in the two derailments. Of major significance is that at the time of the second derailment, the car was loaded, as opposed to being empty at Cox Landing. Also, in the second derailment, the side bearing clearances were outside the recommended range, while investigators determined that the clearances at the time of the Cox Landing accident were within tolerance. Further, the second derailment occurred at a site of track surface deviations where special trackwork—a turnout and guardrail— complicated the track geometry. The Cox landing derailment occurred at the beginning of a slight curve with no special trackwork. Finally, the second accident occurred after substantial work had been performed on the car, including replacing the wheel sets on the B-end and replacing a truck bolster and one side frame. No inspections of car CCX 752 performed after the Cox Landing derailment and in the presence of Safety Board investigators and FRA representatives pinpointed any defect in the car that would have caused it to derail. Although this car is a covered hopper which, as a class of car, has a higher center of gravity when loaded and is more susceptible to being “rocked” off the rails than some other car types, no evidence was found after the Cox Landing accident to indicate that car CCX 752 was more likely to derail than other cars of its type. The Safety Board therefore concludes that the Cox Landing derailment was not caused by a mechanical defect in the empty covered hopper that was the first car to derail. Roadbed Instability Railroad track structure supports the weight of trains by distributing the load over a relatively wide area. The weight of the train is transferred from the rails to the crossties and from the crossties to the track ballast. The track ballast and subballast rest on the roadbed. Although different types of roadbed soil will react differently to an excessive amount of water, complete water saturation will generally destabilize a roadbed. To avoid such saturation, the track system, including ballast and subballast, must be able to guide both rain and drainage water away from the track structure. The track ballast allows water to drain through it, while the subballast should be impermeable, guiding water away from the subgrade and into the drainage ditches that parallel all railroad right-of-ways. These ditches are designed to flow water away from the track and toward culverts or terrain features that will channel the water away from the roadbed. Before the accident, no culverts or other effective means of channeling water away from the track bed were located in the derailment area. According to statements from local residents, water stood in the ditches alongside the track until it either evaporated or soaked into the roadbed. At least partly because of the lack of effective drainage, the area in and

Analysis 23 Railroad Accident Report around MP 207.9 had experienced instances of subgrade and surface problems, which had resulted in speed restrictions being placed on trackage in the derailment area. Track inspection records indicated that several locations near the derailment site had had track surface defects. In February 1998 and again in May 1998 (about 1 month before the accident), surface defects resulted in slow orders being issued for the accident area. CSX was aware of and had attempted to address the roadbed instability in the vicinity of the derailment by adding ballast or other fill material. These measures, however, while temporarily effective, did not permanently solve the problem of roadbed instability, as indicated by the fact that in the area of the derailment, track inspectors noted numerous defects in cross level and curve elevation during the 12 months preceding the accident. In June 1998, the effects of inadequate drainage were exacerbated by above- average rainfall, which further contributed to roadbed saturation and made the roadbed even less able to maintain the integrity of the track geometry under load. With the roadbed thus weakened, the weight of trains passing through the area contributed to an irregular track surface. At some point, perhaps during the passage of train Q316 itself, the weakened subgrade allowed the cross level to degrade to the point that the cars passing through the area incurred a high degree of longitudinal roll. This rolling action would have decreased vertical force on the wheels on the outside rail of the curve and thus would have allowed, as happened in this accident, the flange of one or more wheels to “lift” and ride on top of the rail. The Safety Board therefore concludes that drainage in the accident area was inadequate and that, as a result, the roadbed in the derailment area likely became water-saturated, rendering the track structure unable to maintain track integrity under the load of train Q316. While CSX added culverts and fill material to correct drainage problems, these measures may not address all the existing or potential drainage problems along the subdivision. Moreover, portions of the Ohio River Subdivision consist of lighter, older rail with observable, if relatively minor, defects in the form of head-checks. At least one of the several accidents that occurred on the subdivision before the Cox Landing derailment was caused by a broken rail. Also, some of the ties in the general area of the accident appeared to Safety Board investigators to be in poor condition. The Safety Board is concerned about these conditions, because the subdivision closely parallels the Ohio River, and the daily passage of two large trains carrying a variety of hazardous materials represents a significant risk to the river and the residents along it, should a derailment occur. The Safety Board therefore believes that CSX should perform a comprehensive engineering analysis and evaluation of track and roadbed conditions on the Ohio River Subdivision and develop a plan and a timetable for correcting existing or potential deficiencies, including inadequate drainage, that may affect the safe passage of trains and the safe shipment of hazardous materials through the area. The Safety Board further believes that CSX should provide the Board with a schedule to correct the deficiencies found during the evaluation. In addition, the Safety Board believes that the FRA, in accordance with its oversight role, should review both the implementation and the management oversight of CSX’s track inspection and maintenance programs for the Ohio River Subdivision and

Analysis 24 Railroad Accident Report take the actions necessary to ensure the safe passage of trains and the safe shipment of hazardous materials through the area. Emergency Response The local responders were effective in identifying the immediate hazards and initiating an immediate evacuation of nearby residents. Also, after some delay, responders called in chemical specialists to assess each tank car for leakage and potential risk. The Safety Board investigation did, however, identify a need for additional planning, training, and communication among the agencies responding to the accident. Availability and Use of OREIS Software Cabell County was equipped with OREIS software capable of printing out emergency response information, including the specific contents of affected cars and detailed information about the handling of any hazardous materials involved. Because the OREIS software was not used after the Cox Landing derailment (the train conductor was available to provide the information), the Safety Board could not evaluate its effectiveness in the response to this accident. In the view of the Safety Board, the software does appear to be a tool with potential for providing information that could be useful in the aftermath of a hazardous materials accident. In this case, however, because the C/WLEPC had not included use of the OREIS software in its disaster drills and had not updated its emergency response plan to include information about the system, responders on scene were unaware of the existence or the capabilities of the OREIS system, and they had not been trained in its use. The Safety Board therefore concludes that the full potential of the Cabell County OREIS software could not be realized, or even evaluated by emergency responders, because of a lack of information about the system in Cabell and Wayne Counties’ emergency response plan and because exercises involving the system were not included in periodic disaster drills. The Safety Board believes that Cabell and Wayne Counties should revise their emergency response plan to incorporate information about the capabilities and use of OREIS software. The Safety Board further believes that the counties should include, in their periodic disaster drills, exercises designed to familiarize emergency responders with the capabilities and use of OREIS software. Emergency Plans and Disaster Drills Even the above measures would have been less than fully effective in this accident, because the incident commander(s) were from the ORVFD, which had not participated in Cabell and Wayne Counties’ periodic disaster drills. Even though the ORVFD maintained copies of the C/WLEPC emergency response plan, the incident commanders did not initiate the call for outside assistance that was directed in the plan. The Cabell County EMS director, who was familiar with the plan, did initiate a call, but because of the delay, individuals with special chemical expertise did not arrive on scene until about 3 hours after the derailment. Had the leaking chemicals been more hazardous than formaldehyde, this delay could have had serious consequences. The Safety Board concludes that because the ORVFD had not participated in Cabell and Wayne Counties’ disaster drills and because its officers were unfamiliar with

Analysis 25 Railroad Accident Report the counties’ emergency response plan, the incident commanders did not use all available resources to assist in the emergency. The Safety Board therefore believes that the C/WLEPC should include in its periodic disaster drills all emergency response agencies within its jurisdiction, including the ORVFD, and ensure that those agencies are aware of Cabell and Wayne Counties’ emergency response plan and its implementation. CSX had a program of community outreach and emergency response training assistance for rail transportation accidents involving hazardous materials. According to CSX officials, on at least two occasions, in 1997 and 1998, the company offered to provide hazardous materials training to local emergency responders in the Cabell and Wayne County areas; however, these offers apparently received no response, with the result that no such CSX-sponsored training was conducted. CSX has, since the accident, developed an 8-hour advanced course for emergency responders that is provided on an “as requested” basis. In the view of the Safety Board, CSX should much more actively promote its company-sponsored hazardous materials training. More active promotion and better follow-up on offers of training would help ensure that local emergency responders are prepared for a railroad emergency. CSX benefits from the transportation of cargo, including hazardous materials, along the Ohio River Subdivision, and the company is acutely aware of the potential hazards to persons and the environment in the event of an accident involving its trains. The Safety Board therefore believes that CSX should review and revise, as necessary, in light of this accident, its community outreach and training assistance programs to ensure that all emergency response groups that may be called upon to respond to an incident or accident involving its railroad receive the necessary training on a timely and recurring basis. Communication With the Natural Gas Pipeline Operator A derailed car struck the vertical riser on a residential gas meter located within 40 feet of the centerline of the tracks. Damage to the riser resulted in a gas leak that lasted for several hours. Gas service personnel were called, but they were not allowed to approach the damaged riser because of concerns that the chlorine tank cars might also be leaking. However, because of concern about the gas leak itself, the incident commander directed gas company employees to shut off gas service in the immediate area at the site. Without access to shut-off valves at the site, gas company employees were unable to repair the damaged riser or isolate the 2-inch line. As an alternative, pipeline personnel considered isolating the 6-inch gas main by closing shutoff valves, but they were concerned about the large number of residential and industrial customers that would be affected. In any event, because of the location of the valves and the pressure in the line, blocking the 6-inch line would not have immediately stopped the leak. The incident commander eventually allowed the gas service crew to access the damaged riser and determine if the 2-inch service line could be shut down. Following their inspection, the service crew capped the 2-inch service line, but the line remained charged with pressurized gas, since the line had not been isolated from the 6-inch main supply line.

Analysis 26 Railroad Accident Report Because railroad and gas company personnel did not coordinate their activities before railroad contractors began working in the area of the gas line, railroad contractors did not know that the gas line was still charged. They stated that, had they known, they would not have carried out the wreckage-clearing operations the next day that severed the gas line and created a second gas leak in the area. This released gas, if ignited, could have injured nearby recovery workers and destroyed or damaged property. Although the gas did not ignite, its release posed a safety hazard to those in the area. The Safety Board concludes that railroad wreckage-clearing operations and pipeline operations were not effectively coordinated and unified under an effective command structure,13 which placed excavation personnel at risk while they worked in the vicinity of a natural gas line. A unified incident command structure would have ensured better commitment from and participation by railroad, pipeline, and public safety officials in decision-making throughout the emergency response, wreckage-clearing, and environmental remediation activities. The need for increased communication and coordination between railroads and pipeline operators has been demonstrated in other Safety Board accident investigations.14 In its investigation of an Amtrak passenger train derailment on CSX tracks near Intercession City, Florida, on November 30, 1993, the Safety Board concluded that the lack of a cooperative action plan between CSX and the pipeline operator contributed to a breakdown in communication during wreckage-clearing operations. After its investigation of the Intercession City accident, the Safety Board asked CSX, in Safety Recommendation R-95-32, to develop procedures for coordinating emergency response and wreckage- clearing operations with public safety officials to ensure that the actions of its employees and its contractors do not endanger personnel safety or the facilities of others on or adjacent to the railroad right-of-way. In its June 6, 1997, response, CSX stated that it had revised emergency response coordination policy to require that operations center personnel determine whether pipelines are likely to be in the area of any emergency. If they are, on-scene personnel must be notified of the possible existence of pipelines and must coordinate with the pipeline operators and public safety officials. On the basis of this response, Safety Recommendation R-95-32 was classified “Closed—Acceptable Alternative Action” on September 11, 1997. Despite the CSX response to Safety Recommendation R-95-32, however, at least in the area of this accident, CSX did not have adequate procedures in place to facilitate the level of on-scene coordination necessary to have prevented putting railroad workers at risk 13 See National Response Team Incident Command Technical Assistance Document: Managing Response to Oil Discharge and Hazardous Substances Under the National Contingency Plan, published by the National Response Team, May 1996. (Available at http://www.nrt.org) 14 For example, see Railroad Accident Report—Derailment of Southern Pacific Transportation Com- pany Freight Train on May 12, 1989, and Subsequent Rupture of Calnev Petroleum Pipeline on May 25, 1989, at San Bernardino, California (NTSB/RAR-90/02); Railroad Accident Report—Atchison, Topeka and Santa Fe Railway Company (ATSF) Freight Trains ATSF 818 and ATSF 891 on the ATSF Railway, Corona, California, November 8, 1990 (NTSB/RAR-91/03); Highway Accident Report—Collision of Amtrak Train No. 88 with Rountree Transport and Riggings, Inc., Vehicle on CSX Transportation, Inc., Railroad Near Intercession City, Florida, November 30, 1993 (NTSB/HAR-95/01); and Railroad Accident Report— Derailment of Freight Train H-BALT1-31 Atchison, Topeka and Santa Fe Railway Company Near Cajon Junction, California, on February 1, 1996 (NTSB/RAR-96/05).

Analysis 27 Railroad Accident Report during wreckage-clearing operations. The Safety Board therefore believes that CSX should develop and implement incident coordination procedures that will ensure that safety-critical operations during wreckage-clearing activities are coordinated with all parties involved in those activities. In addition, on the local level, the Safety Board believes that Mountaineer Gas Company and Cabell County should, in cooperation with CSX, develop and implement incident coordination procedures that will ensure that safety-critical operations during wreckage-clearing activities are coordinated with all parties involved in those activities.

28 Railroad Accident Report Conclusions Findings

1. The operation of the train did not cause or contribute to the severity of the derailment.
2. The Cox Landing derailment was not caused by a mechanical defect in the empty

covered hopper that was the first car to derail.

1. Drainage in the accident area was inadequate and, as a result, the roadbed in the

derailment area likely became water-saturated, rendering the track structure unable to maintain track integrity under the load of train Q316.

1. The full potential of the Cabell County Operation Respond Emergency Information

System software could not be realized, or even evaluated by emergency responders, because of a lack of information about the system in Cabell and Wayne Counties’ emergency response plan and because exercises involving the system were not included in periodic disaster drills.

1. Because the Ohio River Road Volunteer Fire Department had not participated in

Cabell and Wayne Counties’ disaster drills and because its officers were unfamiliar with the counties’ emergency response plan, the incident commanders did not use all available resources to assist in the emergency.

1. Railroad wreckage-clearing operations and pipeline operations were not effectively

coordinated and unified under an effective command structure, which placed excavation personnel at risk while they worked in the vicinity of a natural gas line. Probable Cause The National Transportation Safety Board determines that the probable cause of this derailment was an unstable roadbed that resulted from the inadequate or ineffective measures taken by CSX Transportation, Inc., to permanently correct known drainage problems in the accident area.

29 Railroad Accident Report Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes safety recommendations as follows: to the Federal Railroad Administration: Review both the implementation and the management oversight of CSX Transportation’s track inspection and maintenance programs for the Ohio River Subdivision and take the actions necessary to ensure the safe passage of trains and the safe shipment of hazardous materials through the area. (R-99-3) to CSX Transportation, Inc.: Perform a comprehensive engineering analysis and evaluation of track and roadbed conditions on the Ohio River Subdivision and develop a plan and a timetable for correcting existing or potential deficiencies, including inadequate drainage, that may affect the safe passage of trains and the safe shipment of hazardous materials through the area. Provide to the National Transportation Safety Board a schedule to correct the deficiencies found during the evaluation. (R-99-4) Develop and implement incident coordination procedures that will ensure that safety-critical operations during wreckage-clearing activities are coordinated with all parties involved in those activities. (R-99-5) Review and revise, as necessary, in light of this accident, your community outreach and training assistance programs to ensure that all emergency response groups that may be called upon to respond to an incident or accident involving your railroad receive the necessary training on a timely and recurring basis. (R-99-6) to Cabell and Wayne Counties’ Local Emergency Planning Committee: Revise your emergency response plan to incorporate information about the capabilities and use of Operation Respond Emergency Information System software. (R-99-7) Include, in your periodic disaster drills, exercises designed to familiarize emergency responders with the capabilities and use of Operation Respond Emergency Information System software. (R-99-8)

Recommendations 30 Railroad Accident Report Include in your periodic disaster drills all emergency response agencies within your jurisdiction, including the Ohio River Road Volunteer Fire Department, and ensure that those agencies are aware of Cabell and Wayne Counties’ emergency response plan and its implementation. (R-99-9) In cooperation with CSX Transportation, Inc., develop and implement incident coordination procedures that will ensure that safety-critical operations during wreckage-clearing activities are coordinated with all parties involved in those activities. (R-99-10) to Mountaineer Gas Company: In cooperation with CSX Transportation, Inc., develop and implement incident coordination procedures that will ensure that safety-critical operations during wreckage-clearing activities are coordinated with all parties involved in those activities. (R-99-11) By the National Trasportation Safety Board James E. Hall Chairman John A. Hammerschmidt Member Robert T. Francis II Vice Chairman John J. Goglia Member George W. Black, Jr. Member Adopted: June 29, 1999

FD07219 ｜ 1999_美国_RAR9903.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB99-916303 NTSB/RAR-99/03 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT COLLISION OF NORTHERN INDIANA COMMUTER TRANSPORTATION DISTRICT TRAIN 102 WITH A TRACTOR-TRAILER PORTAGE, INDIANA JUNE 18, 1998 7055B

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov/. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB99-916303 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 National Transportation Safety Board. 1999. Collision of Northern Indiana Commuter Transportation District Train 102 With a Tractor-Trailer, Portage, Indiana, June 18, 1998. Railroad Accident Report NTSB/RAR-99/03. Washington, DC. Abstract: About 4:31 a.m. on June 18, 1998, a westbound Northern Indiana Commuter Transportation District two-car passenger train struck the second semitrailer of a long combination vehicle consisting of a tractor pulling two flatbed semitrailers loaded with steel coils at a highway-rail grade crossing near Portage, Indiana. When the vehicles collided, the second semitrailer broke away and was dragged by the train, while a chain securing a steel coil to the second semitrailer broke. The released coil entered the train’s lead car through the front bulkhead and moved into the passenger compartment. Three fatalities and five minor injuries resulted. The safety issues discussed in this report are safety at private grade crossings, the design of the National Steel Corporation’s Midwest Steel grade crossing, the conspicuity of the long combination vehicle semitrailer, and the crashworthiness of the Northern Indiana Commuter Transportation District railcars. As a result of its investigation, the National Transportation Safety Board issued recommendations to the U.S. Department of Transportation, the Federal Railroad Administration, the Federal Highway Administration, the Indiana Department of Transportation, the Northern Indiana Commuter Transportation District, the National Steel Corporation (Midwest Steel Division), and the Norfolk Southern Corporation. The Safety Board also reiterated one safety recommendation to the U.S. Department of Transportation.

Railroad Accident Report Collision of Northern Indiana Commuter Transportation District Train 102 With a Tractor-Trailer Portage, Indiana June 18, 1998 NTSB/RAR-99/03 PB99-916303 National Transportation Safety Board Notation 7055B 490 L’Enfant Plaza, S.W. Adopted July 26, 1999 Washington, D.C. 20594 E P L U R IB US UN U M N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

this page intentionally left blank

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Long Combination Vehicle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 NICTD Train 102 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Conrail Train 201. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 NICTD Train 102 Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Medical Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Training and Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Truckdriver. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Training and Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Accident Trip. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Train. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Mechanical. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Train Consist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 NICTD Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Truck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Truck Position and Roadway Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Load and Load Securement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Vehicle Conspicuity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 NICTD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Conrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Grade Crossing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Location, Configuration, and Traffic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Crossing Geometry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Grade-Crossing Obligations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Highway-Rail Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Grade-Crossing Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Survival Aspects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 NICTD Carbody Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Crashworthiness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Postaccident Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Rail Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Truck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Contents iv Railroad Accident Report Postaccident Testing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Visibility and Stopping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Crossing Signal Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Laboratory Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Other Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 State Truck Size and Weight Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Operator Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Train 102 Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Truckdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Grade Crossing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Crossing Geometry and Storage Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Grade Crossing Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Long Combination Vehicle Conspicuity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Train Car Crashworthiness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Collision Post. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Emergency Lighting and Public Address Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Conclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Probable Cause. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 B: Selections from the Indiana State Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 C: Visibility and Stopping Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 D: Highway-Rail Grade-Crossing Obligations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

v Railroad Accident Report Executive Summary About 4:31 a.m. central daylight time on June 18, 1998, a westbound Northern Indiana Commuter Transportation District two-car passenger train struck the second semitrailer of a long combination vehicle that consisted of a tractor pulling two flatbed semitrailers loaded with steel coils at a highway-rail grade crossing near Portage, Indiana. When the vehicles collided, the second semitrailer broke away from the first semitrailer and was dragged by the front of the train, while the single chain securing a steel coil to the second semitrailer broke. The released steel coil, weighing about 19 tons, entered the train through the front bulkhead of the lead car and moved into the passenger compartment. Three fatalities and five minor injuries resulted from the accident. Damages were estimated to total $886,000. The National Transportation Safety Board determines that the probable cause of the collision between Northern Indiana Commuter Transportation District train 102 and a long combination vehicle (truck) at the National Steel Corporation’s Midwest Steel grade crossing was ineffective action by Federal, State, and private agencies to permanently resolve safety problems at the Midwest Steel grade crossing, which they knew to be a hazardous crossing. The major safety issues addressed in this report are • Safety at private grade crossings, • Design of the Midwest Steel grade crossing, • Conspicuity of the long combination vehicle semitrailer, and • Crashworthiness of the Northern Indiana Commuter Transportation District railcars. As a result of this accident investigation, the Safety Board makes safety recommendations to the U.S. Department of Transportation, the Federal Railroad Administration, the Federal Highway Administration, the Indiana Department of Transportation, the Northern Indiana Commuter Transportation District, the National Steel Corporation (Midwest Steel Division), and the Norfolk Southern Corporation. The Safety Board also reiterates one safety recommendation to the U.S. Department of Transportation.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Narrative About 4:31 a.m. central daylight time1 on Thursday, June 18, 1998, Northern Indiana Commuter Transportation District (NICTD) train 102, a two-car passenger train, collided with the right side of a long combination vehicle (LCV)2 owned by Richard Pluta Trucking at the Midwest Division of the National Steel Corporation’s (Midwest Steel’s) grade crossing near Portage, Indiana.3 (See figure 1 for a map of the region.) At this grade crossing, a private road leads north from U.S. Route 12 (US 12), intersects NICTD and Consolidated Rail Corporation (Conrail)4 railroad tracks, and continues to the Midwest Steel facility and other businesses. The collision occurred on the westward NICTD track. (See figure 2 for a diagram of the various vehicles and the accident scene.) Shortly before the collision, while the LCV was traversing the NICTD tracks, the approach of the westbound Conrail train 201 had activated the flashing light signals and automatic gates at the Conrail crossing. The truckdriver stopped the LCV before the Conrail crossing’s south gate. The vehicle’s second semitrailer was resting on the west- ward NICTD track. At this time, NICTD train 102, traveling westbound about 68 mph, was approaching the Midwest Steel grade crossing. About 542 feet east of the crossing, the train 102 crew noticed the LCV’s second semitrailer, which carried a steel coil (weighing about 19 tons) covered by a black tarp, on the crossing. The engineer said that he placed the train in emergency braking; then, fol- lowed by the conductor, he exited the control compartment and ran toward the rear of the passenger compartment. The crew alerted passengers in that area about the impending col- lision and told them to evacuate. As the collision occurred, the LCV’s second semitrailer broke away from the first semitrailer and was dragged by the front of the NICTD train, while the single chain secur- ing a steel coil to the second semitrailer broke. The released steel coil entered the lead car of the train through the front bulkhead. The coil moved through the car until it came to rest about 34 feet into the passenger compartment. (See figures 3, 4, 5, and 6.) Three fatalities and five minor injuries among the passengers resulted. 1 Unless otherwise noted, all times are in central daylight time. 2 The LCV comprised a tractor and two semitrailers bearing three steel coils. 3 All train movements and locations are within Indiana unless otherwise specified. 4 At the time of the accident, Conrail operated the northern portion of the Midwest Steel crossing. As of June 1, 1999, the Conrail operation in this area was taken over by the Norfolk Southern Corporation. To avoid confusion, this report will continue to refer to the “Conrail” tracks for the remainder of the report.

Factual Information 2 Railroad Accident Report Long Combination Vehicle The LCV had been traveling from Detroit, Michigan, to Portage, Indiana, with a load of three coils of steel. The truckdriver arrived at the Midwest Steel grade crossing about 4:29 a.m., after traveling northbound on State Route 249 and turning eastbound on US 12. The driver stated that he drove in the rightmost of the two left turn lanes. He said he stopped and waited for the traffic signal to turn green (with an arrow); when it did, he began to turn northward toward the Midwest Steel facility. The driver’s destination was PreCoat Metals, a company located next to the National Steel Corporation’s Midwest Division facility. Figure 1. Map of accident area

Factual Information 3 Railroad Accident Report The truckdriver said that while he was making the turn into the Midwest Steel crossing, he did not see any approaching trains and the crossing gates and lights were not activated. According to the truckdriver, as he entered the area between the two sets of tracks (NICTD and Conrail), the Conrail gates and lights activated, and he stopped the LCV short of the descending inner gate. The second semitrailer of the 82-foot-long LCV remained on the NICTD westward track, clear of the descending southern outer NICTD gate. The northern inner NICTD gate remained in the “up” position. As Conrail train 201 passed through the crossing, the truckdriver looked out his left door-mounted rearview mirror and saw the northern inner NICTD gate descending and the lights flashing. He said this indicated to him that a train was approaching on the NICTD tracks. According to the driver, he attempted to turn his vehicle to the left to pull the semitrailer off the tracks, but he did not have enough room or time. The commuter Figure 2. Scene of collision at Midwest Steel grade crossing

Factual Information 4 Railroad Accident Report Figure 3. East (undamaged) end of NICTD car 11 Figure 4. West (damaged) end of NICTD car 11

Factual Information 5 Railroad Accident Report Figure 5. Steel coil inside NICTD car 11 Figure 6. Steel coil outside NICTD car 11

Factual Information 6 Railroad Accident Report train struck the rear semitrailer, shearing off the kingpin and separating it from the first semitrailer of the LCV. The truckdriver was not injured in the collision, and he remained with his vehicle until emergency response personnel arrived. NICTD Train 102 The two-person crew (a conductor and an engineer) on NICTD train 102 had reported for duty at 3:57 a.m. in Michigan City, Indiana. Train 102 was a regularly sched- uled westbound passenger train traveling from Michigan City to Chicago, Illinois, and consisting of two multiple-unit (MU) cars. The crew made the required predeparture inspections and reviewed the general orders. Finding no anomalies, the crew began the trip at 4:02 a.m. After making a scheduled stop at the Michigan City Station, train 102 departed at 4:07 a.m. and proceeded on its route, making stops at the Tamarack and Dune Park Stations. Train 102 departed Dune Park at 4:22 a.m., heading toward its next scheduled stop at the Ogden Dunes Station. The conductor joined the engineer in the control com- partment of the first car. The train 102 engineer said that between milepost (MP) 48.0 and 50.0, he attempted to accelerate to the authorized speed of 79 mph. According to event recorder information, the train reached 78 mph for about 20 seconds before the engineer changed the throttle to a coasting position for the reduced speed limit at MP 50.0. As train 102 approached the Midwest Steel grade crossing (MP 49.77), the engineer observed a white tractor at the crossing. The engineer said that as train 102 neared the Midwest Steel grade crossing, conditions were dark with a light fog and it was difficult to see, so he asked the conductor to help him determine what was at the crossing. Both crewmembers believed that the tractor became visible about six pole lengths5 (1,020 feet) from the crossing. The engineer said that when train 102 was about five pole lengths (850 feet) east of the cross- ing, he saw a semitrailer on the crossing and put the braking control into the emergency position. The conductor and engineer then left the control compartment and ran toward the rear of the car to warn the passengers of the impending collision. One passenger, who was a NICTD employee, left his seat on the north side of the first car (near the control compartment) and followed behind the crewmembers. He did not reach a safe location before the steel coil moving through the railcar overtook him. The steel coil also overtook two passengers who were riding on the south side of the first car while they were at or near their seats. The railroad employee and the two other passengers received fatal injuries from the moving coil of steel. (See figure 7, passenger car diagram.) The cars remained coupled during the accident, and neither car derailed. No fire occurred in either car. 5 The NICTD train crewmembers referred to distances in “pole lengths,” in reference to the distance between the catenary poles running along the track. The distance between the catenary poles east of the Midwest Steel grade crossing was 170 feet.

Factual Information 7 Railroad Accident Report Figure 7. View of a typical NICTD Nippon Sharyo passenger railcar (Source: NICTD Running Maintenance and Troubleshooting Manual, September 1982 edition, as modified by the Safety Board.)

Factual Information 8 Railroad Accident Report After the impact with the LCV, all the lights went off in train 102’s first car, and the engineer observed that the front of the train was “just collapsed, like it was folding.” Lights remained on in the second car. The engineer said he ran into the second car and remained there until the train came to a complete stop. He then moved to the operating cab in the rear of the second car and radioed the dispatcher to inform him that “we had hit a truck at the Midwest rail crossing and for him to get emergency personnel out as quickly as possible.” The engineer said he then returned to the first car to attempt to help the injured passengers. On the way, he met the conductor, who was going to the second car. The engi- neer took the conductor’s flashlight and continued into the first car, where he saw the injured NICTD employee. The engineer said he shone his flashlight toward the front of the car, where he knew two passengers had been. He did not see anyone, and he did not hear anything. He went back to the second car and called the dispatcher again to let him know that the conductor was safe. He also advised the dispatcher that the coil had come into the car. The 13 remaining passengers and the 2 members of the crew exited through the last door on the south side of the second car. By the time they had exited the train, emer- gency personnel (police) were arriving, and the engineer told them where to find the injured passengers. He said he tried to open the center door of the first car by using the emergency pull, but the door was jammed. The engineer then went to the north side of the first car and opened the emergency exit there. Conrail Train 201 The crewmembers on Conrail train 201, which was a freight train, could not recall whether they had seen a truck at the Midwest Steel crossing. As Conrail train 201 passed the crossing, its conductor saw a “blue flash” in the rearview mirror on the left side of the locomotive cab. The conductor commented on the flash to the Conrail engineer, who also looked back. They estimated that their train’s speed was about 45 mph when passing the cross- ing. At the Midwest Steel crossing for Conrail trains, freight trains were allowed to travel 60 or 50 mph, depending on the type of train. The Conrail engineer said he was intention- ally operating at a reduced speed because a train ahead of train 201 had to stop and switch cars. Emergency Response The accident site was under the incident command of the Portage Fire Department (PFD) of Porter County, Indiana. A Midwest Steel representative notified the Portage Police Department (PPD) dispatcher of the accident at 4:35 a.m. The PPD dispatcher dis- patched Portage police, fire, and emergency medical services (EMS) personnel at 4:36 a.m. The PFD chief arrived on the scene at 4:44 a.m. and was advised that a steel coil was halfway into the first NICTD car and had pinned two people. At 4:49 a.m., the fire chief established incident and medical command and became the incident commander.

Factual Information 9 Railroad Accident Report The fire chief requested that off-duty PFD and EMS personnel report to the station and called for mutual aid from the Ogden Dunes Volunteer Fire Department and the South Haven Fire Department, as well as an additional ambulance from the Porter Memorial Hospital EMS. At this time, the incident commander was advised that three people were inside the first NICTD car and that two were dead and one was alive but severely injured and pinned under the steel coil. The PFD chief immediately requested a crane from Midwest Steel or the Port of Indiana to raise the coil. The assistant PFD chief asked the PPD dispatcher to request a University of Chicago Aeromedical Network helicopter and additional assistance. The assistant chief also contacted the Methodist Hospital, Northlake campus, to request a sur- geon. While the additional help was being sought, a paramedic firefighter tried to commu- nicate with, administer oxygen to, and monitor the cardiac status of the severely injured person pinned under the coil. About 5:14 a.m., the incident commander was told that the injured person had lost all vital signs. The request for the helicopter was canceled, and all personnel left the NICTD train. The PFD chief released all units from the scene at 11:39 a.m.; he remained on the scene until the train was removed by NICTD. Five people with minor injuries were transported or transported themselves to hos- pitals. All were treated and released the same day. A total of 22 emergency response per- sonnel, 2 fire engines, and 2 ambulances responded from the PFD for this accident. Injuries Table 1. Injuries Based on the injury criteria of 49 Code of Federal Regulations (CFR) 830.2 of the International Civil Aviation Organization, which the Safety Board uses in accident reports for all transportation modes. Type Train Crew Railroad Personnel Truckdriver Passengers TOTAL Fatal 0 1 0 2 3 Serious Injuries 0 0 0 0 0 Minor Injuries 0 0 0 5 5 No Injuries 2 0 1 8 11 Total 2 1 1 15 19

Factual Information 10 Railroad Accident Report Damage6 NICTD Train 102 Crew NICTD records showed that each crewmember was qualified on the physical char- acteristics of the territory and the operating rules for trains over the NICTD system. The engineer and conductor typically worked together. The engineer said that on the morning of the accident, he had awoken at 2:45 a.m. feeling rested. He had not worked on June 17 and had gone to bed that night at 9:30 p.m. and fell asleep about 10:30 p.m. On June 16, he had been woken up at 8:00 a.m. by a dis- patcher who requested that he work that day (normally his day off). He departed for work at 9:45 a.m. and went off duty at 6:45 p.m. The conductor said that on the morning of the accident, he had awoken at 2:45 a.m. feeling rested. He had had June 17 off and had gone to sleep at 8:15 p.m. that night. On June 16, which was normally his day off, he had worked with the engineer. That night, he went to bed at 10:30 p.m. and awoke about 7:00 a.m. on June 17. On June 18, both the engineer and conductor had reported for duty at 3:57 a.m. Their train departed from the home terminal in Michigan City, Indiana, about 4:02 a.m. NICTD had scheduled them to finish work that day at 7:47 a.m. Both were compliant with the Federal Hours of Service Law. Medical Factors Both the engineer and conductor had received company physicals within the last 2 years and were in good health and qualified for service. Neither reported having taken any prescription or nonprescription medications on the day of the accident. Training and Experience The engineer, 33, had been working for NICTD as an engineer for about 9 years. He started with the railroad in May 1985 and had worked in the transportation department since January 1986. He had been working over the territory between Michigan City and Chicago since 1986, first as a collector and, since 1989, as an engineer. Truck semitrailers $11,000 Train car 11 750,000 Train car 45 75,000 Signal 50,000 Total $886,000 6 The truck semitrailer damage information was provided by Richard Pluta, the trailer owner. NICTD provided the rail damage information.

Factual Information 11 Railroad Accident Report In accordance with Federal regulations covering the certification of locomotive engineers (49 CFR Part 240), NICTD records showed that the engineer’s certification was current. The records included his motor vehicle driving record, as well as the findings of his physical exams, operational rules tests, and on-board performance checks. The conductor, 41, had worked for NICTD for almost 20 years. He was hired on August 21, 1978, and became a conductor on August 23, 1980. He had operated between Michigan City and Chicago for about 20 years. Truckdriver Training and Experience The truckdriver, 39, had been working as a truckdriver since 1985. He held a valid Michigan Class A commercial driver’s license (CDL) with an endorsement for double and triple semitrailers. His license had no restrictions. He had a valid medical card, and his most recent medical examination had been on January 8, 1998. The driver said he was in good health and not under a doctor’s care. The truckdriver’s driving history showed the following incidents: 3/09/92 Improper class/endorsement on CDL 5/21/92 Speeding 10/08/93 Speeding 9/11/95 Traffic collision, no injury (property damage only) 1/23/98 Speeding At the time of the collision, the truckdriver was driving a vehicle owned by Rich- ard Pluta Trucking. The vehicle and driver were on a long-term lease to Eastern Express, Inc., of Griffith, Indiana. The lease included a provision that allowed the driver to trip lease7 with other carriers when Eastern Express did not have work for him. Eastern Express officials said that the truckdriver had been working for them since January 1995. He had undergone pre-employment drug and alcohol testing, as well as three random drug and alcohol tests while employed by Eastern Express, and the results had all been negative. (The last random drug test had taken place on February 3, 1998.) The driver had also passed a company background check. Company officials said they were satisfied with the driver’s work, but they had not heard from him since May 20, 1998. If a driver did not report for 30 days, company policy was to terminate that driver’s employment. Eastern Express said it had been preparing to terminate this driver’s employment but had not yet done so when the accident occurred. 7 A short-term lease under which a driver and vehicle are contracted to haul goods for a single trip (usually one way). Trip leases are commonly used by carriers needing additional drivers and vehicles.

Factual Information 12 Railroad Accident Report The truckdriver had used the Midwest Steel grade crossing regularly between 1985 and 1993. He estimated that he traveled over the crossing twice a week during this period. Nearly all these crossings were made in vehicles with double semitrailer configurations. Since 1995, when he began working for Eastern Express, up to and including the accident trip, he estimated that he had used the Midwest Steel crossing two or three times. Accident Trip On June 15, 1998, the truckdriver entered into a trip-lease agreement with Top Line Express of Lima, Ohio. He was to pick up steel coils from Bethlehem Steel in Burns Harbor, Indiana, and deliver them to Flat Rock Metals in Flat Rock, Michigan, and Michi- gan Steel Processing in New Boston, Michigan. According to the driver’s logbook, he picked up the load at Bethlehem Steel about 4:00 p.m. on June 15 and began to drive about 7:45 p.m. The truck had a mechanical failure en route, so he stopped at a truck stop in New Buffalo, Michigan, disconnected the semitrailers, and went home to nearby Niles, Michi- gan. He went to bed about 2:15 a.m. On June 16, he woke at noon and drove the tractor to Be-Right Truck Repair in Gary, Indiana. (Be-Right Truck Repair is co-owned by the accident truck owner.) He spent the day at a restaurant and the repair shop. The vehicle was repaired about 4:00 p.m., and the driver drove the tractor home. He ate dinner, watched television, and went to bed about 9:00 p.m. He woke about 12:30 a.m. on June 17 and began his delivery trip about 1:30 a.m. The truckdriver’s log indicates that he made his first delivery to Flat Rock Metals about 5:30 a.m. and departed about 7:45 a.m. Security logs at Flat Rock Metals showed that he arrived at 5:50 a.m. and departed at 8:40 a.m. His log indicates that he then drove to Michigan Steel Processing, about 7 miles away. The truckdriver contacted Top Line Express’s agent about 2:15 p.m. to ask whether the agent had a return load for him. He was told to go to Thyssen Steel in Detroit and pick up three steel coils for delivery to PreCoat Metals, Inc., in Burns Harbor, Indiana. He did not obtain a signed copy of the trip lease or the required weight permit for Indiana. The truckdriver arrived at Thyssen Steel between 3:00 and 3:30 p.m. According to the bill of lading, loading was completed at 4:19 p.m. The driver went to a truck stop in Detroit, where he rested in the truck’s sleeper berth from 5:00 p.m. to about 11:00 p.m. He said he got up feeling rested. He then drove to Burns Harbor to make the delivery, arriving about 4:29 a.m. Table 2 lists the reported activities of the truckdriver during the 3 days preceding the accident in chart form. (Some times provided in table 2 are estimated.)

Factual Information 13 Railroad Accident Report Table 2. Truckdriver’s activities between June 15 and June 18, 1998 Date and Time Driver’s Actions June 15 12:00 a.m. to 9:00 a.m. Slept. 9:00 a.m. to 10:00 a.m. Woke up and ate. 0:00 a.m. to 3:00 p.m. Worked around house. 3:00 p.m. to 4:00 p.m. Called Top Line Express. 4:00 p.m. to 8:00 p.m. Picked up steel at Bethlehem Steel, Burns Harbor, Indiana. 8:00 p.m. to 9:00 p.m. Drove to New Buffalo, Michigan. Truck broke down. 9:00 p.m. to 12:00 a.m. Logged off duty. Watched TV and ate. June 16 12:00 a.m. to 2:15 a.m. Logged off duty. Watched TV and ate. 2:15 a.m. to 1:00 p.m. Slept, woke about 12:00 p.m. Dressed. 1:00 p.m. to 2:00 p.m. Drove to Gary, Indiana, to have tractor repaired. 2:00 p.m. to 4:00 p.m. Waited for repair. 4:00 p.m. to 5:00 p.m. Drove to New Buffalo, Michigan. 5:00 p.m. to 9:00 p.m. Watched TV and ate. 9:00 p.m. to 12:30 a.m. Slept. June 17 12:30 a.m. to 1:30 a.m. Woke up. Prepared for trip. 1:30 a.m. to 6:00 a.m. Drove to Flat Rock Metals in Flat Rock, Michigan. 6:00 a.m. to 9:00 a.m. Delivered steel to Flat Rock Metals, drove to Michigan Steel Products. 9:00 a.m. to 11:00 a.m. Off-loaded steel at Michigan Steel Products. 11:00 a.m. to 2:15 p.m. Ate lunch (no log entries). 2:15 p.m. to 3:00 p.m. Called Top Line Express agent and drove to Thyssen Steel in Detroit, Michigan. 3:00 p.m. to 5:00 p.m. Was at Thyssen Steel. 5:00 p.m. to 11:00 p.m. Ate dinner and rested in sleeper berth. 11:00 p.m. to 12:00 a.m. Departed for PreCoat Metals. June 18 12:00 a.m. to 4:29 a.m. Drove to Midwest Steel crossing. 4:31 a.m. Collision at Midwest Steel crossing.

Factual Information 14 Railroad Accident Report Train Mechanical The Safety Board reviewed the inspection records for NICTD train 102. The records indicated the train had been mechanically inspected at 11:00 p.m., June 17, 1998. No defects were reported. Train Consist The MU lightweight stainless steel passenger railcars that NICTD operates in rev- enue service are self-propelled electric cars. Each 85-foot-long, 118,000-pound car oper- ates on 1,500 volts DC supplied by overhead catenary wire. The operator controls are in control compartments at both ends of each car, allowing individual unit operation. NICTD operates its trains in consists of up to eight cars. Each car generally has a 93-passenger seating capacity and is fitted with bench seats that accommodate 2 passengers each. NICTD car 11 (the lead car) was built in 1982. It was designed to generate 640 hp and was equipped with schedule 26B1 brake equipment. NICTD records show that car 11 passed an annual inspection on May 11, 1998. It could seat 93 passengers. NICTD car 45 (the trailing car) was built in 1992. It was also designed to generate 640 hp and was equipped with schedule 26B1 brake equipment. NICTD records show that car 45 passed an annual inspection on June 15, 1998. It could seat 110 passengers. Both cars on NICTD train 102 were equipped with model 1260 event recorders from Peerless Instrument Company, Inc. Event recorder data indicated the train had been traveling at 68 mph when the emergency brakes were applied. NICTD Operations NICTD was established in 1977 by an act of the Indiana General Assembly and is an agency of the State of Indiana. NICTD provides passenger service between the Michiana Regional Airport in South Bend, Indiana, and Randolph Street Station in Chicago, Illinois. The line is about 90 miles long. The rules for the NICTD railroad are set forth in an operating rulebook8 and are supplemented and modified by timetable. Daily bulletins are used to show changes to the rules. If necessary, train orders are issued to immediately implement an operating rule or modify an existing rule. The permanent track speeds for NICTD trains are designated in the timetable, and temporary speed restrictions are issued by track bulletin. NICTD uses wayside block signals. This automatic block signal system is prima- rily activated by conditions in the field, such as the presence of other railroad equipment 8 The rulebook is the Chicago South Shore and South Bend Railroad and Northern Indiana Commuter Transportation District, Rules and Regulations for the Government of the Operating Department. It became effective September 1, 1986, and contains revisions added in April 1990.

Factual Information 15 Railroad Accident Report or disruptions in the electrical circuit running through the rail from one block signal to the next. The majority of the signals cannot be controlled by a train dispatcher. NICTD train 102 is a scheduled passenger train and, according to NICTD officials, carries about 200 passengers daily. The NICTD railroad uses an efficiency testing program under which a supervisor had observed both the engineer and conductor performing their duties. In 1997, the engi- neer had been observed 28 times and the conductor 36 times. No exceptions were reported. Some of these observations occurred without the employees’ knowledge. Results indicated that both employees routinely performed appropriately at grade crossings. Truck The LCV was a conventional truck tractor in combination with two heavy semi- trailers; such a unit is commonly referred to as a “Michigan Train.”9 (See figures 8 and 9 for a photo of a Michigan Train as well as a diagram of the Michigan Train involved in this accident.) The vehicle was 82 feet long, and it had a gross vehicle weight (GVW) of 153,115 pounds.10 The truck tractor was a 1996 white GMC, model WIA64TES, three-axle conven- tional tractor with a sleeper cab. It was equipped with a model 3406E six-cylinder Caterpillar diesel engine, an Eaton-Fuller model RTX-16709B nine-speed transmission, and two Eaton model DS402 (3:90 ratio) rear-drive axles. The tractor was equipped with S-cam airbrakes. The first semitrailer was a 1973 ASM five-axle flatbed trailer with a fifth wheel hitch. The semitrailer was equipped with type 30 S-cam airbrakes on all five axles. The trailer bed was 28 feet long. The total semitrailer length to the rear of the frame, which extended about 10 feet beyond the trailer bed, was 38 feet. The second semitrailer was a 1969 Fruehauf three-axle flatbed trailer. The semi- trailer was equipped with type 30 S-cam airbrakes on all three axles and was 28 feet, 6 inches, long. 9 A Michigan Train is a three-axle truck tractor in combination with a five-axle primary trailer equipped with a fifth wheel and trailed by a three-axle semitrailer. Michigan Trains generally have a total of 11 axles. Although these combination units are normally prohibited in Indiana, by using special designated routes and weight permits, they may transport goods, often steel, from Michigan to industrial locations in northern Indiana. 10 The maximum GVW permitted in Indiana is 80,000 pounds. With a special weight permit, Michigan Trains may haul up to 134,000 pounds in Indiana over specified routes.

Factual Information 16 Railroad Accident Report Figure 8. A Michigan Train at the Midwest Steel grade crossing

Factual Information 17 Railroad Accident Report Figure 9. Diagram of the Michigan Train involved in this accident (Safety Board)

Factual Information 18 Railroad Accident Report Truck Position and Roadway Evidence Police reported that when they arrived at the scene soon after the accident, the front of the tractor was about 6 feet south of the southernmost Conrail gate, and the rear of the first semitrailer was about 7.5 feet north of the northernmost NICTD rail. Tiremarks from the second semitrailer’s three axles were found. The tiremark from the first axle was about 53 feet long, running east to west and generally parallel to the north edge of the northernmost NICTD rail. The tiremark from the second axle was about 1 foot long and lay between the NICTD double tracks, about 3 feet from the southernmost rail for the westward mainline. The tiremark from the third axle was about 13 feet long. It lay between the NICTD double tracks and began about 8 feet from the southernmost rail for the westward mainline. All three tiremarks began about 15 to 20 feet from the east edge of the crossing pavement. Load and Load Securement The truckdriver had picked up the load of three steel coils at Thyssen Steel Group in Detroit, Michigan. According to the bill of lading, the motor carrier was Top Line Express, and the coils were to be delivered to PreCoat Metals, Inc., in Portage, Indiana. The (gross) weight of the three coils was listed as 1) 38,030 pounds, 2) 30,137 pounds, and 3) 30,468 pounds. The coils were loaded in reverse order, with the first coil placed on the rear semitrailer and the second and third coils on the lead semitrailer. The coil placed on the rear semitrailer was 72 inches in outside diameter, 41 inches wide, and had an open center (“eye”). After the accident, an Indiana State trooper found the two coils secured to the lead semitrailer by a chain over each coil. “Bump chains”11 were also found. All the chains were 3/8-inch grade 7 chains with 6,600-pound working load limits (WLLs). The truckdriver told the Safety Board that the coil on the rear semitrailer had been held by three chains. The driver said that to fix the position of the coil he had used one bump chain, one “over-the-top” chain, and one chain to keep the coil from moving back- wards. During postaccident inspection of the semitrailers and NICTD car 11, investigators found one broken chain; it was also a 3/8-inch grade 7 chain. Title 49 CFR 393.102 (b), “Securement Systems,” states that “the aggregate WLL of the tiedown assemblies used to secure an article against movement in any direction must be at least 1/2 times the weight of the article.” The 38,030-pound steel coil would have required three 3/8-inch grade 7 chains with a cumulative WLL of 19,800 pounds, or 52 percent of the weight of the coil, to secure it according to regulation. Neither the bump chain nor the one used to keep the coil from moving rearward can be used in calculating the number of chains needed to secure the load. The three chains required by the securement regulation have to go “over the top” of the coil or “through the eye.”12 11 A bump chain is fastened over a wood block and in front of the steel coil. The bump chain keeps the steel coil from moving forward during a forceful brake application. 12 49 CFR 393.100 (iii) (a) (1), (2), and (3).

Factual Information 19 Railroad Accident Report The executive director of the National Association of Chain Manufacturers told the Safety Board that too many variables exist to effectively calculate how many chains would have been needed to keep the coil secured to the rear semitrailer after the impact with the train, but three chains would probably not have kept the coil from breaking loose from the semitrailer. The Safety Board analyzed the load securement configuration as specified by Federal regulations (using three chains) for steel coil transport. The Board’s computations showed that the rigging of three chains would have failed by a factor of about eight in this accident. Vehicle Conspicuity The second semitrailer had three amber lens lights, each about 2.5 inches in diam- eter, installed on both sides at a frame rail height of about 50 inches. The rear of the semi- trailer had two tail lights and two combination brake and turn signal lights. The front corners of the semitrailer had one amber light each. Additionally, the semitrailer had round lens-style reflectors on the front corners, sides, and rear. Postaccident examination of the bulbs and electrical testing of the second semitrailer revealed that the lights had been on at the time of the accident. Neither semitrailer was equipped with retroreflective tape. The Federal Conspicu- ity Systems law (49 CFR 571.108) mandates that all trailers manufactured after December 1, 1993, with a GVW rating in excess of 10,000 pounds and a width of at least 80 inches have retroreflective sheeting tape along both sides and the rear. Both semitrailers had been manufactured before December 1, 1993. Track NICTD NICTD owns, inspects, and maintains its track structures. As Federal Railroad Administration (FRA) class 4 track, both the NICTD eastward and westward main tracks (from south to north) have a maximum allowable operating speed of 79 mph for passenger trains and 35 mph for freight trains. An electrically energized catenary wire is situated over the approximate centerline of each NICTD track. The wire is supported by a series of wayside catenary support poles situated outboard of the track roadbed along the right of way. Investigators found no abnormalities during the postaccident inspection of the track. A visual inspection of the rail did not reveal any fractures that may have interrupted signal circuitry. In addition to inspecting the track physically, the Safety Board reviewed NICTD track inspection records from May 19, 1998, to June 18, 1998. The inspection frequency for both main tracks met FRA requirements, and remedial corrective actions were taken when track defects were noted. No deficiencies were noted at the Midwest Steel grade crossing. All NICTD track inspections were conducted by designated individ- uals qualified under 49 CFR 213.7.

Factual Information 20 Railroad Accident Report NICTD had conducted the most recent internal rail inspection in the area of the Midwest Steel grade crossing on November 6, 1997. During a visual inspection, investiga- tors found no fractures that could have interrupted signal circuitry within the Midwest Steel grade-crossing area. Conrail The Conrail track consists of main track No. 2 and main track No. 1 (from south to north), which are tangent and about level in this vicinity. All train operations were remotely controlled by the Conrail train dispatchers in Dearborn, Michigan, and a traffic control sig- nal system.13 Besides Conrail trains, CP Rail System, Indiana Harbor Belt, CSX Transpor- tation, and Amtrak trains operate over the Conrail tracks at the Midwest Steel grade crossing. Grade Crossing The FRA considers the intersections of the Midwest Steel private road with the Conrail and NICTD tracks to be two separate grade crossings. The FRA considers both intersections to be private crossings. Location, Configuration, and Traffic Location and Configuration. The highway portion of the Midwest Steel grade crossing is about 60 feet wide, accommodates two lanes of traffic in each direction, and intersects the railroad tracks at a right angle. The crossing is used primarily by the Mid- west Division of the National Steel Corporation, including its employees, suppliers, visi- tors, and others having business at the plant. PreCoat Metals and other adjacent businesses also use the crossing. In this area of Porter County, the Conrail and NICTD tracks parallel each other. Traveling from east to west, the tracks begin to parallel each other at the Burns Harbor Yard near Conrail MP 486 and NICTD MP 48.5. At the time of the accident, this stretch of track contained five grade crossings. All five crossings, with the exception of the five- track Conrail crossing at Old Wilson Road, were protected by gates, lights, and bells. (The Conrail crossing at Old Wilson Road had only flashing lights.) From east to west, the fol- lowing crossings were in this area of parallel tracks: 13 The tracks are signaled in both directions. Signal indication provides the authority for a train to operate in either direction on the same track. Common Name Conrail MP NICTD MP Primary Use Ownership Old Wilson Road MP 486.71 MP 49.2 Commercial (now closed) private Midwest Steel MP 487.29 MP 49.77 Commercial private Continental Can MP 488 MP 50.51 Inactive private Hillcrest Road MP 488.3 MP 50.8 Residential public County Line Road MP 490.1 MP 52.6 Residential/Recreation public

Factual Information 21 Railroad Accident Report Traffic. Based on a postaccident traffic count by Midwest Steel, vehicles go through the crossing about 4,300 times per day. Of these crossings, about 2,500 are made by light vehicles (cars, pickup trucks, and so forth) and 1,800 by heavy trucks. These fig- ures represent the traffic in both directions, so about 2,150 vehicles use the crossing daily. The Midwest Steel crossing serves as the primary entrance and exit to the area. An average of about 132 trains use the Midwest Steel crossing daily. A Conrail dispatcher in Dearborn, Michigan, conducted an inventory and found that an average of 100 trains from various railroads, including about 14 Amtrak passenger trains, pass over the Conrail portion of the Midwest crossing daily. Most of these trains (about 86), are freight trains. On the NICTD side of the crossing, about 26 NICTD passenger trains use the crossing daily, as do an average of 6 freight trains. Crossing Geometry The Conrail and NICTD sections of the crossing are separated by 86 feet and 9 3/4 inches of paved asphalt from the southernmost Conrail rail to the northernmost NICTD rail. The NICTD north gate and the Conrail south gate are 58 feet apart. (See figure 10 for representations of these distances at the crossing.) Grade-Crossing Obligations History. According to NICTD officials, around 1908, an ice company owned a tract of land north of the tracks near the present-day Midwest Steel property. At the time, the ice company purchased a right of way to this property from the Chicago Lake Shore Railroad. The ice company retained the right to a private grade crossing and access to its property until the National Steel Corporation purchased the property. NICTD officials told the Safety Board that, in July 1959, the National Steel Corpo- ration requested the establishment of what eventually became the NICTD portion of the crossing. Gates and flashers were put in service in August 1959. Responsibility. Four organizations have direct involvement with the Midwest Steel grade crossing—Midwest Steel (that is, the National Steel Corporation), NICTD, Conrail, and the Indiana Department of Transportation (INDOT). Several other businesses and agencies have less significant involvement with the crossing. The engineering firm Cole Associates, Inc., conducted a property survey at the Midwest Steel grade crossing in 1997. Based on this survey, NICTD owns 120.58 feet of land between a monument located near US 12 and a north point near the crossing gate arm at the Conrail No. 2 main track. From the northern NICTD property line, Conrail owns 100.07 feet of property to its northern boundary line. NICTD’s agreement with the National Steel Corporation, dated August 1, 1968, for the construction, maintenance, and use of the private road crossing14 requires that the National Steel Corporation, at its own expense, construct and maintain the Midwest Steel crossing in compliance with statutory regulations. All work must meet the approval of NICTD’s chief engineer or his authorized agent. The agreement stipulates that the

Factual Information 22 Railroad Accident Report crossing is to be protected at all times by automatic gates and flashing lights and such safety devices as may be required by NICTD. The agreement also stipulates that the cross- ing is to be used only by “Midwest Steel’s agents and servants and by persons having busi- ness with Midwest Steel.” In addition to the agreement, the railroads and the National Steel Corporation have issued permission to Sequa Coating Corporation (PreCoat Metals) and Portside Energy Corporation to use, under defined terms, the crossing.15 Conrail has a similar agreement with the National Steel Corporation, dated April

1. Like the agreement with NICTD, Conrail’s agreement states that the crossing shall

be protected with flashing lights and gates. These warning devices must be installed and maintained by Conrail at the National Steel Corporation’s expense. 14 The contract was first made with the Chicago SouthShore and South Bend Railroad; it now applies to NICTD. Figure 10. Distances at the crossing

Factual Information 23 Railroad Accident Report US 12 runs parallel to and about 45 feet south of the NICTD right of way. US 12 is maintained and operated by INDOT. INDOT does not exercise jurisdiction over the Mid- west Steel crossing. INDOT is responsible for maintaining the highway traffic signals for the crossing and for managing traffic access to and from US 12 at the intersection adjacent to the crossing. According to the NICTD general manager, INDOT has safety and crossing over- sight responsibilities with respect to NICTD to the same extent as it has for other railroads within Indiana. According to the chief of the INDOT division of Intermodal Transporta- tion, INDOT has a regulatory role over public grade crossings as defined in State statute, and no jurisdiction over private grade crossings. This official also stated that INDOT has oversight obligations arising from NICTD’s enabling legislation such that INDOT pro- vides funds to offset NICTD operating and capital costs, including the local matching funds associated with Federal grants. According to testimony provided by INDOT representatives during depositions conducted by the Safety Board on October 28 and 29, 1998, in Merrillville, Indiana, INDOT has neither performed nor knows of any risk assessments performed on grade- crossing limitations regarding storage area lengths in this geographic region. During these proceedings, Federal Highway Administration (FHWA) and INDOT representatives also stated that neither the FHWA nor INDOT has the responsibility or authority to fund or otherwise oversee improvements at private crossings. Highway-Rail Signals NICTD Grade-Crossing Warning System. The NICTD grade-crossing warning system uses two signal masts, each equipped with a gate and located so that they will come down across each direction of highway traffic. The system uses 12 round 8-inch- diameter flashing lights and a bell, all mounted on the signal masts to provide warning for all directions of highway traffic. Track circuits monitor trains approaching the crossing from both directions. The amount of warning time provided is determined by the length of the approach track circuit and the speed of the approaching train. The westbound track has both a west and an east approach track circuit. The west approach track circuit extends about 934 feet from the crossing. Trains approaching the crossing from the west are restricted to 20 mph. This configuration results in a minimum warning time of 31.8 seconds; slower trains receive a longer warning time. The east approach track circuit extends about 3,087 feet from the crossing. The maximum 15 NICTD and PreCoat Metals had a formal agreement as to the latter’s responsibilities for the Midwest Steel grade crossing. Under this agreement, PreCoat Metals agreed to meet all obligations (fiduciary in nature) that the National Steel Corporation had for this crossing should the National Steel Corporation not meet its obligations. Also, under this agreement, PreCoat Metals will incur all “reasonable costs,” defined as those costs necessary and appropriate to the safe and prudent use and maintenance of the crossings as determined by mutual agreement or per industry, statutory, or regulatory standards, “as promulgated by the Association of American Railroads, the American Railway Engineering Association, State or Federal agencies, or the District’s Chief Operation officer or his designee.”

Factual Information 24 Railroad Accident Report authorized speed for trains approaching the crossing from the east is 79 mph.16 This con- figuration results in a minimum warning time of 26 seconds. The eastbound track also has west and east approach track circuits. The west approach track circuit extends about 3,480 feet from the crossing. The maximum autho- rized speed for trains approaching the crossing from the west is 79 mph; this results in a minimum warning time of 33 seconds. The east approach track circuit extends about 3,087 feet from the crossing. Trains approaching the crossing from the east are restricted to 20 mph; this results in a minimum warning time of 105 seconds. Slower trains approaching the crossing from either direction receive a longer warning time. Conrail Grade-Crossing Warning System. The Conrail grade-crossing warning system uses two signal masts, each equipped with a gate and located so that they will come down across each direction of highway traffic. The warning system uses eight round 8-inch-diameter flashing lights and a bell, all mounted on the signal masts to provide warning for all directions of highway traffic. The west approach for track No. 1 and track No. 2 are configured similarly; the east approach for track Nos. 1 and 2 are the same. The west approach circuit extends about 4,980 feet from the crossing. A grade- crossing microprocessor monitors the approach circuit and calculates the speed of an approaching train and the time the train will take to arrive at the crossing. The micropro- cessor then activates the warning devices at a predetermined warning time. The micro- processor provides a relatively uniform warning time, but the time will fluctuate somewhat due to changing ballast and track conditions. The maximum authorized speed for trains approaching the crossing from the west is 79 mph. This configuration results in a minimum warning time of 43 seconds for all train speeds up to 79 mph. The east approach consists of two circuits that extend a total of about 5,480 feet. The maximum authorized speed for trains approaching the crossing from the east is 79 mph. This configuration results in a minimum warning time of 46 seconds; slower trains receive a longer warning time. The east approach circuits also check the wayside railroad signal. If the wayside signal is red, the crossing will not be activated. This pre- vents the crossing warning devices from activating and blocking highway traffic while a train approaching the crossing from the east is stopped on the east approach circuit waiting for a permissive wayside signal. INDOT Highway Traffic Signal System. The highway signal system is pro- grammed to monitor traffic in four directions: (1) eastbound traffic on US 12, (2) westbound traffic on US 12, (3) eastbound US 12 traffic turning left onto the Midwest Steel entrance road, and (4) southbound traffic exiting the Midwest Steel facilities. The intersection is equipped with solid-state monitoring equipment and a video detection 16 The signals on the NICTD signal system are arranged on the two tracks for movement with the current of traffic; trains traveling west are routed on the westbound track, while the eastbound track handles trains traveling east. Trains traveling east on the westward track are moving against the current of traffic and are restricted to 20 mph. Trains traveling west on the eastward track are moving against the current of traffic and are restricted to 20 mph.

Factual Information 25 Railroad Accident Report system, which is used as a motion detector to notify the monitoring equipment of traffic waiting for a green light. The traffic signals are standard round 12-inch-diameter traffic lights and operate on a commercial power supply. Highway-Rail Signal Interaction. The Midwest Steel entrance road is a north- south, two-way, double-lane roadway, intersected by four railroad tracks (two Conrail tracks on the north end and two NICTD tracks on the south end). Because of the proximity of the two railroad crossings, the Conrail and NICTD crossing warning devices are inter- connected such that operation of the warning devices from one railroad activates the warn- ing devices on the other railroad. The two crossing warning devices are also interconnected with the highway traffic signals. Activation of either railroad crossing warning system causes the highway traffic signals to begin a railroad “preemption”17 sequence. The signal preempt sequence is designed to provide a green signal for southbound traffic leaving the Midwest Steel facil- ity. (See tables 3 and 4.) Grade-Crossing Oversight The FHWA. The FHWA does not have jurisdiction over private grade crossings. The funds it provides are not available for use at private crossings, including the accident crossing. The FHWA regulates aspects of public grade crossings that affect highway safety. FHWA publications provide guidelines and standards for the correct design of grade crossings, the assessment of safety at grade crossings, and the appropriate placement of traffic control devices at and on the approaches to grade crossings. The FHWA also administers several Federal funding sources available to States for improving grade cross- ings. Title 23 United States Code section 130 designates specific funds for grade-crossing safety. Fifty percent of the section 130 funds must be spent on improving signs and pave- ment markings. Funds for hazard elimination (not specific to grade crossings) are desig- nated in 23 United States Code section 152. According to the FHWA, “hazard elimination funds may also be used for highway-rail grade-crossing safety if the State has identified it on the priority list”18 as a hazardous crossing. There is also an optional category of funds, a portion of which may be used either for grade-crossing improvements or for more gen- eral hazard elimination. In fiscal year 1997, Indiana received $4.96 million in section 130 funds, $3.84 million in hazard elimination funds, and $7.88 million in optional safety funds, for a total of $16.68 million. That year, Indiana obligated $6.21 million of Federal funds for specific grade-crossing projects. 17 Preemption is the transfer of normal operation of traffic signals to a special control mode. It may involve using unique phase combinations, shortening interval times, or extinguishing certain indications and using visibility-limited signal indications. 18 Transcript of 1998 deposition proceedings for FHWA Office of Motor Carriers representative Fred Small, p. 116.

Factual Information 26 Railroad Accident Report The FRA. The FRA defines a private crossing as “a highway-rail crossing which is not a public crossing.” It defines a public crossing as “the location where railroad tracks intersect a roadway which is under the jurisdiction of and maintained by a public authority and open to public travel.”19 The FRA regulates the aspects of grade-crossing safety pertaining to railroads, including track safety, active signals, and train safety and conspicuity. For example, the agency’s regulations specify the type of lighting to be placed on a locomotive (49 CFR 229.125); the audibility of the train horns (49 CFR 229.129); and the inspection, testing, and maintenance standards for grade-crossing signal system safety (49 CFR Part 234). The FRA also conducts research on safety at grade crossings. In addition to grade-crossing oversight, the FRA is responsible for three specific areas of railroad operational oversight, as codified in 49 CFR Parts 217, 219, and 240. Part 217 requires railroads to file operating rules with the FRA and to test their employees on Table 3. Order of events when a westbound Conrail train approaches crossing NICTD CONRAIL INDOT Event/Time Gates Flashing Lights Gates Flashing Lights Highway Traffic Signals Conrail train detected on approach circuit. Flashing lights on the south crossing signal activate. Both north and south crossing signal lights activate. Railroad preempt sequence begins. 3 seconds after activation. South gate begins to descend. Both gates begin to descend. *9 seconds after activation. US 12 traffic signals move to red. Southbound traffic receives green interval. 15 seconds later. Southbound traffic signals move to red. 5 seconds later. East/west US 12 traffic receives green interval; interval stays green until crossing deactivates.

• This is the maximum time required to move the signals to red. Time may be less, depdending on which traffic

phase the lights are in when preemption occurs. 19 Federal Railroad Administration, National Highway-Rail Crossing Inventory Instructions and Procedures Manual (Washington: U.S. Department of Transportation, 1996), pp. 1-7.

Factual Information 27 Railroad Accident Report those rules “to determine the extent of compliance.” Part 219 regulates the circumstances, conditions, and requirements concerning drug and alcohol testing. Part 240 describes the locomotive engineer certification process. (NICTD’s records showed that the engineer involved in this accident had been properly certified.) The FRA has eight geographic regions in which it places its regional field offices, and each of these regions is assigned a grade-crossing safety manager. Portage is in Region 4, which is headquartered in Chicago, Illinois. Before the accident, the FRA Region 4 crossing manager, having received a December 2, 1997, letter from NICTD regarding the potential hazard posed by the use of Michigan Train LCVs at the Midwest Steel crossing, had called for meetings between the railroads using the crossing, Midwest Steel, INDOT, the Port of Indiana, and the FRA. Representatives of these organizations and several other interested agencies met in January 1998. In spring 1998, the parties agreed to retain American Consulting Engineers, Inc., to provide alternative improvement options. American Consulting Engineers, Inc., completed its study on October 7, 1998. The study offered six “grade separation”20 alternatives, all involving the construction of new Table 4. Order of events when a westbound NICTD train approaches crossing NICTD CONRAIL INDOT Event/Time Gates Flashing Lights Gates Flashing Lights Highway Traffic Signals Conrail train detected on approach circuit. Both north and south crossing signal flashing lights activate. North crossing signal lights activate. Railroad preempt sequence begins. 3 seconds after activation. Both gates begin to descend. North gate begins to descend. *9 seconds after activation. US 12 traffic signals move to red. Southbound traffic receives green interval. 15 seconds later. Southbound traffic signals move to red. 5 seconds later. East/west US 12 traffic receives green interval; interval stays green until crossing deactivates.

• This is the maximum time required to move the signals to red. Time may be less, depdending on which traffic

phase the lights are in when preemption occurs.

Factual Information 28 Railroad Accident Report bridges or additions to the Port of Indiana bridge. They ranged in cost between $5 million and $10 million. The firm recommended an option costing $5.1 million, indicating that this proposal was the most economical, had the simplest geometrics, and eliminated inter- mixing with Port of Indiana traffic. In November 1998, National Steel Corporation repre- sentatives presented the study to INDOT, the Indiana Department of Commerce, and the Governor of Indiana. In August 1998, the FRA crossing manager arranged for a safety alert to be posted on the Internet for American Trucking Associations truckdrivers. This safety alert briefly described the Portage accident, provided some grade-crossing accident statistics, and listed “lifesaving tips for the professional driver” concerning locations where roadways cross railroad tracks. State of Indiana. The State of Indiana, through INDOT, is also involved with the safety of grade crossings. INDOT declares its mission to be providing “customers the best transportation system that enhances mobility, stimulates economic growth, and integrates safety, efficiency, and environmental sensitivity.”21 In addition, one of INDOT’s strategic goals is to “create, promote, and maintain a safe transportation system and a safe work environment” through reducing the number and severity of accidents.22 As a part of its effort to fulfill its mission and meet its strategic goal, INDOT maintains an inventory of Indiana’s public grade crossings, assesses the relative risk at each one, and allocates Fed- eral and other funds to improve those it considers most dangerous. However, the State of Indiana does not have jurisdiction over, and does not inventory or upgrade, private crossings. Under the Indiana State Code, INDOT adopted rules for the operation of LCVs on heavy duty highways. The code specifies the routes to be used by the heavy duty vehicles. (See appendix B for selections from the Indiana State Code.) Under Chapter 5, section 4, the Code lists the highways designated as “extra heavy duty highways,” noting that “High- way 12, from one-fourth (1/4) mile west of the Midwest Steel entrance to Highway 249” is such a highway. Chapter 5, section 6 of the Code states that [INDOT] shall implement procedures that, in cooperation with the State police department and local police departments, enhance the safety of citizens along and near extra heavy duty highways listed in section 4 of this chapter. INDOT does not have authority over permitted vehicles once they leave State highways. Private Crossings. In June 1994, the FRA, in conjunction with the FHWA, the National Highway Traffic Safety Administration, and the Federal Transit Administration, 20 Grade separation occurs when a bridge or tunnel is built to vertically separate roadways from railroads at a crossing site. 21 INDOT strategic plan detailed at http://www.state.in.us/dot/sp. Viewed on May 25, 1999. 22 INDOT strategic plan.

Factual Information 29 Railroad Accident Report published a report entitled Rail-Highway Crossing Safety Action Plan Support Proposals. The report describes an action plan, consisting of numerous projects within six initiative areas, intended to reduce the number of grade-crossing accidents and casualties without adversely affecting the economic potential of the rail and highway infrastructures. One of the six initiatives was safety at private crossings; the report concluded that responsibilities and standards for private crossings should be developed and defined. The report also stated The Department proposes to develop and provide national, minimum safety standards for private crossings and to eliminate the potential impediment to high speed rail operations posed by private crossings. In July 1998, the Safety Board published a study on safety at passive grade cross- ings, based on investigations of 60 passive grade-crossing accidents.23 At that time, no action had been taken on the U.S. Department of Transportation’s (DOT’s) proposals con- cerning responsibility at private grade crossings. In this study, the Safety Board made the following safety recommendation to the DOT: H-98-32 Determine within 2 years, in conjunction with the States, governmental oversight responsibility for safety at private highway-rail grade crossings and ensure that traffic control on these crossings meets the standards within the Manual on Uniform Traffic Control Devices. In a letter dated December 23, 1998, the DOT stated In 1993, the FRA circulated ‘Preliminary Guidelines: Safety of Private Highway-Rail crossings.’ Our intent was to work with state and industry officials to develop final guidelines. In the 1994 action plan, the department made a commitment to develop and define responsibilities and minimum safety standards (Guidelines) for private crossings. That commitment still stands; however, severe staff resource limitations in [the] FRA’s safety and legal offices have precluded the aggressive pursuit of this goal. Our review in the 1993/1994 time frame indicated that federal legislation might be necessary in order to resolve some of the issues and controversies. The Department appreciates the increased emphasis this recommendation provides and commits to initiating action on this issue within 2 years, following completion of the statutory mandated whistle ban proceedings. In a letter dated February 8, 1999, the Safety Board stated The Safety Board notes in your response that the DOT remains committed to initiating action on this issue within the next 2 years, following completion of the FRA statutorily mandated whistle ban proceedings. [Safety Recommendation] H-98-32 has been classified ‘Open-Acceptable 23 National Transportation Safety Board, Safety at Passive Grade Crossings, Volume I: Analysis, Safety Study NTSB/SS-98/02 (Washington: National Transportation Safety Board, 1998).

Factual Information 30 Railroad Accident Report Response’ pending completion by the DOT of the minimum safety standards and clarification of governmental oversight responsibility for private grade crossings. The Safety Board also issued parallel Safety Recommendation H-98-35 to the States. It stated: H-98-35 Determine within 2 years, in conjunction with the U.S. Department of Transportation, governmental oversight responsibility for safety at private highway-rail grade crossings and ensure that traffic control on these crossings meets the standards within the Manual on Uniform Traffic Control Devices. To date, nine States (Maryland, New Mexico, North Carolina, Utah, Hawaii, Con- necticut, New York, Nebraska, and Montana) have responded to Safety Recommendation H-98-35. Maryland’s September 9, 1998, response stated that We agree that governmental agencies have an oversight responsibility for safety at private highway-rail grade crossings. Also, the State does periodically evaluate all of the public crossings in Maryland. Many of the passive crossings where a driver would have a problem detecting the approach of a train have already had active devices installed. The few that remain unsignalized are prioritized for improvement and active devices are being installed, as funding becomes available. New Mexico’s September 11, 1998, response stated that The Railroads and Utilities Section of the Department will communicate and work closely with the FRA regarding the need to take action on this issue. Any action taken will be predicated on what Federal law calls for and the level of funding available. New Mexico law does not currently provide for addressing safety issues at private grade crossings; such issues are exclusively dealt with between the railroad and private property owner. North Carolina’s September 11, 1998, response stated that The regulation of private crossings involves government in the private matters of individual property owners. Such regulation runs counter to the current push to make government less intrusive in private matters…. Utah’s September 21, 1998, response stated that “UDOT would be willing to work with USDOT in making such a determination.” Hawaii’s September 25, 1998, response stated that “the Hawaii Department of Transportation will comply with your Safety Recommendations H-98-34 through -37.” Connecticut’s October 5, 1998, response stated that

Factual Information 31 Railroad Accident Report Under the authority of existing State statutes, in March of 1993 DOT implemented a private crossing safety initiative to establish uniform minimum standards for traffic control devices at private rail crossings. Every private crossing in Connecticut that did not have active warning devices was assigned a minimum traffic control device consisting of a private crossing sign or a private crossing sign and a stop sign. Some crossings were also assigned a painted stop bar. Enforcement of the maintenance of the signage has proven to be somewhat difficult due to lack of staff, but enforcement is currently sufficient. New York’s October 20, 1998, response stated that New York State Law affords the Commissioner of Transportation broad jurisdiction over private grade crossings along railroad routes where passenger trains operate. Currently this law applies to all intercity passenger routes. Nebraska’s March 8, 1999, response stated that The Nebraska Department of Roads’ policy on private highway-rail grade crossings conforms in large part to the recommendation of H-98-35. The Nebraska Department of Roads, pursuant to LB 255 adopted in 1997 by the Nebraska Legislature, is in the process of undertaking a safety analysis of all 6,613 at-grade crossings in Nebraska, both public and private. Pursuant to § 4 of LB 255, Nebraska has a measure of jurisdiction over all crossings, regarding the construction, repair, and maintenance of such crossings. Whether the Nebraska Department of Roads has the power to direct the placement of traffic control devices at private crossings or at crossings not part of the State Highway System has not been determined. In any case, a determination of the power of the Department regarding such crossings by a court of law will not be made until the Department has rules and regulations in place and has attempted to force compliance of those rules. Montana’s March 19, 1999, response stated that “State or local authorities should not have any responsibility or oversight for private crossings. Private railroad crossings are an issue to be addressed by the private party and the respective railroad company.” Indiana has not responded to Safety Recommendation H-98-35. The Safety Board is sending a second notification of the recommendation to the State of Indiana. Meteorological Information At 4:50 a.m., on June 18, 1998, the weather station at Gary, Indiana, 9 miles west of Portage, reported the weather as mostly cloudy with 10-mile visibility, a temperature of 71.6° F, and 6-knot winds. The train 102 engineer described the weather at the time of the accident as “dark and a light fog” and said it was not raining.

Factual Information 32 Railroad Accident Report Toxicological Information After the accident, the operating crewmembers of NICTD train 102 submitted urine samples for postaccident drug testing and were given breath tests for the presence of alcohol. FRA regulations did not require that they take such tests. In this accident, excep- tions to toxicological testing at 49 CFR 219.201 (b) applied: Exceptions. No test shall be required in the case of a collision between railroad rolling stock and a motor vehicle or other highway conveyance at a rail/highway grade crossing. No test shall be required in the case of an accident/incident the cause and severity of which are wholly attributable to natural cause (e.g., flood, tornado or other natural disaster) or to vandalism or trespasser(s), as determined on the basis of objective and documented facts by the railroad representative responding to the scene. Breath tests were administered to the conductor and the engineer at 7:51 and 8:35 a.m., respectively. Urine samples were taken from the conductor and the engineer at 8:10 and 8:50 a.m., respectively, at LaPorte Hospital in LaPorte, Indiana. The urine sam- ples were sent to the South Bend Medical Foundation, where they were analyzed. The results for both drug and alcohol testing for the NICTD train 102 crew were negative. When the police arrived at the accident site, they did not observe any indication of impaired behavior on the part of the truckdriver. They requested that the driver submit to blood and urine tests, and he agreed. The Porter Memorial Hospital’s Northern Indiana Occupational Medical Services clinic staff took blood and urine samples from the truck- driver at 7:30 a.m., about 3 hours after the accident. Samples were taken in accordance with the sampling procedures set out in DOT regulations at 49 CFR Part 382. The clinic sent the samples to a contract lab, Quest Diagnostics, Inc., of Wood Dale, Illinois. The lab tested the samples using the DOT testing protocol. Under 49 CFR Part 382, blood is used for alcohol testing, and urine is tested for five families of illicit drugs.24 The truckdriver’s blood test results were negative for ethyl alcohol. The urine test results were positive for cannabinoids (marijuana). The testing specified does not distin- guish between tetrahydrocannabinol (THC), the active substance in marijuana, and tet- rahydrocannabinol carboxylic acid (THC-COOH), an inactive metabolite of marijuana. THC can impair behavior, depending on how much of the marijuana substance was used and how recently it was used. THC-COOH is a product of the metabolism of THC and does not measurably affect behavior. THC-COOH can remain in the body for several weeks or months after marijuana use. About 3 milliliters of the blood sample taken from the driver remained after the lab had completed the alcohol testing. The Safety Board sought a portion of the remaining blood sample for additional testing. Quest Diagnostics agreed to retain the sample pending a subpoena. A subpoena was issued and forwarded to Quest Diagnostics, where it was received on Wednesday, July 15, 1998. The subpoena called for the lab to send the blood 24 Marijuana, cocaine, opiates, phencyclidine, and amphetamines.

Factual Information 33 Railroad Accident Report sample to the Civil Aeromedical Institute (CAMI) Toxicology and Accident Research Laboratory in Oklahoma City, Oklahoma, for further testing. On Friday, July 17, Safety Board, CAMI, and Quest Diagnostics representatives conducted phone discussions about forwarding the sample. Shipment of the sample on that day would have resulted in a Saturday delivery to CAMI. Because CAMI did not have staff working on Saturday, the sample, which was to be shipped in a container with ice and kept cold, could warm over the weekend without care, potentially damaging it. They agreed that the shipment should be delayed until the following Monday, July 20. On July 23, the Quest Diagnostics director of laboratory operations notified the Safety Board that the sample had not been forwarded but had been inadvertently disposed of during the weekend of July 18 and 19. He reported that Quest Diagnostics had tagged the sample to be kept, but it had apparently been stored with other samples for disposal and had been discarded. Efforts to locate the discarded sample were unsuccessful. Survival Aspects NICTD Carbody Structure Train 102 consisted of two self-propelled railcars;25 NICTD car 11 was in the lead at the time of the accident with NICTD car 45 in trail. The self-propelled MU electric pas- senger railway cars that NICTD operates in revenue service are of similar design and were manufactured by Nippon Sharyo Seizo Kaisha Ltd. of Toyokowa, Japan (Nippon Sharyo).26 The body shells were constructed by Nippon Sharyo at its facility in Toyokowa and then shipped to the Cleveland, Ohio, facility of the General Electric Apparatus Ser- vice Division for final assembly. The leading car (car 11) of train 102 was a 1EBU51 model (as designated by Nippon Sharyo’s internal order number), from a lot of 43 cars delivered in 1982 and 1983. Crashworthiness Collision posts fitted to MU passenger railcars are substantially constructed I-beam-shaped structural members, located within the vestibule door frame at the end bulkheads of each car. One collision post is installed on each side of the end bulkhead ves- tibule door frame, for a total of four collision posts per car. They are anchored to the car- body underframe and roof structure. By deforming on impact, they are intended to absorb kinetic energy in a “centerline-to-centerline” type of collision, reducing the tendency of car bodies to telescope (when one carbody intrudes longitudinally into another). This type of intrusion has historically been disastrous to occupants of passenger compartments.27 25 Passenger-carrying railroad cars operated by NICTD, as described in this investigation, are technically defined as “MU locomotives,” pursuant to the definition under the FRA locomotive safety standards in 49 CFR 229.5. 26 Nippon Sharyo Seizo Kaisha Ltd. is now operating under the name Nippon Sharyo Ltd. Also, Sumitomo Corporation of America handled commercial arrangements for the transaction.

Factual Information 34 Railroad Accident Report The construction drawings28 for this car design showed that two collision posts, consisting of modified I-beam members, were fitted to the vestibule door frames at the end bulkheads of each car, as required by 49 CFR 229.141. The construction technical specifi- cation29 for this car design indicated that each collision post was a welded assembly, made from steel plates and welded to the underframe end sill and roof structure. According to 49 CFR 229.141 (a) (4), MU railcar main vertical members (referred to by the industry as “collision posts”) “shall have an ultimate shear value of not less than 300,000 pounds at a point even with the top of the underframe member to which it is attached,” among other technical requirements. Postaccident Inspection Upon their arrival at the accident site, investigators found two catenary support poles to the north side of the NICTD right of way dislodged and destroyed. The point of impact was about the intersection of the westbound NICTD track and the northbound lane of the grade crossing. The front of NICTD car 11 came to rest about 450 feet west of the point of impact. The flatbed truck trailer was distorted into a crescent shape, and the wreck- age had wrapped and wedged around the front of car 11 during the collision. The kingpin of the struck trailer, which had connected it to the leading trailer, was sheared off. The leading flatbed trailer remained attached to the truck tractor at the grade crossing and retained its cargo. The cargo of the struck trailer was a 72-inch-diameter by 41-inch-wide open- center coil of steel that reportedly weighed 38,030 pounds. It had reportedly been chained to the approximate center of the flatbed trailer deck and covered with a tarp. The coil had dislodged from the trailer on impact and penetrated the front bulkhead of NICTD car 11. Investigators found the tarp wrapped around the front end of NICTD car 11. They found the coil inside the forward passenger compartment area of car 11, it having traveled inward almost to the center vestibule area, a distance of about 34 feet. The coil was recov- ered from the car at the grade-crossing site with a heavy-lift crane that operated through a hole cut in the roof above the coil. The NICTD signal controller box adjacent to and immediately west of the crossing on the north side of the track was off its foundation and demolished. The rails and track roadbed between the point of impact and where the equipment came to rest were 27 National Transportation Safety Board, Collision of Illinois Central Gulf Railroad Commuter Trains, Chicago, Illinois, October 30, 1972, Railroad Accident Report NTSB/RAR-73/05 (Washington: National Transportation Safety Board, 1973), and John H. White, Jr., The American Railroad Passenger Car: Vol. 1 (Baltimore: John Hopkins University Press, 1978), p. 148. 28 Nippon Sharyo engineering drawing ref. B0631B13680, originally dated April 23, 1981, revision B, dated December 7, 1981, and related engineering drawings for this carbody series. 29 Specifications of Electric Multiple Unit Commuter Cars for Northern Indiana Commuter Transportation District (Chicago South Shore & South Bend Railroad) Spec. No. SP90034, 1983, [prepared by] Nippon Sharyo Seizo Kaisha, Ltd., Japan.

Factual Information 35 Railroad Accident Report undamaged. An overhead streetlight on the southeast corner of the NICTD tracks was not operational. Safety Board investigators examined the train 102 control positions at the NICTD shop in Michigan City on June 19, 1998. Car 11’s operating controls were positioned in the following manner: the reverser key was in the forward position; the master controller handle was popped up; the brake valve cut-out was in the operating position and locked; and the brake handle was in the extreme right quadrant in the emergency position. Rail Equipment NICTD Car 11. The front bulkhead had sustained major impact damage, resulting in a breach that opened into the front vestibule and passenger compartment and extended from about the floorline to the ceiling and from the extreme left front corner post to the left edge of the right collision post, contained within the front bulkhead. The damage sev- ered the wiring and electrical conduits routed through the front bulkhead. Neither the inte- rior emergency lights nor the public address system in the first car was operable following the accident. A battery back-up arrangement supported these systems, but these circuits were also rendered inoperable by the front bulkhead damage. The front bulkhead panel assembly had been pressed inward in a crushing manner and destroyed. Several structural and sheathing elements, including parts of the left front sheathing panel and the door frame, had been displaced and bowed into a curved shape toward the left sidewall. The ceiling and roof structural elements above the front bulkhead and vestibule were pulled downward and inward. The inner partition wall of the front ves- tibule and the partition slider-door were also pressed inward with the elements com- pressed beneath and among the remains of the front bulkhead panel. The left collision post had fractured into two pieces at a point about 39 inches above its bottom end. The connections at its upper and lower ends were not completely severed, and the top and bottom segments did not fully separate from their anchorage points. (See figure 11 for a diagram showing the collision posts within the car structure.) The front window in the operator’s cab area was fractured, and several wall panels had been slightly displaced and distorted. The forward passenger compartment (behind the front vestibule) revealed scuffing and gouges on the low ceiling area immediately aft of the vestibule slider door. The rows of seats on the left side of the aisle, from the extreme front to the rearmost seat (adjacent to the restroom door), had been crushed and pressed downward in an aft direction. The rows of seats on the right side of the aisle in the forward passenger compartment were intact and did not exhibit impact damage. Two lengths of heavy chain were on the floor, one length of which had a hook-eye attached.30 30 Information on the chain appears in the “Laboratory Tests” section of the report.

Factual Information 36 Railroad Accident Report The floor area adjacent to the restroom, where the steel coil came to rest about 34 feet from the front of the train, had partially collapsed. The coil was oriented with its parallel side faces about parallel to the exterior sidewalls. A pronounced crescent-shaped gouge was found on the exterior aisle wall of the restroom partition, aft of the leading corner of the restroom aisle wall partition, consistent with the coil having traveled to the restroom partition wall before moving back toward the front of the car, a distance of about 56 inches, to the point where it came to rest. Examination of the center vestibule area indicated no damage. Examination of the aft passenger compartment, behind the center vestibule area, indicated that the seats were fully intact and undamaged. Numerous seat cushions were dislodged. With the exception of the breach in the front bulkhead, the exterior of car 11 received little damage. Minor nonstructural impact damage was observed at the right rear step well. Figure 11. View of a typical NICTD Nippon Sharyo railcar, showing “colli- sion post” locations within the car (Source: NICTD Running Maintenance and Troubleshooting Manual, September 1982 edition, as modified by the Safety Board.)

Factual Information 37 Railroad Accident Report NICTD Car 45. Investigators found no internal damage to the trailing car. Exter- nally, it sustained minor penetration of its exterior shell due to electrical arcing from contact with the dislodged (but energized) overhead catenary wire. The pantographs and related electrical equipment on the roof were destroyed. Truck On June 20 and 22, 1998, the Safety Board and the Indiana State police conducted a joint inspection of the LCV. They found the following defects: 1) tire less than 2/32 inch on #8 axle, first semitrailer, 2) exhaust leak in tractor, 3) leaking outer wheel seal on #4 axle, 4) air leak at tractor secondary tank, 5) low air buzzer not functioning in tractor, 6) brake shoe partially missing at left #4 axle, 7) defective hose at main tank in first semi- trailer, 8) combination vehicle overweight (153,115 pounds), and 9) brakes out of adjust- ment on axles #4, 5, 6, 7, and 8. The Indiana State police issued citations for the following out-of-service violations under the Commercial Vehicle Safety Alliance: logbook not kept current, eight brakes out of adjustment, improper load securement, and failure to retain previous 7 days of logbook pages. Postaccident Testing Visibility and Stopping On June 20, 1998, Safety Board investigators conducted visibility and stopping tests with a two-car train similar to NICTD train 102 and a Michigan Train LCV similar to the accident vehicle, except that it was equipped with reflective tape. To approximate accident conditions, all tests were performed between 3:45 and 4:45 a.m. The weather was clear. Test results appear in table 5. (See appendix C for more detailed test results.) Table 5. Visibility and stopping test results Test Action Result Visibility Test 1 Parked tractor-trailer on grade crossing and moved train eastward until tractor was out of sight. Lost sight of tractor- trailer 3,279 feet from grade crossing. Visibility Test 2 Same conditions as in test 1 except railcar interior lights were turned off. Lost sight of tractor- trailer 3,279 feet from grade crossing. Visibility Test 3 With tractor-trailer lights on and side marker lights and reflective tape covered, moved train westward until tractor came into view. Tractor became visi- ble 794 feet from the grade crossing. Visibility Test 4 With tractor-trailer lights on and side marker lights and reflective tape covered, moved train westward until semitrailer came into view. Test conducted at 4:28 a.m. Semitrailer became visible 542 feet from the grade crossing. Stopping Test With train moving westward at 68 mph, emergency braking was applied 542 feet east of grade crossing. Train stopped 1,675 feet from brake appli- cation.

Factual Information 38 Railroad Accident Report Crossing Signal Systems Conrail signal and grade-crossing warning equipment did not sustain any damage in the accident. INDOT reported that its highway signal equipment was not damaged. NICTD signal equipment was damaged by a downed pole line. The catenary line was also affected. The crossing warning equipment case was destroyed. NICTD Grade-Crossing Warning System. NICTD signal equipment was destroyed during the collision and so was not available for testing. The underground cables used to interconnect the NICTD signal case with the Conrail signal case and the highway traffic signal case were identified, and their insulation resistance was tested. Test results showed them to be clear of grounds and short circuits. The monthly record indi- cated that the crossing was in compliance, and the record noted no exceptions. Highway Traffic Signal System. Safety Board staff reviewed the maintenance log for the traffic equipment. It showed that an annual inspection and relamp (replacement of bulbs) was performed on September 16, 1997. On March 2, 1998, the timing and preemp- tion operation was verified. The most recent log entry, for March 19, 1998, listed no equipment exceptions. INDOT personnel stated that, in 1995, INDOT began a program to check the func- tionality of all traffic signals subject to railroad preemption. The Midwest Steel crossing preemption was inspected, and changes were made to the interconnection circuits. Before December 1995, the preemption circuit used a normally open contact to monitor activation of the warning devices. This was changed to a normally closed contact, which provided a “fail-safe”31 circuit. Conrail and NICTD Interconnection. Safety Board investigators tested the inter- connection between the two railroads after the equipment for each crossing had been indi- vidually tested. Investigators measured the delay between activation of the warning devices from one railroad and the appropriate devices from the other railroad. The delay was negligible. Railroad and Highway Interconnection. INDOT provided the Safety Board with timing charts for the Midwest Steel traffic light preemption sequences. Investigators con- ducted tests to verify that the equipment was working as designed. When east and west highway traffic lights on US 12 signaled green, activation of the crossing warning devices from either railroad on either main track caused the east and west traffic lights to move to red in an average of 6 seconds. Southbound traffic lights then displayed a green light (for track clearance) for an average of 14 seconds. After the south- bound traffic lights moved to red, east and west traffic lights displayed a green light. They remained green until the railroad crossing preemption terminated. Left turn arrows for east US 12 traffic remained red while the railroad crossing devices activated. 31 Term used to designate a railway signaling design principle, the object of which is to minimize the hazardous effects of a component or system failure. Under a fail-safe system, if a break or failure occurs, the signal activates to prevent traffic from entering the intersection.

Factual Information 39 Railroad Accident Report When the left turn arrows for east US 12 traffic turning left onto Midwest Steel Road displayed green, activation of the crossing warning devices from either railroad on either main track caused the left turn arrows to move to red in an average of 4 seconds. The southbound traffic lights then displayed a green light (for track clearance) for an aver- age of 13 seconds. East and west US 12 traffic lights also displayed green lights. The lights remained green until the railroad crossing preemption terminated. Left turn arrows remained red while the railroad crossing devices activated. Testing determined the traffic light preemption sequences to be in accordance with the timing charts provided by INDOT. Railroad Signal Event Recorders. Postaccident data were downloaded from the Diagnostic Log at the Conrail Computer Assisted Train Dispatching Facility in Dearborn, Michigan. They indicated the following: Time32 Event 05:16:48 Westbound signal is cleared by Conrail dispatcher for westbound Conrail train 201, track No. 1. 05:29:26 Crossing warning devices are activated for Conrail train 201 at the Midwest Steel crossing. 05:30:22 Crossing warning devices are activated for NICTD train 102 at the Midwest Steel crossing. 05:32:55 Crossing warning devices at the Midwest Steel crossing are deactivated for Conrail train 201. Laboratory Tests The chain that was used to secure the coil of steel to the second semitrailer was sent to the Safety Board Materials Laboratory for analysis. The chain was in two pieces, one of which had a hook-eye attached to the end. It was considerably worn near the hook- eye. Hardness and cross-sectional area measurements were made on the links in the worn and unworn areas. Theoretical calculations of the load-carrying capability of the chain, based on these measurements, indicated that the unworn section would break at a load of about 29,000 pounds. The worn section, which had a much smaller cross-sectional area, would have broken at about 15,000 pounds. The chain had fractured in an unworn region. The left collision post from the front of train car 11 was examined both on site and in the laboratory. Examination revealed that the collision post had fractured in overstress where its reinforcement ended, about 39 inches from the bottom. The collision post had also partially separated from its attachment to the frame structure at the top and bottom. The fracture at the top, where the collision post attached to the ceiling structure, was an overstress separation. The fracture at the bottom, where the collision post was welded to the end sill assembly under the floor of the car, occurred immediately adjacent to a weld. 32 Because the dispatcher was in Michigan, times were provided in eastern daylight time.

Factual Information 40 Railroad Accident Report Investigators learned that NICTD car 11 had not been involved in any collision event prior to the Portage accident that might have compromised the strength of the collision post. Design documentation indicated that the collision post had met FRA design requirement safety standards as specified in 49 CFR 229.141 (a) (4). Investigators found two welds in the collision post attachment that were identified for further examination. The first was the vertical inboard rear weld, which had been spec- ified33 as a fillet weld. The weld was not readily visible due to the presence of a 6.7-inch- long threaded fastener at the joint. The fastener was 5/16-inch in diameter, rusted on the surface, and it did not have a head. It appeared welded and/or wedged in place. (See figure 12.) According to NICTD (Mechanical Department management), this fastener is not a normal component of the collision post. Comments were offered that it could have functioned as a shim or filler material during welding, although a positive determination could not be made.34 The second weld that was further examined was the vertical inboard front weld. This weld was specified35 as a single-bevel groove weld and was required to have 100-percent penetration by the NICTD specification.36 The front of the collision post had separated from the sill at this joint, with nearly all of the weld filler material remaining on the end sill side of the fracture. 33 Nippon Sharyo drawing B0631B13680, revision B, “Arrangement of Collision Post and Corner Post,” dated April 23, 1981. 34 When asked, Nippon Sharyo did not provide an explanation of the purpose of this element. 35 Nippon Sharyo drawing B0631B13680. Figure 12. Arrow indicates threaded fastener at the joint welded and/or wedged in place

Factual Information 41 Railroad Accident Report Six metallographic sections were taken through the end sill side of the joint, such as the one shown in the lower portion of figure 13. Only one of the six sections showed 100-percent penetration, with the amount of penetration varying in the other five sections. All six sections showed areas of lack of fusion between the weld and the collision post material, as evidenced by the joint failing not through the weld or the collision post mate- rial, but at the interface between the two. The incomplete penetration, the lack of fusion, and the presence of the fastener indicated a failure on the part of Nippon Sharyo to employ adequate welding quality assurance when manufacturing the car. The Safety Board contacted Nippon Sharyo to determine whether any documentation existed regarding inspection or testing of the welds in question. Nippon Sharyo responded that neither the NICTD contract, industry practice and standards, nor the quality control and assurance program at the manufacturer’s assem- bly plant required the preparation of written reports confirming weld inspection. No such inspection documentation was prepared or existed. Nippon Sharyo further indicated that its quality control and assurance procedures were approved by NICTD and NICTD’s expert consultant on railroad car design and that Nippon Sharyo used its experience in pre- paring manufacturing drawings in accordance with the production contract specifications. Nippon Sharyo indicated that it used only “certified” welders in the construction of the cars and that its certified welders performed “self-inspections” of each weld. The car manufacturer also indicated that NICTD and its expert consultant had the right and oppor- tunity to inspect the welds to ensure that proper welding procedures and practices were followed and that the welds met specifications. Nippon Sharyo reported that NICTD and its representatives performed such inspections, and that Nippon Sharyo performed its own inspections, each company adhering to its respective quality assurance procedures. Other Information State Truck Size and Weight Regulations The Midwest Steel highway-railroad grade crossing was built in the 1950s, when trucks were typically much shorter in length than those on today’s highways. As the need for larger commercial vehicles grew, manufacturers began to build larger single vehicles, and carriers increased the use of combination vehicles (tractors, semitrailers, and trailers). Traffic regulation is under the jurisdiction of the individual States. Each State has truck size and weight regulations consistent with the design of its local roads. As interstate truck traffic increased, the differences between the various States’ truck size and weight regulations impeded interstate movement of goods. Whenever a truck crossed the State line from a less restrictive to a more restrictive State, the truckdriver would be required to 36 Specification of Electric Multiple Unit Commuter Cars for Northern Indiana Commuter Transportation District, Specification number SP90034, section S3.03(c), which states that “End underframe shall be assembled by arc welding in accordance with S12.10, using 100-percent penetration welds.”

Factual Information 42 Railroad Accident Report reduce his vehicle’s length or be subject to citation or prohibition from travel (or both) in that State. The trucking industry petitioned the U.S. Congress to enact legislation to standard- ize size and weight regulations among the States. In 1982, Congress passed the Surface Transportation Assistance Act. It contains a provision that essentially permits unlimited overall truck lengths on designated routes, which include the National System of Interstate and Defense Highways; on the Federal-aid primary system of highways qualified by the Secretary of Transportation; and on routes designated by local (State) authorities. Thus two sets of vehicle length regulations apply in each State. The State’s own regulations restrict the length of combination commercial vehicles operating on highways other than designated routes, and the Federal law allows combination commercial vehicles Figure 13. Top graphic shows an illustration of a full penetration weld between two pieces of metal; bottom graphic shows a photograph of the weld found at the base of the collision post, where less than full penetration is indicated by the gaps on the left side and at the bottom

Factual Information 43 Railroad Accident Report of unlimited lengths (with minor restrictions) to operate on designated highways. The minor restrictions are (1) The length of the semitrailer in exclusive combination with a truck tractor does not exceed 48 feet. A semitrailer not more than 53 feet in length shall satisfy this requirement when configured with two or more rear axles, the rearmost of which is located 40 feet or less from the kingpin or when configured with a single axle which is located 38 feet or less from the kingpin. For purposes of this paragraph, a motortruck used in combination with a semitrailer, when that combination of vehicles is engaged solely in the transportation of motor vehicles or boats, is considered to be a truck tractor. (2) Neither the length of the semitrailer nor the length of the trailer when simultaneously in combination with a truck tractor exceeds 28 feet, 6 inches.37 The Portage accident vehicle was 82 feet long overall, and the two semitrailers measured 28 feet and 28 feet, 6 inches, respectively. In Michigan, if this vehicle had been operated on nondesignated highways, the maximum permissible overall length of the trac- tor and two semitrailers would have been 59 feet. In Indiana, if this vehicle had been oper- ated on nondesignated routes, the maximum permissible overall length would have been 65 feet. Because this vehicle was operated on designated routes in both Michigan and Indiana, its 82-foot length was lawful under the Federal unlimited vehicle length exemp- tion. The Surface Transportation Assistance Act did not address the issue of truck weight. State legislatures continue to enact weight restrictions consistent with their State’s roadway and bridge designs. The maximum GVW for a commercial vehicle is 80,000 pounds in all but 10 States. Twenty-seven States have some provision for heavier vehicle weight limits when specific combinations of vehicles are used. All States have programs in place under which the State may, via a permit purchased by the carrier, allow specified vehicles using specified routes to carry specified (up to unlimited) weights. Such loads are known as “permit loads.” In Michigan, the maximum vehicle weight is 80,000 pounds when the vehicle is equipped with 5 axles. A vehicle may legally weigh up to 161,000 (plus) pounds when equipped with up to 11 axles. In Indiana, the maximum vehicle weight is normally 80,000 pounds, but a maximum weight of 134,000 pounds is allowed when the vehicle has a permit. Indiana also restricts these permitted loads to specific routes. The accident vehicle had a GVW38 of about 153,115 pounds. The truckdriver did not obtain an overweight permit for the State of Indiana nor would a permit have been issued for a vehicle with a GVW greater than the 134,000-pound limit. According to the 37 California Vehicle Code: Division 15, “Size, Weight, and Load,” and Chapter 4, “Length,” Section 35401.5. 38 The weight was determined by the Indiana State police by weighing the vehicle, minus the rear trailer and load, and then adding the weight of the coil and the unladen weight of the semitrailer.

Factual Information 44 Railroad Accident Report driver’s account of the routes he traveled from Detroit, Michigan, to Burns Harbor, Indiana, he used routes specified for heavier vehicles. The LCV was not inspected at the Indiana-Michigan border. Neither Indiana nor Michigan has a “port-of-entry”39 system for monitoring commercial vehicle traffic enter- ing its State. Enforcement of the size and weight regulations is a function of the State and local law agencies and is conducted at fixed facilities and by mobile enforcement units. Postaccident Actions NICTD. After the accident, NICTD officials met with FRA representatives and instituted a slow-speed restriction at the Midwest Steel crossing. NICTD also reduced its operating speeds for passenger trains to 50 mph on this crossing. Since the Portage acci- dent, NICTD has given two Operation Lifesaver education programs at the Midwest Steel grade crossing, during which NICTD representatives provided truckers with Operation Lifesaver materials about the dangers of highway-rail grade crossings. National Steel Corporation’s Midwest Division. According to Midwest Steel officials, they have instituted a number of changes since the accident. They have • Installed new signs40 that describe the relationship between the two sets of tracks and the safe distance between them. • Conducted communications campaigns involving carriers, vendors, and drivers making deliveries to their plant. • Participated with the FRA in two safety blitzes during which plant personnel spoke to drivers about the crossing and its dangers. • Improved visibility at the crossing, at the recommendation of the FRA, by installing a 75-foot light tower with 12,000 watts of lighting. • Completely repaved the crossing. • Developed procedures to keep trucks from waiting along the highway. • Issued frequent-delivering carriers pre-scale tickets to avoid unnecessary stops at gate 1, roughly 100 feet north of the crossing. • Issued carriers blank pre-scale tickets. • Posted a traffic controller at the crossing. 39 A port-of-entry system requires the establishment of truck inspection terminals on the major highway routes entering a State. Commercial vehicles entering the State are examined for weight, registration, fuel tax, and other documentation necessary to operate in the State. States not having a port of entry system rely on road enforcement or a series of inspection sites in the State for commercial vehicle enforcement, or both. 40 Three signs were posted, in July 1998, in a cluster, providing information as follows: (1) DANGER: Trucks, Do Not Stop On or Between Tracks (white background, black lettering with red around the word “DANGER”), (2) a 30- by 30-inch (approximate) yellow sign with black lettering showing two sets of railroad tracks and arrows indicating the distance between the tracks as 55 feet, and (3) a 30- by 30-inch (approximate) circular sign with a white background showing a truck between the tracks with the truck’s trailer fouling them. The sign has a red circle with a slash, indicating that such positioning is prohibited.

Factual Information 45 Railroad Accident Report Incidents Since the Portage Accident. On July 16, 1998, at 6:34 a.m., the engi- neer of the eastbound Conrail train MAIL8M, traveling at 60 mph on the Conrail No. 2 (inside) track, put the train into emergency braking because he was concerned that a south- bound flatbed trailer was extending onto the No. 2 track. According to the engineer, he could not tell whether the trailer was on the track or simply in close proximity. The engi- neer said that he was about an “engine length” away when the truck moved forward and a collision was avoided. About 3:00 p.m., on August 19, 1998, the engineer of the eastbound Amtrak train 352, the Lake Cities, put the train into emergency braking because he saw a truck on or near the Conrail tracks. On January 21, 1999, an eastbound Conrail train went into emergency braking at 11:02 a.m. because of a truck extending onto the tracks. All three incidents involved tractors with single semitrailers exiting the Midwest Steel plant area during daylight hours. The Safety Board has learned of other incidents since June 18, 1998, at the Midwest Steel crossing involving trucks striking the gates in attempts to avoid oncoming trains. One incident was witnessed by a Conrail police officer, another by an independent truckdriver (who notified the Safety Board), and a third by a Safety Board investigator. Additional gate contact incidents have been reported to NICTD. FRA Safety Standards. On May 12, 1999, the FRA issued comprehensive Fed- eral safety standards for railroad passenger equipment,41 entitled “Passenger Equipment Safety Standards; Final Rule,” to become effective July 12, 1999. Included in the stan- dards are new strength requirements for collision post structures of MU locomotives and cab car equipment, which are cited under 49 CFR 238.211. Strength requirements for col- lision post structures of MU locomotives and cab car equipment were previously cited under 49 CFR 229.141, which applies to the NICTD equipment in this investigation. 41 Federal Register, Vol. 64, No. 91, May 12, 1999, “Rules and Regulations,” pp. 25539-25705.

46 Railroad Accident Report Analysis Exclusions The weather was dry with a light fog at the time of the accident. The weather, including the fog, did not significantly impair visibility or the stopping capabilities of any of the vehicles involved. The NICTD track approaching the accident site is straight and provides an unim- peded view of the Midwest Steel grade crossing. No obstructions were found to impair sight of the crossing for westbound trains. A review of track inspection records and an inspection of the track and its geome- try revealed no anomalies, and the NICTD train 102 engineer took no exception to the track. A review of the maintenance records and inspections both before and after the accident revealed that neither of the two NICTD passenger cars had any mechanical prob- lems. Investigators found that the LCV had numerous mechanical violations that, if they had been discovered during a roadside inspection, would have caused it to have been placed out of service. However, the truckdriver did not indicate that he had any difficulty (mechanical or otherwise) with the operation of his vehicle, and none of the violations appear to have had any effect on this accident. Investigators considered the current railroad operational instructions and rules, the supervision of the operational personnel, the overall operation of the trains, and the perfor- mance of the employees involved with the accident. Regarding these factors, the Safety Board investigators discovered no deficiencies during the NICTD operations investiga- tion. Based on the foregoing information, the Safety Board concludes that neither the weather, the track, the mechanical condition of the train, the mechanical condition of the LCV, nor railroad operations caused or contributed to the collision. The train 102 engineer was experienced in operating the commuter passenger train over the territory and had been observing the appropriate rules and procedures, in accor- dance with NICTD practices, while operating the train. His past efficiency and safety audits showed that he routinely complied with NICTD rules. Similarly, the conductor was experienced and was compliant with NICTD rules. The night before the accident, both the engineer and conductor had less sleep than the amount typically needed to achieve adequate rest, about 8 hours of uninterrupted sleep. People who receive less than adequate sleep are subject to fatigue-impaired perfor-

Analysis 47 Railroad Accident Report mance. Nevertheless, the Safety Board found no performance deficiencies on the part of the crewmembers in their efforts to stop the train, avoid the collision with the tractor- trailer, or respond to the accident. No evidence indicates that either crewmember had been taking prescription or nonprescription medications or illicit drugs that could have affected their performance. No evidence indicates they were under the influence of alcohol. Both men were in good health and had normal vision (or were wearing corrective lenses) and hearing. The Safety Board concludes that the train engineer and conductor were qualified to perform their duties and showed no evidence of impairment from drugs, alcohol, or fatigue. The emergency response personnel arrived at the accident site within about 10 minutes and, despite the problems posed by the size of the steel coil, tried to free the injured person trapped under it. Although he succumbed to his injuries, their efforts were appropriate under the circumstances and involved a number of agencies that might reason- ably have been expected to provide suitable assistance. Therefore, the Safety Board con- cludes that the emergency response was timely and effective. The remainder of the analysis is divided into four main sections. In the first, the Safety Board reviews the accident. In the second section, the Board considers the behavior of the train 102 engineer and the LCV truckdriver. The third section of the analysis consid- ers the major safety issues identified in this investigation: the safety at private grade cross- ings and the design of the Midwest Steel grade crossing. Finally, the Safety Board considers the other safety issues that emerged during this investigation, including the con- spicuity of the LCV semitrailer and the crashworthiness of the NICTD railcars. Accident About 4:31 a.m. on Thursday, June 18, 1998, NICTD train 102 collided with the right side of an LCV at the Midwest Steel grade crossing near Portage, Indiana. At this grade crossing, a private road leads north from US 12, intersects the NICTD and Conrail railroad tracks, and continues to the Midwest Steel facility and other businesses. Shortly before the collision, while the LCV was traversing the NICTD tracks, the approach of the westbound Conrail train 201 had activated the flashing light signals and automatic gates at the Conrail crossing. The truckdriver had stopped the LCV before reaching the Conrail crossing’s south gate with the vehicle’s second semitrailer resting on the westward NICTD track. At this time, NICTD train 102, traveling westbound about 68 mph, was approaching the Midwest Steel grade crossing. About 542 feet east of the crossing, the train 102 crew noticed the LCV’s second semitrailer, which carried a steel coil covered by a black tarp, on the crossing. The engi- neer said that he placed the train in emergency braking; then, followed by the conductor, he exited the control compartment and ran toward the rear of the passenger compartment.

Analysis 48 Railroad Accident Report The crew alerted passengers in that area about the impending collision and told them to evacuate. As the collision occurred, the LCV’s second semitrailer broke away from the first semitrailer and was dragged by the front of the NICTD train; at the same time, the single chain securing the steel coil to the second semitrailer broke. The released steel coil entered the first train car through the front bulkhead. The coil moved through the car until it came to rest about 34 feet into the passenger compartment. Three fatalities and five minor inju- ries resulted. Operator Actions Train 102 Engineer The train 102 engineer estimated that he first saw the tractor when the train was about 6 pole lengths (1,020 feet) from the crossing and then detected the semitrailer and made the brake application when the train was about five pole lengths (850 feet) from the crossing. According to the Board’s accident reconstruction, the engineer could have seen the truck tractor when train 102 was about 794 feet from the crossing, and the semitrailer (blocking the crossing) when the train was about 542 feet from the crossing.42 The train 102 engineer would have needed very little time (about 1 second) to recognize the danger and put the train into emergency braking. Safety Board stopping tests showed that at a speed of 68 mph, train 102 required about 1,675 feet in which to stop. Visibility test results showed that the engineer could not have seen any part of the truck until the train was about 800 feet from the crossing, roughly half the distance necessary to stop the train. Therefore, the Safety Board con- cludes that, if the train 102 engineer had detected the truck as soon as it became visible and immediately put the train into emergency braking, train 102 could still not have been stopped in time to avoid the collision. Truckdriver Actions Preceding the Accident Period. The Safety Board found numerous indications of inadequate performance on the part of the truckdriver before he reached the Midwest Steel grade crossing. Postaccident examination of the vehicle indicated, for example, that the driver had not adequately maintained his logbook and that his vehicle had been overweight for travel in Indiana. The securement of the coil to the trailer, for which the truckdriver was responsible, was also not adequately performed. According to the truckdriver, the 38,030-pound steel coil on the LCV’s second semitrailer was secured by three chains. Two of the three chains kept the coil from moving 42 Although the Safety Board tried to replicate visibility and other conditions during the accident reconstruction, at the time of the accident, the visibility of the LCV would have been additionally diminished by the presence of Conrail train 201, which blocked the artificial light coming from the Midwest Steel and PreCoat Metals facilities from reaching the LCV.

Analysis 49 Railroad Accident Report forward or rearward. Only one 3/8-inch grade 7 chain, which was very worn in areas and had a 6,600-pound WLL, went over top of the coil to secure it to the trailer bed. Federal regulations require that such a steel coil be secured to a semitrailer by a minimum of three 3/8-inch grade 7 tiedown assemblies (chains). The regulations also require that the chains used to keep the coil from moving forward or rearward not be included when calculating the number of chains needed to secure the load. In other words, use of three “over the top” or “through the eye” chains would have been necessary to meet Federal requirements for securing the coil to the trailer bed, and the truckdriver used only one such chain. While the truckdriver did not correctly apply Federal regulations regarding load securement, the impact with train 102 brought tremendous force to bear on the semitrailer and placed enormous stress upon the chain that secured the coil. All available evidence indicates that, given the force of the accident and the weight of the coil that broke loose from the second semitrailer, the coil still would have broken loose from the semitrailer even had it been secured according to Federal regulations. Actions at the Midwest Steel Crossing. When the truckdriver arrived at the Midwest Steel grade crossing, no trains were visible, and no warning devices were active. As he crossed the NICTD tracks, the lights and gates activated for the approaching Conrail train 201. In response to these signals, the truckdriver stopped the LCV about 6 feet before it reached the gate separating it from the Conrail tracks. When he stopped for the Conrail gate, the truckdriver knew that the second semitrailer of his LCV was blocking a portion of the NICTD tracks. The truckdriver had three primary options by which he could have actively addressed the situation. He could have tried to 1) back the LCV completely out of the crossing and onto the highway, 2) turn the LCV so it would fit safely between the NICTD and Conrail tracks, or 3) move the LCV forward and closer to the lowered Conrail gate. All these options had drawbacks. In backing the LCV off the crossing, the truckdriver would have been backing a large, multi-segment vehicle onto a highway, where traffic might be present. Because the vehicle was so long and the space between the tracks was limited, maneuvering it to fit safely between the tracks would have required the truck- driver to first back up the LCV and then to make minute and indeterminate positioning adjustments within a confined space. Moving the 82-foot LCV forward the 6 feet remain- ing between it and the lowered Conrail crossing gate would still have left a portion of the second trailer overhanging the NICTD track. Absent the imminent danger of an approaching train on the NICTD tracks, the driver may have felt no special urgency to take any of these options, all of which were, for different reasons, unsatisfactory. Once the driver saw, however, that the crossing warning devices for the opposite lane of traffic had been activated, he knew that a train was approaching on the NICTD tracks, which was an imminent danger. At this point, the truckdriver should have known that some action on his part was necessary to avoid a colli- sion. Given that the NICTD signal activated some 26 seconds before NICTD train 102 would arrive at the crossing, the driver had less than 26 seconds in which to act.

Analysis 50 Railroad Accident Report After the accident, investigators found that the truck’s wheels had been turned to the left, consistent with the driver’s statement that he had begun to turn the LCV to posi- tion it between the two sets of tracks. Based on the truckdriver’s statement that he had tried to reposition the LCV between the tracks but lacked sufficient room and time, and the position of the LCV’s wheels after the accident, it appears the truckdriver began but did not successfully complete the maneuver before the NICTD train reached the crossing. (Because the truck was not equipped with an event recorder, the Safety Board cannot be sure of the truckdriver’s actions and must rely on physical evidence and testimony.) The Safety Board considers that, although the truckdriver could have taken more effective action earlier to prevent the accident, the prompting of the traffic and rail signals introduced him into a situation in which his vehicle created a grade-crossing hazard. The Safety Board conducted a study, published in 1995, entitled Factors That Affect Fatigue in Heavy Truck Accidents.43 The study identified critical measures that pre- dict fatigue-related accidents. The duration of the most recent sleep period and the amount of sleep in the past 24 hours are the leading critical measures. By examining the driver’s (incomplete) logbook and conducting postaccident interviews, investigators learned the truckdriver slept only about 6 hours in his truck sleeper berth (between 5:00 and 11:00 p.m. on June 17) in his most recent sleep period and that this was the total amount of his sleep for the 27 hours preceding the accident. This quantity of sleep is 2 hours less than the 8 hours the average person needs to function nor- mally. In addition, this driver worked a somewhat irregular schedule; he was awake at the time of the accident (4:30 a.m.) the day before, but slept during that time 2 days earlier. Irregular schedule was another predictor examined in the fatigue study. Consequently, the potential existed for the truckdriver to have been fatigued. As previously stated, however, the Board found that the driver’s actions at the Midwest Steel grade crossing were generally consistent with reasonable driver behavior under the given circumstances. To determine whether drugs and alcohol caused or contributed to this accident, the truckdriver’s postaccident toxicological samples were taken and tested in a timely manner. The results of the blood alcohol test were negative. The results of the urine drug test were positive for the presence of marijuana or marijuana metabolites, raising the possibility that the driver might have been impaired by marijuana. To resolve the issue, the Safety Board sought to conduct further blood tests that would distinguish between THC (the active sub- stance in marijuana) and THC-COOH (the inactive metabolite of marijuana). Unfortu- nately, the testing lab discarded the blood sample before further tests could be conducted. The Safety Board had to consider other evidence to determine whether the truck- driver might have been impaired by drug use at the time of the accident. For instance, in their postaccident observations, the police did not detect any signs of behavior impairment 43 National Transportation Safety Board, Factors that Affect Fatigue in Heavy Truck Accidents, Safety Study NTSB/SS-95/02 (Washington: National Transportation Safety Board, 1995).

Analysis 51 Railroad Accident Report on the part of the truckdriver. Also, as noted above, the truckdriver’s conduct at the cross- ing represented reasonable driver behavior, and his responses were essentially those that would have been expected of an unimpaired driver. Therefore, based on the foregoing evidence concerning the truckdriver’s actions, decision-making, and behavior both before and during the accident, the Safety Board con- cludes that, despite vehicle overloading, logbook discrepancies, inadequate load secure- ment, and the potential for impairment due to fatigue and marijuana use, these factors concerning the truckdriver’s actions did not contribute to the collision. Grade Crossing Crossing Geometry and Storage Area The crossing area of the Midwest Steel compound grade crossing consisted of two sets of double tracks, one set owned by Conrail and one by NICTD, separated by 86 feet and 9 3/4 inches of paved asphalt (from the southernmost Conrail rail to the northernmost NICTD rail). A 58-foot space lay between the southernmost Conrail gate and the northern- most NICTD gate. Thus, the maximum storage area for the grade crossing was about 58 feet. The accident LCV was 82 feet long, 24 feet longer than the 58-foot storage dis- tance. Nevertheless, nothing in law or practice prevented the 82-foot-long LCV from using this crossing. Therefore, the Safety Board concludes that, as currently configured, the Midwest Steel grade-crossing storage area cannot safely accommodate all vehicles that are allowed to use it. Since the Portage accident in late June 1998, several additional incidents and near- misses have taken place at the Midwest Steel grade crossing. The Safety Board under- stands that, even before this accident occurred, the National Steel Corporation, NICTD, INDOT, the Port of Indiana, and the FRA had agreed that the safety issues raised by the crossing should be addressed. The Safety Board has long advocated total grade separation as the best means of ensuring grade-crossing safety.44 Because of the continuing danger posed by this crossing, the Safety Board believes that the FRA, the FHWA, INDOT, the National Steel Corporation, Norfolk Southern Corporation,45 and NICTD should work together to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. Signals Conrail Traffic Control Signal System. Postaccident examination showed that the traffic control signals were displaying the proper signal sequence for Conrail train 44 Safety at Passive Grade Crossings, Volume I: Analysis, Safety Study NTSB/SS-98/02, p. 64. 45 On June 1, 1999, the Conrail operation through this crossing became part of Norfolk Southern Corporation.

Analysis 52 Railroad Accident Report movements on both tracks. Signal inspection records indicated no deficiencies that would have prevented proper operation of the system. NICTD Automatic Block Signal System. Similarly, postaccident signal examina- tion and inspection records did not show any deficiencies that would have prevented proper operation of the automatic block signal system. The train crew said that NICTD train 102 was operating on a clear signal indication and that the visibility of the wayside signals was adequate for proper train handling. Conrail/Midwest Steel Grade-Crossing Warning System. Statements from the LCV truckdriver indicated that the crossing warning devices were clearly visible, which allowed the truckdriver to stop his vehicle when the Conrail train activated the gates and flashing lights. With the Conrail signal correctly lined, the overlay circuit on the west- bound approach would activate the crossing as soon as a train was detected46 on the cir- cuit. In this instance, the interconnection between the Conrail and NICTD systems activated the proper lights and gates for both railroads without observable delay. NICTD/Midwest Steel Grade-Crossing Warning System. Because the signal case was destroyed during the collision, no grade-crossing signal equipment was available for testing. A routine maintenance inspection of the grade-crossing warning equipment performed the day before the accident showed no deficiencies that would have prevented the warning devices from operating properly. The inspection report listed no anomalies in the functionality of the warning devices. Furthermore, the LCV truckdriver said that he saw the NICTD north gate and flashing light units for southbound traffic activate shortly before the accident occurred. The NICTD preemption circuit that sent the signal to the highway traffic controller was functioning properly and, along with the railroad interconnect circuit, would preempt the highway traffic signals whenever either railroad warning device was activated. The LCV truckdriver stated that he saw the Conrail warning system activate and he stopped his vehicle. The Conrail warning system was designed to provide a minimum of 45 seconds warning before an approaching train occupied the crossing. Conrail train 201 was not traveling at the maximum authorized speed so the actual time provided was 56 seconds (according to event recorder data). The LCV truckdriver also stated that while he was stopped, he saw the NICTD north flashing lights and gate activate. The NICTD warning system was designed to provide a minimum of 26 seconds of warning before an approaching train occupied the crossing. NICTD train 102 was traveling close to the maximum authorized speed but went into emergency braking about 542 feet from the crossing. Therefore, it appears that about 82 seconds elapsed between the time the Conrail train entered the circuit and the collision. US 12/Midwest Steel Traffic Signal System. The investigation determined that the preemption circuit between the highway traffic controller and the NICTD signal case was functioning as designed. Activation of the grade-crossing warning system from either 46 The equipment takes 2 to 3 seconds to recognize a shunt on the track circuit.

Analysis 53 Railroad Accident Report railroad would have triggered the highway traffic signals to begin their railroad preemp- tion sequence. The preemption sequence was designed to run through the traffic signal phases to provide southbound traffic with a green interval adequate to clear any vehicles that might be on, or close to, the track in an area exposed to railroad traffic. The preemption was also designed to prevent traffic on US 12 from receiving a green left turn arrow interval after the NICTD south gate and flashing light units were activated and while the traffic signal controller was in the railroad preemption sequence. The traffic preemption sequence was not designed to affect northbound highway traffic coming from the east or west and mov- ing into the Midwest Steel facility. By design, therefore, eastbound US 12 traffic turning left could receive a green turn arrow and start across the railroad tracks but be unable to clear both sets of tracks before being stopped by the activation of the Conrail railroad crossing warning devices. On the basis of the preceding information, the Safety Board concludes that the signal sys- tems operating at the Midwest Steel grade crossing functioned as designed, and no signal operation failures caused or contributed to the accident. Interconnected Signals. Under the current signal configuration, the intercon- nected railroad crossing warning devices “simultaneously preempt”47 the highway traffic signals. Because of this design, the left turn arrow that signaled the LCV truckdriver was green and did not move to red until after the railroad crossing warning devices activated. If the highway traffic signal preemption had been designed to account for both directions of traffic on the Midwest Steel Road, the highway traffic signals would have flushed out any traffic stopped on the crossings exiting the Midwest Steel facility and would not have dis- played a green light for traffic approaching the facility. This design feature would have prevented traffic from beginning to cross the two sets of tracks and then being stopped before safely clearing them. The railroad warning system is currently designed to simultaneously activate the gates and lights of the occupied track and the single set of outside gates and lights for the opposite set of tracks. This activation makes the exit gate and signals for the opposite set of tracks inactive, permitting traffic to exit the storage area. In this accident, when the Conrail train entered the approach circuit, both Conrail gates and the outside NICTD gate (for northbound traffic entering the plant) activated simultaneously. The inside NICTD gate (for southbound traffic exiting the plant) did not activate until the NICTD train entered the east approach circuit. The Safety Board therefore concludes that the Midwest Steel grade-crossing signal system did not prevent vehicles from being trapped in the stor- age area between the NICTD and Conrail tracks. Cognizant that the signal system at the Midwest Steel grade crossing was not keep- ing vehicles from becoming trapped within the storage area, on August 12, 1998, the Safety Board issued four urgent Safety Recommendations (R-98-44 through -47) that 47 Simultaneous preemption occurs when the “notification of an approaching train is forwarded to the highway traffic controller unit or assembly and railroad active warning devices at the same time.”

Analysis 54 Railroad Accident Report asked the FRA, the FHWA, INDOT, and the National Steel Corporation to institute imme- diate measures to ensure safe passage for traffic across the Midwest Steel grade crossing until a more permanent solution could be implemented. The recommendations called for the organizations to work together to Take immediate steps to provide traffic controllers to supervise and coordinate the safe movement of highway and railroad traffic at the Midwest Steel and Wilson Road grade crossings.48 Ensure that the traffic controllers are able to communicate directly with highway and railroad traffic, and keep the controllers assigned to this duty until permanent engineering changes to these grade crossings can be identified and implemented. [Footnote added.] The Safety Board received responses from the FRA, the FHWA, INDOT, and the National Steel Corporation. The responses indicated that a traffic controller has been posted to coordinate the safe movement of traffic through the Midwest Steel grade cross- ing until a more permanent solution, such as grade separation, can be developed. The Safety Board classified Safety Recommendations R-98-44 through -47 “Open—Accept- able Response.” The Safety Board urges the recipients to continue to work to improve safety at the Midwest Steel grade crossing. Grade Crossing Safety Oversight and Jurisdiction. The various entities involved at the Midwest Steel grade crossing were aware that the crossing posed unusual hazards. The relatively high rate of vehicle and train traffic, as well as the number of LCVs using the crossing, were hazard factors noted by NICTD and the other organizations connected with the crossing. Despite their consciousness of the dangers posed by the crossing, they took no effective permanent corrective action to ensure its safety. This lack of action in the face of known safety hazards raises serious concerns about the distribution of responsibilities for ensur- ing safety at a private grade crossing, such as the Midwest Steel grade crossing. The primary difference between public and private grade crossings is roadway ownership, which affects the obligations and indemnification of the parties involved in the crossing activity. At a private crossing, roadway design and maintenance are usually the responsibility of the private entity that owns the roadway. The private entity may enter into a contractual agreement with the railroad(s) regarding the liability for any casualty incurred at the crossing due to any lack of specified maintenance.49 In the case of the Midwest Steel grade crossing, the National Steel Corporation had contractual agreements with NICTD and Conrail specifying the National Steel Corporation’s 48 The Wilson Road grade crossing was closed on December 29, 1998. This crossing is now opened only when the Port of Indiana advises that a cargo vehicle cannot use the Port of Indiana overpass because of size or weight restrictions. At such times, Port of Indiana supervisory personnel direct and control the rail and vehicle traffic. 49 Not all private crossings are covered by contractual agreements. In many cases, the owner of the private roadway is unknown.

Analysis 55 Railroad Accident Report responsibility50 to maintain the crossing signal lights, the gates, and the road surface. This agreement is fiduciary in nature, calling for the National Steel Corporation to furnish the funding for the maintenance of the roadway surface and any crossing signal lights and gates as specified by the respective railroad’s division engineer. Should deficiencies in any of these identified areas cause an accident, the National Steel Corporation would be liable. But the contracts do not state that the National Steel Corporation is responsible for the overall safety of the crossing. Contracts governing private crossings often do not specify responsibility for all factors that could affect crossing safety. Because of the distribution of safety responsibilities for private crossings, some important safety factors are not addressed by any agency. The FRA is responsible for railroad track, train, and signals safety at all grade crossings, whether private or public. The FRA’s jurisdiction applies to rail operations only. The FRA oversees the gates, crossing lights, and track gauges for both public and private crossings, ensuring that they meet Federal standards. On the other hand, the FHWA and INDOT have far fewer responsibilities for private crossings than for public crossings. Because it is a private crossing, neither the FHWA nor INDOT has jurisdiction over the highway component of the Midwest Steel crossing. Consequently, key factors affecting the crossing’s safety, such as what types of vehicles may use the crossing, the appropriate configuration of the storage area, and nec- essary signal timing considerations, are not overseen by any agency. Not only are signifi- cant safety elements not addressed by any private or government entity, but the complex interactions between rail and highway operations are not adequately coordinated. To summarize, no single entity—not the crossing owner, or a railroad, or a Federal or State regulatory agency—was responsible for the safety of the entire Midwest Steel pri- vate grade crossing. (See appendix D for a table detailing the responsibilities of the enti- ties involved in this situation.) Therefore, the safety-related developments that affected the Midwest Steel crossing over time, such as changes in vehicles using the crossing and in train and vehicle traffic levels, were not reviewed by a single entity, and effective steps were not taken to resolve these recognized safety problems. Several organizations involved in the crossing, including Midwest Steel, NICTD, and the FRA, were aware that safety was being compromised at the Midwest Steel crossing, but no entity had or assumed the responsibility to act to solve the problems. Therefore, the Safety Board con- cludes that the lack of clear delineation of oversight responsibility for the safety of the Midwest Steel private grade crossing undermined its safety. The private classification of a crossing can affect still other important factors con- cerning its safety. For instance, funds distributed to the States by the FHWA for making crossing improvements will not, in most States, be available to improve safety at a private crossing. In addition, individual State policy establishes whether existing guidelines and standards for safe crossing design must be applied to both public and private crossings. As 50 Depending on the contractual situation, PreCoat Metals, rather than the National Steel Corporation, could be responsible.

Analysis 56 Railroad Accident Report noted, the State of Indiana does not have jurisdiction over private crossings; hence, INDOT does not have clear authority to require the same level of design safety at both public and private crossings. In Indiana and other States, Federal guidelines for the appropriate design and placement of warning devices at grade crossings, as codified in the Manual on Uniform Traffic Control Devices (MUTCD), are required to be applied at public crossings.51 Because of many States’ (including Indiana) lack of jurisdiction, however, adherence to the MUTCD guidelines cannot be required at private crossings. Consequently, private crossings in Indiana are not required to meet any standards for signage, pavement mark- ings, or other elements of traffic safety and control. Following the 1995 Fox River Grove accident,52 in which a school bus stopped at a grade crossing extended into the path of a train, the Safety Board made the following safety recommendation to the FHWA: H-96-40 Develop guidelines and amend the MUTCD to provide methods to delineate the area (zone) that a train, or its cargo, or both, may occupy on the track or tracks of a railroad grade crossing so motorists have visual reference points that enable them to ascertain whether their vehicle is encroaching on the travel path of the train, or its cargo, or both. In a letter dated March 13, 1997, the FHWA stated The Federal Highway Administration has begun developing delineation and signing guidelines for the recommended zone at railroad grade crossings. The FHWA has worked with the Illinois Department of Transportation (IDOT) in determining a signing and delineation method which will comply with the requirements of the MUTCD. The IDOT will begin using the method in early 1997. The FHWA has assigned a number and title to a[n] IDOT request for a change to the MUTCD for inclusion of the proposed delineation and signing method; Request VIII-43 C— Roadway Rail Pavement Marking and Signing Plan. The FHWA will consider the IDOT method and other submitted methods and will request public comments through the publication of a Notice of Proposed Amendments to the MUTCD regarding recommended guidance which may be included in the MUTCD as discussed in the above safety recommendation. In a letter dated May 21, 1997, the Safety Board stated 51 The MUTCD provides guidelines for sign, signal, and pavement marking design, as well as for appropriate placement. MUTCD guidelines become State law when each State adopts them; all States are required to adopt the MUTCD or a State manual that conforms to the MUTCD. 52 National Transportation Safety Board, Collision of Northeast Illinois Regional Commuter Railroad Corporation (METRA) Train and Transportation Joint Agreement School District 47/155 School Bus at Railroad/Highway Grade Crossing in Fox River Grove, Illinois, on October 25, 1995, Highway/Railroad Accident Report NTSB/HAR-96/02 (Washington: National Transportation Safety Board, 1996).

Analysis 57 Railroad Accident Report The Safety Board understands that the FHWA has begun developing delineation and signing guidelines for such zones at railroad grade crossings. The FHWA has worked and will continue to work with the Illinois Department of Transportation in determining a signing and delineation method that will comply with the design requirements of the MUTCD. Pending amendment of the MUTCD to meet the intent of this recommendation, Safety Recommendation H-96-40 will be classified ‘Open—Acceptable Response.’ Recent contact with the FHWA indicates that a Notice of Proposed Rulemaking will be issued in December 1999 to amend the MUTCD to address this recommendation. Signage of the type specified in Safety Recommendation H-96-40 might have warned the driver of an LCV of the special hazard the Midwest Steel crossing posed. Therefore, the Safety Board concludes that the use of the MUTCD at private as well as public crossings may help ensure that certain hazardous situations at private grade cross- ings receive appropriate attention before an accident occurs. Public Use of Private Crossings. Throughout the United States, roadway owner- ship establishes whether a grade crossing is classified as public or private. The classifica- tion does not take into account the impact each privately owned crossing may have on the safety of the members of the general public who also use it. The Midwest Steel grade crossing involves more public presence than its designa- tion as a private crossing would imply. About 4,300 public highway vehicles and 132 trains traverse the Midwest Steel grade crossing on an average day. Of the 132 trains, about 14 are Amtrak and 26 are NICTD passenger trains, all carrying members of the pub- lic. In addition, during this investigation, the Safety Board found that the Midwest Steel grade-crossing storage area is owned by NICTD (a public agency) and that the collision occurred on publicly owned land. The Midwest Steel crossing is not the only private grade crossing in the United States with significant public involvement. Many private crossings provide access to pub- lic facilities, such as parks or municipal dumps. In addition, many crossings throughout the Nation are traversed by the public riding on passenger trains. The members of the pub- lic using these private crossings are entitled to the same level of safety as is required on public grade crossings. Nevertheless, because of differentiations in how private and public crossings are overseen, funded, and regulated, a lower level of safety may be tolerated on private crossings than on public crossings. The Safety Board concludes that the current method of classifying grade crossings based solely on whether the roadway involved is publicly or privately owned does not provide a uniform level of safety at all grade cross- ings. Therefore, to ensure that public and private crossings are provided a uniform level of safety, the Safety Board believes the DOT should eliminate any differentiations between private and public highway-rail grade crossings with regard to providing funding for, or requiring the implementation of, safety improvements. One Level of Safety. While roadway ownership determines whether a crossing is classified as private or public, the public rightly expects safe transport over all U.S. grade

Analysis 58 Railroad Accident Report crossings, whether private or public. The Safety Board considers that the Nation’s motor- ists and rail passengers are entitled to the same high level of safety at both public and pri- vate grade crossings. This “one-level-of-safety” objective means that public and private crossings throughout the United States should be equally safe for use and should meet the same safety requirements. The Safety Board’s investigation of the Portage grade-crossing accident has shown that some of the differences between public and private grade crossings have a negative effect on the safety of some private grade crossings. Private grade crossings lack coordi- nated safety oversight, funding to make safety improvements, and established safety guidelines and standards. Public grade crossings, however, have all of these benefits. The Safety Board considers that this situation causes disparity between the safety levels required at public and private grade crossings. In effect, public grade crossings are by their public nature provided greater potential to achieve and maintain a higher level of safety than private grade crossings. But many private grade crossings involve the public, either as railroad passengers or highway vehicle occupants. Therefore, the Safety Board concludes that the current disparity in treatment between private and public grade cross- ings can place members of the public traveling on private grade crossings at increased risk. Public safety demands that all grade crossings throughout the United States be required to meet one level of safety. In its 1998 passive grade-crossing safety study, the Safety Board found that a serious impediment to achieving one level of safety at all grade crossings was public agencies’ lack of jurisdiction at private crossings. Accordingly, the Safety Board made the following safety recommendations to the DOT and the States (respectively): H-98-32 and -35 Determine [in conjunction with each other] within 2 years, governmental oversight responsibility for safety at private highway-rail grade crossings and ensure that traffic control on these crossings meets the standards within the MUTCD. 53 The DOT has stated that it intends to act on this issue within the proposed time frame, and the recommendation is in “Open—Acceptable Response” status. The responses from the States, however, have been limited (nine States have responded to date) and not generally favorable. Only three States (Utah, Maryland, and Hawaii) appear to fully accept this recommendation. Indiana has not yet replied to the recommendation. Grade-Crossing Hazard Formula. At public grade crossings in Indiana, INDOT uses a formula developed by the DOT to determine the relative likelihood of accidents occurring at the grade crossing. Those public crossings found to be hazardous under this 53 Safety at Passive Grade Crossings, Volume I: Analysis, Safety Study NTSB/SS-98/02, p. 87.

Analysis 59 Railroad Accident Report formula are listed and addressed, in priority order, as crossings requiring safety improve- ments. INDOT does not use this hazard index formula to evaluate private crossings, so INDOT never applied the formula to the Midwest Steel grade crossing. However, even if INDOT had evaluated private grade crossings, the hazard index formula used would not have included data on the special characteristics that make the Midwest Steel crossing par- ticularly hazardous. The DOT-based index employed by INDOT basically considers the volume of vehicular traffic using the crossing, the number of trains traversing the crossing, the types of warning devices at the crossing, and the number of accidents that have taken place at that location. The formula would not take into account the fact that about 30 percent of the trains traversing the Midwest Steel grade crossing are passenger trains. (Systemwide, NICTD reportedly carries 11,000 to 12,000 commuters each weekday.) Nor would the for- mula consider that, of the 4,300 motor vehicle crossings that take place daily, about 1,800 are made by heavy trucks. Despite the obvious safety problems identified during the Por- tage investigation, under the limited INDOT hazard criteria, the Midwest Steel crossing would not have been classified as a particularly dangerous crossing, largely because it had experienced only one accident in the past 5 years. The Safety Board therefore concludes that an accurate evaluation of the accident risk at the Midwest Steel grade crossing could not be made using the current hazard index formula because the formula does not reflect the presence of passenger trains and the prevalence of tractor-semitrailers using the cross- ing. In its 1998 passive grade crossing safety study, the Safety Board issued the follow- ing safety recommendation to the DOT. H-98-33 Develop a standardized hazard index or a safety prediction formula that will include all variables proven by research or experience to be useful in evaluating highway-rail grade crossings, and require the States to use it. In the same letter of December 23, 1998, in which the DOT responded to Safety Recommendation H-98-32, the DOT failed to respond to Safety Recommendation H-98-33. Therefore, in a letter dated February 8, 1999, the Safety Board stated [Safety Recommendation] H-98-33 asked the DOT to develop a standardized hazard index or a safety prediction formula that will include all variables proven by research or experience to be useful in evaluating highway-rail grade crossings, and require the States to use it. Because no response was provided for [Safety Recommendation] H-98-33, the Board has classified this recommendation ‘Open--Await Response.’ Therefore, to ensure that the hazard formula used to establish the relative danger posed by a grade crossing is as accurate as possible, the Safety Board reiterates Safety Recommendation H-98-33 to the DOT.

Analysis 60 Railroad Accident Report Crossing Closure. The Safety Board has long held that the ultimate level of safety for grade crossings is achieved by grade-crossing elimination through grade separa- tion or closure. The FRA has made reducing the number of crossings throughout the Nation an agency objective. In 1990, the FRA’s grade crossing inventory files recorded 292,839 public and private grade crossings. The FRA’s goal, announced in 1991, is a 25-percent reduction in the number of crossings (about 73,000 crossings) by the year 2001.54 As of May 31, 1999, the FRA recorded an inventory of 259,266 public and private grade crossings, representing a reduction of about 11.5 percent (33,573 crossings) in the number of crossings. In recent years (1994 through 1998), more than 4,000 accidents, on average, have occurred annually at U.S. grade crossings. This means about 11 accidents occur daily on these crossings. In 1998, a total of 431 deaths resulted from grade-crossing accidents, or more than 1 death per day.55 Grade-crossing elimination would improve safety for members of the public trav- eling in both trains and motor vehicles. Although the FRA is working to reduce the num- ber of U.S. grade crossings, the agency’s stated goals are not being met. In fact, 8 years into its 10-year plan, the FRA has achieved less than half of its goal. The Safety Board therefore concludes that had the FRA grade-crossing closure program been more success- ful in eliminating grade crossings, fewer grade-crossing accidents might have occurred. Long Combination Vehicle Conspicuity Two days after the accident, the Safety Board conducted sight and stopping dis- tance testing with a train similar to NICTD train 102 and an LCV Michigan Train similar to the one involved in the accident. Unlike the accident semitrailer, the test semitrailer was marked with retroreflective tape. During the test, retroreflective tape on the test semitrailer was visible to the test engineer at a distance of 3,279 feet. Had the LCV on the tracks on the morning of June 18 been marked with retrore- flective tape like that on the test semitrailer, the engineer of train 102 would quite likely have seen the LCV while the train was still more than 3,000 feet from the crossing. Because the engineer required only about 1,675 feet in which to stop the train, he might have been able to stop the train well before the crossing, thus avoiding the collision. Therefore, the Safety Board concludes that the train 102 engineer might have seen the LCV sooner and been able to stop the train in time to avoid the collision if the semitrailer involved had been equipped with retroreflective tape. The Conspicuity Systems law that became effective December 1, 1993, did not apply to trailers manufactured before that date. However, DOT rulemaking that would 54 Gilbert E. Carmichael, Highway–Rail Grade Crossings: The Unfinished Safety Agenda. In: The Job’s Not Done: Proceedings, 1991 National Conference On Highway–Rail Safety, 1991 July 7–10 (Philadelphia, PA. College Station, TX: TransCo, 1991), pp. 5–9. 55 Safety at Passive Grade Crossings, Volume I: Analysis, Safety Study NTSB/SS-98/02, p. vii.

Analysis 61 Railroad Accident Report require all trailers manufactured before December 1, 1993, to be retrofitted with retrore- flective tape went into effect on June 1, 1999.56 Motor carriers have 2 years to complete the retrofitting. Train Car Crashworthiness Collision Post According to 49 CFR 229.141 (a) (4), a collision post “shall have an ultimate shear value of not less than 300,000 pounds at a point even with the top of the underframe mem- ber to which it is attached.” The kinetic energy released by the impact of the coil upon its collision with the front bulkhead of car 11 was approximately 2.36 million foot pounds. The collision post in car 11 was not designed to absorb the force of an object (such as the coil) weighing 38,030 pounds at the speed at which the collision occurred. There- fore, the Safety Board concludes that the structural elements of the NICTD railcar 11 col- lision post that failed were overwhelmed by the force of the collision, and the post could not have prevented penetration of the steel coil, given the train speed and the weight of the coil. Nevertheless, the Safety Board is concerned about the lack of weld penetration and fusion and the unexplained fastener found in the collision post welds of this railcar. Although intrusion of the coil into the railcar was probably unavoidable in this accident, collision posts should always be installed to ensure optimum strength and effectiveness. The purpose of the collision posts provided within passenger cars is to prevent intrusion into the car body. Passengers and crew depend on the collision posts to provide protection in the event of an accident. The Safety Board therefore finds the existence of defective welds in the area of the collision posts disturbing. Although the weld quality did not affect the outcome of the Portage accident, the presence of defective welds can only serve to weaken the structure of the car. If adjacent welds had demonstrated the same deficiencies as those found by investigators, the strength of the collision post structure could have been significantly compromised. The lack of joint penetration and lack of fusion found on the vertical inboard front weld would have resulted in a weld that was weaker than the 100-percent penetration (and fused) weld that was required. Because of the loading speed and the point of application in this accident, the load path did not go through either the front or rear vertical inboard welds. However, many other possible accident scenarios exist in which the strength of the vertical inboard collision post welds would have been relied upon to prevent intrusion into the car. The Safety Board concludes that, under some circumstances, the full strength of the vertical inboard collision post welds may be necessary to protect passengers and crew. Railroad passenger and transit cars are purchased through contracts that cite detailed technical specifications. The technical specifications typically dictate require- 56 FHWA final rule docket No. MC-94-1 (Federal Register, Vol. 64, No. 61, March 31, 1999, pp. 15587-15606).

Analysis 62 Railroad Accident Report ments intended to ensure the quality and performance of the vehicle, including workman- ship standards. The NICTD specification is clear that “The contractor shall be responsible for the quality of the welding and brazing done by himself and his subcontractors.”57 Nip- pon Sharyo indicated that it performed inspections in addition to those performed by NICTD and its representatives, but the welding defects noted in the vertical inboard colli- sion post welds were apparently not found during these inspections. No records of the Nippon Sharyo weld inspections could be reviewed by the Safety Board, but based on the presence of these weld defects, the Safety Board concludes that Nippon Sharyo did not employ sufficient quality assurance procedures during the welding of the collision post structures. The Safety Board considers that, because of Nippon Sharyo’s insufficient welding quality assurance procedures, deficiencies such as the lack of joint penetration, the lack of fusion, and the unexplained components found in the collision post welds of this car might also be found in other Nippon Sharyo railcars in the NICTD fleet. Therefore, the Safety Board believes that NICTD should inspect the collision post welds of all Nippon Sharyo railcars in its fleet and repair any welds that are deficient. The Safety Board is aware of another fleet of cars, virtually identical in design to the NICTD cars, that was also manufactured by Nippon Sharyo.58 It is not known whether these cars contain weld defects in the collision posts, such as the lack of penetration and fusion noted here, or whether the same weld quality assurance procedures were used in both cases. The Safety Board therefore believes that the FRA should determine the extent of the weld quality assurance inadequacies demonstrated by Nippon Sharyo in its collision post welds, and implement corrective action as necessary to ensure the strength of the col- lision posts. The Safety Board is aware of no Federal requirements for welding quality assur- ance in the attachment of collision posts. The FRA does require, however, that collision posts be constructed to a certain strength specification and that “the attachment of these members at bottom shall be sufficient to develop their full shear value.”59 Because of the vital safety role played by the collision posts, the Safety Board considers that the attach- ment welds should be carefully inspected to ensure that they are of a sufficient quality to fulfill the design requirements of the car. The Safety Board therefore believes that the FRA should require 100-percent nonvisual inspection of all collision post attachment welds made on MU locomotives and passenger cars during manufacture, and require that inspection records be retained for the life of the car. 57 Specification of Electric Multiple Unit Commuter Cars for Northern Indiana Commuter Transportation District, Specification number SP90034, section S12.10(b), dated 1983. 58 National Transportation Safety Board, Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation AMTRAK Train 29 near Silver Spring, Maryland, on February 16, 1996, Railroad Accident Report NTSB/RAR-97/02 (Washington: National Transportation Safety Board, 1997). 59 49 CFR 229.141.

Analysis 63 Railroad Accident Report Emergency Lighting and Public Address Systems Following the collision, the emergency electrical system on the first car of train 102 immediately lost all power because damage to the front end severed the wiring and electrical conduits routed through the front bulkhead of that car. Consequently, neither the interior emergency lights nor the public address system in car 11 was operable. Circuits for the backup battery were also made inoperable by the front bulkhead damage. The failure of emergency electrical systems to provide power can be a serious problem in situations such as collisions and derailments and has been addressed by the Safety Board in other accident investigations.60 In this case, to provide emergency care and extricate victims, the PFD furnished its own portable lighting. Passengers in the lead railcar used illumination from the second car and a flashlight provided by one of the crew- members for their emergency lighting, so the electrical failure did not hinder their evacua- tion. Crewmember statements indicated that, because of the train’s small size, they were able to communicate readily with the passengers despite the nonfunctioning public address system. Therefore, the Safety Board concludes that the failure of car 11’s emer- gency electrical systems did not affect the evacuation and emergency response efforts fol- lowing the Portage accident. 60 National Transportation Safety Board, Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation AMTRAK Train 29 near Silver Spring, Maryland, on February 16, 1996, Railroad Accident Report NTSB/RAR-97/02 (Washington: National Transportation Safety Board, 1997); Amtrak Train 87 Derailment after Colliding with Intermodal Trailer from CSXT Train 176 Selma, North Carolina May 16, 1994, Railroad Accident Report NTSB/RAR-95/02 (Washington: National Transportation Safety Board, 1995); and Derailment of Amtrak Train No. 2 on the CSXT Big Bayou Canot Bridge near Mobile, Alabama, September 22, 1993, Railroad-Marine Accident Report NTSB/RAR- 94/01 (Washington: National Transportation Safety Board, 1994).

64 Railroad Accident Report Conclusions Findings 1. Neither the weather, the track, the mechanical condition of the train, the mechanical condition of the long combination vehicle, nor railroad operations caused or contributed to the collision. 2. The train engineer and conductor were qualified to perform their duties and showed no evidence of impairment from drugs, alcohol, or fatigue. 3. The emergency response was timely and effective. 4. If the train 102 engineer had detected the truck as soon as it became visible and immediately put the train into emergency braking, train 102 could still not have been stopped in time to avoid the collision. 5. Despite vehicle overloading, logbook discrepancies, inadequate load securement, and the potential for impairment due to fatigue and marijuana use, these factors concerning the truckdriver’s actions did not contribute to the collision. 6. As currently configured, the Midwest Steel grade-crossing storage area cannot safely accommodate all vehicles that are allowed to use it. 7. The signal systems operating at the Midwest Steel grade crossing functioned as designed, and no signal operation failures caused or contributed to the accident. 8. The Midwest Steel grade-crossing signal system did not prevent vehicles from being trapped in the storage area between the Northern Indiana Commuter Transportation District and Consolidated Rail Corporation tracks. 9. The lack of clear delineation of oversight responsibility for the safety of the Midwest Steel private grade crossing undermined its safety. 10. The use of the Manual on Uniform Traffic Control Devices at private as well as public grade crossings may help ensure that certain hazardous conditions at private grade crossings receive appropriate attention before an accident occurs. 11. The current method of classifying grade crossings based solely on whether the roadway involved is publicly or privately owned does not provide a uniform level of safety at all grade crossings. 12. The current disparity in treatment between private and public grade crossings can place members of the public traveling on private grade crossings at increased risk.

Conclusions 65 Railroad Accident Report 13. An accurate evaluation of the accident risk at the Midwest Steel grade crossing could not be made using the current hazard index formula because the formula does not reflect the presence of passenger trains and the prevalence of tractor-semitrailers using the crossing. 14. Had the Federal Railroad Administration grade-crossing closure program been more successful in eliminating grade crossings, fewer grade-crossing accidents might have occurred. 15. The train 102 engineer might have seen the long combination vehicle sooner and been able to stop the train in time to avoid the collision if the semitrailer involved had been equipped with retroreflective tape. 16. The structural elements of the Northern Indiana Commuter Transportation District railcar 11 collision post that failed were overwhelmed by the force of the collision, and the post could not have prevented penetration of the steel coil, given the train speed and the weight of the coil. 17. Under some circumstances, the full strength of the vertical inboard collision post welds may be necessary to protect passengers and crew. 18. Nippon Sharyo Ltd. did not employ sufficient quality assurance procedures during the welding of the collision post structures. 19. The failure of car 11’s emergency electrical systems did not affect the evacuation and emergency response efforts following the Portage accident. Probable Cause The National Transportation Safety Board determines that the probable cause of the collision between Northern Indiana Commuter Transportation District train 102 and a long combination vehicle (truck) at the National Steel Corporation’s Midwest Steel grade crossing was ineffective action by Federal, State, and private agencies to permanently resolve safety problems at the Midwest Steel grade crossing, which they knew to be a hazardous crossing.

66 Railroad Accident Report Recommendations As a result of this investigation, the National Transportation Safety Board makes the following safety recommendations: to the U.S. Department of Transportation: Eliminate any differentiations between private and public highway-rail grade crossings with regard to providing funding for, or requiring the implementation of, safety improvements. (I-99-02) to the Federal Railroad Administration: Work together with the Federal Highway Administration, the Indiana Department of Transportation, the National Steel Corporation, the Norfolk Southern Corporation, and the Northern Indiana Commuter Transportation District to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. (R-99-31) Determine the extent of the weld quality assurance inadequacies demonstrated by Nippon Sharyo Ltd. in its collision post welds, and implement corrective action as necessary to ensure the strength of the collision posts. (R-99-32) Require 100-percent nonvisual inspection of all collision post attachment welds made on multiple-unit locomotives and passenger cars during manufacture, and require that inspection records be retained for the life of the car. (R-99-33) to the Federal Highway Administration: Work together with the Federal Railroad Administration, the Indiana Department of Transportation, the National Steel Corporation, the Norfolk Southern Corporation, and the Northern Indiana Commuter Transportation District to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. (H-99-27) to the Indiana Department of Transportation: Work together with the Federal Railroad Administration, the Federal Highway Administration, the National Steel Corporation, the Norfolk

Recommendations 67 Railroad Accident Report Southern Corporation, and the Northern Indiana Commuter Transportation District to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. (H-99-28) to the National Steel Corporation, Midwest Steel Division: Work together with the Federal Railroad Administration, the Federal Highway Administration, the Indiana Department of Transportation, the Norfolk Southern Corporation, and the Northern Indiana Commuter Transportation District to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. (H-99-29) to the Norfolk Southern Corporation: Work together with the Federal Railroad Administration, the Federal Highway Administration, the Indiana Department of Transportation, the National Steel Corporation, and the Northern Indiana Commuter Transportation District to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. (R-99-34) to the Northern Indiana Commuter Transportation District: Work together with the Federal Railroad Administration, the Federal Highway Administration, the Indiana Department of Transportation, the National Steel Corporation, and the Norfolk Southern Corporation to make, within 2 years, permanent engineering changes to the Midwest Steel highway-rail grade crossing that will minimize or eliminate safety hazards at this crossing. (R-99-35) Inspect the collision post welds of all Nippon Sharyo Ltd. railcars in your fleet and repair any welds that are deficient. (R-99-36) Also as a result of its investigation, the National Transportation Safety Board reiterates the following safety recommendation: to the U.S. Department of Transportation: Develop a standardized hazard index or a safety prediction formula that will include all variables proven by research or experience to be useful in evaluating highway-rail grade crossings, and require the States to use it. (H-98-33)

Recommendations 68 Railroad Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member ROBERT T. FRANCIS II Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: July 26, 1999

69 Railroad Accident Report Appendix A Investigation The National Transportation Safety Board was notified about 8:00 a.m., eastern daylight time, on June 18, 1998, that a Northern Indiana Commuter Transportation District (NICTD) commuter train had collided with a tractor-trailer near Portage, Indiana. The investigator-in-charge and other members of the Safety Board investigative team were dispatched from the Washington, D.C., headquarters office and the Los Angeles, California, Denver, Colorado, and Chicago, Illinois, regional offices. The investigative groups studied rail operations, track and signals, mechanical and survival factors, human performance, and highway operations and vehicles. The Federal Railroad Administration, the Federal Highway Administration, NICTD, the United Transportation Union, the National Steel Corporation’s Midwest Division, the Portage Fire Department, the Porter County Sheriff’s Office, the Indiana State Police, and the Indiana Department of Transportation assisted in the Safety Board investigation. Safety Board staff conducted a deposition proceeding as part of its investigation on October 28 and 29, 1998, in Merrillville, Indiana, during which 10 witnesses testified.

70 Railroad Accident Report Appendix B Selections from the Indiana State Code IC 9-20-5, Chapter 5. Heavy Duty Highways and Extra Heavy Duty Highways: IC 9-20-5-1: Sec. 1. (a) The Indiana department of transportation may adopt rules under IC 4-22-2 to do the following: (1) Establish and designate a highway as a heavy duty highway. (2) Remove the designation of a highway or part of a highway as a heavy duty highway. (b) The Indiana department of transportation shall periodically publish a map showing all highways designated by the department at the time as heavy duty highways. As added by P.L. 2-1991, SEC. 8. IC 9-20-5-2: Sec. 2. Whenever the Indiana department of transportation designates a heavy duty highway, the department shall also fix the maximum weights of vehicles that may be transported on the highway. The maximum weights may not exceed the following limitations: (1) A vehicle may not have a maximum wheel weight, unladen or with load, in excess of eight hundred (800) pounds per inch width of tire, measured between the flanges of the rim, or an axle weight in excess of twenty-two thousand four hundred (22,400) pounds. (2) The total weight concentrated on the roadway surface from any tandem axle group may not exceed eighteen thousand (18,000) pounds for each axle of the assembly. (3) The total gross weight, with load, in pounds of a vehicle or combination of vehicles may not exceed eighty thousand (80,000) pounds. As added by P.L. 2-1991, SEC. 8.

Appendix B 71 Railroad Accident Report IC 9-20-5-3: Sec. 3. The Indiana department of transportation may not designate an Indiana highway as a heavy duty highway unless the department finds that the highway is: (1) so constructed and can be so maintained; or (2) in such condition; that the use of the highway as a heavy duty highway will not materially decrease or contribute materially to the decrease of the ordinary useful life of the highway. As added by P.L. 2-1991, SEC. 8. IC 9-20-5-4: Sec. 4. In addition to the highways established and designated as heavy duty highways under section 1 of this chapter, the following highways are designated as extra heavy duty highways: (1) Highway 41, from 129th Street in Hammond to Highway 312. (2) Highway 312, from Highway 41 to Highway 12. (3) Highway 912, from Michigan Avenue in East Chicago to Highway 12. (4) Highway 12, from Highway 912 to Clark Road in Gary. (5) Highway 20, from Clark Road in Gary to Highway 39. (6) Highway 12, from one-fourth (1/4) mile west of the Midwest Steel entrance to Highway 249. (7) Highway 249, from Highway 12 to Highway 20. (8) Highway 12, from one and one-half (1 1/2) miles east of the Bethlehem Steel entrance to Highway 149. Emphasis added. Highway 149, from Highway 12 to a point thirty-six one-hundredths (.36) of a mile south of Highway 20. (10) Highway 39, from Highway 20 to the Michigan state line. (11) Highway 20, from Highway 39 to Highway 2. (12) Highway 2, from Highway 20 to Highway 31. (13) Highway 31, from the Michigan state line to Highway 23. (14) Highway 23, from Highway 31 to Olive Street in South Bend. As added by P.L. 2-1991, SEC. 8. Amended by P.L. 12-1991, SEC. 4; P.L. 123-1993, SEC. 1; P.L. 124-1993, SEC. 1; P.L. 119-1995, SEC. 2.

Appendix B 72 Railroad Accident Report IC 9-20-5-5: Sec. 5. The maximum size and weight limits for vehicles operated with a special weight permit on an extra heavy duty highway are as follows: (1) A vehicle may not have a maximum wheel weight, unladen or with load, in excess of eight hundred (800) pounds per inch width of tire, measured between the flanges of the rim. (2) A single axle weight may not exceed eighteen thousand (18,000) pounds. (3) An axle in an axle combination may not exceed thirteen thousand (13,000) pounds per axle, with the exception of one (1) tandem group that may weigh sixteen thousand (16,000) pounds per axle or a total of thirty-two thousand (32,000) pounds. (4) The total gross weight, with load, of any vehicle or combination of vehicles may not exceed one hundred thirty-four thousand (134,000) pounds. (5) Axle spacings may not be less than three (3) feet, six (6) inches, between each axle in an axle combination. (6) Axle spacings may not be less than eight (8) feet between each axle or axle combination. As added by P.L. 2-1991, SEC. 8. IC 9-20-5-6: Sec. 6. The Indiana department of transportation shall implement procedures that, in cooperation with the state police department and local police departments, enhance the safety of citizens along and near extra heavy duty highways listed in section 4 of this chapter. [Emphasis added.] As added by P.L. 2-1991, SEC. 8. IC 9-20-5-7: Sec. 7. A vehicle or combination of vehicles having a total gross weight in excess of eighty thousand (80,000) pounds but less than one hundred thirty-four thousand (134,000) pounds must obtain a special weight permit to travel on an extra heavy duty highway. As added by P.L. 2-1991, SEC. 8. Amended by P.L. 122-1993, SEC. 2.

Appendix B 73 Railroad Accident Report IC 9-20-5-8: Sec. 8. The Indiana department of transportation may not issue a permit under this chapter for the operation of a vehicle if any of the following conditions apply: (1) The owner or operator of the vehicle has not complied with IC 8-2.1-24. (2) The owner or operator of the vehicle has not provided the Indiana department of transportation with the owner's or operator's Social Security number or federal identification number. (3) The owner or operator of the vehicle has not registered the vehicle with the bureau, if the vehicle is required to be registered under IC 9-18. As added by P.L. 122-1993, SEC. 3. Amended by P.L. 110-1995, SEC. 30.

74 Railroad Accident Report Appendix C Visibility and Stopping Tests Safety Board investigators conducted visibility and stopping tests with a two-car train similar to NICTD train 102 on June 20, 1998. To approximate accident conditions, all tests were performed between 3:45 and 4:45 a.m. The weather was clear. Visibility test 1.—A Michigan Train LCV similar to the accident vehicle, except that it was equipped with reflective tape, was parked with its semitrailer on the NICTD westward track at the crossing. The train, with headlights illuminated, was backed from the crossing until the tractor-trailer could not be seen. It could not be seen beyond 3,279 feet. Visibility test 2.—Same conditions as test 1, but the interior lights on the train were extinguished. This factor made no discernible difference in the tractor-trailer’s visibility. Results were identical to test 1. Visibility test 3.—While the semitrailer’s lights were on and its side marker lights and reflective tape were covered (making the test semitrailer indistinguishable from the accident semitrailer), the train was slowly brought toward the crossing until the white tractor of the LCV could be seen. The tractor could be seen when the train was 794 feet from the crossing. Visibility test 4.—The train was moved further toward the crossing until the semitrailer could be seen. It was discernable 542 feet from the crossing. This test was performed at 4:28 a.m. Stopping distance.—Two torpedoes (explosive caps fastened to the top of the rail and exploded by the pressure of a rolling wheel to give an audible indication of conditions on the track ahead) were placed on the rail 542 feet to the east of the crossing. The semitrailer was removed from the crossing. The train was moved eastward sufficiently to allow it to accelerate to 68 mph. As the test train approached the crossing at 68 mph and reached the spot 542 feet from the crossing, the torpedoes exploded, which gave the test engineer an audible stimulus to place the train into emergency braking, which he did. The train then slowed and stopped. With the train in emergency braking, it passed through the crossing at 43 mph, stopping 1,133 feet beyond the crossing. The total stopping distance was 1,675 feet. Air brake test.—Investigators inspected the braking systems on cars 11 and 45 in the NICTD Michigan City, Indiana, shop on June 19, 1998. Both units were equipped with Sabe/Knise tread brake units. The braking system on each car functioned as intended during application and release, and the electronic monitoring system indicated the proper corresponding condition.

75 Railroad Accident Report Appendix D Highway-Rail Grade-Crossing Obligations ORGANIZATION RESPONSIBILITIES General For Public Crossings For Private Crossings FRA Regulates the aspects of grade-crossing safety pertaining to railroads (track safety, active signals, and train safety and conspicuity). Limited to operations on the railroad rights of way for railroad track, train, and signal safety. No responsibility for highway components. Limited to operations on the railroad rights of way for railroad track, train, and signal safety. No responsibility for highway components. FHWA Regulates the aspects of grade-crossing safety pertaining to highway safety (crossing design, safety assessments, traffic control devices, and funding improvements). Regulates truck size on “designated” highways. Regulates aspects of grade crossings that affect highway safety and funds improvements for public crossings, including MUTCD warning device standards Has no authority to regulate passive crossings on private roads. INDOT Owns U.S. Route 12. Is responsible for maintaining the highway traffic signals that can be preempted and are interconnected with the railroad signals. Regulates truck weight on designated highways and truck size and weight on “nondesignated” highways. Maintains the public roadways and highway signal systems next to private crossings. Maintains an inventory of public crossings, assesses the relative risk at each crossing, and allocates funds for improvements. No jurisdiction. No inventory. No funding for improvements. No authority over private crossings or roads. NICTD Owns, maintains, and inspects the NICTD tracks. Maintains the railroad automatic block signal system and the preemption circuit between the highway traffic controller and the NICTD signal case. Maintains the interconnection between the two railroads. No responsibility for the roadway or crossing. Through contractual agreement, maintains the crossing signal lights and gates for private crossing owner (Midwest Steel). No responsibility for the roadway or crossing. Conrail Owns, maintains, and inspects the Conrail tracks. Conrail dispatchers control all trains on this track via a train control signal system. Maintains the crossing signal lights and gates. Through contractual agreement, maintains the crossing signal lights and gates for private crossing owner (Midwest Steel). No responsibility for the roadway or crossing. National Steel Corporation’s Midwest Steel Division Owns the roadway intersecting the railroad tracks and the storage area. N/A Through contractual agreements with NICTD and Conrail, constructs and maintains the crossing signal lights, gates, and roadway surface.

76 Railroad Accident Report Acronyms and Abbreviations CAMI Civil Aeromedical Institute CDL commercial driver’s license CFR Code of Federal Regulations Conrail Consolidated Rail Corporation DOT U.S. Department of Transportation EMS emergency medical services FHWA Federal Highway Administration FRA Federal Railroad Administration GVW gross vehicle weight IDOT Illinois Department of Transportation INDOT Indiana Department of Transportation LCV long combination vehicle Midwest Steel Midwest Division of the National Steel Corporation MP milepost MU multiple-unit MUTCD Manual on Uniform Traffic Control Devices NICTD Northern Indiana Commuter Transportation District Nippon Sharyo Nippon Sharyo Ltd. PFD Portage Fire Department PPD Portage Police Department THC tetrahydrocannabinol THC-COOH tetrahydrocannabinol carboxylic acid US 12 U.S. Route 12 WLL working load limit

FD07220 ｜ 1999_美国_RAR9904.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：1999 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB99-916304 NTSB/RAR-99/04 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT COLLISION BETWEEN UNION PACIFIC FREIGHT TRAINS MKSNP-01 AND ZSEME-29 NEAR DELIA, KANSAS JULY 2, 1997 6899B

National Transportation Safety Board. 1999. Collision between Union Pacific Freight Trains MKSNP-01 and ZSEME-29 near Delia, Kansas. July 2, 1997. Railroad Accident Report NTSB/RAR-99/04. Washington, DC. Abstract: This report explains the collision of Union Pacific freight trains MKSNP-01 and ZSEME-29 near Delia, Kansas, on July 2, 1997. One crewmember was killed, and 1 crewmember sustained minor injuries as a result of this accident. Damages related to the accident exceeded $5.1 million. From its investigation of this accident, the Safety Board identified safety issues in the following areas: the MKSNP-01 engineer’s performance, the Union Pacific Railroad’s fatigue education program, crew resource management, and positive train separation control systems. Based on its findings, the Safety Board made recommendations to the Federal Railroad Administration, the Union Pacific Railroad, the Brotherhood of Locomotive Engineers, and the United Transportation Union. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB99-916304 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

Railroad Accident Report Collision between Union Pacific Freight Trains MKSNP-01 and ZSEME-29 near Delia, Kansas July 2, 1997 NTSB/RAR-99/04 PB99-916304 National Transportation Safety Board Notation 6899B 490 L’Enfant Plaza, S.W. Adopted: August 31, 1999 Washington, D.C. 20594

this page intentionally left blank

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 Accident Narrative. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 Locomotive UP 3616. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 Locomotive SP 7519 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7 Train NP-01 Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 Train NP-01 Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9 Train ME-29 Engineer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10 Train ME-29 Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10 Train Dispatcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 Train Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 Train NP-01. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 Train ME-29 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 Automatic Cab Signal Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12 Other Industry Safety Features for Trains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12 Postaccident Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Hazardous Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Track and Signal Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14 Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14 Signal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 UP Fatigue Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 Accident Crews’ Testimony . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17 Meteorological Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Fatalities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Toxicological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Survival Factors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 Disaster Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 Train ME-29 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 Train NP-01. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 A-1 Charging Cut-Off Valve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 Event Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22 Past Safety Board Actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Contents iv Railroad Accident Report Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 NP-01 Engineer’s Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24 UP’s Fatigue Education Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27 Crew Resource Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28 Positive Train Separation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29 Other Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 Alerters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 Event Recorder Crashworthiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32 Voice Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39 B: Truck Trailers and Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40 C: Signal Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41 D: Union Pacific’s 1998 Fatigue Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42 Abbreviations and Acronyms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

v Railroad Accident Report Executive Summary About 2:15 a.m., July 2, 1997, westbound Union Pacific (UP) freight train NP-01, operating on a siding track, proceeded past a wayside stop signal at the end of the siding and collided with the side of eastbound UP freight train ME-29, which was operating on a mainline track on the UP railroad near Delia, Kansas. The NP-01 train engineer was killed, and the NP-01 train conductor sustained minor injuries. The National Transportation Safety Board determines that the probable cause of this collision and derailment was the failure of the of the NP-01 engineer to stop at the stop signal, enabled by the failure of UP management to ensure redundant safety systems for train operations and control, including effective crew resource management techniques and technological advances for crew alertness. Contributing to the collision and derailment was the failure of the Federal Railroad Administration (FRA) and the railroad industry to aggressively develop and implement a positive train separation (PTS) control system. The major safety issues discussed in this report are the NP-01 train engineer’s performance, crew resource management, the UP’s fatigue education program, and PTS control system. As a result of its investigation of this accident, the Safety Board makes recommendations to the FRA, the UP, the Brotherhood of Locomotive Engineers, and the United Transportation Union.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis On July 2, 1997, about 2:15 a.m., westbound Union Pacific (UP) freight train MKSNP-01 (NP-01) collided with the side of eastbound UP freight train ZSEME-29 (ME-29) where the Kenefick siding track merges with the main track on the UP railroad near Delia, Kansas, (figure 1). Each train was staffed by an engineer and a conductor. The NP-01 train engineer was killed, and the NP-01 train conductor sustained minor injuries. Accident Narrative Train NP-01, originally consisting of 2 diesel locomotive units and 68 cars, departed UP’s 18th Street Yard in Kansas City, Kansas, at 10:10 p.m. for North Platte, Nebraska.1 About 11:15 p.m., the train stopped at Bonner Springs, Kansas, where the crew added 22 loaded auto-rack cars. At 12:10 a.m., train NP-01 departed Bonner Springs at milepost (MP) 18 and continued westward to Soldier Creek at MP 76 without incident. Figure 1. Collision occurred near Delia, Kansas. 1 The events in this narrative are reconstructed using data from computer-aided dispatching (CAD) records and testimony from UP train crews and dispatchers. All times are central daylight time.

Factual Information 2 Railroad Accident Report Meanwhile, train ME-29, consisting of 5 diesel locomotive units and 38 loaded cars, left Marysville, Kansas, about 12:30 a.m. on July 2, and proceeded eastbound without incident toward the Kenefick siding. Eight cars in the consist were flatcars carrying truck trailers, or TOFCs,2 with containers of hazardous materials. According to the Marysville Subdivision train dispatcher, he routed eastbound train ME-29 to move on the main track because it was a higher priority train than train NP-01. He routed westbound train NP-01 into the Kenefick siding and had a stop signal displayed at the west end of the siding. Before reaching the siding, train NP-01 passed two intermediate signals, which displayed the aspects shown in figure 2. Both trains were equipped with Automatic Cab Signal (ACS) and Automatic Train Stop (ATS). Whenever the lead locomotive passed a more restrictive wayside signal aspect, a signal was displayed, and an audible alarm sounded in the cab, which the engineer was required to acknowledge within 8 seconds. Should the engineer not respond to the alarm, an automatic (penalty) application of the train brakes would occur. Additional information about ACS appears in the Train Information section of this report. Figure 2 also lists the cab indications that would have been displayed in the lead locomotive as it passed the mainline wayside signals after Soldier Creek. As train NP-01 passed the intermediate signals at MP 78.3 and MP 80.7, no penalty application of the train brakes occurred. CAD records indicate that train NP-01 passed the east control point (CP) at the Kenefick siding signal about 2:05 a.m. and was completely in the siding and off the main track about 2:10 a.m. In recounting the events of the accident to Safety Board investigators, the NP-01 conductor testified that he observed the signal at West Menoken (Soldier Creek).3 He initially said the Soldier Creek wayside signal was yellow over yellow; later in the interview, he said that it was a green signal. The NP-01 conductor subsequently stated that on the night of the accident, he was having a “slight stomach problem.” He said that when the train approached the Soldier Creek signal, “I was on my way down to the bathroom,” in the nose of the locomotive. He said that when he entered the lavatory, the speed of the train was “no more than 20 [mph] and probably about 15 [mph].” He remained in the lavatory while the train traversed the entire length of the siding, a distance of about 2½ miles. The conductor said that the NP-01 engineer did not complain of feeling tired or ill and appeared “normal” during the trip. He said that he did not see him doze or go to sleep from the time they went on duty until he (the conductor) went into the lavatory. The conductor stated that he was coming out of the lavatory when he heard what he thought was an “emergency application of the exhaust valve.” He said about 3 to 4 seconds elapsed and then he yelled, “what happened.” He said that the engineer replied, 2 TOFC is an acronym for “trailer on flatcar” intermodal service. 3 The milepost area now known as Soldier Creek was formerly called West Menoken.

Factual Information 3 Railroad Accident Report Signal at CP East Kenefick Intermediate Signal at MP 80.7 Intermediate Signal at MP 78.3 Name Aspect Name Aspect Name Aspects Timetable No. 2 Instructions Timetable No. 2 Instructions Timetable No. 2 Instructions Proceed on diverging route at prescribed speed through turnout prepared to stop before any part of train or engine passes the next signal. Proceed. Speed passing next signal must not exceed 30 mph. Proceed. Speed passing next signal must not exceed 40 mph unless it can be plainly seen that ...the next signal displays Clear, Approach Limited, or Approach Limited Passenger. ACS System ACS System ACS System Cab signal continues to display a yellow aspect. No audible alarm sounds. Cab signal drops from yellow over green to yellow, and audible alarm indicates a more restrictive cab signal. Cab signal in locomotive drops from green to yellow over green, and audible alarm indicates a more restrictive signal. Figure 2. Wayside signals and locomotive cab signals for train NP-01 from Soldier Creek to the entry of the Kenefick siding.

Factual Information 4 Railroad Accident Report “I can’t get it stopped.” The conductor said that about 2 seconds later, when he was about halfway out of the stairwell from the lavatory, he felt the initial impact and the front of the engine collapsed on the engineer’s side. He further stated: When I untangled myself between what was left of the refrigerator and the seat, he [the engineer] was pinned behind the control cabinet….his one foot was caught between the control panel, back wall, and [a] hole in the floor where a truck had either ruptured the floor or whatever… I tried to pick him up two or three times. I was throwing stuff everywhere trying to get him out of there…. In his account of the events preceding the collision, the ME-29 train engineer stated that he was approaching the Kenefick siding at a speed of about 70 mph when he observed a westbound train (NP-01) with its headlight on bright and its ditch lights illuminated about 3 miles away. The engineer stated that he and the ME-29 conductor tried several times to radio the on-coming train’s crew to ask them to dim their lights. He said that they never received a response; however, he was not too concerned because the wayside signal that he was operating under was displaying a green, or clear, indication and the cab signal within his operating compartment unit was also displaying a clear indication. As a precaution, he switched the train’s ditch lights on and off and flashed the high beam of the train’s headlight several times. In accordance with UP operating procedures, when he was about ¾ of a mile from a private road crossing, he began sounded the train’s horn for several seconds. The ME-29 engineer said he was relieved when shortly thereafter the oncoming train’s headlight dimmed and its ditch lights were turned off. He said he continued moving4 and as the lead locomotive of the westbound train (NP-01) was passing on the siding, he looked over into the cab but could not see anyone because of the low cab lighting. He said that the speed of the passing train was “minimal, as though he [the NP-01 engineer] was trying to get stopped or [was] coasting to a stop….” The ME-29 conductor also said that train NP-01 was moving slowly. The ME-29 engineer said that as the westbound train passed, he turned around and observed that it had a red, or stop, signal at the end of the siding. He said that shortly thereafter, his train (ME-29) went into emergency braking. The collision occurred at UP MP 85.5, where the main line and the siding merge. The lead locomotive of train NP-01 struck the sixth freight car of train ME-29, resulting in the derailment of 15 cars from train ME-29 and 2 locomotives and 3 cars from NP-01 (figure 3). A fire erupted on train ME-29, engulfing the derailed cars and locomotives of both trains. 4 Event recorder data indicate that train ME-29 was traveling about 68 mph.

Factual Information 5 Railroad Accident Report After the collision, the engineer on train ME-29 said that he pushed the emergency call button on the locomotive radio several times but did not immediately receive a response from the dispatcher in Omaha, Nebraska. He then used his cellular telephone to report the collision to a local UP supervisor at 2:23 a.m. He said that immediately after he finished his call with the supervisor, the train dispatcher answered his emergency radio call at 2:24 a.m. At 2:41 a.m., the Shawnee County Sheriff’s Department (SCSD) dispatcher received a 911 call from a local resident reporting the derailment, whereupon the SCSD dispatched six units to the accident site. At 2:44 a.m., the SCSD requested fire and emergency medical services go to the accident. At 2:48 a.m., the SCSD received a call about the accident from the UP. The first fire unit arrived on the accident site at 2:51 a.m. When responders initially arrived on scene, they noted that several trailers on the derailed cars were marked as containing hazardous materials. Not knowing whether any hazardous materials were involved in the fire, the responders evacuated about 1,500 people from the immediate area as a precaution. (Additional information about the response effort appears in the Survival Factors section of this report.) Figure 3. Accident site (looking east). Unit facing camera is the lead locomotive of westbound train NP-01.

Factual Information 6 Railroad Accident Report Injuries Table 1 is based on the injury criteria of the International Civil Aviation Organization, which the Safety Board uses in accident reports for all transportation modes. Damages The UP provided the damage estimates shown in table 2. Wreckage The five locomotive units of train ME-29 were not damaged in the accident. The locomotive units of train NP-01 sustained the structural impact damage described below and were ultimately destroyed by fire. Locomotive UP 3616 The control stand was displaced rearward 3 feet (figure 4). The right side wall at sill level showed extensive intrusion damage and was separated from the sill. The upper half of the right rear control compartment door was displaced inward and jammed in the door frame. The left front door was open. All window glazing was broken out of the Table 1. Injuries sustained in Delia, Kansas, accident Injury Type Train MKSNP-01 Train ZSEME-29 Total Fatal 1 0 1 Serious 0 0 0 Minor 1 0 1 None 0 2 2 Total 2 2 4 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.” Table 2. Damages sustained in the Delia, Kansas, accident Locomotives and Cars $ 2,174,714 Lading 2,200,000 Track 641,000 Wreckage Cleanup 125,000 Total $5,140,714

Factual Information 7 Railroad Accident Report window frames in the control compartment. The fuel tank was still attached to the underside of the sill; however, the tank’s front wall was crushed rearward and was distorted, gouged, and holed on its left side and its underside. Locomotive SP 7519 The rear portion of the control compartment was completely torn from the superstructure (figure 5). The fuel tank was still attached to the underside of the sill; however, the tank had sustained extensive longitudinal tearing, had been breached, and was holed and creased. Personnel Information Safety Board investigators reviewed the personnel files and work records of the two train crews and the dispatcher. Records showed that the train crews were qualified on the physical characteristics of the Marysville subdivision, which included the accident area. Marysville subdivision supervisors had conducted a combined total of 226 efficiency tests of the four crewmembers and recorded four failures between July 1996 and June

1. The ME-29 engineer had failed to sound the locomotive horn properly at a crossing

on April 3, 1997. The NP-01 conductor had been cited for three efficiency test failures, including the failure to comply with an operating rule upon entering a main track at a Figure 4. Unit UP 3616, the lead locomotive of train NP-01

Factual Information 8 Railroad Accident Report hand-operated switch on July 15, 1996, the failure to have adequate hearing protection on July 25, 1996; and the failure to inspect a train while in a siding on August 26, 1996. The NP-01 engineer, the ME-29 conductor, and the dispatcher had no efficiency test failures. Train NP-01 Engineer General. The NP-01 engineer was hired by the UP as a switchman (brakeman) on July 6, 1978. He was promoted to conductor on October 13, 1987, and to locomotive engineer on November 26, 1990. UP records indicate that he had most recently passed an operating rules test on February 21, 1996, and that he had been examined and had received a passing score on various aspects of railroad operations, including track warrants, bulletins, air brakes, signals, and mechanical systems. Before being promoted to engineer, he had received 3 weeks student-engineer training. He also had received company training in fuel conservation, winter safety, locomotive daily inspection, hazardous materials, and distributed power. 72-hour History. The NP-01 engineer had been on vacation for 17 days before reporting for duty the evening of July 1, 1997. His wife said that during his vacation, he retired each evening between 9 p.m. and midnight and normally awoke the following morning between 5 a.m. and 7 a.m. She said that he typically would get from 5 to 9 hours of sleep per rest period and that, regardless of what time he had retired the previous Figure 5. Unit SP 7519, the second locomotive of train NP-01

Factual Information 9 Railroad Accident Report evening, he typically did not sleep during daylight. She recalled that he retired between 9:30 p.m. and 10 p.m. on June 30 and awoke the next morning about 8 a.m. He remained awake until he left for work after receiving a 7 p.m. call to report for work at 8:30 p.m. Based on information obtained from his spouse, the NP-01 engineer had been on duty for 5 hours and 45 minutes and had been continuously awake for about 18 hours and 15 minutes at the time of the accident. Medical History UP records indicate that the engineer underwent a company hearing and vision test on November 13, 1995, as part of the UP locomotive engineer recertification program. He successfully passed the hearing portion of the test, but not the vision requirements. His right eye was rated 20/20, and his left eye 20/70. The UP indicated in a November 17, 1995, letter to him that he was required to provide medical documentation certifying that his vision was at least 20/40 in each eye. In December 1995, the engineer had eye surgery at Medical-Surgical Eye Care in Kansas City, Kansas. UP records contain a December 29, 1995, letter from Medical-Surgical Eye Care stating that the engineer’s vision rating in his left eye was correctable to 20/20. Records show that the UP physically qualified him for duty as a locomotive engineer on January 2, 1996. Train NP-01 Conductor General. The conductor was hired by the UP as a switchman (brakeman) on May 11, 1970. On May 20, 1974, he was promoted to conductor. UP records indicate that the conductor most recently passed the operating rules test for his position on October 19, 1995, and that he had received operational training in fire extinguisher use and forms management and awareness training about drugs, hazardous materials, and “mental vacations,” that is, how lapses in attention to duties can result in rail accidents. 72-hour History. The NP-01 conductor stated that on Sunday, June 29, he went to bed about 9 a.m. and slept until about 3 p.m. He said that he was off the following 2 days and that during those days, he retired each evening between 10 p.m. and 10:30 p.m. and awoke the following mornings between 5 a.m. and 6 a.m. He said that on the afternoon of Tuesday, July 1, he received a call informing him that he would be working that evening. He stated that he napped from about 2:30 p.m. or 3 p.m. until 4:30 p.m. or 5 p.m. After waking up, he went on duty at 8:30 p.m. At the time of the accident, he had been awake between 9 and 10 hours and had been on duty about 5 hours and 45 minutes. Medical History. UP records show that the NP-01 conductor most recently underwent a physical examination on January 26, 1993. On the accompanying medical form to the examination, he indicated that he took medication for high blood pressure and diabetes. The medical examiner determined that he was medically qualified to perform his duties as a conductor. The conductor advised Safety Board investigators that he had discovered that he had Type II diabetes (non-insulin-dependent diabetes) in 1988 and that the UP had been aware that he had the disease since that time. He said that he had his blood sugar level checked every 30 days by his physician. He said that to control the diabetes, he took two medications, 10 milligrams of Glucotrol5 once a day in the morning and 5 milligrams of

Factual Information 10 Railroad Accident Report Glucophage6 twice a day (morning and evening). He said that he also discovered he had hypertension in 1988 and that he took 10 milligrams of Monibril7 each day to control this disease. The conductor indicated that he had never experienced any adverse effects from taking the medications, that both the diabetes and hypertension were under control, and that neither condition had caused him any problems in his work as a conductor. Train ME-29 Engineer General. The engineer was hired by the UP as a switchman (brakeman) on July 10, 1984. He was promoted to engineer on July 29, 1988. UP records indicate that the engineer most recently had passed the operating rules test for his position on March 10, 1997, and that he had received operational or awareness training in hazardous materials, mental vacations, distributed power, fuel conservation, employee assistance–peer support, and incident reports. 72-hour History. The engineer was called to work at 12:50 a.m. on Sunday, June

1. His train departed at 3:40 a.m., and he went off duty at 11:20 a.m. He said that he slept

from about 2:00 p.m. until about 7:00 p.m. He said that he was called for duty at 7:20 p.m. and departed on his train at 9:30 p.m. He completed the trip at 6 a.m. the following morning, Monday, June 30, and went off duty at 6:50 a.m. He said that he was off duty for 16 hours and 5 minutes, during which he slept 8 hours. He was called for duty at 11 p.m. on June 30 and departed on his train at 1 a.m. on July 1. He arrived at his destination at 10:30 a.m. and went off duty at 11:15 a.m. He was off duty for 12 hours and 30 minutes, of which he slept 8 hours. At 11:45 p.m. on July 1, he was called to report to duty. His train departed about 12:30 a.m. on Wednesday, July 2. At the time of the accident, he had been on duty for about 2 hours and 30 minutes. Train ME-29 Conductor General. The ME-29 conductor was hired by the UP as a switchman (brakeman) on September 1, 1975. He was promoted to yardmaster on July 1, 1984, and to his present position, conductor, on May 1, 1992. The UP records show that he had most recently passed the operating rules test for his position on January 10, 1996, and that he had received training in drug awareness and hostling8 qualifications for switchmen. He testified that he had attended 2 weeks of switchman training when he was hired by the railroad. 72-hour History. On Sunday, June 29, the ME-29 conductor arose at 8:30 a.m. and remained awake until he went to bed at 6:30 p.m. He rested and slept until about 10:30 p.m. He traveled to an away terminal in Topeka, Kansas, where he went on duty at 11:59 p.m. The following morning, Monday, June 30, he went off duty at Topeka at 7:59 a.m. He 5 An oral blood-glucose-lowering drug. 6 An oral antihyperglycemic drug used to manage non-insulin-dependent diabetes mellitus. 7 The investigation disclosed that the conductor was referring to Monopril, an antihypertensive angiotensin-converting enzyme inhibitor used to treat high blood pressure and congestive heart failure. 8 The act of moving a locomotive around between runs, typically within the rail yard.

Factual Information 11 Railroad Accident Report then drove to his home in Kansas City, Missouri, where he slept from 9:30 a.m. until 2:30 p.m. After he awoke, he went shopping and then had dinner with his family. He returned to Topeka at 7:00 p.m. and retired at 8:30 p.m. He awoke at 10 p.m. and worked from 11:00 p.m. until 11:15 a.m. on July 1. He slept from 11:30 a.m. until 5:00 p.m. After he awoke, he ate and conversed with railroad personnel in the dormitory until 7 p.m. He slept from 7:00 p.m. until about 10:15 p.m. He reported for duty at 11:45 p.m. and worked until the accident. At the time of the accident, the ME-29 conductor had been awake for about 4 hours and on duty for 2 hours and 30 minutes. Train Dispatcher The train dispatcher was hired as a clerk in 1985 by the Missouri-Kansas Texas Railroad Company, which later merged with the UP. In 1989, he began dispatching. He had last attended a rules class in 1997. He had been off duty for more than 15 hours before reporting for duty at 11:00 p.m. on July 1. Train Information Train NP-01 Train NP-01, comprising 68 cars and two locomotives (UP 3616 and SP 7519), was made ready at 7:50 p.m. on July 1, 1997, at UP’s 18th Street Yard in Kansas City. Mechanical personnel conducted a yard plant air test, and the train crew checked the two- way end-of-train device before the train departed Kansas City at 10:10 p.m. The train stopped at Bonner Springs, Kansas, where the crew added a block of 22 loaded auto-rack cars behind the locomotives. The NP-01 conductor said that after the additional cars were coupled together and their air brake hoses connected, he inspected the newly added cars and performed an air brake set and release test. The train then consisted of two diesel-electric locomotives pulling 39 loaded and 51 empty cars. Its trailing tonnage was 5,347, and it was 6,445 feet long. Train ME-29 Train ME-29 originated in Seattle, Washington, on June 29, 1997, and was destined for Memphis, Tennessee. The train traveled through Oregon, Idaho, Wyoming, and Nebraska before entering Kansas. It had received a Federal Railroad Administration (FRA) 1,000-mile inspection at Pocatello, Idaho, and at North Platte, Nebraska. Marysville was its last crew change point before the accident. Train ME-29 departed Marysville at 12:30 a.m. on July 2, 1997, and proceeded without incident to the Kenefick siding, about 60 miles away. At the time of the accident, train ME-29 consisted of 5 locomotive units (UP 6129, UP 9241, SP 8599, UP 3696, and UP 6010) and 38 loaded cars. Its trailing tonnage was 3,925 and it was 6,034 feet long. Most of the cars were articulated deep-well container-on- flat-cars (COFCs) or spine TOFCs with three to five platforms. The train also had 89-foot- long flat cars carrying one or two trailers or containers or both.

Factual Information 12 Railroad Accident Report Automatic Cab Signal Systems As mentioned earlier, both trains were equipped with ACS, an electronic display system that works in concert with the ATS. On UP trains, the ACS signal display typically is mounted above the control panel between the forward cab windows of the locomotive so that the signal is clearly visible by all crewmembers in the operating cab. The ACS illuminates one of four signals (figure 6), which change only when the locomotive passes a wayside signal indicating a different level of restriction. Whenever the wayside signal has a less restrictive indication, only the ACS light display changes. Whenever the wayside signal has a more restrictive indication, the ACS light display changes and the device activates an alarm. The alarm continues to sound until the engineer pushes a spring-action lever that, on UP trains, is on the front right of the control stand. If the locomotive engineer fails to acknowledge the ACS alarm within 8 seconds, a full service penalty brake application of the train airbrake system results. Other Industry Safety Features for Trains Neither of the accident trains was equipped with automatic speed control, which triggers a penalty brake application to reduce train speed when the train operator passes a wayside signal faster than the allowable speed indicated by the aspect. The locomotive cabs of train NP-01 and train ME-29 were not equipped with an alerter, an electronic device that monitors the movement of the engineer. A lack of a significant movement, such as touching a certain metal object or making a control manipulation, within a specified time results in the alerter generating an audio alarm, a visual alarm, or both, which, if not acknowledged by the engineer, result in the locomotive being brought to a gradual, controlled stop. In most cases, the alerter time interval varies with the speed of the locomotive; the faster a train’s speed, the shorter the time interval during which the engineer must move. The top light displays a green cab signal aspect indicating a clear signal. The second light displays a yellow-over-green cab signal aspect indicating an approach limited signal. The third light displays a yellow cab signal aspect indicating an approach signal. The bottom light displays a red- over-yellow aspect indicating a restricting signal. Note: Only one light is illuminated at a time. Figure 6. Order and indication of the automatic cab signal system lights

Factual Information 13 Railroad Accident Report Postaccident Examinations Teams comprising representatives from the Safety Board, the FRA, and the UP performed equipment inspections and air brake tests on the undamaged vehicles. Investigators inspected and measured all undamaged cars for brake shoe wear and piston travel; they determined that no brake shoes were condemnable and that the type and number of minor defects were acceptable under FRA standards. Investigators conducted an initial terminal air brake test in accordance with 49 CFR 232.12 on all cars and noted no deficiencies. All wheels and running gear were serviceable. Locomotive electricians removed the ATS and ACS equipment from the NP-01 lead locomotive (UP 3616) for testing at UP’s mechanical facility in Sedalia, Missouri. The tests, which were monitored by Safety Board investigators, indicated that the systems operated as designed. Hazardous Materials One of the trailers (RDWZ 221251) involved in the fire carried packages containing 18 spent generators that produced a radioisotope used in nuclear diagnostic medicine.9 Mallinckrodt Medical/Airport Drayage Company of Seattle, Washington, had contracted Roadway Express, Inc., to transport the spent generators to Mallinckrodt’s Maryland Heights, Missouri, plant for recycling. Roadway, in turn, had contracted UP to transport the trailer (as a TOFC) from Portland. Eight packaged generators were shipped as a Radioactive Yellow II material, and 10 packaged generators were shipped as a Radioactive White I material.10 Tests at the accident site showed that the combined radioactive exposure was well below the exposure level for public concern.11 Radiation surveys of the burned rail cars showed that the floor of one car had low radiation levels which, tests showed, were indistinguishable from local background levels.12 (For a list of the hazardous-materials- carrying truck trailers that were involved in the derailment and a detailed description of their contents and the contents’ status, see appendix B.) 9 Each generator contained a column of molybdenum 99 (Mo99) chemically bonded to an inert material shielded with lead. The radioisotope, Tc99m, is a byproduct of Mo99 decay. Hospital staff collect the Tc99m by removing it from the Mo99 column with a saline solution. 10 Three shipping categories are used in transporting hazardous materials; Radioactive White I is the lowest, and Radioactive Yellow III is the highest. The shipping categories are based on the surface radiation level of the package and the transport index, or TI number, which is placed on the package label by the shipper to designate the degree of control to be exercised by the carrier during transportation. 11 Based on Kansas Department of Health and Environment standards. 12 Local background levels ranged from 30 to 50 microroentgens per hour.

Factual Information 14 Railroad Accident Report Track and Signal Information Track The Marysville Subdivision of the Kansas City Service Unit at MP 85.47 near Kenefick had two track structures, a main track and a siding track, which were owned, inspected, and maintained by the UP. The main track had a maximum allowable operating speed of 70 mph, designating it as FRA-class-5 track. The siding track had a maximum allowable operating speed of 30 mph, designating it as FRA-class-3 track. In 1996, traffic density averaged 60 to 75 trains per day, for a total of 155.1 million gross tons. The two tracks were parallel and spaced at 15.67 foot track centers. The siding track was 12,729 feet long between clearance points. The distance between the eastbound and the westbound switch points on the siding track was 13,495 feet. The tracks were oriented geographically in a northwesterly to southeasterly direction and by timetable in a west and east direction. The MP numbering decreased in an eastward timetable direction. The track gradient beginning at a point about 1.76 miles east of the siding was as follows for westward movement: between MP 81.2 and MP 81.6, level grade; between MP 81.6 and MP 84.4, a 0.6-percent ascending grade; between MP 84.4 and MP 85.3, level grade; and between MP 85.3 and MP 86.3, a 0.6-percent descending grade. Two curves were located between MP 81.0 and MP 87.0. For a westward movement, a 1-degree, 59.8 minute-left-hand curve was between MP 81.3 and MP 81.55, and a 1-degree, 33.3-minute right-hand curve was between MP 83.9 and MP 84.2. The switch near the area of the collision was a dual-controlled, power-operated machine that could be operated by hand at the site or remotely by a UP dispatcher at the Harriman Dispatching Center in Omaha. Safety Board investigators visually inspected the main and siding track structure and found no anomalous conditions other than the damage caused by the collision and subsequent derailment. Investigators also reviewed the UP track and switch inspection records for May 1, 1997, to July 1, 1997, and found that company maintenance crews had inspected both the main track and the siding track more frequently than required by the UP and that they had immediately taken proper corrective action when track defects were noted. The most recent inspection of the switches at the siding was on June 29, 1997. No deviations were listed on the inspection report. Signal A Traffic Control System (TCS) wayside signal system was in effect from East Topeka to Gibbon Junction on the Marysville Subdivision. The TCS signal system had an ATS overlay supplemented with an ACS system between MP 72.9 at Soldier Creek and MP 147.8 at East Marysville, a distance of 74.9 miles, and between MP 150.5 at West Marysville and MP 287.8 at Gibbon Junction, a distance of 137.3 miles. The siding at Kenefick between MP 82.9 and MP 85.5 was controlled by these signal systems.

Factual Information 15 Railroad Accident Report The wayside signals were Union Switch and Signal H-2 search-light models with M-23 power-operated, dual-controlled model switch machines and DC noncoded track and line circuits. The DC track circuits had superimposed AC coded circuits for operating ACS-ATS systems onboard locomotive units so equipped. After the accident, UP signal department personnel arrived at the Kenefick siding and had secured the signal cabin at the east end by 4:30 a.m.; they had secured the signal cabin at the west end of the siding and the approach signal at MP 87.2 by 7:30 a.m. These tasks were completed in accordance with Rule 3.1.2 of the UP’s Signal Tests and Standards emergency procedures. UP signal personnel conducted postaccident testing of the signal system, which was monitored by Safety Board investigators, to determine whether the wayside signals and switches were functioning properly and relaying correct operating information to train crews. The protocol conformed to examination procedures contained in 49 CFR and in the UP Signal Maintenance, Inspection Test, and Standard Instructions manual and included the tests for the following: switch obstruction, point detector, shunt fouling, indication locking, time and route locking, grounding, and searchlight mechanism operation. Tests of the wayside signal system and its associated circuitry indicated that the system operated as designed. The UP’s signal department also provided records of past UP signal tests, which indicate no exceptions noted for the wayside signals in the accident area. (Appendix C shows the sequence of signal events on the day of the accident.) Operations Information General Train movement over this territory is governed by the General Code of Operating Rules (GCOR), third edition, effective April 10, 1994. Excerpts from the GCOR related to the general duties of engineers and conductors are shown in figure 7. At the time of the accident, UP timetable No. 2, dated October 29, 1995, was in effect. The TCS is under the direction of the Marysville Subdivision train dispatcher at the Harriman Dispatching Center. GCOR Rule 5.16, “Observe and Call Signals,” stipulates that crewmembers in the engine control compartment must announce to each other the signals as they become visible or audible and announce any aspect change until the train passes the signal. Rule 5.16 further states: If the signal is not complied with promptly, other crewmembers must remind the engineer and/or conductor of the rule requirement. If the crewmembers receive no response or if the engineer is unable to respond, they must immediately take action to ensure safety, using the emergency brake valve to stop the train, if necessary.

Factual Information 16 Railroad Accident Report The UP operating rules do not require the engineer to call signals over the radio when he is alone in the locomotive cab. UP Fatigue Program 1990 Mailing According to the UP General Director for Safety, the carrier contracted SynchroTech of Lincoln, Nebraska, to conduct a study of UP employees and managers in all operating crafts to obtain input about work schedules, rest, lifestyles, diet, exercise, and alertness. SynchroTech prepared The Railroader’s Handbook: A Personal Health & Lifestyle Guide for Professional Railroaders (hereafter referred to as the handbook), and a video on fatigue- related subjects. In September 1990, the UP mailed an explanatory letter along with the handbook and video to the homes of UP’s 14,000 train and engine service employees and 3,000 mechanical service employees. The carrier also sent the material to the Safety Board, the Association of American Railroads (AAR), and several other railroad companies. After the initial employee mailing in 1990, the UP sent the fatigue video to all company divisions for inclusion in their libraries. Individuals hired after September 1990 were to be given the fatigue handbook at the same time they were given a UP rulebook and were encouraged to view the video in the library. According to UP officials, the company did not document which employees received a copy of the video and handbook in September 1990. Likewise, it did not have a process for determining or documenting whether employees hired after 1990 actually read the handbook or viewed the video. Program Expansion. Following the Synchrotech project, the UP began a number of initiatives to improve its fatigue program. In 1992, the UP hired a contractor to expand the carrier’s fatigue educational effort. The contractor assisted with the design and Rule 1.47 Duties of Trainmen and Enginemen The conductor and the engineer are responsible for the safety and protection of their train and observance of the rules. If any conditions are not covered by the rules, they must take every precaution for protection. Conductor Responsibilities The conductor supervises the operation and administration of the train….All persons employed on the train must obey the conductor’s instructions, unless the instructions endanger the train’s safety or violate the rules. If any doubts arise concerning the authority for proceeding or safety, the conductor must consult with the engineer who will be equally responsible for the safety and proper handling of the train. The conductor must advise the engineer and train dispatcher of any restriction placed on equipment being handled. Freight conductors are responsible for the freight carried by their train. They are also responsible for ensuring that the freight is delivered with any accompanying documents to its destination or terminals. Freight conductors must maintain required records. Engineer Responsibilities The engineer is responsible for safely and efficiently operating the engine. Crew members must obey the engineer’s instructions that concern operating the engine. A student engineer or other qualified employee may operate the engine under close supervision of the engineer. Any employee that operates an engine must have a current certificate in his possession. The engineer must check with the conductor to determine if any cars or units in the train require special handling. Figure 7. Excerpts from the GCOR

Factual Information 17 Railroad Accident Report implementation of the 1994 Sleepwell Pilot, which demonstrated that fatigue could be positively affected through behavioral change model. Postaccident Actions. In July 1997, the UP established a Senior Level Team (SLT), led by the Executive Vice President of Operations, which meets at least once monthly to define the details and work plan of the company’s fatigue program. After a representative from the UP’s Health Services Department and the SLT attended a fatigue training module developed by the National Aeronautics and Space Administration’s (NASA’s) Ames Research Center, on July 29, 1997, the UP conducted an educational seminar based on the NASA program. According to UP officials, the carrier plans to use information from the NASA-based module along with information on additional countermeasures in future educational sessions. In September 1997, based on the SLT’s recommendation, the UP established the position of Director of Alertness Management, whose purpose is to manage projects addressing the following: • Education; • Crew scheduling and collective bargaining issues; • Manager issues; • Technology; • Napping strategies; and • Healthy sleep initiatives. Additionally, the Director of Alertness Management is responsible for obtaining and overseeing outside consultants. In December 1997, the UP contracted with Alertness Solutions to provide the carrier with the needed expertise to develop a comprehensive, integrated, and systematic program to address fatigue. The program plan that was developed for 1998 appears in appendix D. Company officials indicate that the carrier plans to make available to employees a fatigue countermeasures book, as well as a revised Health Risk Appraisal (HRA). The new HRA will offer employees the opportunity to work one-on-one with a counselor. Employees wishing assistance will be offered individual counseling sessions, independent study guides, and periodic mailings. UP officials stated that carrier representatives have attended most, if not all, of the fatigue management meetings for the transportation industry in the last 3 years, including the March 1998 public hearing that the Safety Board convened following several UP accidents. Accident Crews’ Testimony The conductors of the trains involved in this accident recalled that they had received the fatigue material. The ME-29 engineer stated that he never had received the information and was not aware of a company-sponsored fatigue management program.

Factual Information 18 Railroad Accident Report The deceased engineer’s spouse could not recall either her or her husband receiving any fatigue-related material from the UP. Each surviving crewmember reported that he was awake and alert from the time he went on duty up to and including the accident. The crewmen said that they did not feel overworked on the evening or the morning of the accident. The NP-01 conductor said that he did not see the engineer fall asleep or doze during any portion of the trip. The NP-01 conductor reported that the workload was “nothing out of the ordinary” and added that the engineer of his train did not appear to be distracted or preoccupied up to and during the accident. Although the ME-29 engineer said he was not tired or stressed on the morning of the accident, he also stated that he considered fatigue a problem on the railroad. He said that the rest pattern that he had learned to live with is “a very difficult situation for me and I believe most engineers.” He indicated that the company had not “offered me any type of training or any type of in-service on how to manage my stress or fatigue” and stated that a fatigue management program was needed at the UP. Meteorological Information Weather observations from the Topeka airport, which is about 19 nautical miles southeast of Delia, reported the following conditions at 1:56 a.m.: temperature, 80° F; winds, 4 knots; skies, partly cloudy; and visibility, 10 miles. At 2:56 a.m., the temperature was 78° F; winds, calm; skies, clear; and visibility, 10 miles. Medical and Pathological Information Fatalities The Shawnee County coroner stated that when he arrived on scene at 8:15 a.m. and entered the control compartment of locomotive 3616, he observed the deceased NP-01 engineer lying on his back forward of the control stand and laterally across the metal beams supporting the cab floor. The Shawnee County coroner’s autopsy findings indicate that the engineer had extensive thermal destruction and soot in his upper airways. The NP-01 conductor sustained multiple contusions. He was taken to St. Francis Hospital in Topeka, where he was treated in the emergency room and released. The engineer and conductor of train ME 29 were not injured. Toxicological Testing Pursuant to FRA postaccident toxicological testing requirements contained in 49 CFR 219 Subpart C, surviving crewmembers provided specimens that were tested by the FRA for the presence of alcohol and drugs. The UP dispatcher who was on duty at the time of the accident also provided specimens for testing. All personnel tested negative for

Factual Information 19 Railroad Accident Report alcohol and illegal drugs. The fatally injured engineer’s toxicological tests were also negative for alcohol and drugs. Survival Factors Emergency Response As mentioned earlier, the SCSD dispatcher was notified of the accident at 2:41 a.m.; he immediately dispatched six SCSD units to the accident scene. At 2:44 a.m., the SCSD requested assistance from the American Medical Response (AMR), a Topeka-based private ambulance service that contracts with volunteer fire and rescue departments to provide, among other services, dispatch and emergency medical services. The AMR dispatched two ambulance units at 2:45 a.m. and then dispatched by pager and by radio tone the Rossville Volunteer Fire Department at 2:46 a.m. In all, one fire chief, one ambulance, two engines, one tanker, one brush truck, and one rescue truck responded to the scene. According to the AMR, the first fire unit arrived on scene at 2:51 a.m. When the Rossville fire chief could not readily determine whether the contents of the trailers carrying hazardous materials were involved in the fire, the SCSD began the evacuation of about 1,500 residents from Rossville and the rural area surrounding the accident site at 3:00 a.m. The Rossville fire chief then called for neighboring counties to provide mutual aid. At 3:30 a.m., the Rossville fire chief established a field command post and staging area at 86th Street and Caper Road. At the same time, the chairman of the Shawnee County Commissioners issued an evacuation declaration, which, in turn, initiated the Shawnee County disaster plan. Once responders determined that the spilled radioactive materials did not present a public threat, the Rossville evacuees were notified at 8:49 a.m. that the evacuation was canceled. By 9:15 a.m., most evacuees had returned to their residences. The activation of the county disaster plan was subsequently terminated at noon. Disaster Preparedness The stated purpose of Shawnee County’s disaster plan is to prevent and minimize injury and damage, reduce exposure of county residents to a disaster, mobilize support agencies, provide prompt and effective response to a disaster, and provide for return to normalcy. Before this accident, Shawnee County had last tested parts of its disaster plan on April 26, 1997, when it simulated a rural fire department responding to a hazardous materials incident involving one fatality and 17 injuries. Although the Rossville fire department, which is in Shawnee County, had not conducted drills with the UP, the carrier’s representative had provided hazardous materials training for members of the Shawnee County emergency management agency and for other Shawnee County fire departments.

Factual Information 20 Railroad Accident Report Tests and Research On July 8, 1997, about the same time of day that the collision occurred, Safety Board investigators participated in a test to determine the sight distance and to examine the operation of the radio, wayside signals, and locomotive cab signals. Train ME-29 Investigators tested the radio from train ME-29’s lead locomotive (unit 6129) at several locations en route to the accident site and noted no exceptions. Testers stopped the locomotive at the accident site and pressed the emergency call button. In all tests, the dispatch center received the transmitted radio calls with no anomalies. Train NP-01 Because the lead locomotive of train NP-01 was damaged in the collision, testers used a similar locomotive unit, UP 3696, to test the operation of the westbound train and the signal system. As the test locomotive proceeded westward from Soldier Creek (MP 76.0), the signal system and the cab signal system functioned as designed and as described by the dispatcher who routed train NP-01 (see figure 8). Milepost Wayside Signal Aspect (Indication) Cab Signal Aspect (Indication) Audible Alarm? Actions 76.0 (Soldier Creek) green (proceed) green (proceed) None N/A 78.3 flashing yellow (approach limited) changes to yellow-over-green (approach limited) Yes Test locomotive engineer acknowledges alarm 80.7 yellow-over-yellow (approach medium) yellow (approach) Yes Test locomotive engineer acknowledges alarm CP East Kenefick red-over-yellow (diverging approach) same as above None N/A CP West Kenefick red* (stop) As the locomotive unit passes this wayside signal, the cab signal drops to red-over-yellow (restricting) Yes Test engineer purposely does not acknowledge alarm. About 7.5 seconds later, a full service penalty brake application of the locomotive brake system occurs and stops the locomotive unit. *Measurements indicated that westward signal for the siding track was clearly visible from 7,453.15 feet. Figure 8. Signal indications and alarms during postaccident tests

Factual Information 21 Railroad Accident Report A-1 Charging Cut-Off Valve Safety Board investigators examined the A-1 charging cut-off pilot valve from train NP-01’s lead unit (UP 3616) to determine the position of the cut-off piston, an indication of whether the emergency braking occurred from the train operator moving the automatic brake handle to the emergency position (up position) or from a trainline separation or rupture initiating the emergency braking (down position). Investigators found the cut-off piston in the applied, or down, position. Event Recorders The event recorder of NP-01’s lead unit, UP 3616, was destroyed by the collision and fire (see figure 9). The second unit was not required to be and was not equipped with an event recorder. UP officials printed out the recorded data from train ME-29’s event recorders under the supervision of Safety Board investigators. Figure 9. The event recorder from UP 3616, train NP-01’s lead locomotive

Factual Information 22 Railroad Accident Report Other Information Past Safety Board Actions Following its investigation of a February 16, 1996, accident in which a Maryland Rail Commuter (MARC) train collided with a National Railroad Passenger Corporation (Amtrak) passenger train near Silver Spring, Maryland, the Safety Board identified the need for train operating cabs to have voice recording devices, similar to the type installed in the cockpit of aircraft. In the Silver Spring accident, the Safety Board determined that the MARC engineer and traincrew failed to operate the train according to signal indications, colliding head-on with the Amtrak lead unit, which resulted in the deaths of 11 people, including all MARC train operating crewmembers, and in the injuries of 26 people in the derailment and subsequent fire. In its report of the accident, the Safety Board observed that the cockpit voice recording had been a key tool in documenting the circumstances leading up to an accident and valuable in determining the cause of aviation accidents for more than 35 years. The Board noted that although current locomotive event recorders have great utility in providing mechanical response data, they cannot answer some questions about the crewmembers’ knowledge and actions. In the case of the Silver Spring accident, the Safety Board stated that had a voice recording from the MARC train existed, investigators could have determined from the communications before the collision the factors that may have affected the MARC train operator’s actions. The Safety Board, therefore, made the following recommendation to the FRA: R-97-9 Amend 49 CFR, Part 229, to require the recording of train crewmembers’ voice communications for exclusive use in accident investigations and with appropriate limitations on the public release of such recordings.

23 Railroad Accident Report Analysis General Nothing in either the predeparture tests or the postaccident equipment inspection indicated any equipment failure, and neither crew had reported any problems while en route. Postaccident inspections and tests found no track defects or deviations from FRA track safety standards and identified no problems with the signal system. The train dispatcher had 10 years of experience in his position and demonstrated sufficient knowledge of centralized traffic control procedures and dispatcher duties. Each train crewmember had received the necessary operational training and experience to competently perform his duties. Further, each member had passed UP physical and visual examinations and rules tests and had been observed and tested on stop signal and operational movements. Results of postaccident toxicological tests indicate that the dispatcher and the train crewmembers were not impaired by alcohol or drugs. The Safety Board concludes that the train equipment, the track, and the signal system functioned as designed; the dispatcher and train crews were qualified, trained, and tested to properly perform their duties; and no UP employee tested as a result of this accident was impaired by alcohol or drugs. Emergency responders, upon reviewing the train consist and noting that containers involved in the accident and fire carried hazardous materials, took appropriate precautionary measures for a hazardous materials incident. Surveys showed that the radioactive packages were well below the public exposure levels set by the Kansas Department of Health and Environment and that the few spots of low-level radioactivity on the floor of one rail car disappeared into the background radiation at distances greater than 2 feet. Therefore, the Safety Board concludes that the hazardous materials cargo did not cause or increase the severity of this accident. Accident Analysis Because the recorder in the lead locomotive of train NP-01 was destroyed in the collision and fire, the train’s movement cannot be precisely determined. However, given the times of signal changes recorded at the dispatch center, the distances covered, and other factors, a reasonable account can be reconstructed. After passing the green signal at Soldier Creek, the engineer of westbound train NP-01 passed two intermediate wayside signals that would have triggered alarms in the locomotive cab requiring a response by the engineer. Postaccident tests indicated that the ACS and ATS systems operated as designed; therefore, the engineer apparently did

Analysis 24 Railroad Accident Report correctly acknowledge the ACS audible alarms as required during this portion of the trip; otherwise, an automatic (penalty) application of the train brakes would have occurred. CAD records indicate that the almost 1 ¼-mile-long NP-01 train began entering the siding at CP East Kenefick about 2:05 a.m. and was completely in the siding and off the main track by 2:10 a.m. Based on the time that the train entered the siding and the time that circuit damage was recorded at the signal at the west end of the 2 ½-mile-long siding (2:15:23 a.m.), train NP-01 probably was traveling about 15 mph when it passed the red signal at MP 85.52 (West Kenefick). The train’s failure to stop for the red signal would have resulted in the ACS cab signal dropping and the ACS alarm sounding, which, if not acknowledged by the engineer, would have resulted in an automatic (penalty) application of the train brakes. The position of the A-1 charging valve indicates that the engineer did not apply the brakes and that the they automatically activated as a result of a penalty application. However, the momentum of train NP-01 carried it forward, and it struck the side of eastbound train ME-29, which was operating on a clear signal. Based on its investigation of this accident, the Safety Board identified issues in the following areas: • NP-01 engineer’s performance, • UP’s fatigue education program, • crew resource management, and • positive train separation (PTS) control systems. The Safety Board also looked at other safety-related issues, such as alerters, event recorder crashworthiness, and voice recorders. NP-01 Engineer’s Performance The Safety Board examined the performance of the NP-01 engineer in the context of information provided by the NP-01 conductor and the train ME-29 crew. The NP-01 conductor stated that on the night of the accident, the NP-01 engineer appeared normal and did not complain of feeling tired or ill. He said that he did not observe the engineer nod or go to sleep from the time they went on duty until the train was about 9 miles from the accident site, when he (the conductor) went into the lavatory, where he remained for about 20 minutes. The NP-01 conductor described the cab conditions as dark, except for a small light in the step well to the lavatory. He said that the train was operating about 15 to 20 mph when he left the operating cab. The ME-29 engineer stated that as he was approaching the Kenefick siding he observed a westbound train (NP-01) about 3 miles away with its headlight on bright and its ditch lights illuminated. The ME-29 engineer and conductor tried radioing the oncoming train several times but never received a response; however, they were not too

Analysis 25 Railroad Accident Report concerned because their train had both a clear wayside signal and a clear cab signal. As a precaution, the ME-29 engineer flashed his train’s lights several times. He also began sounding the train’s horn for several seconds when he was about ¾ of a mile from a private road crossing. The lights of train NP-01 finally dimmed shortly thereafter. The Safety Board is convinced that the NP-01 engineer probably fell asleep sometime after his train entered the east end of the siding. He did not respond at all to the train ME-29 crew’s repeated radio calls and did not respond timely to the ME-29’s flashing headlight beam. He possibly awoke upon hearing the ME-29’s horn sounding and dimmed his train lights and extinguished his ditch lights in reaction to meeting an oncoming train, but either was not sufficiently alert or was too startled or disoriented to realize that he needed to apply the brakes. The Safety Board attempted to determine why the NP-01 engineer might have been sufficiently fatigued to fall asleep. Previous accident investigations13 have identified three background factors related to fatigue: cumulative sleep loss, the number of continuous hours of wakefulness, and the time of day when the incident occurs. Sleep research14 has established that, to be fully alert and functioning, people need a certain number of continuous hours of sleep each day, typically 6 to 10 hours, depending on the individual. The engineer’s spouse told investigators that the engineer usually slept anywhere from 5 to 9 hours per rest period. She recalled that he retired between 9:30 p.m. and 10:00 p.m. on June 30 and arose the following morning about 8 a.m., meaning that he had slept about 10 hours during his last rest period before the accident and did not have an accumulated sleep debt. The engineer’s continuous hours of wakefulness, together with the time of his work shift probably affected his behavior. His spouse said that he had remained awake from 8 a.m. until he left his residence for an 8:30 p.m. reporting time. Therefore, at the time of the accident, the NP-01 engineer had been awake continuously for about 18 hours. Research shows that the longer an individual goes without sleep beyond the normal waking day of 14 to 16 hours, the greater the occurrence of attention lapses and the longer the duration of the lapses.15 The accident occurred at 2:15 a.m. Researchers also have established that two periods of maximum sleepiness occur during a 24-hour period, determined by 13 See Safety Study–Factors that Affect Fatigue in Heavy Truck Accidents (NTSB/SS-95/01) and Aircraft Accident Report–Uncontrolled Collision with Terrain American International Airways Flight 808 Douglas DC-8-61, N814CK, U.S. Naval Station, Guantanamo Bay, Cuba, August 18, 1993 (NTSB/AAR-94/04). 14 Carskadon, M., and Dement, W., “Normal Human Sleep: An Overview,” Principles and Practice of Sleep Medicine, pp. 16-26, section 1, chapter 2. W.B. Sanders Company, Philadelphia, Pennsylvania, 1994. Roth, T., Roehrs, T., Carskadon, M. and Dement, W., “Daytime Sleepiness and Alertness,” Principles and Practice of Sleep Medicine, pp. 40-50, section 1, chapter 4. National Commission on Sleep Disorders Research, “Wake Up America; A National Sleep Alert,” vol. 1: Executive Summary and Executive Report submitted to the U.S. Congress and the Secretary of Health and Human Services in 1993. 15 David F. Dinges, Ph. D., “Performance Effects of Fatigue,” Fatigue Symposium Proceedings, November 1-2, 1995, p. 42, National Transportation Safety Board and NASA AMES Research Center.

Analysis 26 Railroad Accident Report physiological fluctuations controlled by the brain.16 Sleep research suggests that the human body maintains a day-night cycle known as circadian rhythm, which affects, among other biological processes, sleep-wake patterns.17 Moreover, a circadian nadir normally occurs between 1:00 a.m. and 7:00 a.m. and between 1:00 p.m. and 5:00 p.m., during which workers experience diminished capacity.18 For many people, including shift workers who work between midnight and 6 a.m., the optimum condition is reduced alertness and the worst case is falling asleep. One study states: It has been demonstrated that the quality and quantity of sleep is degraded and performance is impaired as result of working at night. These changes are primarily caused by the disharmony between the night worker’s schedule and the underlying circadian rhythms of the body. The two are completely out of phase. The body is programmed to be awake and active by day and asleep and inactive by night, and it is extremely difficult to adjust this program in order to accommodate artificial phase shifts in the sleep-wake cycle.19 The NP-01 engineer had been on vacation for 17 days before returning to work on June 30. His spouse told Safety Board investigators that while he was on vacation, he had retired each evening between 9 p.m. and midnight and had awoken each morning between 5 a.m. and 7 a.m. The accident, therefore, occurred on the first day after an extended period during which he had established a sleep-wake pattern. When individuals change their work-rest schedules, their bodies do not adjust immediately. They normally require from several days to weeks to adapt to work-rest schedule changes. In the interim, as their bodies adjust to the new schedule, they can experience impaired performance, diminished alertness, and increased reaction time. In this case, the engineer did not have the necessary time for his circadian rhythm to match his new sleep-wake cycle. As a result, he probably was not prepared to stay awake all night. Once NP-01 entered the 13,496-foot-long siding, the engineer had no performance demands for at least 10 minutes before the train reached the west end of the siding. The combined factors of the rhythmic sound and motion produced by the locomotives’ engines, the time of day for diminished alertness, the engineer’s long period of wakefulness after significantly changing his work-rest schedule, and the lack of sensory stimulation, that is, the darkened cab environment and the absence of conversation with the conductor, would have contributed to the engineer’s probably falling asleep. 16 Rosekind, M., Gander, P., Connel, L., and Co, E., “Crew Factors in Flight Operations X: Alertness Management in Flight Operations.” NASA-FAA Technical Memorandum DOT/FAA/RD-93/18, 1994. 17 Circadian rhythm is a term used to describe cyclical biological processes that occur at approximately 24-hour intervals in approximate synchrony with the earth’s day-night cycle. Sleep-wake patterns, body temperature, hormone levels, and metabolism are some of the processes that have recurring and predictable variations throughout a 24-hour period. 18 Dinges, D.F., “The Nature of Sleepiness: Causes, Contexts and Consequences.” Chapter 9 in Strunkard, A.J., and Baum, A., eds., Perspectives in Behavioral Medicine, 1988, p. 162. 19 Tilley, A.J., et.al., “The Sleep and Performance of Shift Workers,” Human Factors, 1982, pp. 629-641.

Analysis 27 Railroad Accident Report The NP-01 engineer’s failure to immediately respond to the repeated visual and aural stimuli from train ME-29 supports the finding that he probably experienced an uncontrolled sleep episode while his train traversed the Kenefick siding. The Safety Board concludes that the NP-01 engineer failed to stop the train at the stop signal because he was probably asleep. UP’s Fatigue Education Program UP officials indicated that in September 1990, the carrier mailed a fatigue awareness handbook and video to all of its train service and mechanical service employees and their family members. The Safety Board reviewed the fatigue-awareness handbook and video, which address such topics as the body’s need for rest, rotating shift work, body rhythms, the beneficial effects of a nutritious diet and exercise, and lifestyle considerations, including family and social life considerations, within the context of shift work. The handouts, which are based on scientific research, describe the physiological aspects of sleep and the effects of fatigue on behavior and performance and explain practicable ways that railroad personnel can address fatigue in their professional and personal lives. The Safety Board concludes that both the handbook and video provided by the UP to employees are valuable information resources for helping railroad personnel and their families understand fatigue issues. In testimony, the conductors of both trains recalled that they had received the fatigue-related material; the ME-29 engineer and the NP-01 engineer’s spouse said that they were unaware that such information or that such a company-sponsored program existed. The personnel and training records of the crewmembers involved in the accident contain no reference or documentation indicating that the material had been sent to them. A UP official indicated that the carrier did not document which employees received this material in 1990. He said that after September 1990, the carrier mailed the handbook and video to each company division and that employees hired after that date would have been encouraged by divisional managers to become familiar with the material. The fact that some crewmembers and family members had not heard of the UP’s fatigue management program indicates that the carrier’s action, although laudable, was not completely effective. While it is pleased that the UP attempted to provide relevant information about fatigue to its employees, the Safety Board is concerned that the company did not establish and implement procedures for identifying those individuals who had received the training, did not establish effective procedures for disseminating the information to new employees, and did not establish ongoing procedures for assessing the effectiveness of the program. Such procedures also would have enabled the UP to effectively evaluate future training needs in the area of fatigue. The Safety Board concludes that the UP did not have procedures enabling the company to track the employees who had received the fatigue awareness material. The Safety Board therefore believes that the UP railroad should issue to all employees, including management personnel, updated fatigue awareness material regarding shift work, work-rest schedules, and proper regimens of health, diet, and rest. In

Analysis 28 Railroad Accident Report addition, the UP should pursue a systematic approach to this training and establish procedures to ensure that all employees have received this material and understand the dangers of fatigue. Furthermore the company should develop and implement a program affording employees the capability to learn of new developments about this critical railroad safety issue and should establish, at a minimum, an annual management oversight review process for the fatigue awareness program to ensure its effectiveness and to identify ways of improving it. For a railroad safety program to be successful, it needs the combined support of management and labor. Accordingly, the Safety Board believes that, in conjunction with the UP, the Brotherhood of Locomotive Engineers and the United Transportation Union should discuss the circumstances of this accident with their members and advise them about the operating danger of working while fatigued. Crew Resource Management GCOR 1.47 requires that the conductor, among other duties, supervise the operation and administration of the train. GCOR 5.16 stipulates that crewmembers in the engine control compartment be alert for signals and communicate clearly to each other the name or aspect of signals affecting their train movement. The rule also states that if the engineer cannot or does not respond, the crewmembers must immediately take action to ensure safety, using the emergency brake valve to stop the train, if necessary. After initially providing the Safety Board with several inconsistent statements regarding the events of the evening, the NP-01 conductor stated that he was in the lavatory from the time that the train departed Soldier Creek until immediately before it collided with train ME-29, a period of 20 minutes. Thus, the train passed three signals and was approaching the fourth without the conductor observing the signals and complying with GCOR rules 1.47 and 1.56. By being absent during much of the trip, the conductor did not properly perform his duties and provide the necessary safety oversight. Had he been present in the locomotive cab and calling out the intermediate signal indications after train NP-01 left Soldier Creek, his interaction with the engineer may have provided the necessary stimulus to keep him awake. At the very least, an alert conductor probably would have detected that the engineer was suffering from fatigue and could either have awakened him or taken actions to stop the train. The Safety Board concludes that the NP-01 train conductor did not provide proper supervision of operating procedures when he left the engineer alone in the locomotive cab for 20 minutes before the collision. As the GCOR requirements suggest, the safe operation of a freight train requires a team effort between the engineer and the conductor. By working in concert, backing each other up, they provide a redundant safety system. When one individual departs the cab, the safety of train operations is compromised.

Analysis 29 Railroad Accident Report Effective operating crew interaction, also known as crew resource management, is particularly important on the UP railroad system, given that most of its freight trains do not have devices providing technological redundancy, such as automatic speed control systems and alerters. The Safety Board understands that the UP is participating in a PTS pilot project (see next section) and is pleased that the carrier is taking this initiative. However, because a PTS control system is not in active operation anywhere on the UP railroad system, the Safety Board thinks that operating procedural changes should be made pending the installation of PTS. Although the procedure is not actually stipulated in the GCOR or UP operating rules, the train must be stopped when the engineer has to leave the operating cab for any reason. The Safety Board thinks that this practice should apply when the conductor has to leave the locomotive cab for tasks that do not actively support safety redundancy in train operations. The Board is aware that the conductor has operating responsibilities that require leaving the cab, including switching operations, flagging duties at highway- railroad grade crossings, and so forth. However, when performing these tasks, the conductor is still an integral part of the safety redundant system. An operating train must have an adequate level of either human or technological safety redundancy. The Safety Board therefore believes that the UP should require that freight trains not equipped with cab signals, speed control, and alerters or with a PTS system stop when either one of the two operating crewmembers must leave the locomotive cab, except in instances when the conductor must perform operating tasks actively supporting safety redundancy in train operations. Positive Train Separation Neither train in this accident was equipped with a PTS control system, which can prevent trains from colliding by automatically interceding in the operation of a train when an engineer does not comply with the requirements of the signal indication. Had train NP- 01 been equipped with PTS, the control system would have prevented this accident by stopping the train when the engineer failed to stop at the red signal. The Safety Board concludes that a fully implemented PTS control system would have prevented the collision at the UP railroad’s Kenefick siding, thus saving the life of the NP-01 engineer. Unfortunately, the Delia collision is merely the latest in a very long list of accidents investigated by the Safety Board in which PTS could have prevented a tragic outcome. The Safety Board initially issued a recommendation addressing this issue in 1970.20 The Safety Board continued to investigate human-performance-based railroad accidents, which prompted the Board to place PTS on its Most Wanted list in September

1. Following its investigation of a head-on collision on the Burlington Northern

20 Railroad Accident Report—Head-on Collision between Penn Central Trains N-48 and N-49 at Darien, Connecticut, August 20, 1969 (NTSB/RAR-70/03).

Analysis 30 Railroad Accident Report Railroad near Ledger, Montana,21 the Safety Board issued in July 1993 the following safety recommendation to the FRA: In conjunction with the AAR and the Railroad Progress Institute, establish a firm timetable that includes at a minimum, dates for final development of required advanced train control system hardware, dates for an implementation of a fully developed advanced train control system, and a commitment to a date for having the advanced train control system ready for installation on the general railroad system. (R-93-12). In the FRA’s July 1994 report to Congress regarding advanced train control, the FRA indicated that it planned to begin a 2-year corridor risk assessment in 1995 to identify and evaluate the conventional rail corridors that would be prime candidates for advanced train control implementation. The study was to contain a geographic information system (GIS) platform to provide the analysis, which would include accidents that may have been prevented by a PTS control system plotted on the GIS. The initial results of the study were presented to the FRA Railroad Safety Advisory Committee (RSAC) in June 1997 for review and further analysis. At the time of the Delia accident, the FRA and the railroad industry were working on or had planned five joint PTS projects, including the following: • The UP-Burlington Northern-Santa Fe Pacific Northwest PTS Project. PTS hardware was built and system software was developed for this project in

1. Deliveries, installations, and testing began in 1996. The project, which

has four planned phases, is slated for completion in 1999. • Amtrak’s Incremental Train Control System (ITCS) Project. ITCS wayside equipment was installed in the test bed, and initial system testing began in

1. The current phase of the project involves producing the hardware and

system software for equipping 71 miles of test bed between Kalamazoo, Michigan, and New Buffalo, Illinois (Detroit-Chicago Corridor). Testing this test bed is scheduled to begin in 1998. • The UP-Amtrak Advanced Train Control System (ATCS) Project. By late 1998, the contract for ATCS hardware and software should be awarded and testing begun on 111 miles of track on the Chicago (Illinois)-St. Louis (Missouri) Corridor. • Amtrak’s Advanced Civil Speed Enforcement System Project. A Federal Register notice announced that testing on a system in the Northeast Corridor should begin in 1998. • Norfolk Southern-CSXT-Conrail Joint PTC Project. In 1997, a vendor was selected to provide design specifications for an on-board platform that is not specific to any PTS protocol. The plan is to develop an economical, interoperable on-board system that features common PTC interfaces. 21 Railroad Accident Report—Head-on Collision between Burlington Northern Freight Trains 602 and 603 near Ledger, Montana, on August 29, 1991 (NTSB/RAR-93/01).

Analysis 31 Railroad Accident Report In addition to the test beds mentioned, other railroads (Alaska, New Jersey Transit, New York City Transit, and CSXT) had each budgeted for PTC projects as part of their capital and safety improvement projects. The Safety Board is actively participating in the RSAC on PTS, which is tasked with developing standards and identifying corridors where fully integrated PTS systems can be implemented. Other Issues Alerters Train NP-01’s lead locomotive unit, UP 3616, was not equipped with an alerter or alertness device to help the crew maintain vigilance. According to the eastbound engineer, the speed of train NP-01 near the east end of Kenefick siding was “minimal, as though he [the NP-01 engineer] was trying to get stopped or coasting to a stop….” The ME-29 conductor also said that NP-01 was moving very slowly. CAD records show the train took 9 minutes 24 seconds to cover the distance between the signals. If the NP-01 cab had been equipped with an alerter, depending on the set timing intervals of the device and the time that the engineer probably began to fall asleep, the device may have sensed a lack of movement and awakened him sooner, which may have enabled him to stop the train or at least avoid being fatally injured. The Safety Board concludes that had the striking locomotive been equipped with an alerter, it may have helped the engineer stay awake while his train traveled through the siding. As a result of its investigation of the August 9, 1990, collision of two Norfolk Southern freight trains near Sugar Valley, Georgia, the Safety Board issued Safety Recommendation R-91-26, urging the FRA, in conjunction with the fatigue study of train crewmembers, to explore the parameters of an optimum alerter system for locomotives. In an FRA August 12, 1997, response to the recommendation, the Administrator stated that the FRA had initiated research to develop a retrofit for existing alerters to negate the ability of locomotive engineers to reset them while dozing and had approved funding for a prototype and testing. However, the contractor subsequently had withdrawn its proposal, citing the lack of a market for the technology, based on the advent of PTS. The Administrator further stated: The FRA has initiated a major project involving rail labor and management to attack the root cause of the fatigue issue.…In addition, we are making major strides toward the implementation of a positive train separation system. These activities address the core issues in the 1990 accident and recommendation 91-26. Our work has superseded the need for the action in recommendation 91-26 and we have decided not to allocate further scarce resources to it. I ask the NTSB reconsider the recommendation and close it based on our alternative action to address its intent.”

Analysis 32 Railroad Accident Report On November 4, 1997, the Safety Board responded: Safety Recommendation R-91-26 urged the FRA, in conjunction with the study of fatigue of train crewmembers, to explore the parameters of an optimum alerter system for locomotives. The Safety Board is disappointed to learn that the FRA plans to take no further action on this recommendation. In the FRA’s June 28, response to the recommendation, Acting Administrator S. Mark Lindsey stated that through the Small Business Innovation Personal Solicitation Program, the FRA had awarded two contracts to develop proposals to modify the existing alerter systems so that they cannot be reset by reflex action. Your August 12, 1997, letter does not mention any research under these two contracts. Moreover, your response is predicated on a market analysis submitted by a manufacturer, not on feasibility research requested by this recommendation. While we applaud the FRA’s rail labor and management project, the Safety Board continues to believe that a successful countermeasure to fatigue in the transportation workplace is an optimum alerter system that cannot be reset by reflex action. For the foreseeable future, the implementation of PTS will not be so widespread as to negate the need for such an alerter on locomotives. Since the FRA has declined to act on this recommendation and requested closure, the Safety Board has classified Safety Recommendation R-91-26 “Closed—Unacceptable Action.” The Safety Board still believes that the FRA should revise Federal regulations to require that the rail industry install locomotive alerter systems that require a cognitive response from the engineer to cancel or reset the system. In the interim, the Safety Board believes that the UP should install a cognitive alerter system that cannot be reset by reflex action on all locomotives that operate on lines that do not have a PTS system. Event Recorder Crashworthiness To identify measures for improving railroad safety, it is essential that event recorder data be preserved after a catastrophic event. In this accident, fire destroyed the event recorder on train NP-01’s lead locomotive unit. Inspection of the fire-damaged units showed that the location of the recording equipment provided satisfactory protection from crash forces. However, the type of encasement designed by the manufacturer did not protect the event recorder from the effects of the fire. The Safety Board therefore was not able to determine what actions the engineer did or did not perform after the train left Kansas City. Consequently, vital information about such functions as braking, throttle manipulation, and the chronological relationship of precollision events, was not available. The Safety Board has investigated a number of accidents in which event recorder data were compromised by impact forces, water, or fire, including Corona, California, Knox, Indiana, Mobile, Alabama, and, most recently, Devine, Texas.22 In the investigation report of the Devine collision, the Safety Board again observed that the aviation industry has crashworthiness standards requiring that event recorders on aircraft must be able to withstand impact forces of 3,500 g and fire exposure of 1,100° F for 1 hour. The Board also noted that, despite assuring the Safety Board as recently as August 1997 that it would

Analysis 33 Railroad Accident Report establish recorder crashworthiness standards for the railroad industry, the FRA had not done so. The Safety Board therefore issued the following safety recommendation to the FRA: R-98-30 Working with the railroad industry, develop and implement event recorder crashworthiness standards for all new or rebuilt locomotives by January 1, 2000. The Safety Board has not yet received a response to Safety Recommendation R-98-30. Voice Recorders In a letter dated February 25, 1998, responding to Safety Recommendation R-97-9, the FRA responded that it was reviewing the recommendation and expected to be able to report a substantive response within 60 days. In its preliminary discussion of the recommendation, the FRA stated: Unlike event recorders, which have value in determining rules compliance prior to an accident, use of voice recorder information would, as suggested by the recommendation, be limited exclusively to use in an accident investigation. Other uses would be viewed as inappropriate electronic monitoring of employees’ conversations in the workplace, whether or not work related. Capturing voice recordings in a locomotive cab may present practical issues not encountered in aviation. Headsets with intercom capability are the exception, rather than the rule, in locomotive cabs. Significant inter-relationships exist between efforts to limit occupational noise exposure in cabs and the effective recording of conversations. Issues of comfort have also been raised by employees and their representatives when use of headsets has been proposed for reduction of occupational noise exposure. Employee representatives cite 8-12 hour shifts and varying environmental conditions in locomotive cabs. The potential release of voice recordings subsequent to an accident presents additional issues. A special statutory exception has been required in the aviation context to prevent inappropriate use of voice recordings following events drawing significant notoriety. Enacting fully effective regulations in the absence of special- purpose legislation would appear to present a difficult conflict in public policy. 22 For more information, see the following publications: Railroad Accident Report—Derailment of Freight Train H-BALT1-31 Atchison, Topeka and Santa Fe Railway Company near Cajon Junction, California, on February 1, 1996 (NTSB/RAR-96/05); Railroad Accident Report—Atchison, Topeka and Santa Fe Railway Company (ATSF) Freight Trains ATSF 818 and ATSF 891 on the ATSF Railway in Corona, California, on November 7, 1990 (NTSB/RAR-91/03); Railroad Accident Report—Derailment of Amtrak Train No. 2 on the CSXT Big Bayou Canot Bridge near Mobile, Alabama, on September 22, 1993 (NTSB/RAR-94/01); Railroad Accident/Incident Summary Report—Knox, Indiana, September 17, 1991 (NTSB/RAR-92/02/SUM); and Railroad Accident Report—Collision and Derailment of Union Pacific Railroad Freight Trains 5981 North and 9186 South in Devine, Texas, on June 22, 1997 (NTSB/RAR-98/02).

Analysis 34 Railroad Accident Report FRA continues to evaluate this recommendation with a view toward offering a more fully considered response. FRA's review would be aided by clarification of the Board's intent. Is it desired that all locomotives, including freight locomotives, be equipped with voice recorders? It is intended that passenger locomotives typically operated by a single employee be included, even if the locomotive cab is inaccessible to other crew members required to be stationed in the occupied passenger coaches (as if often the case in intercity service)?…Since the Board would be the primary user of voice data, does the Board intend to utilize the power conferred under its charter statute to recommend legislation affording appropriate controls on release of voice recordings in the rail mode? The Safety Board is considering the FRA response.

35 Railroad Accident Report Conclusions Findings

1. The train equipment, the track, and the signal system functioned as designed; the

dispatcher and train crews were qualified, trained, and tested to properly perform their duties; and no Union Pacific employee tested as a result of this accident was impaired by alcohol or drugs.

1. The hazardous materials cargo did not cause or increase the severity of this accident.
2. The NP-01 engineer failed to stop the train at the stop signal because he was probably

asleep.

1. Both the handbook and video provided by the Union Pacific to employees are valuable

resources for helping railroad personnel and their families understand fatigue issues.

1. The Union Pacific did not have procedures enabling the company to track the

employees who had received the fatigue awareness material.

1. The NP-01 train conductor did not provide proper supervision when he left the

engineer alone in the locomotive cab for 20 minutes before the collision.

1. A fully implemented positive train separation control system would have prevented

the collision at the Union Pacific railroad’s Kenefick siding, thus saving the life of the NP-01 engineer.

1. Had the striking locomotive been equipped with an alerter, it may have helped the

engineer stay awake while his train traveled through the siding. Probable Cause The National Transportation Safety Board determines that the probable cause of this collision and derailment was the failure of the of the NP-01 engineer to stop at the stop signal, enabled by the failure of Union Pacific management to ensure redundant safety systems for train operations and control, including effective crew resource management techniques and technological advances for crew alertness. Contributing to the collision and derailment was the failure of the Federal Railroad Administration and the railroad industry to aggressively develop and implement a positive train separation control system.

36 Railroad Accident Report Recommendations As a result of its investigation, the National Transportation Safety Board makes the following recommendations: To the Federal Railroad Administration: Revise the Federal regulations to require that all locomotives operating on lines that do not have a positive train separation system be equipped with a cognitive alerter system that cannot be reset by reflex action. (R-99-53) To the Union Pacific Railroad: Issue to all employees, including management personnel, updated fatigue awareness material regarding shift work, work-rest schedules, and proper regimens of health, diet, and rest. (R-99-54) Revise your fatigue awareness program to include a process for documenting which employees receive the currently available fatigue awareness material, any new or updated fatigue-related information, or both, and for determining whether the recipients understand the dangers of working while fatigued. (R-99-55) Establish, at a minimum, an annual management oversight review process for the fatigue awareness program to ensure its effectiveness and to identify ways of improving it. (R-99-56) In conjunction with the operating unions, discuss the circumstances of this accident with employees and advise them about the operating danger of working while fatigued. (R-99-57) Require that freight trains not equipped with cab signals, speed control, and alerters or with a positive train separation system stop when either one of the two operating crewmembers must leave the operating cab, except in instances when the conductor must perform operating tasks actively supporting safety redundancy in train operations. (R-99-58) Install a cognitive alerter system that cannot be reset by reflex action on all locomotives that operate on lines that do not have a positive train separation system. (R-99-59)

Recommendations 37 Railroad Accident Report To the Brotherhood of Locomotive Engineers: In conjunction with other operating unions and with the Union Pacific Railroad, discuss the circumstances of this accident with your members and advise them about the operating dangers of working while fatigued. (R-99-60) To the United Transportation Union: In conjunction with other operating unions and with the Union Pacific Railroad, discuss the circumstances of this accident with your members and advise them about the operating dangers of working while fatigued. (R-99-61) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member ROBERT T. FRANCIS II Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: August 31, 1999

Recommendations 38 Railroad Accident Report John A. Hammerschmidt, Member, filed the following concurring and dissenting opinion on November 18, 1999: Notation 6899B Member HAMMERSCHMIDT, concurring and dissenting: After a careful review of the evidence that was developed during the investigation, I agree with the Probable Cause contained in the Notation Draft that staff originally submitted to the Board: The National Transportation Safety Board determines that the probable cause of this accident was the failure of the NP-01 engineer to stop at the stop signal because he was probably asleep and the failure of the NP-01 conductor to provide proper operating safety redundancy by leaving the locomotive cab. I do not concur with the issuance of Safety Recommendations R-99-58 and R-99-59.

39 Railroad Accident Report Appendix A Investigation The National Transportation Safety Board was notified at 4:01 a.m., eastern daylight time, on July 2, 1997, of a collision and derailment involving two Union Pacific freight trains near Delia, Kansas. The investigator-in-charge and other members of the Safety Board investigative team were dispatched from the Washington, D. C., headquarters office and from the Atlanta, Georgia, and the Chicago, Illinois, field offices. Upon arriving on scene, the Board established investigative groups to study operations, track, signals, mechanical, survival factors, human performance, and hazardous materials. The Safety Board was assisted in the investigation by the Federal Railroad Administration, the Union Pacific Railroad Company, the Brotherhood of Locomotive Engineers, the United Transportation Union, the Shawnee County Department of Emergency Management, and the Kansas Department of Health and Environment.

40 Railroad Accident Report Appendix B Truck Trailers and Contents Trailer ID Hazardous Material and Status YFSZ 36289 108 cartons, 4190 lbs. of pesticide, liquid, toxic, NOS (Abameticin Solution), division 6.1 (poisonous material). Status: Recovered. Plastic bottles in a few boxes leaked slightly. YFSZ 113012 10 cylinders, 55 lbs. each of several refrigerant gases, division 2.2 (nonflammable gas). Status: Cylinders recovered intact NONZ 173810 13 packages, 78 lbs. of paint in aerosol cans with a flammable gas propellant, shipped as paint, division 2.1 (flammable gas). Status: Not recovered.* NONZ 191287 4 packages, 152 lbs. of wood bleach shipped as hydrogen peroxide aqueous solution, division 5.1 (oxidizer) and sodium hydroxide solution, class 8 (corrosive material). Status: Not recovered. KCSZ 211906 310 packages, 1,864 lbs. of paint in aerosol cans with a flammable gas propellant, shipped as paint, division 2.1 (flammable gas). Status: Not recovered. NONZ 192194 32 packages, 205 lbs. of paint in aerosol cans with a flammable gas propellant, shipped as paint, division 2.1 (flammable gas). Status: Not recovered. YFSZ 42688 3 pails, 133 lbs. of corrosive liquid, NOS (ammonium hydroxide), class 8 (corrosive material). Status: Not recovered. 1 pail, 43 lbs. of corrosive liquid, NOS (tripropylene glycol diamine), class 8 (corrosive material). Status: Not recovered. RDWZ 221251 25 packages, 1,055 lbs. of coating solution, class 3 (flammable liquid). Status: Not recovered. 18 packages of molybdenum 99/technetium 99m generators with between 0.028 and 80 millicuries of radioactive materials, NOS (molybdenum 99/technetium 99m), UN 2982; 10 packages White I and 8 packages Yellow II. Status: Some remains (melted lead, springs and bits of cardboard) of severely fire damaged packages were found.

• Each shipment listed as not recovered was in truck trailers damaged or destroyed by fire.

41 Railroad Accident Report Appendix C Signal Changes The sequence of signal and switch events at the east and west ends of Kenefick siding is listed below. (The best wayside signal aspect would have been a red over yellow. The best cab signal aspect would have been a solid yellow). Time Control Point Switch Event 1:27:57 West Kenefick Switch normal position (Main track movement). 1:46:16 CP East Kenefick Request reverse switch (Main track movement to-from the siding track). 1:46:18 West Kenefick Request eastbound signal (train ME-29). 1:46:34 East Kenefick Switch reverse. (The switch was lined for train NP-01 to move into the siding track .) 1:46:36 West Kenefick Eastbound signal cleared for train ME-29. 1:46:47 East Kenefick Westbound signal cleared for train NP-01. 2:05:59 East Kenefick Westbound signal at “stop”, switch reverse, OS track occupied for train NP-01. (The train entered the siding). 2:06:01 East Kenefick Siding track occupied by train NP-01. 2:09:48 East Kenefick East approach unoccupied 2:10:16 East Kenefick Switch reverse, OS track unoccupied. (Train NP-01 was completely in the siding.) 2:10:19 East Kenefick Request normal switch for main track movement. 2:10:49 East Kenefick Switch normal (for main track movement). 2:10:49 East Kenefick Request eastbound signal for train ME-29. 2:11:02 East Kenefick Eastbound signal cleared. 2:12:02 West Kenefick West approach occupied by train ME-29. 2:15:03 West Kenefick Siding track occupied by train NP-01. (The train was approaching the west end of the track.) 2:15:08 West Kenefick Eastbound signal at stop, switch normal, OS track occupied by train ME-29. (The head end of train ME-29 passed the eastbound signal at the west end of Kenefick Siding.) 2:15:23 West Kenefick Westbound signal, main track, showed cleared.

42 Railroad Accident Report Appendix D Union Pacific’s 1998 Fatigue Program ALERTNESS MANAGEMENT PROGRAM ROLL-OUT PLAN This program represents an integrated and comprehensive effort to address the issues of fatigue and rest at the Union Pacific Railroad Company. The following components constitute the major activities for 1998:

1. Strategic, Operational, and Project Plans Development

This planning process is critical to assure the approach to managing employee fatigue and improving alertness is comprehensive and that the objectives of the program are met. Strategic, Operational and key project plans will be completed by June, 1998.

1. Crew Scheduling

The Crew Scheduling Project is a vehicle to implement fatigue management within the transportation craft. Listed below is a status report of the project. • Alertness Solutions is in the process of analyzing data in order to develop appropriate scheduling approaches for the corridor selected for the first pilot. • Initial contract negotiation discussions with the UTU and BLE [Brotherhood of Locomotive Engineers] begin 4/28/98. • Fatigue and alertness education efforts have begun with initial training for the involved union representatives, operating managers, and labor relations managers. • In June, 1998, educational efforts will continue with general education in a “townhall” meeting format for employees.

1. Education/Training and Communications

Education and training will be the foundation to all other projects in the overall program. • General fatigue education is currently being provided to operating employees in training sessions that coincide with bi-annual rules examinations. • General Awareness educational materials such as a video, brochures, and books should be available for use by mid summer, 1998.

1. Napping/Policy Implementation Project

The Napping/Policy Implementation Project will offer employees the opportunity to use a planned structured nap when operationally appropriate.

Appendix D 43 Railroad Accident Report • First pilot is currently underway on the St. Louis Service Unit. Evaluation of this pilot is scheduled for May and June of 1998. • 4 additional pilots are scheduled for mid-summer 1998. • Napping will also be included in any crew scheduling efforts.

1. Lodging Task Force

A Lodging Guidelines and Evaluation document has been developed which will be reviewed by this task force and plans for implementation will be developed. This team is currently being formed and an implementation plan should be completed by July, 1998. The following components of the program are currently in the developmental stages:

1. Minimum Rest and A.M. Mark-Up
2. Technology Implementation Project

A team will be formed to search out and analyze the use of products which could have an impact on fatigue and determine the feasible use of the products within the railroad environment.

1. Healthy Sleep Project

The Healthy Sleep Project will involve the identification and treatment of sleep complaints and disturbances among the Union Pacific workforce.

1. General Fatigue Countermeasures Project

The General Fatigue Countermeasures Project is a series of sub projects which will be developed within specific work groups that will address fatigue related issues and develop countermeasures.

1. Measurement Task Force

The Measurement Task Force will be responsible for determining appropriate measurements which will look at whether cultural changes are occurring, and the impact of fatigue on productivity.

1. Emergency Response Project

The Emergency Response Project will develop principles and guidelines to assist Union Pacific in developing policies and procedures for Emergency Response Teams.

44 Railroad Accident Report Abbreviations and Acronyms AAR Association of American Railroads ACS Automatic Cab Signal AMR American Medical Response ATCS Advanced Train Control System (another term for PTS) ATS Automatic Train Stop CAD computer-aided dispatching CFR Code of Federal Regulations COFC Container On Flat Car cp control point FRA Federal Railroad Administration GCOR General Code of Operating Rules GIS geographic information system HRA health risk appraisal ITCS Incremental Train Control System (another term for PTS) MARC Maryland Rail Commuter Mo99 molybdenum 99 MP milepost NASA National Aeronautics and Space Administration PTS positive train separation RSAC Railroad Safety Advisory Committee SCSD Shawnee County Sheriff’s Department SLT Senior level team TCS traffic control system TOFC trailer on flatcar UP Union Pacific

FD07221 ｜ 2000_美国_AAR0001.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

PB00-910401 ‘I NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 AIRCRAFT ACCIDENT REPORT CONTROLLED FLIGHT INTO TERRAIN KOREAN AIR FLIGHT 801 BOEING 747-300, HL7468 NIMITZ HILL, GUAM AUGUST 6, 1997 NTSB/AAR-00/01 DCA97MA058 6952B

National Transportation Safety Board. 2000. Controlled Flight Into Terrain, Korean Air Flight 801, Boeing 747-300, HL7468, Nimitz Hill, Guam, August 6, 1997. Aircraft Accident Report NTSB/AAR-00/01. Washington, DC. Abstract: This report explains the accident involving Korean Air flight 801, a Boeing 747-300, which crashed into high terrain at Nimitz Hill, Guam, on August 6, 1997. Safety issues in the report focus on flight crew performance, approach procedures, and pilot training; air traffic control, including controller performance and the inhibition of the minimum safe altitude warning system at Guam; emergency response; the adequacy of Korean Civil Aviation Bureau and Federal Aviation Administration oversight; and flight data recorder documentation. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration, the Governor of the Territory of Guam, and the Korean Civil Aviation Bureau. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB00-910401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

Aircraft Accident Report Controlled Flight Into Terrain Korean Air Flight 801 Boeing 747-300, HL7468 Nimitz Hill, Guam August 6, 1997 NTSB/AAR-00/01 PB00-910401 National Transportation Safety Board Notation 6952B 490 L’Enfant Plaza, S.W. Adopted January 13, 2000 Washington, D.C. 20594

this page intentionally left blank

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.3 The Flight Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.5.4 The Flight Attendants. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.5.5 The Air Traffic Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.5.5.1 Combined Center/Radar Approach Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.5.5.2 Air Traffic Control Tower . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.6.1 Maintenance Discrepancies Before the Accident Flight . . . . . . . . . . . . . . . . . . . . . 14 1.6.2 Cockpit Instrumentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.6.2.1 Autopilot System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.6.2.2 Ground Proximity Warning System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.6.2.3 Instrument Landing System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.6.3 Weight and Balance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.7.1 Weather Conditions at Guam International Airport. . . . . . . . . . . . . . . . . . . . . . . . . 20 1.7.2 Air Traffic Control Weather Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.7.3 Additional Weather Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.10.1 Air Traffic Control Services for Guam International Airport . . . . . . . . . . . . . . . . . 25 1.10.1.1 Combined Center/Radar Approach Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.10.1.2 Minimum Safe Altitude Warning System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.10.1.3 Air Traffic Control Tower . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.10.2 Instrument Landing System Ground-Based Equipment. . . . . . . . . . . . . . . . . . . . . . 31 1.10.3 Instrument Approach Procedures at Guam International Airport . . . . . . . . . . . . . . 32 1.10.3.1 The Nonprecision Runway 6L Instrument Landing System Localizer-only (Glideslope Out) Procedure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.10.3.2 Instrument Approach Charts for Guam International Airport . . . . . . . . . . . . . . . 33 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.11.1 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.11.2 Cockpit Voice Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Contents iv Aircraft Accident Report 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.12.1 General Wreckage Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.12.2 Fuselage and Empennage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.12.3 Wings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.12.4 Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.15.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.15.2 Survivor Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.15.3 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.15.3.1 Emergency Response Planning and Exercises. . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.15.4 Guam Governor’s Accident Response Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.16.1 Enhanced Ground Proximity Warning System Simulation . . . . . . . . . . . . . . . . . . . 49 1.16.2 Minimum Safe Altitude Warning System Simulation . . . . . . . . . . . . . . . . . . . . . . . 50 1.16.3 Korean Air Spurious Radio Signal Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.16.3.1 Guam Instrument Landing System and Potential Interference From Spurious Radio Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.17.1 Korean Air Postaccident Safety Initiatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.17.2 Korean Air Flight Crew Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.17.2.1 Basic and Advanced Instrument Flight Course . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.17.2.2 Boeing 747 Flight Crew Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.17.2.3 Crew Resource Management Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 1.17.2.4 Postaccident Changes to Flight Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 1.17.3 Korean Air Preflight Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 1.17.3.1 Supervisor of Flying Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 1.17.3.2 Airport Familiarization Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 1.17.4 Korean Air Descent and Approach Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.17.4.1 Briefing and Checklist Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.17.4.2 Flight Crew Actions and Callouts During Nonprecision Approaches. . . . . . . . . 64 1.17.4.3 Terrain Avoidance Recovery Maneuvers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.17.5 Korean Air Accident and Incident History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.17.5.1 1983 to 1997 Accident History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1.17.5.2 1998 and 1999 Accident and Incident History . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.17.6 Oversight of Korean Air. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.17.6.1 Korean Civil Aviation Bureau . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.17.6.1.1 Accident and Incident Investigation Authority . . . . . . . . . . . . . . . . . . . . . . . 73 1.17.6.2 Federal Aviation Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 1.17.6.2.1 International Aviation Safety Assessment Program . . . . . . . . . . . . . . . . . . . 75 1.17.6.3 Department of Transportation Audit Report on Aviation Safety Under International Code Share Agreements . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 1.18.1 Minimum Safe Altitude Warning System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 1.18.1.1 Postaccident Actions Taken by the Federal Aviation Administration. . . . . . . . . 81 1.18.1.2 Previous Safety Board Recommendations on the Minimum Safe Altitude Warning System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 1.18.2 Traditional and Enhanced Ground Proximity Warning Systems. . . . . . . . . . . . . . . 93 1.18.2.1 Traditional Ground Proximity Warning System . . . . . . . . . . . . . . . . . . . . . . . . . 93

Contents v Aircraft Accident Report 1.18.2.2 Enhanced Ground Proximity Warning System . . . . . . . . . . . . . . . . . . . . . . . . . . 94 1.18.2.2.1 Notice of Proposed Rulemaking for Enhanced Ground Proximity Warning Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 1.18.2.3 Department of Transportation Studies on Traditional and Enhanced Ground Proximity Warning Systems . . . . . . . . . . . . . . . . . . . . . . . . . 95 1.18.2.4 Previous Safety Board Recommendations on Traditional and Enhanced Ground Proximity Warning Systems . . . . . . . . . . . . . . . . . . . . . . . . . 96 1.18.3 Controlled Flight Into Terrain Accident Information . . . . . . . . . . . . . . . . . . . . . . 103 1.18.3.1 Flight Safety Foundation Study of Controlled Flight Into Terrain Accidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1.18.3.2 Factors Involved in Recent Controlled Flight Into Terrain Accidents and Incidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 1.18.3.3 Controlled Flight Into Terrain Training Aids . . . . . . . . . . . . . . . . . . . . . . . . . . 107 1.18.3.4 Previous Safety Board Recommendations Related to Controlled Flight Into Terrain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 1.18.3.5 Previous Controlled Flight Into Terrain Accidents Related to Nonprecision Instrument Approach Procedures . . . . . . . . . . . . . . . . . . . . . . . . 113 1.18.4 Industry Actions to Improve the Safety of Nonprecision Instrument Approaches Conducted by Air Carriers. . . . . . . . . . . . . . . . . . . . . . . . 114 1.18.4.1 Nonprecision Approach Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 1.18.4.2 Approach Chart Terrain Depiction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 1.18.4.3 Federal Aviation Administration Form 8260. . . . . . . . . . . . . . . . . . . . . . . . . . . 116 1.18.4.4 Previous Safety Board Recommendations Related to Approach Procedure Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 1.18.5 Flight Crew Decision-making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 1.18.5.1 Safety Board Study of Flight Crew Involvement in Major Accidents. . . . . . . . 120 1.18.5.2 Previous Safety Recommendations on Flight Crew Decision-making . . . . . . . 122 1.18.5.3 National Aeronautics and Space Administration’s Flight Crew Decision-making Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 1.18.6 Previous Fatigue-Related Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 1.18.6.1 Previous Safety Recommendations Regarding Fatigue. . . . . . . . . . . . . . . . . . . 128 1.18.7 Flight Data Recorder Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 1.18.7.1 Previous Safety Board Recommendations on Flight Data Recorder Parameter Verification and Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 1.18.7.1.1 Digital Flight Data Recorder Advisory Circular . . . . . . . . . . . . . . . . . . . . . 132 1.18.7.2 International Guidance Regarding the Documentation of Flight Data Recorder Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 1.18.8 Special Airport Criteria and Designation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 2.2 Weather Factors on the Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 2.3 Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 2.3.1 Description of the Approach and Required Flight Crew Procedures. . . . . . . . . . . 136 2.3.2 Flight 801’s Premature Descent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 2.4 Flight Crew Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 2.4.1 The Captain’s Performance of the Approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 2.4.1.1 Approach Briefing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Contents vi Aircraft Accident Report 2.4.1.2 Expectation of a Visual Approach and Role of the Guam Airport Familiarization Video . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 2.4.1.3 Possible Explanations for the Approach Conducted . . . . . . . . . . . . . . . . . . . . . 142 2.4.1.3.1 Confusion About Status of Glideslope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 2.4.1.3.2 Confusion About Location of DME . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 2.4.1.4 Summary of Captain’s Performance on the Approach . . . . . . . . . . . . . . . . . . . 145 2.4.2 Flight Crew Monitoring of the Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 2.4.3 Flight Crew Fatigue Factors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.5 Pilot Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 2.6 Air Traffic Control Factors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 2.6.1 Controller Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 2.6.2 Intentional Inhibition of the Minimum Safe Altitude Warning System at Guam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 2.7 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 2.8 Controlled Flight Into Terrain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 2.8.1 Constant Angle of Descent Nonprecision Approaches . . . . . . . . . . . . . . . . . . . . . 161 2.8.2 Safety Aspects of Enhanced Ground Proximity Warning Systems . . . . . . . . . . . . 162 2.8.3 Terrain Depiction on Approach Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 2.8.4 User Review of Instrument Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 2.9 Oversight Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.9.1 Korean Air . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.9.2 Korean Civil Aviation Bureau Oversight of Korean Air . . . . . . . . . . . . . . . . . . . . 166 2.9.3 Federal Aviation Administration Oversight of Korean Air and Assessment of Korean Civil Aviation Bureau. . . . . . . . . . . . . . . . . . . . . . . . . 167 2.9.3.1 Independent Accident Investigation Authority . . . . . . . . . . . . . . . . . . . . . . . . . 169 2.10 Flight Data Recorder Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

1. Conclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
2. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

A: Investigation and Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 C: Flight Safety Foundation Study Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Contents vii Aircraft Accident Report Figures

1. Instrument approach chart for the Guam International Airport

runway 6L ILS procedure.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1. Side view of FAA radar data with selected ATC

and CVR communication excerpts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1. Overhead view of FAA radar data with selected ATC

and CVR communication excerpts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1. Captain’s instrumentation panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2. First officer’s instrumentation panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3. WSR-88D four-panel base reflectivity product for Guam. . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4. The January 19, 1996, 11-1 ILS runway 6L instrument approach chart. . . . . . . . . . . . . . . . 35

8a. Wreckage from Korean Air flight 801 in relation to Guam International Airport runway 6L, the NIMITZ VOR, and Apra Harbor. . . . . . . . . . . 38 8b. Closer view of the wreckage from Korean Air flight 801 and the NIMITZ VOR.. . . . . . . . 39

1. Korean Air flight 801 cabin configuration and survivor seat locations. . . . . . . . . . . . . . . . . 44
2. Vertical profile information from the 40 CFIT accidents

and incidents between 1986 and 1990. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Tables

1. Injury chart. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2. Information differences between the January 19 and August 2, 1996,

Guam ILS runway 6L approach charts.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

1. Loss totals and rates for the 10-year period ending December 31, 1998,

by losses per 1 million departures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

1. Distribution of errors identified in the 37 accidents reviewed

in the Safety Board’s 1994 safety study. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

viii Aircraft Accident Report Abbreviations AC advisory circular ADF automatic direction finder ADI attitude director indicator AFB Air Force Base agl above ground level AIG Accident Investigation Group ALA approach and landing accident ALPA Air Line Pilots Association ARFF aircraft rescue and firefighting ARTS Automated Radar Terminal System ASR Airport Surveillance Radar ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service ATP airline transport pilot CAA civil aviation authority CAMI Civil Aeromedical Institute CDI course deviation indicator CERAP Combined Center/Radar Approach Control CFIT controlled flight into terrain CFR Code of Federal Regulations CRM crew resource management CVR cockpit voice recorder D-BRITE digital bright radar indicator tower equipment DFDR digital flight data recorder DH decision height DME distance measuring equipment DOD Department of Defense DOT Department of Transportation DOT/IG Department of Transportation Office of Inspector General EARTS En route Automated Radar Tracking System EMT emergency management technician EU European Union FAA Federal Aviation Administration FAF final approach fix FAR Federal Aviation Regulation FD flight director FDAU flight data acquisition unit FDR flight data recorder F/E flight engineer FMA flight mode annunciator

Abbreviations ix Aircraft Accident Report FMS flight management system FSF Flight Safety Foundation GCD Guam Civil Defense GFD Guam Fire Department GPS global positioning system GPWS ground proximity warning system GS glideslope HAT height above touchdown Hg Mercury HSI horizontal situation indicator Hz Hertz IAF initial approach fix IASA International Aviation Safety Assessment ICAO International Civil Aviation Organization IFR instrument flight rules ILS instrument landing system IMC instrument meteorological conditions IOE initial operational experience KCAB Korean Civil Aviation Bureau kg kilogram LOC localizer LOFT line-oriented flight training MAP missed approach point MDA minimum descent altitude MHz megahertz MOCT Ministry of Construction and Transport MOU memorandum of understanding MSAW minimum safe altitude warning msl mean sea level NASA National Aeronautics and Space Administration NDB nondirectional beacon nm nautical mile NOTAM Notice to Airmen NPRM notice of proposed rulemaking NWS National Weather Service OSC on-scene commander OST Office of the Secretary of Transportation PAPI precision approach path indicator PF pilot flying PIC pilot-in-command PNF pilot not flying POI principal operations inspector

Abbreviations x Aircraft Accident Report SIGMET Significant Meteorological Information SOF supervisor of flying SOP standard operating procedure STAR standard terminal arrivals STARS Standard Terminal Automation Replacement System TACAN tactical air control and navigation TAESA Transportes Aereos Ejecutivos, S.A. TAF terminal aerodrome forecast TAWS terrain awareness and warning system TCAS traffic alert and collision avoidance system TERPS Terminal Instrument Procedures TOD top of descent TRACON terminal radar approach control TSA time since awakening TSO technical standard order UTC coordinated universal time VASI visual approach slope indicator VFR visual flight rules VHF very high frequency VMC visual meteorological conditions VNAV vertical navigation VOR very high frequency omnidirectional radio range WSR-88D Weather Surveillance Radar-1988, Doppler

xi Aircraft Accident Report Executive Summary On August 6, 1997, about 0142:26 Guam local time, Korean Air flight 801, a Boeing 747-3B5B (747-300), Korean registration HL7468, operated by Korean Air Company, Ltd., crashed at Nimitz Hill, Guam. Flight 801 departed from Kimpo International Airport, Seoul, Korea, with 2 pilots, 1 flight engineer, 14 flight attendants, and 237 passengers on board. The airplane had been cleared to land on runway 6 Left at A.B. Won Guam International Airport, Agana, Guam, and crashed into high terrain about 3 miles southwest of the airport. Of the 254 persons on board, 228 were killed, and 23 passengers and 3 flight attendants survived the accident with serious injuries. The airplane was destroyed by impact forces and a postcrash fire. Flight 801 was operating in U.S. airspace as a regularly scheduled international passenger service flight under the Convention on International Civil Aviation and the provisions of 14 Code of Federal Regulations Part 129 and was on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable cause of the Korean Air flight 801 accident was the captain’s failure to adequately brief and execute the nonprecision approach and the first officer’s and flight engineer’s failure to effectively monitor and cross-check the captain’s execution of the approach. Contributing to these failures were the captain’s fatigue and Korean Air’s inadequate flight crew training. Contributing to the accident was the Federal Aviation Administration’s (FAA) intentional inhibition of the minimum safe altitude warning system (MSAW) at Guam and the agency’s failure to adequately manage the system. The safety issues in this report focus on flight crew performance, approach procedures, and pilot training; air traffic control, including controller performance and the intentional inhibition of the MSAW system at Guam; emergency response; the adequacy of Korean Civil Aviation Bureau (KCAB) and FAA oversight; and flight data recorder documentation. Safety recommendations concerning these issues are addressed to the FAA, the Governor of the Territory of Guam, and the KCAB.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On August 6, 1997, about 0142:26 Guam local time,1 Korean Air flight 801, a Boeing 747-3B5B (747-300), Korean registration HL7468, operated by Korean Air Company, Ltd., crashed at Nimitz Hill, Guam.2 Flight 801 departed from Kimpo International Airport, Seoul, Korea, with 2 pilots, 1 flight engineer, 14 flight attendants, and 237 passengers3 on board. The airplane had been cleared to land on runway 6 Left at A.B. Won Guam International Airport, Agana, Guam, and crashed into high terrain about 3 miles southwest of the airport. Of the 254 persons on board, 228 were killed,4 and 23 passengers and 3 flight attendants survived the accident with serious injuries.5 The airplane was destroyed by impact forces and a postcrash fire. Flight 801 was operating in U.S. airspace as a regularly scheduled international passenger service flight under the Convention on International Civil Aviation and the provisions of 14 Code of Federal Regulations (CFR) Part 129 and was on an instrument flight rules (IFR) flight plan. According to Korean Air company records, the flight crew arrived at the dispatch center in the Korean Air headquarters building in Seoul about 2 hours before the scheduled departure time of 2105 (2005 Seoul local time) on August 5, 1997. The original flight plan for flight 801 listed a different captain’s name. The captain aboard the accident flight had initially been scheduled to fly to Dubai, United Arab Emirates; however, because the accident captain did not have adequate rest for that trip, he was reassigned the shorter trip to Guam.6 According to Korean Air personnel, the flight crewmembers collected the trip paperwork, conducted a self-briefing, and received a briefing from the assigned supervisor of flying (SOF).7 Flight 801 departed the gate about 2127 and was airborne about 2153. 1 Unless otherwise indicated, all times are Guam local time, based on a 24-hour clock. 2 The island of Guam is a U.S. territory in the Pacific Ocean and is part of the Mariana Islands. Guam has an elected governor and a 21-member unicameral legislature. U.S. Naval and Air Force installations make up 35 percent of the island’s area. 3 Six of the passengers were Korean Air flight attendants who were “deadheading,” that is, traveling off duty. 4 Three passengers (including one deadheading flight attendant) initially survived the accident with serious injuries but died within 30 days after the accident. According to 14 Code of Federal Regulations (CFR) Section 830.2, such fatalities are to be included in the total number of fatal injuries. A passenger with serious injuries died at the U.S. Army Medical Center in San Antonio, Texas, on October 10, 1997, but is not officially listed as a fatality because the passenger’s death occurred more than 30 days after the accident. 5 See table 1 in section 1.2 for the injury chart. 6 The captain began a scheduled round trip to Hong Kong on August 3, 1997, but his return flight was delayed because of inclement weather. As a result, the captain had to remain overnight in Hong Kong and fly back to Seoul (as a pilot) on the morning of August 4. 7 The self- and SOF briefings are required parts of Korean Air’s flight crew predeparture procedures. See section 1.17.3 for additional information.

Factual Information 2 Aircraft Accident Report According to the cockpit voice recorder (CVR), the captain was performing the pilot- flying (PF) duties, and the first officer was performing the pilot-not-flying (PNF) duties. Upon arrival to the Guam area, the first officer made initial contact with the Federal Aviation Administration’s (FAA) Guam Combined Center/Radar Approach Control (CERAP) controller about 0103:18, when the airplane was level at 41,000 feet mean sea level (msl) and about 240 nautical miles (nm) northwest of the NIMITZ VOR/DME.8 About 0105:00, the CERAP controller told flight 801 to expect to land on runway 6L, and the first officer acknowledged the transmission. About 0110:00, the controller instructed flight 801 to “…descend at your discretion maintain two thousand six hundred [feet msl].” The first officer responded, “…descend two thousand six hundred pilot discretion.” About 0111:51, the CVR9 recorded the captain briefing the first officer and the flight engineer about the approach and landing at Guam. The captain stated: I will give you a short briefing…ILS [instrument landing system10] is one one zero three…NIMITZ VOR is one one five three, the course zero six three, since the visibility is six, when we are in the visual approach, as I said before, set the VOR on number two and maintain the VOR for the TOD [top of descent],11 I will add three miles from the VOR, and start descent when we’re about one hundred fifty five miles out. I will add some more speed above the target speed. Well, everything else is all right. In case of go-around, since it is VFR [visual flight rules], while staying visual and turning to the right…request a radar vector…if not, we have to go to FLAKE12…since the localizer glideslope is out,13 MDA [minimum descent altitude] is five hundred sixty feet and HAT [height above touchdown] is three hundred four feet…. About 0113:33, the CVR recorded the captain saying, “we better start descent;” shortly thereafter, the first officer advised the controller that flight 801 was “leaving four one zero for two thousand six hundred.” The controller acknowledged the transmission. The CVR recorded the captain making several remarks related to crew scheduling and rest issues. About 0120:01, the captain stated, “if this round trip is more than a nine hour trip, we might get a little something…with eight hours, we get nothing…eight hours 8 VOR/DME stands for very high frequency omnidirectional radio range/distance measuring equipment. DME is expressed in miles. 9 Appendix B contains the CVR transcript. The transcript expresses the times of the CVR comments and sounds in coordinated universal time (UTC). Guam local time is 10 hours ahead of UTC time. 10 The ILS is a precision approach system that provides lateral guidance (localizer) and vertical alignment (glideslope) with the runway. The system uses ground-based radio transmitters that provide both the localizer and the glideslope signals. See sections 1.6.2.3 and 1.10.2 for additional information. 11 TOD is the departing cruise altitude. 12 The FLAKE intersection is 7 DME from the NIMITZ VOR and is on the 242° radial. An intersection can be defined by the crossing of two radials or by a specific distance on a bearing from a navigational aid. 13 An ILS approach can either be flown as a “full ILS” precision approach or a localizer-only, nonprecision approach. The criteria for both approaches are often presented on the same chart. For information on how the accident flight crew was to execute the nonprecision, localizer-only approach for runway 6L, see section 1.10.3.1.

Factual Information 3 Aircraft Accident Report do not help us at all.”14 The captain also stated that “they make us work to maximum, up to maximum….” About 0120:28, the captain further stated, “probably this way [unintelligible words], hotel expenses will be saved for cabin crews, and maximize the flight hours. Anyway, they make us [747] classic guys work to maximum.”15 About 0121:13, the captain stated, “eh…really…sleepy.” About 0121:59, the first officer stated, “captain, Guam condition is no good.” About 0122:06, the CERAP controller informed the flight crew that the automatic terminal information service (ATIS) information Uniform16 was current and that the altimeter setting was 29.86 inches of mercury (Hg). About 0122:11, the first officer responded, “Korean eight zero one is checked uniform;” his response did not acknowledge the altimeter setting. About 0122:26, the captain stated, “uh…it rains a lot.” About 0123:45, the captain stated, “request twenty miles deviation later on…to the left as we are descending.” About 0124:02, the first officer questioned, “don’t you think it rains more? in this area, here?” The captain then stated, “left, request deviation” and “one zero mile.” About 0124:30, the controller approved the first officer’s request to deviate “…one zero mile left of track [for weather].” The CVR then recorded about 6 minutes of discussion among the flight crew regarding the weather conditions and the deviation around the weather. About 0126:25, the flight engineer stated, “it’s Guam, Guam.” About 0131:17, the first officer reported to the CERAP controller that the airplane was “…clear of Charlie Bravo [cumulonimbus clouds]” and requested “radar vectors for runway six left.” The controller instructed the flight crew to fly a heading of 120°. After this transmission, the flight crew performed the approach checklist and verified the radio frequency for the ILS to runway 6L. About 0138:49, the CERAP controller instructed flight 801 to “…turn left heading zero nine zero join localizer;” the first officer acknowledged this transmission. At that time, flight 801 was descending through 2,800 feet msl with the flaps extended 10° and the landing gear up. About 0139:30, the first officer said, “glideslope [several unintelligible words]...localizer capture [several unintelligible words]...glideslope...did.” About 0139:44, the controller stated, “Korean Air eight zero one cleared for ILS runway six left approach…glideslope unusable.”17 The first officer responded, “Korean eight zero one roger…cleared ILS runway six left;” his response did not acknowledge that the glideslope was unusable. 14 The accident flight was scheduled to remain on the ground at Guam for 3 ½ hours and then return to Seoul at 0930 (0830 Seoul local time). 15 In the aviation industry, a “747 classic” refers to the -100, -200, -300, and -SP (special purpose) models of the Boeing 747 airplane. Classic 747s have three crewmember seats and mostly analog (mechanical) gauges. 16 ATIS information Uniform noted the Notice to Airmen (NOTAM) for runway 6L, which stated that the ILS glideslope was “out of service until further notice.” See section 1.7.1. 17 The CERAP controller did not advise the flight crew of its position. FAA Order 7110.65, “Arrival Instructions,” section 5-9-4, paragraph (a) states that a controller is to provide the flight crew with a “position relative to a fix on the final approach course. If none is portrayed on the radar display or if none is prescribed in the procedure, issue position information relative to the navigation aid which provides final approach guidance or relative to the airport.”

Factual Information 4 Aircraft Accident Report According to the CVR, about 0139:55 the flight engineer asked, “is the glideslope working? glideslope? yeh?” One second later, the captain responded, “yes, yes, it’s working.” About 0139:58, an unidentified voice in the cockpit stated, “check the glideslope if working?” This statement was followed 1 second later by an unidentified voice in the cockpit asking, “why is it working?” About 0140:00, the first officer responded, “not useable.” About 0140:06, the CVR recorded the sound of the altitude alert system18 chime. According to information from the flight data recorder (FDR), the airplane began to descend about 0140:13 from an altitude of 2,640 feet msl at a point approximately 9 nm from the runway 6L threshold (5.7 nm from the NIMITZ VOR). About 0140:22, an unidentified voice in the cockpit said, “glideslope is incorrect.” About 0140:33, as the airplane was descending through 2,400 feet msl, the first officer stated, “approaching fourteen hundred [feet].” About 4 seconds later, when the airplane was about 8 nm from the runway 6L threshold, the captain stated, “since today’s glideslope condition is not good, we need to maintain one thousand four hundred forty [feet]. please set it.” An unidentified voice in the cockpit then responded, “yes.” About 0140:42, the CERAP controller instructed flight 801 to contact the Agana control tower; the first officer acknowledged the frequency change. The first officer contacted the Agana tower about 0140:55 and stated, “Korean air eight zero one intercept the localizer six left.” Shortly after this transmission, the CVR again recorded the sound of the altitude alert chime, and the FDR data indicated that the airplane was descending below 2,000 feet msl at a point 6.8 nm from the runway threshold (3.5 nm from the VOR). About 0141:01, the Agana tower controller cleared flight 801 to land. About 0141:14, as the airplane was descending through 1,800 feet msl, the first officer acknowledged the landing clearance, and the captain requested 30° of flaps. No further communications were recorded between flight 801 and the Agana control tower. About 0141:31, the first officer called for the landing checklist. About 0141:33, the captain said, “look carefully” and “set five hundred sixty feet” (the published MDA). The first officer replied “set,” the captain called for the landing checklist, and the flight engineer began reading the landing checklist. About 0141:42, as the airplane descended through 1,400 feet msl, the CVR recorded the sound of the ground proximity warning system (GPWS)19 radio altitude callout “one thousand [feet].” One second later, the captain stated, “no flags gear and flaps,” to which the flight engineer responded, “no flags gear and flaps.” About 0141:46, the captain asked, “isn’t glideslope working?” There was no indication on the CVR that the first officer and flight engineer responded to the this question. About 0141:48, the captain stated, “wiper on.”20 About 0141:53, the CVR recorded the sound of the windshield wipers starting. The windshield wipers remained on throughout the remainder of the flight. 18 The altitude alert system provides visual and aural signals when approaching or deviating from the selected altitude. See section 1.6.2.1 for more information. 19 A GPWS is designed to provide the flight crew with visual and aural warnings when proximity to terrain, closure rate, descent rate, bank angle, and glideslope deviation become excessive. For more information, see sections 1.6.2.2 and 1.18.2.

Factual Information 5 Aircraft Accident Report About 0141:53, the first officer again called for the landing checklist, and the flight engineer resumed reading the checklist items. About 0141:59, when the airplane was descending through 1,100 feet msl at a point about 4.6 nm from the runway 6L threshold (approximately 1.3 nm from the VOR), the first officer stated “not in sight?” One second later, the CVR recorded the GPWS radio altitude callout of “five hundred [feet].” According to the CVR, about 2 seconds later the flight engineer stated “eh?” in an astonished tone of voice. About 0142:05, the captain and flight engineer continued the landing checklist. About 0142:14, as the airplane was descending through 840 feet msl and the flight crew was performing the landing checklist, the GPWS issued a “minimums minimums” annunciation followed by a “sink rate” alert21 about 3 seconds later. The first officer responded, “sink rate okay” about 0142:18; FDR data indicated that the airplane was descending 1,400 feet per minute at that time. About 0142:19, as the airplane descended through 730 feet msl, the flight engineer stated, “two hundred [feet],” and the first officer said, “let’s make a missed approach.” About 1 second later, the flight engineer stated, “not in sight,” and the first officer said, “not in sight, missed approach.” About 0142:22, as the airplane descended through approximately 680 feet msl, the FDR showed that the control column position began increasing (nose up) at a rate of about 1° per second, and the CVR indicated that the flight engineer stated, “go around.” When the captain stated “go around” about 1 second later, the airplane’s engine pressure ratios and airspeed began to increase. However, the rate of nose-up control column deflection remained about 1° per second. At 0142:23.77, as the airplane descended through 670 feet msl, the CVR recorded the sound of the autopilot disconnect warning. At 0142:24.05, the CVR began recording sequential GPWS radio altitude callouts of “one hundred…fifty…forty…thirty…twenty [feet].” About 0142:26, the airplane impacted hilly terrain at Nimitz Hill, Guam, about 660 feet msl and about 3.3 nm from the runway 6L threshold. FDR data indicated that, at the time of initial ground impact, the pitch attitude of the airplane was increasing through 3°. The accident occurred at 13° 27.35 minutes north latitude and 144° 43.92 minutes east longitude during the hours of darkness. The CVR stopped recording about 0142:32. Figure 1 shows the instrument approach chart for the Guam runway 6L ILS procedure that was in effect at the time of the accident. Figures 2 and 3 show FDR information for the last 5 ½ minutes of flight, along with CVR comments and sounds and air traffic control (ATC) data. 20 According to FAA radar data and CVR information, the captain’s call for the windshield wipers to be activated occurred when the airplane was in the vicinity of the outer marker, which was located 1.6 DME from the NIMITZ VOR. 21 This alert occurs when the GPWS computer determines that the barometric sink rate of the airplane, beginning at 2,450 feet above ground level (agl), exceeds the designed threshold sink rate value. The threshold value for approximately 200 feet agl is 1,200 feet per minute.

Factual Information 6 Aircraft Accident Report Figure 1. Instrument approach chart for the Guam International Airport runway 6L ILS procedure. Reproduced with the permission of Jeppesen Sanderson, Inc. NOT TO BE USED FOR NAVIGATION.

Factual Information 7 Aircraft Accident Report Note: Only selected CVR excerpts are shown. Appendix B contains a complete record of all CVR information and a legend of ATC abbreviations. Figure 2. Side view of FAA radar data with selected ATC and CVR communication excerpts.

Factual Information 8 Aircraft Accident Report Note: Only selected CVR excerpts are shown. Appendix B contains a complete record of all CVR information and a legend of ATC abbreviations. Figure 3. Overhead view of FAA radar data with selected ATC and CVR communication excerpts.

Factual Information 9 Aircraft Accident Report 1.2 Injuries to Persons 1.3 Damage to Airplane The airplane was destroyed by impact forces and a postcrash fire. The estimated value of the airplane was about $60 million. 1.4 Other Damage The accident caused extensive ground scarring and fire damage to trees and foliage along the wreckage path and in the immediate vicinity of the main wreckage area. Also, a 12-inch fuel oil pipeline located along a vehicle access road that services the NIMITZ VOR was severed when it was struck by the airplane. The severed pipeline spilled about 1,000 gallons of oil in a localized area. 1.5 Personnel Information 1.5.1 The Captain The captain, age 42, was hired by Korean Air on November 2, 1987. He was previously a pilot in the Republic of Korea Air Force. He held an Airline Transport Pilot (ATP) certificate issued by the Korean Ministry of Construction and Transport (MOCT)22 on April 19, 1992, with type ratings in the Boeing 727 and 747. The captain qualified as a 727 first officer on December 19, 1988, and as a 747 first officer on February 13, 1991. He upgraded to 727 captain on December 27, 1992, and 747 captain on August 20, 1995. The Table 1. Injury chart. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 3 11 214 0 228 Serious 0 3 23 0 26 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 3 14 237 0 254 22 The Korean MOCT is similar in function to the U.S. Department of Transportation (DOT). The Korean Civil Aviation Bureau (KCAB), a division within the MOCT, is responsible for overseeing the Korean civil airlines. For more information on the KCAB, see section 1.17.6.1.

Factual Information 10 Aircraft Accident Report captain held Korean and FAA First Class Airman Medical certificates, both issued on March 13, 1997, without limitations. According to Korean Air records, the captain had accumulated a total of 8,932 hours of flight time, 2,884 hours as a military pilot and 6,048 hours as a civilian pilot. He had logged a total of 1,474 and 1,718 hours as a 747 first officer and captain, respectively. Also, Korean Air’s 747 chief pilot stated, in a postaccident interview, that the captain had received a Flight Safety Award in May 1997 from the company president for successfully handling an in-flight emergency involving a 747 engine failure at a low altitude. The captain had flown 235, 144, 90, and 17 hours in the last 90, 60, 30, and 7 days, respectively, before the accident. Between December 1992 and August 1993, he had flown from Seoul to Guam eight times as a 727 captain. In addition, he had flown from Seoul to Guam as a 747 captain on July 4, 1997 (about 1 month before the accident). National Transportation Safety Board investigators interviewed the first officer from the July 4, 1997, flight. That first officer stated that the captain had contacted him by telephone 1 day before the trip and proposed that they obtain a charter briefing for Guam because they did not regularly conduct 747 operations at that airport. Consequently, the captain and first officer arrived several hours before the trip departure time and received a charter briefing from a Korean Air instructor, even though the briefing was not required. The captain and first officer watched the Guam airport familiarization video presentation23 and studied the approach charts for the airport. During that time, the captain commented that the area where the NIMITZ VOR is located was mountainous and required extra attention (referring to this area as a “black hole”). The first officer said the trip to Guam was routine and that the weather was good, with scattered cumulous clouds and good visibility at the airport. Further, the first officer said that the captain briefed and executed the ILS 6L approach to a routine landing.24 The captain’s last route check was on a round trip flight from Seoul to Narita, Japan, on July 19, 1997. A company check airman told Safety Board investigators that, although the weather conditions at Narita and Seoul were above instrument approach minimums, the captain executed the full ILS approach to each airport and received an “above standard” evaluation for the flights. The captain’s last proficiency check was conducted in a Korean Air 747 simulator on June 11, 1997. According to Korean Air, the captain executed a nonprecision VOR/DME approach to runway 32L at Kimpo Airport during the proficiency check. The simulated weather conditions for the approach were 900 feet overcast and winds 290° at 11 knots. The captain received an “excellent” evaluation. A Korean Air representative told Safety Board investigators that the captain had passed the company’s Level 3 Pilot English Test25 and had attended crew resource 23 For information on Korean Air’s airport familiarization video presentation program, see section 1.17.3.2. 24 The first officer from the July 4, 1997, trip to Guam also indicated that the captain had used the ground time between that flight and the return trip to sleep in a seat in the first class compartment. 25 Korean Air’s Level 3 Pilot English Test comprises written, listening, and oral sections. An ATC- related part in the listening section “tests correct understanding and proper usage of ATC transmissions, ATIS broadcasts, [and] ATC terminology/phraseology.” All Korean Air pilots are required to pass this test.

Factual Information 11 Aircraft Accident Report management (CRM) training from October 24 to 27, 1989. The captain had not flown with the flight 801 first officer before the accident flight. Korean Air records indicated that the captain flew a round trip flight sequence from Seoul to San Francisco, California, from July 28 to July 30, 1997. He was off-duty until August 2, when he flew two round trip domestic flights between the hours of 1100 and 2000.26 On August 3, the captain flew an international trip to Hong Kong that arrived in the early evening. The return flight was delayed because of inclement weather. The captain remained in Hong Kong overnight and flew back to Seoul the next morning, arriving about 1230. After the accident, the captain’s wife told Safety Board investigators, through a family representative, that the captain normally awoke between 0600 and 0630 and went to bed between 2200 and 2300. She stated that, on August 2, the captain awoke between 0600 and 0630 and went to bed about 2300. On August 3, the captain awoke about 0630 for the trip to Hong Kong and remained there overnight. The captain’s wife stated that, after arriving home on August 4 from the trip, he was involved in routine activities and went to bed at his accustomed time. According to the captain’s wife, on August 5, he awoke at 0600, worked out in a gym for an hour and returned home for breakfast. He later studied the flight schedule for the trip to Guam, took a nap from 1100 to 1340, and then ate lunch. She also stated that the captain departed for the 20-minute drive to Kimpo Airport about 1500 and that the captain had left early to allow time to prepare for the flight to Guam. 1.5.2 The First Officer The first officer, age 40, was hired by Korean Air on January 10, 1994. He was previously a pilot in the Republic of Korea Air Force. He held an ATP certificate issued by the FAA on July 10, 1994, and a Korean ATP certificate issued by the MOCT on March 28, 1997. He received a 747 type rating on March 11, 1995, and qualified as a 747 first officer on July 23, 1995. The first officer held Korean and FAA First Class Airman Medical certificates, both issued on June 13, 1997, with no limitations. According to company records, the first officer had accumulated a total of 4,066 hours of flight time, 2,276 hours as a military pilot and 1,790 hours as a civilian pilot. He had logged a total of 1,560 hours as a 747 first officer. The first officer had flown 189, 132, 67, and 20 hours in the last 90, 60, 30, and 7 days, respectively, before the accident. The first officer had flown from Seoul to Guam in August and September 1995 as a 747 first officer. According to company records, he viewed the Guam airport familiarization video on July 8, 1997, in preparation for a future flight to Guam. The first officer’s last route check was conducted in July 1995. The first officer’s last proficiency check was conducted in a Korean Air 747 simulator on March 28, 1997. During the proficiency check, the first officer executed a nonprecision VOR/DME approach to runway 32L at Kimpo Airport. The simulated weather conditions for the 26 The times in sections 1.5.1 through 1.5.3 are expressed in Seoul local time, based on a 24-hour clock.

Factual Information 12 Aircraft Accident Report approach were clouds 900 feet broken and winds 260° at 11 knots. An instructor noted, in an overall simulator session evaluation, that the first officer’s “control skills and knowledge [were] above standard.” The first officer received a “standard” evaluation for his nonprecision VOR approaches. However, the instructor noted that the “altitude management on nonprecision approach [was] somewhat less than desirable.” Another instructor noted that the first officer was “somewhat slow to carry out directions.” According to Korean Air records, the first officer had passed the Level 3 Pilot English Test but had not attended CRM training. Korean Air records indicated that the first officer returned from an international trip to the United States on the afternoon of August 2, 1997. He was off-duty on August 3 and flew a round trip domestic flight on August 4, 1997, between 0930 and 1245. The first officer was then off-duty until the accident flight. Safety Board investigators interviewed the first officer’s relatives after the accident. They stated that he telephoned his mother about 1700 on August 5 and that “everything seemed routine.” Because his family lived in New Zealand, the first officer’s relatives could not be specific about his activities before the accident flight. 1.5.3 The Flight Engineer The flight engineer, age 57, was hired by Korean Air on May 7, 1979. He was previously a navigator in the Republic of Korea Air Force. He obtained his flight engineer’s certificate on December 29, 1979, and was qualified on the Boeing 727 and 747 and Airbus A300 airplanes. The flight engineer held a Korean First Class Airman Medical Certificate issued on June 5, 1997. According to company records, the flight engineer had accumulated a total of 13,065 hours of flight time, including 11,088 hours as a flight engineer (1,573 hours of which were as a flight engineer on the 747). Korean Air records also indicated that the flight engineer had flown 165, 120, 77, and 28 hours in the last 90, 60, 30, and 7 days, respectively, before the accident. The flight engineer’s last two route checks were in April 1997. He received an “above standard” evaluation for the first route check and an “excellent” evaluation for the second route check. The flight engineer’s last proficiency check was in a Korean Air 747 simulator on March 7, 1997. He received an “above standard” evaluation for the session, and an instructor note stated, “control skills and knowledge are above standard.” The flight engineer’s crew coordination was also rated as “above standard.” According to Korean Air records, the flight engineer passed the Level 3 Pilot English Test and attended CRM training from April 28 to May 1, 1987. A Korean Air official indicated that the flight engineer had never flown to Guam. The flight engineer had returned to Seoul on August 3, 1997, after completing a 3-day international trip to Anchorage, Alaska, and San Francisco. Although he was off- duty on August 4 and was assumed to have engaged in routine activities at home, the flight engineer’s wife and son could not provide Safety Board investigators with details of his activities or sleep patterns before the accident flight.

Factual Information 13 Aircraft Accident Report 1.5.4 The Flight Attendants Fourteen flight attendants were working on the accident flight. The lead flight attendant (or purser), age 37, had been hired by Korean Air on July 18, 1988. According to company records, the purser had completed her basic training on August 28, 1988, and her most recent recurrent training was completed on December 10, 1996. One flight attendant, age 43, was hired by Korean Air in August 1981; the other 12 flight attendants, ranging in age from 21 to 25, were hired between November 1992 and March 1997. According to company records, all had completed their basic training, and their most recent recurrent training was completed between June 1996 and April 1997. 1.5.5 The Air Traffic Controllers 1.5.5.1 Combined Center/Radar Approach Control The CERAP controller, age 39, was hired by the FAA on May 30, 1982, in Los Angeles, California, and initially qualified as a terminal radar approach control (TRACON) controller. He transferred to the Guam CERAP facility on September 3, 1995,27 where he was certified as a full-performance level controller. Before his employment with the FAA, the controller worked as a radar and tower controller in the U.S. Navy. His last duty station in the Navy was at Naval Air Station Cubi Point, Philippines, from 1978 to 1982. He was medically certified as a controller without waivers or limitations. 1.5.5.2 Air Traffic Control Tower The Agana tower controller, age 39, was hired by Barton ATC International, Inc.— a nonfederal contract ATC service company—as an air traffic controller at the Guam Federal Control Tower on May 15, 1995.28 According to company and FAA records, the controller was fully certified on all positions of operations in the tower, including clearance delivery, ground control, local control, and controller-in-charge. He was medically qualified for his duties and held an FAA Second Class Airman Medical Certificate issued on April 9, 1997, without waivers or limitations. Before his employment with Barton ATC International, the controller held a similar position in the U.S. Navy from 1983 to 1992. During this time, the controller was trained and qualified in various TRACON positions, including radar approach control, arrival radar, radar final, departure radar, and precision and surveillance radar. He was assigned to the Naval Air Station Agana tower in 1989. The controller told Safety Board investigators that, at the Agana Naval tower, he was qualified in all tower positions and worked as a flight data controller, radar final controller, tower supervisor, facility watch 27 For information on the CERAP facility, see section 1.10.1.1. 28 For information on the Agana tower facility, see section 1.10.1.3.

Factual Information 14 Aircraft Accident Report supervisor, and radar branch chief. The controller remained on Guam after he was discharged from the Navy. 1.6 Airplane Information The accident airplane, HL7468, serial number 22487, was one of three Boeing 747-300s in Korean Air’s fleet. The airplane was delivered new to the company on December 12, 1984, and had been operated and maintained continuously by Korean Air until the accident. Every Korean-registered aircraft is subject to annual renewal of its airworthiness certificate from the Korean Civil Aviation Bureau (KCAB); this airplane’s last airworthiness certificate was issued on July 7, 1997. At the time of the accident, the airplane had accumulated about 50,105 hours total time in service and about 8,552 cycles.29 The airplane was equipped with four Pratt & Whitney JT9D-7R4G2 engines with total times and cycles since new of 26,014 hours and 4,699 cycles (No. 1), 36,611 hours and 6,137 cycles (No. 2), 25,904 hours and 4,383 cycles (No. 3), and 33,889 hours and 5,701 cycles (No. 4). The most recent engine change before the accident was the replacement of the No. 3 engine on June 11, 1997, after a compressor surge incident. According to Korean Air, the airplane was maintained according to the company’s Continuous Maintenance Program, which was approved by the KCAB. The maintenance program comprised “A” checks performed at 350-hour intervals and “C” checks at 4,000-hour intervals. (Approximately 12 A checks are performed between each C check.) The last A check was performed on July 12, 1997, at 49,874 hours. The last C check was performed on December 16, 1996, at 47,918 hours. During the C check, operational/functional test work cards were completed for the transponders, radar altimeters, VOR/ILS navigation receivers, central air data computers, GPWS, autopilot, automatic direction finder (ADF), altitude alert, inertial navigation systems, weather radar, DME, and high-frequency radios. Further, the FDR was read out, and the altimeters were calibrated. 1.6.1 Maintenance Discrepancies Before the Accident Flight The accident airplane’s logbooks indicated that, from December 1996 (the time of the last C check) to August 1997, all mechanical discrepancies identified by flight crews or maintenance personnel had been corrected before the next scheduled flight. Several discrepancies were deferred, in accordance with Korean Air minimum equipment list guidelines, and the airplane was flown to Seoul for repair. The airplane’s logbook entries during this time period detailed the following maintenance deficiencies and corrective actions: 29 A cycle is one complete takeoff and landing sequence.

Factual Information 15 Aircraft Accident Report • Between December 18, 1996, and January 5, 1997, five airspeed-related writeups were logged, including one that identified a discrepancy of up to 50 knots between the captain’s and first officer’s airspeed indicators while in cruise. Corrective actions were taken. • On April 9, 1997, the GPWS failed the “below glideslope” test. Contamination was cleaned from a connector. • Between May 3, 1997, and June 23, 1997, six writeups were logged about erroneous fuel quantity indications on the No. 1 fuel quantity indicator. The system was checked after each event. • On July 3, 1997, the first officer’s altimeter was replaced. • On July 30, 1997, during an autocoupled approach at Seoul, autopilot channel “A” disengaged at a radar altitude of 1,000 feet. (According to a Boeing representative, because the autopilot is a triple-redundant system, it would have continued to control the airplane using the “B” and “C” channels.) A pin on one of the autopilot system’s electrical connectors was subsequently cleaned. Korean Air records indicated that the accident airplane had no deferred maintenance items when it was dispatched on August 5, 1997, and that no discrepancies had been identified in the airplane’s logbook for the previous 12 flights. The partially completed logbook page for the accident flight was recovered from the wreckage, and no maintenance writeups had been logged. 1.6.2 Cockpit Instrumentation The captain’s and first officer’s instrumentation panels from the Boeing 747 Classic are shown in figures 4 and 5, respectively. A discussion of the accident airplane’s autopilot system, GPWS, and ILS follows. 1.6.2.1 Autopilot System The accident airplane was equipped with a Sperry-Rand (now Rockwell Collins) autopilot, model SPZ1. The autopilot system consists of a mode control panel and three pitch and roll computers (with a landing rollout function) that drive the pitch and roll actuators. In addition, two separate yaw damper computers provide control to the “split” rudder system (two individual rudder panels). Boeing engineers stated that, when the autopilot’s ILS mode is selected by the pilot and a sufficient glideslope signal exists, the glideslope “armed” indicator is annunciated in the cockpit with an amber light. The pitch and roll computers maintain pitch control and operate in any of the following modes: “Altitude Hold,” “Altitude Select,” “Indicated Airspeed Hold,” or “Vertical Speed.” When the deviation of the glideslope signal reaches a predetermined level, the vertical beam sensor automatically switches the landing rollout computer function to control the pitch axis of the elevator. The glideslope signal is

Factual Information 16 Aircraft Accident Report Figure 4. Captain’s instrumentation panel. Reproduction courtesy of The Boeing Company.

Factual Information 17 Aircraft Accident Report Figure 5. First officer’s instrumentation panel. Reproduction courtesy of The Boeing Company.

Factual Information 18 Aircraft Accident Report validated before the system can arm the glideslope “engage” logic and the vertical beam sensor. According to Boeing, if the glideslope signal is invalid, the failure will be annunciated in the cockpit with a steady red “autopilot” warning light. The altitude alert system is coupled to the autopilot. The altitude alert is armed by the pilot when the desired altitude is set into the “ALT SEL” (altitude select) window on the pilot’s control panel (or glareshield). The amber “ALTITUDE ALERT” light illuminates steadily, and a 2-second aural tone sounds when the aircraft is approaching the selected altitude from either 900 feet above or below. The light remains illuminated until the aircraft is within 300 feet of the desired altitude. The light then flashes, and the 2-second aural tone sounds when the aircraft deviates 300 feet above or below the selected altitude until the deviation exceeds 900 feet, at which time the light extinguishes and the system automatically resets for subsequent altitude alerting. The “deviation from altitude” mode of the altitude alert system deactivates when the landing gear is extended. 1.6.2.2 Ground Proximity Warning System The accident airplane was equipped with an AlliedSignal Mark VII GPWS Warning Computer.30 The mode 2 warnings “TERRAIN” and “PULL UP” were desensitized31 during flight 801’s approach while the airplane was in the landing configuration (gear down/flaps extended). The advisories and alerts that remained active in the landing configuration were those for excessive descent rate (sink rate); excessive terrain closure rate; excessive glideslope deviation; minimums (radio altitude decision height) callout; and 1,000, 500, 100, 50, 40, 30, 20, and 10 feet radio altitude callouts.32 On October 3, 1997, postaccident testing of the GPWS installed on flight 801 was performed at AlliedSignal facilities in Redmond, Washington. The testing found that the GPWS was capable of normal operation. 1.6.2.3 Instrument Landing System The accident airplane was equipped with three Rockwell International/Collins Model 51RV-5B ILS receivers. No recorded malfunctions or abnormalities with the three receivers were recorded between the time of their respective installations (from November 1996 to May 1997) and the accident. 30 For general information on GPWS, see section 1.18.2.1. For information on previous safety recommendations on GPWS and related systems, see section 1.18.2.4. 31 Desensitizing changes the range of values to which the alerts respond to minimize nuisance warnings. Desensitizing does not suppress or cancel (inhibit) the alerts. A terrain closure rate must exceed 2,500 feet per minute to initiate a warning during the time that the terrain and pull up warnings are desensitized. 32 According to the Boeing 747 Operations Manual used by Korean Air, activation of the pull up alert (which was desensitized in the landing configuration) requires the recovery maneuver (see section 1.17.4.3) immediately unless daytime VFR conditions exist and a positive visual verification is made that no hazards exist. The operations manual further states that flight crews should respond to terrain, don’t sink, sink rate, too low gear, and glideslope alerts by correcting “flightpath and/or airplane configuration to eliminate the cause of the aural alert.”

Factual Information 19 Aircraft Accident Report In a normally functioning system, ILS information is displayed in the cockpit on the captain's and first officer's raw data indicators on the attitude director indicator (ADI) and the horizontal situation indicator (HSI) if they are receiving localizer and glideslope information. In addition, the ADI’s flight directors (FD) display ILS information if the appropriate FD mode is selected.33 The ADI and HSI are equipped with a warning flag that is displayed over the ILS indications (localizer and glideslope) to alert a pilot if either the ground or airborne system fails or if the receivers are not set to the correct radio frequency.34 According to the manufacturer, the glideslope warning flag will appear if the navigation receiver is tuned to an ILS frequency and any of the following conditions exist: • there is an absence of a glideslope radio-frequency signal or 90- and 150-Hertz (Hz) modulations; • the percentage of modulation of either the 90- or 150-Hz signal is reduced to zero and the other is sustained at 40 percent or more; or • the level of a standard glideslope deviation signal produces 50 percent or less of the standard deflection of the deviation indicator. 1.6.3 Weight and Balance The weight and balance form signed by the captain and the dispatcher for the accident flight included the following data:35 • zero fuel weight, 197,897 kilograms (kg); • departure fuel, 51,847 kg; • trip fuel, 36,923 kg; • takeoff weight, 249,744 kg; • estimated landing weight, 212,821 kg; • passenger weight (including cabin baggage), 17,694 kg; • cargo in compartments, 7,333 kg; • takeoff weight center of gravity, 24 percent mean aerodynamic cord; and • takeoff stabilizer trim setting, 4.4 units. 33 The flight mode annunciator (FMA), although not a part of the ILS system, indicates the mode for the FD and autopilot. The NAV mode selector switch determines what a flight crew expects to see on the FMA. “Armed” is indicated with white letters on a black background; “capture” is indicated with black letters on a green background. The radio magnetic indicator is used to determine VOR passage if the needles are set to VOR (and not to the ADF). 34 The FD is equipped with command bars. In a precision approach, the command bars provide guidance to maintain the glideslope; in a nonprecision approach, the command bars typically provide guidance to maintain the desired vertical speed. 35 The maximums for zero fuel weight, takeoff weight, and estimated landing weight were 242,630, 377,777, and 265,306 kg, respectively.

Factual Information 20 Aircraft Accident Report 1.7 Meteorological Information 1.7.1 Weather Conditions at Guam International Airport Guam’s climate is relatively uniform throughout the year. Guam averages 247 days each year with measurable amounts of precipitation (rain), and most days begin with scattered layers of clouds that become broken to overcast by afternoon. From August to October, visual meteorological conditions (VMC) prevail about 80 percent of the time, and instrument meteorological conditions (IMC) prevail predominately during the afternoon hours. The rainy season lasts from July to November. During that time, precipitation averages about 24 days per month, and the prevailing winds are usually from the east, averaging about 9 knots. A weather synopsis prepared by the Guam National Weather Service (NWS) Office on the day of the accident stated: …a weak low pressure trough is moving slowly [through] the Mariana Islands…resulting in gentle to moderate easterly winds and scattered showers. The effects of the upper level low far to the northeast have diminished during the past 12 hours or so. Light to moderate showers should be expected except for isolated afternoon thunderstorms due to solar heating. About 0122:06 during the accident flight, the flight crew was informed by the CERAP controller that ATIS information Uniform was current. The content of that report was as follows: Agana tower information UNIFORM, time one four five zero zulu, wind calm, visibility seven, [clouds] one thousand six hundred scattered, two thousand five hundred scattered, temperature two seven [Celsius], dew point two four, altimeter two niner eight six, runway six in use. NOTAMs [Notices to Airmen36], runway six left ILS glideslope out of service until further notice, advise on contact you have information UNIFORM. The special surface weather observation for 0132 on August 6, 1997, was as follows: Wind 090° at 6 knots; visibility—7 miles; present weather—shower vicinity; sky condition—scattered 1,600 feet, broken 2,500 feet, overcast 5,000 feet;37 temperature—27° C; dew point—25° C; altimeter setting 29.85 inches Hg; remarks—showers vicinity northwest-northeast. 36 NOTAMs are disseminated to flight crews to provide information about conditions or changes in any aeronautical facility, service, procedure, or hazard. 37 In surface weather observations, cloud bases are measured in feet agl.

Factual Information 21 Aircraft Accident Report The special surface weather observation for Guam International Airport for 0147 on August 6 was as follows: Wind variable at 4 knots; visibility—5 miles; present weather—light rain shower; sky condition—few 1,500 feet, scattered 2,500 feet, overcast 4,000 feet; temperature 26° C; dew point 24° C; altimeter 29.85 inches Hg. The Safety Board examined the NWS surface weather observation logs and found that heavy rain showers were reported at the airport between 0020 and 0029, between 0114 and 0116, and between 0153 and 0158. The weather logs also indicated that light rain showers were reported at the airport between 0016 and 0020, between 0029 and 0033, between 0106 and 0114, between 0116 and 0128, and between 0138 and 0148. Further, light rain and mist were also reported between 0148 and 0153. The maximum windspeed recorded at the airport between 0130 and 0150 was about 10 knots. The following terminal aerodrome forecast (TAF) for Guam International Airport, which was issued by the NWS on August 6 at 0030 as an amendment to an earlier TAF, was valid at the time of the accident: Wind 120° at 7 knots, visibility greater than 6 miles, scattered 1,600 feet scattered 4,000 feet scattered 8,000 feet overcast 30,000 feet. Temporary August 6, 0100 to August 6, 0600, wind 130° at 12 knots gusting 20 knots, visibility 3 miles, heavy rain shower, broken 1,500 feet cumulonimbus overcast 4,000 feet. The radar antenna of the Guam Weather Surveillance Radar-1988, Doppler (WSR-88D) was located about 5 nm east of the accident site. Data recorded about 0143 on August 6 (1543 UTC time on August 5, 1997) indicated an area of precipitation over higher terrain about 4 nm southwest of the airport, including Nimitz Hill. The precipitation was oriented east to west, about 7 to 8 nm long and 3 to 4 nm wide, and was moving toward the west. Figure 6 shows the WSR-88D four-panel base reflectivity product for 0143. 1.7.2 Air Traffic Control Weather Information The CERAP radar controller stated that, although areas of weather were in the vicinity of the VOR and airport, he had not received any pilot reports from midnight to the time of the accident. The controller stated that a “relatively small cell,”38 which he believed to be of light to moderate intensity, was depicted on the Airport Surveillance Radar (ASR)-8 display. Further, the controller said that the “relatively small cell” observed on radar extended about 3 to 5 miles on the final approach course and was about 2 to 3 miles across in the largest area. The controller said that he had no means of determining the intensity of this or any other weather cell because, unlike other weather radar displays, the ASR-8 radar display is monochromatic, and it is difficult to differentiate precipitation intensity without color. However, the controller also said that he 38 The term “cell” is used to describe an area of precipitation depicted on radar.

Factual Information 22 Aircraft Accident Report Figure 6. WSR-88D four-panel base reflectivity product for Guam.

Factual Information 23 Aircraft Accident Report interpreted the intensity of precipitation by the different levels of opaque (white) shading and his experience as a controller. The CERAP controller stated that he did not advise the flight crew or the Agana tower controller that he had observed the precipitation on radar while flight 801 was on the approach course to the airport. The controller said that he had assumed that the flight crew was using cockpit radar because they had asked him twice for deviations around weather. The controller stated that the airplane’s cockpit radar was more accurate and more precise than the radar he was using at the CERAP. The controller further stated that he did not observe (on radar) the airplane entering the precipitation. FAA Order 7110.65, “Air Traffic Control,” paragraph 2-6-4 (a) states that a controller is to “issue pertinent information on observed/reported weather or chaff39 areas. Provide radar navigational guidance and/or approved deviations around weather or chaff when requested by the pilot….” Paragraph 2-6-4 (c) states that a controller is to “inform any tower for which you provide approach control services if you have any weather echoes on radar which might affect their operations.” Further, paragraph 2-9-2 states that, in the event of “rapidly changing conditions,” a new ATIS is to be recorded and that the information is to be issued by ATC. The Agana tower controller stated that, although it was not raining at the airport when flight 801 was inbound, a rain shower was moving in from the northeast over the airport and down the runway to the southwest. The tower controller said that he did not know when the rain began at the airport because he was using binoculars to try to locate flight 801 on the approach. He estimated that the visibility was 7 miles and stated that no low clouds were visible. 1.7.3 Additional Weather Information A certified Navy weather observer on Nimitz Hill, about ¾ mile northwest from the accident site, stated that the cloud ceiling about the time of the accident was approximately 700 to 800 feet above ground level (agl), or 1,300 to 1,400 feet msl, during a heavy rain shower. Also, he stated that visibility was about 200 to 300 meters and that the windspeed was not more than 10 knots. The NWS forecaster on duty at the time of the accident stated that no SIGMETs [Significant Meteorological Information] were valid for Guam and that the night was “pretty routine.” The flight crew of Continental Air Micronesia flight 960, a Boeing 747 that landed at Guam about 30 minutes before the accident, stated that visibility was “excellent” from PAYEE intersection (located about 240 nm north of the NIMITZ VOR) and that scattered thunderstorms were occurring around the area. Further, the pilots indicated that their on-board radar depicted rain showers over the NIMITZ VOR but not over the airport. They also stated the visibility was “good” under 2,000 feet and that they maintained visual contact with the airport throughout the approach. 39 Chaff is aluminum foil strips dropped by military aircraft as phony targets to confuse radars.

Factual Information 24 Aircraft Accident Report The flight crew of Ryan International flight 789, which landed shortly after the accident occurred, stated that the visibility was sufficient to see the lights of Guam from about 150 nm away. The first officer stated that on-board weather radar indicated showers northeast of the airport but no thunderstorms. Additionally, the Ryan flight crew initially requested a visual approach when the flight was about 15 nm from the VOR, but the airplane encountered clouds and rain on approach to runway 6L shortly thereafter. The first officer stated that the airplane remained in the clouds until it was in proximity of the VOR, at which time the airplane broke out and the flight crew was able to acquire and maintain visual contact with the airport. The captain stated that, although clouds and rain were over the island’s shoreline, the air around the airport and in the vicinity of the accident site was smooth. Further, the captain, who was also a check airman based at Guam, said that he “noticed that once [flight] crews are given a visual approach [to Guam International Airport] they have a tendency to press on even when they lose visual contact in hopes of regaining visual contact again…. That’s because so many approaches are visual and the clouds and rain showers are so localized.” In addition, a witness who was hunting on Nimitz Hill at the time of the accident stated that it was not raining when he observed flight 801 pass over his position (100 feet north of the VOR beacon) and crash a very short distance away. He said that there had been intermittent rain showers shortly before the accident but that, when he saw the airplane crash, he could see stars directly over the accident site. The witness also said that the visibility was “very good” at the time of the accident and that, although he could not see the airport lights, he could see the lights of the town of Tamuning (3 to 4 miles northeast of his location). He said that the wind was “normal” and that no thunder or lightning was in the area. 1.8 Aids to Navigation Guam International Airport is serviced by three navigational aids: the NIMITZ VOR/DME (UNZ); the Mount Macajna nondirectional beacon (NDB), which was not operational at the time of the accident; and the ILS glideslope and localizer. The colocated VOR and DME transmitters were equipped with a “self- monitoring” system that samples radiated transmitter signals to ensure that the system is operating within prescribed tolerances and parameters. If these tolerances are exceeded, the monitoring system automatically shuts down the equipment. According to the facility logs, the VOR was not shut down at the time of the accident. On the day of the accident, the FAA conducted a flight check of the localizer, outer marker, and NDB at Guam. The VOR and DME at Guam were not checked by the FAA until the day after the accident because of rescue operations. The FAA’s flight checks determined that the respective systems were functioning properly and within prescribed tolerances.40 The flight checks did not examine the glideslope because it was out of service and removed at the time (see section 1.10.2 for more information).

Factual Information 25 Aircraft Accident Report 1.9 Communications No communications problems were reported between the crew of flight 801 and any of the FAA or contract ATC facilities. (See sections 1.7.2 and 1.10.1 for more information.) 1.10 Airport Information The A.B. Won Pat Guam International Airport is located about 3 nm northeast of Agana on the west-central coast of Guam at an elevation of 297 feet msl. The airport is leased to the Guam International Airport Authority by the U.S. Navy, and the associated navigational facilities are owned and operated by the FAA. The airport has two parallel runways oriented northeast/southwest: runway 6R/24L, which is 8,001 feet long and 150 feet wide, and runway 6L/24R, which is 10,015 feet long and 150 feet wide. Runway 6L is equipped with high-intensity runway edge lights and a medium- intensity approach lighting system with runway alignment indicator lights.41 The runway was not equipped with runway end identifier lights, centerline lights, or touchdown zone lights. Runway 6L is also equipped with a four-box visual approach slope indicator (VASI) calibrated for a 3° visual glidepath angle. The touchdown elevation of runway 6L is 256 feet but rises to 297 feet at the departure end of the runway. Guam International Airport was certified by the FAA as an Index D aircraft rescue and firefighting (ARFF) facility under 14 CFR Part 139. In accordance with this index, the airport is required to maintain a minimum of three ARFF vehicles capable of carrying a total quantity of at least 4,000 gallons of water. 1.10.1 Air Traffic Control Services for Guam International Airport 1.10.1.1 Combined Center/Radar Approach Control The Guam CERAP, located at Andersen Air Force Base (AFB),42 provides both TRACON and en route ATC services. To do so, the CERAP is equipped with two 40 Although the FAA concluded that the outer marker was functioning properly, its aural alert was not heard on the accident airplane’s CVR, and the CVR contained no indication that the flight crew had seen the flashing blue light of the marker beacon indicator. However, the alert would not have been audible and the indicator would not have been seen if the flight crew had turned off the marker beacon aural alert and the marker beacon indicator. The instruments and switches related to the ILS that were found in the wreckage did not indicate the operational status of the marker beacon aural receivers and indicators. 41 The tower controller said that, at the time of the accident, the lights for runway 6L were on step 2, and the medium intensity approach lights were on step 1 (the lowest of three approach light intensity settings). These settings were not changed until after the accident when Ryan flight 789 requested that the lights on runway 24R be changed from step 2 to 3. The controller documented the runway light settings about an hour after the Ryan flight had landed and said that no one had reset the runway lighting panel during that period. 42 Andersen AFB is located at the northeastern end of the island. It has two runways that are oriented in the same manner as those at Guam International Airport.

Factual Information 26 Aircraft Accident Report independent radar data processing systems that receive radar information from different radar sites: terminal ATC services are provided by an Automated Radar Terminal System (ARTS) IIA analog display processor connected to an ASR-8 radar system; en route ATC services are provided by a digitized, narrow-band Micro-En route Automated Radar Tracking System (EARTS) processor connected to an FPS-93 long-range radar.43 Each of these systems independently performs its own minimum safe altitude warning (MSAW) processing (see section 1.10.1.2) but uses different algorithms that have been optimized for either terminal or en route operations. Both the FPS-93 and ASR-8 sensors are located about 1,500 feet apart on Mount Santa Rosa. The CERAP airspace comprises concentric circles centered around the Mount Santa Rosa radar antenna site. The 250-nm-radius outer ring, which encompasses all of the airspace from above the surface, is classified as oceanic airspace. A 100-nm-radius inner ring, which extends over the Saipan radio beacon and from the surface to 28,000 feet, is classified as domestic airspace.44 The CERAP airspace is adjoined on all sides by the Oakland Air Route Traffic Control Center oceanic sectors. The airspace over Saipan and Guam is classified as approach control airspace, and its boundaries extend from the surface to 17,000 feet. The CERAP was classified as a Level II facility at the time of the accident.45 The CERAP facility has two en route and one approach control radar positions. The R-1 en route radar position is responsible for the 100-nm inner circle; the R-4 en route radar position is responsible for the 250-nm outer circle. The D-3 approach control radar position, which is located between the en route R-1 and R-4 radar positions, is responsible for a 25-nm inner ring that extends from the surface to 17,000 feet and includes the NIMITZ VOR and the Andersen TACAN.46 At the time of the accident, one controller was performing the functions of all three positions from the R-4 position. Authorized staffing for the Guam CERAP comprises 14 full-performance level controllers, 3 supervisors, an Automation Specialist, a Quality Assurance/Training Specialist, an Air Traffic Manager, and a secretary. According to FAA quality assurance staff at Guam, afternoon traffic at Guam is primarily overflights of aircraft traveling northbound, and evening traffic is primarily aircraft traveling inbound from Asia. The CERAP controller on duty at the time of the accident told Safety Board investigators that, after arriving at the facility at 2345 on August 5, 1997, he assumed the duties at the R-4 en route radar position (and the colocated R-1 en route and D-3 approach control radar positions). A coworker arrived at the facility and assumed the duties at the 43 The FPS-93 long-range radar system is connected to an Air Traffic Control Beacon Interrogator-5 encoder, and the ASR-8 radar system is connected to an Air Traffic Control Beacon Interrogator-4 encoder. 44 Saipan is part of the Mariana Islands. 45 At the time of the accident, ATC facilities were classified according to the number of flight operations per hour. Level I had the lowest number of flight operations; Level V had the highest number. ATC facilities are now classified under a different system that considers other factors in addition to the number of flight operations per hour. 46 TACAN stands for tactical air control and navigation. It is the U.S. military’s version of DME.

Factual Information 27 Aircraft Accident Report D-3 position from midnight to 0110, at which time he went on a break. The controller then resumed the duties of the D-3 position. (His coworker was not in the control room at the time of the accident.) The CERAP controller stated that he was monitoring the EARTS (en route) radar display, which was set to 265 nm (but normally covers 250 nm). The controller also said that the en route radar display (which was located directly in front of him) was set to show the MSAW area in the lower right corner. (Controllers are able to set radar information to any position on the radar screen.) According to the controller, the en route radar system was displaying only secondary radar (beacon) target information47 throughout his shift. (The system was set up that way when he relieved the previous controller on duty.) He said the en route radar system was not able to display weather information because the part of the system that would normally display such information was out of service. Further, the CERAP controller told investigators that the TRACON radar display (which was located to his immediate right) was set to a 60-nm range. The controller also stated that the approach control radar was set to display the MSAW area in the lower center of the screen. In addition, the controller said that the approach control radar was displaying primary and secondary radar return targets48 and areas of weather that were moving through the Guam area throughout his shift. The CERAP controller also told investigators that the traffic complexity and density, that is, the number of aircraft under his control, from the time of initial radio contact with flight 801 (about 0103:18) to the time he advised the flight crew to contact the Agana tower (about 0140:42) was “light to moderate traffic and routine complexity.” The controller estimated that he was handling 10 to 15 aircraft during that time, including flight 801. After the CERAP controller initiated the communications change (instructing flight 801 to contact the Agana tower controller), he was still responsible for radar monitoring of the flight because the Agana tower was a VFR facility and none of the criteria for automatic termination of radar service, as stated in FAA Order 7110.65, “Air Traffic Control,” paragraph 5-1-13, had been met. However, the CERAP controller was no longer able to directly contact the airplane after it had switched to the Agana tower frequency. During a postaccident interview, the controller stated that he did not monitor the progress of flight 801 after the communications changeover because he was performing other duties that might have precluded further monitoring. According to the transcript from the recorded voice communications of radio and interphone lines during the period that flight 801 was in communication with the Agana tower, the CERAP controller made a radio transmission to another aircraft about 0140:54. From about 0141:14 to 0141:30, he was on the interphone with a controller at the Oakland Center. About 0142:05, the CERAP 47 Secondary radars transmit interrogation pulses to a receiver aboard an aircraft. The radars display altitude and identity information sent from the aircraft in response. 48 Primary radar targets only detect radar energy reflected from the structure of the aircraft itself.

Factual Information 28 Aircraft Accident Report controller acknowledged a transmission from the flight crew of Ryan International flight

1. The transcript indicated no further activity until about 0143:49, when the CERAP

controller called the Agana tower with a flight plan. The CERAP controller said that he last observed the target of flight 801 on the terminal radar display when the airplane was 7 miles from the airport at an altitude of 2,600 feet. Between 0150 and 0151, the CERAP controller was queried by the Agana tower controller about flight 801. About 0154:44, the CERAP controller contacted Ryan flight 789 and stated, “ryan seven eighty nine roger we may have lost an airplane….” About 0156:03, the CERAP controller requested the Ryan flight crew to “…look for signs of an accident west of the airport.” About 0156:35, a Ryan flight crewmember advised the CERAP controller, “…about fifteen minutes ago we saw the clouds light up bright red it was kinda weird we thought it was just our eyes or something.” About 0156:58, the crewmember advised the controller, “we got a big fireball on the hillside up here…about our three o’clock and two miles–ah a mile.” 1.10.1.2 Minimum Safe Altitude Warning System Beginning in 1977, MSAW functions were incorporated into the ARTS software installed in FAA terminal radar data processing systems.49 According to FAA technical document NAS-MD-684, MSAW provides general terrain monitoring for all aircraft, including those not on approach, within a predetermined geographic area and approach path monitoring for certain aircraft operating within an approach capture box (a rectangular area surrounding a runway and final approach course). The document also states that aircraft on approach are to be monitored based on their current or predicted altitude compared with the lowest MDA for the approach and that warning alerts are based on an “aircraft’s relative position to a runway threshold and final approach course centerline.” The ARTS IIA MSAW system uses computer software that contains a terrain database customized for the environment around each airport that utilizes ARTS processors. The MSAW system is designed to visually and aurally alert a controller whenever an IFR-tracked target with an altitude encoding transponder (Mode C) descends below, or is predicted by the software to descend below, a predetermined safe altitude. The ARTS IIA and EARTS MSAW systems use approach capture boxes aligned with runway final approach courses to identify aircraft that are landing. Within these boxes, MSAW applies special rules specific to approach and landing operations. The ARTS IIA adaptation allows the use of a “pseudo-glideslope” that underlies the actual glideslope. Predicted or actual descent below this pseudo-glideslope normally produces a low-altitude alert. EARTS approach adaptation is less sophisticated and does not include glideslope monitoring; instead, a single base altitude is used for the entire approach capture box. According to FAA records, the Guam terminal (approach) MSAW system was originally installed in 1990 to provide altitude protection within a 55-nm radius around the Guam ASR-8 site. In March 1993, a new software package was developed and evaluated 49 See section 1.18.1.2 for information on Safety Board recommendations regarding the MSAW system.

Factual Information 29 Aircraft Accident Report by FAA technicians for installation at Guam. The new software was designed to inhibit MSAW alerts inside a 54-nm radius of the Guam ASR-8 site. Thus, the MSAW was only available (uninhibited) for a 1-mile radius (from 54 to 55 nm around the Guam ASR-8 site). According to FAA representatives, this change, designed as a temporary solution to reduce false, or “nuisance,” warnings, was submitted by the Guam CERAP and approved by the FAA’s Western Pacific Regional Office. The Safety Board requested documentation of the reasons for the changes, but the FAA was unable to explain the specific reason(s) for the change in the MSAW configuration.50 The FAA Technical Center in Atlantic City, New Jersey, modified the software and delivered it to Guam in January 1994, but the software did not become operational until February 1995. (The EARTS MSAW system at Guam only generates visual MSAW alerts, and these alerts were not inhibited at the time of the accident.) The ARTS IIA system recorded no alerts for Korean Air flight 801 at any time. The EARTS MSAW alert records showed that a visual approach path warning was generated at 0142:20, about 6 seconds before the crash of flight 801, and continued until at least 0142:49. At the Safety Board’s public hearing,51 the FAA’s Deputy Program Director of Air Traffic Operations testified that, in some circumstances, controller issuance of an MSAW- based safety alert could be a first-priority duty equal to separation of aircraft. FAA Technical Center management testified that MSAW is a safety-critical service. An FAA quality assurance evaluation report, dated July 31, 1995, on the Guam CERAP facility stated that the MSAW system had been inhibited and that a NOTAM had been issued about the inhibited MSAW.52 An FAA representative stated that, because no “established policy” existed for MSAW operations at the time of the 1995 evaluation, the MSAW inhibition was noted only as an “informational” item in the evaluation team’s report and, as a result, did not require corrective or follow-up action. The report also indicated that a new digital terrain map had been ordered and was scheduled for delivery in April 1995 but that the delivery date had been rescheduled for August 1995. 50 According to FAA Order 7210.3M, “Facility Operation and Administration,” section 13-2-7, MSAW and conflict alert functions can be temporarily inhibited “when their continued use would adversely impact operational priorities.” The order also states that a brief written report should be sent to the FAA air traffic directorate whenever these functions are inhibited. 51 The Safety Board may hold a public hearing as part of its investigation into certain accidents to supplement the factual record of an accident investigation. The Board calls technical experts as witnesses to testify, and Board investigative staff and designated representatives from the parties to the investigation ask questions to glean factual information. The hearing is not intended to analyze any factual information for cause. The Board held a public hearing on this accident from March 24 to 26, 1998, in Honolulu, Hawaii (see appendix A). Five issues were addressed at this hearing: controlled flight into terrain (CFIT) accidents, operation of navigational devices at the Guam airport, MSAW systems and practices related to these systems, search and rescue operations, and U.S. and foreign government oversight of foreign air carriers operating into the United States. 52 Safety Board investigators and FAA representatives were not able to locate a NOTAM addressing the Guam MSAW system’s inhibited status. However, the FAA stated that a NOTAM would not normally be issued for an inhibited MSAW system.

Factual Information 30 Aircraft Accident Report FAA documents revealed that new MSAW software became operational in April 1996, but it contained the same 54-nm-radius inhibition as the February 1995 version. About 1 year after the installation of the new software, the FAA conducted another facility quality assurance evaluation of the Guam CERAP. The evaluation report, dated April 1997, did not note that the ARTS IIA MSAW system remained inhibited. According to the FAA, the MSAW system at Guam was restored to full, uninhibited operation on August 23, 1997 (17 days after the flight 801 accident), after the monitoring software parameters were adjusted to reduce false alert incidents.53 The FAA indicated that, since that time, controllers had been experiencing about 18 nuisance alarms per day and that work was ongoing to reduce these alarms. 1.10.1.3 Air Traffic Control Tower The Agana tower is responsible for operations within the surrounding Class D airspace, which is defined as the airspace within a 5-statute mile radius from the center of the Guam International Airport up to, but not including, 2,500 feet agl. The tower facility is located on the south-southwest side of the airport and is operational 24 hours a day. The controller positions are arranged in a semicircular pattern that face generally from the southwest to the northeast. The four operational positions are the controller-in-charge, local control, ground control, and flight data. All of the positions are typically worked by one controller as a combined function, but the positions may be separated depending on traffic conditions and staffing levels. In August 1994, Barton ATC International, Inc., was awarded the contract to provide ATC services at the Agana tower. Barton was purchased by Serco Aviation Services, Inc., in January 1997. According to a Serco official, 6 controllers with an average of 15 years of experience worked at the tower at the time of the accident.54 Three of these staff members, including the Air Traffic Manager, had worked at the facility when it was operated by the U.S. Navy. The Guam Air Traffic Manager said that the FAA evaluated the tower facility at Guam in October 1995 to determine whether a new tower should be constructed or the existing facility should be upgraded. The FAA also evaluated the Guam tower in September 1996, and the Air Traffic Manager learned that the facility would be upgraded with digital bright radar indicator tower equipment (D-BRITE) 55 displays. In February 1997, two D-BRITE systems were delivered to the Agana tower, and the radar displays were installed by the FAA in July 1997. The tower controller on duty at 53 See section 1.18.1.1 for information on other postaccident MSAW-related actions taken by the FAA. 54 In July 1995 and April 1997, the FAA conducted standard evaluations of the Agana tower. In addition, internal biannual evaluations were conducted during July 1995 and June 1997. After these evaluations, labor hours were increased to provide dual coverage of ATC positions during peak traffic periods. Because of this action, Serco began recruitment for an additional air traffic controller in mid-July

1. The Safety Board was advised during its on-scene accident investigation that, although approval from

the FAA had not been received, an additional controller was hired on August 12, 1997. 55 D-BRITE is a radar display remote linked from approach control to the tower.

Factual Information 31 Aircraft Accident Report the time of the accident stated that the D-BRITE radar display was operational but had not been certified for use. (At the time of the accident, the associated control panels for configuring the Guam tower D-BRITE video maps and settings were located at the Andersen AFB tower. According to the FAA, the equipment at the Agana tower was not certified or commissioned for use because of missing hardware and computer software.) The tower controller stated that the display showed secondary radar targets but that the radar setting selected by the Andersen AFB controllers determined whether Mode C targets would be displayed. He said that the controllers at Guam were not able to determine an airplane’s position on the video map because it did not depict any final approach courses or runway orientations for the airport. By December 1997, the two D-BRITE systems had been tested, and the Agana tower controllers received training on the systems’ operation. The D-BRITE systems were certified and commissioned for use on April 11, 1998. The video map has been modified to depict the airport with extended centerlines for both runways 6L and 6R, and the system is controlled at the Guam tower. The Agana tower controller on duty at the time of the accident told Safety Board investigators that he arrived for duty about 2215 on August 5, 1997. After that time, he and the controller on duty performed a position relief briefing, which covered airport conditions, navigation aid conditions, traffic clearances that had been issued, and the facility equipment status. After midnight, the controller performed daily administrative duties. The controller said that he was working at the local control position, which was located in the center of the tower cab facing the runway. The controller also stated that he was aware of the NOTAM regarding the out-of-service glideslope. The tower controller said that, when Korean Air flight 801 made initial radio contact (about 0140:55), it was the only airplane that he was controlling. The tower controller said that, when flight 801 did not visually appear within 3 to 4 minutes after the airplane was cleared to land (about 0141:01), he commenced a communications search for the aircraft.56 The controller attempted to contact flight 801 about 0145:13 and 0150:06. Between about 0150:00 and 0151:00, the tower controller queried the CERAP controller, the ramp controller, and an Andersen AFB controller about flight 801. 1.10.2 Instrument Landing System Ground-Based Equipment FAA Form 6030-1, “Air Traffic Control Facility Maintenance Log,” for July 7, 1997, showed that the Agana tower had been notified by an FAA maintenance technician that the glideslope portion of the ILS would be out of service starting that day for extensive reconstruction. The reconstruction work included the replacement of the glideslope’s equipment shelter and all cabling and the upgrade of the power systems and grounding. A NOTAM issued by the FAA on July 7, 1997, indicated that the glideslope would remain out of service until September 12, 1997. The complete ILS system was 56 FAA Order 7110.65, “Air Traffic Control,” paragraph 10-3-1(b), states that controllers are to declare, in a timely manner, a flight that is overdue.

Factual Information 32 Aircraft Accident Report flight checked, certified, and returned to service on August 31, 1997. The Safety Board’s review of the facility maintenance log revealed no entries of pilot reports regarding the ILS or related navigation systems from July 7 to August 6, 1997. The accident airplane’s CVR recorded conversation among the flight crew regarding the operational status of the ILS glideslope as they approached the airport. For example, as previously stated in section 1.1, about 0139:55, the flight engineer asked, “is the glideslope working? glideslope? yeh?” About 0139:56, the captain answered, “yes, yes, it’s working.” About 0140:00, the first officer responded, “not useable.” About 0141:46, the captain asked, “isn’t glideslope working?” In a postaccident interview, the captain of a Continental Air Micronesia 727-200 stated that, about 1530 on August 5, 1997, he was conducting an in-flight functional test of a newly installed global positioning system (GPS)57 when the airplane’s instrumentation showed an indication of the ILS glideslope,58 even though the glideslope was out of service. Specifically, the captain stated that he was on approach to runway 6L at Guam International Airport and was centered on the localizer when he noticed that the glideslope was also centered and that no warning flags were associated with the ILS. In addition, the captain said that the glideslope always indicated “center” with no warnings even when the airplane was above the normal glidepath. The first officer confirmed the captain’s observations. However, the flight crew did not indicate any anomalous glideslope indication to ATC personnel or submit any maintenance writeups containing such information. The Continental Micronesia captain told Safety Board investigators that he originally assumed that the anomalous glideslope indication he experienced was caused by an airplane anomaly. The captain further stated that he thought the anomaly might have been a result of the GPS wiring installation. The captain did not report the glideslope anomaly to his chief pilot until 2 days after the Korean Air accident. The first officer stated that he and the captain “never thought twice” about the glideslope indications because they knew the glideslope was inoperative. According to the maintenance records for the Continental Air Micronesia airplane, the first officer’s ADI and HSI were removed and replaced on August 5, 1997, after the functional test flight. In addition, the records showed repeated squawks for the first officer’s ADI and HSI between August 8 and 25, 1997. 1.10.3 Instrument Approach Procedures at Guam International Airport Instrument approaches available for runway 6L at the time of the accident were the ILS (localizer only, glideslope out of service), the VOR/DME, and the VOR. 57 A GPS is a navigation system that provides precise, real-time information about an airplane’s position. 58 The 727-200 was equipped with Rockwell International/Collins Model 51RV-1 ILS receivers.

Factual Information 33 Aircraft Accident Report 1.10.3.1 The Nonprecision Runway 6L Instrument Landing System Localizer-only (Glideslope Out) Procedure The execution of the Guam ILS runway 6L localizer-only (glideslope out) approach requires the use of the NIMITZ VOR as a step-down fix59 between the final approach fix (FAF) and the runway and DME to identify the step-down points.60 The DME is not colocated or frequency paired with the localizer transmitter (which is physically located at the airport); rather, it is colocated and frequency paired with the NIMITZ VOR. The nonprecision localizer-only approach requires the use of the localizer to obtain lateral guidance to the runway, the DME to identify the step-down points, and the VOR to identify the final step-down fix to the MDA. According to Jeppesen Sanderson’s August 2, 1996, 11-1 ILS Runway 6L approach plate, the airplane should cross the FLAKE initial approach fix (IAF)—located at 7 DME from the VOR—at or above 2,600 feet msl. The nonprecision approach procedure prohibits descent below 2,000 feet msl (1,744 feet above airport elevation) before reaching the outer marker identified as GUQQY, which is the FAF and is located 1.6 DME from the VOR. Upon crossing the FAF, the procedure prohibits descent below 1,440 feet msl (1,184 feet above airport elevation) until passing the VOR. The procedure calls for a descent to 560 feet msl (the MDA, 304 feet above airport elevation), and the pilot is required to count up from less than 1 DME, as the airplane passes over the VOR, to 2.8 DME, the published missed approach point (MAP) and location of the middle marker. If a missed approach is not required, the airplane can continue its descent to the runway 6L threshold, located 3.3 DME from the VOR. According to the FAA, the DME and localizer at Guam are now frequency paired and colocated. In addition, the August 27, 1999, Jeppesen instrument chart for the ILS runway 6L approach (which became effective on September 9, 1999) states “DME or RADAR required” and includes “ILS DME” in the frequency box. 1.10.3.2 Instrument Approach Charts for Guam International Airport During postaccident examination of the cockpit area (which had separated from the main wreckage, as discussed in section 1.12), investigators found a clear plastic sleeve, measuring approximately 8 ½ by 11 inches, that contained the following Jeppesen approach charts for Guam International Airport, all of which were dated January 19, 1996: 11-1, ILS Runway 6L; 13-1, VOR Runway 6L; 13-2, VOR DME Runway 6L; 16-1, NDB Runway 6L; and 16-2, NDB DME Runway 24R.61 59 The Safety Board is not aware of any other approaches that use a VOR as a step-down fix on the final approach segment of a localizer-only approach. 60 The step-down approach technique requires pilots to cross specific navigational fixes at or above several altitudes while descending to the MDA, at which point the pilot either executes a landing or a missed approach. 61 Copies of these approach charts are contained in the Safety Board’s public docket for this accident. The Board maintains a public docket for each accident it investigates. The docket is used to establish the permanent record of an accident.

Factual Information 34 Aircraft Accident Report Charts 11-1 and 13-2 were found side by side and were visible through one face of the plastic sleeve. Chart 16-1 and the blank side of an approach plate were visible through the opposite face of the plastic sleeve. Chart 11-1, which is shown in figure 7, had the following items highlighted with a green fluorescent tint: 62 Plan view ILS facilities box: 063° (inbound magnetic course), 110.3 (ILS frequency), IGUM (identifier), and FLAKE (IAF). VOR facilities box: 115.3 (NIMITZ VOR frequency) and UNZ (identifier). Profile view 2500’ (msl altitude crossing FLAKE). 1900’ (msl altitude crossing the outer marker). 256’ (touchdown zone elevation–runway 6L). The instrument approach charts for Guam International Airport in effect at the time of the accident were issued on August 2, 1996 (with an effective date of August 15, 1996). Changes incorporated in the August 2, 1996, 11-1, ILS runway 6L approach chart (shown in figure 1) included the location names, crossing altitudes, and the missed approach procedure. Table 2 details the specific differences between the January and August 1996 instrument approach charts. 1.11 Flight Recorders 1.11.1 Flight Data Recorder The accident airplane was equipped with a Sundstrand Data Corporation model 573A FDR, serial number 2663, which was configured to record 51 parameters. The FDR recorded information digitally on four tracks using ¼-inch-wide magnetic tape that had a recording duration of 25 hours before the oldest data were overwritten. Even though the FDR case was damaged by impact forces, data could be retrieved and analyzed. Examination of the data indicated that the FDR had operated normally, except for a loss of synchronization about 3 seconds before the transition to 25-hour-old data. About 3 hours 48 minutes of data were transcribed for the entire accident flight (takeoff to impact). After an initial readout of the FDR, Korean Air provided the Safety Board with documentation that indicated that 11 additional sensors had been retrofitted after the airline took delivery of the airplane. These retrofitted sensors—exhaust gas temperature and oil quantities for the airplane’s four engines, static air pressure, and the left No. 4 and right No. 12 spoiler positions—were not reflected in the FDR documentation provided by the manufacturer or the airline at the time of the initial FDR readout. Documentation for the additional sensors provided by Korean Air did not include the equations necessary to 62 The plan view is the approach viewed from above; the profile view is the approach viewed from the side.

Factual Information 35 Aircraft Accident Report Figure 7. The January 19, 1996, 11-1 ILS runway 6L instrument approach chart. Reproduced with the permission of Jeppesen Sanderson, Inc. NOT TO BE USED FOR NAVIGATION.

Factual Information 36 Aircraft Accident Report Table 2. Information differences between the January 19 and August 2, 1996, Guam ILS runway 6L approach charts. Chart dated January 19, 1996 Chart dated August 2, 1996 No note regarding DME requirement. Note on chart stating DME REQUIRED. DME from UNZ VOR. MILITARY (in amendment block). AMEND 0 (in amendment block). HAMAL (IAF) is 8 DME on R-343. HAMAL (IAF) is 7 DME on R-343. ZEEKE (IAF) defined as 7 DME on R-169. ZEEKE defined as 7 DME on R-169. FLAKE (IAF) defined as 7 DME on R-242. IAF is defined as 7 DME from UNZ on the localizer. FLAKE (IAF) crossing altitude is 2,500 feet. 7 DME fix (IAF) on the localizer; crossing altitude is 2,600 feet. Outer marker fix designated OM. Outer marker fix designated GUQQY. Outer marker crossing altitude is 1,900 feet. GUQQY crossing altitude is 2,000 feet. VOR crossing altitude is 1,300 feet. VOR crossing altitude is 1,440 feet. Missed approach point designated 2.8 DME at the middle marker. Missed approach point depicted in large, bold font: D2.8 UNZ VOR, MM Touchdown zone elevation for runway 6L. Touchdown zone elevation for both runways 6R and 6L. Sidestep minimums included. Sidestep minimums deleted. Missed approach procedure: Climb to 2500’ outbound on UNZ VOR R-062, turn RIGHT direct FLAKE D7.0. Missed approach procedure: Climb to 2600, then turn RIGHT via UNZ VOR R-242 to FLAKE D7.0 UNZ VOR and hold SOUTHWEST, RIGHT turn, 062° inbound. Holding pattern at FLAKE depicted. No holding pattern at the IAF or FLAKE depicted. No obstruction symbol depicted at the VOR. 724-foot obstruction symbol depicted at the VOR. 803-foot elevation shown for UNZ VOR. No elevation shown for UNZ VOR. 1,154-foot elevation at outer marker. 1,190-foot obstruction shown at GUQQY. 1.6 DME at outer marker depicted on plan view. 1.6 DME UNZ VOR at GUQQY depicted on plan view. No note for FLAKE. Note added: (FLAKE) for missed approach only.

Factual Information 37 Aircraft Accident Report convert the recorded information into engineering units.63 The Safety Board applied equations used in previous readouts of FDRs from similar 747s, but the validity of the conversion equations could not be verified. 1.11.2 Cockpit Voice Recorder The accident airplane was equipped with Fairchild model A-100A CVR, serial number 61216. The CVR case revealed no evidence of structural damage, and the interior of the recorder and the tape showed no evidence of interior heat or impact damage. The recording consisted of four channels of “good quality” audio information,64 which included the captain, first officer, and flight engineer microphones; audio panels; and the cockpit area microphone. The fourth channel also recorded the interphone and the public address system. The audio portion began about 0111:42 and continued uninterrupted until 0142:32.53. The recording ended shortly after the airplane crashed and the power to the CVR was lost. The CVR group, consisting of representatives from the parties to the investigation and the KCAB, collectively transcribed the 31-minute 1-second tape in its entirety. A bilingual (English and Korean) transcript was produced of the entire recording (see appendix B). 1.12 Wreckage and Impact Information 1.12.1 General Wreckage Description Examination of the ground scars and the debris pattern revealed that the accident airplane impacted high terrain with the left outboard engine, main landing gear, and left wing at an elevation of about 660 feet msl and on a magnetic heading of approximately 063°. The Safety Board performed a complete survey of the accident site and airplane structure. The main wreckage site area was in a gully covered with dense vegetation, located approximately 2,000 feet southwest of the NIMITZ VOR. The wreckage distribution area was about 2,100 feet long and 400 feet wide and included airplane debris, tree strikes, and ground impact marks. All major structural components of the airplane and control surfaces that were not consumed by the postimpact fire were identified along the wreckage path. The terrain along the wreckage path was hilly and ranged from about 673 feet msl at the first tree strikes to about 582 feet msl at the main wreckage area. 63 See section 1.18.7.1 for safety recommendations regarding the need for improved FDR documentation. 64 The Safety Board ranks the quality of CVR recordings in five categories: excellent, good, fair, poor, and unusable. For a recording to be considered “good quality,” most of the crew conversations need to be accurately and easily understood. The transcript developed from the recording might indicate several words or phrases that were not intelligible; such losses are attributed to minor technical deficiencies/momentary dropouts in the recording system or simultaneous cockpit/radio transmissions that obscure one another.

Factual Information 38 Aircraft Accident Report The initial point of impact was evidenced by several cut treetops that extended along the wreckage path. Several ground impact marks, consistent with the main landing gear, were found in the vicinity of the broken oil pipeline, located about 400 feet from the point of initial impact. A ground scar, about 89 feet long, 6 feet wide, and 2 feet deep, was found about 415 feet from the point of initial impact, and several pieces of the No. 1 engine cowl were found embedded in this area, along with parts of the left wing leading and trailing edge flap structure. Numerous parts of the left main landing gear, including two wheels and tires, were found embedded in a small berm about 1,430 feet from the initial impact point. Most of the fuselage structure was located in the main wreckage area and was found separated into five major sections: the empennage, the aft fuselage, the center fuselage, the forward fuselage, and the cockpit. Figures 8a and 8b are photographs of the wreckage from Korean Air flight 801. Figure 8a shows the airplane wreckage in relation to runway 6L, the NIMITZ VOR, and Apra Harbor.65 Figure 8b provides a closer view of the wreckage and the VOR. Figure 8a. Wreckage from Korean Air flight 801 in relation to Guam International Airport runway 6L (upper middle), the NIMITZ VOR (upper right), and Apra Harbor (upper left). 65 Apra Harbor is located 5 DME on the approach course.

Factual Information 39 Aircraft Accident Report 1.12.2 Fuselage and Empennage The cockpit section was located down an embankment beyond the large portion of the forward fuselage. The airplane’s VHF [very high frequency] navigational radio control panels were recovered from the wreckage. To determine which radio frequencies were selected on both the captain’s and the first officer’s control panels in the cockpit, an examination was conducted on October 2, 1997, under the Safety Board’s supervision, at Pacific Aero Tech, an FAA-approved repair station for the control panel, in Kent, Washington. The captain’s frequency selector was found tuned to 110.30 megahertz (MHz), which was the Guam localizer frequency. The captain’s control panel had been damaged by impact forces, and the frequency depicted was locked into a position that could not be changed by turning the frequency selector knob. The first officer’s control panel selector knob could be easily rotated, and the frequency selector was found tuned to 116.60 MHz, which did not correspond to any voice or navigation frequencies at Guam. The cockpit section was found separated about station66 400. Most of the aft nose wheel well structure (nose gear attachment point) was relatively intact with the trunnion Figure 8b. Closer view of the wreckage from Korean Air flight 801 and the NIMITZ VOR. 66 Station refers to a specific location on the airplane, as measured from a data point. Examples include fuselage station, typically measured from a point forward of the nose of the aircraft, and wing station, typically measured from a point at the wing root and extending outward.

Factual Information 40 Aircraft Accident Report support fittings, drag brace fittings, and transverse beam still attached. Examination of the nose landing gear and the wing- and body-mounted landing gear revealed that they were in the extended position at the time of impact. This section of fuselage structure revealed no evidence of fire damage. The forward fuselage section approximately from stations 400 to 1120 was located on the upslope of a hill beyond the center fuselage section. The fuselage structure was split above the main deck floor on the right side, and most of the internal structure (frames, stringers, and fractured floor beams) remained attached. The structure exhibited extensive fire damage, including burn-through of the crown area (upper forward fuselage), sidewalls, and floor. Examination of doors 1L, 1R, 2L, and 2R could not be performed in detail because the airframe structure around these doors was heavily burned, and only portions of the doors were located in the main wreckage site. The door identified as 3L was found closed and locked. Door 3R was found separated from the fuselage, with more than one-half of the door frame area missing because of fuselage separation in this area. According to Korean Air records, the 3L and 3R doors were deactivated before the company took delivery of the airplane. The doors identified as 4L and 4R were found detached from their respective mounted positions, and approximately one-third of the 4R door frame was missing. Door 5L was found closed and locked. Door 5R was found in the open position; however, the door handle was not in the full open position. The upper deck doors were not located; these doors were mounted in an area of the fuselage that sustained extensive fire damage. The center portion of the fuselage structure, extending from stations 1120 (left side) to 1240 (right ride) and aft to station 1780, was found attached across the crown area and to the right wing by the landing gear beam. The landing gear beam at station 1350 was attached to the fuselage section. The entire center section was found rotated about 180° to the debris path, with the forward end of the section facing the aft body and empennage. The interior was extensively damaged by fire throughout the section. The exterior fuselage skin bore fire damage primarily adjacent to the break, and the right-side fuselage skin was heavily burned between doors 3R and 4R. The exterior fuselage surface was lightly sooted on the left side of the center section, and the exterior of the right side bore evidence of light soot and areas of fire damage around the periphery of door 5R. The interior was damaged by fire from the main deck floor level to the belly; however, the upper portions of the internal structure were not burned significantly. The aft pressure bulkhead was intact, with the lower portion deformed. The bulkhead was not damaged by fire. The empennage was found separated from the aft fuselage in an upright position. The empennage had sustained impact damage and some light fire damage. The left- and right-side horizontal stabilizers, their respective elevators, and the vertical fin (with the rudder attached) remained attached in their respective mounted positions.

Factual Information 41 Aircraft Accident Report 1.12.3 Wings The left and right wings were located on the left side of the airplane in the main wreckage area. The right wing remained attached to the fuselage center section, and the left wing was located under the fuselage and right wing. The outboard section of the left wing was located approximately parallel to and under the right wing section. This portion of the left wing structure was approximately 80 percent intact and had sustained extensive postimpact fire damage to the upper skin and midspar (between wing stations 470 and 1200), including the midspar web and chord structure. The corresponding lower skin and stringers also exhibited considerable fire damage. Exposure to the postimpact fire resulted in various degrees of damage to the remaining wing structure, including the leading edge and trailing edge flap structure. The outboard wing tip, which comprised 10 composite aluminum and fiberglass structures, was found separated from the wing box at the surge tank end rib at wing station 1548 and was not damaged by fire. Most of the right wing inboard and outboard trailing edge flaps and support structure were found intact and attached to the wing box, except for approximately 6 feet of the inboard fore, mid, and aft flap structure of the inboard-most section of the flap. This section had separated and was found in the debris path in the vicinity of the initial impact point. Examination of the ball screw indicated the flap extension was approximately 25°. All of the leading edge variable camber flap and inboard Krueger flap structure was destroyed by impact forces and the postcrash fire. The trailing edge flaps and control surfaces were found relatively intact with some localized fire damage, except for the inboard flap system, No. 4 flap track, and No. 6 spoiler, which separated from the wing box during initial impact. The No. 1 through No. 5 flight spoilers were found in place in a neutral position at the in-spar box structure. The spoilers exhibited extensive fire damage. The No. 6 ground spoiler had separated from the wing and could not be located among the wreckage. Examination of the spoiler support beam revealed evidence consistent with overload from impact forces. The full combination of outboard flap and support structure on the left wing was found in place on the wing box with a detent extension indicative of approximately 25°. All of the inboard flap and most of the support structure had separated from the wing box and was found along the wreckage path, with numerous parts in the area of the initial impact point. 1.12.4 Engines All four of the engines were found separated from their respective mounted positions on the airplane. The No. 1 engine was located about 970 feet from the initial

Factual Information 42 Aircraft Accident Report impact point and about 1,300 feet from the main wreckage site. The other three engines were all located within the main wreckage site. All of the engines sustained damage to the fan blades, with the tips and leading edges bent opposite to the direction of rotation. Further, vegetation and dirt had been ingested into the fans and low-pressure compressors of each of the engines. Examination of the rotating parts within each engine revealed evidence of rotational smearing, rubbing, and blade fractures that were consistent with the engines producing power at the time of impact. Further, none of the four engines exhibited any evidence of uncontained failures, case ruptures, or in-flight fires. All of the thrust reverser actuators that were found indicated that the thrust reversers on each of the engines were in the stowed position. 1.13 Medical and Pathological Information Tissue and fluid samples from both pilots and the flight engineer were transported to the FAA’s Civil Aeromedical Institute (CAMI) for toxicology analysis. The CAMI laboratory performed its routine analysis for major drugs of abuse and prescription and over-the-counter medications, and the results were negative. The analysis detected ethanol in the blood and tissue samples of both pilots and the flight engineer, but no ethanol was detected in the vitreous (eyeball) fluid sample taken from the captain. All specimens were noted in the laboratory report to have been received by CAMI in a “putrefied” condition. According to the captain’s medical records, he consulted a personal physician on July 27, 1997, and was diagnosed with bronchitis. The physician prescribed three medications: Copan (clenbuterol), a medication to open the upper airways; Vibramycin (doxycycline), an antibiotic; and Sentil (clobazam), a medication in the benzodiazepine class of drugs that is frequently used as a sedative.67 The postmortem tests conducted by CAMI on the captain’s blood specimen were negative for benzodiazepines, and no CAMI testing was available for the detection of Copan or Vibramycin. The remains of deceased airplane occupants were examined by the Disaster Mortuary of Guam to determine the cause of death. Because many of the remains were fragmentary, the total number of remains sets (300) exceeded the number of accident fatalities. Autopsy examinations and toxicological analysis determined that the airplane occupants died of blunt force trauma, thermal injuries, and carbon monoxide inhalation. Complete autopsies and toxicological evaluations were performed on the remains of the three flight crewmembers (as discussed previously.) Of the 297 non-flight crewmember 67 The captain did not advise Korean Air, before the July 28 to July 30, 1997, round trip flight from Seoul to San Francisco that he had been diagnosed with bronchitis and prescribed medications for the condition, nor did he receive medical approval from the company to conduct this trip. Korean Air’s Operations Manual, chapter 4-12-4 (dated May 21, 1997), requires that a crewmember who “must be on duty under influence of medication, shall follow the direction of an Aeromedical Specialist.” International Civil Aviation Organization (ICAO) Annex 1, section 1.2.6 (dated November 16, 1989), specifies that license holders should not exercise the privileges of their licenses and related ratings at any time when they are aware of any decrease in their medical fitness that might render them unable to safely exercise these privileges.

Factual Information 43 Aircraft Accident Report sets of remains, about 145 sets could not be evaluated for soot in the airway because the condition of the remains precluded an evaluation. Of the 137 remains sets that could be evaluated, soot was found in the airway of 20 sets, no evidence of soot was found in 41 sets, and no definitive observations could be made regarding soot in the airway for 76 sets (in many of these 76 cases, however, the traumatic injuries described would have precluded survival after the impact sequence). Information was not available for the final 15 sets of remains. 1.14 Fire A fire erupted during the impact sequence and was sustained by the fuel on board the airplane; the last report of small remaining fires was about 0800. The Safety Board’s investigation revealed no evidence of an in-flight fire. 1.15 Survival Aspects 1.15.1 General The 747-300 cabin contained a total of 385 passenger seats and was divided into three sections: first class, prestige (business) class, and economy class. The airplane was configured with four rear-facing, double-occupancy flight attendant jumpseats and six rear-facing, single-occupancy flight attendant jumpseats, all of which were equipped with a four-point restraint system. The flight attendant seats were located at each of the four emergency exit doors located on the left and right side of the cabin. Of the 237 passengers aboard flight 801, 3 were children between 2 and 12 years old, and 3 were children 24 months or younger. Thirty-one airplane occupants were found alive by rescue workers Two passengers died en route to area hospitals. The autopsy report for one of these two passengers did not identify a single cause of death (her remains showed evidence of multiple internal injuries but no burns or soot in her airway). The autopsy report, however, identified that she was alive when medical personnel arrived at the accident scene and that she was treated aggressively as a result of serious injuries. In addition, 3 passengers died of their injuries within 30 days after the accident, bringing the official total number of accident survivors to 26. Of the 26 survivors of the accident, 7 passengers and 1 flight attendant were seated in the first class section, 1 flight attendant was seated in the prestige class section, 7 passengers were seated in the forward economy class section, and 9 passengers and 1 flight attendant were seated in the aft economy class section. Two of the surviving flight attendants and 13 of the surviving passengers were seated on the right side of the airplane; 6 of these 13 passengers were seated over the right wing. Figure 9 shows the 747-300 cabin configuration and the survivor seat locations.

Factual Information 44 Aircraft Accident Report Figure 9. Korean Air flight 801 cabin configuration and survivor seat locations.

Factual Information 45 Aircraft Accident Report 1.15.2 Survivor Statements Safety Board investigators and MOCT officials interviewed a surviving flight attendant and several passengers in a Guam hospital on August 9, 1997. In addition, 11 passengers responded to a Safety Board “Survivor Questionnaire” after returning to Korea. Information obtained from the interviews and questionnaire responses indicated that these survivors either had been ejected from the airplane during the impact sequence or had extricated themselves from the wreckage. Most of these survivors indicated that they were injured as a result of the impact; however, two survivors stated that they were injured by fire. Further, the survivors stated that, during their egress from the airplane, they encountered damaged seats, overhead bins that had fallen, and other unidentified obstacles. A flight attendant who was seated in the R1 jumpseat (in the first class section) stated that she heard a loud “boom” before the airplane began shaking violently and breaking up. The flight attendant said that she was thrown from the airplane in her jumpseat during the impact. She then unfastened her restraint system, walked about 30 feet beyond the right side of the airplane, and assisted a female passenger. Several surviving passengers stated that, after the impact, baggage from the overhead bins fell to the floor and that “intense flames and heat swept through the cabin.” One survivor, who was seated in the aft economy class section (row 34), stated that her husband was engulfed by fire in the seat next to hers. Another passenger, a professional helicopter pilot, stated he felt what he thought was a “hard landing” but that the airplane then rolled and began to disintegrate. The passenger stated that he exited the burning cabin by walking through a large hole in the fuselage. He also said that a “ball of flame was going down the center of the airplane” and that passengers were screaming and calling for help. 1.15.3 Emergency Response About 0150, the Guam Fire Department (GFD) communications center received an emergency call from a local resident, who reported seeing a fire in the hills near the airport. About 0158, after receiving notification of the accident from the CERAP controller (based on the Ryan International flight crew’s observation of a “big fireball on the hillside”), the Agana tower controller alerted ramp control about the crash of Korean Air flight 801.68 According to airport ramp control logs, ramp control initiated the required emergency notifications at 0202, including a call at 0208 to the Naval Regional Medical Center to place its personnel on standby. According to GFD communications center logs, notification of a downed aircraft was received from the Guam ramp control at 0207. Immediately afterward, the GFD communications center dispatched Engine Company No. 7, which was located about 3 ½ miles from the accident site. According to the GFD chief, the departure of Engine No. 7 was delayed because its brakes had been drained to prevent an overnight buildup of condensation in the brake lines.69 Thus, the brake lines had to be first recharged with air. Engine No. 7 departed the station at 0219 (12 minutes 68 According to the Guam airport emergency response guidelines, ramp control is responsible for providing all communication/dispatch functions in the event of an emergency.

Factual Information 46 Aircraft Accident Report after being notified) and arrived 15 minutes later (at 0234) at the gate to the pipeline/VOR access road (which was the only vehicle ground access to the accident site). The Federal Fire Department’s Station No. 5, located on Nimitz Hill 1 mile away from the accident site, was the nearest fire station.70 GFD communications center logs indicated that the federal dispatch facility was notified of the accident at 0207, but the federal dispatch facility records indicated that notification was received at 0234 and that Engine No. 5 arrived at the scene at 0239. The Chief of Staff, Commander, U.S. Naval Forces, Marianas, who was also the wife of the airport director, testified during the public hearing that she first became aware of the crash after an airport official called her husband at 0216 to report that a Korean Air 747 was missing over the Nimitz Hill area. The Chief of Staff went outside and observed a “bright orange glow” in the sky. She then notified the Navy Security Office and Command Duty Officer to activate the Navy’s “first responders,” search and rescue assets, and hospital mass casualty units. The GFD incident on-scene commander (OSC) told investigators that he arrived at the accident site about 0234 and proceeded down the access road toward the wreckage. The access road to the site—a narrow (one-lane) dirt and stone road with a drainage ditch on both sides—had been blocked by a section of damaged oil pipe. The pipe, which was located next to the road and elevated about 3 feet, was removed 1 hour later by a truck- mounted winch after efforts to remove it by hand were unsuccessful. According to GFD documents, Engine No. 7 became stuck in mud when the driver tried to maneuver around the oil pipe obstruction. The GFD chief stated that, once the broken pipeline had been removed and the fire truck had been towed out of the mud (about 0345), no further blockages of the access road were reported. In a postaccident interview and at the Safety Board’s public hearing, the OSC testified that he and other rescue personnel abandoned their vehicles and approached the accident site on foot. The OSC indicated that he and the rescue personnel carried flashlights, rope, and a trauma kit. The OSC stated that he heard people screaming and could see small areas of fire. The OSC said that the darkness and terrain made access to the accident site difficult. The OSC stated, “we had to go across all types of vegetation, sword grass, all types of trees…it was very rough getting down to the crash site, especially with no light whatsoever but flashlight alone…we had to deal with all kinds of bugs down there, snakes...we tried to pull out the survivors the best way we could and from what we received in fire-fighting training.” The OSC also stated that 69 After the accident, GFD policy was changed to drain fire truck brake lines only during periodic maintenance to prevent moisture from contaminating the lines. The GFD chief stated that a fire truck would not be taken out of service without having another vehicle in its place. 70 The Federal Fire Department’s Station No. 5 is responsible for providing fire protection to U.S. Naval facilities on Guam.

Factual Information 47 Aircraft Accident Report the airplane [had been] totally engulfed [in fire] when we got there...already to the point where the fires weren’t really bothering the rescuers. The rescue personnel were actually going into the plane checking passengers…who was still alive and who was not…. We had to go back up on those slippery hills without any rappelling gear whatsoever…. We were holding the victims in one arm and holding the tools in the other so we just could make it to the top…. We did this until we could clear a landing site for the choppers…. The OSC stated that a command post was established to the east (on higher terrain) of the main wreckage site, where requests for resources and personnel were relayed by radio to the GFD dispatcher. The dispatcher then relayed the information to the response activity coordination team located at Guam Civil Defense (GCD) headquarters. The GCD director told Safety Board investigators that he arrived at the access road gate about 0235. The director stated that the GCD owned a command post vehicle but that he did not use the vehicle because it was outdated and had been out of service for several years. He stated that funds were not available to repair and equip the vehicle.71 A U.S. Navy emergency medical technician (EMT) assigned to the Naval Regional Medical Center told Safety Board investigators that he received verbal notification of the accident between 0200 and 0230 from personnel at the Guam Naval Activities Station, which is located about 8 miles southwest of Nimitz Hill. The EMT reported that he arrived at the accident site on foot between 0245 and 0300. Upon arrival, the EMT observed the fuselage and interior engulfed in “bright blue flames.” The EMT stated that he approached the burning wreckage to within about 150 feet and saw about 14 survivors outside the airplane with various injuries, most of which were burn related. The EMT said that many of these survivors were clustered together and that they appeared to have extricated themselves from the wreckage. The EMT told investigators that it was difficult to maneuver around the wreckage because of darkness, intermittent rain, soft ground, tall grass, and rugged terrain. Further, the EMT stated that two triage areas had been set up: one near the front of the airplane (near the nose section), and the other between the fuselage wreckage and the access road. A Guam Department of Public Health physician told Safety Board investigators that she was notified of the accident by GCD about 0245 and arrived at the accident site about 0315. Upon arrival, she noted that the triage and transportation activities were “functioning well” but that medical and evacuation efforts lacked coordination. Additionally, she said that, after assessing the situation, she established another triage area near the VOR, where the terrain was level. Some of the survivors that had been treated at the triage area near the airplane were evacuated by military helicopters, whereas others had been carried to the triage area near the VOR to be treated and then transported by ambulance via the access road. The OSC 71 After the accident, the regional director of the Federal Emergency Management Agency stated that the agency would provide money to refurbish the command post vehicle.

Factual Information 48 Aircraft Accident Report stated that the first survivors were transported to hospitals between about 0300 and 0330. The EMT stated that the last survivor was found about 0430. According to hospital records, the first survivor transported by helicopter to the U.S. Naval Hospital arrived about 0334, and the last survivor arrived by helicopter about 0710. Also, hospital records indicated that the first survivor transported to Guam Memorial Hospital arrived by ambulance about 0420 and that 16 other survivors were transported by ambulance to Guam Memorial, the last of which was admitted about 0709.72 1.15.3.1 Emergency Response Planning and Exercises At the Safety Board’s public hearing, the GCD director testified that, in April 1997, a joint full-scale disaster drill had been conducted on the airport with Guam airport authorities.73 The GCD director stated that no off-airport drills had been conducted before the accident but that an off-airport aircraft accident drill had been scheduled for September

1. The GCD director added that, after the accident, new radios had been purchased to

allow interagency communication and coordination during emergencies. The GCD director also testified that, before the accident, GCD authorities had a memorandum of understanding (MOU) with the U.S. Air Force for emergency response but had not established an MOU with the U.S. Navy or U.S. Coast Guard. The GCD director stated that, after the accident, Guam authorities formed an emergency response committee, which included the Navy, the Coast Guard, and the Air Force, and that an MOU involving all emergency response agencies on the island had been drafted. The director stated that the MOU called for emergency response drills involving all of the agencies. In June 1999, the GCD acting administrator stated that, instead of the MOU, a final draft of “Joint Standard Operating Procedures for Mutual Civil Emergency Support for Emergencies or Disasters Without Presidential Declaration” was circulated to the GCD office; Commander, Naval Forces Marianas; U.S. Coast Guard Marianas Section; and the U.S. Air Force 43rd Air Base Wing. The acting administrator indicated that the procedures could be implemented by the end of June 1999. The Safety Board’s latest information from the GCD office (August 1999) indicated that the procedures had not been implemented. Officials from the GCD office stated that the planned September 1998 off-airport exercise did not take place. In June 1999, the GCD acting administrator stated that planning for a major off-site exercise had started. 72 Admittance times may be different than arrival times because patients received immediate emergency room treatment before being officially admitted to the hospital. 73 Title 14 CFR Section 139.325, “Airport Emergency Plan,” paragraph (g)(4) and (5), requires the certificate holder, that is, the airport, to “at least once every 12 months, review the emergency plan with all the parties with whom the plan is coordinated…ensure that all parties know their responsibilities…and hold a full-scale airport emergency plan exercise at least once every three years….”

Factual Information 49 Aircraft Accident Report 1.15.4 Guam Governor’s Accident Response Review The Guam government conducted a review of its response to the accident and issued a report, titled Korean Air 801 Incident Report. According to the report, the “focus of the investigation was to identify an accurate timeline of emergency response during the first hours of the incident, and to address issues/questions raised concerning the rescue efforts. Those issues/questions concerned fire suppression, command structure and activity of key members of the rescue team.” Problems discussed in the report included the lack of radio communications between key personnel, which complicated the command situation. The report stated, “…the civilian and military components were on different and incompatible radio systems…radios had to be shared in the command post so that the various agencies could communicate.” Additionally, the report cited the remoteness of the accident site and the difficulty in bringing fire trucks close enough to the site to be effective. However, the report stated that “no fire suppression was used” because it would have “interfered with rescue operations.”74 The report also cited accounts from rescuers that indicated, “…most of the survivors were initially located away from the flames of the aircraft…. It is noted that the first rescuers arrived approximately 55 minutes after the plane had crashed…. If the fire was as intense as originally reported [immediately after impact], fatalities caused by fire and smoke inhalation would have occurred before the rescuers arrived.” 1.16 Tests and Research 1.16.1 Enhanced Ground Proximity Warning System Simulation Because of advances in computer technology and terrain mapping capabilities, GPWS manufacturers have developed improved terrain avoidance systems. In 1997, the FAA certified a new terrain awareness and warning system (TAWS), also known as enhanced GPWS. (See section 1.18.2.2 for general information about enhanced GPWS.) This system was not installed or required on the accident airplane.75 An enhanced GPWS simulation was conducted after the accident to determine the additional forewarning that the flight crew of Korean Air flight 801 would have received if such a system had been installed on the airplane. The simulation revealed that the flight crew would have received an aural “CAUTION TERRAIN” warning and a yellow visual terrain depiction on the weather radar about 60 seconds before impact. In addition, 74 The report stated that water and foam were available on the fire trucks at the scene but that “water would have spread…fire caused by fuel” and “foam would have caused further injury to those with burns and/or open wounds.” The report also added that airborne water buckets would have pushed the toxic gases and smoke onto rescuers. 75 At the time of the accident, no enhanced GPWS system had been certified for the 747-300 series airplane.

Factual Information 50 Aircraft Accident Report enhanced GPWS would have provided the aural annunciations “TERRAIN, TERRAIN” and “PULL UP” and a red visual terrain indication on the weather radar display about 45 seconds before impact; the annunciations would have sounded continuously until completion of a successful escape or impact with terrain. In July 1999, Korean Air announced that it would equip all of its aircraft with enhanced GPWS by the end of 2003. The KCAB subsequently confirmed Korean Air’s announcement. 1.16.2 Minimum Safe Altitude Warning System Simulation An ARTS IIA MSAW simulation was conducted after the accident at the FAA Technical Center in Atlantic City, New Jersey. The simulation indicated that, without the 54-nm-inhibited ring, a visual and aural low-altitude alert would have been generated for flight 801 on the terminal ARTS IIA display at the CERAP facility. Further, the simulation indicated that the visual and aural approach path alert would have been generated at 0141:22, as the airplane was descending through 1,700 feet msl, or about 64 seconds before the airplane crashed. 1.16.3 Korean Air Spurious Radio Signal Tests After the accident, the KCAB and Korean Air conducted a series of independent tests on a Boeing 747 on the ground to determine if spurious radio-frequency energy could induce an abnormal (“false”) glideslope indication. These tests were not intended to represent conditions at the time of the accident; rather, the tests were designed to explore ILS system sensitivity to spurious signals. According to Korean Air engineers, the tests revealed that the glideslope deviation needle could be positioned near the middle of the glideslope reference scale, and the warning flag could be retracted by introducing a “335 MHz signal (120 Hz signal modulated at 100 percent)” near the ILS receiver antenna.76 The KCAB and Korean Air technical staff demonstrated their test results to the Safety Board and parties to the investigation at a January 1998 meeting. The demonstration, which was conducted using a portable 51-RV5(B) receiver and a signal generator, indicated that a single 120-Hz signal with 100-percent modulation at the Guam ILS frequency resulted in an out-of-view glideslope flag and glideslope indicator movement. If a glideslope signal is not being generated by the transmitter (resulting in an open frequency channel/band), the airborne glideslope receiver will continue to hunt for a glideslope signal. Although the radio-frequency filters built into the receivers are designed to bias out the majority of spurious radio signals, the postaccident testing by the KCAB and Korean Air revealed that, in the absence of a valid glideslope signal, it is possible for an airborne glideslope receiver to momentarily receive a spurious signal in the frequency 76 See Public Hearing exhibit 9F for detailed information regarding these spurious signal tests.

Factual Information 51 Aircraft Accident Report band of the glideslope signal. The reception of such a signal could result in the movement of the glideslope receiver needle and present a false indication to the pilot. 1.16.3.1 Guam Instrument Landing System and Potential Interference From Spurious Radio Signals An FAA National Resource Engineer for Navigation testified at the Safety Board’s public hearing about the Guam ILS system and the potential for interference from spurious radio signals. The engineer stated that “the pilot would normally be warned that a signal is not present by the presence of a flag, a warning flag, that indicates that something about the receiver system or something about the ground system is abnormal....” The engineer testified that he assumed that the accident flight crew’s remarks regarding the glideslope (as recorded on the CVR) had to do with the presence or absence of flags. He concluded that “...there must have been some sort of flag activity coming into view, disappearing from view, some time during the approach” and that the comments, although they did not convey information about the duration of any flag activity, indicated that “...there must have been enough absence of the flag for the crew to occasionally decide that the system was on the air when in fact it wasn’t….” The FAA engineer also testified that, although the glideslope at Guam International Airport had been removed from its shelter, radio signals generated by some other source could have provided an intermittent signal to the glideslope receiver, which might have prevented the instrument warning flag from remaining in view. The engineer explained that potential external sources of noise and unintended signals, which are normally too weak to be heard, can be heard on an empty channel and that, during airborne flight tests of ILSs in which the localizer or the glideslope is turned off, it has been fairly common for the cockpit instrumentation to record intermittent indications of flag and needle activity. However, he expressed that this sort of activity on the instrumentation (referred to by pilots as “flag pops”) is typically intermittent and of very short duration. The engineer testified about the types of radio signals that could potentially cause a movement of the flag. He stated that the ILS transmits two tones and that the difference in the signal strength of the tones deflects the glideslope fly-up and fly-down needle. The engineer indicated that the receiver has some circuits that look for these two tones and that the fly-up/fly-down needle indicates the difference in strength of those two tones. He added that “...the difference will be zero, and the needle will be centered when the two tones are equal….” Further, the FAA engineer stated that the flag circuit, the other indication that a pilot sees, is driven by a signal that is the sum of the two circuits or the two signals. He indicated that “as long as the 90 and 150 [Hz] signals are both present at sufficient strength, the flag will remain out of view.” The engineer also stated that, if there is no ground station transmitting and no intended ground station but some other signal, then those portions of the signal that contain 90- and 150-Hz tones77 would still get through those filters and could cause the needles to deflect. The engineer added that, depending on

Factual Information 52 Aircraft Accident Report the shape of the filters’ response (which varies according to receiver model and manufacturer), the circuits would experience varying amounts of intermittent deflections. 1.17 Organizational and Management Information Korean Air evolved from Korean National Airlines, a government-owned carrier established in 1948 to provide domestic air service from Seoul to Pusan. The airline was privatized in 1969 and renamed Korean Airlines. The name was again changed to Korean Air Company, Ltd., d.b.a. Korean Air, in the 1980s. Korean Air, based at Seoul’s Kimpo International Airport, operates domestic routes to 16 airports and international routes to 54 airports, including those in North America, Europe, the Middle East, Southeast Asia, China, Australia, and Japan. At the time of the flight 801 accident, Korean Air had a fleet of 116 airplanes: 2 Boeing 747-SPs, 15 Boeing 747-200s, 3 Boeing 747-300s, 26 Boeing 747-400s, 2 Boeing 777s, 5 McDonnell Douglas MD-11s, 14 McDonnell Douglas MD-82s, 10 Airbus A-300s, 2 Airbus A-330s, 25 Airbus A-300-600s, and 12 Fokker F.100s. Korean Air stated that its fleet was expected to grow to approximately 175 aircraft by 2005. Korean Air employed approximately 1,600 flight crewmembers at the time of the flight 801 accident. In an interview with Safety Board investigators, Korean Air management personnel stated that pilot recruitment at the company had historically been from the Korean military. However, as the airline grew, the supply of available Korean military pilots could not keep pace with the rapidly increasing demand for pilots at the company. Because of this shortage, Korean Air recruited foreign nationals to supplement its pilot force. At the time of the accident, 167 foreign national pilots were employed by Korean Air. (Most of these foreign pilots were from the United States and Canada and were hired through several crew leasing companies; the pilots’ employment was subject to the terms of a renewable contract.) Of the 128 captains assigned to 747-200, -300, and -SP airplanes at the time of the accident, 69 were foreign national pilots. Also, partly as a result of the pilot shortage, Korean Air began what it referred to as an “ab-initio” (that is, from the beginning) program in 1989 that was designed to select and train candidates from zero flight time. According to a Korean Air representative, ab-initio- trained pilots were initially assigned to the smaller airplanes used to fly domestic routes. As the pilots gained experience, they were upgraded to the larger airplanes used primarily to fly international routes. At the time of the accident, 389 pilots had been trained under the ab-initio program, and Korean Air estimated that the first group of ab-initio pilots would be evaluated for possible upgrade to captain during 1998. In September 1999, a KCAB official stated that the first ab-initio-trained pilots were being upgraded to captain. 77 The FAA engineer indicated during his testimony that voices and music contain 90- and 150-Hz components.

Factual Information 53 Aircraft Accident Report The Korean Air Deputy Director of Flight Operations testified at the Safety Board’s public hearing that the Korean economy had been in a recession and that, although 1995 was “a good year,” 1996 and 1997 were “in the red.” This official also testified that, despite economic pressures, additional funding had been allocated by the company for safety programs. The Deputy Director of Flight Operations, in his closing remarks at the public hearing, stated: Looking back upon this accident we feel that most of our management up to now has been [ ] perhaps too short-term, short-[sighted], and superficial in its nature. …from this point on for the purpose of ascertaining safe flight operations we plan to make long-term plans and spare no resources in [attaining] this final objective of flight safety. Accordingly, we will adjust our management systems and invest all the more heavily into training and program development.78 In a March 26, 1998, letter, however, Korean Air requested that the Safety Board remove the Deputy Director of Flight Operations’ statement from the public hearing record. In its letter, Korean Air maintained that the deputy director’s statement was “personal in nature” and “made in accordance with the Korean custom to express condolences on public occasions to those affected by an accident.” The letter also said that “the statement could suggest a finding by [Korean Air] of management deficiencies having been ascertained as a result of internal review” and that “there has been no such finding or review.” Further, the letter expressed Korean Air’s belief that the company’s management structure “is competent to perform its functions.” The Safety Board did not delete the statement from the record. According to the KCAB, Korean Air’s president resigned in April 1999 as a result of government criticism. The vice president of Korean Air was subsequently promoted to president and chief executive officer. 1.17.1 Korean Air Postaccident Safety Initiatives On October 9, 1998, the MOCT ordered Korean Air to suspend 138 flights per week on 10 of its domestic routes for 6 months. According to the MOCT, the action followed seven accidents/incidents (including the August 5 and September 30, 1998, events listed in section 1.17.5.2). The MOCT ordered the airline to reduce service on its Seoul to Tokyo route from 28 to 26 flights per week. According to a KCAB representative, “these accidents/incidents were without human casualties, but we mete out the severe punishment as a warning.” The KCAB indicated that other administrative actions against Korean Air included the following: • increased captain qualification requirements for large aircraft (including the 747),79 • prohibition of initial assignment of large aircraft for first officers, 78 Korean Air’s Deputy Director of Flight Operations further testified that “…starting on the 1st of April [1998] the company is under contract to receive expert consultation of comprehensive nature from a well- known and well-respected international organization.”

Factual Information 54 Aircraft Accident Report • increased simulator training for CRM and line-oriented flight training (LOFT), and • special simulator training for adverse weather conditions. After the MOCT took action, Korean Air announced that it planned to spend more than $100 million over the next 2 years on safety initiatives, including changes in pilot training and maintenance operations. Korean Air also stated that it planned to accomplish the following: • install enhanced GPWS on all new aircraft and upgrade traffic alert and collision avoidance systems (TCAS) on all airplanes; • recruit safety specialists to provide safety awareness training to all flight crewmembers; • conduct regular aircraft-specific safety and training sessions for flight crews, including an expanded controlled flight into terrain (CFIT) awareness program in both initial and upgrade training; • develop a “safety alert system” in which data about incidents, accidents, and irregular operations are gathered from every department and analyzed to identify trends and develop accident prevention strategies; • revise simulator scenarios that reflect a variety of situations that may be encountered during line operations, including takeoffs and landings from different airports, TCAS avoidance maneuvers, and ground proximity escape maneuvers; • standardize pilot callouts, improve takeoff, approach, and landing checklists, and enhance pilots’ knowledge of local terrain; and • ensure that all flight crewmembers receive CRM and LOFT classes that require “efficient and effective communication in the cockpit and cabin through simulated situations.” Korean Air also indicated that it planned to mandate a 30-day English language training course and implement a confidential pilot reporting system so that errors and concerns can be reported to the chief pilot without fear of reprisal. In addition, the airline implemented a “maintenance error decision air program” designed to detect potential maintenance anomalies caused by human error. In May 1999, Korean Air’s new president issued a safety policy statement and additional material to support the company’s planned safety enhancements. Specifically, Korean Air reevaluated its operational philosophy and adopted a five-point “Immediate Action Plan,” which contained safety measures that were designed to “minimize exposure 79 The increased requirements were a 2-year freeze period as a captain on small- and medium-sized aircraft in Korean Air’s fleet, 500 landing cycles on small- and medium-sized fleet aircraft, 350 landing cycles on large fleet aircraft, and 4,000 hours of flight time with the company.

Factual Information 55 Aircraft Accident Report to risk, eliminate known hazards, and curtail operations under circumstances where there may be reduced margins of safety.” First, the Immediate Action Plan imposed operational limits at five airports in Korea to minimize exposure to risk when the margin of safety may be reduced. For example, at three of the five airports, no operations can be conducted at night when the runways are wet or crosswinds exceed 15 knots. Second, the plan contained Korean Air’s revised policies and procedures for operations under slippery runway conditions80 and the use of automation.81 Third, the plan included Korean Air’s decision to outsource flight simulator training.82 Fourth, the Immediate Action Plan stated that Korean Air’s most important operating priority is safety. According to Korean Air, every company line captain participated in a series of seminars in April 1999 in which the captain’s decision-making, authority, and responsibilities were redefined. These seminars reemphasized that the captain “serves as the first, and last, line of quality assurance for [Korean Air], and is charged with final responsibility for the safety of its flight operations.” Last, the plan provided senior management’s commitment to enhance decision- making, especially as it relates to flight safety matters. The plan stated that Korean Air created an Executive Action Council to resolve critical operational and support issues in a timely manner and a Flight Operations Action Team to identify and resolve critical flight operations issues. According to Korean Air, new flight crew work rules will become effective in October 1999. The new rules are expected to be similar to the duty and rest standards established under 14 CFR Part 121 and the practices of leading airlines in the industry. Korean Air indicated that its goal was to eventually achieve a standard of 80 hours of flying time per month. Also, Korean Air stated that it was in the process of implementing an automated flight crew scheduling system purchased from Sabre Technologies. This new system was designed to monitor crew training and instrument and landing currency and automatically update compliance with flight and duty limitations. The system was expected to be fully implemented by the end of 1999. 80 Regarding Korean Air’s revised policy on slippery runway conditions, the Immediate Action Plan stated that “wind gusts are to be taken into account when computing maximum allowable cross/tailwinds, allowable wind conditions must be adjusted to take into account braking action categories...[and] auto land approaches, new minimum stopping distances...[and] improved guidelines for determining wet runways must be observed, and more stringent takeoff and landing restrictions for marginal runway conditions have been adopted.” 81 According to Korean Air’s Immediate Action Plan, “automation should be at the most appropriate level. The level used should permit both pilots to maintain a comfortable workload distribution and maintain situational awareness.” 82 Korean Air decided to outsource all simulator training activities to FlightSafetyBoeing. The details for this arrangement were finalized in June 1999. Korean Air expected that the outsourcing program would begin in the latter part of 1999.

Factual Information 56 Aircraft Accident Report In addition, Korean Air indicated that it has been revising its Flight Operations Manual, Aircraft Operating Manual for each aircraft type, Operations Data Manual, and Aircraft Restriction Manual from the manufacturer-supplied versions to reflect the company’s standard operating procedures and achieve standardization. According to Korean Air, 8 of the total 21 chapters of the Flight Operations Manual were revised and distributed to all flight crewmembers on August 1, 1999, and the rest of the chapters were expected to be revised and distributed during October 1999. Korean Air also indicated that all of the company’s Aircraft Operating Manuals had been revised and issued according to each aircraft manufacturer’s schedule. A Korean Air representative said in September 1999 that the Boeing 747 operating manual had been revised four times since the flight 801 accident. 1.17.2 Korean Air Flight Crew Training Flight crew training is currently conducted at one of two facilities in Korea. Ground instruction is conducted at the Korean Air Flightcrew Training Center in Seoul, and simulator flight training is conducted at the Korean Air Simulator Flight Training Facility in Inchon. (Korean Air conducts its ab-initio training at the Sierra Academy of Aeronautics in Livermore, California, and then at its Cheju flight training facility.) To become qualified as a Korean Air flight instructor or evaluator, candidates must attend 1 week of ground school, 10 days of simulator observations, 10 days of practice simulator instruction, CRM and LOFT seminars, and check rides. Program managers and senior flight instructors provide supervision and ensure standardization. 1.17.2.1 Basic and Advanced Instrument Flight Course Korean Air provides basic and advanced instrument flight courses for every specific airplane training program. Pilots receive this training before their initial training on the particular airplane for which they are qualifying. Because the captain of the accident flight was initially trained on the Boeing 727, he took the 727 basic and advanced instrument flight courses; likewise, because the first officer was initially trained on the Boeing 747, he took the 747 basic and advanced instrument flight courses. (The captain received training on the 747 in transition courses, which are discussed in section 1.17.2.2.) According to Korean Air’s flight training curriculum at the time of the accident, the basic instrument course consisted of eight 4-hour simulator periods and included modules in air work and instrument departures, arrivals, and approaches. The advanced instrument course, which expanded on the procedures taught during the basic course, included avionics operation, standard instrument departures, noise abatement procedures, standard terminal arrivals (STAR),83 and engine-out procedures. The advanced course consisted of 10 4-hour simulator periods. The countdown/count up DME/localizer procedure, such as the one depicted in the Guam ILS runway 6L localizer-only (glideslope 83 STARs are routes established for arriving IFR aircraft. Their purpose is to simplify clearance delivery procedures and facilitate the transition between en route and instrument approach procedures.

Factual Information 57 Aircraft Accident Report out) approach, was not included in any of the Korean Air simulator training scenarios for either the basic or advanced instrument courses. 1.17.2.2 Boeing 747 Flight Crew Training Korean Air’s Boeing 747 flight crew training includes initial and transition training, which are presented in five units: ground school, cockpit procedures training, simulator flight training, airplane local training (as required), and route training. The captain and the flight engineer on the accident flight were trained according to the 747 transition training syllabus, and the first officer was trained according to the initial training syllabus. At the time of the accident, the 747 initial and transition ground school training included instruction on general aircraft systems, normal procedures, abnormal and emergency procedures, weight and balance, performance, limitations, differences, Category II instrument approaches,84 a review period, and a test. The initial ground school training syllabus allocated 177 hours of instruction for both pilots and flight engineers and required about 28 hours of cockpit procedures training. The transition ground school syllabus allocated about 153 hours of instruction for captains and first officers with type ratings on other airplanes and about 157 hours for flight engineers with qualifications on other airplanes. Pilots and flight engineers were required to complete about 24 hours of cockpit procedures training. Flight training for the initial and transition courses included 40 hours of simulator time (10 4-hour training periods in which each pilot performed as a PF and a PNF for 2 hours) and a 2-hour proficiency check period. At the time of the accident, the Korean Air simulator training syllabus for 747-100, -200, and -300 initial and transition training consisted of 10 profiles that described the events to be accomplished during each training period. Each profile listed the approaches to be performed, including the specific airport, runway, weather, and airplane malfunction, and information on whether the approach would be made to a landing or the reason for a missed approach or go-around. The 10 training profiles consisted of the following approach scenarios: • 23 ILS approaches to runway 14 at Kimpo Airport; • 5 VOR and VOR/DME approaches to runway 32 at Kimpo Airport; • 2 NDB approaches, one to a runway at Cheju Airport and one to a runway at another airport; and • 1 localizer (LOC) approach to runway 14 at Kimpo Airport. After accomplishing the 10 simulator training profiles, pilots were given a proficiency check using the scenarios contained in the 11th simulator profile. Korean Air 84 Category II instrument approaches have minimums of 100 feet decision height (DH) and a runway visual range of 1,200 feet.

Factual Information 58 Aircraft Accident Report training records indicated that the 11th simulator profile consisted of four ILS approaches to runway 14 at Kimpo Airport and one VOR/DME approach to runway 32 at Kimpo. The 747-200 Simulator Training Guide for Instructors, dated February 1997, detailed the various training scenarios used in 747-100, -200, and -300 simulator training at the time of the accident.85 The training guide described only one of the nonprecision approaches: the VOR/DME approach to runway 32 at Kimpo Airport. The description for this approach included the DME distance to initiate gear and flap configuration changes and specific vertical speed settings during step-down fixes on the approach procedure. Also, this nonprecision approach scenario always involved DME that was located on the airport and colocated and frequency paired with the primary approach navigational facility. Thus, all simulator approach scenarios using DME were approaches for which the pilot had to count down toward the MAP. The simulator training curricula did not contain nonprecision approaches to other airports or with varied or diverse scenarios. For example, no approach scenarios required the pilot to count down to the DME, fly past the DME, and count up to the MAP, which was required for the runway 6L ILS localizer-only (glideslope out) approach to Guam. At the Safety Board’s public hearing, Korean Air’s Director of Academic Flight Training and a Korean Air check airman testified that the simulator scenarios were to be followed as published in the training curricula. They also indicated that there were no provisions or guidance that enabled instructors to vary the nonprecision approach scenarios from those published. The Korean Air Simulator Training Guide contained specific approach scenarios to be used during proficiency checks and type rating simulator checks. These approach scenarios were the same ones taught and practiced during the initial and transition training sessions. After the accident and subsequent discussions with the Safety Board, the KCAB asked Korean Air to modify its simulator training syllabus to include diverse approaches. The Safety Board notes that the Korean Air simulator training now incorporates a variety of approach scenarios, including approaches in which the DME is not colocated with an on-airport navigational facility and approaches involving countdown/count up DME procedures. Also, the simulator training now includes approaches that are likely to be encountered during domestic and international line operations. 1.17.2.3 Crew Resource Management Program The Korean Air Director of Academic Flight Training stated that the company instituted a CRM training program in December 1986 as a result of the Korean Air shoot down accident in August 1983 off the coast of the Soviet Union. The director stated that the CRM sessions are not graded and that no program records are kept. Pilots are evaluated on CRM during route checks and proficiency check rides. In addition, pilots receive LOFT86 during simulator sessions once a year and are evaluated based on how 85 Korean Air used a 747-200 model simulator to train 747-100, -200, and -300 pilots.

Factual Information 59 Aircraft Accident Report they interact in coping with various anomalies during the simulated flight. According to Korean Air, a total of 1,614 flight crewmembers had successfully completed CRM training classes as of May 1999. The CRM program that was in place at the time of the flight 801 accident was developed from the United Airlines CRM program and adapted with the assistance of an outside contractor. This 4-day program, which was provided to flight crews only, emphasized dilemma resolution and focused on teamwork and leadership in problem- solving at the individual, crew complement, and organizational levels. The CRM program used reading materials, films, and class exercises to help flight crewmembers recognize and improve aspects of their behavior and interaction. The Director of Academic Flight Training testified that this CRM program taught first officers and flight engineers to intervene and challenge the captain if they had safety or operational concerns. He noted that the company had encountered difficulties teaching some first officers and flight engineers to challenge the captain and intervene in safety-of-flight situations. The director also testified that this issue was no longer a problem in training and that captains were being taught to encourage a cockpit environment in which first officers and flight engineers could freely express concerns when necessary. In May 1999, Korean Air announced it would replace the existing CRM program with a new CRM program that was developed with and adopted from Delta Air Lines. The new program will consist of four courses: a base course, a course for new captains, a recurrent course, and a recurrent joint flight operations/cabin services course.87 The one- time base course, called “Error Management CRM,” will last 5 days: the first 3 days will be classroom instruction, the fourth day will be a jumpseat observation flight, and the fifth day will be a debriefing session. The one-time “In-Command” course for new captains will last 1 day. The 1-hour pilot recurrent course and the 3-hour recurrent joint flight operations/cabin services course will be presented each year. According to Korean Air, the courses will be taught through lectures, class exercises, reading material, and other techniques to impart practical skills for the crews. In addition, Korean Air stated that its new CRM course would add “realism” to training through an audio-visual presentation format. Korean Air indicated that it expected to implement this program by January 2000. 1.17.2.4 Postaccident Changes to Flight Training In addition to the changes being implemented in response to the MOCT action and as part of the Immediate Action Plan and the new CRM program, Korean Air indicated that it has made other changes in the area of flight training. For example, the company’s Flight Standards Branch, within the Flight Operations Department, is now primarily responsible for overall quality assurance for all flight training and checking activities. Other changes are as follows: 86 According to Korean Air, the company began LOFT in 1992 using the 747-200. In 1993, this training was expanded to the 747-400 and the MD-82. The training eventually covered all aircraft types and models. 87 The purpose of this course is to increase team abilities to handle abnormal situations through cooperative efforts between flight and cabin crewmembers.

Factual Information 60 Aircraft Accident Report • Beginning in November 1998, training modules on risk and error management and recovery training for CFIT awareness, GPWS and windshear warnings, slippery runways, and crosswind and icing conditions were added to the recurrent proficiency training curriculum for all airplane types. • In January 1999, a policy of training to proficiency in the recurrent training and checking system was implemented. Crewmembers are to be given three opportunities during recurrent training and checks to receive additional instruction and correction while training to the acceptable level of proficiency. • Also in January 1999, the Flight Operations Department changed its system for selecting candidates for aircraft transition and upgrade to incorporate “more objective” criteria. The standards for upgrading to captain were also revised. The new standards increase the minimum requirements from 3 years and 3,000 hours to 5 years, 4,000 hours, and 350 landing cycles with the company regardless of previous military or other aviation experience. • In April 1999, new standardized flight instruction manuals were issued. • A new Line Check Pilot Manual was being developed to include detailed procedures and requirements so that check pilots could consistently apply and enforce company standards and policies. The new manual was expected to be completed in October 1999. • The Flight Operations Department developed a new all-volunteer system, to replace the previous assignment system, for all line check pilots. Candidates who volunteer for these positions are to be selected based on their ability to judge deficiencies in training and impart line flying skills. Also, the training requirements for line check pilots were increased so that the check pilots could impart better decision-making and crew coordination skills to the line pilots. 1.17.3 Korean Air Preflight Procedures The Korean Air Operations Manual that was in effect at the time of the accident (dated May 21, 1997) stated that crewmembers were to arrive at the company dispatch center at least 1 ½ hours before the scheduled departure time for international flights. According to company procedures at the time, flight crewmembers were to receive their paperwork and then gather as a group to study the paperwork. This process, referred to as the “self-briefing,” typically lasted about 15 minutes. The flight crewmembers then met with their assigned SOF for the “SOF briefing.” Afterward, the captain met with the flight and cabin crewmembers for a “full crew briefing.” Korean Air stated that, in March 1999, it began issuing “flight-specific manual packages” to outbound crews to ensure that pilots possessed updated route information for each trip. In addition, the company said that it developed an airport information program to promote additional route and airport familiarization. Korean Air expected that this program would be completed by the end of 1999 and that it would cover all of the airports serviced by the company’s aircraft.

Factual Information 61 Aircraft Accident Report 1.17.3.1 Supervisor of Flying Program According to Korean Air officials, the company’s SOF program began in 1996. The officials described the SOFs as retired captains and instructors who were among the company’s most experienced pilots and had no record of disciplinary action. The officials stated that the purpose of the SOF briefing was to ensure that pilots had reviewed all pertinent materials for the flight, including any NOTAMs. Further, the SOFs were expected to periodically check crewmembers’ charts and manuals for currency as well as their airman certificates and passports, which are required documents for international flights. There is no formal checklist of items to be covered in the SOF briefing. The officials stated that the SOF briefings were designed to last 15 minutes but averaged about 10 minutes. In a postaccident interview with Safety Board investigators, the Korean Air Deputy Director of Flight Operations said that he initiated the SOF program to correct pilot performance deficiencies that were involved in the accident/incident events (see section 1.17.5.1) and violations that the company had been experiencing.88 Further, the deputy director said that he was not aware of any other air carrier that had a SOF program and that he believed the number of accident/incident events and violations had dramatically declined since the initiation of this program. The SOF for Korean Air flight 801 was a retired company 747 captain. The SOF stated, in a postaccident interview, that he reviewed the flight data and asked the flight crew about the weather conditions en route to and at Guam. The SOF also stated that he and the flight crew discussed a typhoon and the possibility of en route turbulence and that he recommended maximum use of the weather radar. The SOF further stated that he and the flight crew discussed company notices but did not discuss the NOTAMs pertaining to Guam and the out-of-service glideslope associated with the runway 6L ILS approach.89 The SOF did not check the flight crew’s charts for currency. The SOF said that his main concern was to confirm that the flight crewmembers had “looked at the [trip paperwork] items closely.” 1.17.3.2 Airport Familiarization Program Korean Air stated that, in June 1997, it established an airport familiarization program that used audio-visual presentations (purchased from Japan Airlines) to prepare pilots for operations into designated airports. Korean Air requires that an airport familiarization tape be viewed if the company or the FAA list that airport as a “special airport.” Title 14 CFR Section 121.445 defines special airports as those that require a special airport qualification for pilots-in-command because of “surrounding terrain, 88 In a postaccident interview, the Deputy Director of Flight Operations stated that Korean Air had incurred 17 violations in 1996. 89 A Korean Air representative stated that the captain was responsible for reviewing applicable NOTAMs during the self-briefing and discussing any questions about them with the company dispatcher. According to the SOF, the flight crew did not indicate that there were NOTAMs regarding the flight. The SOF also indicated that he was unaware of the NOTAM regarding the inoperative glideslope.

Factual Information 62 Aircraft Accident Report obstructions, or complex approach or departure procedures.”90 Guam International Airport was not classified by Korean Air or the FAA as a special airport; thus, the accident flight crew was not required to view this familiarization tape. However, Korean Air recommends that pilots view a familiarization video if they have not flown into the destination within the preceding 3 months. The airport videotapes are available to pilots 6 days a week. The audio-visual presentation for Guam gave a general description of Guam’s weather and topography, including Mount Alutom, located near the outer marker, and Mount Macajna, located north of the NIMITZ VOR. The presentation advised pilots that “…when you report airport-in-sight, you will be cleared for a visual approach.” Further, the presentation stated that “…you [the pilot] will be radar-vectored to ILS runway 6L.... Normally, you will be guided from over Apra Harbor to the localizer…. You will then perform a visual approach.” The presentation highlighted the visual approach, identified visual cues for the approach to runways 6L and 24R, and advised pilots not to fly over a hospital located northwest of the airport. 1.17.4 Korean Air Descent and Approach Procedures 1.17.4.1 Briefing and Checklist Usage A Korean Air instructor pilot testified at the Safety Board’s public hearing that the company required the PF to conduct an approach briefing for every approach and that the briefing was to include the division of crewmember duties during the approach procedures. The instructor pilot stated that, if a pilot receives information that a navigational aid, such as a glideslope, was reported to be unreliable or unusable, Korean Air policy requires the pilot not to use that navigational aid to conduct the approach. The Korean Air 747 checklist booklet contained a landing briefing card (dated September 10, 1996), listing the following required items for a landing (or approach) briefing:91 LANDING BRIEFING

1. WEATHER
2. STAR

• TOD • No 1 & No 2 VOR/ADF Courses • ALT [altitude] & SPD [speed] Restrictions • Arrival Routes

1. USING RUNWAY, TYPE OF APPROACH, AND TRANSITION LEVEL

90 See section 1.18.8 for more information on 14 CFR Section 121.445 and safety recommendations to the FAA on special airport criteria and designation. 91 In this report, the term “landing briefing” is synonymous with “approach briefing.”

Factual Information 63 Aircraft Accident Report

1. REVIEW OF INSTRUMENT APPROACH PROCEDURES

• Minimum Safe Altitude • Approach Frequency (ILS, VOR, ADF) • Approach Course • Touch Down Zone Elevation • Missed Approach Procedure • Holding Procedure

1. CREW ACTION AND CALL OUT
2. PARKING SPOT AND TAXI WAYS

• DOCKING GUIDANCE SYSTEM

1. OTHER ABNORMAL CONFIGURATION AND CONDITION

TIME: BRIEFING SHOULD BE COMPLETED PRIOR TO ARRIVAL OVER TOD The Korean Air instructor pilot testified that company pilots were taught to include the following items in a nonprecision approach briefing: • ATIS information, including the weather, expected approach procedure, and field NOTAMs; • arrival and descent procedure to the IAF; • runway, type of approach, and type of transition; • transition level; • instrument approach procedure in detail; • airport name and chart number; • approach plate issue and effective dates; • minimum safe altitude; • airport elevation; • special notes; • configuration of navigational receivers and how to tune and identify them; • crew actions and callouts; • procedure to intercept approach course; • step-down altitudes and how they were determined; • MDA and how it was determined; • MAP; • parking spot and taxiways; and • instruction to nonflying crewmembers to call out any abnormalities or deviation from procedures.

Factual Information 64 Aircraft Accident Report Korean Air’s checklist philosophy, as described in its Boeing 747 Guidebook,92 states the following: Normal procedures[93] for each phase of flight are performed by recall, and the normal checklist is used to ascertain that all the safety items have been accomplished. Each response to the checklist challenge should be preceded by the verification of the present configurations, and the crewmembers should check for conformation. If any disagreements have been found between present configuration and checklist response, corrective actions should be taken first before any further checklist challenge. The Korean Air Boeing 747 Guidebook states that the “descent checklist” is to be performed while the airplane is descending through 20,000 feet to approximately 18,000 feet (or 1,000 feet above transition level in North America). The guidebook also states that the “approach checklist” is to be performed after a speed reduction to 250 knots and while the airplane is descending through 10,000 feet with its inboard landing lights on and that the “landing checklist” is to be performed when the airplane has been configured for landing. 1.17.4.2 Flight Crew Actions and Callouts During Nonprecision Approaches A Korean Air simulator instructor testified that the company trained its pilots to utilize the step-down rather than the “constant angle of descent”94 technique when executing nonprecision approaches. However, the instructor stated that captains were permitted to use the constant angle of descent approach technique under visual conditions provided that they did not descend below the published intermediate step-down altitudes. The Korean Air simulator instructor also stated that, at the time of the accident, pilots were trained to fly a nonprecision approach with the autopilot either engaged or disengaged. With the autopilot engaged, the PF was instructed to program the autopilot/FD controls, including vertical speed and the altitude select, unless the PF specifically directed the PNF to perform that function. In addition, the PF was instructed to initiate all heading, course, and altitude changes, including the selection of the step-down altitudes, while executing the approach profile. Further, the PNF was instructed to monitor the approach and challenge the PF when necessary. 92 The Boeing 747 Guidebook is a Korean Air procedures and technique training aid. It is published in Korean and English. The edition in effect at the time of the accident was dated August 1993. 93 Korean Air states that normal procedures “...are the recommended actions necessary to operate the airplane for each phase of flight. They enable the flightcrew to more readily memorize the required items, ensure that all necessary actions have been taken, and minimize the time required.” 94 The constant angle of descent technique requires pilots to maintain a predetermined constant angle and constant rate of descent, which is generally calculated to be about 3°, except when terrain or an obstacle necessitates a steeper descent. When a ground-based glideslope signal is absent, pilots can fly the constant angle of descent approach by using flight management system (FMS) and GPS equipment for electronic guidance. (See section 1.10.3.1 for a description of the step-down technique.)

Factual Information 65 Aircraft Accident Report Korean Air did not provide the Safety Board with any documentation from its operations or training manuals on specific PF and PNF roles and duties taught during ground and simulator training. For approach procedures, the only specified duties for the PNF, as described in Korean Air’s Boeing 747 Guidebook and 747 Aircraft Operating Manual (page 04.27.01, dated January 30, 1980), were as follows: • Position flap lever as directed. • Prior to crossing the outer marker cross-check all flight and navigation instruments, observe all warning flags retracted and all radios tuned to correct frequencies. • Position landing gear lever down on command. • Use windshield wipers and rain repellant as required. • Check AUTO SPOILERS and AUTO BRAKE DISARM lights. The Korean Air 747 Aircraft Operating Manual (dated October 1, 1984) described the following conditions and locations and the standard callouts for the PNF (with the flight engineer monitoring) during IFR conditions: • First positive INWARD motion of localizer bar: “Localizer.” • First positive motion of glide slope bar: “Glide slope.” • Final fix inbound (altimeter, instrument, and flag crosscheck): “Outer Marker/VOR/NDB/etc., Time, ____ Feet, altimeters and instruments crosschecked.” • 1000 and 500 ft above field elevation (altimeter, instrument, and flag crosscheck): “1000/500, altimeters and instruments crosschecked.” • After 500 ft above field elevation: (Call out significant deviations from programmed airspeed, descent, and instrument indications.) • 100 ft above DH [decision height]/100 ft above MDA: “100 above.” • Reaching DH or MAP: “Minimums, approach/strobe/centerline lights— runway (or no runway). Korean Air indicated that Standardization Circular 90-07, “747 Standard Callouts” (dated April 1996), described actions and callouts to be made during a nonprecision approach. The Standardization Circular Manual, which was issued to all pilots, contained general and aircraft-specific information. However, the callouts were not included in Korean Air’s Boeing 747 Aircraft Operating Manual, company Operations Manual, or 747 Flight Crew Training Manual. Korean Air indicated in July 1999 that its pilots were trained to use the standard callouts during initial simulator training and were checked for the use of these callouts during simulator and line checks. Korean Air also stated that its pilots “always take this document in flight” and that the document is “readily available to

Factual Information 66 Aircraft Accident Report pilots.” The callouts presented in the standardization circular for the PF, PNF, and flight engineer (F/E) are as follows:95 At 20,000 ~18,000 Feet msl: PF Initiates Descent Checklist PNF N/A F/E Executes Descent Checklist Approaching Transition Level: PF Transition Altimeter Reset PNF Transition Altimeter Reset F/E Transition Altimeter Reset At 10,000 Feet msl: PF Initiates Approach Checklist PNF Calls “One Zero Thousand” F/E Executes Approach Checklist 1,000 Feet Above Initial Approach Altitude: PNF Calls “One Thousand to Initial” PF Responds to PNF “Roger” F/E N/A On Intercepting Heading (Check VOR/NDB Freq. and Inbound Course): PF Select VOR/LOC Mode PNF Confirms “Select VOR/LOC Mode’ F/E Monitor Auto Mode and Monitor Instruments First Positive Inward Motion of Localizer Bar: PNF “VOR Approach;” “CDI [course deviation indicator] Alive;” “CDI Capture;” (NDB Approach) PF Responds “Roger” F/E Monitor Auto Mode, Monitor Instruments **PF Orders flap extension on approach then calls “Command Bug Set” PNF Responds “Command Bug Reset” PF Sets Auto Brake and Places Speed Brake Lever 95 Some international air carriers have the PNF lead or prompt the PF through the nonprecision approach procedure by stating the next procedural change, including course, heading, altitude, time, visual contact, and MAP. Further, some air carriers have the captain serve as the PNF (until just before landing) and monitor the first officer’s performance (as the PF) during the approach procedure.

Factual Information 67 Aircraft Accident Report After CDI LOC Bar Moving: PF Requests “Set Inbound Heading” PNF Responds “Setting Inbound Heading” F/E N/A Leaving Initial Approach Fix (IAF): PNF States “Leaving IAF (name), Time Check, Altitude” PF Responds “Roger” F/E Monitors Altimeter and Altitude Cross Check, Monitor Instruments Landing Gear Down and Landing Checklist: PF Calls Gear Down, Flaps Down (incrementally), Requests “Landing Checklist” PNF Responds to confirm gear position and flap position F/E Executes Landing Checklist Over Final Approach Fix (Call “Time” and Push Clock Button): PF States “Outer Marker/Final Approach Fix” PNF Responds “Outer Marker/Final Approach Fix, Time, Altimeter, and Instrument Cross-Check” F/E Monitors Altitude, Attitude and Airspeed 1,000 Feet Above Field Elevation (Altimeter, Instrument & Flag Check): PNF States “One Thousand” PF Responds “No Flag, Gear and Flaps” F/E Responds “No Flag, Gear and Flaps” and Monitors Instruments On Final Approach—Deviation Call: The PNF will call any of the following deviations—Bank 15 degrees at or above, DME & Altitude, CDI Exceeds 1/3 dot, Indicated Airspeed exceeds 10 knots, Below Minimum Altitude, Too High or Low on VASI or PAPI [precision approach path indicator] 100 Feet Above MDA: PF Looks for Visual Cues PNF States “One Hundred Above” F/E Monitors Instruments At MDA: PNF States “Minimums” PF Responds “Roger” F/E Monitors Instruments

Factual Information 68 Aircraft Accident Report 1.17.4.3 Terrain Avoidance Recovery Maneuvers At the time of the accident, one manual issued to Korean Air flight crewmembers—the company’s 747 Aircraft Operating Manual—contained written guidance on when to execute a recovery maneuver to avoid terrain. Under the section entitled “PULL UP/TERRAIN AVOIDANCE,” the manual stated: 96 The published RECOVERY MANEUVER procedure is immediately accomplished by recall whenever the threat of ground contact exists. Either of the following conditions is regarded as presenting a potential for ground contact: • Activation of the “PULL UP” warning. • Inadvertent windshear encounter or other situations resulting in unacceptable flight path deviations. Korean Air’s 747 Aircraft Operating Manual (page 14.20.02, dated November 2, 1992), required the following procedures for the recovery maneuver: Aggressively position the thrust levers forward to ensure maximum thrust is attained, disengage autopilot and autothrottle (as installed), and rotate smoothly at a normal rate toward an initial pitch attitude of 15 degrees. Do not use flight director commands. Pitch attitudes in excess of 15 degrees may be required to silence the “PULL UP” warning and/or avoid terrain. Note: In all cases, the pitch attitude that results in intermittent stick shaker or initial buffet is the upper pitch attitude limit (this may be less than 15 degrees in a severe windshear encounter). Large thrust increases may result in a nose-up pitching tendency requiring forward column pressure and trim. Monitor vertical speed and altitude. Do not attempt to change flap or gear position or regain lost airspeed until ground contact is no longer a factor. 1.17.5 Korean Air Accident and Incident History The Safety Board used data provided by Airclaims Limited97 to compare Korean Air’s safety record with the records of five major U.S.-based airlines and five major Asian-based airlines. The total hull loss records for all of these airlines were calculated for a 10-year period ending December 31, 1998, using two measures of activity or exposure to 96 Most U.S. airlines refer to this procedure as the escape maneuver. 97 Airclaims Limited is an aviation consulting firm that collects data, in part, for the aviation insurance industry. The Airclaims Limited database is recognized by the aviation industry as a definitive source for worldwide aviation accident information. Loss data for this comparison were retrieved from Airclaims Client Aviation System Enquiry database and were current as of August 10, 1999. Exposure data were retrieved from Airclaims Limited, Jet Operator Statistics, 1999, issue 1.

Factual Information 69 Aircraft Accident Report risk: aircraft flight hours and departures. Airclaims Limited defines a total loss as an aircraft that has been destroyed or for which the estimated repair costs rendered the aircraft a total loss under the terms of the insurance contract. (Airclaims Limited notes that some airplanes that became total losses were repaired and returned to service.) Any total loss that resulted from a deliberate violent act was eliminated from the Board’s comparison. The results of the comparison are shown in table 3. As table 3 indicates, eight of the operators had fewer than one hull loss per 1 million flight hours (All Nippon Airways, Singapore Airlines, Japan Airlines, Northwest Airlines, United Airlines, US Airways, Delta Air Lines, and American Airlines). Asiana Airlines had 1.25 hull losses per 1 million flight hours, Korean Air had 2.38, and China Airlines had 4.59. Seven operators in the comparison group had fewer that one hull loss per 1 million departures (All Nippon Airways, Japan Airlines, Northwest Airlines, United Airlines, US Airways, Delta Air Lines, and American Airlines). Two operators had between one and two hull losses per 1 million departures (Singapore Airlines and Asiana Airlines). Korean Air Lines had 4.79 hull losses per 1 million departures, and China Airlines had 11.74. Table 3. Loss totals and rates for the 10-year period ending December 31, 1998, by losses per 1 million departures. Operator Lossesa a Loss totals include all total hull losses, excluding acts of violence. Aircraftb b Aircraft hours and departures are expressed in thousands. Losses per aircraftc c Loss rates are expressed as accidents per 1 million aircraft hours and 1 million departures. Hours Departures Hours Departures All Nippon Airways 0 2,751 2,069 0.00 0.00 Japan Airlines 0 3,535 1,396 0.00 0.00 Delta Air Lines 1 15,988 9,614 0.06 0.10 Northwest Airlines 1 10,570 5,598 0.09 0.18 United Airlines 2 16,075 7,273 0.12 0.27 American Airlines 3 18,823 8,607 0.16 0.35 US Airways 6 11,700 8,988 0.51 0.67 Singapore Airlines 1 2,351 598 0.43 1.67 Asiana Airlines 1 803 576 1.25 1.74 Korean Air 6 2,522 1,252 2.38 4.79 China Airlines 5 1,090 426 4.59 11.74

Factual Information 70 Aircraft Accident Report 1.17.5.1 1983 to 1997 Accident History Between 1983 and the time of the flight 801 accident, Korean Air experienced several accidents that were attributed primarily to pilot performance.98 Some of these accidents resulted in substantive management, operational, and policy changes initiated by the company to correct deficiencies identified by the accident investigations. The following is a brief description of some of these pilot performance accidents: • On August 31, 1983, Korean Air flight 007, a 747-200B, crashed in the Sea of Japan off Sakhalin Island, Soviet Union, killing 269 people. Although the airplane was intentionally shot down, the investigation99 revealed the flight crew likely made a navigation entry error in the autopilot, causing the airplane to depart from its assigned flightpath without the crew’s detection and subsequently enter restricted airspace in the Soviet Union.100 • On December 23, 1983, Korean Air flight 084, a Douglas DC-10 on a scheduled cargo flight, collided head on with SouthCentral Air flight 59, a Piper PA-31 on a scheduled commuter flight, on a runway at Anchorage, Alaska, in heavy fog. Three people received serious injuries, and three people received minor injuries. The Safety Board determined that the probable cause of the accident was the failure of the Korean Air pilot to follow accepted procedures during taxi, which caused him to become disoriented while selecting the runway; the failure of the Korean Air pilot to use the compass to confirm his position; and the decision of the Korean Air pilot to take off when he was unsure that the aircraft was positioned on the correct runway.101 • On July 27, 1989, a Korean Air McDonnell Douglas DC-10-30 crashed in fog about 1.5 kilometers short of the runway at Tripoli International Airport, Libya, during the execution of a nonprecision approach (in which the ILS was out of service).102 Of the 199 people on board the airplane, 4 crewmembers and 68 passengers died; 6 people on the ground were also killed. The Libyan Civil Aviation Authority determined that the cause of the accident was improper flight crew coordination likely influenced by fatigue.103 98 Some of these accidents occurred when Korean Air was known as Korean Airlines. For consistency, Korean Air is used throughout this section. 99 See International Civil Aviation Organization (ICAO), Destruction of Korean Air Lines Boeing 747 on 31 August 1983, Report on the Completion of the ICAO Fact-finding Investigation, June 1993. 100 As stated in section 1.17.2.3, Korean Air instituted a CRM training program in December 1986 as a result of this accident. 101 See National Transportation Safety Board. 1984. Korean Air Lines, McDonnell Douglas DC-10-30, HL7339, SouthCentral Air, Piper PA-31-350, N35206, Anchorage, Alaska, December 23, 1983. Aircraft Accident Report NTSB/AAR-84/10. Washington, DC. 102 See Libyan Civil Aviation Authority, Korean Air McDonnell Douglas DC-10-30 Korean Registration ML-7328 crashed nearby Tripoli International Airport Southeast of Runway 27 on July 27, 1989. Aircraft Accident Final Report. 103 According to Korean Air personnel, this accident resulted in upgrades of the Korean Air pilot training program, including increased instrument flight time requirements, additional GPWS awareness in simulator training, and the adoption of computer-based academic training.

Factual Information 71 Aircraft Accident Report • On August 10, 1994, a Korean Air Airbus A300-620R landed long at a high rate of speed and overran the runway at Cheju Airport, Korea, after an apparent misunderstanding between the flight crewmembers as to whether they should continue with landing or abort and execute a go around.104 All of the 160 airplane occupants survived the crash. The airplane was destroyed. According to Korean Air personnel, both pilots were jailed temporarily, and neither resumed flight service with the company.105 1.17.5.2 1998 and 1999 Accident and Incident History Since the time of the Korean Air flight 801 crash, the company has experienced several accidents and incidents, some of which are detailed below. • On August 5, 1998, Korean Air flight 8702, a Boeing 747-400, HL7496, skidded off the runway and crashed during a landing roll in heavy rain at Kimpo Airport in Seoul. None of the 16 crewmembers were injured, and 65 of the 379 passengers received minor injuries. The accident caused substantial damage to the airplane. The KCAB’s investigation determined that the accident was caused by the captain’s misuse of the thrust reverser during the landing roll and his confusion over crosswind conditions.106 • On September 30, 1998, Korean Air flight 1603, a McDonnell Douglas MD-82, HL7236, overran a runway at Ulsan Airport, Korea, in heavy rain. None of the 6 crewmembers were injured, and 3 of the 142 passengers received minor injuries. Both engines’ fan blades were damaged as a result of the event. The KCAB determined that this event was the result of “high speed over a wet runway.” • On March 15, 1999, Korean Air flight 1533, a McDonnell Douglas MD-83, HL7570, overran a runway at Pohang Airport, Korea, during a second landing attempt and crashed into an embankment. The accident occurred in stormy weather with strong winds. One of the 6 crewmembers and 15 of the 156 passengers were injured. The airplane received substantial damage as a result of the accident. The KCAB determined that the cause of the accident was the flight crew’s “poor action” in bad weather (including gusts and variable winds), misuse of the brake and thrust reverser during the landing roll, and lack of decision-making for executing a go-around and stop.107 In addition, the KCAB believed that the flight crew received poor ground assistance. 104 This information was contained in an Airclaims Limited major loss record. 105 According to Korean Air, this accident led to an increased awareness of the importance of speed callouts during the approach phase of flight. 106 The KCAB subsequently suspended the captain’s flying status for 1 year and the first officer’s status for 6 months. 107 The KCAB subsequently suspended the captain’s ATP certificate and the first officer’s flying status for 1 year.

Factual Information 72 Aircraft Accident Report • On April 15, 1999, Korean Air flight 6316, a McDonnell Douglas MD-11, HL7373, crashed in a residential area of Shanghai, China, about 6 minutes after takeoff.108 The two pilots and one mechanic on board the airplane were killed. Additionally, at least 4 people on the ground were killed, and 37 others were injured. The airplane was destroyed by impact forces. The accident is being investigated by the Civil Aviation Administration of China with participation by the Safety Board and the KCAB. 1.17.6 Oversight of Korean Air 1.17.6.1 Korean Civil Aviation Bureau As previously stated, the KCAB, a division within the MOCT, is responsible for providing oversight of the Korean civil airlines. The Safety Board found that two KCAB operations inspectors were assigned to provide oversight of Korean Air’s flight operations at the time of the accident. Neither of these inspectors were type rated in any of the airplanes operated by Korean Air. According to the KCAB, these two inspectors also had oversight duties at Asiana Airlines, another domestic air carrier. The KCAB stated that, before the flight 801 accident, it performed an annual 7-day safety inspection, quarterly 7-day regional inspections, and random inspections an average of 40 times per year. The KCAB also said that it frequently relied on Korean Air to self- report corrective actions taken in response to KCAB inspections. During testimony at the Safety Board’s public hearing, the Korean Air Director of Academic Flight Training stated that the KCAB approved all company aircraft operations manuals, training manuals, training programs, and flight operations procedures.109 The official also stated that the KCAB provided direct oversight of Korean Air and its training curricula primarily during the annual safety inspection and two to three random operations inspections each year. Korean Air’s Director of Academic Flight Training also testified that the KCAB conducted almost all type-rating proficiency checks on the company’s Fokker F.100 and McDonnell Douglas MD-82 airplanes. However, the official said that type-rating proficiency checks on the other airplanes in Korean Air’s fleet, including the 747-200, -300, and -SP, were conducted by company check airmen designated by the KCAB.110 Korean Air’s Director of Academic Flight Training could not recall any direct surveillance by the KCAB on 747 proficiency checks or training sessions. The Korean Air official indicated that, if company records indicated otherwise, he would forward such 108 Delta Air Lines, Air Canada, and Air France suspended their code-sharing agreements with Korean Air after this accident. 109 In addition, as stated in section 1.6, the KCAB was responsible for approving Korean Air’s Continuous Maintenance Program. 110 These designated check airmen were authorized by the KCAB to conduct proficiency checks and aircraft type rating checks. The KCAB conducted annual evaluations of the designated check airmen.

Factual Information 73 Aircraft Accident Report information to the Safety Board after he returned to Korea. The Board never received any such information from Korean Air. The KCAB, however, stated that it had written records of such surveillance and that it had given these records to Korean Air. The Korean Air Director of Safety and Security stated that the KCAB provided oversight for the Korean Air simulator training syllabi during the annual safety inspection. This director further stated that, before the accident, he was not aware of any KCAB written criticisms or required changes to the Korean Air flight training program. The Korean Air Director of Academic Flight Training testified that he could not recall any KCAB written record of recommended or required corrective actions as a result of its inspections before the Guam accident. However, the KCAB stated that it has written records of recommended and required actions from its inspections before the accident. The KCAB stated that, after the flight 801 accident, it hired five inspectors (three of whom were captains), two examiners, and two technical experts. The KCAB also stated that it hired 14 commercial pilots to provide in-house technical expertise. These pilots, however, are not directly involved in oversight activities. In addition, the KCAB inspectors now assigned to Korean Air are type rated in the Boeing 747-400, and they previously flew 747 Classics (that is, the 747-100, -200, -300, and -SP). Further, the KCAB indicated that, after the accident, it instituted the following changes regarding its oversight of Korean Air: increased simulator training requirements for adverse weather conditions, risk avoidance, GPWS, and terrain awareness; mandated CFIT prevention concepts in recurrent ground school that are to be practiced in simulator training; diversification of training scenarios, including those airports with approach navigational aids that are not colocated with the field of landing; separate localizer and VOR approach requirements included as training items for nonprecision approaches; and a requirement to choose random profiles for check rides. 1.17.6.1.1 Accident and Incident Investigation Authority The KCAB’s Division of Aviation Safety is responsible for aviation accident and incident investigations. Paragraph 5.4 in Annex 13 to the Convention on International Civil Aviation (Chicago Convention)111 specifies in part that “the accident investigation authority shall have independence in the conduct of the investigation and have unrestricted authority over its conduct.” Further, on November 21, 1994, the Council of the European Union (EU) adopted a directive that specified that EU Member States would ensure, within 2 years, that aviation accident and serious incident investigations were conducted or supervised by a permanent body or entity that is functionally independent of the national aviation authorities responsible for regulation and oversight of the aviation system. According to 111 Virtually all countries (including South Korea) are signatory to the Chicago Convention Treaty, which established the standards and recommended practices for international civil aviation. Annex 13 addresses aircraft accident and incident investigation.

Factual Information 74 Aircraft Accident Report EU officials, all EU Member States have complied with this directive or are moving toward full compliance. 1.17.6.2 Federal Aviation Administration Korean Air was granted authority to operate into U.S. airspace under the provisions of 14 CFR Part 129 and International Civil Aviation Organization (ICAO) Annex 6.112 The FAA approves operations specifications and assigns a principal operations inspector (POI) to each foreign carrier.113 The POI assigned to Korean Air at the time of the accident was not qualified in any of the airplanes operated by Korean Air, but no international or FAA provisions require that inspectors be qualified or current in any aircraft operated by the foreign air carrier for which they have responsibility. This POI also provided oversight to six other international air carriers. The POI said that, at the time, it was customary for the FAA to rotate inspectors of foreign air carriers so that each foreign airline was assigned a different inspector every 1 to 2 years. The POI also said that there was no formal interaction between the KCAB and the FAA regarding oversight of Korean Air. Neither civil aviation authority (CAA) was required to formally or informally exchange reports of inspection activities or safety concerns. The KCAB, however, indicated that it and the FAA have an ongoing exchange of reports on inspection activities, violations, and certificate actions as well as safety concerns. Further, the POI assigned to Korean Air said that the FAA’s oversight role for Part 129 operators was to approve operations specifications, inspect trip records and facilities, and accomplish ramp inspections of airplanes and crews when they were in the United States or its territories. The POI also stated that the FAA did not inspect, approve, or provide oversight for a foreign airline’s training or operations manuals. The Safety Board has not identified any requirement under the Convention on International Civil Aviation or the Federal Aviation Regulations (FAR) that the FAA be provided copies of these manuals. In addition, the POI stated that the FAA did not conduct line checks or en route inspections on board a foreign carrier. FAA Order 8400.10, “Air Transportation Operations Inspector’s Handbook,” volume 2, chapter 4, paragraph 297, states that the purpose of surveillance of each foreign air carrier, its aircraft, and its operations is to determine compliance, on a recurrent or rotating basis, with the FARs and the foreign carrier’s operations specifications. According to the FAA order, surveillance is conducted if a foreign carrier experiences “a series of accidents, incidents, violations, or complaints (that relate to safety.)” The surveillance includes any “R” (required) items specified in national program guidelines and can also include routine and unannounced ramp inspections. 112 Annex 6 addresses the standards and recommended practices for operation of aircraft. 113 The position title for POIs assigned to foreign carriers is International Geographic Inspector (Operations).

Factual Information 75 Aircraft Accident Report Paragraph 297 of the FAA order also states that routine and unannounced ramp inspections of a foreign air carrier conducting operations with foreign-registered aircraft should be limited to those operations being conducted in the United States. The paragraph also states that the inspections should include the following items: aircraft markings; airworthiness, registration, and crewmember certificates; air traffic compliance; taxi and ramp and passenger enplaning/deplaning procedures; baggage and cargo (especially hazardous cargo); and compliance with the pilot-in-command age 60 policy, which states that a flight crewmember is prohibited from acting as pilot-in-command if he or she has reached age 60. According to the FAA, the only “R” item required for Korean Air is one annual ramp inspection. The FAA indicated that, since 1996, Korean Air received about 201 operations inspections, 129 maintenance inspections, and 48 avionics inspections. 1.17.6.2.1 International Aviation Safety Assessment Program The FAA established the International Aviation Safety Assessment (IASA) program in August 1992 in response to concerns114 about the adequacy of surveillance provided to foreign air carriers.115 According to an overview of the program posted on the FAA’s Web site, the IASA is a foreign assessment program that “focuses on a country’s ability, not the [ability of an] individual air carrier, to adhere to international standards and recommended practices for aircraft operations and maintenance established by [ICAO].” The overview indicated that “[t]he purpose of the IASA is to ensure that all foreign air carriers that operate to or from the United States are properly licensed and [are provided] safety oversight [ ] by a competent Civil Aviation Authority (CAA) in accordance with ICAO standards.”116 According to the overview: A foreign air carrier of a sovereign state desiring to conduct foreign air transportation operations into the United States files an application with the DOT [Department of Transportation] for a foreign air carrier permit under the Federal Aviation Act,...at 49 U.S.C. 41302.... Consistent with international law, certain safety requirements for operations into the United States are prescribed by the FAA's Part 129 regulations (14 CFR part 129). 14 CFR Part 129 specifies that the carrier must meet the safety standards contained in Part 1 (International Commercial Air Transport) of Annex 6 (Operations of Aircraft) to the Convention on International Civil Aviation (Chicago Convention). Before DOT issues a foreign air carrier permit, it notifies the FAA of the application and requests the 114 One accident that raised such concerns was the January 25, 1990, crash of an Avianca Boeing 707 in Cove Neck, New York, as a result of fuel exhaustion. 115 According to the FAA, about 600 foreign air carriers operate into the United States, and about 103 countries or regional country alliances have oversight responsibilities for air carriers that either operate into the United States or have applied to operate into the United States. 116 Paragraph 9.3.1 of ICAO Annex 6 states that operators “shall establish and maintain a ground and flight training program . . . which ensures that all flight crew members are adequately trained to perform their assigned duties. [The training program] shall also include training in knowledge and skills related to human performance and limitations...[and] shall ensure that all flight crew members know the functions for which they are responsible and the relation of those functions to the functions of other crew members.”

Factual Information 76 Aircraft Accident Report FAA’s evaluation of the respective CAA’s capability for providing safety certification and continuing oversight for its international carriers. Upon DOT notification of a pending foreign air carrier application, if the FAA has not made a positive assessment of that countr[y’]s safety oversight capabilities, the FAA Flight Standards Service will direct its appropriate international field office to schedule an FAA assessment visit to the CAA of the applicant’s country. Once the assessments visits have been completed, the FAA assessment team will return to the United States to compile the findings. Appropriate notifications to the CAA and other U.S. Government officials of the results of the assessments will be made from Washington, D.C., headquarters as soon as possible. If a CAA is found to be meeting its minimum safety obligations under the Chicago Convention, the FAA will forward a positive recommendation to DOT. If there is a pending foreign carrier application, DOT will issue the requested economic authority and FAA will issue operations specifications to permit the carrier to begin operations to or from the United States. When CAA's of countries with existing air carrier service to the U.S. are found to not meet ICAO standards, the FAA formally requests consultations with the CAA. The purpose of consultations is to discuss [the FAA’s] findings in some detail and explore means to quickly rectify shortcomings found with regard to ICAO annexes, to enable its air carriers to continue service to the United States. During the consultation phase, foreign air carrier operations from that country into the United States will be frozen at existing levels.[117] FAA may also heighten its surveillance inspections (ramp checks) on these carriers while they are in the United States. If the deficiencies noted during consultations cannot be successfully corrected within a reasonable period of time, FAA will notify DOT that carriers from that country do not have an acceptable level of safety oversight and will recommend that DOT revoke or suspend its carriers economic operating authority. When CAA's of countries with no existing air carrier service to the United States are found to not meet ICAO standards, the FAA does not, of course, undertake consultations. The FAA will notify DOT that the CAA does not have an acceptable level of safety oversight and its application for economic authority will be denied. The FAA will undertake a reassessment of the CAA after evidence of compliance with ICAO provisions has been received. FAA will, of course, be willing to meet with CAA’s at any time, as [ ] resources permit. After the assessment visit, consultations (if necessary), and notifications have been completed, the FAA will publicly release the results of these assessments. The FAA plans to periodically revisit CAA's of countries with air carriers operating into the United States to maintain full familiarity of the methods of that country’s continued compliance with ICAO provisions. The FAA may also find it necessary to reassess a CAA at any time if it has reason to believe that minimum ICAO standards are not being met. 117 This policy is defined in a notice published in the Federal Register, Volume 60, No. 210, October 31, 1995.

Factual Information 77 Aircraft Accident Report DESIRED OUTCOME: The FAA is working to determine that each country meets its obligations under ICAO and to provide proper oversight to each air carrier operating into the U.S. The continued application of this program will result in a lower number of safety-related problems, including accidents, incidents, and an improved level of safety to the flying public. The FAA established three ratings for the status of countries at the time of the assessment. These categories and their definitions are as follows: • Category I—Does Comply with ICAO Standards: A country’s civil aviation authority has been assessed by FAA inspectors and has been found to license and oversee air carriers in accordance with ICAO aviation safety standards. • Category II—Conditional: A country’s civil aviation authority in which FAA inspectors found areas that did not meet ICAO aviation safety standards and the FAA is negotiating actively with the authority to implement corrective measures. During these negotiations, limited operations by this country’s air carriers to the U.S. are permitted under heightened FAA operations inspections and surveillance. • Category III—Does Not Comply with ICAO Standards: A country’s civil aviation authority found not to meet ICAO standards for aviation oversight. Unacceptable ratings apply if the civil aviation authority has not developed or implemented laws or regulations in accordance with ICAO standards; if it lacks the technical expertise or resources to license or oversee civil aviation; if it lacks the flight operations capability to certify, oversee and enforce air carrier operations requirements; if it lacks the aircraft maintenance capability to certify, oversee and enforce air carrier maintenance requirements; or if it lacks appropriately trained inspector personnel required by ICAO standards. Operations to the U.S. by a carrier from a country that has received a Category III rating are not permitted unless they arrange to have their flights conducted with a duly authorized and properly supervised foreign air carrier appropriately certified from a country meeting international aviation safety standards. During a June 17, 1999, briefing to Safety Board staff, the FAA indicated that, although the IASA program is intended to determine whether a foreign country’s CAA is providing adequate oversight, the program does not directly assess whether foreign carriers are receiving such oversight or are complying with the provisions of Annex 6 to the Convention on International Civil Aviation. The FAA assessment team does not conduct surveillance of foreign air carriers; rather, it collects information and evaluates a foreign CAA’s compliance with Annex 6 standards in seven areas: aviation law; aviation regulations; CAA structure; technical inspector workforce; technical guidance; records of certification; and records of surveillance, including followup and corrective actions.118 The country must be found to meet ICAO Annex 6 standards in all seven areas to be rated as Category I. The FAA offers assistance to those countries that, according to its evaluation, do not comply with ICAO Annex 6.

Factual Information 78 Aircraft Accident Report The FAA also indicated that it has completed all of its initial assessments and that the IASA program would soon transition to “Phase 2,”119 which will focus on review and validation of the initial ratings and continued evaluation of the safety compliance capability of foreign CAAs. According to the FAA, Phase 2 will be accomplished by reviewing each country’s rating and all available information relevant to ICAO safety oversight requirements at least every 2 years. However, the FAA indicated that it would reevaluate a country that has air carriers operating into the United States any time there is reason to question whether that country is meeting its international safety oversight obligations. According to the FAA, Phase 2 rating decisions will be based on information gathered by the FAA, either during an on-site visit or through a questionnaire directed to the foreign CAA, or the results of an assessment by another qualified entity, such as ICAO. Also, the FAA intends to eliminate the Category III rating as part of Phase 2; accordingly, countries found not to comply with ICAO Annex 6 will be rated as Category II regardless of whether that country is conducting operations into the United States. The KCAB was initially assessed in 1996 and was given a Category I rating. As of October 1999, the KCAB had not been reassessed. 1.17.6.3 Department of Transportation Audit Report on Aviation Safety Under International Code Share Agreements On September 30, 1999, the Department of Transportation Office of Inspector General (DOT/IG) issued a report, titled Aviation Safety Under International Code Share Agreements (Report No. AV-1999-138). The report noted that the number of international code share agreements has more than tripled in the last 5 years and that U.S. carriers are increasingly entering into such agreements with carriers from regions of the world where aviation oversight and safety records are not as strong as those of the United States. The report found that the current process by which code share agreements are approved by the DOT does not adequately address safety implications and that the “FAA has not taken an active role in the approval or safety oversight of international code share agreements, either before or after approval.” Specifically, the DOT/IG report stated: FAA limits its input to advising [the Office of the Secretary of Transportation (OST)] about whether a foreign carrier’s homeland, as distinguished from the air carrier involved, has procedures to exercise oversight of its carriers in compliance with international safety standards. FAA staff stated that if they become aware of adverse safety information about a foreign carrier, they will pass that on as well; 118 The FAA does not assess a country’s compliance with Annex 13. The Safety Board notes that, during the Accident Investigation Group (AIG) divisional meeting held by ICAO from September 14 to 24, 1999, AIG delegates adopted a recommendation for the ICAO Council to take steps to expand the ICAO safety oversight audit program to include an assessment of a country’s compliance with Annex 13. The program currently assesses a country’s compliance with Annexes 1, 6, and 8. 119 The FAA indicated that, in August 1998, the agency’s Administrator had approved the transition to Phase 2 but that the change would not take effect until publication of a notice in the Federal Register.

Factual Information 79 Aircraft Accident Report however, they were able to provide only one example of this kind of advice, and the effort made to assess safety implications appears to be nonexistent. [The DOT/IG’s] review found that the Department’s current procedures require nothing of the U.S. or foreign carrier that will be parties to the agreement about the foreign carrier’s safety. FAA performs no trend or other analysis, and makes no recommendations to OST, as to whether it is satisfied that there are no negative safety implications relative to the foreign carrier that will be involved in the code share agreement…. The DOT/IG’s report evaluated the FAA’s explanation for its limited oversight role in code share agreements. The report made the following three points: First, FAA says it is without legal authority to make safety fitness determinations regarding individual foreign carriers. This view has merit. However, the legal situation is quite different when, as here, a U.S. carrier seeks U.S. approval to hold out to the public flights on a foreign aircraft as if they were U.S. flights and to ticket such flights in the name of a U.S. carrier. Furthermore, Federal law requires that “safety” be a paramount consideration in deciding whether to approve agreements like code shares. Second, FAA correctly points out that it does make determinations [through the IASA program] about the civil aviation authority in the foreign carrier’s homeland. This program identifies whether the carrier’s homeland provides adequate aviation oversight of its carriers, and has improved international aviation safety by helping foreign civil aviation authorities improve their oversight. However, this is quite different from a judgment about the safety practices of an individual carrier. FAA is itself a civil aviation authority that meets international standards, but that is materially different from a conclusion that all U.S. carriers therefore follow sound safety practices. The third and most legitimate point FAA raises is that it has limited resources and already is resource-constrained in exercising oversight of U.S. aircraft and U.S. crew operations. Adding code share agreements to the workload would be an additional burden and raise expectations. We believe the answer to this is that U.S. carriers seeking approval for a code share agreement can reasonably be expected to perform most of the work and provide FAA assurances that the foreign carrier that will operate as a U.S. flight is compliant with applicable safety requirements. FAA’s role would be to ensure that U.S. carriers have a credible process in place to provide such assurances. The Department of Defense (DOD) is one of the largest U.S. consumers of air carrier services because of its need to transport military personnel to locations throughout the world. According to the DOT/IG report, DOD’s policy has been to use U.S. carriers for this transportation service, and DOD performs a safety review of a U.S. carrier before it can be included on an approved list of authorized military air transport providers. The report also indicated that the U.S. carriers proposed the use of foreign code share carriers for providing military transportation. Because DOD must ensure the safety of foreign code share carriers, it established a program in August 1999 with the Air Transport Association and six U.S. airlines.120 Under this program, the six U.S. air carriers will perform (or will

Factual Information 80 Aircraft Accident Report arrange to have a third party perform) safety assessments of their foreign code share partners to ensure that those partners meet the legal criteria necessary to transport U.S. military personnel. The DOT/IG found that the FAA could build on DOD’s program and that the FAA must ensure that safety is “a condition of initial and continued approval for international code share arrangements.” The DOT/IG report made the following recommendations to the DOT and the FAA: • Develop and implement procedures requiring that all U.S. carriers perform safety assessments of foreign carriers as a condition of code share approval and continued authorization. These procedures should include requirements that carriers: • perform an initial on-site review of all existing, pending, and future code share partners; • establish review procedures, to be approved by FAA, that will address the content of the assessments and qualifications of staff conducting the assessments; • develop assessment processes that include review and verification that foreign partners have implemented effective procedures in critical safety areas such as maintenance operations, airworthiness of aircraft, crew qualifications, crew training, flight operations, en-route procedures, emergency response plans, security, and dangerous goods; • provide copies of safety assessments to FAA for review and acceptance, and make available to FAA, when necessary, information supporting assessment results; • submit confirmations from senior safety officials that the assessment results were satisfactory and any deficiencies noted have been corrected; and • coordinate reviews to avoid multiple assessments of foreign carriers code sharing with more than one U.S. partner. • Coordinate closely with the Department of Defense to maximize the effective use of limited resources between the two agencies, avoid duplication, and establish protocols for the exchange of information about carrier safety assessments. FAA should also consider the safety assessment results in performing IASA reviews. • Establish procedures for terminating or restricting the use of code share agreements when (1) the Department of Defense determines that adverse safety information warrants prohibiting U.S. military personnel from using a foreign carrier, (2) the U.S. carrier terminates the agreement, or (3) FAA, on its own initiative, makes a similar determination regarding the transport of U.S. passengers. The DOT/IG report also recommended that the FAA • Develop oversight procedures for FAA to validate U.S. carriers’ safety assessment programs. The validation should include: 120 According to the DOT/IG report, the six airlines are American, Continental, Delta, Northwest, Trans World, and United.

Factual Information 81 Aircraft Accident Report • reviews of air carriers’ audit procedures, assessment processes, and documentation supporting review conclusions to ensure the consistency, quality, and effectiveness of the review results; • comprehensive audits of a sample of safety assessments to confirm that carriers have applied agreed upon standards and procedures in conducting the assessments; and • procedures to, if necessary, perform on-site inspection of aircraft used in code share operations. • Require that FAA staff perform risk assessments using available safety data on foreign carriers and review results of air carrier safety assessments, if made available, as part of its safety advice to OST on code share applications. This interim procedure should be used no more than 3 months, until the Department finalizes new code share procedures.121 1.18 Additional Information 1.18.1 Minimum Safe Altitude Warning System 1.18.1.1 Postaccident Actions Taken by the Federal Aviation Administration On August 15, 1997, the FAA announced in a press release that, as a “routine precaution,” it had ordered MSAW testing and recertification after the Safety Board’s investigation of the flight 801 accident raised questions about the MSAW’s performance. The FAA reported that, of the 192 in-service122 MSAW software functions at radar approach control facilities, all but 2 were found to be working properly. According to the press release, the software functions were corrected, and all of the functions were recertified as operating properly. Also, in response to inquiries from Safety Board staff, the FAA created special teams of automation experts to completely examine all site adaptation parameters for the 192 MSAW systems located throughout the United States. The FAA directed ATC managers at these locations to document and report any MSAW problems. Further, the FAA’s Associate Administrator for Air Traffic Services directed a fact- finding review of MSAW equipment and operational procedures at 10 ATC towers The review included a survey of 105 air traffic personnel and 33 airway facilities personnel. 121 The DOT/IG report indicated that a “code share team,” comprising representatives from the DOT and the FAA, was developing recommendations to address many of the issues discussed in the audit report. The report noted that, once the recommendations are accepted by DOT and FAA management, additional time and effort would be required to develop policies and procedures to implement those recommendations. 122 The FAA indicated that one MSAW function—at the Aspen/Pitkin Airport in Colorado—was not in service because of the “large number of false low-altitude alerts in the mountainous terrain.” The FAA also indicated that “aviators have been notified of this condition.”

Factual Information 82 Aircraft Accident Report According to the FAA’s executive summary of the MSAW fact-finding review (dated September 1997), “air traffic staff and operational personnel, except for those with automation training, claimed little knowledge of the parameters or components that make up MSAW.” The executive summary indicated that very few of the air traffic survey respondents could remember receiving facility training about different MSAW areas and that most reported that their only MSAW training was an overview during the initial air traffic course. According to the executive summary, the air traffic survey respondents indicated that a check of the MSAW aural alarm was required at the beginning of each shift, but they gave varying answers concerning what should be done if the MSAW was not functioning properly. Likewise, these survey participants believed that controllers should issue an advisory if an aircraft generates an MSAW alert, but the participants were not consistent in their answers regarding who was responsible for responding to the MSAW alert at a satellite tower. In addition, the air traffic personnel in the survey gave different answers regarding who had the authority to adjust MSAW parameters and “vague” answers regarding MSAW general notices. All of the airways facilities personnel in the survey indicated that daily functional checks of aural MSAW alarms were required, and they knew where this check was documented. However, these personnel gave varying answers concerning how they would complete the check if an MSAW system were inhibited. Further, these respondents indicated that their MSAW training ranged from initial hardware training and on-the-job training to only on-the-job training for those personnel who completed initial schooling before the MSAW system was implemented. The fact-finding review also found that the ARTS IIA and IIIE parameter documentation was unclear and confusing to automation specialists and that there were “no guidelines or standards defined in any document concerning the proper way to adapt the MSAW site variables.” The survey revealed that, as a result of inadequate reference material, the MSAW altitudes at one ATC tower and two TRACONs were set incorrectly. These facilities had adapted the MSAW approach path monitor altitudes to be agl values when the system was intended to provide msl values. As a result, all the altitudes used for the MSAW system were hundreds of feet too low at the ATC tower and one of the TRACON facilities; the altitude discrepancy at the other TRACON was “negligible” because of its approximate sea level elevation. On the basis of its fact-finding review, the FAA made several internal recommendations, including the following: • a standardized comprehensive training program should be established to provide a basis for entry-level and periodic refresher training in the operation and maintenance of MSAW equipment, and a certification process should be established for personnel who have completed this training; • uniform site adaptation/system parameters should be established for MSAW equipment operation;

Factual Information 83 Aircraft Accident Report • provisions for periodic evaluation of MSAW equipment should be established to ensure system integrity and reliability; and • configuration management of all software should be reflected in appropriate documents and centrally controlled. In addition, in an October 1997 briefing to Safety Board investigators, FAA officials presented the agency’s planned corrective actions for the national MSAW system. The officials stated that the FAA was developing a central oversight process for the MSAW program and that MSAW systems would be flight checked and ground certified as part of the commissioning process for a new radar and then periodically thereafter. Further, the officials said that the FAA had approved a new MSAW software management policy that “established strict management oversight and control” for MSAW software modifications. 1.18.1.2 Previous Safety Board Recommendations on the Minimum Safe Altitude Warning System The Safety Board has issued numerous safety recommendations regarding the MSAW system. Recent MSAW safety recommendations have addressed the installation of MSAW equipment in VFR terminal facilities that receive radar information from a host radar control facility (as is the case with the Agana tower), as well as the inspection and testing of MSAW speakers to ensure the integrity of MSAW systems. Development of an MSAW System (A-73-46) On December 29, 1972, Eastern Air Lines flight 401, a Lockheed L-1011, N310EA, crashed near Miami, Florida. In its final report,123 the Safety Board stated that its investigation …revealed another instance where the ARTS III system conceivably could have aided the approach controller in his ability to detect an altitude deviation of a transponder-equipped aircraft, analyze the situation, and take timely action…to assist the flight crew. In this instance, the controller, after noticing on his radar that the alphanumeric block representing flight 401 indicated an altitude of 900 feet, immediately queried the flight as to its progress. An immediate positive response from the flight crew, and the knowledge that the ARTS III equipment, at times, indicates incorrect information for up to three scans, led the controller to believe that flight 401 was in no immediate danger. As a result of its findings, the Safety Board issued Safety Recommendation A-73-46, which asked the FAA to 123 National Transportation Safety Board. 1973. Eastern Air Lines, Inc. L-1011, N310EA, Miami, Florida, December 29, 1972. Aircraft Accident Report NTSB/AAR-73/14. Washington, DC.

Factual Information 84 Aircraft Accident Report Review the ARTS III program for the possible development of procedures to aid flight crews when marked deviations in altitude are noticed by an air traffic controller. In a May 31, 1977, letter, the FAA advised the Safety Board that an MSAW system had been developed as an integral function of the ARTS III program and that controllers had received guidance on its use. On September 16, 1977, the Safety Board classified Safety Recommendation A-73-46 “Closed—Acceptable Action.” Minimizing MSAW Inhibited Areas (A-90-130) On September 8, 1989, USAir flight 105, a 737-200, N283AU, struck four electronic transmission cables while executing the localizer backcourse approach to runway 27 at Kansas City International Airport in Kansas City, Missouri.124 The Safety Board’s final report on this incident concluded that, although the Kansas City airport’s ATC facility was equipped with MSAW software, the MSAW alert failed to activate during the premature descent of flight 105 because the descent had occurred more than 1 mile from the runway threshold and inside an area that had been designed to inhibit the MSAW to reduce false alerts. The Safety Board’s report said that “…this incident indicates the need to revise the parameters controlling the size of the MSAW inhibit areas.” The report urged the FAA “to provide site adaptations guidance to encourage modification of MSAW parameters, as appropriate, to increase the MSAW protection areas and to minimize the extent of inhibited areas.” On the basis of its findings, the Safety Board issued Safety Recommendation A-90-130, which asked the FAA to Provide site adaptation guidance to encourage modification of Minimum Safe Altitude Warning parameters, as appropriate, to minimize the extent of inhibit areas. In an October 6, 1993, letter, the FAA stated that it had issued a change to FAA Order 7210.3K, “Facility Operation and Administration,” which provided for site adaptation guidance to minimize the extent of MSAW inhibited areas. Because the FAA’s response met the intent of Safety Recommendation A-90-130, it was classified “Closed— Acceptable Action” on January 28, 1994. MSAW Site Variables and Capture Boxes (A-94-187) On June 18, 1994, a Transportes Aereos Ejecutivos, S.A. (TAESA) Learjet 25D, operating under 14 CFR Part 129, was executing an ILS approach in IMC when the airplane crashed 0.8 nm south of the runway 1R threshold at Dulles International Airport, Chantilly, Virginia.125 The 2 flight crew members and all 10 passengers were killed. The Safety Board’s investigation determined that the accident airplane did not generate any 124 National Transportation Safety Board. 1990. USAir Flight 105, Boeing 737-200, N283AU, Kansas City International Airport, Missouri, September 8, 1989. Aircraft Accident Report NTSB/AAR-90/04. Washington, DC. 125 National Transportation Safety Board, Controlled Collision With Terrain, Transportes Aereos Ejecutivos, S.A. (TAESA), Learjet 25D, XA-BBA, Dulles International Airport, Chantilly, Virginia, June 18,

1. Aircraft Accident Report NTSB/AAR-95/02. Washington, DC.

Factual Information 85 Aircraft Accident Report MSAW alerts while on the approach to the airport. The investigation also determined that the MSAW site variable parameters at the airport required two “current position” radar returns or three “predicted position” radar returns below the 500-foot floor before the aural and visual alerts would activate. A review of the radar data revealed that the airplane generated one radar return below the alert altitude of the runway 1R MSAW capture box. The Safety Board’s investigation of this accident revealed discrepancies with the airport’s MSAW equipment.126 Specifically, the MSAW site variable parameters for runway 1R indicated a discrepancy between the MSAW-defined runway location and the actual threshold location. The FAA said that, when the ARTS III software was programmed for a 10° west variation (the angular difference between true north and magnetic north at Dulles Airport), the computed position for the runway threshold did not correlate to the actual geographic runway location. Further, the “radar-established” runway position was 700 feet northeast of the actual runway threshold. The Safety Board found that the error in the radar position for the runway 1R threshold resulted in a similar displacement of the radar MSAW capture box from its intended position with the actual approach path to runway 1R. The Safety Board concluded that such displacement might compromise the protective intent of the MSAW system. On November 21, 1994, the Safety Board issued Safety Recommendation A-94-187, which asked the FAA to Conduct a complete national review of all environments using MSAW systems. This review should address all user-defined site variables for the MSAW programs that control general terrain warnings, as well as runway capture boxes, to ensure compliance with prescribed procedures.127 In a March 20, 1995, letter, the FAA stated that it planned to review the MSAW site variables to ensure compliance with prescribed procedures. According to the FAA, the 126 The Safety Board investigated another accident involving discrepancies with an MSAW system. On January 13, 1998, a Gates Learjet 25B, N627WS, operated by American Corporate Aviation, Inc., of Houston, Texas, crashed approximately 2 nm east of the runway 26 threshold at George Bush Intercontinental Airport in Houston, Texas, during an ILS approach. (See Brief of Accident FTW98MA096 for more information.) The investigation revealed, among other things, that the MSAW system at the airport was not configured in accordance with the guidance provided in FAA technical document NAS-MD-633, “Minimum Safe Altitude Warning.” The Board identified two MSAW-related errors: the altitude computations for runway 26 were based on the ILS DH instead of the localizer-only MDA, and the ILS data should not have been used at all because other nonprecision approaches to the runway were available. At the time of the accident, the MSAW threshold altitude for runway 26 was incorrectly set to 100 feet agl. Proper application of the procedures contained in NAS-MD-633 would have resulted in a threshold setting of 402 feet agl. This accident is also included in the discussion of Safety Recommendations A-95-35 and A-99-36 in section 1.18.2.4. 127 The Safety Board also issued Safety Recommendation A-94-186, which asked the FAA to review the calculations establishing the runway threshold coordinates for all runways at Dulles International Airport with respect to the air surveillance radar to verify proper alignment of the MSAW capture boxes. On November 20, 1995, the Safety Board noted that the FAA had completed its review of the calculations and adaptation values for runway threshold coordinates for all runways at the airport and had verified proper alignment of the capture boxes. Therefore, Safety Recommendation A-94-186 was classified “Closed— Acceptable Action.”

Factual Information 86 Aircraft Accident Report review would address all user-defined site variables for the MSAW program that control general terrain warnings, as well as runway capture boxes, to ensure compliance. The FAA stated that its review of 190 ATC facilities (128 operational ARTS IIA and 62 operational ARTS IIIA sites) would begin in April 1995 and be concluded by July 1995. On November 20, 1995, the Safety Board stated its concern that the FAA’s review process for the 190 ATC facilities with MSAW was taking longer than originally anticipated. On January 26, 1996, the FAA stated that it had completed its review of the 190 ATC facilities. Further, the FAA stated that, as of October 1995, proper alignment of the MSAW capture boxes had been verified at all 128 ARTS IIA and 62 ARTS IIIA sites.128 On April 8, 1996, the Safety Board stated that, because this action met the intent of Safety Recommendation A-94-187, it was classified “Closed—Acceptable Action.” MSAW Aural Alerts in VFR Facilities (A-95-120) On January 29, 1995, a Beechcraft A36 crashed during a missed ILS approach to DeKalb-Peachtree Airport in Chamblee, Georgia.129 The pilot, the sole occupant of the flight, was killed. The Safety Board determined that, before the accident, the airport tower had received four MSAW general terrain warning alerts from the Atlanta TRACON, which was providing approach control services. The tower was equipped with a D-BRITE radar display with visual MSAW alerting only.130 The Safety Board’s investigation found that, if a full MSAW system (including an aural alert) had been installed in the DeKalb-Peachtree tower, the controller would have received an aural MSAW alert along with the visual alert that had been depicted on the radar. Further, the tower controller told Board investigators that he did not observe the visual MSAW alert on the D-BRITE because he had been involved with other duties before the accident that did not allow him to continually monitor the data block for the airplane. As part of its investigation into the accident, on February 8, 1995, the Safety Board requested that the FAA provide its policy on installation of aural MSAW alerts at low-density ATC towers equipped with D-BRITE radar displays. On June 27, 1995, the FAA stated that “…no policy exists for the operation of an aural alarm associated with MSAW in VFR towers that are not combined with full radar approach control facilities.” On November 30, 1995, the Safety Board issued Safety Recommendation A-95-120, which asked the FAA to 128 According to FAA inspection records, the Guam CERAP ARTS IIA facility was reviewed in July 1995. 129 See Brief of Accident ATL95FA046 for more information. 130 FAA Order 7110.65, “Air Traffic Control,” states that “…unless otherwise authorized, tower radar displays are intended to be an aid to local controllers in meeting their responsibilities to the aircraft operating on the runways or within the surface area.” The order also states that “…local controllers at non-approach control towers must devote the majority of their time to visually scanning the runways and local area; an assurance of continued positive radar identification could place distracting and operationally inefficient requirements upon the local controller.”

Factual Information 87 Aircraft Accident Report Within 90 days from the receipt of this letter, develop a policy that would require the installation of aural minimum safe altitude warning (MSAW) equipment in those visual flight rules terminal facilities that receive radar information from a host radar control facility and would otherwise receive only a visual MSAW alert. On February 21, 1996, the FAA stated that it would conduct a cost-benefit analysis to determine the feasibility of implementing this safety recommendation. The FAA further stated that the analysis would be completed by the end of March 1996. In June 1996, the FAA completed the cost-benefit analysis and determined that it was feasible to implement the recommendation. The FAA expected that implementation would be accomplished by the end of March 1997. In its July 15, 1996, letter to the FAA, the Safety Board stated that, although the FAA’s implementation of the requirement for the aural alert was not accomplished within the 90 days specified in the safety recommendation, the Board was pleased that the FAA had proceeded with the implementation. The Board indicated that it would wait to receive a list of the affected facilities and anticipated installation dates. On July 31, 1997, the FAA stated that it had conducted a survey to determine the total number of ATC facilities that did not have aural MSAW alerts installed. The FAA found that 43 remote displays had been equipped with aural alarms but that 69 remote displays did not have aural alarms. The FAA anticipated that the aural alarms at those 69 remote displays would be implemented by February 1998. On December 30, 1997, the Safety Board said that it was encouraged that the FAA was moving forward and urged the FAA to keep the program on track and within its anticipated milestones. On May 14, 1998, the FAA said that, as of April 10, 1998, kits had been delivered to all 69 remote sites and that all alarms would be operational during May

1. However, at the Safety Board’s public hearing in March 1998, the FAA’s Deputy

Director for Air Traffic Operations testified that the new projected completion date for installation of aural alarms at VFR towers, including the tower at Guam, was April 2000. On October 19, 1998, the Safety Board stated that the primary intent of this recommendation was to ensure that VFR tower controllers who have a visual representation from a distant host radar receive an aural alert when aircraft under their control and with whom they are in radio communication descend below the minimum safe altitude. If the tower controller was engaged in visually scanning for other aircraft, the aural alert would allow the controller to determine the aircraft call sign and transmit the appropriate warning to the pilot. The Board’s letter indicated that the FAA was unclear about whether controllers at VFR terminal facilities would receive an aural alert for those aircraft with whom they are in communication. Further, Safety Board staff had determined that, in at least one location, the VFR tower would not receive an aural warning. (The Board’s letter did not identify the location of this facility.) The Board requested that the FAA ensure that controllers at all VFR towers with visual representation systems from a distant host radar receive an aural alert when aircraft within their traffic pattern and with whom they are in communication descend below the minimum safe altitude. Pending the

Factual Information 88 Aircraft Accident Report receipt of this information from the FAA, Safety Recommendation A-95-120 was classified “Open—Acceptable Response.” On September 29, 1999, a representative from the FAA stated that the agency’s management had indicated that the Agana tower was currently receiving aural MSAW alerts. At an October 7, 1999, briefing attended by the FAA Administrator, the Safety Board Chairman, and staff from both agencies, the FAA indicated that 69 MSAW aural alarms had been delivered and that 51 alarms were to be delivered. The FAA expected that the acquisition of these 51 alarms would be completed by October 2000 and that their installation in VFR towers would be completed by April 2001. On October 12, 1999, the FAA Program Director for Serco Aviation Services told Safety Board staff that the Agana tower has the capability to receive an aural MSAW alert but that, unless the Guam CERAP transfers responsibility for the aircraft’s data block, the tower will not receive the aural warning. The official added that the CERAP does not currently transfer responsibility for the aircraft’s data block to the Agana tower; therefore, the tower does not receive an aural MSAW alert. On October 14, 1999, the FAA Program Director for Air Traffic Operations confirmed that Agana tower was not receiving aural MSAW alerts. In an October 15, 1999, facsimile, the program director indicated that the Agana tower “has the software and hardware capability in place to receive aural alarms.” The director further indicated that the FAA had issued a policy “to ensure that the facility that is in direct radio communications with the aircraft receives the aural alarm” and that the policy would become effective by November 15, 1999. (The FAA subsequently indicated that, under the new procedures, the Guam CERAP would transfer responsibility for the aircraft’s data block to the Agana tower and that the aural MSAW alert would be transferred to the tower upon its acceptance of the transfer of the data block. The tower would advise the CERAP after an MSAW alert was issued.) The program director stated, in a followup telephone conversation with the Safety Board’s Director of the Office of Aviation Safety, that a national policy would be issued to ensure that procedures similar to those being implemented at Guam are followed at other VFR towers. On October 25, 1999, the FAA indicated that the MSAW aural alarms for the ARTS IIA system at Guam were reconfigured on October 24, 1999. The FAA stated that, in the event of a low-altitude alert for an aircraft operating in the vicinity of Guam International Airport, aural alarms will be simultaneously generated at the CERAP and the Agana tower, along with visual low-altitude alerts on the radar displays at both facilities. On November 2, 1999, the Safety Board received a copy of draft FAA Notice N7210.485, “Minimum Safe Altitude Warning for Remote Tower Displays.” According to the notice, facility managers at ATC towers that have aural alarms for MSAW are to ensure that “the operational support facility has adapted the software functionality to ensure the aural alarms operate in the ATCT [air traffic control tower]” and that “aural alarms are received in the ATCT upon transfer of communications.” The FAA indicated that the effective date for this notice would be February 1, 2000.

Factual Information 89 Aircraft Accident Report The Safety Board’s evaluation and classification of Safety Recommendation A-95-120 are discussed in section 2.6.2. Inspections and Tests of MSAW Speakers and the Standard Terminal Automation Replacement System Program (A-97-22 Through A-97-27) On October 2, 1996, a Piper PA-32-300, N2881W, crashed in a heavily wooded area in Brandywine, Maryland, while on approach to Washington Executive/Hyde Field Airport in Clinton, Maryland.131 The pilot and two passengers were killed, and the airplane was destroyed. According to MSAW data retrieved from the Washington National TRACON, the accident airplane generated four general terrain warning MSAW alerts during the approach to the airport. A controller-in-training and a fully certified instructor were providing ATC services to the accident airplane from the TRACON’s F-2 radar position. In a postaccident interview, both controllers stated that they did not recall seeing or hearing any MSAW alerts. Several other controllers and a supervisor who were stationed at nearby positions about the time of the accident also stated that they did not recall hearing or observing any low-altitude warnings before the accident. As part of the Safety Board’s investigation of this accident, a Board investigator toured the TRACON radar room to observe the control position that provided ATC services to the accident pilot. During this tour, the investigator noted that the MSAW aural alarm speaker, located directly above the F-2 radar position (and the only MSAW speaker in the radar room), was covered with heavy paper held in place with what appeared to be masking tape. On the basis of its findings during this accident, the Safety Board issued Safety Recommendations A-97-22 through -27 on April 16, 1997. Safety Recommendations A-97-22 and -23 asked the FAA to Immediately issue an urgent general notice to all affected air traffic managers, directing them to conduct an immediate visual inspection and aural test of the aural minimum safe altitude warning speakers in their facilities to ensure that no devices have been placed over them that might hinder, mute, or prevent the aural warning from being heard in the operational quarters. (A-97-22) Require that a daily visual inspection and aural test of the minimum safe altitude warning (MSAW) speakers located in the operational quarters be conducted by supervisory personnel prior to the start of each shift to ensure the integrity of the MSAW system. Require that these inspections be recorded in the appropriate facility logs. (A-97-23) On July 1, 1997, the FAA stated that it agreed with the intent of Safety Recommendations A-97-22 and -23. The FAA stated that, on May 7, 1997, it had ordered air traffic division managers to brief facility managers on the issue of muted MSAW speakers and instructed supervisors to conduct a visual inspection of MSAW speakers and remove “any muting devices” from these speakers. In addition, the FAA issued a general 131 See Brief of Accident IAD97FA001 for more information.

Factual Information 90 Aircraft Accident Report notice on June 7, 1997, to implement the requirement for supervisors to check the MSAW speakers as part of the shift checklist and record the completion of this inspection on the appropriate facility logs. The FAA also revised Order 7210.3, “Facility Operation and Administration,” to reflect the change in policy and procedures. On February 27, 1998, the Safety Board stated that, because the actions taken by the FAA addressed the intent of Safety Recommendations A-97-22 and -23, they were classified “Closed—Acceptable Action.” Safety Recommendation A-97-24 asked the FAA to Require that all affected terminal personnel be briefed on the contents of this safety recommendation letter. This briefing should focus on generating awareness and vigilance in those situations in which a safety alert might occur and controllers must be prepared to respond, as directed in FAA Order 7110.65, “Air Traffic Control.” On July 1, 1997, the FAA stated that it complied with this safety recommendation in a June 9, 1997, memorandum to facility managers, requiring that controllers be briefed on how to respond to MSAW alerts. The facility managers were directed to ensure, within 2 weeks after the receipt of the memorandum, that all operational personnel were briefed on the requirements of FAA Order 7110.65, “Air Traffic Control,” paragraph 2-1-1, “Duty Priority;” 2-1-6, “Safety Alerts;” and 5-15-57, “Inhibiting Minimum Safe Altitude Warnings (MSAW).” All operational personnel were also expected to be briefed on the actions to be taken when controllers are alerted by the MSAW of an aircraft’s proximity to terrain. On February 27, 1998, the Safety Board stated that it had received a copy of the FAA’s June 9, 1997, memorandum but that, in light of the Korean Air flight 801 accident on August 6, 1997, the Board had not received written confirmation that the actions directed by the memorandum were completed for the Guam ATC facilities. On September 25, 1998, the FAA stated that it had accomplished the briefing to Guam ATC facility personnel on July 18, 1997. As a result, the Safety Board classified Safety Recommendation A-97-24 “Closed—Acceptable Action” on January 14, 1999. Safety Recommendation A-97-25 asked the FAA to Modify the software for the minimum safe altitude warning system to enhance conspicuity of those aircraft that may require the controller’s immediate attention and action. Such modifications might be accomplished by placing the target and data block within a flashing circle. The FAA stated in its July 1, 1997, letter that it reviewed the feasibility of modifying the software for the MSAW system to enhance the conspicuity of the data block. The FAA concluded that the existing MSAW processing generated sufficient alarms and was completely adequate; thus, no further action would be necessary.

Factual Information 91 Aircraft Accident Report On February 27, 1998, the Safety Board stated that it was disappointed with the FAA’s response to this safety recommendation and the FAA’s continued belief that the design of the current MSAW visual display is adequate. Further, the Safety Board stated that the evidence in the Brandywine, Maryland, accident clearly demonstrated that multiple MSAW visual and aural warning alerts were generated in the operational quarters of the TRACON but that the controller failed to respond to these alerts. The Safety Board believed that the FAA should reconsider its position not to remedy the deficiencies that led to the issuance of this recommendation. On September 25, 1998, the FAA stated that color displays, now under development for the Standard Terminal Automation Replacement System (STARS), would provide the increased conspicuity suggested in this safety recommendation. According to the FAA, the STARS early display configuration initial operational capability was scheduled for Ronald Reagan Washington National Airport in March 1999, and the early display configuration operational readiness demonstration was scheduled for June 1999. The early display configuration was to include the color red for alerts in addition to flashing data blocks. All ARTS data, except for alerts, would be monochrome. On January 14, 1999, the Safety Board stated that, pending the commissioning of STARS and the FAA’s inclusion of the flashing red MSAW display feature in the system’s final operational configuration, Safety Recommendation A-97-25 was classified “Open— Acceptable Response.” On August 13, 1999, the FAA stated that the delivery of STARS had been delayed. The FAA indicated that, on April 26, 1999, it announced a revised plan for the STARS program. According to the revised plan, the STARS early display configuration (which includes existing MSAW capability) is to begin initial operations at Syracuse, New York, and El Paso, Texas, in December 1999 and January 2000, respectively. Also, the FAA stated that, as part of the revised plan, it would procure ARTS color displays (which display the alert data blocks in flashing red) for the largest TRACONs and any new facilities while STARS development continues. The ARTS color displays are scheduled to begin operations at the New York TRACON in August 2000. The FAA indicated that, when the STARS full-service system is deployed, the MSAW alerts will flash in red. However, the FAA stated that it did not plan to modify the existing MSAW system as requested in this safety recommendation because the existing system provides both aural and visual alarms and is completely adequate when operated according to design. On November 3, 1999, the Safety Board stated that it was deeply concerned about the significant delay in fielding STARS and that it could not continue to maintain the classification of this recommendation, which was evaluated to be “Open—Acceptable Response” in January 1999, if the implementation of STARS according to its current schedule was the FAA’s only means for complying with the recommendation. The Board urged the FAA to expedite the implementation of STARS by significantly accelerating the current schedule. The Board also urged the FAA to reconsider its position on modifying existing MSAW software if the STARS implementation schedule cannot be accelerated.

Factual Information 92 Aircraft Accident Report Pending the FAA’s reconsideration of this issue or a change in the implementation schedule for STARS, Safety Recommendation A-97-25 remained classified “Open— Acceptable Response.” Safety Recommendation A-97-26 asked the FAA to Require that the Standard Terminal Automation Replacement System program include a minimum safe altitude warning (MSAW) speaker at each radar display, a capability for the controller to momentarily override and mute an MSAW alert, and a computerized recording of the muting of such an alert. On July 1, 1997, the FAA outlined the specifications for STARS and the MSAW system. On February 27, 1998, the Safety Board stated its belief that, for those aircraft that qualify under the MSAW system as part of the routine ATC services, the controller should not be given the option to permanently inhibit the MSAW processing. The Board clarified the intent of this safety recommendation by restating that the controller should be permitted to temporarily mute an alert to acknowledge that warning was received and then act on such an alert, if required. Further, the Board stated that, although the FAA provided specifications regarding the STARS and MSAW system, it did not address the intent of the recommendation. On September 25, 1998, the FAA said that STARS terminal controller workstations and tower display workstations contained individual aural alarm speakers and that STARS would permit MSAW alert inhibits for either a specified aircraft or workstation. The FAA also stated that STARS was designed to permit temporary inhibits resulting from specific aircraft operation characteristics or possible system malfunctions and that all inhibit actions would be recorded. According to the FAA, STARS allows a controller to silence a routine aural alert by hitting an “acknowledge” key. The FAA indicated that, although the aural alarm would be silenced, the alert would remain displayed until the violation condition ceased. On January 14, 1999, the Safety Board stated that, because STARS incorporated all components suggested in Safety Recommendation A-97-26, it was classified “Closed—Acceptable Action.” Safety Recommendation A-97-27 asked the FAA to Require, under the Standard Terminal Automation Replacement System program, that minimum safe altitude warning alerts on instrument flight rules aircraft be duplicated at a position in the operational quarters designated for supervisory personnel and that the supervisor determine the validity of the alert and whether appropriate corrective action has been initiated or is required. The FAA’s July 1, 1997, letter indicated that there is no operational requirement under STARS to duplicate MSAW alarms at supervisory positions. The FAA also stated that supervisory positions did not include controller displays and that it did not plan to provide displays to supervisory personnel. According to the FAA, STARS would provide

Factual Information 93 Aircraft Accident Report a supervisor with the ability to monitor MSAW alerts immediately from every controller position that displays an alert. On February 27, 1998, the Safety Board stated its understanding that the current STARS operational documentation contained no requirement to duplicate the MSAW alerts at supervisory positions and that STARS would provide a supervisor with the ability to monitor MSAW alerts immediately from every controller position that displays an alert. The Board explained that it was not the intent of this recommendation to have a controller workstation be designed for the supervisor but rather to enable the supervisor to be “in the loop” if an MSAW alert was generated. The Board believed that such an arrangement would serve as a form of redundancy that could enhance the benefits of the MSAW system and STARS. In its September 25, 1998, letter, the FAA stated that supervisors should be aware whenever MSAW alerts are generated. Further, the FAA stated that, in STARS, supervisor awareness of MSAW events is accomplished through aural alarms at each controller position. According to the FAA, supervisors are expected to be on the control room floor to monitor all areas of the operation, including MSAW alerts, and are expected to spend a minimal amount of time at supervisory workstations. On January 14, 1999, the Safety Board stated that the individual aural alert speakers located at each controller position should alert a supervisor to the sector experiencing an MSAW alert. Therefore, supervisors should be able to react to each alert from their workstation or throughout the operating floor. Because the intent of Safety Recommendation A-97-27 was satisfied in an alternative manner, it was classified “Closed—Acceptable Alternate Action.” 1.18.2 Traditional and Enhanced Ground Proximity Warning Systems 1.18.2.1 Traditional Ground Proximity Warning System Traditional GPWS uses numerous input signals to determine if a terrain collision threat exists.132 Inputs from the aircraft systems include the radio altitude,133 descent rate and airspeed, landing gear position, landing flap position, and glideslope information. This information generates the visual and aural annunciations to the flight crew. GPWS uses the radio altimeter to calculate closure rate with terrain to predict a potential collision threat. However, if the terrain rises steeply (for example, a sheer cliff), the system cannot provide a timely warning to the flight crew. The optional altitude callout 132 For information on the GPWS installed on Korean Air flight 801, see section 1.6.2.2. 133 Radio altitude is derived from the radio altimeter, also called the radar altimeter. The radio altimeter does not require an accurate barometric pressure setting; rather, it displays the height above the ground by using time-varying frequency and measuring the differences in the frequency of received waves, proportional to time and height.

Factual Information 94 Aircraft Accident Report advisories generated by GPWS are the aircraft’s altitude above the ground as calculated by the radio altimeter. 1.18.2.2 Enhanced Ground Proximity Warning System Enhanced GPWS has the ability to “look ahead” of the aircraft to determine the terrain elevation along the flightpath. Enhanced GPWS can therefore provide pilots with visual and aural alerts in advance of an impending impact with terrain, thus allowing pilots more time than with traditional GPWS to determine the necessary corrective actions to be taken.134 Enhanced GPWS compares the aircraft’s position, as determined by its on-board navigational systems (that is, the flight management system [FMS], inertial reference system, or GPS), with a stored terrain database. Terrain and ground obstructions that may pose a collision threat along the flightpath of the aircraft result in aural and visual warnings. The visual warning information is provided to the pilot using the color graphics capabilities of a dedicated display screen, the color weather radar, or an Electronic Flight Instrument System map display (depending on the particular installation). Further, unlike traditional GPWS, enhanced GPWS utilizes an airport position database to establish a “terrain clearance floor” around all airports. This feature ensures sufficient terrain clearance regardless of the airplane’s landing gear and flap configuration. 1.18.2.2.1 Notice of Proposed Rulemaking for Enhanced Ground Proximity Warning Systems On August 26, 1998, the FAA issued a notice of proposed rulemaking (NPRM) addressing the development and installation of a TAWS135 (Docket No. 29312, Notice No. 98-11). The NPRM stated that Technical Standard Order (TSO) C151, titled “Terrain Awareness and Warning System,” was being developed through the FAA’s TSO process and that, once the TSO has been completed, the FAA would issue an advisory circular (AC)136 addressing an acceptable means of obtaining installation approval. The FAA believed that the installation of a TAWS would ensure that all applicable airplanes operated under Parts 91, 121, and 135 would have state-of-the-art equipment to aid in the prevention of CFIT accidents. The FAA’s proposal also applies to operators conducting flights under Part 125 and operators of U.S.-registered airplanes under Part 129. The FAA proposed that, for operations conducted under Part 121, the rule would apply to all turbine-powered airplanes and that, for operations under Parts 91, 125, 129, 134 For information on the aural alerts that would have been generated by enhanced GPWS for flight 801, see section 1.16.1. 135 In the NPRM, the FAA used the term “TAWS” when referring to enhanced GPWS because the FAA expected that a variety of systems could be developed to meet the improved standards proposed in the NPRM. 136 An AC provides nonregulatory guidance to certificate holders for compliance with the FARs.

Factual Information 95 Aircraft Accident Report and 135, the rule would apply to all turbine-powered airplanes type certificated to have six or more passenger seats, excluding any pilot seat. (The FAA stated in the NPRM that the proposed rule applied only to turbine-powered airplanes, but the FAA indicated that it would consider comments on whether the installation of a TAWS on reciprocating engine- powered airplanes should be required. The FAA also stated that it would study data and information submitted by respondents before making a determination whether TAWS should be required for reciprocating engine-powered airplanes.) The FAA proposed that, beginning 1 year after the effective date of the final rule, U.S.-registered turbine-powered airplanes manufactured after that date be equipped with TAWS and that existing turbine-powered airplanes be equipped with TAWS within 4 years after the effective date of the final rule. The FAA also proposed to amend 14 CFR Sections 121.360 and 135.153 to add an expiration date of 4 years after the effective date of the final rule for the use of current GPWS systems; thereafter, compliance with those sections would not be allowed instead of the provisions proposed within the NPRM. In addition, the FAA’s proposal would also require operators to include in their airplane flight manuals the appropriate procedures for operating and responding to the audio and visual warnings of the TAWS. In a December 24, 1998, letter to the FAA, the Safety Board indicated that the NPRM, if promulgated, would have a positive effect on aviation safety by reducing the possibility for CFIT accidents. However, on May 12, 1999, the Safety Board concluded that the 4-year installation time frame proposed by the FAA should be shortened to 3 years for airplanes that currently lack any GPWS protection (see section 1.18.2.4). The FAA indicated that it expected to issue the final rule by March 2000, with an effective date 1 year after the date of issuance. According to the FAA, the final rule would mandate the installation and use of TAWS within 1 year after the effective date on new-production airplanes and within 4 years after the effective date for existing airplanes. 1.18.2.3 Department of Transportation Studies on Traditional and Enhanced Ground Proximity Warning Systems In 1995, the FAA commissioned the DOT’s Volpe National Transportation Systems Center to examine the effectiveness of GPWS and enhanced GPWS in preventing CFIT accidents in 14 CFR Part 91 operations. The center studied 44 CFIT accidents that occurred between 1985 and 1994 and involved airplanes operating under 14 CFR Part 91 with 6 to 10 passenger seats. Of the 44 airplanes, 11 were turbojets and 33 were turboprops, and none of the airplanes had GPWS installed.137 The center used computer modeling techniques to conclude that (1) GPWS could have prevented 33 of the 44 accidents (75 percent) and 96 fatalities and (2) enhanced GPWS could have prevented 42 of the 44 accidents (95 percent) and 126 fatalities.138 137 These airplanes were not required by the FARs to be equipped with a GPWS. 138 Investigation of Controlled Flight Into Terrain, Aircraft Accidents Involving Turbine-Powered Aircraft with Six or More Passenger Seats Flying Under FAR Part 91 Flight Rules and the Potential for Their Prevention by Ground Proximity Warning Systems, DOT-TSC-FA6D1-96-01, 1996.

Factual Information 96 Aircraft Accident Report Later in 1996, the FAA commissioned the DOT’s Volpe National Transportation Systems Center for a second study that examined the effectiveness of GPWS and enhanced GPWS in preventing CFIT accidents involving airplanes operating under 14 CFR Part 121 and 135 or their foreign equivalents. The center studied 47 domestic and 104 foreign CFIT accidents that occurred between 1985 and 1995; 38 of the domestic accidents and 96 of the foreign accidents involved fatalities. The center developed a methodology and scheme for selecting a representative sample, and nine accidents were selected for detailed study and analysis. The Volpe center found that four of the nine accidents (44 percent) should have been prevented by the basic GPWS equipment that had been installed. In two of these four accidents, the GPWS equipment either was disconnected or malfunctioned; in the other two accidents, poor flight crew coordination after the GPWS warning led to inaction rather than decisive recovery maneuvers. The Volpe center further found that, for all nine accidents, enhanced GPWS would have provided more warning time than GPWS (which was assumed to be 12 to 15 seconds). For seven of the accidents, warning times with enhanced GPWS would have exceeded those of GPWS by more than 20 seconds; two of the accidents would have involved differences of more than 1 minute. The center concluded that “in general, [enhanced GPWS] should have provided an additional margin in which flight crews could assess their situation, discover errors, regain situational awareness, and take appropriate action before impact.” The center noted only one accident for which an assumed enhanced GPWS warning duration would have been only slightly above the 12- to 15-second GPWS warning. The center argued that this case, which involved a pilot’s fatal wrong turn toward mountains, might have been prevented by the visual forward-looking terrain display installed in enhanced GPWS. Thus, the center believed that it was reasonable to assume that enhanced GPWS could have prevented all nine (100 percent) of these accidents. The Part 121 and 135 study credited GPWS as a significant factor in reducing the frequency of CFIT accidents since 1975. However, the center concluded that “there is compelling evidence of the potential effectiveness of [enhanced GPWS] in preventing CFIT accidents.” The study emphasized that CFIT accident prevention would result not only from the increased warning time after the enhanced GPWS detected terrain threats but also from the system’s continuous terrain display, which would enable flight crews to perceive terrain threats and respond to them well before enhanced GPWS would generate its warnings.139 1.18.2.4 Previous Safety Board Recommendations on Traditional and Enhanced Ground Proximity Warning Systems In 1971, the Safety Board began issuing numerous recommendations to the FAA regarding the installation and upgrade modification of GPWS. (The FAA first mandated 139 Investigation of Controlled Flight Into Terrain, Selected Aircraft Accidents Involving Aircraft Flying Under FAR Parts 121 and 135 Flight Rules and the Potential for Their Prevention by Enhanced Ground Proximity Warning System (EGPWS), DOT-TSC-FA6D1-96-03, 1996.

Factual Information 97 Aircraft Accident Report the installation of GPWS in 1974 for all 14 CFR Part 121 carriers.) More recently, the Safety Board has issued recommendations addressing the additional benefits of installing enhanced GPWS. GPWS Development (A-71-53, A-72-19, and A-72-35) On February 17, 1971, a Southern Airways Douglas DC-9-15, N92S, struck an electric transmission line static cable during a VOR approach to runway 31 at the Municipal Airport in Gulfport, Mississippi.140 A successful missed approach was accomplished, and the aircraft landed safely. On the basis of the results of its investigation, the Safety Board issued Safety Recommendation A-71-53, asking the FAA to Develop a ground proximity warning system for use in the approach and landing phases of operation, which will warn flight crews of excessive rates of descent, unwanted/inadvertent descent below minimum descent altitudes, or descent through decision heights. It would be desirable if the equipment now installed could meet this need. The FAA responded that it believed that “the present instrumentation and procedures are safe and adequate provided cockpit disciplines are maintained.” The Safety Board subsequently classified this recommendation “Closed—No Longer Applicable” because it was superceded by Safety Recommendation A-72-19. That recommendation was issued as a result of the June 22, 1971, accident involving a Northeast Airlines McDonnell Douglas DC-9-31, N982NE, which struck the water during a nonprecision instrument approach to runway 24 at the airport at Martha's Vineyard, Massachusetts.141 The Safety Board issued Safety Recommendation A-72-19, asking that The Administrator require all air carrier aircraft to be equipped with a functional ground proximity warning device, in addition to barometric altimeters. On November 14, 1972, Southern Airways charter flight 932, a DC-9, N97S, crashed during a nonprecision instrument landing approach to runway 11 at the Tri-State Airport, Huntington, West Virginia.142 The airplane impacted trees on a hill approximately 1 mile west of the runway threshold. All 71 passengers and 4 crewmembers were killed, and the airplane was destroyed. As a result of its investigation, the Safety Board issued Safety Recommendation A-72-35 to the FAA, asking that The Administrator evaluate the need for the installation and use of ground proximity warning devices on air carrier aircraft. 140 National Transportation Safety Board. 1971. Southern Airways, Inc., Douglas DC-9-15, N92S, Gulfport, Mississippi, February 17, 1971. Aircraft Accident Report NTSB/AAR-71/04. Washington, DC. 141 National Transportation Safety Board. 1972. Northeast Airlines, Inc., McDonnell Douglas DC-9-31, N982NE, Martha’s Vineyard, Massachusetts, June 22, 1971. Aircraft Accident Report NTSB/AAR-72-04. Washington, DC. 142 National Transportation Safety Board. 1972. Southern Airways, Inc., DC-9, N97S, Tri-State Airport, Huntington, West Virginia, November 14, 1972. Aircraft Accident Report NTSB/AAR-72-11. Washington, DC.

Factual Information 98 Aircraft Accident Report In its November 2, 1973, letter to the FAA, the Safety Board classified Safety Recommendation A-72-19 “Closed—Acceptable Alternate Action.” Also, the Board classified Safety Recommendation A-72-35 “Closed—No Longer Applicable” in the same letter. GPWS Installation for 14 CFR Part 135 Operations (A-86-109) On August 25, 1985, Bar Harbor Airlines flight 1808, a Beech B99, N300WP, crashed during an ILS approach to Auburn-Lewiston Airport, Auburn, Maine. The airplane struck trees at an elevation of 345 feet msl in a wings-level attitude 4,000 feet from the end of the runway threshold and 440 feet to the right of the extended runway centerline. All eight airplane occupants were killed. On September 23, 1985, Henson Airlines flight 1517, a Beech B99, N339HA, crashed during an ILS approach to Shenandoah Valley Airport, Weyers Cave, Virginia. The airplane struck trees at an elevation of 2,400 feet msl in a wings-level attitude about 6 miles east of the airport. All 14 airplane occupants were killed. On March 13, 1986, Simmons Airlines flight 1746, an Embraer EMB-110P1, N1356P, crashed during an ILS approach to Phelps Collins Airport, Alpena, Michigan. The airplane struck trees at an elevation of 725 feet msl in a wings-level attitude about 1 ½ miles from the end of the runway threshold and about 300 feet to the left of the extended runway centerline. Three of the nine airplane occupants were killed, five occupants received serious injuries, and one occupant received minor injuries. The Safety Board's investigation of these accidents revealed that the accidents occurred while the airplanes were in controlled flight and the flight crews were attempting to complete precision instrument approaches in IMC.143 None of the flight crews indicated that they were experiencing airplane or equipment problems, and none of the postaccident examinations disclosed airplane or equipment problems that would explain the accidents. As a result of these three accidents, the Safety Board issued Safety Recommendation A-86-109, which asked the FAA to Amend 14 CFR Section 135.153 to require after a specified date the installation and use of ground proximity warning devices in all multiengine, turbine-powered fixed-wing airplanes, certificated to carry 10 or more passengers. On January 8, 1987, the FAA stated that it initiated a proposed regulatory project for the development of an NPRM for a GPWS requirement for 14 CFR Part 135 operators. According to the FAA, the rationale and requirements for the NPRM were finalized and would be presented to the Regulatory Review Board in early 1987. On May 15, 1987, the Safety Board asked for an update on the status of the NPRM. 143 For more information on the Bar Harbor, Henson, and Simmons Airlines accidents, see Briefs of Accident DCA85AA035, DCA85AA037, and DCA86AA021, respectively.

Factual Information 99 Aircraft Accident Report On May 16, 1989, the FAA stated that the March 1989 Volpe National Transportation System Center report, titled Investigation of Controlled Flight Into Terrain (DOT-TSC-FA994-89-10), presented an investigation of CFIT accidents involving multiengine, fixed-wing, turbine-powered aircraft operating in accordance with 14 CFR Part 135 at the time of the accident and the potential application for a GPWS. The FAA stated that, as a result of the Volpe report and the availability of a GPWS at a more reasonable cost to commuter aircraft, the FAA was considering the issuance of an NPRM to address the intent of Safety Recommendation A-86-109. On June 20, 1989, the Safety Board stated that it was pleased that the FAA was considering the issuance of an NPRM. On April 24, 1992, the FAA stated that, on March 17, 1992, it issued a final rule (Docket No. 26202; Amendment No. 135-42) to require that all turbine-powered (rather than only turbojet) airplanes with 10 or more seats be equipped with an approved GPWS. On June 10, 1992, the Safety Board stated that it was pleased to note that the FAA had issued the final rule and that, as a result, Safety Recommendation A-86-109 was classified “Closed—Acceptable Action.” GPWS Installation for 14 CFR Part 91 Operations (A-92-55 and A-95-35) On December 11, 1991, a Bruno’s, Inc., Beechjet 400, N25BR, operating under 14 CFR Part 91, impacted mountainous terrain approximately 3 minutes after takeoff from Richard B. Russell Airport near Rome, Georgia. The two flight crewmembers and all seven passengers were killed. The airplane was not equipped with a GPWS and was not required by the FARs to be so equipped. The Safety Board concluded that, if a GPWS had been installed on the airplane, a warning would have sounded about 12 seconds before impact and would have most likely provided sufficient time for the pilots to take action to avoid flying into terrain.144 As a result of the accident, the Board issued Safety Recommendation A-92-55, which asked the FAA to Require all turbojet-powered airplanes that have six or more passenger seats to be equipped with a ground proximity warning system. The FAA, however, did not agree with this recommendation. In an October 13, 1992, letter to the Safety Board, the FAA stated that, in making the determination not to require a GPWS on all turbojet-powered airplanes with six or more passenger seats, it considered, “among other factors, the operating environment most prevalent for turbojet- powered airplanes, the extent of radar service in the air traffic control system, and the employment of the minimum safe altitude warning system.” On January 6, 1993, the Board classified Safety Recommendation A-92-55 “Closed—Unacceptable Action.” After the June 18, 1994, TAESA Learjet accident at Dulles International Airport,145 the Safety Board issued Safety Recommendation A-95-35, which asked the FAA to 144 National Transportation Safety Board. 1992. Bruno’s, Inc., Beechjet 400, N25BR, Rome, Georgia, December 11, 1991. Aircraft Accident Report NTSB/AAR/92-01/SUM. Washington, DC. 145 See Safety Recommendation A-94-187 in section 1.18.1.2 for additional information about this accident.

Factual Information 100 Aircraft Accident Report Require within 2 years that all turbojet-powered airplanes with six or more passenger seats have an operating ground proximity warning system installed. On June 14, 1995, the FAA stated that it had asked the Volpe National Transportation Systems Center to study CFIT accidents involving turbojet-powered airplanes equipped with six or more passenger seats and document those CFIT accidents that would have been avoided if GPWS or enhanced GPWS had been installed.146 The FAA stated that it would review the results of the study to determine any regulatory action that would need to be initiated. On August 29, 1995, the Safety Board stated that it would wait for the study to be completed and then evaluate the actions taken by the FAA in response to the study’s findings. On April 17, 1997, the FAA stated that it had initiated rulemaking proposing to mandate the installation of enhanced GPWS on all turbine-powered airplanes with six or more passenger seats.147 The FAA also indicated that the White House Commission on Aviation Safety and Security issued a recommendation that urged the installation of enhanced GPWS on commercial aircraft. The FAA stated that it was proposing to revise 14 CFR Parts 91, 121, and 135 to address the Board’s and White House’s recommendations. On July 31, 1997, the Safety Board said that it reviewed the results of the study by the Volpe National Transportation Systems Center. The Board stated that it was pleased that the FAA had initiated rulemaking activity to revise 14 CFR Parts 91, 121, and 135 to mandate enhanced GPWS on all turbine-powered airplanes with six or more passenger seats. The Board indicated that nearly 1 year had passed since the study was completed, and the Board hoped that the FAA’s important rulemaking action would not be further delayed. On January 13, 1998, the Houston Gates Learjet accident occurred. This accident, which was briefly discussed in section 1.18.1.2, involved a positioning flight operating under 14 CFR Part 91. The airplane departed from Hobby Airport in Houston for George Bush Intercontinental Airport, where five people were waiting to board the airplane for a 14 CFR Part 135 charter flight to Fargo, North Dakota. The captain and first officer—the sole occupants aboard the flight—were killed when the airplane struck trees and impacted the ground, and the airplane was destroyed by impact forces and fire. The airplane was not equipped with a GPWS and was not required by the FARs to be so equipped. Although the Safety Board determined that the probable cause of this accident was flight crew error, the Board also found that the lack of an FAA requirement for a GPWS on the airplane was a factor in the accident. On May 12, 1999, the Safety Board stated that the circumstances of the Houston Learjet accident, the TAESA Learjet accident, and the Bruno’s Beechjet accident clearly 146 See section 1.18.2.3 for more information about this study. 147 Between the time of the Safety Board’s August 1995 letter and the FAA’s April 1997 letter, the Volpe study was issued, and an American Airlines CFIT accident involving traditional GPWS occurred. (This accident is discussed in the Safety Recommendation A-96-101, which is the next recommendation presented.)

Factual Information 101 Aircraft Accident Report indicated the potential to reduce CFIT accidents by requiring the installation of a GPWS in turbojet-powered airplanes equipped with six or more passenger seats. The Board further stated that the 1996 DOT study provided compelling evidence that Safety Recommendation A-95-35 should be broadened to include turboprop-powered airplanes and require the installation of enhanced GPWS. As a result, the Safety Board classified Safety Recommendation A-95-35 “Closed—Acceptable Action/Superseded.”148 Enhanced GPWS for Transport-Category Airplanes (A-96-101) On December 20, 1995, American Airlines flight 965, a Boeing 757, N651AA, was on a regularly scheduled 14 CFR Part 121 flight from Miami, Florida, to Cali, Colombia, when it struck trees and crashed into the side of a mountain in night VMC.149 Of the 8 crewmembers and 156 passengers aboard the airplane, all but 4 were killed. The airplane was equipped with a GPWS, as required. Approximately 12 seconds before impact, the GPWS began issuing aural warnings of “TERRAIN” and “PULL UP.” However, the GPWS did not provide the warning in time for the flight crew to successfully avoid crashing into the mountainous terrain. As a result of this accident, the Safety Board issued Safety Recommendation A-96-101, asking the FAA to Examine the effectiveness of the enhanced ground proximity warning equipment and, if found effective, require all transport-category aircraft to be equipped with enhanced ground proximity warning equipment that provides pilots with an early warning of terrain. On December 31, 1996, the FAA stated that it had begun evaluating the effectiveness of enhanced GPWS. Further, the FAA stated its belief that enhanced GPWS would perform as intended and should significantly increase a pilot’s situational awareness. The FAA indicated that evaluations to date revealed that enhanced GPWS would be a valuable aid in preventing CFIT accidents. The FAA anticipated completing its evaluation by March 1997 and stated that it would initiate appropriate action based on the results of the evaluation. On April 11, 1997, the Safety Board acknowledged that the FAA was considering the issuance of an NPRM to require enhanced GPWS equipment on all civil, turbine- powered aircraft with six or more passenger seats. The Board indicated that it would wait to review the FAA’s final action. On May 4, 1999, the FAA stated that, in August 1998, it issued an NPRM proposing to require the installation and use of TAWS on any U.S.-registered turbine- powered airplane with six or more passenger seats operating under 14 CFR Parts 91, 121, and 135. According to the FAA, because operators under 14 CFR Part 125 and operators 148 Safety Recommendation A-95-35 was superceded by A-99-36. 149 The investigation of this accident was conducted by the Aeronautica Civil of the Government of Colombia, with assistance from the Safety Board. For more information, see the Aeronautica Civil of the Government of Colombia Aircraft Accident Report, Controlled Flight Into Terrain, American Airlines Flight 965, Boeing 757-223, N651AA, Near Cali, Colombia, December 20, 1995.

Factual Information 102 Aircraft Accident Report of U.S.-registered airplanes under 14 CFR Part 129 must comply with 14 CFR Part 91, they would also have to meet the proposed requirements of the NPRM. The FAA further indicated that it had issued TSO C151, “Terrain Awareness and Warning System,” for public comment. According to the FAA, TSO C151 would prescribe the minimum operational performance standards that a TAWS must meet.150 The FAA stated that the comment period for TSO C151 was from November 4, 1998, to January 26, 1999. The FAA also stated that it had extended the ending date of the comment period for the NPRM from November 24, 1998, to January 26, 1999, to coincide with the ending date of the comment period for the TSO. On July 13, 1999, the Safety Board stated that, pending the issuance of the final rule on the installation and use of TAWS and TSO C151, Safety Recommendation A-96-101 was classified “Open—Acceptable Response.” In an October 1, 1999, response, the FAA stated that it had issued the final TSO on August 16, 1999. The FAA also stated that it expected to issue the final rule by March 2000 with an effective date of 1 year after the date of issuance. The Safety Board’s evaluation and classification of Safety Recommendation A-96-101 are discussed in section 2.8.2. Enhanced GPWS for Turbine-Powered Airplanes (A-99-36) As part of its investigation into the 1998 Houston Learjet accident (see the discussion regarding Safety Recommendation A-95-35), the Safety Board concluded that the 4-year TAWS installation time frame should be shortened for airplanes that lack any GPWS protection. On May 12, 1999, the Safety Board issued Safety Recommendation A-99-36, which asked the FAA to Require, within 3 years, that all turbine-powered airplanes with six or more passenger seats that are not currently required to be equipped with a ground proximity warning system (GPWS) have an operating enhanced GPWS (or terrain awareness and warning system). On July 26, 1999, the FAA stated that, in August 1998, it had issued an NPRM on the installation and use of TAWS on any U.S.-registered turbine-powered airplane with six or more passenger seats operating under 14 CFR Parts 91, 121, and 135. The FAA indicated that the NPRM proposed adding new rules that would prohibit the operation of certain airplanes unless those airplanes were equipped with a TAWS that met the minimum operational performance standards prescribed in TSO C151, “Terrain Awareness and Warning System.” The FAA also stated that, on May 27, 1999, it published a change to the proposed TSO to include two classes (A and B) of TAWS equipment. According to the FAA, TSO C151 Class A equipment would be required for airplanes operated under 14 CFR Part 121 and for airplanes configured with 10 or more passenger seats operating under 14 CFR 150 See the discussion in Safety Recommendation A-99-36 for detailed information on TSO C151.

Factual Information 103 Aircraft Accident Report Part 135, and TSO C151 Class B equipment would be the minimum requirement for airplanes operating under 14 CFR Part 91 and for airplanes configured with six to nine passenger seats operating under 14 CFR Part 135. The FAA indicated that both classes of equipment would include the TAWS features of comparing airplane position information with an on-board terrain database and providing appropriate caution and warning alerts, if necessary. Further, the FAA stated that it revised the proposed TSO to include the airworthiness requirements for both classes of equipment. The FAA indicated that it expected to issue the final TSO by September 1999 and the final rule by March 2000, with an effective date 1 year after the date of issuance. According to the FAA, the final rule would mandate the installation of TAWS within 1 year after the effective date on new-production airplanes and within 4 years after the effective date for existing airplanes. The FAA indicated that these compliance dates, which were established in the current NPRM, were developed based on product availability and the anticipated manufacturing approval process. The FAA further indicated that a change in the compliance dates, as recommended in this safety recommendation, would require publishing a supplemental NPRM. The FAA believed that any change to the current rulemaking effort would delay the implementation of TAWS well beyond the proposed dates of the current final rule, as well as the compliance dates included in the recommendation. On October 1, 1999, the FAA stated that it had issued the TSO C151 on August 16, 1999. The Safety Board’s evaluation and classification of Safety Recommendation A-99-36 are discussed in section 2.8.2. 1.18.3 Controlled Flight Into Terrain Accident Information 1.18.3.1 Flight Safety Foundation Study of Controlled Flight Into Terrain Accidents In the early 1990s, the Flight Safety Foundation (FSF) created a CFIT Awareness Task Force to promote general CFIT awareness. This task force evolved into an international Approach and Landing Accident Reduction Task Force, working under the auspices of the FSF. According to statistics compiled by the task force, CFIT accidents have killed more than 9,000 passengers and crewmembers since the beginning of commercial jet operations in the late 1950s. The statistics also indicate that, between 1988 and 1997, more than 2,800 people were killed in 39 CFIT-related accidents worldwide. The FSF task force estimated that about 25 CFIT accidents occur worldwide each year involving large commercial jet transports and large commuter and regional turboprop airplanes. Several factors that frequently appeared in CFIT accident reports included night and limited visibility conditions, terrain not observed until just before impact, loss of horizontal or vertical situational awareness, unfamiliarity with terrain and obstructions, flight crew uncertainty about altitudes and distance from the airport, navigational equipment improperly set or misinterpreted by the flight crew, and an unstabilized approach.

Factual Information 104 Aircraft Accident Report The FSF, using statistics from the United Kingdom’s CAA global database, found that 287, or 46 percent, of the 621 fatal CFIT accidents worldwide between 1980 and 1986 occurred during the approach and landing phase of flight. A study commissioned by the CAA for the FSF151 examined these 287 fatal approach and landing accidents.152 According to the study, these 287 accidents resulted in 7,185 fatalities to passengers and crewmembers, which averaged 25 fatalities per accident, or 63 percent of the total aircraft occupants. The study indicated that 75 percent of the accidents occurred when a precision approach aid was neither available nor used and that nighttime accidents occurred at three times the rate of those that occurred during daylight conditions. The lack of ground aids was cited in at least 25 percent of the accidents. The study concluded that the “most frequent circumstantial factors were non-installation of currently available safety equipment (generally GPWS systems) and the failure to emphasize the use of crew resource management.” The study determined that, in 279 of the accidents,153 the 5 most frequently identified primary causal factors—omission of action/inappropriate action, lack of positional awareness in the air, flight handling, “press-on-itis,” and poor professional judgment/airmanship—accounted for 71 percent of the accidents.154 According to the FSF, omission of action/inappropriate action generally referred to the crew continuing the descent below the DH or MDA without visual reference or when visual cues were lost. Lack of positional awareness in the air generally involved a lack of appreciation of the aircraft’s proximity to high ground, frequently when the aircraft was not equipped with a GPWS and when precision approach aids were not available. Press-on-itis referred to a flight crew’s “determination to get to a destination or persistence in a situation when that action is unwise.” The study also determined that all five primary causal factors involved crewmembers.155 The study reported that the number of accidents and the number of fatalities showed an overall increasing trend and that, if the trend were to continue, “…by 2010 there will be 23 fatal ALAs [approach and landing accidents] with a total of 495 fatalities annually involving Western-built aircraft (commercial jets, business jets and turboprop airplanes)….” On the basis of the results of this study, the FSF Approach and Landing 151 “A Study of Fatal Approach-and-landing Accidents Worldwide, 1980-1996,” Flight Safety Digest, February-March 1998. This study was also included as part of a special FSF report, “Killers in Aviation: FSF Task Force Presents Facts About Approach-and-landing and Controlled-flight-into-terrain Accidents,” Flight Safety Digest, November-December 1998 and January-February 1999. 152 The study’s data indicated that, of the 287 approach and landing accidents, 108 occurred on initial approach, 82 on final approach, and 97 on landing. 153 Of the 287 accidents in the study, 8 were judged to have insufficient information available to determine a primary causal factor. 154 Omission of action/inappropriate action was identified in 69 accidents, lack of positional awareness in 52 accidents; flight handling in 34 accidents, “press-on-itis” in 31 accidents, and poor professional judgment/airmanship in 12 accidents. 155 According to the FSF report, “considering the causal groups, rather than individual factors, “crew” featured in 228 of the 279 accidents (82 percent)....”

Factual Information 105 Aircraft Accident Report Accident Reduction Task Force issued nine conclusions and recommended several initiatives to support each conclusion.156 (The recommendations for each conclusion are detailed in appendix C.) The conclusions were as follows: • Establishing and adhering to adequate standard operating procedures and CRM processes will improve approach and landing safety. • Improving communication and mutual understanding between ATC services and flight crews of each other’s operational environment will improve approach and landing safety. • Unstabilized and rushed approaches contribute to ALAs. • Failure to recognize the need for and to execute a missed approach, when appropriate, is a major cause of ALAs. • The risk of ALAs is higher in operations conducted during low light and poor visibility, on wet or otherwise contaminated runways, and with the presence of optical physiological illusions. • Using the radio altimeter as an effective tool will help prevent ALAs. • When the PIC [pilot-in-command] is the PF and the operational environment is complex, the task profile and workload reduce PF flight management efficiency and decision-making capability in approach and landing operations. • Collection and analysis of in-flight parameters (for example, flight operations quality assurance programs) can identify performance trends that can be used to improve the quality of approach and landing operations. • Global sharing of aviation information decreases the risk of ALAs. 1.18.3.2 Factors Involved in Recent Controlled Flight Into Terrain Accidents and Incidents A British Airways Boeing 777 captain who was a member of the FSF’s Approach and Landing Accident Reduction Task Force and CFIT Awareness Task Force testified at the Safety Board’s public hearing about the factors that have been involved in CFIT accidents and incidents. The captain testified that five of six CFIT accidents in 1996 and 1997 occurred during nonprecision approaches. The captain also said that, from 1988 to 1997, one-half of the commercial jet CFIT accidents were during step-down approaches, even though most of those airplanes had DME available.157 The captain testified that, according to the accident data, the chances of a CFIT accident occurring during a nonprecision approach is five times greater than during a 156 These conclusions and recommendations were presented at the FSF’s Corporate Aviation Safety Seminar, held May 5 through 7, 1998. 157 The captain stated that only three CFIT accidents during that time period occurred on precision approaches and that these accidents experienced a probable failure of the glideslope receiver, a probable failure of the FD to capture, and a possible situation in which the autopilot was not coupled.

Factual Information 106 Aircraft Accident Report precision approach. The captain also stated that nonprecision approaches are generally much more complex than precision approaches because, for many pilots, nonprecision approaches are less familiar, are more prone to error, and require more comprehensive briefing. Further, the captain stated that nonprecision approaches need particularly careful and accurate monitoring and that it is possible, with complex step-down procedures, for steps to be missed or taken out of order. The captain added, “in other words, to get one step ahead of the airplane could be fatal.” He recommended eliminating step-down nonprecision approaches “…because the accident data says we should….” In addition, the captain testified that nonprecision approaches need much more carefully managed airplane crew and checklist management because many CFIT accidents occur when the crew is preoccupied or distracted by other tasks. The captain stated that 70 percent of the CFIT accidents occurred on final approach and that most of these aircraft were “…in line with the runway.” The captain also stated that “…many accident aircraft [were] underneath the three-degree glideslope [of a precision approach].” Figure 10 shows vertical profile information that was available from the 40 CFIT accidents and incidents that occurred between 1986 and 1990, as prepared by Boeing and provided by the FSF’s CFIT Awareness Task Force. Figure 10. Vertical profile information from the 40 CFIT accidents and incidents between 1986 and 1990. Reproduction courtesy of The Boeing Company and the Flight Safety Foundation’s Controlled Flight Into Terrain Awareness Task Force.

Factual Information 107 Aircraft Accident Report The captain stated his belief that no single measure or piece of aircraft equipment can prevent CFIT accidents and that a range of measures suited to a particular operator and operating environment is needed. The captain added that ICAO has planned a series of CFIT-related actions, including the following: • the adoption of colored terrain and minimum safe altitude contour presentation on approach procedure charts to improve their readability and understanding by a flight crew, particularly in the cockpit environment at night; • new requirements and new emphasis on standard operating procedures (specifically, altitude awareness procedures), including the use of standard or automated callouts, guidance on the use of autopilot, and the incorporation of stabilized approach procedures concepts; • changes to instrument approach procedure design, including the optimum angle for nonprecision approaches and the application of vertical navigation (VNAV) or FMS during nonprecision approaches; and • the translation of the FSF’s Education and Training Aid (see section 1.18.3.3) from English into the other five languages used by ICAO.158 1.18.3.3 Controlled Flight Into Terrain Training Aids The Boeing Commercial Airplanes Group, along with the FAA, and the FSF have developed and published CFIT educational materials and training aids for use by operators. The purpose of each aid is to heighten flight crew awareness to CFIT precursors and the methods and techniques to avoid this type of accident. The Boeing/FAA CFIT Education and Training Aid, which became available to air carriers in 1997, is presented in five sections. According to the FAA, this training aid, along with a new videotape, was distributed to all 14 CFR Part 121 and 135 operators for inclusion in their training programs. Section one provides a broad overview for airline executives of CFIT problems and possible solutions. Section two, titled “A Decision Maker’s Guide,” describes airline operations, aviation industry regulators, and industry efforts to eliminate CFIT. Section three, titled “An Operator’s Guide,” describes causal factors of CFIT accidents, the traps in which flight crews can find themselves, and specific in-flight escape maneuvers. Section four describes a model CFIT airline education program. Section five provides additional background information on CFIT and references selected reading materials and accident and incident information. The FSF’s CFIT Task Force developed a CFIT checklist in 1993 to aid in the avoidance of CFIT accidents. The checklist was designed so that the user, before a flight, could evaluate the risk factors and identify the potential for a CFIT accident. For example, the checklist indicated that flying in night IMC significantly increases the risk of a CFIT accident occurring. The checklist is divided into two diagnostic parts. The first part, titled “CFIT Risk Assessment,” includes negative destination CFIT risk factors, such as VOR/DME approaches, airports near mountainous terrain, and radar coverage limited by 158 The captain also indicated that ICAO was considering whether to publish a manual on CFIT avoidance.

Factual Information 108 Aircraft Accident Report terrain masking. Further, this assessment evaluates risk multipliers, such as IMC weather and extended crew duty days. The second part, titled “CFIT Risk Reduction Factors,” includes positive company management traits and the availability of CFIT training programs. 1.18.3.4 Previous Safety Board Recommendations Related to Controlled Flight Into Terrain Since the early 1970s, the Safety Board has issued numerous safety recommendations to the FAA in response to CFIT accidents, including those discussed as part of the GPWS and enhanced GPWS recommendations in section 1.18.2.4 and approach procedure design recommendations in section 1.18.4.4. This section provides information on other CFIT-related safety recommendations. On December 20, 1995, the American Airlines flight 965 accident near Cali, Colombia, occurred.159 On October 16, 1996, the Safety Board issued Safety Recommendations A-96-93 through -95, A-96-102, and A-96-106 as a result of the findings from this accident investigation.160 Safety Recommendation A-96-93 asked the FAA to Evaluate the terrain avoidance procedures of air carriers operating transport- category aircraft to ensure that the procedures provide for the extraction of maximum escape performance and ensure that those procedures are placed in procedural sections of the approved operations manuals. On April 23, 1997, the FAA stated it agreed with the intent of Safety Recommendation A-96-93 and that it had completed its efforts to evaluate terrain avoidance procedures. The FAA stated that, in January 1997, it developed and published the CFIT Education and Training Aid along with Boeing (see section 1.18.3.3). The FAA also stated that, on February 25, 1997, it issued a revision (Change 2) to AC-120-51B, “Crew Resource Management,” Appendix 3, “Appropriate CRM Training Topics,” paragraph 2(1), to recommend that CRM training in LOFT or Special Purpose Operational Training for flight crewmembers contain a CFIT scenario. According to the FAA, this paragraph recommends that the training should emphasize prevention through effective 159 See section 1.18.2.4 for more information about this accident. 160 The Aeronautica Civil of the Government of Colombia issued the following CFIT-related recommendations to the FAA: (1) require that all approach and navigation charts used in aviation graphically portray the presence of terrain located near airports or flightpaths, (2) encourage manufacturers to develop and validate methods to present accurate terrain information on flight displays as part of a system of early ground proximity warning, (3) develop a mandatory CFIT training program that includes realistic simulator exercises that are comparable to the successful windshear and rejected takeoff training programs, and (4) evaluate the CFIT escape procedures of air carriers operating transport-category aircraft to ensure that the procedures provide for the extraction of maximum escape performance and ensure that those procedures are placed in operating sections of the approved operations manuals. In addition, the Aeronautica Civil recommended that ICAO evaluate and consider adopting the recommendations of the FSF’s CFIT task force (see appendix C).

Factual Information 109 Aircraft Accident Report communication and decision behavior and the importance of immediate, decisive, and correct response to a ground proximity warning. On November 13, 1997, the Safety Board acknowledged the progress made by the FAA but noted that the FAA’s response did not address whether the escape/terrain avoidance procedures would be included in the procedural sections of approved operations manuals. Pending further information from the FAA, Safety Recommendation A-96-93 was classified “Open—Acceptable Response.” On August 11, 1999, the FAA stated that it would issue a flight standards information bulletin that directed POIs to ensure that the aircraft-specific procedure for maximum escape performance (as depicted in the CFIT training aid), or an equivalent of that procedure, was contained in each appropriate FAA-approved operations manual. The FAA indicated that it planned to issue the bulletin by the end of August 1999. On October 20, 1999, the FAA indicated that it had issued Flight Standards Information Bulletin for Air Transportation 99-08, “Controlled Flight Into Terrain (CFIT) Training,” on October 5, 1999. According to the FAA, the bulletin announces the publication of the CFIT Education and Training Aid and informs POIs that the training aid is posted on the FAA’s Web site. The FAA stated that the bulletin also directs POIs to ensure that the aircraft-specific procedure for maximum escape performance is contained in each appropriate FAA-approved operations manual. Safety Recommendation A-96-94 asked the FAA to Require that all transport-category aircraft present pilots with angle-of-attack information in a visual format and that all air carriers train their pilots to use this information to obtain maximum possible airplane climb performance.161 On December 31, 1996, the FAA stated that it had begun an evaluation to assess the operational requirements for an angle-of-attack162 indicator. The FAA indicated that the evaluation should be completed by March 1997. On April 11, 1997, the Safety Board stated its understanding that the FAA’s assessment would include implementation and training requirements, the complexity and cost of the system, and other functions and would indicate the angle-of-attack for maximum rate climb. The Safety Board also stated its understanding that, if angle-of- attack indicators were warranted, the FAA would take appropriate regulatory action. Pending an evaluation of the FAA’s completed action, Safety Recommendation A-96-94 was classified “Open—Acceptable Response.” 161 The Safety Board reiterated Safety Recommendation A-96-94 on July 15, 1997. See National Transportation Safety Board. 1997. Uncontrolled Flight Into Terrain, ABX (Airborne Express), Douglas DC-8-63, N827AX, Narrows, Virginia, December 22, 1996. Aircraft Accident Report NTSB/AAR-97/05. Washington, DC. 162 Angle-of-attack is the angle of the airplane wing to the relative wind.

Factual Information 110 Aircraft Accident Report On May 4, 1999, the FAA stated that it had evaluated the requirements for the display of angle-of-attack information to obtain the maximum airplane climb performance. The FAA indicated that angle-of-attack information during an escape maneuver could provide some improvement in climb performance but that the prevention of terrain escape maneuvers would provide a much greater safety benefit than the climb performance improvements gained by the display of angle-of-attack information. The FAA indicated that it had reviewed CFIT accidents and analyses of CFIT accident data prepared by various organizations. The FAA stated that its review found that accidents have only rarely been caused by the failure to obtain the maximum possible airplane climb performance during the ground proximity escape maneuver. Thus, the FAA believed that more effective prevention of CFIT accidents would yield the greatest safety benefit. The FAA cited initiatives to prevent CFIT accidents, including TAWS and the use of FMS with VNAV capability for constant angle of descent approaches. The FAA believed that these initiatives would greatly improve pilots’ situational awareness with regard to terrain and would directly reduce the likelihood that pilots using these systems would need to perform a ground proximity escape maneuver. Further, the FAA believed that the safety gains from improvements in escape maneuver climb performance, gained by the introduction of angle-of-attack information, would be overshadowed by the safety gains from the implementation of TAWS, especially when that system is combined with other technologies, such as FMS with VNAV capability and GPS. Regarding the training portion of Safety Recommendation A-96-94, the FAA stated that it was revising air carrier pilot training requirements contained in 14 CFR Part 121 to include mandatory training in the ground proximity escape maneuver recommended by manufacturers for their specific airplane(s). The FAA indicated that one objective of this training would be to improve pilot actions in achieving maximum airplane climb performance during the escape maneuver. In addition, the FAA stated that the regulatory proposal would refer to the guidance in the CFIT Education and Training Aid, which provides instructions on how to achieve the optimum angle-of-attack (given the indications available in the airplane) and the manufacturers’ recommended ground proximity escape maneuvers. Safety Recommendation A-96-95 asked the FAA to Develop a controlled flight into terrain training program that includes realistic simulator exercises comparable to the successful windshear and rejected takeoff training programs and make training in such a program mandatory for all pilots operating under 14 CFR Part 121. On April 23, 1997, the FAA stated it agreed with the intent of Safety Recommendation A-96-95 and that it had completed its efforts to evaluate terrain avoidance procedures. The FAA stated that, in January 1997, it developed and published the CFIT Education and Training Aid along with Boeing. The FAA also stated that, on February 25, 1997, it issued Change 2 to AC-120-51B Appendix 3, paragraph 2(1), to

Factual Information 111 Aircraft Accident Report recommend that CRM training in LOFT or Special Purpose Operational Training for flight crewmembers contain a CFIT scenario. According to the FAA, this paragraph recommends that the training should emphasize prevention through effective communication and decision behavior and the importance of immediate, decisive, and correct response to a ground proximity warning. On November 13, 1997, the Safety Board acknowledged the progress made by the FAA but noted that the FAA’s response did not indicate that the newly developed CFIT training program was mandatory, as urged by the recommendation. Pending further information from the FAA, Safety Recommendation A-96-95 was classified “Open— Acceptable Response.” On August 11, 1999, the FAA stated that it had initiated an NPRM proposing to mandate training in CFIT, including flight training in simulators and the ground proximity escape maneuver. The FAA indicated that the NPRM was expected to be published in December 2000. The Safety Board’s evaluation and classification of Safety Recommendation A-96-95 are discussed in section 2.8. Safety Recommendation A-96-102 asked the FAA to Require that all approach and navigation charts graphically present terrain information.163 On December 31, 1996, the FAA stated that it agreed with the intent of this recommendation. However, the FAA stated that it was not necessary to depict terrain on IFR en route low-altitude charts because the off-route obstruction clearance altitudes adequately presented terrain and obstruction clearance information. In addition, the FAA indicated that the Government/Industry Charting Forum, chaired by the FAA’s Air Traffic Service, was evaluating the possibility of adding terrain information (contour lines and shading) graphically on approach charts. On April 11, 1997, the Safety Board stated that, although the FAA’s action regarding approach charts was appropriate, the Board did not agree with the FAA that current off-route obstruction clearance altitudes adequately presented terrain and obstruction clearance information. The Board reiterated that the intent of this recommendation was to have terrain information graphically presented on all approach and navigation charts. On February 19, 1998, the FAA stated that the Task Group 31 from the Air Cartographic Committee (a Government interagency and aviation industry committee) was evaluating the possibility of adding contour lines and shading on the plan view 163 The Safety Board issued this recommendation because Jeppesen Sanderson was changing the portrayal of terrain on some, rather than all, of its charts. Specifically, Jeppesen was revising approach charts only if they displayed terrain that was above 2,000 feet within 6 miles of an airport; local area charts were being revised only if they displayed terrain that was more than 4,000 feet above the plan view of an airport.

Factual Information 112 Aircraft Accident Report portion of approach charts for terrain-impacted airports only. The FAA also stated its belief that the addition of contour lines and tinting to IFR en route charts has not been supported by users and industry personnel and that sufficient information on en route charts obviates the need for such changes. Further, the FAA stated that overlaying additional information into charts that already contained a considerable amount of information could diminish the clarity of existing information on those charts. On September 3, 1998, the Safety Board stated that the points the FAA raised with regard to adding information to en route charts were valid. However, the Board noted that these concerns did not apply to terminal navigation charts and approach charts. The Safety Board continued to believe that the FAA should do all it can to enhance pilots’ situational awareness regarding proximity to terrain and that adding readily interpretable terrain information to navigation charts would be an economical way to accomplish this goal. The Safety Board indicated that it would await FAA action regarding approach charts after the efforts of Task Group 31 were completed. Because the FAA appeared unwilling to require that terminal charts graphically portray terrain information to help prevent CFIT accidents, Safety Recommendation A-96-102 was classified “Open— Unacceptable Response.” On July 7, 1999, the FAA stated that it met with the Safety Board on March 12, 1999, to clarify the intent of this safety recommendation and discuss the issue of adding terrain contours to all charts. At this meeting, the FAA indicated that it would consider placing terrain contours only on en route area charts. According to the FAA, this plan was proposed in April 1999 at the Government/Industry Aeronautical Charting Forum, which endorsed the proposal. The FAA stated that it was developing funding requirements with the National Oceanic and Atmospheric Administration and that, pending funding approval, it would submit a requirements document to the Interagency Air Cartographic Committee to amend the chart specifications to add terrain contours to en route area charts. The FAA also stated that it was planning to add terrain contours on instrument approach procedure charts for terrain-impacted airports. On September 24, 1999, the Safety Board stated that, on the basis of the FAA’s commitment to consider adding terrain contours to en route area charts only, Safety Recommendation A-96-102 was classified “Open—Acceptable Alternate Response.” Safety Recommendation A-96-106 asked the FAA to Revise Advisory Circular 120-51B to include specific guidance on methods to effectively train pilots to recognize cues that indicate that they have not obtained situational awareness, and provide effective measures to obtain that awareness. On December 31, 1996, the FAA stated that it would fund a research project to determine cues that flight crewmembers could readily recognize to indicate situational awareness problems. According to the FAA, this project would focus on developing specific cues for situational awareness in automated cockpits. The FAA indicated that, as soon as this project was completed, it would revise AC 120-51B to include guidance on

Factual Information 113 Aircraft Accident Report training flight crews in cue recognition. On April 11, 1997, the Safety Board stated that it was waiting to evaluate the FAA’s revised version of AC 120-51B. On August 3, 1998, the FAA stated that the results of its research project were outlined in a report, titled Guidelines for Situation Awareness Training, which was published in February 1998. According to the FAA, the report included an overview, specific training tips, and sample training courses for use by the aviation community. The FAA indicated that it would incorporate guidance on cue recognition training for flight crewmembers in AC 120-51B. On November 2, 1998, the Safety Board restated that it would wait to evaluate the FAA’s revised version of AC 120-51B. On December 11, 1998, the FAA stated that, on October 30, 1998, it issued AC 120-51C, “Crew Resource Management Training,” a revision to AC 120-51B. The FAA stated that Appendix 3, “Appropriate CRM Training Topics,” paragraph 2(m), specifically addressed training for pilots in recognizing cues that indicate lack or loss of situational awareness in themselves and others and training in countermeasures to restore that awareness. According to the FAA, paragraph 2(m) reiterates that training should emphasize the importance of recognizing each pilot’s relative experience level, experience in specific duty positions, preparation level, planning level, normal communication style and level, overload state, and fatigue state. Further, the FAA stated that training should emphasize that improper procedures, adverse weather, and abnormal or malfunctioning equipment might reduce situation awareness. In addition, the FAA stated that AC 120-51B references the Guidelines for Situation Awareness Training report because of the AC’s expanded guidance on cues and countermeasures. On March 1, 1999, the Safety Board stated that the amendments to AC 120-51B, which resulted in the issuance of AC 120-51C, met the intent of this recommendation. Accordingly, Safety Recommendation A-96-106 was classified “Closed— Acceptable Action.” 1.18.3.5 Previous Controlled Flight Into Terrain Accidents Related to Nonprecision Instrument Approach Procedures As stated in section 1.18.3.2, accident data has shown that the chances of a CFIT accident occurring during a nonprecision approach is five times greater than during a precision approach. In addition to the CFIT events discussed previously (including the USAir flight 105 incident in Kansas City, Missouri, and the American Airlines flight 965 accident in Cali, Colombia) and in section 1.18.4.4 (American Airlines flight 1572 in East Granby, Connecticut), the Safety Board has investigated the following CFIT accidents that occurred while the airplane was on a nonprecision approach: On February 18, 1989, a Flying Tigers Boeing 747-200, operating as a cargo flight under 14 CFR Part 121, crashed while on an NDB approach to Subang International Airport in Kuala Lumpur, Malaysia. Night visual conditions prevailed around the airport at the time of the accident. All four airplane occupants were killed, and the airplane was destroyed. The investigation into this accident was being conducted by the Department of Civil Aviation of the Government of Malaysia with the assistance of the Safety Board.

Factual Information 114 Aircraft Accident Report On June 2, 1990, about 0937 Alaskan daylight time, Markair, Inc., flight 3087, a Boeing 737-2X6C, N670MA, operating under 14 CFR Part 121, crashed about 7 ½ miles short of runway 14 at Unalakleet, Alaska, while executing a localizer-only approach in IMC. One flight attendant received serious injuries; the captain, the first officer, and a flight attendant received minor injuries; and the aircraft was destroyed. The Safety Board determined that the probable cause of the accident was deficiencies in flight crew coordination, the crew’s failure to adequately prepare for and properly execute the localizer-only runway 14 nonprecision approach, and the crew’s subsequent premature descent.164 On April 3, 1996, a U.S. Air Force CT-43A (737-200) carrying the Secretary of Commerce, other Government officials, and a delegation of business executives crashed on a mountainside while on an NDB approach to Cilipi Airport in Croatia. All 35 people aboard the airplane were killed. The Safety Board provided technical assistance to the Air Force during its investigation.165 1.18.4 Industry Actions to Improve the Safety of Nonprecision Instrument Approaches Conducted by Air Carriers 1.18.4.1 Nonprecision Approach Procedures According to the Air Line Pilots Association (ALPA),166 limited data indicate that airline transport crews conduct only about one to three nonprecision approaches per year and practice these approaches in a simulator “just as infrequently.” Thus, ALPA concluded that the risk associated with this “inherently less safe type of approach” is compounded by the infrequency of flight crew exposure and practice. ALPA stated that most nonprecision approaches are presented in a series of step-down altitudes and that, although step-down altitudes may be satisfactory for light, slow, maneuverable aircraft, they are unacceptable for transport-category aircraft. ALPA further stated that these step-down altitudes are in fact directly contrary to the underlying concept of the stabilized approach because they require multiple power and pitch changes to be flown as charted. ALPA believed that approach charts and procedures should be modified to provide the information necessary to conduct a stabilized descent without explicit vertical guidance. The issue of nonprecision approaches flown by air carrier (primarily turbojet) airplanes has been debated, especially in light of the recent CFIT accidents that occurred during the execution of a nonprecision approach. ALPA stated that “all turbojet air carrier airports need to have a precision approach available at all times in the appropriate landing direction.” Further, ALPA believed that it is “problematic at best” for a “500,000 pound 164 National Transportation Safety Board. 1991. Controlled Flight Into Terrain, Markair Flight 3087, Boeing 737-2X6C, N670MA, Unalakleet, Alaska. Aircraft Accident Report NTSB/AAR-91/02. Washington, DC. 165 For more information, see the Air Force’s Accident Investigation Board Report, United States Air Force CT-43A [Boeing 737], 73-1149, 3 April 1996, at Dubrovnik, Croatia. 166 See Air Line Pilots Association Report on Accident Involving Korean Air Flight 801 at Agana, Guam, on August 6, 1997, dated June 24, 1998.

Factual Information 115 Aircraft Accident Report aircraft to transition from level flight (at MDA) and very high thrust settings, to a stabilized approach and touchdown in 15 to 20 seconds (the distance covered in one mile visibility at 180 knots)” because of the size of the aircraft and approach speeds at which the nonprecision approaches are flown. 1.18.4.2 Approach Chart Terrain Depiction According to testimony at the Safety Board’s public hearing by the Senior Corporate Vice President of Flight Information Technology and External Affairs for Jeppesen Sanderson, Inc., approach chart manufacturers use various methods to depict obstructions and high terrain on published approach charts. Some en route charts and the plan view of some terminal approach charts use contour lines and color shading to depict various height gradients with symbols for high obstructions. Other charts use broader colored areas for terrain depiction and specify a minimum sector altitude for obstacle clearance in segmented areas around the airport. In some instances, terrain may be depicted on the plan view of some approach charts but not on other charts published by the same manufacturer. Currently, no chart publisher depicts terrain or obstructions on the profile view, which depicts the inbound course descent profile from the IAF to the landing or MAP. Further, the FAA Terminal Instrument Procedures (TERPS) manual contains no requirement for a standardized format that chart manufacturers must adhere to when depicting terrain on an approach chart, except for the requirement to depict the height of certain obstructions. The Jeppesen Sanderson official testified that “the Agana ILS 6 Left approach did not have terrain [depicted on the chart]…because through the agreements that we’ve had with our airlines, seminars in the airline community, as well as a lot of the general aviation input, it is believed by Jeppesen that…there should be criteria because you don’t want terrain to be on all charts; you want it there when it’s significant.” The official added that, for Jeppesen to depict terrain on a chart, there needs to be at least one elevation that is 4,000 feet or greater above the airport in at least one plan view of the airport or, if there is one elevation that is 2,000 feet above the airport within 6 miles, then contour lines need to start at the nearest 1,000 feet to the airport elevation and appear at 1,000-foot intervals all the way up to the top altitude that is depicted. The Jeppesen official’s testimony discussed the difficulties of obtaining accurate worldwide terrain data through public sources. The official said that inaccurate information was one of several reasons for not providing terrain information on the charts. The official further stated that there are many sources for terrain information but that the information needs to be publicly available so that chart manufacturers can have ready access. The Chief Engineer of Flight Safety Systems at AlliedSignal, Inc., testified at the Safety Board public hearing about the acquisition and accuracy of terrain data. The official indicated that terrain data needs to be collected to build the database not only for chart manufacturers but also for companies that are incorporating such data into enhanced

Factual Information 116 Aircraft Accident Report GPWS or TAWS. The official also testified that some countries still consider terrain data to be a military secret. 1.18.4.3 Federal Aviation Administration Form 8260 FAA Form 8260 provides charting companies with information for publishing instrument procedures. This form includes data for the terminal area and final and missed approach standards. The manager of the FAA’s Western Flight Procedures Development Branch testified at the Safety Board’s public hearing that the FAA distributes approach procedures to industry user groups (including ALPA, the Air Transport Association, and the Aircraft Owners and Pilots Association) and airport operators for comment. The manager testified that the user groups receive information that describes the approach in words or numbers and does not depict the proposed published approach. According to ALPA’s submission, the information that the FAA releases “bears no resemblance to the final user product,” which “seriously hampers the ability to readily and effectively critique the proposed approach procedure.” 1.18.4.4 Previous Safety Board Recommendations Related to Approach Procedure Design On November 12, 1995, American Airlines flight 1572, a McDonnell Douglas MD-83, N566AA, collided with trees in East Granby, Connecticut, while on final approach to runway 15 at Bradley International Airport in Windsor Locks, Connecticut.167 The airplane then landed safely at the airport. Of the 78 airplane occupants, 1 passenger received minor injuries during the emergency evacuation. The Safety Board determined that the probable cause of this accident was the flight crew’s failure to maintain the required MDA until the required visual references identifiable with the runway were in sight. As a result of its investigation, the Board issued Safety Recommendations A-96-128, A-96-129, and A-96-131 through -133 on November 13, 1996. Safety Recommendation A-96-128 asked the FAA to Evaluate Terminal Instrument Procedures design criteria for nonprecision approaches to consider the incorporation of a constant rate or constant angle of descent to minimum descent altitude in lieu of step-down criteria. On February 24, 1997, the FAA stated that it would begin implementation of instrument approach development proposals in late 1997. On June 26, 1997, the Safety Board stated that it was waiting to review the pending FAA proposals in response to this recommendation. On January 28, 1998, the FAA stated that it developed draft criteria to provide a constant angle of descent for aircraft with area and vertical navigation and that these criteria were incorporated into a draft order, which was being coordinated with 167 National Transportation Safety Board. 1996. Collision With Trees on Final Approach, American Airlines Flight 1572, McDonnell Douglas MD-83, N566AA, East Granby, Connecticut, November 12, 1995. Aircraft Accident Report NTSB/AAR-96/05. Washington, DC.

Factual Information 117 Aircraft Accident Report industry. The FAA anticipated that the final order would be published in June 1998. On April 15, 1998, the Safety Board stated that it would wait to review the final order. On August 7, 1998, the FAA stated that, on February 13, 1998, it issued a revision (Change 17) to Order 8260.3B, “United States Standard Terminal Instrument Procedures (TERPS),” which requires descent angles and descent gradients to be computed for nonprecision approaches by the FAA and subsequently depicted on aeronautical charts supplied by the National Ocean Service. The FAA indicated that the angles and descent gradients would be integrated during biennial reviews of each instrument approach procedure. According to the FAA, Change 17 states that the optimum gradient on the final approach segment is 318 feet per nautical mile, which approximates a 3° descent angle and allows VNAV-equipped aircraft to perform a stabilized descent on final approach using a computed VNAV path. Depiction of a descent gradient allows pilots to determine a target rate of descent to be maintained to fly a stabilized final approach path. Change 17 also addresses the elimination of a step-down fix through manipulation of either the FAF altitude/location or the step-down fix altitude/location. When use of the step-down fix cannot be avoided, the descent angles are provided for the portion of the final segment from the step-down fix to the runway threshold. Additionally, the FAA stated that, on May 26, 1998, it issued Order 8260.47, “Barometric Vertical Navigation (VNAV) Instrument Procedures Development.” According to the FAA, this order contains criteria for design of stand-alone area navigation approaches using barometric VNAV guidance on the final approach segment. Approaches so designed are to specify the vertical path angle from the FAF to the runway threshold. In addition, the MDA of a conventional nonprecision approach has been replaced by a decision altitude. The FAA stated that the use of a decision altitude was authorized because an allowance has been made for height loss during a missed approach and an obstacle assessment has been conducted of the visual segment (runway threshold to decision altitude point) and found to be clear of obstructions. Because the new standards met the intent of Safety Recommendation A-96-128, it was classified “Closed—Acceptable Action” on December 8, 1998. Safety Recommendation A-96-129 asked the FAA to Examine and make more effective the coordinating efforts of the flight inspection program and the procedures development program, with emphasis on ensuring quality control during the development, amendment, and flight inspection process for instrument approaches. On February 24, 1997, the FAA said that it had established a test program to ensure interaction between the flight inspection program and the procedures development program. On June 11, 1997, the FAA stated that it completed its first test program to ensure interaction between the flight inspection program and the procedures development program. According to the FAA, the test program involved the placement of a liaison position (effective March 16, 1997) in the flight inspection central operations office to respond to queries and ensure resolution of all issues. The FAA added that the individual

Factual Information 118 Aircraft Accident Report in this position served as a focal point for the two offices to correct discrepancies found during flight, enhanced the interaction between the offices, conveyed information to flight inspection crews, and ensured standardization. On September 8, 1997, the Safety Board stated that the actions taken to effectively coordinate the functions of the procedures development and flight inspection programs had satisfied the intent of the recommendation. Therefore, Safety Recommendation A-96-129 was classified “Closed—Acceptable Action.” Safety Recommendation A-96-131 asked the FAA to Include a more comprehensive set of guidelines concerning precipitous terrain adjustments in the Terminal Instrument Procedures (FAA Order 8260.3B) Handbook, clarifying the definition of precipitous terrain and establishing defined criteria for addressing the potential effect of such terrain. On January 28, 1998, the FAA stated that it was developing a plan to revise the guidelines concerning precipitous terrain adjustments currently contained in the TERPS handbook. The FAA noted that it received appropriate funding and negotiated a contract with the National Center for Atmospheric Research to develop a plan to address this recommendation. The FAA expected that it would be provided with the findings of the center’s effort by the end of fiscal year 1998. On April 15, 1998, the Safety Board indicated that it would await further information from the FAA. On June 17, 1999, the FAA stated that it was continuing its efforts to revise the guidelines concerning precipitous terrain adjustments currently contained in the TERPS Handbook. According to the FAA, the National Center for Atmospheric Research developed a prototype software package that examines digital terrain elevation data from the Defense Mapping Agency’s terrain elevation database. This software uses weighted parameters to determine if the terrain underlying the primary, secondary, and buffer area approach segments are high, steep, or rough enough to be considered precipitous. The output of this software specifies the minimum adjustment to the required obstacle clearance for precipitous terrain in each segment. The FAA indicated that the TERPS Handbook would be revised to require the use of this software in identifying precipitous terrain and determining the minimum required adjustment for such terrain. On August 20, 1999, the Safety Board stated that, pending final modification of the TERPS Handbook, Safety Recommendation A-96-131 was classified “Open—Acceptable Response.” Safety Recommendation A-96-132 asked the FAA to Review and evaluate the appropriateness of the let-down altitudes for all nonprecision approaches that have significant terrain features along the approach course between the initial approach fix and the runway. Airline safety departments and pilot labor organizations, such as the Allied Pilots Association and the Air Line Pilots Association, should be consulted as part of this review.

Factual Information 119 Aircraft Accident Report On December 30, 1997, the FAA said that it established a mandatory review for significant terrain features as part of its biennial review process. The FAA stated that Order 8260.19C, “Flight Procedures and Airspace,” section 8, includes procedures for reviews of instrument procedures, which are to be conducted every 2 years or more frequently when deemed necessary. According to the FAA, the reviews are to be conducted in accordance with Order 8260.3B, “United States Standard Terminal Instrument Procedures (TERPS),” chapter 3, “Takeoff and Landing Minimums.” Paragraph 323a, “Precipitous Terrain,” states that “when procedures are designed for use in areas characterized by precipitous terrain, in or outside of designated mountainous area, consideration must be given to induced altimeter errors and pilot control problems which result when winds of 20 knots or more move over such terrain.” The paragraph also states that, for areas in which these conditions are known to exist, the required obstacle clearance in the final approach segment should be increased. The FAA added that Order 8260.19C stated that user comments should be solicited to obtain the best available local information to ensure that requirements for obstacle clearance, navigational guidance, safety, and practicality were met. The FAA also indicated that, on June 2, 1997, it reemphasized the procedures to be followed when conducting a periodic review of an instrument procedure. According to the FAA, the procedures require that obstacles, including terrain, be considered as potential precipitous terrain when developing or amending a standard instrument approach procedure and that these obstacles are to be evaluated and appropriate adjustments are to be made according to existing FAA orders and guidelines. The procedures also require that discussion and coordination with the users, airline safety departments, and pilot labor organizations are included in the review process. On April 7, 1998, the Safety Board noted that the FAA had established a mandatory review for significant terrain features as part of its biennial review process. The Board also noted that the FAA had reemphasized that these procedures be followed when conducting a periodic review of an instrument procedure. Because these actions met the intent of Safety Recommendation A-96-132, it was classified “Closed—Acceptable Action.” Safety Recommendation A-96-133 asked the FAA to Solicit and record user comments about difficulties encountered in flying a particular approach to evaluate approach design accurately. On February 24, 1997, the FAA stated that it would “invite airspace users to comment on dangerous approaches.” On June 11, 1997, the FAA said that it had sent letters to various organizations, including the Allied Pilots Association, ALPA, the Air Transport Association, and the Aircraft Owners and Pilots Association, to request comments and concerns from their members regarding instrument flight procedures. On September 8, 1997, the Safety Board stated that it had received copies of the letters from the industry organizations that had responded to the FAA’s letter. Because the

Factual Information 120 Aircraft Accident Report FAA’s effort met the intent of Safety Recommendation A-96-133, it was classified “Closed—Acceptable Action.” 1.18.5 Flight Crew Decision-making 1.18.5.1 Safety Board Study of Flight Crew Involvement in Major Accidents In a 1994 safety study,168 the Safety Board examined the operating environments and errors made by flight crewmembers in 37 major accidents between 1978 and 1990. The safety issues examined in the report included the performance of flight crews when the captain was the PF, the performance of the PNF in monitoring and challenging errors made by the PF, and the adequacy of CRM training programs. The study concluded that the captain was the PF in more than 80 percent of the 37 accidents reviewed. This result was significant because U.S. air carrier flights during the study’s time frame were divided about equally between those flown by the captain and those flown by the first officer. The Safety Board identified 302 flight crew errors in the 37 accidents; the median number of errors per accident was 7. Of the total number of errors, 232 were considered primary errors, and 70 were considered secondary errors. The primary error categories identified by the Safety Board included aircraft handling, communication, navigational, procedural (for example, not conducting or completing required checklists or not following prescribed checklist procedures), resource management, situational awareness (for example, controlling the airplane at an incorrect target altitude), systems operation, and tactical decision (for example, improper decision-making, failing to change a course of action in response to a signal to do so, or failing to heed warnings or alerts that suggest a change in the course of actions). Secondary errors resulted from the failure of a crewmember to monitor or challenge a primary error made by the other crewmember. Table 4 shows the distribution of the 302 errors identified in the 37 accidents by type of error. The Safety Board’s study determined that procedural, tactical decision, and resource management errors were largely errors of omission and that navigational and most of the aircraft handling, communication, and systems operation errors were errors of commission. Of the 232 primary errors identified, 123 (53 percent) were errors of omission, and 109 (47 percent) were errors of commission. The safety study also determined that captains were responsible for 168 of the 302 identified errors. Of the 168 errors made by captains, 49 (29 percent) were tactical decision errors, the most common error type attributed to captains. The 49 tactical decision errors made by captains accounted for 96 percent of the 51 tactical decision errors made by all crewmembers, which is consistent with the captain’s ultimate responsibility for decisions. The study also found that procedural (23 percent) and aircraft 168 See National Transportation Safety Board. 1994. A Review of Flightcrew-Involved Major Accidents of U.S. Air Carriers, 1978 Through 1990. Safety Study NTSB/SS-94/01. Washington, DC.

Factual Information 121 Aircraft Accident Report handling (20 percent) were the next most common error types made by captains. The aircraft handling errors made by captains accounted for 33 (72 percent) of the 46 aircraft handling errors made by all crewmembers, which is consistent with the captain conducting the PF duties on more than 80 percent of the accident flights reviewed in the study. Further, the study stated that a common pattern in 17 of the 37 accidents was a tactical decision error by the captain (more than one-half of which constituted a failure to initiate a required action) followed by the first officer’s failure to challenge the captain’s decision. The study also concluded that, of the 49 tactical decision errors made by captains, 44 (90 percent) were made while the captain was serving as the PF and that 26 (59 percent) of these errors were errors of omission. Thus, the most common tactical decision error was the failure of a captain serving as the PF to take action when the situation demanded change. In addition, of the 26 tactical decision errors made by captains that were errors of omission, 16 (62 percent) involved the captain’s failure to execute a go- around during the approach. These 16 errors were made during 10 different accident sequences. Of the 16 failures to execute a go-around, 8 involved an unstabilized approach. The study found that the 70 monitoring/challenging errors committed by flight crewmembers occurred in 31 (84 percent) of the 37 accidents reviewed in the study and that most of these errors played very important roles in the accidents. The study concluded Table 4. Distribution of errors identified in the 37 accidents reviewed in the Safety Board’s 1994 safety study. Type of error Number Percent Number of accidents Primary error Aircraft handling 46 15.2 26 Communication 13 4.3 5 Navigational 6 2.0 3 Procedural 73 24.2 29 Resource management 11 3.6 9 Situational awareness 19 6.3 12 Systems operation 13 4.3 10 Tactical decision 51 16.9 25 Secondary error Monitoring/challenging 70 23.2 31

Factual Information 122 Aircraft Accident Report that the highest percentage of the unmonitored/unchallenged errors were tactical decision errors (40 percent). In addition, the study found that, of the 15 accidents for which information was available, 11 (73 percent) occurred during the first duty day together for the captain and first officer. Of the 16 accidents for which data were available, 7 (44 percent) occurred during the crewmembers’ first flight together. According to the study, these rates are substantially higher than the percentage of crews who would be expected to be paired for the first time on any given flight or day. Finally, the study examined the effect of the length of time since awakening (TSA) on the errors committed by flight crewmembers in the accident sequence. The performances of flight crews in which both the captain and the first officer had been awake a long time (average TSA length, 13.6 hours) were compared with flight crews in which both the captain and the first officer had been awake a short time (average TSA length, 5.3 hours). The Safety Board found that both the number and type of errors made by the flight crews varied significantly according to the TSA length. Specifically, high TSA crews made an average of 40 percent more errors (almost all of which were errors of omission) than low TSA crews. High TSA crews made significantly more procedural errors and tactical decision errors than low TSA crews. These results suggested that the degraded performance by high TSA crews tended to involve ineffective decision-making (such as failing to perform a missed approach) and procedural slips (such as not making altitude awareness callouts) rather than a deterioration of aircraft handling skill. Also, the number and types of errors made by the flight crews varied according to the TSA length before the accident. The median TSA periods were quite high: 12 hours for captains and 11 hours for first officers. Those pilots who had been awake longer than the median TSA length for their crew position made more decision-making errors and procedural errors than pilots who had been awake for less time.169 1.18.5.2 Previous Safety Recommendations on Flight Crew Decision-making On the basis of the findings of its safety study, the Safety Board issued Safety Recommendations A-94-3 and A-94-4 on February 3, 1994. Safety Recommendation A-94-3 asked the FAA to Require U.S. air carriers operating under 14 CFR Part 121 to provide, for flight crews not covered by the Advanced Qualification Program, line operational simulation training during each initial or upgrade qualification into the flight engineer, first officer, and captain position that (1) allows flight crews to practice, under realistic conditions, nonflying pilot functions, including monitoring and challenging errors made by other crewmembers; (2) attunes flight crews to the 169 For a discussion of previous accidents in which the Safety Board determined that fatigue was a factor, see section 1.18.6.

Factual Information 123 Aircraft Accident Report hazards of tactical decision errors that are errors of omission, especially when those errors are not challenged; and (3) includes practice in monitoring and challenging errors during taxi operations, specifically with respect to minimizing procedural errors involving inadequately performed checklists. On April 26, 1994, the FAA stated that it was amending AC 120-51A, “Crew Resource Management,” to emphasize the areas detailed in the recommendation. On July 6, 1994, the Safety Board noted that including the recommendation’s material in an AC would be an acceptable alternative to regulatory change. However, on May 8, 1995, the Safety Board expressed disappointment that the revised AC 120-51B (issued on January 3, 1995) made no specific reference to practicing PNF procedures, such as monitoring and challenging the errors of the other pilots, during line-oriented simulation training. Likewise, the AC contained no specific references to line-oriented simulation training in the areas of monitoring and challenging tactical decision errors or inadequately performed taxi checklist procedures. On September 8, 1995, the FAA issued a revision (Change 2) to AC 120-51B. On January 16, 1996, the Safety Board stated that the revised AC’s reference to line operational simulation was responsive to all aspects of Safety Recommendation A-94-3. The provisions for PNF functions, monitoring and challenging of errors made by other crewmembers, tactical decision errors that are errors of omission, and errors made during taxi operations would achieve the Board’s objectives as an alternative to the regulatory change that was originally proposed. Therefore, Safety Recommendation A-94-3 was classified “Closed—Acceptable Alternate Action.” Safety Recommendation A-94-4 asked the FAA to Require that U.S. air carriers operating under 14 CFR Part 121 structure their initial operating experience programs to include (1) training for check airmen in enhancing the monitoring and challenging functions of captains and first officers; (2) sufficient experience for new first officers in performing the nonflying pilot role to establish a positive attitude toward monitoring and challenging errors made by the flying pilot; and (3) experience (during initial operating experience and annual line checks) for captains in giving and receiving challenges of errors. On April 26, 1994, the FAA stated that its actions in response to Safety Recommendation A-94-3 addressed the issues referenced in this recommendation. On July 6, 1994, the Safety Board reiterated that one intent of Safety Recommendation A-94-4 was for air carriers to provide crewmembers undergoing initial operational experience (IOE) with experience specifically in the PNF role. The Safety Board believed that the FAA should, at the very least, provide guidance to air carriers on this issue in the form of an AC. On February 28, 1995, the FAA informed the Safety Board that, on January 3, 1995, AC 120-51B, “Crew Resource Management,” was issued to provide emphasis for the PNF to monitor and challenge errors and for the PF to give and receive challenges of errors. On April 24, 1995, the Safety Board expressed its disappointment that AC 120-51B

Factual Information 124 Aircraft Accident Report made no reference to the structure of IOE, PNF experience in monitoring and challenging errors during IOE and LOFT, or experience for captains in giving and receiving challenges of errors. On June 16, 1995, the FAA stated that, on April 21, 1995, it had issued a final rule to amend the pilot qualification requirements for air carrier and commercial operators. According to the FAA, the final rule requires that second-in-command pilots obtain operating experience while performing the duties of a second-in-command under the supervision of a qualified pilot check airman. Additionally, the FAA stated that it was revising AC 120-51B to provide emphasis on the role of the PNF in monitoring and challenging errors and for captains to gain experience in giving and receiving challenges of errors. The FAA indicated that the revisions to the AC would emphasize the training of check airmen so that they would be prepared to enhance the monitoring and challenging functions of captains and first officers. On August 29, 1995, the Safety Board stated that it was pleased that the FAA had issued a final rule that required air carriers to provide newly qualified second-in-command pilots with IOE while actually performing the duties of, rather than while observing, a second-in-command pilot. The Board was also pleased that the FAA was revising AC-120-51B. The Board believed that check airmen who receive training in enhancing the monitoring and challenging functions of captains and first officers would be able to provide more effective operating experience for newly qualified pilots if air carrier IOE programs ensured that pilots receive sufficient experience performing PNF functions while under check airman supervision. On November 17, 1995, the FAA informed the Safety Board that it had revised AC-120B. On January 16, 1996, the Safety Board stated that the revised AC’s reference to training for check airmen in methods that could be used to enhance the monitoring and challenging function of captains and first officers was responsive to Safety Recommendation A-94-4 because the check airmen would apply their CRM skills during IOE for new captains and first officers. Because the FAA’s revisions to AC 120-51B satisfied the intent of Safety Recommendation A-94-4, it was classified “Closed— Acceptable Alternate Action.” 1.18.5.3 National Aeronautics and Space Administration’s Flight Crew Decision-making Study Researchers at the National Aeronautics and Space Administration’s (NASA) Ames Research Center conducted a study that examined the Safety Board’s findings in its 1994 safety study (see section 1.18.5.1). The purpose of the NASA study was to analyze the accident data to identify any contributing factors such as “ambiguous dynamic conditions and organizational and socially-induced goal conflicts.”170 170 Orasanu, Judith, Martin, Lynne, and Davison, Jeannie. Errors in Aviation Decision Making: Bad Decisions or Bad Luck? NASA Ames Research Center, Moffett Field, California. Presented to the Fourth Conference on Naturalistic Decision Making, Warrenton, Virginia, May 29-31, 1998.

Factual Information 125 Aircraft Accident Report The NASA researchers reexamined the 37 accidents included in the safety study to determine the most common decision errors and any themes or patterns in the context within which the errors occurred. NASA found that the most common decision errors occurred when the flight crew decided to “continue with the original plan of action in the face of cues that suggested changing the course of action.” The NASA study stated: Clearly, more cognitive effort is needed to revise one’s understanding of a situation or to consider a new course of action than sticking with the original plan whose details have already been worked out…. It appears that evidence must be unambiguous and of sufficient weight to prompt a change of plan. With regard to ambiguity and its effect on situation assessment and decision- making, the NASA study stated: Cues that signal a problem are not always clear-cut. Conditions can deteriorate gradually, and the decision maker’s situation assessment may not keep pace…a recurring problem is that pilots are not likely to question their interpretation of a situation even if it is in error. Ambiguous cues may permit multiple interpretations. If this ambiguity is not recognized, the crew may be confident that they have correctly interpreted the problem. Even if the ambiguity is recognized, a substantial weight of evidence may be needed to change the plan being executed. The study noted that stress may limit the pilot’s ability to properly evaluate the situation: Reaching decision…requires projection and evaluation of the consequences of the various options. If pilots are under stress, they may not do the required evaluations.... Under stress, decision makers often fall back on their most familiar responses, which may not be appropriate to the current situation. Further, the NASA study determined that organizational and social pressures may contribute to the high incidence of “plan continuation errors” by creating goal conflicts, which may result in decision errors in the face of ambiguous cues and high-risk situations. The study noted that organizational and social factors that have the potential to create goal conflicts with safety include pressure for on-time arrival rates, fuel economy, and avoidance of diversions to reduce passenger inconvenience. The NASA study concluded that, to reduce pressures on pilots, operators “must be willing to stand behind their pilots who take a safe course of action rather than a riskier one, even if there is a cost associated.” The study noted that integrated flight displays that present up-to-date information on dynamic variables, such as weather and traffic, could reduce the ambiguity of events flight crews might encounter and that training to help flight crews develop “strategies for choosing a course of action” would be beneficial.

Factual Information 126 Aircraft Accident Report 1.18.6 Previous Fatigue-Related Accidents The Safety Board has investigated several accidents in which fatigue was either the cause or a contributing factor. A discussion of two such accidents follows. Continental Express Jet Link Flight 2733 On April 29, 1993, Continental Airlines (d.b.a. Continental Express) Jet Link flight 2733, an Embraer EMB-120RT, N24706, crashed at Pine Bluff, Arkansas, during a forced landing and runway overrun at a closed airport.171 The flight was a scheduled 14 CFR 135 operation from Little Rock, Arkansas, to Houston, Texas. The 2 flight crewmembers and 15 passengers were uninjured, and the flight attendant and 12 passengers received minor injuries. The accident occurred on the third day of a 3-day trip sequence, and the accident flight was the seventh and last flight of the day. As the airplane was climbing, the captain, who was the PF, increased pitch so that the flight attendant could begin cabin service. The autoflight was set in pitch and heading modes, contrary to company policy. The airplane stalled in IMC at 17,400 feet. Initial recovery was at 6,700 feet. Because of an improper recovery procedure, a second stall occurred, and recovery was at 5,500 feet. The left propeller shed three blades, the left engine cowling separated, and the left engine was shut down in descent. Level flight could not be maintained, and a forced landing was made. The captain overshot the final turn because of controllability problems, and the airplane landed fast with 1,880 feet of wet runway remaining. The airplane hydroplaned off the runway and received additional damage. No preaccident malfunction was found. The Safety Board’s review of the captain's schedule revealed that the first day of the trip involved 9.5 hours of duty time followed by 8.5 hours of rest time (a reduced rest period). The second day of the trip involved 3.8 hours of duty time. The captain was off duty at 1130 but did not go to sleep until between midnight and 0030.172 On the third day of the trip, the captain awoke about 0500 for an early duty time. At the time of the accident, the captain had been awake for about 11 hours. The first officer’s flight, duty, and crew rest schedules were the same as that of the captain for the 3-day trip sequence. The first officer went to bed between 2300 and midnight on the night before the accident and awoke about 0430 on the day of the accident. The first officer had also been awake about 11 hours at the time of the accident. The Safety Board determined that the probable cause of the accident was the captain’s failure to maintain professional cockpit discipline, his consequent inattention to flight instruments and ice accretion, and his selection of an improper autoflight vertical mode, all of which led to an aerodynamic stall, loss of control, and a forced landing. 171 National Transportation Safety Board. 1994. In-flight Loss of Control, Leading to Forced Landing and Runway Overrun, Continental Express, Inc., Embraer EMB-120RT, N24706, Pine Bluff, Arkansas, April 29, 1993. Aircraft Accident Report NTSB/AAR-94/02/SUM. Washington, DC. 172 All times for this accident are central standard time, based on a 24-hour clock.

Factual Information 127 Aircraft Accident Report A factor contributing to the accident was fatigue induced by the flight crew’s failure to properly manage provided rest periods.173 American International Airways Flight 808 On August 18, 1993, American International Airways (d.b.a. Connie Kalitta Services, Inc.) flight 808, a Douglas DC-8-61, N814CK, was on a nonscheduled 14 CFR Part 121 operation when it crashed in at the U.S. Naval Air Station at Guantanamo Bay, Cuba.174 The cargo airplane collided with level terrain approximately ¼ mile from the approach end of runway 10 at Leeward Point Airfield after the captain lost control of the airplane. The airplane was destroyed by impact forces and a postcrash fire, and the three flight crew members—the only occupants aboard the airplane—received serious injuries. The cargo airplane was on the last leg of a flight sequence that day from Atlanta, Georgia, to Norfolk, Virginia, and then Guantanamo Bay. The flight crew had been on duty about 18 hours and had flown approximately 9 hours.175 The captain did not recognize deteriorating flightpath and airspeed conditions because of his preoccupation with locating a strobe light176 on the ground. The flight engineer made repeated callouts regarding slow airspeed conditions. The captain initiated a turn on final approach at an airspeed below the calculated approach speed of 147 knots and less than 1,000 feet from the shoreline, and the captain allowed bank angles in excess of 50° to develop. The stall warning stickshaker activated 7 seconds before impact and 5 seconds before the airplane reached stall speed. No evidence indicated that the captain attempted to take proper corrective action at the onset of the stickshaker. The Safety Board concluded that the substandard performance by this experienced pilot may have reflected the debilitating influences of fatigue. In its report on this accident, the Safety Board stated that three background factors are commonly examined for evidence related to fatigue: cumulative sleep loss, continuous hours of wakefulness, and time of day. The flight crew had received limited sleep in the 48 hours before the accident because of flight and duty time. Also, at the time of the accident, the captain had been awake for 23.5 hours, the first officer for 19 hours, and the flight engineer for 21 hours. In addition, the accident occurred about 1656 eastern daylight time (based on a 24-hour clock), at the end of one of the two low periods in a person’s circadian rhythm. The Board also considered the captain’s self-report (for example, his report of 173 Human fatigue in transport operations was listed as one of the Safety Board’s May 1999 Most Wanted Transportation Safety Improvements. 174 National Transportation Safety Board. 1994. Uncontrolled Collision With Terrain, American International Airways Flight 808, Douglas DC-8-61, N814CK, U.S. Naval Air Station, Guantanamo Bay, Cuba, August 18, 1993. Aircraft Accident Report NTSB/AAR-94/04. Washington, DC. 175 At the public hearing on this accident, the chief crew scheduler for American International Airways testified that this flight assignment would have resulted in an accumulated flight time of 12 hours, which was within the company’s “24-hour crew day policy.” 176 The strobe light was to be used as visual reference during the approach. The flight crew was not advised, however, that the strobe light was inoperative.

Factual Information 128 Aircraft Accident Report feeling “lethargic and indifferent” in the last period before the accident) in evaluating whether fatigue was present. The Safety Board determined that the probable cause of the accident was the impaired judgment, decision-making, and flying abilities of the captain and the other flight crewmembers because of the effects of fatigue; the captain’s failure to properly assess the conditions for landing and maintaining vigilant situational awareness of the airplane while maneuvering onto final approach; his failure to prevent the loss of airspeed and avoid a stall while in the steep bank turn; and his failure to execute immediate action to recover from a stall. Additional factors contributing to the cause of the accident included the inadequacy of the flight and duty time regulations applied to 14 CFR Part 121 supplemental air carriers, international operations, and the circumstances that resulted in the extended flight and duty hours and fatigue of the flight crewmembers. 1.18.6.1 Previous Safety Recommendations Regarding Fatigue On May 17, 1999, the Safety Board adopted a safety report entitled Evaluation of U.S. Department of Transportation Efforts in the 1990s to Address Operator Fatigue.177 In its report, the Board noted that in 1989 it issued three recommendations to the DOT addressing needed research, education, and revisions to hours-of-service regulations.178 The Board further noted that, since that time, it had issued more than 70 additional recommendations aimed at reducing the incidence of fatigue-related accidents. The Board stated that, even though the DOT and modal administrations had responded positively to the recommendations addressing research and education, little action had occurred with respect to revising the hours-of-service regulations. The safety report discussed the activities and efforts by the DOT and the modal administrations to address operator fatigue and the resulting progress that has been made over the past 10 years to implement the actions called for in the Safety Board’s fatigue- related recommendations. The report also provided background information on current hours-of-service regulations, fatigue, and the effects of fatigue on transportation safety. As a result of its findings, the Safety Board issued Safety Recommendations I-99-1 and A-99-45. Safety Recommendation I-99-1 asked the DOT to Require the modal administrations to modify the appropriate Codes of Federal Regulations to establish scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and 177 National Transportation Safety Board. 1999. Evaluation of U.S. Department of Transportation Efforts in the 1990s to Address Operator Fatigue. Safety Report NTSB/SR-99/01. Washington, DC. 178 Safety Recommendation A-89-1 asked the DOT to expedite a coordinated research program on the effects of fatigue, sleepiness, sleep disorders, and circadian factors on transportation system safety. Safety Recommendation A-89-2 asked the DOT to develop and disseminate educational material for transportation industry personnel and management regarding shift work; work and rest schedules; and proper regimens of health, diet, and rest. Safety Recommendation A-89-3 asked the DOT to review and upgrade regulations governing hours of service for all transportation modes to ensure that they are consistent and that they incorporate the results of the latest research on fatigue and sleep issues.

Factual Information 129 Aircraft Accident Report consider circadian rhythms and human sleep and rest requirements. Seek Congressional authority, if necessary, for the modal administrations to establish these regulations.179 Safety Recommendation A-99-45 asked the FAA to Establish within 2 years scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements. On July 15, 1999, the FAA indicated that it agreed with the intent of Safety Recommendation A-99-45 and stated that, on December 11, 1998, it had issued NPRM 95-18, which proposed amending existing regulations to establish one set of duty period limitations, flight time limitations, and rest requirements for flight crewmembers engaged in air transportation. The FAA stated that the NPRM considered scientific data from studies conducted by NASA relating to flight crewmember duty periods, flight times, and rest and that Safety Recommendation A-99-45 would be included in this rulemaking project. The FAA further indicated that its Aviation Rulemaking Advisory Committee was tasked to review reserve issues related to the NPRM but was unable to agree on a recommendation. The FAA indicated that it was conducting a risk assessment to determine the probability of preventing future incidents related to fatigue and did not know when a supplemental NPRM would be issued. However, the FAA stated that, in the interim, it published a notice on June 15, 1999, indicating its intent to enforce the regulations concerning flight time limitations and rest requirements. At an October 7, 1999, meeting with the Safety Board’s Chairman, the FAA Administrator indicated that a final rule would not be issued within the next 2 years. 1.18.7 Flight Data Recorder Documentation A digital flight data recorder (DFDR) records values for parameters related to the operation of an airplane (for example, altitude, airspeed, and heading). The values are recorded in a serial binary digital data stream that must be converted either to engineering units or discrete states. The arrangement of the recorded values often varies among DFDR systems; consequently, accurate conversion of the recorded values to their corresponding engineering units or discrete states can be accomplished only when the configuration of the data has been thoroughly documented. 1.18.7.1 Previous Safety Board Recommendations on Flight Data Recorder Parameter Verification and Documentation In the early 1970s, the Safety Board began issuing safety recommendations to improve FDR parameter verification and documentation. In 1991, the Safety Board issued two safety recommendations (A-91-23 and -24) to the FAA for developing a permanent 179 As of November 1999, the Safety Board had not received a response on this recommendation from the DOT.

Factual Information 130 Aircraft Accident Report policy for FDR maintenance and record-keeping. In 1997, after a series of accidents that involved problems with extracting data from retrofitted FDRs, the Safety Board issued a safety recommendation (A-97-30) that asked the FAA to publish an AC addressing the certification and maintenance of FDRs.180 Safety Recommendation A-91-23 asked the FAA to Issue permanent policy and guidance material for the continued airworthiness of digital flight data recorder systems, stating that the make and model of the flight data recorder and the make and model of the flight data acquisition unit, if installed, must be maintained as part of each aircraft’s records, as well as at least the following information for each parameter recorded: • Location of parameter word (2 through 64 or 128). • Assigned bits (1 through 12). • Range (in engineering units when applicable). • Sign convention (for example, trailing edge up = +). • Type sensor (for example, synchro or low-level DC). • Accuracy limits (sensor input). • FAA requirement (that is, mandatory or not mandatory). • Subframe/superframe assignment: Documentation for engineering unit conversion. • General equation: Provide A0, A1, A2, and A3 for the equation Y = A0 + A1X + A2X2 + A3X3, where Y = output in engineering units and X = input in decimal or converted counts. • Nonlinear parameters: Provide a sufficient number of data samples (engineering units versus recorded decimal counts) to develop a conversion algorithm that will accurately define the full range of the parameter. • Discrete parameters: Status (that is, 1 = on, 0 = off). Safety Recommendation A-91-24 asked the FAA to Require operators to maintain current information for each unique digital flight data recorder configuration in its inventory using a single, universally adopted format, such as that described in the standard being developed by Aeronautical Radio, Inc. 180 The Board encountered problems extracting data from retrofitted FDRs recovered from the following accidents and incidents: Express One, Boeing 727, Orebro, Sweden, November 12, 1996; Millon Air, Boeing 707, Manta, Ecuador, October 22, 1996; ValuJet, DC-9, Miami, Florida, May 11, 1996; ValuJet, DC-9, Savannah, Georgia, February 28, 1996; ValuJet, DC-9, Nashville, Tennessee, February 1, 1996; ValuJet, DC-9, Nashville, Tennessee, January 7, 1996; Millon Air, DC-8, Guatemala City, Guatemala, April 28, 1995; and Air Transport International, DC-8, Kansas City, Missouri, February 16, 1995. The lack of adequate documentation of these FDR systems prevented accurate and complete readouts of the FDR data and, consequently, a clear understanding of the circumstances surrounding the accidents.

Factual Information 131 Aircraft Accident Report On May 9, 1991, the FAA stated that it was reviewing these safety recommendations. On August 1, 1991, the Safety Board stated that it was disappointed that the FAA failed to include any timetable for the completion of the review because untimely or missing DFDR documentation was adversely affecting ongoing investigations. The Board reemphasized its commitment to these recommendations, stating that it would continue to work with the FAA and the aviation industry to implement the recommendations. On December 18, 1991, the FAA stated that it was planning to develop an AC to address the installation and maintenance of DFDRs and flight data acquisition units (FDAU). The FAA indicated that the AC would reference the appropriate regulatory requirements and contain the universal documentation format for each DFDR aircraft configuration and installation. The FAA further indicated that the baseline documents for the AC would be the universal format being developed by Aeronautical Radio, Inc., and the Board’s proposed FDR configuration documentation standard. On January 28, 1992, the Safety Board stated that it remained encouraged by the FAA’s support for these safety recommendations. The Board believed that the FAA’s plan to develop an AC that addresses the installation and maintenance of DFDR systems and references a universal documentation standard was a step in the right direction. However, the Board believed that the AC needed to be supplemented with permanent policy and guidance material so that FAA inspectors would require that the AC be implemented. On April 22, 1994, the Safety Board stated that, in early 1993, FAA staff had indicated that the proposed AC had not been developed because the FAA was waiting for Aeronautical Radio, Inc., to publish the proposed documentation standard. Because Aeronautical Radio was unable to commit the resources needed to publish the proposed standard, the FAA proposed that the Board draft an AC that incorporated the draft Aeronautical Radio documentation standard. Safety Board and FAA staffs subsequently discussed and agreed on the principal elements of a draft AC based on the draft Aeronautical Radio documentation standards. On October 18, 1993, the Board provided a draft of the AC and DFDR documentation standards. However, the FAA made no progress toward implementing Safety Recommendations A-91-23 and -24, even with the Board’s draft AC. The Safety Board continued to believe that the actions requested in these recommendations were essential and therefore urged the FAA to take the necessary actions. On March 3, 1997, the FAA stated that it included information regarding the installation and maintenance of DFDRs and FDAUs in Notice N8110.65, “Policy and Guidance for the Certification and Continued Airworthiness of Digital Flight Data Recorder Systems.” According to the FAA, the notice referenced the appropriate regulatory requirements and contained the universal documentation format for each DFDR aircraft configuration and installation. The FAA stated that the universal format developed by Aeronautical Radio, Inc., and the Board’s proposed FDR configuration documentation standard were used as baseline documents for the notice. On July 10, 1998, the Safety Board noted its disappointment that the AC had still not been completed. The Board stated that inclusion of guidance relating to FDR

Factual Information 132 Aircraft Accident Report maintenance documentation (which was addressed in FAA Notice N8110.65) in this AC would satisfy the intent of Safety Recommendations A-91-23 and -24, which had been issued 7 years earlier. The Board was concerned that the AC might still not be produced in a timely manner. Accordingly, the Safety Board classified Safety Recommendations A-91-23 and -24 “Open—Unacceptable Response” pending the FAA’s completion of the AC. Safety Recommendation A-97-30 asked the FAA to Complete the planned flight data recorder (FDR) advisory circular (AC) to define FDR certification requirements and FDR maintenance requirements, and incorporate the FDR documentation standards contained in Notice N8110.65. The AC should be released no later than January 16, 1998. On July 14, 1997, the FAA stated that it agreed with the intent of this safety recommendation. The FAA also stated that it would complete the AC for FDR certification and maintenance requirements by January 1998. On July 10, 1998, the Safety Board stated its disappointment that the AC, promised by the FAA to be issued by January 1998, had not been completed. The Board was concerned that the AC would not be produced in a timely manner. The Board stated that the guidance contained in this AC was essential to avoid widespread retrofit problems.181 Pending the FAA’s completion of the AC, the Safety Board classified Safety Recommendation A-97-30 “Open—Unacceptable Response.” 1.18.7.1.1 Digital Flight Data Recorder Advisory Circular On October 5, 1999, AC 20-141, “Airworthiness and Operational Approval of Digital Flight Data Recorder Systems,” was issued. The purpose of the AC is to provide “guidance on design, installation, and continued airworthiness of Digital Flight Data Recorder Systems.” Appendix 1 to the AC, titled “Standard Data Format for Digital Flight Data Recorder Data Stream Format and Correlation Documentation,” provides “a standard for the data stream format and correlation documentation that operators must maintain to aid accident investigators in interpreting recorded flight data.” The appendix details how to develop a document for each airplane that would provide in detail the information that would assist Safety Board investigators in transcribing each parameter recorded by an FDR. 1.18.7.2 International Guidance Regarding the Documentation of Flight Data Recorder Parameters ICAO provides guidance to Member States regarding the documentation of FDR parameters. ICAO Annex 6, “International Standards and Recommended Practices— Operation of Aircraft, Part I—International Commercial Air Transport—Aeroplanes,” includes Attachment D, Flight Recorders. Section 3 of the attachment, “Inspections of flight data and cockpit voice recorder systems,” provides guidance on the continued 181 The FAA adopted rulemaking to require airlines to retrofit FDRs on most U.S.-registered aircraft.

Factual Information 133 Aircraft Accident Report airworthiness of FDR systems, including how to conduct annual checks of every FDR parameter. Paragraph 3.2(c) states that “a complete flight from the FDR should be examined in engineering units to evaluate the validity of all recorded parameters.” In addition, paragraph 3.2(d) states that “the readout facility should have the necessary software to accurately convert the recorded values to engineering units and to determine the status of discrete signals.” 1.18.8 Special Airport Criteria and Designation On October 19, 1996, Delta Air Lines flight 554, a McDonnell Douglas MD-88, N914DL, struck the approach light structure at the end of the runway deck during the approach to land on runway 13 at LaGuardia Airport in Flushing, New York.182 IMC conditions prevailed for the ILS DME approach. None of the two flight crewmembers and three flight attendants were injured, but 3 of the 58 passengers received minor injuries. The airplane sustained substantial damage. According to the first officer of the flight, the approach to runway 13 requires landing over water, a 250-foot DH, and an offset localizer, and the approach to the opposite direction runway (31) requires maneuvering an airplane at high bank angles close to the ground. However, LaGuardia was not designated by the FAA as a special airport under 14 CFR Section 121.445.183 That section, titled “Pilot in command airport qualification: Special areas and airports,” states the following:184 (a) The [FAA] Administrator may determine that certain airports (due to items such as surrounding terrain, obstructions, or complex approach or departure procedures) are special airports requiring special airport qualifications and that certain areas or routes, or both, require a special type of navigation qualification. (b) ...no certificate holder may use any person, nor may any person serve, as pilot in command to or from an airport determined to require special airport qualifications unless, within the preceding 12 calendar months: (1) The pilot in command or second in command has made an entry to that airport (including a takeoff and landing) while serving as a pilot flight crewmember; or (2) The pilot in command has qualified by using pictorial means acceptable to the Administrator for that airport. The Safety Board’s investigation of the accident concluded, among other things, that the FAA’s guidance on special airports was not sufficiently specific about criteria and 182 National Transportation Safety Board. 1997. Descent Below Visual Glidepath and Collision With Terrain, Delta Air Lines Flight 554, McDonnell Douglas MD-88, N914DL, LaGuardia Airport, New York, October 19, 1996. Aircraft Accident Report NTSB/AAR-97/03. Washington, DC. 183 The first officer indicated his belief that LaGuardia should be designated as a special airport and that approaches to runways 13 and 31 were worthy of special pilot qualification requirements. 184 This rule was adopted in June 1980.

Factual Information 134 Aircraft Accident Report procedures for designation of special airports; therefore, the FAA’s guidance might not always be useful to air carriers operating in and out of special airports. The Board also concluded that the requirements for special airport pilot qualifications might not be sufficient to ensure that qualified pilots have been exposed to the runways and/or approaches that make those airports “special.” As a result of its findings, the Safety Board issued Safety Recommendations A-97-92 through -94 on August 25, 1997. Safety Recommendations A-97-92 through -94 asked the FAA to Expedite the development and publication of specific criteria and conditions for the classification of special airports; the resultant publication should include specific remarks detailing the reason(s) an airport is determined to be a special airport and procedures for adding and removing airports from special airport classification. (A-97-92) Develop criteria for special runways and/or special approaches, giving consideration to the circumstances of this accident and any unique characteristics and special conditions at airports...and include detailed pilot qualification requirements for designated special runways or approaches. (A-97-93) Once criteria for designating special airports and special runways and/or special approaches have been developed, as recommended in Safety Recommendations A-97-92 and -93, evaluate all airports against that criteria and update special airport publications accordingly. (A-97-94) On November 13, 1997, the FAA stated that it was developing a flight standards handbook bulletin and revising AC 121.445, “Pilot-In-Command Qualifications for Special Area/Routes and Airports, Federal Aviation Regulations (FAR) Section 121.445.”185 The FAA indicated that the bulletin and AC would address the issues discussed in the recommendations. The FAA anticipated that these documents would be issued in April 1998. On August 17, 1998, the Safety Board stated that, pending the FAA’s completion of these documents, Safety Recommendations A-97-92 through -94 were classified “Open—Acceptable Response.” On September 21, 1999, the FAA stated that AC 121.445 was undergoing internal coordination and should be published in the Federal Register by November 1999. The FAA indicated that it would proceed with issuing the flight standards handbook bulletin as soon as the AC was completed. According to the FAA, both documents were expected to be issued by February 2000. 185 The version of AC 121.445 that was in effect at the time of the accident was dated June 1990.

135 Aircraft Accident Report 2. Analysis 2.1 General The three Korean Air flight 801 flight crewmembers were properly certificated and qualified in accordance with applicable Korean Civil Aviation Bureau (KCAB) and U.S. Federal regulations, International Civil Aviation Organization (ICAO) standards, and Korean Air company requirements. No evidence indicated that any medical factors affected the flight crew’s performance. The airplane was properly certificated, equipped, and maintained in accordance with applicable KCAB and ICAO standards and Korean Air company procedures. The airplane was authorized to operate in U.S. airspace under the provisions of 14 Code of Federal Regulations (CFR) Part 129. The weight and balance of the airplane were within the prescribed limits for landing. No evidence indicated that the airplane experienced preimpact failures of its structures, flight control systems, or engines. ATC personnel involved with the flight were properly certificated and qualified as full-performance level controllers. ATC radar and communications equipment were found to be functioning properly, although the FAA-maintained minimum safe altitude warning (MSAW) system had been intentionally inhibited. This analysis examines the accident scenario, including weather factors, flight crew performance and decision-making, and other relevant factors during the approach, as well as flight crew fatigue issues. The analysis also examines the performance of ATC personnel, the effects of the MSAW system’s intentional inhibition, and the timeliness and effectiveness of the emergency response to the accident site. In addition, the analysis examines Korean Air’s flight crew simulator training, KCAB oversight of Korean Air’s flight training programs, FAA oversight of Korean Air’s operations under 14 CFR Part 129, and international efforts to reduce the number of controlled flight into terrain (CFIT) accidents. 2.2 Weather Factors on the Approach A review of weather data indicated that variable clouds and scattered rain showers associated with a weak eastward-moving low-pressure trough were affecting the Guam area about the time of the accident and that the showers increased in intensity as they moved over the higher terrain of the island. However, Safety Board interviews with flight crewmembers who flew into Guam before and after the flight 801 accident indicated that the lights of the island were occasionally visible from as far away as 150 nm. In addition, CVR data indicated that the accident flight crew made visual contact with the island about 16 minutes before the accident (about 0126:25) when the flight engineer stated “it’s Guam, Guam.”

Analysis 136 Aircraft Accident Report On the basis of weather data and witness statements, flight 801 was likely to have initially encountered variable scattered to broken cloud layers below 5,000 feet msl during the final approach to Guam. Ground lights were likely occasionally visible along the coastline, and it is probable that only scattered clouds existed below the airplane in the vicinity of the FLAKE intersection, located 7 DME from the NIMITZ VOR (UNZ). Doppler radar data indicated that a heavy to very heavy rain shower was centered over higher terrain about 4 nm southwest of the airport (along the approach corridor) about the time of the accident. Weather data indicated that, although the Apra Harbor area (about 5 DME on the approach course) would likely have been visible to the flight crew as the airplane descended through 2,000 feet msl, the airplane would have entered clouds and light precipitation shortly after passing Apra Harbor. Radar data indicated that the flight likely experienced rain of continuously increasing intensity as the airplane proceeded inbound toward the airport and that the flight encountered very heavy precipitation for a short time near the outer marker (GUQQY). About 0141:48, when the airplane was near the outer marker, the CVR recorded the captain stating “wiper on.” Although a hunter on Nimitz Hill stated that it was not raining at the time he observed the flight overhead, Doppler radar data indicated light to moderate rain shower activity between Nimitz Hill and the airport. Therefore, on the basis of weather radar and observation data, the Safety Board concludes that, after the flight crew made an initial sighting of Guam, Korean Air flight 801 encountered instrument meteorological conditions (IMC) as the flight continued on its approach to Guam International Airport. Further, the Safety Board concludes that, although flight 801 likely exited a heavy rain shower shortly before the accident, the flight crew was still not able to see the airport because of the presence of another rain shower located between Nimitz Hill and the airport. 2.3 Accident Sequence 2.3.1 Description of the Approach and Required Flight Crew Procedures The instrument landing system (ILS) glideslope (GS) inoperative, or localizer (LOC)-only, approach to runway 6L at Guam International Airport required the flight crew to maintain at least 2,000 feet from the FLAKE intersection (7 DME from the UNZ VOR) to the GUQQY (outer marker) final approach fix (FAF), which was located 1.6 DME from the UNZ VOR. After passing GUQQY, the crew was required to maintain at least 1,440 feet msl until passing the UNZ VOR. After passing the UNZ VOR, the next step-down fix was to 560 feet (the minimum descent altitude [MDA]), and the flight crew was required to maintain at least this altitude while counting up to 2.8 DME (the missed approach point [MAP]) from the UNZ VOR. To properly fly this approach, the flying pilot’s navigation receiver would need to be tuned to the localizer frequency, and the nonflying pilot’s navigation receiver would

Analysis 137 Aircraft Accident Report need to be tuned to the UNZ VOR to provide the pilots with DME information for FLAKE, GUQQY, and the MAP and allow them to identify station passage over the UNZ VOR. Station passage over UNZ would be marked by the following instrument indications: the TO/FROM indicator in the first officer’s horizontal situation indicator (HSI) would have changed from TO to FROM, and the No. 2 (double) pointer in the captain’s and first officer’s radio magnetic indicator would have swung from pointing forward to aft. Although station passage is not defined by DME, station passage over the UNZ VOR would have been indicated by a DME countdown to near zero and then a count up as the airplane continued away from UNZ to runway 6L. To use the autopilot and flight director (FD) during a nonprecision approach, the flying pilot would have set the Nav Mode Switch to VOR/LOC on the glareshield instrument panel once the airplane was established on the intercept heading to the localizer outside the FAF. The FD and autopilot flight mode annunciator (FMA) on the pilots’ instrument panels would then indicate NAV armed and GS blank.186 After localizer capture, the pilots’ and the autopilot’s FMAs would indicate NAV capture,187 and the GS would remain blank. The autopilot would turn the airplane as needed to track the localizer. (Although the nonflying pilot’s navigation receiver would be tuned to the VOR, a different frequency, that pilot’s FMA would also indicate NAV capture because the UNZ 243° radial approximately overlays the localizer.) The FD command bars on the captain’s and the first officer’s instruments would provide left and right roll commands to maintain a capture on the respective courses. When the airplane was descending, the flying pilot would normally have reset the altitude selector to the next (lower) altitude target and moved the VERT SPEED (vertical speed) wheel to position the airplane in about a 1,000-feet-per-minute rate of descent to reach the next crossing altitude. The FD pitch command bars would move up and down to provide guidance to maintain the desired rate of descent. (In a precision approach, the command bars would provide guidance to maintain the glideslope; in nonprecision approaches, they provide guidance to maintain the desired vertical speed.) Once the airplane had reached the altitude set in the altitude selector, the FDs and autopilot would capture and maintain that altitude. At no time during the localizer approach would the flight crew have armed the autopilot or FDs to capture a glideslope signal or have referenced or attempted to track any glideslope needle indications. 2.3.2 Flight 801’s Premature Descent The Combined Center/Radar Approach Control (CERAP) controller vectored flight 801 to join the runway 6L localizer course between the FLAKE intersection and the GUQQY outer marker/1.6 DME fix. Although the flight was restricted to no lower than 2,000 feet msl in that portion of the localizer-only approach procedure (until crossing the GUQQY outer marker), flight 801 descended below 2,000 feet about 1.9 nm before reaching the outer marker. 186 Armed is indicated with white letters on a black background. Blank is indicated by an absence of letters. 187 Capture is indicated with black letters on a green background.

Analysis 138 Aircraft Accident Report Further, although the approach procedure specified that at least 1,440 feet msl should be maintained after passing the GUQQY outer marker and until passing the UNZ VOR, flight 801 descended below 1,440 feet about 2.1 DME before reaching the UNZ VOR. (None of the indications of UNZ station passage would have been presented on the flight crew’s instrument panels at any time before impact.) CVR information indicated that the captain was flying the airplane on autopilot during the approach. As flight 801 descended on the approach, the captain twice commanded the entry of lower altitudes into the airplane’s altitude selector before the airplane had reached the associated step-down fix. After the captain heard the first officer call out “approaching fourteen hundred [feet]” about 0140:33, as the airplane was passing 5 DME at 2,400 feet msl,188 the captain directed the first officer to reset the altitude selector to 1,440 feet, replacing the step-down altitude of 2,000 feet before the autopilot had captured that altitude or reached the GUQQY outer marker/1.6 DME fix. Further, about 0141:33, with the flight neither having leveled off at 1,440 feet msl nor reached the UNZ VOR step-down fix, the captain instructed the first officer to set 560 feet, the MDA, in the altitude selector. The altitude selector provides the basis for the altitude alert’s aural annunciations and the autopilot’s altitude capture functions. The captain’s premature orders to reset the altitude selector indicated that he had lost awareness of the airplane’s position along the final approach course. Therefore, as a result of the captain’s commanded input to the altitude selector, the autopilot continued to descend the airplane prematurely through the 2,000- and 1,440-foot intermediate altitude constraints of the approach procedure. The CVR comments indicated no awareness by the captain that the airplane was descending prematurely below the required intermediate altitudes. 2.4 Flight Crew Performance 2.4.1 The Captain’s Performance of the Approach 2.4.1.1 Approach Briefing Korean Air cockpit procedures call for an approach (landing) briefing189 before descent. Also, company training instructs the flying pilot to conduct an approach briefing before descent. According to the Korean Air 747 landing briefing checklist card and testimony by Korean Air officials during the Safety Board’s public hearing, this briefing should include a discussion of weather conditions, a review of the instrument approach 188 It is not clear why the first officer made this callout at this altitude. It is possible that the first officer may have intended the callout to mean that only 1,000 feet remained before reaching the 1,440-foot step- down altitude, or he may have confused 2,400 feet with 1,400 feet on the altimeter. It is also possible that the first officer may have believed that the DME was located on the airport and that the airplane was approaching a DME value at which the airplane could descend to 1,440 feet. (See section 2.4.1.3.2 for a discussion about possible DME confusion.) 189 The approach briefing is called a “landing briefing” on the Korean Air checklist card.

Analysis 139 Aircraft Accident Report procedure, details of the approach’s execution (including the minimum safe altitude, approach frequency and approach course, the runway touchdown zone elevation, and the missed approach procedure), crew actions and callouts, and any abnormal configurations or conditions. CVR information indicated that the captain briefed a visual approach in his approach briefing, which he referred to as a “short briefing.” However, the captain also briefed some elements of the localizer-only instrument approach, indicating that he intended to follow that approach as a supplement or backup to the visual approach. Specifically, the captain’s briefing included a reminder that the glideslope was inoperative, some details of the radio setup, the localizer-only MDA, the missed approach procedure, and the visibility at Guam (stated by the captain to be 6 miles). However, the captain did not brief other information about the localizer-only approach, including the definitions of the FAF and step-down fixes and their associated crossing altitude restrictions or the title, issue, and effective dates of the approach charts to be used. The Safety Board notes that the landing briefing checklist did not specifically require the captain to brief the fix definitions, crossing altitudes, or approach chart title and dates,190 although it would have been good practice to do so. Further, according to public hearing testimony by a Korean Air instructor pilot, company pilots were trained to conduct a more detailed briefing than the one specified in the landing briefing checklist for a nonprecision approach, such as the localizer approach to runway 6L at Guam. According to the instructor pilot, this more detailed briefing included a discussion of the “instrument approach in detail” and a discussion of the “step- down altitudes and how they were determined.” The Safety Board notes that this information is essential for a nonprecision approach briefing. The Safety Board also notes that the captain did not brief the first officer and flight engineer on how he would fly the descent (including his planned autopilot/FD modes and his plan to fly either a constant angle of descent or a series of descents and level-off altitudes associated with the step-down fixes), and he did not discuss go-around decision criteria. Further, although not specifically required, it would have been prudent for the captain to note the need for special caution in the UNZ VOR area (which he had described as a “black hole” in his approach briefing to another first officer about 1 month earlier). The Safety Board further notes that, in this case, a thorough briefing was especially important because the accident captain and first officer were flying together for the first time, which is a situation that has been linked to flight crew-involved accidents.191 According to recent human factors research, a good briefing is important to develop a “shared mental model” to ensure “that all crew members are solving the same problem and have the same understanding of priorities, urgency, cue significance, what to watch out for, who does what, and when to perform certain activities.”192 The Safety Board 190 Testimony by Korean Air officials at the Safety Board’s public hearing indicated that these items were taught in company flight crew training. 191 National Transportation Safety Board. 1994. A Review of Flightcrew-Involved Major Accidents of U.S. Air Carriers, 1978 Through 1990. Safety Study NTSB/SS-94/01. Washington, DC, pp. 40-41.

Analysis 140 Aircraft Accident Report concludes that, by not fully briefing the instrument approach, the captain missed an opportunity to prepare himself, the first officer, and the flight engineer for the relatively complex localizer-only approach and failed to provide the first officer and flight engineer with adequate guidance about monitoring the approach; therefore, the captain’s approach briefing was inadequate. 2.4.1.2 Expectation of a Visual Approach and Role of the Guam Airport Familiarization Video The Safety Board notes that, when the captain flew to Guam about 1 month before the accident, he executed a routine ILS approach to runway 6L in good visibility, with a scattered cumulous buildup. Further, the most current ATIS information available to the accident flight crew indicated that visual conditions (scattered cloud decks and 7-mile visibility) existed at the airport. Korean Air’s Guam airport familiarization video, which the captain and first officer had viewed in July 1997, noted that weather conditions in Guam allowed visual approaches most of the year and that, even though IMC is likely during the rainy season from June to November, “you [the pilot] will be guided from over Apra Harbor to the localizer. You will then perform a visual approach….” Thus, the captain may have assumed that conditions for the flight 801 approach would be similar to those he experienced about 1 month earlier. The captain’s anticipation of a visual approach probably became a strong expectation after the flight crew’s early visual sighting of Guam. Although the captain would likely have recognized the possibility of flight through clouds as the airplane descended from its cruise altitude, he may have assumed that the visual approach slope indicator (VASI) system would be in sight after the flight was vectored onto final approach by the CERAP controller. The VASI system would have provided visual guidance for a constant angle of descent that safely cleared obstacles. As previously discussed, the captain’s landing briefing included references to his expectation of visual conditions at the airport as well as an abbreviated and inadequate briefing for the localizer-only approach. The Safety Board concludes that the captain’s expectation of a visual approach was a factor in his incomplete briefing of the localizer approach. The Board is aware that it is a common practice among air carrier pilots to abbreviate the briefing for a backup instrument approach when a visual approach is expected. Although there may be little benefit to fully briefing a backup instrument approach in daylight conditions when no appreciable possibility of encountering IMC exists, the Safety Board concludes that, for flights conducted at night or when there is any possibility that IMC may be encountered, the failure to fully brief an available backup instrument approach compromises safety. Therefore, the Safety Board believes that the FAA should require principal operations inspectors (POI) assigned to U.S. air carriers to ensure that air carrier pilots conduct a full briefing for the instrument approach (if available) intended to back up a visual approach conducted at night or when IMC may be encountered. 192 Orasanu, J. “Decision-making in the Cockpit.” In Cockpit Resource Management. 1993. Ed. E.L. Weiner, B.G. Kanki, and R.L. Helmreich. San Diego: Academic Press, p. 159.

Analysis 141 Aircraft Accident Report The Safety Board notes that, although Guam was not a designated special airport requiring special training or familiarization by flight crews, Korean Air encouraged its flight crews to view the airport familiarization video. However, the Guam familiarization video gave only a generalized description of the topography of the island of Guam. Although the video mentioned some of the obstacles near the approach course, it did not specifically state that the UNZ VOR was located on a hill, the DME was not colocated with the localizer, or the final approach segment was over hilly or mountainous terrain. Even though the airport familiarization video accurately identified some landmarks and advised pilots not to fly over a residential area and a Naval hospital (for noise abatement), the Safety Board also notes with concern that the video contained no discussion of factors that made operations into Guam challenging, such as the high terrain along the approach course or in the vicinity of the airport. Further, the presentation did not describe the complexity of the Guam nonprecision approaches, including the multiple step-down fixes, the use of two separate navigation facilities (the localizer and the VOR), and the countdown/count up DME procedure. The Safety Board concludes that the Korean Air airport familiarization video for Guam, by emphasizing the visual aspects of the approach, fostered the expectation by company flight crews of a visual approach and, by not emphasizing the terrain hazards and offset DME factors, did not adequately prepare flight crews for the range of potential challenges associated with operations into Guam. Thus, the Safety Board believes that the KCAB should require Korean Air to revise its video presentation for Guam to emphasize that instrument approaches should also be expected and describe the complexity of such approaches and the significant terrain along the approach courses and in the vicinity of the airport. The Safety Board addressed the issue of the classification of special airports and approaches to certain airports in connection with its investigation of the October 19, 1996, accident involving Delta Air Lines flight 554, an MD-88, at LaGuardia Airport in New York. On August 25, 1997, the Board issued Safety Recommendations A-97-92 through -94, asking the FAA to develop and publish “specific criteria and conditions” for the classification of special airports (including special runways and/or special approaches) and use these criteria to evaluate all airports and “update special airport publications.” On November 13, 1997, the FAA responded that it was revising Advisory Circular (AC) 121.445, “Pilot-in-Command Qualifications for Special Area/Routes and Airports,” and that the revision would address the issues discussed in the safety recommendations. On August 17, 1998, the Board classified Safety Recommendations A-97-92 through -94 “Open—Acceptable Response” pending completion of the AC. The Board recognizes that the FAA’s eventual evaluation of Guam against the newly developed criteria might result in its classification as a special airport. The Safety Board further recognizes that, because the captain flew into Guam and viewed the Guam airport familiarization video during July 1997, he would have been authorized to conduct the accident flight even if Guam had been classified as a special airport. Nonetheless, the Safety Board concludes that the challenges associated with operations to Guam International Airport support its immediate consideration as a special

Analysis 142 Aircraft Accident Report airport requiring special pilot qualifications. Therefore, the Safety Board believes that the FAA should consider designating Guam International Airport as a special airport requiring special pilot qualifications. 2.4.1.3 Possible Explanations for the Approach Conducted 2.4.1.3.1 Confusion About Status of Glideslope Despite several indications that the flight crew was aware that the glideslope was inoperative, in the last 2 ½ minutes of the flight (beginning shortly after the airplane was established on the approach), the CVR recorded a series of conflicting flight crew comments concerning the operational status of the glideslope. About 0139:55, the flight engineer asked, “is the glideslope working?” The captain responded, “yes, yes it’s working.” About 0139:58, an unidentified voice in the cockpit stated, “check the glideslope if working?” One second later, an unidentified voice in the cockpit stated, “why is it working?” About 0140:00, the first officer responded, “not useable.” About 0140:22, an unidentified voice in the cockpit stated, “glideslope is incorrect,” followed by the captain’s statement, “since today’s glideslope condition is not good, we need to maintain one thousand four hundred forty [feet].” However, about 0141:46, after the airplane crossed the GUQQY outer marker (1.6 DME from the VOR), the captain again stated, “isn’t glideslope working?” The Safety Board considered whether the flight crew might have misinterpreted some cockpit instrumentation indications as a valid glideslope capture signal. During the localizer approach into Guam, both pilots’ HSIs would have appeared centered; the captain’s would have captured the localizer, and the first officer’s would have captured the VOR radial. With VOR/LOC selected, the localizer captured, and the pitch commands set to VERT SPEED (the most likely setting), the captain’s FD command bars would have shown some vertical and horizontal movement, similar to an FD that was responding to a captured localizer and glideslope. However, the raw data glideslope needles on the attitude director indicator (ADI) and HSI would not have been affected by the VERT SPEED setting; therefore, the captain’s ADI and HSI glideslope needles should have been covered by “off” flags.193 Further, there would have been no glideslope capture annunciator on the GS bar of the FMA on top of the captain’s and first officer’s instrument panels. The Safety Board also considered whether the flight crewmembers might have observed intermittent movement of the glideslope needles during the approach, thereby creating or adding to their confusion about the glideslope. An FAA navigation expert testified at the Safety Board’s public hearing that spurious radio signals could cause a sporadic or intermittent glideslope indicator deviation in the absence of a valid glideslope signal. However, he stated that the glideslope off flag would still appear on the HSI and ADI glideslope needles and that, when the off flag appears, any movement of the glideslope needle should be considered unreliable. Postaccident testing by Korean Air and the KCAB confirmed that an airplane’s glideslope receiver could be affected by spurious 193 The Safety Board notes that the raw data localizer and glideslope needles and off flags on the first officer’s ADI and HSI would have been out of view because his navigation receiver was tuned to the VOR.

Analysis 143 Aircraft Accident Report radio signals when no valid glideslope signal was being transmitted. The tests demonstrated that spurious signals could cause movement of the glideslope needle and that, when the receiver was subjected to a steady signal, retraction of the off flag was also possible. However, the Safety Board notes that these tests were conducted with an airplane on the ground and that the airplane’s navigational receiver was subjected to extreme signal modulations transmitted very near the airplane’s antenna. These conditions are not likely to be encountered by an airplane on an actual instrument approach. The Safety Board also notes that the flight crew of a Boeing 727 reported glideslope anomalies on August 5, 1997, while executing the localizer-only approach to runway 6L at Guam.194 (The purpose of the flight was to test a newly installed GPS.) However, the captain of the 727 stated that he thought the glideslope anomaly might have been caused by the GPS wiring installation. Further, the first officer stated that he and the captain “never thought twice” about the glideslope indications because they knew that the glideslope was inoperative. The Board’s investigation into the 727’s maintenance history indicated that, in the weeks after the test flight, several cockpit navigational displays, including the first officer’s HSI and ADI, were repeatedly removed and replaced by maintenance personnel because of anomaly reports written up by flight crews. The maintenance documents indicated that the cockpit display problems were the result of integrating the new GPS with the existing cockpit displays. Although it is possible that spurious radio signals caused some erratic movement of the glideslope needles on the accident captain’s HSI and ADI, it is unlikely that the accident airplane’s navigation receivers could have been subjected to a steady spurious signal of a duration that would have resulted in a continuous glideslope needle activation and flag retraction over a period of minutes and several miles of aircraft motion. Thus, the presence of the off flags over the glideslope needles at some times and the absence of FMA glideslope capture indicators on the captain’s and first officer’s instrument panels should have been sufficient to convince the flight 801 flight crew to disregard the glideslope indications. Even if the flight crewmembers did see a continuous glideslope needle activation and flag retraction, it would not have been prudent or reasonable for them to rely on a glideslope signal of any sort when the glideslope had been reported to be unusable. (Korean Air officials stated that flight crews were trained not to use navigational aids, including glideslopes, that were reported to be unreliable or unusable). Therefore, the Safety Board concludes that, although the captain apparently became confused about the glideslope’s status, the flight crew had sufficient information to be aware that the glideslope was unusable for vertical guidance and should have ignored any glideslope indications while executing the nonprecision localizer-only approach. The Safety Board notes that, when a glideslope signal is not generated by the transmitter (resulting in an open frequency channel), an airborne glideslope receiver will continue to seek a glideslope signal, although navigation receiver filters are designed to block most spurious radio signals. The postaccident testing conducted by Korean Air and 194 The Boeing 727 flight crew stated that no glideslope flags were visible and that the ADI glideslope needle was “centered.”

Analysis 144 Aircraft Accident Report the KCAB involved the glideslope receiver; however, the Safety Board concludes that navigation receivers, including glideslope receivers, may be susceptible to spurious radio signals. Therefore, the Safety Board believes that the FAA should disseminate information to pilots, through the Aeronautical Information Manual, about the possibility of momentary erroneous indications on cockpit displays when the primary signal generator for a ground-based navigational transmitter (for example, a glideslope, VOR, or nondirectional beacon [NDB] transmitter) is inoperative. Further, this information should reiterate to pilots that they should disregard any navigation indication, regardless of its apparent validity, if the particular transmitter was identified as unusable or inoperative. 2.4.1.3.2 Confusion About Location of DME About 0140:37, when the airplane was at 2,400 feet msl and descending at 1,000 feet per minute, the captain stated, “since today’s glideslope condition is not good, we need to maintain one thousand fourteen hundred forty [feet]. please set it.” This statement suggests that the captain was attempting to comply with the restrictions of the localizer- only approach and believed that he had passed the GUQQY step-down fix. However, the CVR recorded no discussion between the captain and the first officer about DME values or their position in relation to the next step-down fix, the VOR, or the airport. The Safety Board considered whether the flight crew might have confused the configuration of the runway 6L localizer approach with one in which the DME is located on the airport. A review of the flight crew’s training records showed that the nonprecision approaches incorporating DME provided to the flight crew during training and check rides had the DME located on the airport. A countdown/count up DME procedure, which is rarely encountered on a localizer procedure, was not included in any of the Korean Air simulator training scenarios. If the flight crewmembers had the misconception that the DME information referred to the distance from the airport, they might have believed that the airplane was much closer to the airport than it actually was (the DME was located 3.3 nm southwest of the airport) and that the airplane was well above the minimum altitudes for the intermediate step-down fixes and thus ready to descend directly to the MDA. If the captain had this misconception, it could explain why he flew the airplane and commanded altitude selections as though he believed he was at or above the altitude constraint for each navigational fix along the approach. If the other flight crewmembers shared this misconception, it could explain why they failed to challenge the captain’s premature descents below 2,000 and 1,440 feet. However, this scenario suggests strongly that the captain was not noting the definitions of the navigational fixes on the approach chart, which were clearly defined as DME values.195 Thus, the Safety Board concludes that the captain may have mistakenly believed that the airplane was closer to the airport than its actual position; however, if the captain conducted the flight’s descent on this basis, he did so in disregard of the DME fix definitions shown on the approach chart. 195 An FAA flight check of the VOR and DME transmitters conducted on August 7, 1997, determined that the systems were functioning properly and within prescribed tolerances.

Analysis 145 Aircraft Accident Report 2.4.1.4 Summary of Captain’s Performance on the Approach As the approach progressed without encountering the visual conditions the captain had anticipated, the captain likely experienced increased stress because of his inadequate preparation for the nonprecision approach, which made the approach increasingly challenging.196 CVR and FDR data indicated that, shortly after the captain appeared to become preoccupied with the status of the glideslope, he allowed the airplane to descend prematurely below the required intermediate altitudes of the approach. Thus, the captain may have failed to track the airplane’s position on the approach because he believed that he would regain visual conditions, the airplane was receiving a valid glideslope signal, and/or the airplane was closer to the airport than its actual position. Regardless of the reason for failing to track the airplane’s position, the captain conducted the approach without properly cross-referencing the positional fixes defined by the VOR and DME with the airplane’s altitude. Therefore, the Safety Board concludes that, as a result of his confusion and preoccupation with the status of the glideslope, failure to properly cross-check the airplane’s position and altitude with the information on the approach chart, and continuing expectation of a visual approach, the captain lost awareness of flight 801’s position on the ILS localizer-only approach to runway 6L at Guam International Airport and improperly descended below the intermediate approach altitudes of 2,000 and 1,440 feet, which was causal to the accident. 2.4.2 Flight Crew Monitoring of the Approach CVR evidence indicated that the flight crew seemed confused about, and did not react to, a series of audible ground proximity warning system (GPWS) alerts during the final approach. The first audible GPWS callout occurred about 0141:42, with the “one thousand [feet]” altitude call. A second GPWS callout of “five hundred [feet]” occurred about 0142:00 (when the airplane was descending through about 1,200 feet msl), to which the flight engineer responded in astonishment, “eh?” However, FDR data indicated that no change in the airplane’s descent profile followed, and the CVR indicated that the flight engineer continued to complete the landing checklist. Similarly, no flight crew discussion followed the GPWS callout of “minimums” about 0142:14, and the first officer dismissed a GPWS “sink rate” alert 3 seconds later by stating “sink rate okay.” About 0142:19, the flight engineer called “two hundred [feet],” followed immediately by the first officer saying “let’s make a missed approach.” The flight engineer immediately responded “not in sight,” followed by the first officer repeating “not in sight missed approach.” According to the CVR, a rapid succession of GPWS altitude callouts down to 20 feet followed, as the flight crew attempted to execute the missed approach. 196 Human factors research has shown that a common decision-making error, especially in high stress and workload situations, is for people to tend to ignore evidence that does not support an initial decision. Human “operators tend to seek (and therefore find) information that confirms the chosen hypothesis and to avoid information or tests whose outcome could disconfirm it,” which produces an “inertia which favors the hypothesis initially formulated.” See Wickens, C. (1992). Engineering Psychology and Human Performance, 2nd Edition. Columbus, Ohio: Charles E. Merrill.

Analysis 146 Aircraft Accident Report The GPWS minimums callout occurred about 12 seconds before impact, when the airplane was descending through about 840 feet msl. The first officer’s first statement suggesting the execution of a missed approach occurred about 6 seconds before impact. The captain initiated a missed approach and thrust began increasing about 4 seconds before impact. However, no significant nose-up control column inputs were made until just before initial impact. Analysis of FDR data indicated that, if a missed approach had been initiated 12 seconds before impact (at the GPWS minimums callout), it is likely that the airplane would have successfully cleared terrain by about 450 feet. Analysis of the FDR data also indicated that, if an aggressive missed approach had been initiated 6 seconds before impact (when the first officer made the first missed approach challenge), it is possible that the airplane might have cleared the terrain. The Safety Board notes that the flight crew would have been gauging the airplane’s height above the MDA by referring to the airplane’s barometric altimeter (which displays altitude above sea level) and not the radio altimeter (which senses altitude above ground level and upon which the GPWS minimums callout was based) and that the MDA of 560 feet msl was never reached. Nevertheless, the GPWS callouts were a salient cue that should have caused the flight crew to question the airplane’s position and the captain to act conservatively and choose to execute a missed approach. The Safety Board concludes that the first officer and flight engineer noted the GPWS callouts and the first officer properly called for a missed approach, but the captain’s failure to react properly to the GPWS minimums callout and the direct challenge from the first officer precluded action that might have prevented the accident. Although the first officer properly called for a missed approach 6 seconds before impact, he failed to challenge the errors made by the captain (as required by Korean Air procedures)197 earlier in the approach, when the captain would have had more time to respond. Significantly, the first officer did not challenge the captain’s premature descents below 2,000 and 1,440 feet. The Safety Board was unable to identify whether the absence of challenges earlier in the approach stemmed from the first officer’s and the flight engineer’s inadequate preparation during the approach briefing to actively monitor the captain’s performance on the localizer approach, their failure to identify the errors made by the captain (including the possibility that they shared the same misconceptions as the captain about the glideslope status/FD mode or the airplane’s proximity to the airport), and/or their unwillingness to confront the captain about errors that they did perceive. The Safety Board notes that the captain’s failure to brief the localizer approach to back up the expected visual approach could have adversely affected the flight crew’s 197 Korean Air’s cockpit training procedures instructed the pilot flying a nonprecision approach (with the autopilot engaged) to program the autopilot/FD controls, including VERT SPEED and ALT SEL (altitude select), unless that pilot directed the nonflying pilot to do so. In addition, flight crews were trained that, while executing the approach profile, the flying pilot was to initiate all heading, course, and altitude changes, including selection of the step-down altitudes. The role of the nonflying pilot was to monitor and challenge if the flying pilot failed to follow proper procedures.

Analysis 147 Aircraft Accident Report preparation for monitoring the approach. If the captain had briefed the details of the approach, including the various navigational fix definitions and associated altitude constraints, he would have enhanced the flight crew’s ability to monitor the approach and challenge any errors he made. Even if the first officer was attempting to monitor the approach, his ability to identify errors made by the captain would have been impaired by the requirement that he tune his navigation receiver to the UNZ VOR, thus forcing him to look across the cockpit to the captain’s instruments to monitor the glideslope/FD status, any indications of glideslope capture on the captain’s ADI and HSI, and the airplane’s lateral position on the localizer. However, the first officer would have had information on his own HSI and radio magnetic indicator about the airplane’s position relative to the VOR (the step-down fix for the descent to 560 feet) and the DME readings that defined the remaining fixes of the approach. The first officer’s ability to monitor the captain was also possibly hindered by the likelihood that he was using a different instrument chart than the captain for the localizer approach. The Safety Board found an out-of-date chart for this approach (dated January 19, 1996) in the cockpit. On the basis of the captain’s comments on the CVR, it appears that the captain was using the correct chart (dated August 2, 1996), which included different definitions and names of DME fixes and different crossing altitudes than the out-of-date chart. Thus, if the first officer was using the out-of-date chart, he would have been hindered in monitoring the captain’s compliance with the altitude constraints at the fixes. Although the precise reason(s) for the lack of monitoring by the flight crew could not be determined, the Safety Board concludes that the first officer and flight engineer failed to properly monitor and/or challenge the captain’s performance, which was causal to the accident. Problems associated with subordinate officers challenging a captain are well known. For example, in its study of flight crew-involved major air carrier accidents in the United States,198 the Safety Board found that more than 80 percent of the accidents studied occurred when the captain was the flying pilot and the first officer was the nonflying pilot (responsible for monitoring). Only 20 percent of the accidents occurred when the first officer was flying and the captain was monitoring. This finding is consistent with testimony at the Safety Board’s public hearing, indicating that CFIT accidents are more likely to occur (on a worldwide basis) when the captain is the flying pilot. (See section 2.8 for a discussion of CFIT accidents and prevention strategies, including monitored approaches.) The Board’s study found that the failure of first officers to challenge errors (especially tactical decision errors) made by a flying captain was a frequent factor in accidents involving such errors. In addition, the study noted that, while monitoring and challenging a captain’s tactical decision error, “a first officer may have difficulty both in deciding that the captain has made a faulty decision, and in choosing the correct time to 198 A Review of Flightcrew-Involved Major Accidents of U.S. Air Carriers, 1978 Through 1990, pp. 47-49 and 55-59.

Analysis 148 Aircraft Accident Report question the decision.” The study concluded that a first officer “may be concerned that a challenge to a decision may be perceived as a direct challenge to the captain’s authority.” The Safety Board is concerned that the use of the nonflying pilot in a passive role, while the flying pilot is responsible for the approach procedure, programming the autopilot/FD controls, and monitoring the aircraft flightpath, places an inordinately high work load on the flying pilot and undertasks the nonflying pilot. The Board is also concerned that, when the nonflying pilot has a passive role in the approach, the flying pilot may erroneously consider the lack of input from the nonflying pilot as confirmation that approach procedures are being properly performed. The Board is aware that some international air carriers use the nonflying pilot in a more interactive role during the performance of a nonprecision approach, in which that pilot leads or prompts the flying pilot through the approach procedure by stating the next procedural change, including course, heading, altitude, time, visual contact, or MAP. The Board is also aware that some air carriers employ a “monitored approach” method, with the first officer as the flying pilot and the captain as the monitoring, nonflying pilot until just before landing. The Safety Board notes that the monitored approach method provides for more effective monitoring by the nonflying pilot because captains are more likely to be comfortable offering corrections or challenges to first officers than the reverse situation. Thus, the Safety Board concludes that monitored approaches decrease the workload of the flying pilot and increase flight crew interaction, especially when experienced captains monitor and prompt first officers during the execution of approaches. However, the Board also notes that, when there are differences in aircraft handling skills between captains and first officers and the approach is not flown using the autopilot, a monitored approach with the captain as the nonflying pilot may not always be appropriate. Therefore, the Safety Board believes that the FAA should conduct or sponsor research to determine the most effective use of the monitored approach method and the maximum degree to which it can be safely used and then require air carriers to modify their procedures accordingly. 2.4.3 Flight Crew Fatigue Factors Fatigue can be a factor in flight operations.199 The Safety Board examined several fatigue-related factors, including time of day, recent sleeping patterns, and the number of hours since awakening, to determine whether fatigue was a factor in the accident captain’s performance. The Board was unable to obtain information on the recent sleeping patterns of the first officer and flight engineer. The accident occurred after midnight (about 0042) in the flight crew’s home time zone (which is 1 hour behind Guam local time). Research has found that this time of day is often associated with degraded alertness and performance and a higher probability of errors and accidents.200 The arrival time was also several hours after the captain’s normal 199 Gander, P.H., Gregory, K.B., Miller, D.L., Graeber, R.C., Connell, L.J., and Rosekind, M.R. (1998). “Flight Crew Fatigue V: Long-Haul Air Transport Operations.” Aviation, Space, and Environmental Medicine, 69 (9, Section II, Supplement), pp. B37-B48.

Analysis 149 Aircraft Accident Report bedtime (2200 to 2300 Seoul local time) and a time at which his body would have been primed for sleep. CVR evidence indicated that the captain was tired. At the beginning of the approach, the captain made unsolicited comments related to fatigue, stating “eh...really...sleepy.” In its investigation of the 1993 American International Airways accident at Guantanamo Bay, Cuba, the Safety Board noted that individuals often tend to underestimate their own level of fatigue.201 Thus, the captain’s comment could have reflected a significant performance degradation. Neither the first officer nor the flight engineer made similar comments. According to his family, the captain slept his normal sleep routine in the days before the accident and had an opportunity to receive adequate rest. He also took a nap from 1100 to 1340 (Seoul local time) on August 5 and would therefore have been awake for 11 hours at the time of the accident. The Safety Board has found this time since awakening to be associated with greater errors.202 For example, in its investigation of the 1993 accident in Pine Bluff, Arkansas, the Board determined that the captain and first officer had both been awake for 11 hours.203 Further, the sleep history provided by the captain’s family does not address the quality of sleep he received. For example, the time of the captain’s reported nap corresponds to a typical physiological period of wakefulness when napping is difficult204 and of limited efficiency at reducing sleep debt.205 If the captain actually napped at this time, it suggests that he may have had unusual sleep needs that were not indicated by the number of hours in his reported sleep history.206 200 Akerstedt, T. (1998). “Shift Work and Disturbed Sleep/Wakefulness.” Sleep Medicine Reviews, 2(2), pp. 117-128. 201 National Transportation Safety Board. 1994. Uncontrolled Collision With Terrain, American International Airways Flight 808, Douglas DC-8-61, N814CK, U.S. Naval Air Station, Guantanamo Bay, Cuba, August 18, 1993. Aircraft Accident Report NTSB/AAR-94/04. Washington, DC, p. 135. 202 A Review of Flightcrew-Involved Major Accidents of U.S. Air Carriers, 1978 Through 1990, pp. 23-28. 203 National Transportation Safety Board. 1994. In-flight Loss of Control, Leading to Forced Landing and Runway Overrun, Continental Express, Inc., Embraer EMB-120RT, N24706, Pine Bluff, Arkansas, April 29, 1993. Aircraft Accident Report NTSB/AAR-94/02/SUM. Washington, DC. 204 Dinges, D.F. “Napping Patterns and Effects in Human Adults.” In Sleep and alertness: Chronobiological, behavioral, and medical aspects of napping. 1989. Ed. D.F. Dinges and R.J. Broughton. New York: Raven Press, p. 181. 205 Lavie, P. “To Nap, Perchance To Sleep—Ultradian Aspects of Napping.” In Sleep and alertness: Chronobiological, behavioral, and medical aspects of napping. 1989. Ed. D.F. Dinges and R.J. Broughton. New York: Raven Press, pp. 114-117. 206 Investigation determined that, on July 27, 1997, the captain’s personal physician diagnosed him with bronchitis and prescribed a medication that could be used as a sleeping aid. On July 28 through 30, the captain flew an international round trip between Korea and the United States. The combined effects of the captain’s illness and his long trip across numerous time zones were likely to have provided disruptions to his sleeping schedule that might have continued to affect him at the time of the accident.

Analysis 150 Aircraft Accident Report Fatigue degrades all aspects of performance and alertness, and deficiencies associated with fatigue were displayed in many aspects of the captain’s behavior. The captain’s preoccupation and confusion with the status of the glideslope to the exclusion of other critical information, his incomplete briefing, and his failure to react to the GPWS alerts are typical of fatigue effects that were found to be present in the Guantanamo Bay and Pine Bluff accidents. On the basis of the time of day, statements recorded on the CVR, and sleep and fatigue research, the Safety Board concludes that the captain was fatigued, which degraded his performance and contributed to his failure to properly execute the approach. 2.5 Pilot Training The Safety Board examined Korean Air’s Boeing 747 pilot training and proficiency checking program to determine what effect, if any, it may have had on the performance of the flight crew of flight 801. In training its pilots to fly the 747-200 and -300 series airplanes, Korean Air conducted 10 4-hour simulator sessions in which pilots were taught various maneuvers, emergencies, and scenarios, followed by a proficiency check in which pilot performance of certain maneuvers was assessed. The profile for each simulator training session outlined the specific airport, runway, weather, and airplane malfunction to be expected and whether the flight would result in a landing or missed approach. The training curriculum was not varied. Korean Air’s Director of Academic Training testified at the Safety Board’s public hearing that, at the time of the accident, the company’s practice was to follow simulator scenarios exactly as outlined in the training curriculum and that instructors were not permitted to vary the scenarios. The director also indicated that the proficiency checks used the same approaches that had been practiced in the previous simulator training sessions. Further, the only nonprecision approach practiced throughout the simulator sessions that used DME information was the VOR/DME approach to runway 32 at Seoul’s Kimpo Airport. However, the DME at that airport is located on the field, unlike at Guam. No scenario was presented in which pilots were required to count down to and fly past the DME and then count up to the MAP, which was required for the Guam approach.207 Further, according to the airline’s training syllabus, the VOR/DME approach to runway 32 at Kimpo was the only nonprecision approach that Korean Air flight crews were required to perform on their check ride. The Safety Board notes that proper training in the execution of nonprecision approaches is essential to safe operations. The complexity of such approaches and the 207 During training, Korean Air pilots performed two different NDB approaches; each was performed once, and neither incorporated DME. The pilots also performed the localizer approach to runway 14 at Kimpo once and the VOR/DME approach to runway 32 at Kimpo five times. The localizer and VOR/DME approaches used a DME that was colocated and frequency paired with approach navigational facilities located on the airport. Thus, the pilots were exposed to four nonprecision approaches during their training, and the VOR/DME approach to runway 32 at Kimpo was the only approach performed more than once.

Analysis 151 Aircraft Accident Report absence of precise vertical guidance create more demands on pilot skills and cognitive performance than precision approaches. An expert on CFIT accidents testified the following at the Board’s public hearing: Nonprecision approaches generally are much more complex than precision approaches. For many pilots, they are less familiar. They are more error-prone. They require [a] more comprehensive briefing. They need particularly careful and accurate monitoring, and it is possible for complex step-down procedures for steps to be missed or to be taken out of step. In other words, to get one step ahead of the airplane could be fatal. Such approaches also need much more carefully managed airplane crew and checklist management, and it is a characteristic of many CFIT accidents that they occur when the crew is preoccupied or distracted by other tasks. The Safety Board notes that the Air Line Pilots Association (ALPA), in its submission regarding this accident, estimated that air transport pilots typically conduct one to three nonprecision approaches a year and practice these approaches “just as infrequently” in the simulator. In its investigation of the November 12, 1995, accident involving American Airlines flight 1572, an MD-83 that crashed in East Granby, Connecticut, while on final approach to Bradley International Airport in Windsor Locks, Connecticut,208 the Board found that even relatively minor errors in the monitoring of the execution of a nonprecision approach can lead to an accident.209 The Safety Board is concerned that the repeated presentation of a single nonprecision approach scenario throughout simulator training (to the exclusion of all other kinds of nonprecision approaches) provides insufficient training in nonprecision approaches. Specifically, the repetition limits pilots’ opportunity to understand and practice the flying techniques necessary to perform the different kinds of nonprecision approaches and limits their ability to successfully apply these techniques to novel situations or unusual approach configurations encountered in line operations, such as the localizer approach at Guam. Further, Korean Air’s reliance on the same approach for both training and checking resulted in an inadequate evaluation of a flight crew’s ability to execute the varied nonprecision approaches that might be encountered in line operations.210 Therefore, the Safety Board concludes that Korean Air’s training in the 208 National Transportation Safety Board. 1996. Collision With Trees on Final Approach, American Airlines Flight 1572, McDonnell Douglas MD-83, N566AA, East Granby, Connecticut, November 12, 1995. Aircraft Accident Report NTSB/AAR-96/05. Washington, DC. 209 The Safety Board found similar nonprecision approach-related factors in its investigation of the 1995 accident involving an American Airlines Boeing 757 on a nonprecision approach to Cali, Colombia; the 1990 accident involving a Markair Boeing 737 on a nonprecision approach to Unalakleet, Alaska; the 1989 accident involving a Flying Tigers Boeing 747 that crashed while executing an NDB approach to Kuala Lumpur, Malaysia; and the 1989 incident involving a USAir Boeing 737 executing a localizer backcourse approach to Kansas City, Missouri. 210 The Safety Board notes the Korean Air simulator training now incorporates a variety of approach scenarios, including approaches in which the DME is not colocated with an on-airport navigational facility and approaches involving countdown/count up DME procedures. Also, the simulator training now includes approaches likely to be encountered in the airline’s domestic and international operations.

Analysis 152 Aircraft Accident Report execution of nonprecision approaches was ineffective, which contributed to the deficient performance of the flight crew. In addition, on the basis of the history of similar accidents involving U.S. air carriers, the Safety Board concludes that U.S. air carrier pilots would benefit from additional training and practice in nonprecision approaches during line operations (in daytime visual conditions in which such a practice would not add a risk factor). Therefore, the Safety Board believes that the FAA should issue guidance to air carriers to ensure that pilots periodically perform nonprecision approaches during line operations in daytime visual conditions in which such practice would not add a risk factor. 2.6 Air Traffic Control Factors 2.6.1 Controller Performance Safety Board investigators evaluated the performance of the CERAP and Agana tower controllers to determine whether their performance played a role in the circumstances of the accident. FAA Order 7110.65, “Air Traffic Control,” prescribes the ATC procedures that controllers are required to follow. The investigation revealed three deviations from those procedures on the part of the CERAP controller. The CERAP controller failed to provide the flight crew with a position advisory relative to a fix on the final approach course when he cleared flight 801 for the approach. If such a position advisory had been given, as required by paragraph 5-9-4, the pilots might have been prompted to cross-check their radar position with the cockpit DME and other navigational aid indications, thereby improving their situational awareness. In addition, the CERAP controller did not inform the flight crew or the tower controller that he had observed a rain shower (described by the CERAP controller as a “cell” during a postaccident interview with Safety Board investigators) on the final approach path, as required by paragraph 2-6-4. Although the pilots should have been aware of the weather situation because they were using on-board weather radar, their decision-making might have been aided if the CERAP controller had provided his weather observations. The CERAP controller also failed to monitor the flight after the frequency change to the tower controller.211 As a result, the CERAP controller did not immediately recognize that the airplane was overdue. (Paragraph 10-3-1 states that a controller who has any reason to believe that an aircraft is overdue should immediately take appropriate action.) If the CERAP controller had been properly monitoring the flight on one or both of the radar displays he had available to him (the en route display and/or the terminal display), he might have observed flight 801 disappear on final approach. Also, the controller might have noticed the approach path warning (low-altitude MSAW alert) that was generated on the en route radar display,212 which began about 6 seconds before impact 211 The controller was required to continue monitoring the flight because radar service had not been terminated in accordance with paragraph 5-1-13.

Analysis 153 Aircraft Accident Report and continued until at least 23 seconds afterward. These actions would have resulted in an earlier notification of the accident to emergency rescue personnel and possibly an earlier emergency response. (See section 2.7 for a discussion of the emergency response.) Further, if the CERAP controller had been monitoring the flight on the terminal radar display, which was located to his immediate right and would have been clearly visible to him,213 he might have seen the airplane descend prematurely toward high terrain and have been able to alert the flight crew and prevent the accident. This radar display would have shown the flight descending through 2,000 feet msl while almost 7 miles from the airport and outside of the outer marker. The radar display would have also shown the airplane crossing the outer marker almost 800 feet lower than the established crossing altitude of 2,000 feet.214 Although the CERAP controller told Safety Board investigators that he did not continue to monitor the flight because he was engaged in other duties about the time of the accident, the ATC transcripts indicated no activity during that time. The transcripts indicated that the controller instructed the flight crew, about 0140:42, to contact the Agana tower. The controller then made a radio transmission to another aircraft about 0140:54. From about 0141:14 to 0141:30, the controller had a conversation with another controller at a different center, and about 0142:05, he acknowledged a transmission from another aircraft. However, the transcripts indicated no further activity until 0143:49, when the CERAP controller called the Agana tower with a flight plan. Thus, the ATC transcripts indicated no activity during the time period beginning 21 seconds before and continuing until 1 minute 23 seconds after the flight 801 crash (which occurred about 0142:26). Therefore, the CERAP controller should have been able to monitor the flight during this time. If the controller had done so, he would have had an opportunity to warn the flight crew of the flight’s premature descent and possibly prevent the accident. The Safety Board concludes that the CERAP controller’s performance was substandard in that he failed to provide the flight crew with a position advisory when he cleared the flight for the approach, inform the flight crew or the Agana tower controller that he had observed a rain shower on the final approach path, and monitor the flight after the frequency change to the tower controller. It could not be determined whether the 212 The CERAP controller was monitoring the EARTS (en route) radar scope, which had a functioning MSAW capability. However, this MSAW capability was based on a different algorithm than the disabled ARTS IIA MSAW system (see section 2.6.2). The ARTS IIA MSAW system compares the airplane’s trajectory with the ILS glideslope. The EARTS system uses a single altitude (based on the lowest MDA for all nonprecision approaches to the runway) from the FAF to the point at which MSAW processing terminates (usually 1 mile from the runway threshold). 213 The Safety Board recognizes that the en route radar display was set to a range of 265 nm and therefore could not be used for effectively monitoring the final approach. The terminal radar display was set to a range of 60 nm and displayed the final approach course for runway 6L. 214 Although the CERAP controller told Safety Board investigators that his last observation of the target of flight 801 on the terminal radar display was when the airplane was 7 miles from the airport at an altitude of 2,600 feet, FDR and radar data do not support his statement. The data indicated that, when the CERAP controller instructed the flight to contact the Agana tower, the airplane was at an altitude of about 2,200 feet and maintained a continual descent. Therefore, the airplane was probably farther than 7 miles from the airport when the CERAP controller last observed the flight.

Analysis 154 Aircraft Accident Report absence of the CERAP controller’s procedural errors, singularly or in any combination, would have prevented the accident or reduced its severity. However, the Safety Board concludes that strict adherence to ATC procedures by the CERAP controller may have prevented the accident or reduced its severity. Therefore, the Safety Board believes that the FAA should develop a mandatory briefing item for all air traffic controllers and ATC managers, describing the circumstances surrounding the performance of the CERAP controller in this accident to reinforce the importance of following ATC procedures. 2.6.2 Intentional Inhibition of the Minimum Safe Altitude Warning System at Guam Since February 1995, the Guam ARTS IIA MSAW system215 had been intentionally inhibited by the FAA from providing low-altitude alerts inside a 54-nm ring around the ASR-8 radar antenna. The system was inhibited because it had been generating what air traffic controllers believed to be numerous false alerts, or “nuisance warnings.” Thus, at the time of the accident, the MSAW system was only available (uninhibited) in a 1-mile-wide band around the ASR-8 radar site, between 54 and 55 nm. Korean Air flight 801 crashed approximately 3 nm southwest of Guam International Airport in an area of rising terrain that would have been covered by the MSAW system if it had not been inhibited. FAA technical staff and Safety Board investigators conducted a postaccident simulation using the original parameters intended for the system. The simulation results indicated that, if the MSAW system had not been inhibited inside the 54-nm radius, both a visual and aural low-altitude alert would have been generated on the ARTS IIA monitors in the CERAP facility about 0141:22, as the airplane was descending through 1,700 feet msl. Accordingly, the Safety Board concludes that, if the ARTS IIA MSAW system had been operating as initially intended, a visual and aural warning would have activated about 64 seconds before flight 801 impacted terrain, and this warning would have likely alerted the CERAP controller that the airplane was descending below the minimum safe altitude for that portion of the approach. Flight 801 was under the control of the Agana tower controller at the time that the low-altitude MSAW alert would have been issued by the ARTS II system in the CERAP facility. The Agana tower was not equipped with a functioning terminal radar display. Therefore, for the crew of flight 801 to have received a low-altitude advisory, the CERAP controller (who was still responsible for monitoring the airplane after he initiated a frequency change to the tower controller) would have had to relay the alert to the tower controller, who would then have had to convey the alert to the flight crew. Given the prevalence of CFIT accidents, controllers would be expected to vigilantly monitor the system and provide timely notification to either another controller or a flight crew when 215 As previously stated, the purpose of the ground-based MSAW system is to provide air traffic controllers with a visual and an aural warning whenever an airplane descends, or is predicted to descend, below a prescribed minimum safe altitude. This information can then be relayed to the pilots so they can take remedial action.

Analysis 155 Aircraft Accident Report an MSAW alert indicates the existence of an unsafe situation. The Safety Board concludes that 64 seconds would have been sufficient time for the CERAP controller to notify the Agana tower controller of the low-altitude alert, the tower controller to convey the alert to the crew of flight 801, and the crew to take appropriate action to avoid the accident. Because of its periodic evaluations of air traffic facilities, FAA quality assurance staff knew as early as July 1995 that the Guam ARTS IIA MSAW system had been inhibited. The inhibition was cited in a 1995 FAA facility evaluation report but was only classified as an “informational” item. The FAA conducted no followup activities after the 1995 evaluation to determine whether corrective action had been taken to restore the MSAW system to the full service for which it was designed. In April 1997, the FAA conducted a second evaluation of the Guam facility, but the FAA’s report on this evaluation did not even note that the ARTS IIA MSAW system was inhibited. Thus, the FAA missed two opportunities not only to recognize that the MSAW system was inhibited to the extent that it was rendered almost completely useless but also to take corrective action. An appropriate corrective action could have prevented this accident. Therefore, the Safety Board concludes that the FAA’s quality assurance for the MSAW system was inadequate, and the agency’s intentional inhibition of that system contributed to the flight 801 accident. As previously noted, in this accident there would have been sufficient time (64 seconds), if the MSAW system had generated an alert in the CERAP facility, for the CERAP controller to have relayed the information to the tower controller. However, under different circumstances, an aircraft descending below the minimum safe altitude may not generate an MSAW alert as far in advance, so controllers may have significantly less time to react. In those cases, it would make a critical difference if the MSAW alert were provided directly to the airport tower. The Safety Board has long been concerned about the issue of aural MSAW alerts in towers. As part of its investigation into the January 1995 Beechcraft A36 accident, the Safety Board found that the FAA did not have a policy regarding the installation of an aural MSAW alert at low-density ATC towers equipped with D-BRITE radar displays. As a result, the Safety Board issued Safety Recommendation A-95-120 on November 30,

1. Safety Recommendation A-95-120 asked the FAA to develop a policy that would

require the installation of aural MSAW equipment in those visual flight rules (VFR) terminal facilities that receive radar information from a host radar control facility and would otherwise receive only a visual MSAW alert.216 In June 1996, the FAA stated that it was feasible to install the aural MSAW alert in 112 VFR towers. In July 1997, the FAA stated that 69 of 112 ATC facilities did not have remote displays with aural alarms and that aural alarms at these facilities would be installed by February 1998. In May 1998, the FAA stated that the aural alarms at these 69 remote sites would be operational by the end of that month. However, in March 1998, at the Safety Board’s public hearing, the FAA’s Deputy Program Director for Air Traffic 216 For more information on this safety recommendation, see section 1.18.2.2.

Analysis 156 Aircraft Accident Report Operations indicated that the new projected completion date for the installation of aural alarms in VFR towers was April 2000. In October 1998, the Safety Board expressed its concern to the FAA that VFR tower controllers who have visual representation from a distant host radar may not receive an aural alert when aircraft under their control, or with whom they are in radio communication, descend below the minimum safe altitude. The Board asked the FAA to ensure that all VFR tower controllers with visual representation from a host radar would in fact receive such warning. Pending further information from the FAA, Safety Recommendation A-95-120 was classified “Open—Acceptable Response.” On September 29, 1999, a representative from the FAA stated that the agency’s management had indicated that the Agana tower was currently receiving aural MSAW alerts. At an October 7, 1999, briefing attended by the FAA Administrator, the Safety Board Chairman, and staff from both agencies, the FAA indicated that 69 MSAW aural alarms had been delivered and that 51 alarms were to be delivered. The FAA expected that the acquisition of these 51 alarms would be completed by October 2000 and that their installation in VFR towers would be completed by April 2001. On October 12, 1999, the FAA Program Director for Serco Aviation Services told Safety Board staff that the Agana tower has the capability to receive an aural MSAW alert but that, unless the Guam CERAP transfers responsibility for the aircraft’s data block, the tower will not receive the warning. The official added that the CERAP does not currently transfer responsibility for the aircraft’s data block to the Agana tower; therefore, the tower does not receive an aural MSAW alert. On October 14, 1999, the FAA Program Director for Air Traffic Operations confirmed that Agana tower was not receiving aural MSAW alerts. In an October 15, 1999, facsimile, the program director indicated that the tower “has the software and hardware capability in place to receive aural alarms.” The director further stated that the FAA had issued a policy “to ensure that the facility that is in direct radio communications with the aircraft receives the aural alarm” and that the policy would become effective by November 15, 1999. In a followup telephone conversation with the Safety Board’s Director of the Office of Aviation Safety, the program director indicated that a national policy would be issued to ensure that procedures similar to those being implemented at Guam are followed at other VFR towers. On October 25, 1999, the FAA indicated that the MSAW aural alarms for the ARTS IIA system at Guam were reconfigured on October 24, 1999. The FAA stated that, in the event of a low-altitude alert for an aircraft operating in the vicinity of Guam International Airport, aural alarms will be simultaneously generated at the CERAP and the Agana tower, along with visual low-altitude alerts on the radar displays at both facilities. On November 2, 1999, the Safety Board received a copy of draft FAA Notice N7210.485, “Minimum Safe Altitude Warning for Remote Tower Displays.” According to the notice, facility managers at ATC towers that have aural alarms for MSAW are to ensure that “the operational support facility has adapted the software functionality to ensure the aural alarms operate in the ATCT [air traffic control tower]” and that “aural

Analysis 157 Aircraft Accident Report alarms are received in the ATCT upon transfer of communications.” The FAA indicated that the effective date for this notice would be February 1, 2000. The Safety Board is concerned about the delay in the implementation of Safety Recommendation A-95-120.217 In addition, the Safety Board is especially concerned that the FAA, until it received queries from the Board, was apparently not aware of, or not addressing, procedural barriers that prevented the installed equipment from being used as intended. However, on the basis of the FAA’s apparent continued intention to fully implement this recommendation, it remains classified “Open—Acceptable Response.” 2.7 Emergency Response Although a fire station was located about 1 mile from the accident site, the first emergency response equipment (dispatched from a different fire station about 3 ½ miles from the accident site) did not arrive on scene until approximately 52 minutes after the accident. Safety Board investigators attempted to determine the reason(s) for the slow emergency response and the extent to which it could have been reduced or avoided. Because of the air traffic controllers’ delayed discovery of the accident, ramp control personnel, who were responsible for emergency notifications, were not aware of the accident until 0158, about 16 minutes after the crash occurred. As discussed in section 2.6.1, if the CERAP controller had been monitoring the flight more closely, this delay might have been eliminated or reduced. After being notified of the accident by Guam airport ramp control, the Guam Fire Department (GFD) communications center dispatched GFD Engine No. 7, which was stationed about 3 ½ miles from the crash site, at 0207. However, Engine No. 7’s departure from the station was delayed by 12 minutes because its brake system needed to be recharged with air. Engine No. 7 departed the station at 0219, and its en route response time was 15 minutes. Engine No. 7 was the first emergency response vehicle to arrive at the VOR access road (at 0234, 52 minutes after the accident). The nearest fire station to the accident site was the U.S. Navy Federal Fire Department (located about 1 mile from the accident site). According to Federal dispatch facility logs, that station was not notified of the accident until 0234. The station’s Engine No. 5 was then immediately dispatched and arrived at the accident scene at 0239 (a response time of 5 minutes). The Chief of Staff for the Commander, U.S. Naval Forces, Marianas, notified Navy "first responders" to stand by after she learned of the accident at

1. However, the Navy had not yet received a request for specific Federal firefighting

and medical resources; therefore, it would have been inappropriate for the Chief of Staff to have dispatched these resources. 217 The Safety Board is also disappointed that the aural MSAW alert could not be installed on the D-BRITE system at Guam in a timely manner because the FAA did not certify the system until April 1998, more than 1 year after it was delivered.

Analysis 158 Aircraft Accident Report The emergency response was further delayed because the VOR access road—a partially paved, single-lane road that was the only ground access to the accident site—was blocked by a section of severed pipe218 when emergency responders arrived. Emergency responders had to walk to the crash site through steep, muddy terrain and dense vegetation until 0334, when a truck-mounted winch removed the pipe. Fire and rescue personnel stated that only small, isolated fires remained when they were finally able to reach the accident scene with firefighting equipment. A U.S. Navy emergency medical technician assigned to the Naval Regional Medical Center reached the accident site on foot between 0245 and 0300. He stated that emergency responders established two triage areas to treat survivors. He added that transport of the survivors to hospitals was delayed because of the terrain and limited access to the crash site and the necessity to stabilize patients in triage. The first survivors were transported to hospitals between about 0300 and 0330. Rescue personnel testified at the Safety Board’s public hearing that the pace of evacuations increased after the pipe blocking the access road was removed and a landing area for helicopters was set up near the VOR. The Safety Board is concerned that the first emergency response equipment did not arrive at the accident scene until about 52 minutes after the accident. Although the harsh terrain and the broken pipeline could not have been controlled, the delay caused by air traffic controllers’ initial unawareness of the accident, the need to recharge the brake system on the GFD Engine No. 7, and the lack of timely notification to the Federal Fire Department could have been avoided. Thus, the Safety Board concludes that a substantial portion of the delayed emergency response was caused by preventable factors. The autopsy reports indicated that at least one seriously injured passenger was treated at the accident site. Although the autopsy report for this passenger did not identify a single cause of death (her remains showed evidence of multiple internal injuries but no burns or soot in the airways), the report indicated that she was alive when medical personnel arrived, was treated aggressively, and might have survived if earlier medical intervention and evacuation had occurred. Therefore, the Safety Board concludes that the delayed emergency response hampered the timely evacuation of injured persons, and at least one passenger who survived the initial impact and fire might not have died if emergency medical responders had reached the accident site sooner. According to public hearing testimony by Guam’s Civil Defense Director, at the time of the accident, Guam emergency response authorities had a memorandum of understanding (MOU) with the U.S. Air Force for emergency response but did not have agreements with the U.S. Navy or U.S. Coast Guard. The director further stated that, before the accident, a joint disaster drill had been conducted at the airport, but no drills had been conducted for off-airport crash emergencies. At the public hearing, the Guam Civil Defense Director and other Guam officials stated that a committee, including representatives from Guam, the U.S. Navy, the U.S. Coast Guard, and the U.S. Air Force, 218 The airplane’s landing gear had struck an oil pipeline on the side of the road and pushed portions of the pipeline into the road.

Analysis 159 Aircraft Accident Report had been formed to develop an MOU; an off-airport aircraft accident drill was planned for September 1998; and new radios had been purchased to allow interagency communication and coordination during emergency responses. However, Guam Civil Defense officials told the Safety Board in June 1999 that no MOU had been signed and that a draft of standard operating procedures for joint emergency response was being circulated to agencies for review. Further, Guam Civil Defense officials stated that the planned September 1998 off-airport aircraft accident drill did not take place and that such an exercise was still in the planning stage. Although it is pleased with the purchase of new emergency radios, the Safety Board concludes that improved formal coordination among Guam’s emergency response agencies has not been implemented, and off-airport drills to identify and correct deficiencies in disaster response planning before an accident occurs have still not been conducted in the more than 2 years since the flight 801 accident. Thus, the Safety Board also concludes that actions taken by Guam’s emergency response agencies after the accident have been inadequate because they failed to ensure that emergency notifications and responses would be timely and coordinated. Therefore, the Safety Board believes that the Governor of the Territory of Guam should form, within 90 days, a task force comprising representatives from all emergency response agencies on the island, including the appropriate departments within the government of Guam, FAA, Guam International Airport Authority, U.S. Navy, U.S. Air Force, U.S. Coast Guard, Federal Emergency Management Agency, and all other affected agencies, to define and coordinate emergency notification and response procedures to ensure that timely emergency notifications are made to all local and Federal agencies according to need, location, and response time capability. Further, the Safety Board believes that the Governor of the Territory of Guam should require periodic and regularly scheduled interagency disaster response exercises, including an off-airport aircraft accident scenario, in addition to those response drills already required at Guam International Airport in accordance with 14 CFR Section 139.325. 2.8 Controlled Flight Into Terrain According to Flight Safety Foundation (FSF) accident data, CFIT accidents have killed more passengers and crewmembers than any other type of air carrier accident, and approach and landing accidents accounted for 70 percent of CFIT accidents, with most accident airplanes “in line with the runway” at impact. CFIT accident data also indicated that nonprecision approaches presented a greater risk than precision approaches and that many CFIT accidents involved failed step-down approaches, with flight profiles similar to that of flight 801’s approach to Guam. As noted in section 2.5, nonprecision approaches are practiced infrequently by air carrier pilots and generally require more extensive briefings and careful monitoring than a typical instrument approach. The FSF CFIT task force also identified several common factors found in CFIT accidents, including night conditions, limited visibility, terrain not seen until just before impact, a stabilized descent path approximating a 3° slope, loss of horizontal and/or

Analysis 160 Aircraft Accident Report vertical situational awareness, unfamiliarity with terrain and obstructions, uncertainty about altitudes and/or distance from the airport, navigational equipment improperly set, or information misinterpreted. The Safety Board notes that many of these factors were present in this accident.219 On October 16, 1996, the Safety Board issued Safety Recommendation A-96-95, asking the FAA to develop a CFIT program that includes realistic simulator exercises comparable to the successful windshear and rejected takeoff training programs and make training in such programs mandatory for all pilots operating under 14 CFR Part 121. On February 25, 1997, the FAA issued a change to AC 120-51B, “Crew Resource Management,” recommending that crew resource management (CRM) training in line- oriented flight training or special purpose operational training modules contain a CFIT scenario. However, the FAA did not require this CFIT training, as urged by the Safety Board. Pending further correspondence from the FAA, Safety Recommendation A-96-95 was classified “Open—Acceptable Response” on November 13, 1997. A CFIT Education and Training Aid, which was developed under the auspices of the FSF and made available to air carriers in 1997, provides an overall summary of CFIT “traps,” outlines causal factors of CFIT accidents, and provides training guidance for specific escape maneuvers. The education and training aid focuses on altimeter errors, procedural errors, misuse of automation, terrain avoidance, and aggressive escape maneuvers. The training materials include a video and a CFIT checklist designed to evaluate mission-specific CFIT risk factors, such as nonprecision approaches, airports near mountainous terrain, duty time, and weather factors. Thus, because CFIT is one of the leading categories of air carrier accidents and this type of accident is likely to increase as worldwide air traffic levels increase, the Safety Board concludes that CFIT accident awareness and avoidance training is an important accident reduction strategy and should be mandatory for all pilots operating under 14 CFR Part 121. The Safety Board is disappointed that the FAA has not yet mandated CFIT training, despite its demonstrated value to air carrier flight crews and in the reduction of CFIT accidents. On August 11, 1999, the FAA stated that it had initiated a notice of proposed rulemaking (NPRM) to mandate CFIT training. The FAA indicated that the NPRM would be published in December 2000. Because of the FAA’s planned rulemaking, Safety Recommendation A-96-95 remains classified “Open—Acceptable Response.” However, the Safety Board notes with concern that the FAA’s expected publishing date for the NPRM (December 2000) would occur more than 4 years after the issuance of the recommendation. Experience has shown that implementation of a final rule could take several additional years. In light of the fact that the CFIT training program is already available to the industry, this delay appears unnecessary and unreasonable. Therefore, the Safety Board urges the FAA to expedite this rulemaking. 219 According to Korean Air’s Director of Academic Flight Training, the company’s CFIT awareness training consisted of a discussion of GPWS alerts in ground school. The director stated that no CFIT avoidance scenarios were included in the simulator training curriculum and that CFIT awareness materials were collected in a “read file” that was available to flight crews. The director stated that Korean Air had no formal CFIT training curriculum.

Analysis 161 Aircraft Accident Report 2.8.1 Constant Angle of Descent Nonprecision Approaches Some airlines have adopted a “constant angle of descent” technique for nonprecision approaches. This technique involves descending on a constant descent angle toward the runway and meeting all of the crossing restrictions of the nonprecision approach procedure while avoiding intermediate level-offs. For this technique, the crossing altitudes depicted on the approach chart are used only as the bottom portion of a window through which the airplane passes as it descends. In most cases, the descent angle is about 3°, except in instances in which terrain or obstructions require a steeper descent. Because of terrain factors, some currently approved nonprecision approaches are not amenable to being flown with a constant angle of descent method. One method for flying a constant angle of descent, in the absence of a ground- based glideslope signal, involves the use of on-board flight management system (FMS) or GPS equipment that provides electronic guidance for a constant angle of descent. This method uses the same flight instrument and FD displays as with an ILS approach. The FMS or GPS equipment, one or both of which is widely installed in newer airplanes, provides precise, real-time information about airplane position. Under FAA Order 8260.47, “Barometric Vertical Navigation Instrument Procedures Development,” issued May 26, 1998, some airlines have received approval to use preprogrammed FMS/GPS approaches that include three-dimensional navigation guidance to the MAP, which is expressed as a barometric decision altitude. The advantages of this method include greater precision, lower pilot workload, and the ability to obtain FD guidance and couple the autopilot to fly the approach automatically. Pilots are not required to use step-down fixes, which removes the chance for misinterpreting the distance to the runway or the proper altitude for that distance and provides for a stabilized approach throughout the descent. The Safety Board concludes that, by providing vertical guidance along a constant descent gradient to the runway, the use of on-board FMS- and/or GPS-based equipment can provide most of the safety advantages of a precision approach during a nonprecision approach. Therefore, the Safety Board believes that the FAA should require that all air carrier airplanes that have been equipped with on-board navigational systems capable of providing vertical flightpath guidance make use of these systems for flying nonprecision approaches whenever terrain factors allow a constant angle of descent with a safe gradient. The Safety Board notes that it is likely that most air carrier airplanes will be equipped with on-board FMS and/or GPS equipment over the next several years and that the lack of such equipment may ultimately result in the loss of approach capability to certain runways for those airplanes not so equipped. Further, the Board acknowledges that terrain along the approach courses to some runways may preclude a constant angle of descent with a safe gradient, thus resulting in the loss of approach capability to certain runways. However, on the basis of the safety advantages of the constant angle of descent with vertical guidance versus step-down approaches, as demonstrated in the circumstances of this accident, the Safety Board believes that the FAA should require, within 10 years,

Analysis 162 Aircraft Accident Report that all nonprecision approaches approved for air carrier use incorporate a constant angle of descent with vertical guidance from on-board navigation systems. For those airplanes not yet equipped with on-board navigational systems capable of providing vertical flightpath guidance, an alternative method allows pilots to approximate a constant angle of descent. This method requires using a published approach procedure that incorporates a defined point along the final approach course to begin a constant angle descent to the runway of about 3°; this descent point and descent angle also fulfill the minimum crossing altitudes at each step-down fix of the nonprecision approach. If pilots are provided a tabular means of cross-referencing the distance from the runway (measured by DME) and the proper altitude for that distance, they can adjust the airplane’s rate of descent to approximate a constant angle. The advantages of this method include greater awareness of the airplane’s position on the approach path and a more stabilized approach, but there is additional workload involved in the cross-referencing of altitude and distance. In Safety Recommendation A-96-128, issued on November 13, 1996, the Safety Board asked the FAA for the incorporation of constant angle descents instead of step- down criteria. The FAA indicated that it has made progress in providing some of the information pilots need to approximate a constant angle of descent (descent angles and gradients to the runway from a defined starting point). However, the FAA continues to provide insufficient information on approach charts to cross-reference DME distances and altitudes. Thus, the Safety Board concludes that the safety of executing a nonprecision approach using the constant angle of descent, or stabilized descent technique, would be enhanced by adding to approach charts the cross-referenced altitudes versus distance from the airport. Therefore, the Safety Board believes that the FAA should include, in nonprecision approach procedures, tabular information that allows pilots to fly a constant angle of descent by cross-referencing the distance from the airport and the barometric altitude. 2.8.2 Safety Aspects of Enhanced Ground Proximity Warning Systems At the time of the flight 801 accident, no Korean Air airplanes were equipped with enhanced GPWS nor were they required to be so equipped. Further, enhanced GPWS was not available for the 747-300 at the time of the accident. The Safety Board notes that postaccident enhanced GPWS simulations conducted by AlliedSignal indicated that, if flight 801 had been equipped with enhanced GPWS, an aural “CAUTION TERRAIN” warning and a yellow visual terrain depiction on the color weather radar display would have been issued about 60 seconds before impact. An aural “TERRAIN TERRAIN” and “PULL UP” warning and a red visual terrain depiction on the weather radar scope would have been issued about 45 seconds before impact and would have sounded continuously until completion of a successful escape maneuver or impact.

Analysis 163 Aircraft Accident Report Safety Recommendation A-96-101, issued on October 16, 1996, asked the FAA to examine the effectiveness of enhanced GPWS equipment and, if found effective, require all transport-category aircraft to be equipped with an enhanced GPWS that provides pilots with an early warning of terrain. In a May 4, 1999, letter to the Safety Board, the FAA stated that it issued an NPRM in August 1998 to require terrain awareness and warning system (TAWS) equipment (the name used in the NPRM for enhanced GPWS) on all civil turbine-powered aircraft with six or more passenger seats within 4 years of the issuance of a final rule. Pending the Board’s evaluation of the FAA’s completed action, Safety Recommendation A-96-101 was classified “Open—Acceptable Response” on July 13, 1999. However, on May 12, 1999, the Safety Board expressed concern that the 4-year installation time frame was too long for retrofitting enhanced GPWS to existing turbine- powered airplanes that currently lack any GPWS protection. As a result, the Board issued Safety Recommendation A-99-36, urging the FAA to shorten the proposed installation period for these airplanes to 3 years (with a completion deadline of May 2002).220 In a July 26, 1999, response to the Safety Board, the FAA indicated that it was “committed to installing and using TAWS as expeditiously as possible.” The FAA stated that the final rule would require installation of TAWS within 1 year after the effective date on new-production airplanes and within 4 years for existing airplanes. The FAA added that the installation timetable was based on “product availability” and the “manufacturing approval process.” The Safety Board notes that, on August 16, 1999, the FAA issued a technical standard order for TAWS equipment (specifications and installation requirements) and that the proposed final rule for TAWS installation was scheduled to be issued by March

1. The Board acknowledges the FAA’s progress to date on TAWS issues but notes with

disappointment that the 2005 installation deadline is 3 years longer than urged in Safety Recommendation A-99-36 for existing airplanes that are not currently required to have a GPWS. The Board continues to urge that the installation of enhanced GPWS be expedited not only for those airplanes covered by Safety Recommendation A-99-36 but also for the transport-category airplanes covered by Safety Recommendation A-96-101. Pending further action by the FAA, the Safety Board classifies Safety Recommendations A-96-101 and A-99-36 “Open—Acceptable Response.” 2.8.3 Terrain Depiction on Approach Charts Approach chart vendors use various methods of depicting obstructions and high terrain on approach charts. On the plan view,221 some vendors use contour lines and color 220 Safety Recommendation A-99-36 superceded A-95-35, which had asked the FAA to require all “turbojet-powered airplanes” with six or more passenger seats to be equipped with a GPWS. Safety Recommendation A-99-36 asked the FAA to require that all “turbine-powered” airplanes with six or more passenger seats not currently required to be equipped with GPWS to have an operating enhanced GPWS installed within 3 years. 221 The plan view shows the approach viewed from above.

Analysis 164 Aircraft Accident Report shading for various height gradients and symbols for high obstructions, and others use broader colored areas with the minimum sector altitude for obstacle clearance printed over each area. However, no chart vendor depicts terrain or obstructions on the profile view,222 which depicts the inbound approach course descent profile from an initial approach fix to a landing or missed approach. Other than the depiction of certain obstruction heights, there is no FAA requirement or standardized format to depict terrain on approach charts. The Safety Board notes that Nimitz Hill was not depicted on the Guam runway 6L ILS approach chart. During an instrument approach, pilots generally refer to the plan view until they are established on the inbound approach course, usually on the intermediate and final approach segments. Once on the inbound approach course, pilots generally shift their attention on the approach chart from the plan to the profile view. Thus, the Safety Board concludes that terrain depiction on the profile view of approach charts could result in increased flight crew awareness of significant terrain on the approach path. The Board recognizes that logistical problems may be associated with obtaining and including this information and that not all users agree that obstacle depiction on the profile view is necessary and helpful. (See section 1.18.4.2.) Nevertheless, the Safety Board believes that the FAA should evaluate the benefits of depicting terrain and other obstacles along a specific approach path on the profile view of approach charts and require such depiction if the evaluation demonstrates the benefits. 2.8.4 User Review of Instrument Procedures Charting companies that publish instrument procedures receive the pertinent information from the FAA on its Form 8260. This form includes data for the terminal area as well as final approach and missed approach standards for a specific instrument procedure. The manager of the FAA’s Western Flight Procedures Development Branch testified at the Safety Board’s public hearing that, when an approach procedure is completed but before it is published, the procedure is distributed to industry user groups, including ALPA, the Air Transport Association, the Aircraft Owners and Pilots Association, and airport operators, for review. The manager stated that the purpose of this user review is to ensure that the final product is safe, accurate, and intelligible. The Safety Board agrees with and endorses this practice. However, the Board notes that the FAA does not provide user groups with the approach procedure in its final, graphical form as it will be published and used. Rather, user groups are only given FAA Form 8260, which describes the approach in words and numbers. Industry user groups, including ALPA (according to its submission to the Safety Board regarding this accident), have stated that the format of FAA Form 8260 makes it difficult for them to evaluate the procedure. Thus, the Safety Board concludes that valuable user group reviews of proposed new instrument procedures are hampered by the format in which the information is disseminated; thus, user groups may not be able to effectively evaluate whether a procedure is safe, accurate, and intelligible. Therefore, the 222 The profile view shows the approach viewed from the side.

Analysis 165 Aircraft Accident Report Safety Board believes that the FAA should provide user groups, along with Form 8260, draft plan and profile views of instrument procedures to assist the groups in effectively evaluating proposed new procedures. 2.9 Oversight Issues 2.9.1 Korean Air As discussed in sections 1.17.2.3 and 1.17.5.1, Korean Air established a CRM program and undertook several other safety initiatives in response to previous accidents. The company also had supervisor briefing and airport familiarization programs, both of which exceeded Korean regulatory requirements. (For more information about these programs, see section 1.17.3.) The Safety Board recognizes that these efforts indicated a positive approach to safety. However, the supervisor briefing, which could have assisted the flight crew in preparing for the approach, did not review important items, such as NOTAMs or the currency of approach charts. Also, the airport familiarization video did not adequately prepare the crew for the possibility of a nonprecision approach in IMC, nor did it note that the DME was not colocated with the localizer. Further, as discussed previously, some of Korean Air’s training and operational procedures, such as the limited number and variety of approach scenarios, lack of an interactive role for the nonflying pilot, and lack of documented cockpit approach procedures that clearly defined crewmember duties, contributed to the flight crew’s deficiencies in this accident. Korean Air experienced a series of accidents (beginning before and continuing after the Guam accident) involving crew coordination and performance (see section 1.17.5). These accidents raise broader questions about the adequacy of the company’s training and operational procedures. The airline did take action in response to some of these accidents to address the safety problems brought to light. However, the continued occurrence of crew error accidents called for a broad in-depth assessment of the airline’s flight operations to determine how best to mitigate opportunities for such errors. At the Safety Board’s public hearing, the Korean Air Deputy Director of Flight Operations appeared to recognize that, before the accident at Guam, Korean Air had not been placing sufficient emphasis on flight safety and particularly on pilot training. He testified: Looking back upon this accident we feel that most of our management up to now has been [ ] perhaps too short-term, short-[sighted], and superficial in its nature. …from this point on for the purpose of ascertaining safe flight operations we plan to make long-term plans and spare no resources in [attaining] this final objective of flight safety. Accordingly, we will adjust our management systems and invest all the more heavily into training and program development.223

Analysis 166 Aircraft Accident Report The Safety Board acknowledges that, since the Guam accident, Korean Air has taken significant management, operational, and flight crew training actions.224 However, in light of the specific deficiencies that were discovered during the investigation of this accident and Korean Air’s accident and incident history, the Safety Board concludes that, at the time of the flight 801 accident, there were underlying systemic problems within Korean Air’s operations and pilot training programs that indicated the need for a broad safety assessment of these programs. 2.9.2 Korean Civil Aviation Bureau Oversight of Korean Air The KCAB is charged with oversight of the Korean civil airlines. At the time of the accident, two KCAB operations inspectors were assigned to provide oversight of Korean Air’s flight operations. Korean Air pilots who were designated by the KCAB as check airmen and examiners conducted flight instruction, check rides, and proficiency checks and issued type ratings. The KCAB inspectors provided an annual evaluation of the flight skills of the check airmen and examiners but did not observe proficiency checks or check rides on Korean Air’s wide-body fleet.225 According to its director, the KCAB routinely conducts one annual safety inspection, four quarterly inspections, and an average of 40 random inspections of the airline each year. The director added that the two safety inspectors assigned to Korean Air at the time of the accident also had oversight duties at another Korean carrier.226 Regardless of the number of inspections of Korean Air performed by the KCAB, its failure to identify and monitor trends within the airline that might be indicative of safety problems raises questions about the adequacy of KCAB’s oversight of Korean Air. Further, KCAB officials acknowledged that the agency, because of personnel workload constraints, frequently relied on Korean Air to self-report corrective actions taken in response to KCAB inspections and did not confirm directly that identified problems had been addressed by the airline. As previously noted, the syllabus for Korean Air’s KCAB-approved simulator training program described the scenarios used in training, type ratings, and proficiency checks, and these scenarios were followed repetitively, without deviation, during training 223 Korean Air officials subsequently asked that this statement be removed from the public record and disagreed that there were deficiencies in Korean Air’s management approach. However, the statement may well have been an adequate assessment of the company’s shortcomings, and the Safety Board is disappointed that Korean Air officials apparently failed to recognize this possibility. 224 As discussed in sections 1.17.1 and 1.17.2.4, Korean Air contracted for extensive flight crew training services (including courses on decision-making, communications skills, and CRM), revised simulator curricula to include a variety of situations encountered during flight operations, increased the minimum flight hour and experience qualification requirements for captains (from 3,000 hours and 3 years to 4,000 hours and 5 years), began a worldwide pilot recruitment program, and set a goal of installing enhanced GPWS equipment on all Korean Air airplanes by the end of 2003. 225 According to the KCAB, its inspectors did observe proficiency checks and check rides on Korean Air’s narrow-body fleet (including the MD-80 and the F.100). 226 According to the KCAB’s director, the agency was authorized after the accident to hire nine additional employees, including five new inspectors, to bolster oversight activities.

Analysis 167 Aircraft Accident Report exercises. Further, the training and checking scenarios incorporated an inadequate number and variety of nonprecision approach procedures. As a result of the airline’s rigid adherence to a curriculum that provided an inadequate variety of approaches, flight crews were inadequately prepared to conduct nonprecision approaches. Also, cockpit approach procedures (for example, for the flying and nonflying pilot roles) were taught anecdotally and were not documented. After the accident and discussions with Safety Board investigators, the KCAB asked Korean Air to modify its simulator training syllabus to include a diversity of approach scenarios and improve its CRM program. Korean Air stated that it complied with these requests. Implementing and maintaining the highest levels of aviation safety requires an ongoing relationship between the regulator (in this case, the KCAB) and the airline (in this case, Korean Air). Each entity plays an essential role: one complies with standards of safety, and the other ensures that such compliance is maintained. One researcher described the role of the regulator as follows:227 Regulators are uniquely placed to function as one of the most effective defen[s]es against organizational accidents. They are located close to the boundaries of the regulated system, but they are not of it. This grants them the perspective to identify unsatisfactory practices and poor equipment that the organization has grown accustomed to or works around. The Safety Board acknowledges that, in October 1998, after several accidents and incidents following the crash of flight 801, the Korean Ministry of Construction and Transportation (of which the KCAB is a part) ordered a 6-month suspension of 138 flights on 10 of Korean Air’s domestic routes and ordered it to reduce service on the Seoul-to- Tokyo route. The Safety Board further acknowledges that KCAB operations inspectors now assigned to Korean Air have type ratings in the airplanes that the airline operates. However, as discussed previously, at the time of the flight 801 accident, there were signs suggesting underlying systemic problems within Korean Air’s operations and pilot training programs that indicated the need for a broad safety assessment of these programs. No such assessment was carried out by Korean Air or the KCAB before the accident. Thus, the Safety Board concludes that the KCAB was ineffective in its oversight of Korean Air’s operations and pilot training programs. 2.9.3 Federal Aviation Administration Oversight of Korean Air and Assessment of Korean Civil Aviation Bureau The FAA issues operations specifications to foreign air carriers operating into the United States pursuant to 14 CFR Part 129. The FAA also assigns a POI228 to each foreign air carrier to provide oversight to that carrier. The POI for Korean Air at the time of the 227 Reason, J.T. (1997). Managing the risks of organizational accidents. Aldershot: Hampshire, England, p. 182. 228 The FAA’s position title for POIs assigned to foreign carriers is International Geographic Inspector (Operations).

Analysis 168 Aircraft Accident Report accident stated that oversight of foreign carriers under Part 129 included inspections of trip records and facilities in the United States and ramp inspections of airplanes and crews when they were in the United States or its territories. However, the POI stated that the FAA did not inspect, approve, or oversee a foreign airline’s training program or any of its manuals or accomplish line checks or en route inspections on board foreign airlines. (There is no requirement that a foreign carrier provide the FAA POI with flight operations or training manuals.) The POI also stated that there was no formal interaction between the KCAB and the FAA regarding their respective oversight activities relating to Korean Air. The Safety Board notes that the purpose of the FAA’s International Aviation Safety Assessment (IASA) program is to ensure that foreign air carriers operating in the United States are receiving adequate oversight by their respective civil aviation authority (CAA). The FAA developed this program in response to an identified need to oversee foreign carriers operating to the United States; however, the FAA’s assessment under that program is limited to an evaluation of the foreign CAA’s ability to provide oversight in accordance with ICAO Annex 6 standards. The FAA does not directly assess whether foreign carriers are receiving such oversight or are complying with Annex 6. When the FAA assessed the KCAB in 1996, the FAA concluded that the KCAB was capable of overseeing Korean air carriers in accordance with ICAO safety standards, and Korea was therefore given a Category I rating (the highest rating of the three IASA categories). The FAA indicated that it would reassess a country that has air carriers operating into the United States if there was any reason to question whether that country was meeting its international safety oversight obligations. The substantial number of Korean Air crew-related accidents and incidents, the deficiencies in Korean Air’s pilot training program, and the lack of documented cockpit procedures suggest that Korean Air had not fully complied with the intent of paragraph 9.3.1 of ICAO Annex 6, which states that operators “shall establish and maintain a ground and flight training program...which ensures that all flight crew members are adequately trained to perform their assigned duties. [The training program] shall also include training in knowledge and skills related to human performance and limitations...[and] shall ensure that all flight crew members know the functions for which they are responsible and the relation of those functions to the functions of other crew members.” The reliability of the FAA’s assessment and rating of a country’s CAA under the IASA program is becoming ever more important in light of increases in code-sharing and other alliances involving U.S. and foreign carriers. U.S. carriers are likely to view a positive assessment by the FAA and the resulting Category I rating as an indication that the country’s airlines are receiving adequate oversight and are therefore maintaining an adequate level of safety. However, even though Korea had received and maintained a Category I rating, the evidence developed in this investigation (including that only two operations inspectors were assigned to Korean Air and that neither was type rated for the 747, as well as the deficiencies in the KCAB’s oversight of Korean Air) and Korean Air’s accident and incident record (both before and after the flight 801 crash) suggest that the FAA’s IASA program was not adequate in its scope and depth to determine the capacity of the KCAB to fully assess Korean Air’s level of safety or ensure that Korean Air was

Analysis 169 Aircraft Accident Report receiving adequate oversight. The Department of Transportation Office of Inspector General’s (DOT/IG) audit report, titled Aviation Safety Under International Code Share Agreements, reached a similar conclusion. The DOT/IG report noted that the FAA’s assessment under the IASA program “is quite different from a judgment about the safety practices of an individual carrier.” The report further noted that the “FAA is itself a civil aviation authority that meets international standards, but that is materially different from a conclusion that all U.S. carriers therefore follow sound safety practices.” The Safety Board concludes that the FAA’s IASA program (which evaluates a foreign CAA’s ability to provide adequate oversight for its air carriers) is not adequate to determine whether foreign air carriers operating into the United States are maintaining an adequate level of safety. The Board notes that the DOT/IG’s audit report recommended that U.S. carriers perform safety assessments of foreign carriers as a condition of approval to enter into code share agreements and that the FAA should consider the results of those assessments when performing IASA reviews. Further, the Safety Board believes that the FAA should consider the accident and incident history of foreign air carriers as a factor when evaluating the adequacy of a foreign CAA’s oversight and whether a reassessment may be warranted. 2.9.3.1 Independent Accident Investigation Authority The entity responsible for investigating aviation accidents and incidents in Korea is an office within the KCAB known as the Aviation Safety Division. Thus, Korea has no independent accident investigation authority. Experience has shown that an accident investigation authority that is not independent of the regulatory authority may not be as objective as necessary to identify and recommend changes. A proper accident investigation requires a review of the practices and procedures of the responsible regulatory agency and their possible role in the accident. Because the results of such an assessment may necessitate conclusions and recommendations that are critical of, or adverse to, the regulatory agency or its officials, many countries have concluded that no accident investigation entity could fully perform such a function unless it was separate and independent from the regulatory agency. Annex 13 to the Convention on International Civil Aviation (paragraph 5.4) states that “the accident investigation authority shall have independence in the conduct of the investigation and have unrestricted authority over its conduct.” On November 21, 1994, the Council of the European Union (EU) adopted a directive that specifies that EU Member States shall ensure, by November 21, 1996, that aviation accident and serious incident investigations are conducted or supervised by a permanent body or entity that is functionally independent of the national aviation authorities responsible for regulation and oversight of the aviation system. All EU members have complied with, or are in the process of complying with, the intent of this directive.229 The Safety Board concludes that an independent accident investigation authority, charged with making objective conclusions and recommendations, is a benefit to transportation safety.

Analysis 170 Aircraft Accident Report 2.10 Flight Data Recorder Documentation The Safety Board was unable to validate data from 11 retrofitted sensors on the accident airplane’s FDR because Korean Air lacked complete and accurate documentation information for them. Although the data from the retrofitted sensors were not critical in the investigation of this accident, the data might have been important under other accident circumstances. For FDR data to be useful during an accident investigation, accurate documentation that is readily available to investigators after an accident is needed. After taking delivery of an airplane from a manufacturer, many airlines provide additional data to be recorded on the FDR by retrofitting the airplane with additional sensors or recording additional data from a flight data acquisition unit. Such retrofits are often mandated by the governing CAA. In addition to the flight 801 accident, the Safety Board has investigated several other recent accidents in which airlines were unable to provide accurate and complete information from a retrofitted FDR because the airlines were unable to provide FDR documentation necessary for a complete and thorough readout.230 Thus, the Safety Board often lacked critical data for a reconstruction of the airplane’s motion and the flight crew’s performance, which prolonged some investigations. The Safety Board has long been concerned about inadequate FDR documentation. Since the early 1970s, the Board has made recommendations to improve FDR data verification and documentation. In 1991, concerns about the airworthiness of FDRs resulted in two safety recommendations to the FAA (A-91-23 and -24) aimed at developing a permanent policy for FDR maintenance and record-keeping. Safety Recommendation A-97-30 asked the FAA to publish, by January 1998, a promised AC addressing the installation and maintenance of FDRs. On October 5, 1999, the FAA issued AC 20-141, “Airworthiness and Operational Approval of Digital Flight Data Recorder Systems.” The purpose of the AC is to provide “guidance on design, installation, and continued airworthiness of Digital Flight Data Recorder Systems.” Appendix 1 to the AC, “Standard Data Format for Digital Flight Data Recorder Data Stream Format and Correlation Documentation,” provides “a standard for the data stream format and correlation documentation that operators must maintain to aid accident investigators in interpreting recorded flight data.” The appendix details how to develop a document for each airplane that would provide the detailed information needed by Safety Board investigators to transcribe each parameter recorded by an FDR. 229 The FAA does not assess a country’s compliance with any of the provisions of Annex 13, which addresses accident and incident investigation standards and practices. However, the Safety Board notes that, during the Accident Investigation Group (AIG) divisional meeting held by ICAO from September 14 to 24, 1999, AIG delegates adopted a recommendation for the ICAO Council to take steps to expand the ICAO safety oversight audit program to include an assessment of a country’s compliance with Annex 13. (The program currently assesses a country’s compliance with Annexes 1, 6, and 8.) 230 See section 1.18.7.1 for a listing of these accidents.

Analysis 171 Aircraft Accident Report The Safety Board is concerned that AC 20-141 was not finalized until more than 8 years after the issuance of Safety Recommendations A-91-23 and -24. Nonetheless, the Board is pleased that the AC is now final and that it will provide airlines with critical and necessary guidance to properly document FDR parameters and systems. As a result, information from FDRs will be provided in the format needed by the Board for a complete and accurate readout. In addition to AC 20-141, ICAO Annex 6, Part I, “International Commercial Air Transport—Aeroplanes,” includes Attachment D, Flight Recorders. Section 3 of the attachment, entitled “Inspections of flight data and cockpit voice recorder systems,” provides guidance to Member States on the continued airworthiness of FDR systems, such as details on how to conduct annual checks of every FDR parameter, including recorded signal and transcribed engineering units. Paragraph 3.2.c states that “a complete flight from the FDR should be examined in engineering units to evaluate the validity of all recorded parameters.” In addition, paragraph 3.2.d states “the readout facility should have the necessary software to accurately convert the recorded values to engineering units and to determine the status of discrete signals.” If Korean Air had been following this ICAO guidance and performing annual checks on all of the FDR parameters for the accident airplane, the airline would have been able to determine the conversion equations necessary to complete an FDR readout or would have been able to discover and correct the FDR parameter documentation discrepancies. As the number of international flights increases, the possibility of accidents involving foreign aircraft within the United States also increases. The Safety Board concludes that it is critical that thorough documentation of the information recorded by an FDR be available for foreign- or U.S.-registered air transport airplanes that fly into or out of the United States. In accordance with the interagency group on international aviation protocol, the Board will introduce AC 20-141 at the next ICAO flight recorder panel meeting, with a proposal that the AC be adopted as the international standard and recommended practice for FDR systems.

172 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. After the flight crew made an initial sighting of Guam, Korean Air flight 801 encountered instrument meteorological conditions as the flight continued on its approach to Guam International Airport. 2. Although flight 801 likely exited a heavy rain shower shortly before the accident, the flight crew was still not able to see the airport because of the presence of another rain shower located between Nimitz Hill and the airport. 3. By not fully briefing the instrument approach, the captain missed an opportunity to prepare himself, the first officer, and the flight engineer for the relatively complex localizer-only approach and failed to provide the first officer and flight engineer with adequate guidance about monitoring the approach; therefore, the captain’s approach briefing was inadequate. 4. The captain’s expectation of a visual approach was a factor in his incomplete briefing of the localizer approach. 5. For flights conducted at night or when there is any possibility that instrument meteorological conditions may be encountered, the failure to fully brief an available backup instrument approach compromises safety. 6. The Korean Air airport familiarization video for Guam, by emphasizing the visual aspects of the approach, fostered the expectation by company flight crews of a visual approach and, by not emphasizing the terrain hazards and offset DME factors, did not adequately prepare flight crews for the range of potential challenges associated with operations into Guam. 7. The challenges associated with operations to Guam International Airport support its immediate consideration as a special airport requiring special pilot qualifications. 8. Although the captain apparently became confused about the glideslope’s status, the flight crew had sufficient information to be aware that the glideslope was unusable for vertical guidance and should have ignored any glideslope indications while executing the nonprecision localizer-only approach. 9. Navigation receivers, including glideslope receivers, may be susceptible to spurious radio signals.

Conclusions 173 Aircraft Accident Report

1. The captain may have mistakenly believed that the airplane was closer to the airport

than its actual position; however, if the captain conducted the flight’s descent on this basis, he did so in disregard of the DME fix definitions shown on the approach chart.

1. As a result of his confusion and preoccupation with the status of the glideslope,

failure to properly cross-check the airplane’s position and altitude with the information on the approach chart, and continuing expectation of a visual approach, the captain lost awareness of flight 801’s position on the instrument landing system localizer-only approach to runway 6L at Guam International Airport and improperly descended below the intermediate approach altitudes of 2,000 and 1,440 feet, which was causal to the accident.

1. The first officer and flight engineer noted the ground proximity warning system

(GPWS) callouts and the first officer properly called for a missed approach, but the captain’s failure to react properly to the GPWS minimums callout and the direct challenge from the first officer precluded action that might have prevented the accident.

1. The first officer and flight engineer failed to properly monitor and/or challenge the

captain’s performance, which was causal to the accident.

1. Monitored approaches decrease the workload of the flying pilot and increase flight

crew interaction, especially when experienced captains monitor and prompt first officers during the execution of approaches.

1. The captain was fatigued, which degraded his performance and contributed to his

failure to properly execute the approach.

1. Korean Air’s training in the execution of nonprecision approaches was ineffective,

which contributed to the deficient performance of the flight crew.

1. U.S. air carrier pilots would benefit from additional training and practice in

nonprecision approaches during line operations (in daytime visual conditions in which such a practice would not add a risk factor).

1. The Combined Center/Radar Approach Control controller’s performance was

substandard in that he failed to provide the flight crew with a position advisory when he cleared the flight for the approach, inform the flight crew or the Agana tower controller that he had observed a rain shower on the final approach path, and monitor the flight after the frequency change to the tower controller.

1. Strict adherence to air traffic control procedures by the Combined Center/Radar

Approach Control controller may have prevented the accident or reduced its severity.

Conclusions 174 Aircraft Accident Report

1. If the ARTS IIA minimum safe altitude warning system had been operating as

initially intended, a visual and aural warning would have activated about 64 seconds before flight 801 impacted terrain, and this warning would have likely alerted the Combined Center/Radar Approach Control controller that the airplane was descending below the minimum safe altitude for that portion of the approach.

1. Sixty-four seconds would have been sufficient time for the Combined Center/Radar

Approach Control controller to notify the Agana tower controller of the low-altitude alert, the tower controller to convey the alert to the crew of flight 801, and the crew to take appropriate action to avoid the accident.

1. The Federal Aviation Administration’s quality assurance for the minimum safe

altitude warning system was inadequate, and the agency’s intentional inhibition of that system contributed to the flight 801 accident.

1. A substantial portion of the delayed emergency response was caused by preventable

factors.

1. The delayed emergency response hampered the timely evacuation of injured persons,

and at least one passenger who survived the initial impact and fire might not have died if emergency medical responders had reached the accident site sooner.

1. Improved formal coordination among Guam’s emergency response agencies has not

been implemented, and off-airport drills to identify and correct deficiencies in disaster response planning before an accident occurs have still not been conducted in the more than 2 years since the flight 801 accident.

1. Actions taken by Guam’s emergency response agencies after the accident have been

inadequate because they failed to ensure that emergency notifications and responses would be timely and coordinated.

1. Controlled flight into terrain accident awareness and avoidance training is an

important accident reduction strategy and should be mandatory for all pilots operating under 14 Code of Federal Regulations Part 121.

1. By providing vertical guidance along a constant descent gradient to the runway, the

use of on-board flight management system- and/or global positioning system-based equipment can provide most of the safety advantages of a precision approach during a nonprecision approach.

1. The safety of executing a nonprecision approach using the constant angle of descent,

or stabilized descent technique, would be enhanced by adding to approach charts the cross-referenced altitudes versus distance from the airport.

1. Terrain depiction on the profile view of approach charts could result in increased

flight crew awareness of significant terrain on the approach path.

Conclusions 175 Aircraft Accident Report

1. Valuable user group reviews of proposed new instrument procedures are hampered by

the format in which the information is disseminated; thus, user groups may not be able to effectively evaluate whether a procedure is safe, accurate, and intelligible.

1. At the time of the flight 801 accident, there were underlying systemic problems

within Korean Air’s operations and pilot training programs that indicated the need for a broad safety assessment of these programs.

1. The Korean Civil Aviation Bureau was ineffective in its oversight of Korean Air’s

operations and pilot training program.

1. The Federal Aviation Administration’s International Aviation Safety Assessment

program (which evaluates a foreign civil aviation authority’s ability to provide adequate oversight for its air carriers) is not adequate to determine whether foreign air carriers operating into the United States are maintaining an adequate level of safety.

1. An independent accident investigation authority, charged with making objective

conclusions and recommendations, is a benefit to transportation safety.

1. It is critical that thorough documentation of the information recorded by a flight data

recorder be available for foreign- or U.S.-registered air transport airplanes that fly into or out of the United States. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the captain’s failure to adequately brief and execute the nonprecision approach and the first officer’s and flight engineer’s failure to effectively monitor and cross-check the captain’s execution of the approach. Contributing to these failures were the captain’s fatigue and Korean Air’s inadequate flight crew training. Contributing to the accident was the Federal Aviation Administration’s intentional inhibition of the minimum safe altitude warning system at Guam and the agency’s failure to adequately manage the system.

176 Aircraft Accident Report 4. Recommendations As a result of the investigation of the Korean Air flight 801 accident, the National Transportation Safety Board makes recommendations to the Federal Aviation Administration, the Governor of the Territory of Guam, and the Korean Civil Aviation Bureau. To the Federal Aviation Administration: Require principal operations inspectors assigned to U.S. air carriers to ensure that air carrier pilots conduct a full briefing for the instrument approach (if available) intended to back up a visual approach conducted at night or when instrument meteorological conditions may be encountered. (A-00-7) Consider designating Guam International Airport as a special airport requiring special pilot qualifications. (A-00-8) Disseminate information to pilots, through the Aeronautical Information Manual, about the possibility of momentary erroneous indications on cockpit displays when the primary signal generator for a ground-based navigational transmitter (for example, a glideslope, VOR, or nondirectional beacon transmitter) is inoperative. Further, this information should reiterate to pilots that they should disregard any navigation indication, regardless of its apparent validity, if the particular transmitter was identified as unusable or inoperative. (A-00-9) Conduct or sponsor research to determine the most effective use of the monitored approach method and the maximum degree to which it can be safely used and then require air carriers to modify their procedures accordingly. (A-00-10) Issue guidance to air carriers to ensure that pilots periodically perform nonprecision approaches during line operations in daytime visual conditions in which such practice would not add a risk factor. (A-00-11) Develop a mandatory briefing item for all air traffic controllers and air traffic control (ATC) managers, describing the circumstances surrounding the performance of the Combined Center/Radar Approach Control controller in this accident to reinforce the importance of following ATC procedures. (A-00-12)

Recommendations 177 Aircraft Accident Report Require that all air carrier airplanes that have been equipped with on-board navigational systems capable of providing vertical flightpath guidance make use of these systems for flying nonprecision approaches whenever terrain factors allow a constant angle of descent with a safe gradient. (A-00-13) Require, within 10 years, that all nonprecision approaches approved for air carrier use incorporate a constant angle of descent with vertical guidance from on-board navigation systems. (A-00-14) Include, in nonprecision approach procedures, tabular information that allows pilots to fly a constant angle of descent by cross-referencing the distance from the airport and the barometric altitude. (A-00-15) Evaluate the benefits of depicting terrain and other obstacles along a specific approach path on the profile view of approach charts and require such depiction if the evaluation demonstrates the benefits. (A-00-16) Provide user groups, along with Federal Aviation Administration Form 8260, draft plan and profile views of instrument procedures to assist the groups in effectively evaluating proposed new procedures. (A-00-17) Consider the accident and incident history of foreign air carriers as a factor when evaluating the adequacy of a foreign civil aviation authority’s oversight and whether a reassessment may be warranted. (A-00-18) To the Governor of the Territory of Guam: Form, within 90 days, a task force comprising representatives from all emergency response agencies on the island, including the appropriate departments within the government of Guam, Federal Aviation Administration, Guam International Airport Authority, U.S. Navy, U.S. Air Force, U.S. Coast Guard, Federal Emergency Management Agency, and all other affected agencies, to define and coordinate emergency notification and response procedures to ensure that timely emergency notifications are made to all local and Federal agencies according to need, location, and response time capability. (A-00-19) Require periodic and regularly scheduled interagency disaster response exercises, including an off-airport aircraft accident scenario, in addition to those response drills already required at Guam International Airport in accordance with 14 Code of Federal Regulations Section 139.325. (A-00-20)

Recommendations 178 Aircraft Accident Report To the Korean Civil Aviation Bureau: Require Korean Air to revise its video presentation for Guam to emphasize that instrument approaches should also be expected and describe the complexity of such approaches and the significant terrain along the approach courses and in the vicinity of the airport. (A-00-21) Vice Chairman Francis requested that the following concurring statement be added to this report: “I concur in the report on Korean Air flight 801—a classic controlled-flight-into- terrain accident. I am troubled, however, by the failure to include a recommendation that urges (1) timely installation of terrain awareness and warning systems in accordance with the FAA’s reasonable proposed schedule; (2) avoidance of any delay in the proposed regulatory schedule; and (3) encouragement by the FAA to aircraft operators to install this critical safety device in advance of the proposed regulatory timetable.” BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member ROBERT T. FRANCIS II Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member January 13, 2000

179 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing Investigation The Safety Board was initially notified of this accident about 1200 eastern standard time on August 5, 1997 (about 0300 Guam local time on August 6). A full go-team was assembled and departed that evening from Andrews Air Force Base in Maryland for Fairchild Air Force Base in Washington. At Fairchild, the team boarded another airplane and arrived in Guam about 0830 Guam local time on August 7, 1997. Accompanying the team to Guam was Board Member George Black. The following investigative teams were formed: Operations, Human Performance, Aircraft Structures, Aircraft Systems, Powerplants, Maintenance Records, Air Traffic Control, Survival Factors, Aircraft Performance, Meteorology, and Search/Fire/Rescue. Specialists were also assigned to conduct the readout of the flight data recorder (FDR) and transcribe the cockpit voice recorder (CVR) in the Safety Board’s laboratory in Washington, D.C. The initial CVR transcript was produced in English. However, the CVR group subsequently produced a more detailed transcript in both the English and Korean languages. Parties to the investigation were the Federal Aviation Administration (FAA); Korean Air Company, Ltd.; Boeing Commercial Airplanes Group; Pratt & Whitney; the National Air Traffic Controllers Association; and Serco Aviation Services, Inc. Assistance was also provided by the U.S. Navy and emergency response personnel in Guam. In addition, an official from the Korean Civil Aviation Bureau (KCAB) was designated as the Korean Accredited Representative in accordance with the provisions of Annex 13 to the Convention on International Civil Aviation. Further, two air safety investigators from Australia’s Bureau of Air Safety Investigations participated in the investigation as technical observers. Hearing A public hearing was conducted for this accident on March 24 through 26, 1998, in Honolulu, Hawaii. Presiding over the hearing was Vice Chairman Robert Francis. Parties to the public hearing were the FAA; Serco Aviation Services; Korean Air; Guam Civil Defense, Fire Department, and Police Department; U.S. Navy; International Civil Aviation Organization (ICAO) Controlled Flight Into Terrain Steering Committee; AlliedSignal; Jeppesen Sanderson, Inc.; and the Air Line Pilots Association.

180 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is a transcript of the Fairchild model A-100A CVR installed on Korean Air flight 801 (a Boeing 747-300, HL7468), which crashed while approaching Guam International Airport on August 6, 1997. The CVR transcript reflects the final 31 minutes 1 second of the accident flight. Times are expressed in coordinated universal time (UTC time), which is 10 hours behind Guam local time. Only radio transmissions to and from the accident airplane were transcribed. Items that were stated either partially or completely in the Korean language are shown as two entries. The first, in bold type, is translated into the English language. The second is typed as if it were spoken in Korean and/or English. Items with only one entry were spoken entirely in English. LEGEND CAM Cockpit area microphone voice or sound source RDO Radio transmission from accident aircraft NAV Navigation signal identifiers heard through aircraft audio system PA Voice transmitted over aircraft public address system CTR Radio transmission from Guam center controller TWR Radio transmission from Guam tower controller GPWS Voice identified as aircraft mechanical voice -1 Voice identified as captain -2 Voice identified as first officer -3 Voice identified as flight engineer .? Voice unidentified • Unintelligible word #

Expletive

Break in continuity ( ) Questionable insertion [ ] Editorial insertion ..... Pause

Appendix B 181 Aircraft Accident Report

Appendix B 182 Aircraft Accident Report

Appendix B 183 Aircraft Accident Report

Appendix B 184 Aircraft Accident Report

Appendix B 185 Aircraft Accident Report

Appendix B 186 Aircraft Accident Report

Appendix B 187 Aircraft Accident Report

Appendix B 188 Aircraft Accident Report

Appendix B 189 Aircraft Accident Report

Appendix B 190 Aircraft Accident Report

Appendix B 191 Aircraft Accident Report

Appendix B 192 Aircraft Accident Report

Appendix B 193 Aircraft Accident Report

Appendix B 194 Aircraft Accident Report

Appendix B 195 Aircraft Accident Report

Appendix B 196 Aircraft Accident Report

Appendix B 197 Aircraft Accident Report

Appendix B 198 Aircraft Accident Report

Appendix B 199 Aircraft Accident Report

Appendix B 200 Aircraft Accident Report

Appendix B 201 Aircraft Accident Report

Appendix B 202 Aircraft Accident Report

Appendix B 203 Aircraft Accident Report

Appendix B 204 Aircraft Accident Report

Appendix B 205 Aircraft Accident Report

Appendix B 206 Aircraft Accident Report

Appendix B 207 Aircraft Accident Report

Appendix B 208 Aircraft Accident Report

209 Aircraft Accident Report Appendix C Flight Safety Foundation Study Recommendations The Flight Safety Foundation Approach and Landing Accident (ALA) Reduction Task Force made several recommendations to support each of its study’s nine conclusions (see section 1.18.3.1 for more information). The conclusions and recommendations are as follows: Conclusion 1: Establishing and adhering to adequate standard operating procedures (SOP) and crew resource management (CRM) processes will improve approach and landing safety. Recommendations: • States should mandate, and operators should develop and implement, SOPs for approach and landing operations. • Operators should develop SOPs that permit their practical application in a normal operating environment. The involvement of flight crews is essential in the development and evaluation of SOPs. Crews will adhere to SOPs that they help develop and understand. • Operators should implement routine and critical evaluation of SOPs to determine the need for change. • Operators should provide education and training that enhance flight crew decision-making and risk (error) management. • Operators should develop SOPs regarding the use of automation in approach and landing operations and train flight crews accordingly. • There should be a clear policy in all operators’ manuals regarding the role of the pilot-in-command (PIC) in complex and demanding flight situations. Training should address the practice of transferring pilot-flying duties during operationally complex situations. Conclusion 2: Improving communication and mutual understanding between air traffic control (ATC) services and flight crews of each other’s operational environment will improve approach and landing safety. ATC recommendations: • Introduce joint training programs that involve both ATC personnel and flight crews to promote mutual understanding of such issues as procedures, instructions, operational requirements, and limitations; improve controllers’ knowledge of the capabilities and limitations of advanced-technology flight decks; and foster improved communications and task management by pilots and controllers during emergency situations. • Ensure that controllers are aware of the importance of unambiguous information exchange, particularly during in-flight emergencies. The use of standard ICAO phraseology should be emphasized.

Appendix C 210 Aircraft Accident Report • Implement procedures that require immediate clarification or verification of transmissions from flight crews that indicate a possible emergency situation. • Implement procedures for ATC handling of aircraft in emergency situations to minimize flight crew distraction. • Implement, in cooperation with airport authorities and rescue services, unambiguous emergency procedures and common phraseology to eliminate confusion. • Develop, jointly with airport authorities and local rescue services, emergency training programs that are conducted on a regular basis. Flight crew recommendations: • Verify understanding of each ATC communication and request clarification when necessary. • Report accurately, using standard ICAO phraseology, the status of abnormal situations and the need for emergency assistance. Conclusion 3: Unstabilized and rushed approaches contribute to ALAs. Recommendations: • Operators should define the parameters of a stabilized approach in their flight operations manuals, including at least the following: intended flightpath, speed, power setting, attitude, sink rate, configuration, and crew readiness. • Company policy should state that a go-around is required if the aircraft becomes destabilized during the approach. • The implementation of certified constant angle, stabilized approach procedures for nonprecision approaches should be expedited globally. • Flight crews should be trained on the proper use of constant angle, stabilized approach procedures. Flight crews should also be educated on approach design criteria and obstacle clearance requirements. • Flight crews should “take time to make time” when the cockpit situation becomes confusing or ambiguous, which means climbing, holding, requesting vectors for delaying purposes, or performing a missed approach early. Conclusion 4: Failure to recognize the need for and to execute a missed approach, when appropriate, is a major cause of ALAs. Recommendations: • Company policy should specify well-defined go-around gates for approach and landing operations. Parameters should include visibility minima required before proceeding past the final approach fix or the outer marker, assessment at the final approach fix or the outer marker of crew and aircraft readiness for the approach, and minimum altitude at which the aircraft must be stabilized. • Companies should declare and support no-fault go-around and missed approach policies.

Appendix C 211 Aircraft Accident Report Conclusion 5: The risk of ALAs is higher in operations conducted during low light and poor visibility, on wet or otherwise contaminated runways, and with the presence of optical physiological illusions. Recommendations: • Flight crews should be trained in operations involving these conditions before being assigned line duties. • Flight crews should make operational use of a risk assessment tool or checklist to identify approach and landing hazards. Appropriate procedures should be implemented to mitigate the risks. • Operators should develop and implement constant angle, stabilized approach procedures to assist crews during approach operations. • Operators should develop and implement a policy for the use of appropriate levels of automation of navigation and approach aids for the approach being flown. Conclusion 6: Using the radio altimeter as an effective tool will help prevent ALAs. Recommendations: • Education is needed to improve crew awareness of radio altimeter operation and benefits. • Operators should install radio altimeters and activate “smart callouts” at 2,500, 1,000, and 500 feet; the altitude set in the decision height window; and 50, 40, 30, 20, and 10 feet for better crew terrain awareness. • Operators should state that the radio altimeter is to be used during approach operations and specify procedures for its use. Conclusion 7: When the PIC is the pilot flying and the operational environment is complex, the task profile and workload reduce the flying pilot’s flight management efficiency and decision-making capability in approach and landing operations. Recommendations: • Operators should develop a clear policy in their manuals defining the role of the PIC in complex and demanding flight situations. • Training should address the practice of transferring pilot flying duties during operationally complex situations.

Appendix C 212 Aircraft Accident Report Conclusion 8: Collection and analysis of in-flight parameters (for example, flight operations quality assurance programs) can identify performance trends that can be used to improve the quality of approach and landing operations. Recommendations: • Flight operations quality assurance should be implemented worldwide along with information-sharing partnerships, such as the Global Analysis and Information Network, British Airways Safety Information System, and FAA Aviation Safety Action Programs. • Examples of flight operations quality assurance benefits (safety improvements and cost reductions) should be widely publicized. • A process should be developed to bring flight operations quality assurance and information-sharing partnerships to regional airlines and business aviation. Conclusion 9: Global sharing of aviation information decreases the risk of ALAs. Recommendations: • Deidentification of aviation information data sources should be a “cardinal rule” in flight operations quality assurance and information-sharing processes. • Public awareness of the importance of information sharing must be increased through a coordinated, professional, and responsible process. The Flight Safety Foundation ALA task force said that its conclusions and recommendations “must be translated into industry action” according to the following principles: • cohesiveness across all aviation sectors and regions to participate jointly in the implementation process and • commitment to a significant awareness campaign that will ensure availability of this information to participants in approach and landing operations worldwide so that they can play a part in improving safety within their “spheres of influence.”

FD07222 ｜ 2000_美国_AAR0002.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 AIRCRAFT ACCIDENT REPORT 7047B PB2000-910402 NTSB/AAR-00/02 DCA97MA055 CRASH DURING LANDING FEDERAL EXPRESS, INC. MCDONNELL DOUGLAS MD-11, N611FE NEWARK INTERNATIONAL AIRPORT NEWARK, NEW JERSERY JULY 31, 1997

this page intentionally left blank

Aircraft Accident Report Crash During Landing Federal Express, Inc. McDonnell Douglas MD-11, N611FE Newark International Airport Newark, New Jersey July 31, 1997 NTSB/AAR-00/02 DCA97MA055 PB2000-910402 National Transportation Safety Board Notation 7047B 490 L’Enfant Plaza, S.W. Adopted July 25, 2000 Washington, D.C. 20594 E P L U R IB U S U N U M N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

National Transportation Safety Board. 2000. Crash During Landing Federal Express, Inc. McDonnell Douglas MD-11, N611FE, Newark International Airport, Newark, New Jersey, July 31, 1997. Aircraft Accident Report NTSB/AAR-00/02. Washington, DC. Abstract: This report explains the accident involving Federal Express flight 14, an MD-11, which crashed while landing on runway 22R at Newark International Airport, Newark, New Jersey, on July 31, 1997. Safety issues discussed in this report focus on landing techniques, bounced landing recovery, and training tools and policies that promote proactive decision-making to go around if an approach is unstabilized. Safety issues also include the use of on board computers to determine the required runway length for landing, MD-11 handling characteristics and structural integrity requirements, hard landing inspection requirements, and tracking hazardous materials. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2000-910402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

iii Aviation Accident Report Contents Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1 History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
3. 1.1 Airplane Performance During the Approach and Landing . . . . . . . . . . . . . . . . . . . 6
4. 1.2 Flight Crew and Witness Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5. 2 Injuries to Persons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
6. 3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
7. 4 Other Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
8. 5 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
9. 5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
10. 5.2 The First Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
11. 6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
12. 6.1 Airplane Maintenance and Incident History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
13. 6.2 Weight and Balance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
14. 7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
15. 8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
16. 9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
17. 10 Airport Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
18. 11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
19. 11.1 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
20. 11.2 Cockpit Voice Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
21. 12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
22. 13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
23. 14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
24. 15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
25. 15.1 Flight Crew and Passenger Egress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
26. 15.2 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
27. 16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
28. 16.1 Landing Gear Energy and Load Limit Certification . . . . . . . . . . . . . . . . . . . . . . 24
29. 16.2 Dynamic Failure Simulation of MD-11 Right Wing

Structure and Right Main Landing Gear Assembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.16.3 Tests of Airplane Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.18.1 Dissemination of Hazardous Materials Information . . . . . . . . . . . . . . . . . . . . . . 32 1.18.2 Cargo Operator Review and FedEx Postaccident Actions . . . . . . . . . . . . . . . . . 36 1.18.3 FedEx MD-11 Tailstrike Awareness and Training Initiatives . . . . . . . . . . . . . . 37 1.18.4 MD-11 Hard Landing Accident at Hong Kong International Airport . . . . . . . . 41 1.18.5 DC-10 Hard Landing Accident in Faro, Portugal . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.18.6 Lockheed L-1011 Hard Landing Accident in New York . . . . . . . . . . . . . . . . . . 43

Contents iv Aviation Accident Report 1.18.7 Other Landing Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.18.8 Safety Board Recommendations Relating to DC-10 and MD-11 Spoiler Pitch-up Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.18.9 MD-11 Flight Control Computer Software Changes . . . . . . . . . . . . . . . . . . . . . . 49

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
2. 1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
3. 2 Accident Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
4. 2.1 Airplane Performance During the Approach and Landing . . . . . . . . . . . . . . . . . . 52
5. 2.2 Flight Crew Factors During the Approach and Landing . . . . . . . . . . . . . . . . . . . . 55
6. 3 MD-11 Handling Characteristics and Flight Control System Design . . . . . . . . . . . . . . 62
7. 3.1 MD-11 Nose-Up Pitching Moment Because

of Ground Spoiler Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 2.3.2 MD-11 Pitch Handling Characteristics and the FCC-908 Software Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 2.3.3 Digital Flight Data Recorder Update Required by FCC-908 . . . . . . . . . . . . . . . . 63 2.3.4 MD-11 Ground Spoiler Knockdown Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 2.4 Transport-Category Airplane Stability and Control During the Landing Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 2.5 Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 2.5.1 Right-Wing Structural Design and Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 2.5.2 Landing Gear Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 2.6 Hazardous Materials Information Dissemination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
2. 1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
3. 2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
4. Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
5. 1 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
6. 2 Previously Issued Recommendations Classified in This Report . . . . . . . . . . . . . . . . . . . 74
7. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

A: Investigation and Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 C: Excerpts from the Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 D: Prior Incident Flight Data Recorder Data for the Accident Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 E: FedEx Tail Strike Awareness Information Bulletin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 F: FedEx Tail Strike Awareness Training Instructor’s Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

v Aircraft Accident Report Figures

1. Aerial view of the accident site. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. N611FE at the height of the firefighting effort. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. N611FE during the final portion of the firefighting effort. . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. N611FE after the fire was extinguished. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
5. Comparison of selected FDR parameters for accident landing and

previous two landings (correlated by radio altitude – 50 feet). . . . . . . . . . . . . . . . . . . . . . 7

1. Comparison of selected FDR parameters for accident landing and

previous two landings (correlated by first touchdown). . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1. Wreckage distribution diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2. Right MLG components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3. Boeing calculations of right MLG energy in the Newark accident. . . . . . . . . . . . . . . . . 28
4. Boeing calculations of right MLG energy in the Faro accident. . . . . . . . . . . . . . . . . . . . 43
5. Boeing calculations of right MLG energy in the TWA L-1011 accident. . . . . . . . . . . . . 45

this page intentionally left blank

vii Aircraft Accident Report Abbreviations ABS automatic brake system AC advisory circular agl above ground level AGS automatic ground spoiler ANC Anchorage International Airport AND airplane nose-down ANPRM advance notice of public rulemaking ANU airplane nose-up APLC airport performance laptop computer ARFF aircraft rescue and firefighting ATP airline transport pilot AWAB automated weight and balance CAWS central aural warning system CFR Code of Federal Regulations c.g. center of gravity CHEMTREC Chemical Transportation Emergency Center CVR cockpit voice recorder DEP Department of Environmental Protection DFDR digital flight data recorder DG dangerous goods DGAC Director-General of Civil Aviation EWR Newark International Airport FAA Federal Aviation Administration FCC flight control computer FCOM flight crew operating manual FCP flight control panel FDR flight data recorder FedEx Federal Express, Inc. FL flight level FMC flight management computer FMS flight management system fpm feet per minute fps feet per second FSAT flight standards information bulletin for air transportation

Abbreviations viii Aircraft Accident Report g acceleration of gravity GOCC Global Operations Command Center HMRU Hazardous Materials Response Unit ICAO International Civil Aviation Organization ILS instrument landing system IRU inertial reference unit KIAS knots indicted airspeed LASE low altitude stability enhancement LSAS longitudinal stability augmentation system MAX maximum MDI Mechanical Dynamics, Inc. MED medium MEL minimum equipment list MLG main landing gear msl mean sea level NASA National Aeronautics and Space Administration NFD Newark Fire Department NOTOC notification to captain NOTAM notice to airmen NPRM notice of proposed rulemaking PAP pitch attitude protection PIO pilot-induced oscillation PNL pitch nose lowering POI principal operations inspector PRD pitch rate damper RSPA Research and Special Programs Administration sm statute miles SN serial number STA station TRA throttle resolver angle TWA Trans World Airlines UN United Nations V1 takeoff decision speed V2 takeoff safety speed VASI visual approach slope indicator Vref reference speed WS wing station

ix Aircraft Accident Report Executive Summary On July 31, 1997, about 0132 eastern daylight time, a McDonnell Douglas MD-11, N611FE, operated by Federal Express, Inc., (FedEx) as flight 14, crashed while landing on runway 22R at Newark International Airport, Newark, New Jersey (EWR). The regularly scheduled cargo flight originated in Singapore on July 30 with intermediate stops in Penang, Malaysia; Taipei, Taiwan; and Anchorage, Alaska. The flight from Anchorage International Airport to EWR was conducted on an instrument flight rules flight plan and operated under the provisions of 14 Code of Federal Regulations Part 121. On board were the captain and first officer, who had taken over the flight in Anchorage for the final leg to EWR, one jumpseat passenger, and two cabin passengers. All five occupants received minor injuries in the crash and during subsequent egress through a cockpit window. The airplane was destroyed by impact and a postcrash fire. The National Transportation Safety Board determines that the probable cause of this accident was the captain’s overcontrol of the airplane during the landing and his failure to execute a go-around from a destabilized flare. Contributing to the accident was the captain’s concern with touching down early to ensure adequate stopping distance. Safety issues discussed in this report focus on landing techniques, bounced landing recovery, and training tools and policies that promote proactive decision-making to go around if an approach is unstabilized. Safety issues also include the use of on board computers to determine the required runway length for landing, MD-11 handling characteristics and structural integrity requirements, and hard landing inspection requirements. Tracking hazardous materials continues to be a safety issue and is also discussed in the report. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On July 31, 1997, about 0132 eastern daylight time,1 a McDonnell Douglas MD-11,2 N611FE, operated by Federal Express, Inc., (FedEx) as flight 14, crashed while landing on runway 22R at Newark International Airport (EWR), Newark, New Jersey. The regularly scheduled cargo flight originated in Singapore on July 30 with intermediate stops in Penang, Malaysia; Taipei, Taiwan; and Anchorage, Alaska. The flight from Anchorage International Airport (ANC), Anchorage, Alaska, to EWR was conducted on an instrument flight rules flight plan and operated under provisions of 14 Code of Federal Regulations (CFR) Part 121. On board were the captain and first officer, who had taken over the flight in Anchorage for the final leg to EWR, one jumpseat passenger, and two cabin passengers.3 All five occupants received minor injuries in the crash and during subsequent egress through a cockpit window. The airplane was destroyed by impact and a postcrash fire (see figures 1 through 4). According to flight plan and release documents, the airplane was dispatched to ANC with the No. 1 (left engine) thrust reverser inoperative.4 The flight plan time from ANC to EWR was 5 hours and 51 minutes—47 minutes shorter than the scheduled time of 6 hours and 38 minutes because of 45-knot tail winds en route. The flight crew stated that at flight level (FL) 330 (about 33,000 feet mean sea level [msl]), the flight from ANC to EWR was routine and uneventful. At 0102:11, a Federal Aviation Administration (FAA) Boston Air Route Traffic Control Center air traffic controller instructed flight 14 to descend and maintain FL 180, according to the airplane’s cockpit voice recorder (CVR).5 About 0103, the captain and first officer discussed the approach and landing to runway 22R and the airplane’s landing performance.6 Using the airport performance laptop computer (APLC),7 the first officer 1 Unless otherwise indicated, all times are eastern daylight time based on a 24-hour clock. 2 Boeing Commercial Airplane Group acquired the holdings of Douglas Aircraft Company and McDonnell Douglas in 1997. The MD-11 was developed by McDonnell Douglas as a follow-on to the DC-10, which first flew in 1970. According to Jane’s All the World’s Aircraft, the MD-11, which was granted a type certificate on November 8, 1990, has, among many design changes, a longer fuselage, a redesigned tailplane, winglets above and below the wingtips, and advanced cockpit instrumentation. 3 The jumpseat passenger was a pilot for another airline, and the two cabin passengers were FedEx employees. 4 A jet engine thrust reverser deflects airflow in the forward direction to help reduce the airplane’s speed after touchdown. Maintenance personnel at ANC deactivated the No. 1 thrust reverser after finding a delaminated door on it. Flight 14’s departure with an inoperative thrust reverser was approved under provisions of the airplane’s minimum equipment list (MEL). The MEL is developed by each operator of an aircraft and must be equivalent to or more conservative than the master MEL, which is developed by the manufacturer and approved by the FAA. 5 See appendix B for a transcript of the recording.

Factual Information 2 Aircraft Accident Report determined that the airplane’s runway stopping distance would be approximately 6,080 feet using medium (MED) autobrakes. According to the CVR, at 0103:33, the flight crew then compared the APLC approximate landing distance for MED braking (6,080 feet) to the after-glideslope touchdown distance (6,860 feet) provided on the instrument approach plate.8 Based on the flight crew's calculation (6,860 – 6,080), MED braking provided a 780-foot margin after stopping.9 The flight crew then compared the APLC approximate landing distance for maximum (MAX) braking (5,030 feet) to the same 6,860-foot after-glideslope touchdown distance provided on the instrument approach plate. Based on the flight crew's calculation (6,860 – 5,030), MAX braking provided a 1,830-foot margin after stopping.10 On the basis of these calculations, the first officer suggested using MAX autobrakes. The captain agreed, stating “we got a lot of stuff going 6 Runway 22R is 1,100 feet shorter than runway 22L, which was closed (see section 1.10 for a discussion of airport information). 7 As an airplane approaches the landing airport, pilots enter several parameters (for example, weather information and airplane weight) into the APLC, which generates landing data, including the approximate landing distances for usable runways at a selected airport. Figure 1. Aerial view of the accident site. 8 The APLC approximate landing distance is intended to be compared with the APLC runway distance, which, in this case, is 7,760 feet. 9 Based on APLC data (7,760 – 6,080), MED braking would have provided a 1,680-foot margin after stopping. 10 Based on APLC data (7,760 – 5,030), MAX braking would have provided a 2,730-foot margin after stopping. Following the accident, FedEx expanded the APLC training presentation that was originally included in initial and upgrade training. This expanded presentation has also been added to recurrent training programs.

Factual Information 3 Aircraft Accident Report Figure 2. N611FE at the height of the firefighting effort. Figure 3. N611FE during the final portion of the firefighting effort.

Factual Information 4 Aircraft Accident Report against us here so we’ll…start with max.” The first officer added, “I mean…I mean if we don’t have the reverser.” At 0114:22, the captain asked the first officer to advise the passengers that “we’re gonna have a pretty abrupt stop because of those brakes and the thrust reversers and all that stuff.” Twice during the approach, the captain asked the first officer to remind him to only use the No. 2 and No. 3 thrust reversers.11 At 0116:16, the captain noted that the left landing light was inoperative, adding “… just the right’s working.” 12 The EWR tower controller cleared flight 14 to land at 0129:45 and advised the flight crew “winds two five zero at five.” At 0130:02, the first officer stated “max brakes” during the before-landing checklist. The captain replied “max brakes will be fine,” and the first officer responded “if they work.”13 At 0130:34, the captain stated “[landing gear] down in four green” and called for “flaps fifty.” Figure 4. N611FE after the fire was extinguished. 11 At 0102:22, during the approach briefing, the captain stated “ah…remind me to, we just want two and three for reverse.” At 0130:59, the captain stated “two and three on reverse…just in case I forget.” The No. 3 thrust reverser can be deployed on main gear spinup. The No. 2 thrust reverser cannot be deployed until after nose gear touchdown. 12 Landing lights are located on the fuselage aft of the L1 and R1 cabin doors. According to the MEL, flights can be conducted at night with inoperative landing lights if the nose gear lights are functioning. The captain told National Transportation Safety Board investigators that the inoperative left landing light did not affect his ability to judge sink rate and land the airplane.

Factual Information 5 Aircraft Accident Report At 0130:45, the captain disengaged the autopilot at an altitude of 1,200 feet during the approach and “hand flew” the airplane to touchdown. The autothrottles were engaged, as recommended by McDonnell Douglas and FedEx procedures.14 According to information from the airplane’s flight data recorder (FDR), the approach was flown on the glideslope and localizer until touchdown,15 and the airplane’s approach airspeed was about 158 knots until the flare. According to the CVR, the pilots had selected an approach reference speed of 157 knots, or Vref plus 5 knots.16 Altitude callouts were made by the on board central aural warning system (CAWS) at 1,000 feet and 500 feet, and the first officer called out minimums (211 feet) at 0132:03. At 0132:09, the first officer stated “brakes on max,” and CAWS callouts followed for 100, 50, 40, 30, 20, and 10 feet until the sound of initial touchdown at 0132:18.75. One-half second later, the CVR recorded an expletive by the captain. At 0132:20.26, the CVR recorded increasing high-frequency tones consistent with engine spool-up (accelerating engine rpms), and at 0132:21.06, the CVR recorded a decrease in high-frequency tones consistent with engine spool-down. The sound of a “loud thump” consistent with another touchdown was recorded at 0132:21.62. A series of expletives by the captain and first officer followed until sounds of “metallic breakup” were recorded at 0132:27. FDR data indicated that after the airplane’s initial touchdown, it became airborne and rolled to the right as it touched down again (see section 1.1.1 for a detailed description of the airplane’s performance during the landing sequence). The airplane continued to roll as it slid down the runway, coming to rest inverted about 5,126 feet beyond the runway threshold and about 580 feet to the right of the runway centerline. The accident occurred during the hours of darkness. Visual meteorological conditions prevailed at the time of the accident. 13 The MD-11’s autobrakes, or automatic brake system (ABS), automatically apply brakes during landing and rejected takeoff. The takeoff mode is armed by selecting “T.O. [takeoff] with the AUTO BRAKE selector,” according to the MD-11 flight crew operating manual (FCOM). The ABS landing mode is armed after the gear is down. The accident airplane’s maintenance logs contained three write-ups about instances in which the autobrakes failed to arm at takeoff or failed to function properly on landing. Maintenance personnel checked the system after each reported failure but found no anomalies. The captain told Safety Board investigators that he discussed the reliability of the autobrakes with the first officer in ANC and elected to execute a MAX power takeoff because of the possibility of autobrake failure in the takeoff mode. However, he added that the autobrakes performed normally on takeoff in ANC. He stated that he kept the possibility of autobrake failure in mind when planning for landing at EWR. 14 During the approach, the captain selected APPROACH LAND and FMS SPEED rather than selecting SPEED SELECT on the flight control panel (FCP) of the flight management system (FMS). In the FMS SPEED mode, the flight management computer (FMC) adjusts the airplane’s speed in relation to configuration changes (for example, leading edge slat, flap, and landing gear extension). In the SPEED SELECT mode, the captain would have had to adjust the airplane’s speed after each configuration by changing the speed on the FCP. 15 The first officer told Safety Board investigators that runway 22R’s three-bar visual approach slope indicator (VASI) was in operation and visible from the cockpit. He stated that during the approach, the airplane was on the lower path of the VASI system, or red-red-white. Three-bar VASI installations provide two visual glidepaths. The lower glidepath, provided by the near and middle bars, is normally set at 3°. The upper glidepath, provided by the middle and far bars, is normally set 1/4 degree higher. 16 Vref, in this case, was a target or reference approach speed. Reference approach speeds are typically about 1.35 Vso (stalling speed with flaps in the landing configuration).

Factual Information 6 Aircraft Accident Report 1.1.1 Airplane Performance During the Approach and Landing The National Transportation Safety Board used FDR and CVR information, radar data,17 and integrated vertical speed and position data to develop a time history of the accident airplane’s performance and flight crew control inputs during final approach and landing (see appendix C).18 Excerpts from the FDR are presented in figures 5 and 6 for comparison to the accident airplane’s two previous landings. According to FDR and radar data, the airplane was stabilized on the approach, with flaps set at 50° and the landing gear down. The airspeed was between 157 knots and 159 knots indicated airspeed (KIAS), and the vertical speed was about 800 feet per minute (fpm). Pitch attitude was about 2° to 3° airplane nose-up (ANU) and throttle resolver (lever) angles (TRA) 19 were between 55° and 58° until flare was initiated at 38 feet radio altitude.20 After the flare was initiated, pitch attitude increased to 4.9°, TRA and airspeed decreased, and vertical acceleration increased to about 1.18 g.21 As the airplane descended through 17 feet radio altitude, an airplane nose-down (AND) elevator deflection was initiated and pitch attitude and vertical acceleration began to decrease. Pitch attitude decreased to 4.2°, and vertical acceleration decreased from about 1.18 g to about 0.93 g as the airplane descended through 7 feet radio altitude. At 0132:17.6, FDR data indicated an ANU elevator deflection of up to 26° out of a maximum possible deflection of 37.5°, a nose-left-rudder deflection of up to 5.5°, a right-wing-down aileron deflection of 5°,22 and a TRA increase to 74°. Airspeed was decreasing through 152 knots at this time. 17 Radar data were obtained from the FAA airport surveillance radar at EWR. 18 Ground scar and wreckage locations were also used to reconstruct landing events (see section 1.12 for details of wreckage and ground scar locations). 19 The MD-11 is equipped with an electronic automated engine power control system. The throttle resolver levers on the cockpit’s power control pedestal are linked to a throttle switch and cam assembly that sends electronic signals, based on power setting, to a full authority digital engine control unit located on the engine. Throttle resolver (lever) degree angles represent the total travel of the throttle lever from the “forward limit stop” (of about 85°), to the idle aft limit (of about 41°), to just below the “reverse stop” (of 7.7°). Forward travel of the throttles is limited by an overboost stop (about 81°). This stop has a detent that allows continued forward movement of the throttles when they are pushed with a strong force. Among other things, this extra forward travel causes autothrottle disengagement. 20 Radio altitude is measured by the on board radio altimeter, which provides a readout of height above ground level (agl). McDonnell Douglas data indicate that the MD-11 radio altitude system is calibrated to read 0 feet when the main landing gear (MLG) tires touch the runway with the struts fully extended at 4° pitch attitude. The radio altitude sensor is 22.8 feet ahead of the MLG; therefore, when pitch is greater than 4°, the radio altitude will read too high, and when pitch is below 4°, it will read too low. The equation to convert from FDR radio altitude to pitch-corrected radio altitude is RADALTcorrected = RADALT – 22 x sin(pitch – 4°). 21 A g is a measure of force on a body undergoing acceleration as a multiple of the force imposed by the acceleration of Earth’s gravity. 22 Aileron deflection values represent the average value of all four aileron positions recorded by the FDR after accounting for any offsets resulting from instrumentation error or misrigging.

Factual Information 7 Aircraft Accident Report Figure 5. Comparison of selected FDR parameters for accident landing and previous two landings (correlated by radio altitude – 50 feet).

Factual Information 8 Aircraft Accident Report Figure 6. Comparison of selected FDR parameters for accident landing and previous two landings (correlated by first touchdown).

Factual Information 9 Aircraft Accident Report As the airplane touched down at 0132:18.6, pitch attitude and vertical acceleration were increasing (along with engine speeds). It touched down 1,126 feet beyond the runway displaced threshold with a 7° nose-up pitch attitude. Vertical speed at the time of the first touchdown was about 7.6 feet per second (fps).23 Vertical acceleration peaked at 1.67 g. About 1/2 second after the first touchdown, the FDR recorded an 18° AND elevator deflection (maximum possible MD-11 AND elevator deflection is 27°) and a TRA decrease.24 At 0132:19, rudder deflection decreased to near zero, and the magnetic heading stabilized at 217.4° (the published magnetic heading for the runway was 219°). Pitch attitude peaked at 8.44° and began decreasing. Thrust continued to increase with N1 values of about 65 percent. Airspeed began to increase and the airplane became airborne.25 As the airplane’s altitude increased, it pitched nose-down and rolled right-wing- down, consistent with the AND elevator deflection and right-wing-down aileron deflection. Engine speeds peaked at 80 percent N1 and began to decrease. The airplane reached an altitude of about 5 feet26 above ground level (agl) and began to descend. At 0132:20.8, as the airplane descended back to the runway, the FDR recorded about 23° ANU elevator, about 12° nose-left rudder, and additional right-wing-down aileron deflections. The airplane touched down the second time about 1,889 feet from the displaced threshold at 0132:21.6 with a 9.5° right-wing-down roll angle, a -0.70° pitch attitude and on a 216.7° magnetic heading. Roll rate was about 7° per second right-wing-down and peak vertical speed at the right main landing gear (MLG) was about 13.5 fps.27 Vertical acceleration at the beginning of the second touchdown was about 0.5 g and peaked at about 1.70 g just after touchdown (see sections 1.16.1 and 2.5.2 for a discussion of vertical acceleration values in relation to landing gear energy absorption limits). Maximum elevator deflection at the second touchdown was about 24° ANU, and TRAs were about 51°. ANU elevator deflection continued for about 1 second after the second touchdown, TRAs increased to about 81°, and a left-wing-down aileron deflection was initiated. The airplane pitched up 5° and began rolling right wing down. An aural “tire failure” warning sounded in the cockpit at 0132:26 as the airplane rolled through 45° right wing down. The right-wing-down roll angle increased to 90° and the pitch attitude decreased to 5° AND 23 This value was the computed vertical speed at the right MLG and includes 6.6 fps vertical speed at the center of gravity (c.g.) and 1.0 fps vertical speed caused by nose-up pitch rate and right-wing-down roll rate. The MD-11 MLG are aft and outboard of the c.g.; therefore, pitch and roll rates affect the vertical speed of the MLG. 24 Ground spoilers on the accident airplane did not deploy after touchdown because the TRA was greater than 49°. The No. 2 engine throttle lever mechanically prevents ground spoiler deployment if its position is greater than 44° to 49° (about 1.05 inches) forward of idle and knocks down extended spoilers if the No. 2 engine throttle lever exceeds this range. Ground spoilers, or speed brakes, are hinged or otherwise moveable surfaces on the upper rear surface of a wing that reduce lift and increase drag when extended. 25 According to the FDR, the airplane touched down at 149 KIAS. The ground speed was 152 knots. 26 The bounce altitude was determined by correcting radio altitude for pitch attitude, as well as by integrating accelerations. 27 This value includes 11.5 fps vertical speed at the c.g. and 2 fps vertical speed caused by the right- wing-down roll rate.

Factual Information 10 Aircraft Accident Report when the FDR stopped recording at 0132:27.6. The CVR stopped 1.3 seconds later, after recording sounds of “metallic breakup.” 1.1.2 Flight Crew and Witness Statements The captain told Safety Board investigators in a postaccident interview that he “wasn’t going to grease it [the landing]…but put it [the airplane] on the end of the runway and to try to make sure…not [to] get any float out of it.” He stated that the glideslope, airspeed, and localizer were “completely nailed” during the approach. He also stated that he noticed an increased sink rate at 20 feet, “felt the airplane sink,” and made a “slight pitch and power change.” The captain stated that the airplane touched down “very firmly” and that he was not certain if the ground spoilers deployed but believed that they had. He also stated that he moved the control column forward and added power to compensate for a pitch-up tendency that occurs when the spoilers are deployed. He stated that his pitch and power response “was instinctive” and in accordance with the response called for in his FedEx tailstrike awareness training (see section 1.18.3 for details about FedEx’s tailstrike awareness training program). The captain further stated that when the airplane touched down the second time, “it started rolling to the right” and that he applied left rudder as the airplane began to roll. He added that he could not understand why the airplane kept rolling to the right and that the rolling was “gradual” and not as violent as he thought it would be. The first officer stated in a postaccident interview that he felt the airplane begin to settle at an altitude of about 20 feet28 and “could tell it was going to be a firm landing.” He added that he had experienced firmer landings in the MD-11. The first officer stated that the airplane bounced about 5 to 10 feet into the air and was on the centerline. He stated that his FedEx training advocated avoiding a nose-high attitude and not controlling sink rate with pitch during a bounce. He added that the training also advocated adding power until the sink rate has been arrested or a landing accomplished. He stated that he observed the captain doing this, adding that he believed the nose attitude was about 7°. The first officer stated that no attempt was made to execute a go-around. A FedEx DC-10 captain, whose airplane was taxiing to the departure end of runway 22R, stated that he watched the accident airplane land. He stated that he saw the airplane pitch nose down and bank to the right. He stated it was not a “normal bank” and that he saw the right wing strike the ground, break off, and catch fire. The EWR tower controller stated that he saw the airplane touch down hard and bounce. He stated that the airplane was in a bank when it touched down again and that he saw sparks and debris coming from the airplane “before something appeared to break off from under the aircraft.” 28 The first officer noted that this was a “seat of the pants” feeling and was not based on indications of cockpit instruments.

Factual Information 11 Aircraft Accident Report 1.2 Injuries to Persons 1.3 Damage to Airplane The airplane and its cargo were destroyed by impact and a postcrash fire. The airplane was valued at $112 million. 1.4 Other Damage A 1,574-foot area along the right side of runway 22R was sooted and scarred. Soil samples taken from the accident site were analyzed and were not found to contain hazardous levels of fuel or other chemical contamination.29 Five runway/taxi signs along the right side of the runway were damaged or destroyed. Cost of cleanup and repairs was estimated at $500,000. 1.5 Personnel Information 1.5.1 The Captain The captain, age 46, was hired by Flying Tigers, Inc., in 1979 and became a FedEx pilot when Flying Tigers merged with FedEx in 1989. The captain held an airline transport pilot (ATP) certificate and was type-rated in the MD-11. In addition to his ATP, the captain held a commercial certificate and a turbojet flight engineer certificate. His most recent FAA first-class medical certificate was issued on April 15, 1997, with limitations requiring him to wear corrective lenses. The captain’s most recent proficiency check was April 15, 1997, and his most recent line check was July 11, 1997. According to company records, the captain had logged a total of 11,000 flying hours, 2,621 hours of which were with FedEx. He had logged a total of 1,253 hours in the MD-11, of which 318 hours were as pilot-in-command. He had flown 155 hours, 96 hours, 41 hours, 6 hours, and 6 hours in the last 90 days, 60 days, 30 days, 7 days, and 24 hours, respectively. A review of training Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 0 0 0 0 0 Serious 0 0 0 0 0 Minor 2 0 3 0 5 None 0 0 0 0 0 Total 2 0 3 0 5 29 FedEx hired a New York-based, independent laboratory, Environmental Testing Laboratories, Inc., to test soil samples taken from the accident site. The laboratory report concluded that the accident “did not have an adverse” impact on the environment and that “no further soil investigation” was warranted.

Factual Information 12 Aircraft Accident Report records indicated that the captain had received an unsatisfactory evaluation on an upgrade proficiency check ride on October 29, 1996. The captain received additional training in V1 cuts30 and multiple engine failures and accomplished a successful recheck. FedEx records indicated that the captain had successfully completed the company’s tailstrike awareness training program twice, on July 10, 1996, during annual recurrent training as a first officer and again on November 15, 1996, during captain upgrade training. A search of FAA and company records showed no enforcement actions, accidents or incidents, or company disciplinary actions, and a search of records at the National Driver Register found no history of driver’s license revocation or suspension. The captain had not flown in the 7 days before the accident. He arrived at ANC from his home in Nevada the evening before the accident flight departed. He reported routine activities and normal sleep in Anchorage and feeling rested upon waking about 0830 local time the day of the accident. The accident occurred approximately 14 hours later. The captain reported eating meals en route and that, typical of flights of similar duration, he felt tired at the end of the accident flight but that his performance was not affected. The captain was in good health, reported a stable personal life, and did not take medications or consume alcohol in the 24 hours before the accident. 1.5.2 The First Officer The first officer, age 39, was hired by FedEx on September 6, 1994, as a ground service employee after serving as a pilot in the U.S. Navy and as a flight engineer for another airline. He had logged a total of 1,911 hours of flying time as a pilot and 1,200 hours as a flight engineer at the time of his transfer to FedEx’s air operations division in October 1995. He held an ATP and a turbojet flight engineer’s certificate and was type-rated in the MD-11. His most recent FAA first-class medical certificate was issued on March 25, 1997, with no limitations. His most recent proficiency check was on May 18, 1997, and his most recent line check was on June 28, 1997. According to company records, he had logged a total of 3,703 flying hours, 592 hours of which were with FedEx. He had logged a total of 95 hours in the MD-11. He had flown 95 hours, 95 hours, 56 hours, 21 hours, and 6 hours in the last 90 days, 60 days, 30 days, 7 days, and 24 hours, respectively. FedEx records indicated that the first officer had successfully completed the company’s tailstrike awareness training program on May 6 and 10, 1997. A search of FAA and company records showed no enforcement actions, accidents or incidents, or company disciplinary actions, and a search of records at the National Driver Register found no history of driver’s license revocation or suspension. The first officer lived in Minnesota and was based at ANC. He was off duty in Anchorage for 2 days before the accident and reported routine activities. He reported sleeping more than 8 hours before the flight and waking about 1200 local time after being awake briefly from 0630 to 0830. The first officer reported eating meals en route. He told investigators that he did not feel fatigued during the accident flight and that he did not 30 V1 is takeoff decision speed or the decision point at which the takeoff is continued or rejected after an engine failure or other system failure. Simulator training includes V1 cut scenarios in which engines or other systems are intentionally failed during this critical takeoff phase.

Factual Information 13 Aircraft Accident Report believe fatigue was an issue in the accident. The first officer was in good health, reported a stable personal life, and did not take medications or consume alcohol in the 24 hours before the accident. 1.6 Airplane Information The accident airplane, serial number (SN) 48604, was initially registered on September 29, 1993. It had a certificated maximum gross weight of 625,500 pounds and was equipped with three General Electric CF6-80C2 engines. At the time of the accident, the airplane had accumulated about 13,034 hours total time in service and 2,950 cycles.31 Engine No. 1, installed on June 12, 1992, had a total of 14,652 hours (3,384 cycles), with 1,666 hours (379 cycles) since its last shop visit/inspection. Engine No. 2, installed on August 23, 1992, had a total of 14,930 hours (2,681 cycles), with 4,779 hours (918 cycles) since its last shop visit/inspection. Engine No. 3, installed on September 7, 1990, had a total of 16,950 hours (3,888 cycles), with 1,259 hours (284 cycles) since its last shop visit/inspection. 1.6.1 Airplane Maintenance and Incident History The accident airplane, as part of a fleet of MD-11 airplanes operated by FedEx, was maintained under an FAA-approved maintenance program. According to FedEx maintenance records, the airplane had received a C check32 at 11,025 flight hours on January 14, 1997; its next C check was due at 15,825 flight hours. FedEx records indicated that an A check was conducted on the airplane on July 18, 1997, at 13,014 flight hours. The Safety Board reviewed the accident airplane’s maintenance logs for the 30 days before the accident. Excluding the disabled thrust reverser, nothing remarkable was noted. FedEx maintenance documents indicated that on January 4, 1994, the airplane sustained damage during a bounced landing at Memphis, Tennessee, when a 2.85 positive g load and a minus .45 lateral g load were applied to the airframe during the second touchdown. FedEx personnel conducted the manufacturer-recommended and FAA- approved hard landing inspection33 and found “mild to moderate buckling of the external skin…from longeron34 36 to longeron 48 [near the nose gear wheel well].” Inspection notes added that “deformations [were] smooth with no creases. Suspect areas were verified to be crack-free via eddy current surface probe.”35 Because no serious damage to 31 A cycle on an airplane is one complete sequence of engine startup, taxi, takeoff, climb, cruise, descent, landing, thrust-reverse, taxi, and shutdown. A cycle on an engine is one startup and subsequent shutdown. 32 Under an FAA-approved maintenance program, maintenance tasks are divided into categories based on the level of maintenance required, beginning with A checks through E checks. 33 The MD-11 hard landing inspection examines all landing gear, tires, fuselage, wings, empennage, engine nacelles and pylons, wheel wells, and control surfaces for signs of damage. 34 Longerons are the principal longitudinal structural members in the fuselage. 35 Eddy current inspections use alternating current to locate surface and near-surface cracks.

Factual Information 14 Aircraft Accident Report any structure was found, the airplane was released to be operated “with buckles ‘as is’” and with the requirement that the area be inspected periodically before permanent repairs were made at the airplane’s next scheduled C check. FDR data for the Memphis, Tennessee, incident indicated that nose-up elevator inputs consistent with flare began at about 35 feet radio altitude and were maintained until 1 second after the first touchdown. The first touchdown occurred with pitch attitude increasing through 7°, roll increasing through 2° left wing down, and throttles in the flight idle position. The ground spoilers did not deploy, the airplane bounced, and nose-down elevator was initiated. Pitch attitude and vertical acceleration began decreasing, and the airplane touched down the second time with pitch attitude decreasing through 1° nose-up, roll angle decreasing through 4° right wing down, and elevator position at about 17° nose down. The ground spoilers deployed fully during the second touchdown; the airplane remained on the ground, and the landing rollout was completed (see FDR plots in appendix D). The airplane also sustained damage from a tailstrike during a bounced landing at Anchorage, Alaska, on November 4, 1994, when a 2.59 positive g load was applied to the airframe during the second touchdown. FedEx maintenance documents indicated that the tailstrike had damaged the airplane’s aft fuselage skin, a rear bulkhead, and several floor supports.36 According to the FedEx records, temporary repairs were made in Anchorage. A FedEx engineering authorization form, dated November 6, 1994, stated that “all other remaining damage [was] acceptable for a one-time non-revenue unpressurized ferry flight from Anchorage to LAX [Los Angeles International Airport] for permanent repair” and that the airplane was ferried to Los Angeles. According to FedEx maintenance records, the damage to the aft fuselage skin and bulkhead was repaired during November 1994. FDR data for the Anchorage, Alaska, incident indicated that nose-up elevator inputs consistent with flare began at about 18 feet radio altitude and were maintained until 1 second after the first touchdown. The first touchdown occurred with pitch attitude increasing through 8°, with roll about 0°, and with throttles having just reached the flight idle position. The ground spoilers did not deploy, the airplane bounced, and nose-down elevator was initiated. Pitch attitude and vertical acceleration began decreasing, and the airplane began descending back toward the runway. Approximately 6° of nose-down elevator was maintained until about 0.5 seconds before the second touchdown when a 15° to 20° nose-up elevator input was made. The airplane touched down the second time with pitch attitude increasing through 3° and roll angle decreasing through 1°. Ground spoilers deployed to 30° after the second touchdown, and pitch attitude increased rapidly as nose- up elevator peaked at about 23°. Nose-down elevator input was initiated as pitch attitude increased through 10°, and the tail struck the ground as pitch attitude increased through 12°. Nose-down elevator input increased to about 20° as pitch attitude started to decrease, then nose-up elevator was used to slow the nose-down pitch rate. The nose gear contacted the runway, ground spoilers fully deployed, and the landing rollout was completed (see FDR plots in appendix D). 36 Because this damage was substantial, the Safety Board classified the November 4, 1994, event as an aviation accident. For more information, see accident investigation file number ANC95FA008.

Factual Information 15 Aircraft Accident Report According to FedEx maintenance documents, permanent forward fuselage skin repairs resulting from the Memphis incident were completed in August 1995. FedEx maintenance records also indicated that the accident airplane’s landing gear struts were examined during a B check on June 27, 1997, and that no anomalies were found.37 1.6.2 Weight and Balance Weight and balance information for FedEx airplanes is calculated by an automated weight and balance (AWAB) report computer program. According to FedEx procedures, station agents prepare the AWAB, which is included in the flight plan and release documentation provided to flight crews before departure; final AWAB figures are provided to flight crews just before departure. Weight and balance information for the accident airplane included the following: According to McDonnell Douglas airplane documentation, the maximum gross takeoff weight for the accident airplane was 625,500 pounds, and the maximum zero fuel weight was 451,300 pounds. The airplane’s maximum gross landing weight was 471,500 pounds. The airplane’s actual gross landing weight was 452,300 pounds. 1.7 Meteorological Information The METAR38 valid for EWR at the time of the accident reported winds of 240° at 10 knots, visibility 10 statute miles (sm), scattered clouds at 8,000 feet, temperature 20° C, dew point 12, and altimeter 30.23 inches of mercury. The automated weather advisory system and automated weather observation system at 0130, about 2 minutes before the accident, reported winds of 270° at 10 knots, visibility 10 sm and clear. According to the CVR, the EWR tower controller informed the flight crew at 0129:45 that winds were 250° at 5 knots. 37 The MD-11 was equipped with dual chamber, MLG shock struts. According to McDonnell Douglas personnel, improperly serviced struts can cause additional rebound during landing. Basic Operating Weight: 252,762 pounds Three passengers: 600 pounds Cargo: 167,384 pounds Zero Fuel Weight: 420,762 pounds Fuel: 138,000 pounds Ramp Weight: 558,762 pounds Taxi Burn: minus 2,000 pounds Estimated Gross Takeoff Weight: 556,762 pounds 38 METAR is the International Civil Aviation Organization (ICAO) code for routine weather reports.

Factual Information 16 Aircraft Accident Report 1.8 Aids to Navigation No problems with navigation aids were reported. 1.9 Communications No external communication difficulties were reported. 1.10 Airport Information EWR, located 3 miles south of Newark at 40°41.57’ N latitude and 74°10.10’ W longitude, is a publicly owned airport operated by the Port Authority of New York and New Jersey and handles about 421,000 commercial, military, and general aviation operations per year. It has an FAA-approved emergency plan and is certified as an Aircraft Rescue and Firefighting (ARFF) Index E39 airport under 14 CFR Part 139. EWR has an elevation of 18 feet above msl. The airport has three asphalt runways with precision instrument markings: 4L/22R, 4R/22L, and 11/29. Runway 22R is 8,200 feet long and 150 feet wide. Its grooved, asphalt surface was reported by EWR tower controllers to be in good condition at the time of the accident. The runway was equipped with high-intensity runway edge lights, centerline lights, and runway end identifier lights. Runway 22R was not equipped, nor was it required to be equipped, with runway approach lights or touchdown zone lights. The three-bar visual approach slope indicator (VASI) was located on the left side of the runway. The runway was also equipped with a Category I instrument landing system (ILS), which included an outer marker beacon but no middle or inner markers. The glideslope was set at a standard 3° angle. There were no FAA Notices to Airmen (NOTAM) on file indicating that any landing aid components were inoperative.40 1.11 Flight Recorders 1.11.1 Flight Data Recorder The airplane was equipped with a Sundstrand Data Control (model UFDR) FDR, SN 2222, which was equipped to record more than 250 parameters. The nonprotected portion of the FDR was destroyed in the postimpact fire. No evidence of thermal or impact 39 Index E refers to ARFF requirements for airports used by air carrier aircraft of at least 200 feet in length. Title 14 CFR Part 139 requires that Index E airports have a minimum of three ARFF vehicles carrying water and fire-suppressing chemical foam and that the total quantity of water for foam production be at least 6,000 gallons. 40 NOTAMs are disseminated to give information about conditions or changes in any aeronautical facility, service, procedure, or hazard.

Factual Information 17 Aircraft Accident Report damage was found on the inside of the crash-protected portion of the FDR, and all data were recovered successfully. 1.11.2 Cockpit Voice Recorder The airplane was equipped with a Fairchild model A-100A CVR, SN 25685. The recording, which contained good quality audio information,41 consisted of four channels including the captain’s microphone, the first officer’s microphone, and the cockpit area microphone. The fourth channel included the interphone and public address systems. The external surface of the recovered CVR was found scorched and coated with soot but with little impact damage. The interior of the crash case was also found scorched and discolored but with no impact damage. Fluctuations in the tape’s audio amplitude, consistent with heat damage, were present in the first 5 minutes of the recording playback. A transcript was prepared of the entire 30-minute, 25-second recording (see appendix B). 1.12 Wreckage and Impact Information The airplane’s wreckage was distributed along a 2,900-foot-long debris path that gradually arced to the right across runway 22R (see figure 7). Pieces of the right inboard trailing edge flap were found at the beginning of the wreckage path, about 2,226 feet from the runway’s displaced threshold. The main wreckage, located about 5,126 feet from the runway threshold and 580 feet to the right of the runway centerline, comprised the fuselage, left wing, nose gear, left MLG, center MLG, and horizontal stabilizer. The fuselage came to rest inverted with the nose on a 95° heading. Other airplane components and structure separated from the airplane during the crash sequence and were located along the debris path. Rubber marks consistent with the touchdown of the airplane’s right MLG tires were found about 1,126 feet from the runway displaced threshold. Rubber marks consistent with the touchdown of the left MLG tires and center MLG tires were found at 1,151 feet and 1,160 feet from the runway displaced threshold, respectively. The location of the tire marks was consistent with a touchdown near the center of the runway. Rubber marks consistent with a second touchdown of the right MLG tires were found about 1,924 feet from the runway displaced threshold (798 feet after the tire marks consistent with the first touchdown). Rubber marks consistent with the center MLG tires were found again about 1,983 feet from the runway displaced threshold. The locations of the second touchdown tire marks were consistent with a touchdown near the center of the runway. The right MLG tire rubber marks veer to the right about 1,995 feet from the runway displaced threshold. 41 The Safety Board ranks the quality of CVR records by five categories: excellent, good, fair, poor, and unusable. In a recording of “good quality,” most of the crew conversations can be accurately and easily understood, and the transcript developed from it may indicate several words or phrases that are not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to several simultaneous cockpit/radio transmissions that obscure each other.

Factual Information 18 Aircraft Accident Report Figure 7. Wreckage distribution diagram.

Factual Information 19 Aircraft Accident Report Ground scarring consistent with the No. 3 (right) engine nacelle contacting the runway were found about 2,164 feet from the runway displaced threshold and continued to about 3,476 feet from the runway threshold. Runway scarring consistent with impact of the right inboard trailing edge flap was found about 2,299 feet from the runway threshold, ending about 2,376 feet from the threshold (where the right inboard trailing edge flap was found). Soot marks consistent with burning fuel were found about 2,506 feet from the threshold and continued to the end of the wreckage path. Runway scrape marks and purple paint42 consistent with the airplane’s tail striking the runway were found about 2,644 feet from the runway threshold and ended about 3,060 feet from the threshold. About 2,826 feet from the threshold, runway scrapes, soot marks, and runway surface gouging began turning toward the right of the runway. The right wing, the vertical stabilizer, and all three engines separated from the airplane and were found in a grassy area to the right of the runway, about 4,577 feet from the runway threshold, and had sustained fire damage consistent with a postaccident fuel fire. The right MLG strut assembly and two MLG wheels and tires were found on the right edge of the runway, about 4,805 feet from the runway threshold. The other two right MLG wheels and tires were found about 235 feet to the right of the runway centerline and about 4,957 feet from the threshold. The right wing separated from the fuselage just inboard of the wing MLG and fuel closure bulkhead at wing station (WS) 264. The outboard upper surface was intact and sooted. Buckling was noted in the upper surface skin approximately 12 feet inboard from the tip. The lower wingtip winglet had separated from the wingtip at its attach surface. The upper winglet remained attached to the wingtip. The No. 3 engine and pylon had separated from the wing completely, and the engine remained attached at the aft and forward pylon mounts. Stringers at the inboard end of the right wing upper surface, as well as the upper surface chordwise fracture surface, were bent in an upward direction. The rear spar fracture near WS 264 was bent aft. All leading edge control surfaces outboard of WS 264 remained attached to the wing. The inboard flap structure had separated from the wing (the full 20-foot section of right inboard flap was found on taxiway H), portions of the separated flap hinge bracket structure were found close to the wing trailing edge, and the spoiler actuator and attach points were found intact. The right MLG was separated from its attach points on the right wing (see figure 8).43 The attach points were broken from the wing, except for the forward lug, which remained attached to the wing with no evidence of failure. The right MLG truck assembly44 was found separated into four parts: one part was attached to the aft axle, where the wheels and tires were found intact; a second part was found on the runway; a 42 The accident airplane’s tail cone, No. 2 engine, and vertical stabilizer were painted purple. 43 On the MD-11, the right and left MLG comprise four wheels, tires, and brakes and are mounted to the wing structure outboard of the fuselage. The center MLG assembly comprises two wheels, tires, and brakes and is mounted to the center fuselage. Landing gear extension and retraction are hydraulically actuated. 44 The landing gear wheel axles attach to the truck beam.

Factual Information 20 Aircraft Accident Report third part was found attached to the forward axle, where the No. 3 and No. 4 wheels were found intact; and a fourth part was found attached to the strut assembly. The pivot pin was found intact between the truck beam and the oleo piston assembly. The oleo piston and cylinder were found intact, and the piston was fully extended. The torque links were intact and had no structural damage. Parts of a wing-to-gear fitting were found on the aft trunnion45 bolt. The forward trunnion bolt, or fuse pin,46 failed and had broken into two pieces along the shear plane.47 The aft portion of the forward trunnion bolt was found on the runway, and the forward portion was found in the right wing-to-gear-fitting forward trunnion lug. Scraping damage was found on the forward trunnion lug’s forward face. The fixed side brace (to) folding side brace fitting joint was found intact with the side brace, the fixed brace, the side brace fitting (commonly referred to as the “pillow block”), and the pillow block hinge joint pin assembly (see figure 8). The inboard attach bolt was found intact with the pillow block and a part of the trapezoidal panel assembly. The remaining bolt was found detached and in two pieces. One piece was found in the remaining part of Figure 8. Right MLG components. 45 A trunnion is a pin or pivot on which an attachment can be rotated or tilted. 46 A fuse pin is an attachment fitting designed to fail at predetermined loads to prevent more severe damage to surrounding structures. MD-11 landing gear fuse pins were designed and positioned to allow the landing gear to fail under loads in the aft direction. 47 A fuse pin shear plane is the point at which the pin is designed to fail.

Factual Information 21 Aircraft Accident Report the trapezoidal panel that had broken off from the fuselage and the pillow block assembly. The other bolt piece was found on the runway. The fixed side brace was found fractured about 6 inches from the wing fitting lug and was bent in the aft direction where it failed. A metallurgical examination of the recovered right MLG components determined that all fracture surface evidence was consistent with overload failure. No evidence of fatigue cracking or corrosion was found. In addition, the examination found no indications of preimpact failures or anomalies. An examination of the right MLG tires found no evidence of pretouchdown failures or malfunctions. The airplane’s nose landing gear was found intact on the inverted fuselage. There was evidence of heat damage to the assembly and tires but no indication of structural damage to the assembly’s support or wheel well structure. The strut was fully extended. The center MLG assembly was found attached to the airplane in an upright position (on the inverted fuselage) but pushed into the fuselage. The strut was fully extended. The oleo piston was separated above the axle, and the remaining part of the oleo piston was pushed inside the cylinder. The left MLG was found intact. There was evidence of fire damage but no indications of structural damage, except for a broken lower valve assembly (used to inflate the strut assembly lower chamber).48 The tires were intact and pressurized. Examination determined that the torque of the two bolts that connected the side braces to the left trapezoidal panel pillow block fitting were normal. The left wing came to rest inverted but remained attached to the fuselage, and all of the control surfaces were attached to the wing. The wing sustained severe damage in the postcrash fire, and sections were melted and sooted by the heat and flames. The left inboard flap was partially extended (10° to 15°) and connected to its attachment points. The left outboard flap was retracted and connected to its attachment points. All three engines were separated from their wing or vertical stabilizer attachments. The No. 1 (left) engine fan cowl was separated from the engine, broken into pieces, and damaged by impact and postcrash fire. Fan blade damage (gradual bending) was consistent with damage occurring during low-speed rotation. The thrust reverser actuators were found in their stowed positions. No evidence of an in-flight engine fire was found. The No. 2 (tail-mounted) engine was separated from the vertical stabilizer at the pylon attachment points. The engine nacelle was found intact with minor impact damage and with postcrash fire damage. All fan blades were intact, and the thrust reverser actuators were found in their stowed positions. No evidence of an in-flight engine fire was found. The No. 3 (right) engine separated from the wing at the pylon-to-wing attachment, and witness marks on the wreckage indicated that the engine’s turbine rear frame contacted the ground at the 6 o’clock position. The fan cowl separated from the engine, broke into pieces, and was damaged by impact and postcrash fire. Fan blade damage was consistent 48 The valve was damaged during postaccident recovery efforts.

Factual Information 22 Aircraft Accident Report with damage occurring during low-speed rotation. The thrust reverser actuators were found in their stowed positions. No evidence of an in-flight engine fire was found. 1.13 Medical and Pathological Information The flight crew provided postaccident toxicological samples, which were tested and found to be negative for drugs of abuse.49 1.14 Fire A fuel-fed fire erupted on impact. 1.15 Survival Aspects 1.15.1 Flight Crew and Passenger Egress The captain told Safety Board investigators that the airplane began a “gradual roll” on the runway at the beginning of the accident sequence and that it remained on its side for a time as it slid down the runway. He stated that he remembered an explosion and saw orange flames. The captain stated that after the airplane pivoted and came to rest inverted, he released his seat belt and shoulder harness and fell on his head and hand. He stated that he crawled to his cockpit window and saw that there was no fire on that side. He stated that when he pushed the window release handle down, it jammed but opened when he applied more force. The captain stated that the window jammed again as he tried to crank it open and that he had to kick an obstruction out of the way to continue. He stated that he exited through the window and shouted “this window is open.” The first officer described the roll as a slow, “controlled soft turnover” and stated that he was not slammed into his seat belt or shoulder harness by impact or rolling forces. He stated that he saw orange flames and sparks and the runway pavement coming up toward him as the airplane rolled over. The first officer stated that he unbuckled his seat belt and shoulder harness and rolled to the other side of his seat because he thought the fuselage and window structure were going to fail. He stated that as the airplane rolled about 135°, he “bear hugged” his seat back and stood on the (inverted) overhead instrument panel between his seat and the center console. The first officer stated that as the airplane’s slide began to slow, he heard the captain say “we’ve got to get out of here” and that he saw the captain and jumpseat passenger hanging upside down, restrained by their seat belts and harnesses. The first officer stated that after the airplane came to a stop, he went to the forward cabin area to 49 The five drugs of abuse tested in postaccident analysis are marijuana, cocaine, opiates, phencyclidine, and amphetamines.

Factual Information 23 Aircraft Accident Report check on the two cabin passengers. He stated that he found one passenger strapped upside down in a seat. The second passenger had unbuckled the seat belt and was standing on the ceiling. The first officer stated that the passengers were talking and appeared to be uninjured and that he attempted to open the right forward cabin door but was unsuccessful. He stated that he saw smoke coming from the cargo cabin and pushed the two passengers in the direction of the cockpit. He stated that he then attempted to open the left forward cabin door, but the handle was blocked by debris. The first officer stated that he yelled into the cockpit that the doors could not be opened and to open the cockpit windows. He stated that the captain exited through the cockpit window, followed by the jumpseat passenger and the two cabin passengers. The first officer stated that he exited through the window behind the cabin passengers. He stated that firefighting vehicles were approaching the airplane when they exited and that they moved to a runway marker located about 100 feet away from the airplane’s nose as firefighters arrived. The jumpseat passenger stated that he released his seat belt and harness after the airplane came to a stop and “did a half twist and roll” to get down on the ceiling. He stated that he remembered hearing the first officer yell that the doors would not open and that the captain opened a cockpit window and told him to come forward. He stated that it was difficult to maneuver in the cockpit because of the inverted seats and debris. 1.15.2 Emergency Response Air traffic controllers in the EWR control tower witnessed the accident and immediately notified Port Authority fire (ARFF) and police units, transmitting a Condition One alarm.50 While en route to the crash site, the ARFF fire crew chief reported that flames were visible along runway 22R and that flames were venting from the aft section of the fuselage. The ARFF fire crew chief stated that it took about 35 seconds to drive from the fire station to the accident site and that five ARFF vehicles were engaged in fire suppression within 3 minutes of the alarm. The Port Authority incident commander told Safety Board investigators that he contacted the Port Authority police dispatcher while en route to the crash site and requested activation of the mutual aid contingency (emergency response) plan with the Newark Fire Department (NFD). He stated that he assumed that the accident airplane carried hazardous cargo because it was a late-night cargo flight and that firefighters and equipment were deployed accordingly (that is, upwind and wearing protective breathing gear). Newark authorities were contacted about 0138 and dispatched firefighting vehicles and personnel, who arrived on scene about 0146. About 0200, the NFD dispatcher notified the Newark Hazardous Materials Response Unit (HMRU) and the New Jersey Department of Environmental Protection (DEP). Newark HMRU personnel arrived at the accident scene shortly after 0200. DEP personnel arrived about 0300 and began downwind wind direction and air quality 50 EWR’s airport certification manual defines a Condition One alarm as “an actual or impending crash. Major aircraft accident or fire. Aircraft dire emergency. Full response as indicated in the aircraft emergency plan will go into effect.”

Factual Information 24 Aircraft Accident Report monitoring operations. About 0315, DEP personnel advised the incident commander that the monitoring had not detected elevated levels of toxic chemicals in the air. About 0320, the NFD deputy chief reported hearing “popping” sounds as the fire in the fuselage advanced toward the forward cabin bulkhead.51 According to ARFF and NFD logs, the entire wreckage site was covered with fire-suppressing foam about 0430. The fire was extinguished (except for sporadic hot spots) about 0700, according to ARFF and NFD logs. About this time, the NFD deputy chief discovered a package marked “Biomedical Research”52 and immediately halted all firefighting operations until a complete cargo manifest was obtained (see section 1.18.1 for details about dissemination of hazardous materials information and efforts to obtain information about the airplane’s cargo). Port Authority ARFF vehicles were withdrawn about 0700, and NFD assumed control of the accident site. 1.16 Tests and Research 1.16.1 Landing Gear Energy and Load Limit Certification Landing gear certification requirements for transport category airplanes that were applicable to the certification of the MD-11 are primarily contained in 14 CFR 25.721 through 25.737. Subsection 25.721(a) states:53 The [MLG] system must be designed so that if it fails due to overloads during takeoff and landing (assuming the overloads to act in the upward and aft directions), the failure mode is not likely to cause— (1) For airplanes that have passenger seating configuration, excluding pilots seats, of nine seats or less, the spillage of enough fuel from any fuel system in the fuselage to constitute a fire hazard; and (2) For airplanes that have a passenger seating configuration, excluding pilots seats, of 10 seats or more, the spillage of enough fuel from any part of the fuel system to constitute a fire hazard. Subsection 25.721(b) states further that “each airplane that has a passenger seating configuration…of 10 seats or more must be designed so that with the airplane under 51 According to FedEx shipping documents, declared items of hazardous materials were loaded in the forward 1L and 2L cargo container positions. Thirteen packages of hazardous materials were in container 1L, including 10 packages of (flammable gas) aerosols and 3 packages of a flammable solid. The 2L container carried 1 package of perfumery, classified as a flammable liquid, a package of gallium (a corrosive), and methyl methacrylate, another flammable liquid. 52 Subsequent examination of the package determined that it contained sterilized blood and that it was not a dangerous goods shipment.

Factual Information 25 Aircraft Accident Report control it can be landed on a paved runway with any one or more landing gear not extended without sustaining a structural component failure that is likely to cause the spillage of enough fuel to constitute a fire hazard.”54 Section 25.473, “Ground Load Conditions and Assumptions,” describes the descent velocities that must be assumed for certain landing conditions (for example, level landing, tail-down landing, one-wheel landing, and side load conditions). Section 25.723, “Shock Absorption Tests”; Section 25.725, “Limit Drop Tests”; and Section 25.727, “Reserve Energy Absorption Drop Tests,” describe landing gear energy and load limits. Subsection 25.723(a) states that “it must be shown that the limit load factors selected for design in accordance with [Section 25.473] for takeoff and landing weights, respectively, will not be exceeded.” Sections 25.725 and 25.727 describe the values and parameters to be used in conducting the landing gear limit and reserve energy absorption drop tests described in Subsections 25.723(a) and (b). Subsection 25.723(b) also states that the “landing gear may not fail in a test, demonstrating its reserve energy absorption capacity, simulating a descent velocity of 12 fps at design landing weight, assuming airplane lift not greater than the airplane weight acting during the landing impact.” Subsection 25.473 (1) states: The selected limit vertical inertia load factors at the center of gravity [c.g.] of the airplane may not be less than the values that would be obtained— (i) In the attitude and subject to the drag loads associated with the particular landing condition; (ii) With a limit descent velocity of 10 fps at the design landing weight (the maximum weight for landing conditions at the maximum descent velocity); and (iii) With a limit descent velocity of 6 fps at the design takeoff weight (the maximum weight for landing conditions at a reduced descent velocity). 53 This requirement was added as a result of a notice of proposed rulemaking (NPRM) issued by the FAA on August 12, 1969. In this NPRM, the FAA stated that the existing Section 25.721 “was designed to [e]nsure that if the landing gear fails, no part of the fuel system in the fuselage of the airplane will be punctured. It is proposed to extend this protection to the entire fuel system of the airplane. However, since not all punctures of the fuel system would result in a fire hazard, the proposal would protect against those punctures only that would result in the spillage of enough fuel to cause a fire.” The NPRM proposed amending 25.721 to require that “[t]he [MLG] system…be designed so that if it fails due to overloads during takeoff and landing (assuming the overloads are in the vertical plane parallel to the longitudinal axis of the airplane), the failure mode is not likely to cause the spillage of enough fuel from any part of the fuel system to constitute a fire hazard.” In its final rule, which adopted the language that currently appears in Subsection 25.721(a), the FAA stated on February 24, 1972, that this paragraph had been “substantially amended” since the NPRM and that “in response to a comment, the parenthetical expression in the proposed amendment has been changed to make it clear that the regulation is based on the assumption that the overloads act in the upward and aft directions.” 54 The cargo version of the MD-11 was designed to passenger aircraft certification standards.

Factual Information 26 Aircraft Accident Report Subsection 25.473 (2) states that “airplane lift, not exceeding the airplane weight, may be assumed to exist throughout the landing impact and to act through the [c.g.] of the airplane.” According to Boeing, the MD-11 was designed to allow “sacrificial shedding” (by use of fuse pins) of the MLG assemblies under aft (drag) overload conditions to prevent catastrophic loads being transmitted to the wing box.55 Boeing indicated that the MD-11 landing gear certification was based on drop tests conducted on DC-10 landing gear, which are nearly identical to MD-11 landing gear. Boeing, in a submission56 to the Safety Board, stated that a review of “historical data indicated that [MLG] failure due to overload was most likely to occur as a result of striking an obstruction.” The Boeing submission, which described Douglas’ landing gear design philosophy for the DC-10 and MD-11, added the following: The [Boeing Long Beach Division] believed that the most probable condition would be a 1.0 g vertical load at maximum ramp weight (i.e., the weight of the aircraft would be distributed between the two [right and left] [MLG], the center [MLG] and the nose landing gear with no aerodynamic lift), static gear extension, with a drag load applied to the axles until the failure of the gear. For this condition it was shown by analysis that the [MLG] would separate from the wing without any failures to the fuel tanks. This was validated by tests done on full scale DC-10 landing gear and wing test structure. By analysis this was shown to be true for vertical loads up to 2.0 g’s (i.e., twice the weight of the aircraft is distributed between the two [right and left] [MLG], the center [MLG] and the nose landing gear with no aerodynamic lift) at the aircraft ramp weight. Because a fuse [pin] in the vertical plane may not prevent substantial loads from entering the wing structure once the fuse has released, and because the review of historical data indicated that failure due to overload was most likely to occur as a result of high drag loads, a different approach was taken to assure fuel tank integrity for the high vertical load (above 2.0 g’s) condition. For vertical loads above 2.0 g’s, the [MLG] is not designed to separate from the wing. Instead, the landing gear and its back-up structure are designed to be very robust, i.e., they are designed to withstand significantly greater descent rates than the 12 fps (ultimate) required per Part 25.723 (b). Analysis has indicated that for a maximum landing weight, typical-landing-configuration landing, the MD-11 [MLG] can withstand up to a 16.9 fps descent rate without bottoming the shock struts or failing its backup structure including the wing rear spar. Similarly, for a rolled landing (8 degrees one-wing-low attitude, with lift equal to aircraft weight), the landing gear can withstand up to 15 fps descent rate without bottoming the shock strut or failing its back-up structure including the wing rear spar.57 55 The wing box, often the heaviest single piece of an airplane’s airframe, is the strong, primary structure of a modern, stressed-skin wing. Loads are taken by cantilever beams comprising upper and lower skins joined to front and rear spars. 56 Boeing’s Long Beach Douglas Products Division. Undated. Submission of Proposed Findings for FedEx Flight 14, MD-11-F, N611FE, Newark, New Jersey, 31 July 1997.

Factual Information 27 Aircraft Accident Report The Boeing submission added that “creating a reliable vertical fuse can only be accomplished by adding weight and complexity” to the airplane, and increasing landing gear energy absorption capability “could have a cascading effect in that the total aircraft structure would have to be strengthened to absorb the additional energy.” For “extreme roll angles,” the Boeing submission noted that “the landing gear design criteria and philosophy do not come into play. Striking the wingtip may fail the wing directly or may cause the aircraft to ‘cartwheel.’” The Boeing submission stated that “for lesser roll angles the single gear on the ‘wing low’ side may fail (or fuse if so designed) if the combination of sink rate and roll rate (and amount of wing lift) impart loads that exceed the design thresholds.” Boeing’s submission added the following: For ‘fused’ aircraft the (remaining) energy of vertical descent would then be absorbed by flexing the low-side wing, or by some combination of exercising the high-side landing gear, and flexing the low-side wing. For some combinations of sink and roll rates the low-side gear may fuse (followed by the wing engine/nacelle) and the aircraft may ‘settle in’ on the remaining gear and the low- side wing without compromising fuel tank integrity. For higher sink and roll rates (or lower amounts of wing lift) the low-side wing may fail nonetheless, as a result of exceeding its flexure (bending) limits. The Boeing submission further noted that because “kinetic energy is a form of energy associated with the motion of an object, the kinetic energy dissipated into the landing gear during landing touchdown is derived from both the rate of descent and the aircraft’s rolling rate at touchdown…During a normal landing, the kinetic energy from descent and roll rates is absorbed by shock strut stroking at touchdown, which can be called ‘Phase 1’ energy absorption.” Boeing’s submission added that during “Phase 2” energy absorption, which also occurs via shock strut stroking, “potential energy related to aircraft weight58 eventually gets absorbed by the main and nose landing gears as wing lift is reduced due to the reduction of both angle of attack and forward velocity and deployment of ground spoilers. This energy is normally absorbed some time after the total kinetic energy related to the descent rate is completely absorbed at initial touchdown.” The Boeing submission added the following: In a stabilized approach, assuming calm atmospheric conditions and ignoring ground effect, once the aircraft’s rate of descent is stabilized, vertical acceleration is equal to 1.0 g and lift is equal to the aircraft weight. … If the aircraft’s vertical acceleration at touchdown is a value less than 1.0 g, then the energy that results from the positive acceleration towards the ground due to the reduced lift becomes additive to the kinetic energy from the rate of descent. The effect is that the landing gear has to absorb not only the Phase 1 energy at touchdown, but a portion of the Phase 2 energy at the same time. The end result is a higher load into the landing gear and attaching structure during touchdown. 57 Boeing further stated in its submission that it had “begun an evaluation into the net safety benefit of installing a fuse for vertical overload in the DC-10 and the MD-11 [MLG]…that could take a year or more to complete.” Boeing also stated that it would include the Newark accident scenario in its study of the potential safety benefits of vertical fusing. 58 Potential energy is a function of gravitational acceleration and vertical distance above a reference level, or the relative position of an object.

Factual Information 28 Aircraft Accident Report The accident aircraft’s recorded vertical acceleration at the start of the second touchdown impact was approximately 0.5 g, that is, wing lift was equal to approximately half the aircraft weight, which imparted huge additional potential energy into the landing gear and attaching structure above and beyond those associated with the 11 fps [c.g.] descent rate and the 7 [degree per second] roll rate [which combined resulted in the 13.5 fps sink rate]. In addition, these energies were imparted primarily into the [right] MLG only, due to the right wing down roll angle…at touchdown. At the accident aircraft’s landing weight of 452,000 [pounds]…potential energy of 678,000 ft-lbs was added to the approximately 896,000 ft-lbs. [Right] MLG kinetic energy from the combined aircraft descent and roll rates, for a total energy into the [right] MLG of nearly 1,574,000 ft-lbs. Comparing the loads into the [right] MLG from the accident landing at Newark to the [right] MLG energy absorption requirements for certification shows that the energy developed during the accident landing was over 3 times the reserve energy (ultimate) certification requirements for a single [MLG]. Figure 9 shows Boeing’s calculations of the energy imparted to the right MLG in the Newark accident. The Boeing submission concluded that a “sink rate of approximately 13.5 fps (11 fps at the [c.g.] plus the [right-wing-down] roll rate) at touchdown impact is, by itself, outside the design envelope; a 13.5 fps sink rate landing on a single [MLG] is even further outside the design envelope; [and] a 13.5 fps sink rate landing on a single [MLG] with a net 0.5 g downward acceleration is yet further outside the design envelope.”59 In addition, the Boeing submission noted that it was revising the MD-11 maintenance manual to expand hard landing definition and inspection criteria. Boeing Figure 9. Boeing calculations of right MLG energy in the Newark accident.

Factual Information 29 Aircraft Accident Report stated that the criteria should include “information on the effects of reduced lift and adverse aircraft attitude on loads into the landing gear.” The Boeing submission added the following: Data developed during this investigation show that the absolute recorded vertical acceleration value during landing should not be the only criteria for determining if a hard landing has taken place. The recorded vertical acceleration at the beginning of the touchdown can also be very important. Specifically, if the recorded vertical acceleration at the beginning of the landing is less than 1.0 g, then aircraft weight that is normally accommodated by the 1.0 g wing lift is instead transmitted into the landing gear on top of the loads required to decelerate the airplane vertically from the aircraft’s sink rate. The effects of non-routine aircraft pitch and roll attitudes on energy introduced into singular landing gear should also be part of the hard landing evaluation.60 1.16.2 Dynamic Failure Simulation of MD-11 Right Wing Structure and Right Main Landing Gear Assembly Initial simulation conducted by Boeing did not show loads great enough to cause the failure of the right-wing rear spar, MLG, or associated structure. Subsequently, Boeing contracted with Mechanical Dynamics, Inc., (MDI), a Michigan-based company specializing in dynamic simulation, for assistance. Boeing and MDI developed a computer model of the airplane structure to simulate its flightpath based on the FDR data and determine the resulting dynamic loading imparted to the aircraft structure during the accident.61 MDI and Boeing personnel developed a computer model of an MD-11’s structural elements and validated its static and dynamic characteristics via comparison with certification test data. Two structural failure sequence theories were then explored. The first scenario (beginning at the second touchdown impact) proposed the following failure sequence: • the right MLG strut and tires bottomed but did not fail immediately, the right inboard flap separated, and the outboard bolt of the side brace fitting failed because of inboard load on the lower right MLG; • the subsequent gear failure transferred the load to the No. 3 engine and pylon and outboard wing and flap; and 59 Certification for landing on one wheel is governed by 14 CFR 25.483, “One-wheel Landing Operations.” Based on conditions and assumptions contained in Section 25.473, Section 25.483 requires that an airplane be certified to withstand a 10 fps vertical landing at its maximum landing weight (471,500 pounds) with zero roll angle. 60 Boeing incorporated these findings into a revised maintenance manual that was released in November 1999. 61 The simulation is based on a mechanical system simulation software package, known as ADAMS software, developed by MDI. According to MDI, ADAMS software is also widely used in the automotive, marine, and construction vehicle industries. The Board’s Airplane Performance Group reviewed this simulation effort and verified the methodology.

Factual Information 30 Aircraft Accident Report • the wing failed inboard of the landing gear fitting. According to the Boeing submission, simulations of Scenario 1 did not generate loads great enough to fail the side brace fitting. Scenario 1 also failed to match runway evidence. The simulations for Scenario 2 indicated the following failure sequence: • right MLG strut and outboard tires bottomed and vertical strut “spiked”; • right rear spar web and spar caps fractured inboard of the gear fitting; • inboard upper wing (skin and stringer) panel began to collapse from back to front; • outboard right wing twisted leading-edge down, right MLG wing fitting moved up, and right MLG tires moved aft and outboard; • right inboard flap track came off rollers at the side of the fuselage; • right inboard flap twisted off its outboard hinge support fitting and separated from the aircraft; • excessive movement of the right MLG and its wing attach fitting imparted large prying loads on the side-brace-fitting-to-trapezoidal-panel joint, inboard half of the inboard trap panel fractured, and outboard bolt fractured; • right [engine] nacelle contacted runway; • fuel spilled from the right wing and ignited; • aircraft began to roll clockwise, “dragging” the right wing underneath; and • other failures were consequent. The Boeing submission concluded that its dynamic simulation model of the Scenario 2 accident sequence correlated “substantially with evidence from the crash site” and FDR data.62 Elaborating on this point, Boeing concluded that it is most probable that, as a result of loads applied to the right [MLG] that were substantially beyond design limits, the right wing structure failed. The failure most probably initiated at the rear spar/bulkhead (trunnion) rib interface and progressed through the primary wing box structure. As a result of this failure, the right main gear trunnion moved substantially upward and aft with respect to the trap [trapezoidal] panel fitting. This motion was sufficient to cause the fixed side brace to bind against the pillow block footing, tearing the pillow block loose from the trap panel.63 62 The Boeing submission stated that the “failure of the rear spar web and the wing torque box [was] modeled as perfectly elastic/perfectly brittle. In the real structure, the failure would be elastic/plastic. Consequently, the results from the point of failure of the rear spar on become less quantitative than prior to this point in the event. Nevertheless, the model behavior subsequent to the structural failure appears to be in reasonably good qualitative agreement with the evidence from the crash site.”

Factual Information 31 Aircraft Accident Report 1.16.3 Tests of Airplane Systems Electronic airplane systems that contained nonvolatile memory were removed for examination and testing. Testing determined that the airplane’s three air data computers, the hydraulic systems control module, two flight control computers (FCC), the miscellaneous system controller, and two advanced flight management computers were operating normally before the accident and that their failures were consistent with loss of electrical power after the second touchdown and structural failure of the airplane. The Safety Board reviewed the longitudinal stability augmentation system (LSAS) and found that its inputs to and outputs from the FCC were continuously monitored, even when the LSAS was not actively commanding the elevators (for example, below 100 feet agl). When these monitors detect a failure, a fault is stored in FCC maintenance memory. A review of FCC maintenance memory for the accident flight revealed that the FCCs did not record any LSAS fault messages immediately before or during the first touchdown. Additionally, the system design provides that failures detected with respect to LSAS inputs/outputs will also result in the affected LSAS channel(s) being shut down, which is recorded on the airplane’s FDR.64 The FDR data for the accident flight did not indicate any LSAS failures during the accident landing. The FCCs did record LSAS failure fault messages at speeds below the first and second recorded touchdown speeds (149 knots and 152.5 knots, respectively).65 The airplane’s left and right fuselage-mounted landing light filaments were examined for impact-related failures. The right landing light filament was found intact with its support structure intact. The left landing light filament was broken into pieces and had slight melting on several ends consistent with having broken while operating. No stretching was found on either filament. 1.17 Organizational and Management Information FedEx began U.S. domestic operations with a fleet of 14 Falcon jets on April 17, 1973, and expanded its domestic operations between 1973 and 1980. Following a series of 63 The Boeing submission also noted that, according to simulations, “subsequent to the failure [of the spar web structure], the right wing twists substantially nose-down under the imposed loads. This twisting causes the right wing to ‘dump’ most of its lift and results in a sudden and substantial outboard motion of the right main gear bogie, caused by the fixed and folding landing gear side braces pivoting about their (common) attachment at the trap panel fitting attachment point.” 64 The shutdown is accomplished by deenergizing the elevator’s electrical shutoff valves that, when energized, permit LSAS commands to move the elevator. The shutdown would be annunciated to the flight crew via the LSAS FAIL lights on the overhead panel as well as electronic instrument system alerts (providing there are no display system inhibits in effect); an LSAS “FAIL” would also be logged in the FDR if the fault was sufficiently sustained to be recorded by the FDR (each LSAS channel is sampled twice per second). 65 The airspeeds logged with these faults are generated by the digital air data computer and are routed to the centralized fault display system via the FMCs, resulting in a latency of less than 0.5 seconds from generation to storage.

Factual Information 32 Aircraft Accident Report international mergers in the 1980s, FedEx began operations in Europe and Asia. FedEx operates the largest all-cargo fleet, with a combined transport capacity of about 26.5 million pounds daily. The airline serves 365 airports worldwide in 210 countries with a fleet of 650 airplanes, including 29 MD-11s and 90 DC-10s. More than 150,000 employees handle 3.3 million packages daily (of which 20,000 daily are dangerous goods).66 The company employs about 3,700 flight crewmembers. 1.18 Additional Information 1.18.1 Dissemination of Hazardous Materials Information FedEx uses several forms to document the shipment of hazardous materials on board its cargo airplanes. The form “Notification of Dangerous Goods Loading (Part A)” is completed for all flights, including those without hazardous materials on board. Part A is an envelope with another multicopy form on the front that identifies cargo containers by their positions on the airplane and the classes of hazardous materials, such as flammable liquids and corrosives, in each container. The Part A envelope contains copies of all shipping documentation about hazardous materials on an airplane and is signed by a hazardous materials specialist and the captain. A “Dangerous Goods Separation Pouch” for each cargo container loaded with a declared hazardous materials package is inserted into the Part A envelope. The separation pouch is also an envelope with a multicopy form on the front that identifies the various classes of hazardous materials in a specific cargo container. A copy of the form on the separation pouch is also affixed to both ends of each hazardous materials cargo container. The Part A form and the separation pouch do not indicate the specific hazardous materials and the quantities on board the airplane. Specific information about hazardous materials in a given package, such as the proper shipping name, United Nations (UN) identification number, hazard class, packing group, quantity, and 24-hour emergency telephone number, is listed on a “Notification of Loading of Dangerous Goods (Part B)” form. The Part B form is affixed to a package containing hazardous materials along with a FedEx tracking number and remains on the package throughout shipment. A copy of the Part B form is placed in the separation pouch for the appropriate cargo container. The assembled Part A form, separation pouches, and copies of Part B forms are carried on board the airplane so that they can be available to the flight crew.67 Copies of the Part A form, separation pouches, and Part B forms are also retained at the originating station where the shipment was accepted and at the departing hub of the flight. 66 FedEx fact sheet, June 2000.

Factual Information 33 Aircraft Accident Report The flight crew also carries a “Load and Weight Plan” form, which lists the position and weight of each cargo container on board the airplane. Remarks on the form identify classifications for hazardous materials carried in cargo containers but do not identify the specific shipping name or quantity of the hazardous material in each package. The Port Authority incident commander stated that he requested the accident airplane’s shipping documents about 5 minutes after arriving at the accident site to determine whether hazardous goods were on board.68 Airport police relayed this request to the FedEx office at EWR. After waiting about 20 minutes, the incident commander stated that he dispatched a police officer to the FedEx office to locate the documents. After witnessing the accident, the FedEx manager for international flights at EWR contacted the FedEx Global Operations Command Center (GOCC) in Memphis, Tennessee, to coordinate collection of the accident flight’s cargo documents. The FedEx duty manager also contacted the FedEx office at ANC, the departure station for flight 14, to obtain the hazardous materials shipping documents. Because the hazardous goods shipment originated in Narita, Japan, the Anchorage office did not have copies of the shipping documents. On the basis of preliminary information provided by the FedEx office in Narita and relayed through the Anchorage office, FedEx personnel in Newark forwarded a brief note to firefighters listing several of the hazardous materials on board flight 14, including the amount and the UN classification numbers.69 The incident commander received the list between 0300 and 0320. The incident commander then requested that the Port Authority police contact the Chemical Transportation Emergency Center (CHEMTREC)70 for a description of the materials based on their UN numbers. CHEMTREC responded that some of the material posed a contamination threat to the air and that one of the products might react violently with water. Firefighters were advised to remain upwind of the fire and to wear protective breathing gear. Between 0500 and 0600, the Anchorage FedEx office began faxing hazardous goods information (Parts A and B) obtained from Narita to the FedEx office in Newark. According to the FedEx manager, the faxes were given to the incident commander about 0600.71 67 In addition to requiring that the proper shipping name, UN identification number, hazard class, packaging group, total quantity of the material, and 24-hour emergency telephone number appear on shipping papers for hazardous materials, 49 CFR 175.33 also requires operators to provide this information in writing to the pilot-in-command and copies of the shipping papers to accompany the shipment on the airplane. In addition, Section 175.33 requires that emergency response information required under Subsection 172.600(g) “must be maintained in the same manner as the written notification to pilot-of- command during transport of the hazardous material aboard the aircraft.” 68 The Part A and Part B hazardous materials notification forms carried on board the accident airplane were not retrieved by the flight crew before they evacuated the airplane. 69 The partial, handwritten list contained the UN/North American hazard identification numbers for five of seven hazardous materials on board, including a notation about “36 pounds of unknown hazardous materials.” 70 CHEMTREC is operated by the Chemical Manufacturers Association and was established to provide immediate emergency response information for handling hazardous materials and other chemicals.

Factual Information 34 Aircraft Accident Report 1.18.1.1 Other FedEx Accidents Involving Dissemination of Hazardous Materials Information On September 5, 1996, a FedEx DC-10-10CF was destroyed by fire after making an emergency landing at Stewart International Airport, Newburgh, New York.72 The emergency landing was executed after the flight crew determined that smoke was in the cabin cargo compartment. The Safety Board’s investigation determined that emergency response agencies repeatedly requested specific information about the hazardous materials on board the airplane and that faxes of shipping documents sent by FedEx personnel in Memphis did not reach the incident commander. The Board also determined that many of the faxes were illegible. The Safety Board’s investigation of the Newburgh accident revealed that FedEx “did not have the capability to generate, in a timely manner, a single list indicating the shipping name, identification number, hazard class, quantity, number of packages, and the location of each declared shipment of hazardous materials on the airplane.” In addition, the Board determined that FedEx was “unable to provide complete information to emergency responders in a timely manner [Part B shipping documents were not available to emergency responders].” (See sections 1.18.1.2, 1.18.2, and 2.6 for details of Board recommendations from this accident.) Two subsequent FedEx accidents also involved hazardous materials dissemination issues.73 1.18.1.2 Previous Safety Board Recommendations on Hazardous Materials Information Dissemination As a result of its investigation of the September 5, 1996, FedEx Douglas DC-10 accident at Newburgh, New York, the Safety Board issued Safety Recommendations A-98-75 and -80 on August 12, 1998. The Board noted in its analysis of the Newburgh accident that “compared to other modes of transportation, it is less likely that shipping papers on board an accident aircraft will survive or be accessible because of the greater likelihood of fire and destruction of the airplane. Because of the danger of fire, a flight crew is also less likely to have time to retrieve the shipping papers after a crash.” The Safety Board concluded that “DOT hazardous materials regulations do not adequately address the need for hazardous materials information on file at a carrier to be quickly retrievable in a format useful to emergency responders.” 71 According to 49 CFR 172.600(g), “Emergency Response Information,” emergency response information, including an emergency response telephone number, is required to be “immediately available to any person who, as a representative of a Federal, State or local government agency, responds to an incident involving a hazardous material, or is conducting an investigation which involves hazardous material.” 72 National Transportation Safety Board. 1998. In-flight Fire/Emergency Landing, Federal Express Flight 1406, Douglas DC-10-10, N68055, Newburgh, New York, September 5, 1996. Aircraft Accident Report NTSB/AAR-98/03. Washington, D.C. 73 On April 7, 1998, a Cessna 208 operated by FedEx crashed near Bismarck, North Dakota. On March 5, 1998, a Cessna 208 owned by FedEx and operated by Baron Aviation Services, Inc., crashed near Clarksville, Tennessee.

Factual Information 35 Aircraft Accident Report Safety Recommendations A-98-75 and -80 were issued to the FAA and the Research and Special Programs Administration (RSPA), respectively, and asked them to: Require, within 2 years, that air carriers transporting hazardous materials have the means, 24 hours per day, to quickly retrieve and provide consolidated, specific information about the identity (including proper shipping name), hazard class, quantity, number of packages, and location of all hazardous materials on an airplane in a timely manner to emergency responders. In an October 27, 1998, response to the Safety Board, the FAA noted that RSPA was “the lead agency on this issue” and was drafting an advance notice of proposed rulemaking (ANPRM) to “require air carriers to develop and implement a system capable of providing this information during instances of emergencies.” Because Safety Recommendation A-98-80 was identical to Safety Recommendation A-98-75 issued to the FAA, the FAA response asked the Board to close Safety Recommendation A-98-75. In a November 9, 1998, response to RSPA, the Board acknowledged that RSPA and the FAA “were jointly developing” an ANPRM “to seek public comment on these recommendations.” Pending completion and review of the final rule, the Board classified Safety Recommendation A-98-80, to RSPA, “Open—Acceptable Response,” which is its current status. Noting RSPA’s assumption of lead agency responsibility in an April 22, 1999, letter to the FAA, the Board classified Safety Recommendation A-98-75 “Closed—No Longer Applicable.” In a June 28, 2000, letter, the Safety Board requested an update from the RSPA regarding its progress on Safety Recommendation A-98-80. In a July 20, 2000, letter, RSPA stated that it is in the final stages of developing the ANPRM with the FAA and anticipates publishing it in the Federal Register by September 1, 2000. (See section 2.6 for further discussion of RSPA’s response.) 1.18.2 Cargo Operator Review and FedEx Postaccident Actions As part of its investigation of the accident involving the FedEx DC-10 in Newburgh, Safety Board investigators reviewed seven other operators that carry cargo74 to determine if they had the ability to quickly retrieve and produce complete information about hazardous materials carried on board a particular flight. Board investigators found that only one carrier (Swissair) had a computerized capability to provide information about the declared hazardous materials on board its airplanes. Swissair reported that all of its notification to captain (NOTOC) forms were accessible by computer and that it had developed a “simplified” NOTOC that contained the UN number, classification, name, quantity, drill code (emergency response guide), and destination of hazardous goods on board.75 According to the Board survey, the remaining carriers, like FedEx, tracked this 74 The September 1997 survey was administered to Airborne Express, United Parcel Service, Northwest Airlines, Swissair, United Airlines, British Airways, and Delta Air Lines.

Factual Information 36 Aircraft Accident Report information only by retaining, at the departing station, paper copies of the hazardous materials shipping documentation carried on board the airplane. In a May 5, 1998, letter to the Safety Board, FedEx’s president and CEO stated that FedEx was developing “systems and procedures which will reduce substantially the length of time required to provide firefighters and other emergency responders with detailed information concerning [hazardous materials] shipments aboard FedEx aircraft.” The letter stated that FedEx planned to first create an “intermediate solution” consisting of an “electronic notification system upon which basic [hazardous materials] information of interest to firefighters will be entered by a DG [dangerous goods] specialist at airport ramps at departure of FedEx aircraft,” including information on hazard class, quantity, and location of all hazardous materials on the airplane. FedEx’s May 5 letter outlined a “permanent solution” that would allow “the tracking, by container and aircraft, of [hazardous materials] shipments throughout the shipping cycle. Complete [hazardous materials] information, including inbound and outbound…manifests, will be available on an immediate basis at the FedEx GOCC, which is manned 24 hours-a-day, 7 days a week, and all FedEx facilities.”76 The letter indicated that this system would require “extensive system development efforts, along with scanning technologies which are currently under development” and that such development would take about 18 months before testing. In a May 20, 1998, letter, the Safety Board replied that FedEx’s plan appeared “reasonable and responsive” and asked the company to keep the Board informed of its progress and the effectiveness of the new systems. FedEx informed the Safety Board of its progress in implementing the changes in a March 4, 1999, letter. FedEx stated that the interim system, the “manual entry of hazard class, total quantity and location of each Dangerous Good on each departing aircraft’s Flight Dispatch Report,” had been implemented in July 1998. The letter added that this eliminated “the necessity of faxing the basic and most needed” hazardous materials information after an accident and that the proposed fully automated tracking and tracing 75 The simplified form, designed for use in emergencies, contains less information than required by 49 CFR 175.33 and ICAO’s “Technical Instructions” for hazardous cargo transport. U.S. carriers must use the more detailed form required under Section 175.33. 76 FedEx refers to the automated dangerous goods tracking system by the acronym BADGES (Beneficial Automation of Dangerous Goods Entry System).

Factual Information 37 Aircraft Accident Report system remained under development but would be ready for testing in late 1999. The letter added the following: This system will be able to generate, on an immediate basis, a [DG] manifest which contains all of the required regulatory information for all DG shipments on every FedEx aircraft and truck…This is possible because of advanced scanning technology, sophisticated computer program development, and a dedicated and exclusive DG server. In addition to simply maintaining and displaying information, we believe the system will also alert aircraft loaders of potential problems with incompatible DG shipments, and alert truck drivers of the need for specific placards. These capabilities will reduce manifest entry mistakes and cargo loading errors, thus rendering our carriage of DG safer. It will certainly assist our efforts to get specific DG information to emergency providers. In an April 5, 1999, letter, the Safety Board acknowledged FedEx for “the actions the company ha[d] initiated” and requested updates on the test and implementation of the system. In his April 19, 1999, letter to the Board, FedEx’s president and CEO stated that FedEx planned to trial test the software in October 1999 with a “full rollout to occur soon thereafter.” In its March 9, 2000, letter and subsequent briefings, FedEx announced that following completion of the October 1999 software test in New Orleans, Louisiana, software changes would be finalized and more testing would be conducted in September 2000 at its St. Louis, Missouri, facility. In a March 24, 2000, letter, the Safety Board replied that it “was gratified that FedEx remained fully committed to the development and implementation of this important safety system.” The Safety Board notes that recent software developments now offer cargo carriers several options for online retrieval of dangerous goods information, such as identifying specific information about hazardous materials on board an airplane and providing information to emergency response personnel. Several air carriers are reported to be incorporating this software into their tracking systems. 1.18.3 FedEx MD-11 Tailstrike Awareness and Training Initiatives FedEx developed and implemented an MD-11 tailstrike awareness training program in June 1996. The program was designed to increase flight crew awareness of pilot-controlled factors that contribute to MD-11 tailstrikes, including control inputs that affect pitching tendency after touchdown. The program also focused on maintaining proper sink rates, bounce recovery, and low-level go-around techniques. FedEx incorporated the tailstrike awareness training into its MD-11 initial, transition, and recurrent training syllabi. The company also compiled and distributed a four-page “Tail Strike Awareness Information” bulletin (see appendix E) for flight crews to study before simulator training.77 A 25-minute awareness video was added to FedEx’s recurrent ground school syllabus in August 1997.

Factual Information 38 Aircraft Accident Report The 1996 information bulletin stated that landing tailstrikes had occurred under the following conditions: “Flaps 35 and flaps 50, forward and aft [c.g.], light and heavy gross weight, and over-serviced and correctly serviced struts.”78 The bulletin also stated that “one consistent factor in every landing tail strike to date [has] been an excessive descent rate with an increasing pitch attitude prior to initial touchdown.” It added that high sink rates can be caused by an unstable approach, late or abrupt align (de-crab)79 maneuver, or early flare. The instructor’s guide (see appendix F) for the 1996 Tail Strike Awareness Training program noted that “25 percent of MD-11 tail strikes to date have occurred on takeoff and 75 percent on landing.” The instructor’s guide recommended a 7.5° pitch attitude and thrust to recover from high sink rate and bounce. It added the following: If a bounce occurs, a go-around should be initiated. Low level go-arounds, i.e., less than 20 feet [radio altitude], are dramatically different than higher altitude go- arounds. High altitude go-arounds are initiated with pitch, while low level go- arounds must be initiated with thrust. During low level go-arounds main wheel touchdown may be unavoidable. The PF [pilot flying] must not exceed 10 degrees of pitch or retract the landing gear until passing 20 feet [radio altitude] with a positive rate of climb. Some tail strikes have occurred as a result of the pilot attempting to arrest a high sink rate or bounce by quickly adding up elevator. This technique immediately increases both the effective weight of the aircraft and the aircraft’s vertical velocity. The resulting increased attitude rate will aggravate the pitching tendency after touchdown and drive the main wheels into the ground, thus compressing the main wheel struts. The aft fuselage will contact the runway at approximately 10 degrees pitch attitude with the struts compressed. The 1996 instructor’s guide included simulator scenarios designed to demonstrate tailstrike avoidance techniques. The approach and landing simulations included an early flare scenario and a high sink rate and bounce recovery demonstration. FedEx’s 1996 MD-11 flight manual (section 7-46) noted that autothrottles should be used for landings “and will begin to retard after passing 50 feet agl.”80 The manual 77 The material in this June 1996 bulletin has since been updated and incorporated in FedEx flight and training manuals. In addition, following this accident, FedEx developed a tailstrike briefing guide for the tailstrike awareness program that incorporated MD-11 landing gear certification data, vertical acceleration information (the effects of acceleration on the weight bearing capability of the MLG), and described the effects of roll and pitch rates on total sink rate. For example, the FedEx bulletin describes the following landing situation: “If the pilot pushes the nose over and unloads the aircraft to .5 g prior to touchdown, the weight bearing capability of the landing gear will be reduced to 6 fps (from the original 10 fps certification).” It added: “One could easily imagine a case where a pilot inadvertently unloads the aircraft to .5 g reducing the weight bearing capability of the [MLG] to 6 fps, and also lowers the upwind wing just prior to touchdown at 6° per second generating another 2 fps of total sink rate at the [MLG], leaving only 4 fps (240 fpm) of capability.” 78 FedEx’s current version of the MD-11 tailstrike awareness training program adds that tailstrikes have also occurred “with full, mid and no spoiler deployment.” 79 The de-crab maneuver is the act of aligning the airplane’s longitudinal axis with the runway before touchdown during a crosswind landing.

Factual Information 39 Aircraft Accident Report stated that pilots should avoid holding the “aircraft off in an attempt to achieve a smooth landing. Holding [the] aircraft off to achieve a smooth landing may result in a long touchdown, unusually heavy braking, a higher pitch attitude and reduced tail clearance.” The manual also noted: Below 10 feet with the aircraft fully flared (sink rate approximately 2-4 [fps]), the basic technique is to maintain attitude by applying the required control wheel pressures. A more advanced technique is to relax the back pressure to lower the nose (approximately 1°) prior to main gear touchdown.81 The 1996 MD-11 flight manual also noted that “another contributor to tail strikes during landing is the nose-up pitching force generated by automatic ground spoiler deployment at main gear spin up.” The manual (section 7-118) added: This is quickly noted and pilots are taught to compensate for it during initial and transition training. It then becomes part of the MD-11 pilot’s reflexes. Spoiler pitch-up is still present during every landing, and must be counteracted. If touchdown does occur with higher than normal pitch attitude, the nose should be lowered promptly to prevent spoiler deployment from further increasing the pitch attitude. FedEx’s revised MD-11 flight manual (section 7-1-6-1, dated June 30, 1998) noted that if the airplane “flares early and the autothrottles are allowed to retard, the airspeed will decay, elevator effectiveness will be reduced, and a higher pitch attitude will be required making pitch-up tendency after touchdown more pronounced and more difficult to counteract.” The manual stated that after countering any pitch-up tendency after main wheel touchdown, the pilot should “fly the nose wheel smoothly to the runway82 [and] avoid full elevator down input.” The revised manual also called for a 7.5° pitch attitude in bounce recovery and increased thrust “until the sink rate has been arrested and/or a normal landing is accomplished.” In “Know Your MD-11,” a 1993 operator letter, McDonnell Douglas recommended the following procedure for flaring the airplane under normal conditions: Autothrottles will begin to retard after passing 50 feet, and a slight flare should be initiated between 30 and 40 feet (approximately 2 degrees). The aircraft should touch down in the touchdown zone…Do not hold the aircraft off. 80 As of Revision 28, June 30, 1998, the use of autothrottles is no longer mandatory for FedEx flight crews. 81 This paragraph was deleted in later revisions of FedEx’s MD-11 flight manual as a result of the accident analysis provided by Boeing. 82 The June 1995 version of the MD-11 FCOM also stated that pilots should be prepared to counter “any pitch-up tendency as spoilers extend.” The section, “Landing Characteristics and Techniques,” added that after spoiler extension, pilots should “fly [the] nosewheel to [the] runway.”

Factual Information 40 Aircraft Accident Report In addition, section 7-1-6-1 of the revised (1998) FedEx MD-11 flight manual described the following procedures for a normal landing: Aim to touch down 1,500 [feet] from the runway threshold. The runway threshold should disappear under the nose at about the same time CAWS announces ‘100 [feet].’ Maintain a stabilized flight path through the 50 and 40 foot CAWS callouts (unless sink rate is high). At 30 [feet] a smooth 2.5-degree flare should be initiated so as to arrive below 10 [feet] in the landing attitude. Do not trim in the flare. Elevator back pressure should be relaxed, and a constant pitch attitude should be maintained from 10 [feet] radio altitude to touchdown. Section 7-1-6-2 of the FedEx flight manual stated that crosswind landings are accomplished by flying the final approach in a wings level attitude with a crab into the wind. At approximately 200 [feet] agl, align the fuselage with the runway by smoothly applying rudder and maintain runway centerline by lowering the upwind wing. In high crosswinds, consideration should be given to commencing the align maneuver (de-crab) prior to 200 [feet] agl. The align maneuver shall be established by 100 [feet] agl.”83 The manual cautions that “excessive sink rates and subsequent tailstrikes have occurred as the result of a late or abrupt align (de-crab) maneuver. The 1993 “Know Your MD-11” operator letter also recommended the following guidelines on go-around decisions while on approach to landing: Experience has shown that approaches which result in large pitch deviations, and which never achieve true speed and glide path stability are much more likely to produce unpredictable landings; hold-offs, floats, hard touchdowns, strong rebounds and tailstrikes. Such approaches make it nearly impossible to establish a proper crosswind correction, and are especially risky on contaminated or slippery surfaces. A destabilized approach is a compelling reason to initiate an early go- around. The MD-11 flight crew operating manual (FCOM), “Procedures and Techniques” (30-01, Volume Two, June 1995), states that if an airplane “is not stabilized by 500 feet agl, a missed approach should be executed.”84 83 FedEx’s tailstrike awareness program stated that the align maneuver was “commonly referred to as a forward slip.” The term “forward slip” has since been replaced by “slip,” which more accurately describes this maneuver. 84 Boeing, in its submission to the Safety Board, stated that “operators should stress to their flight crews the importance of executing a go-around any time below approximately 500 agl that a stable approach becomes destabilized. As a general ‘rule of thumb,’ if large power and/or control deflections are required to maintain desired flight path and/or alignment with the runway, then a go-around is warranted.”

Factual Information 41 Aircraft Accident Report 1.18.4 MD-11 Hard Landing Accident at Hong Kong International Airport On August 22, 1999, a China Airlines MD-11 crashed during a landing approach to Hong Kong International Airport. Of the 315 passengers and crew aboard, two were fatally injured, one passenger died later at a hospital, and 199 received various injuries. The aircraft was destroyed by impact and subsequent fire. The weather at the time of the accident included high winds and rain. According to the Hong Kong Civil Aviation Department, after obtaining visual contact with the runway, the captain disconnected the autopilot but left the autothrottle system engaged. The airplane then continued to track the extended centerline but descended and stabilized slightly low on the glideslope. At around 50 feet above the runway, coincident with the reduction of power to flight idle by the autothrottle system and an increase in pitch attitude, the indicated airspeed reduced from 170 knots to 152 knots immediately before touchdown. Although an attempt was made to flare the airplane in a slightly right-wing-down attitude (less than 4°), the sink rate was maintained and a hard landing occurred. The right main wheels contacted the runway first, followed by the right engine cowling; the right landing gear and wing separated as the aircraft rolled inverted. The right wing front spar fractured at station (STA) 268 (4 inches outboard from the STA 264 bulkhead that separates the #2 and #3 fuel tanks). This was a vertical fracture that intersected the lower and upper cap. The rear spar fractured at STA 222 at the lower cap. The rear spar fracture progressed diagonally upwards and inward to the upper cap at STA 185. Preliminary calculations conducted by the Safety Board indicate that the airplane’s rate of descent at impact was 18 to 20 fps. This accident is still under investigation by the Hong Kong Civil Aviation Department. 1.18.5 DC-10 Hard Landing Accident in Faro, Portugal On December 21, 1992, a DC-10-30CF operated as Martinair flight 495 crashed while landing on runway 11 at Faro (Portugal) Airport. There were 340 passengers and crewmembers on board at the time of the crash. Two cabin crewmembers and 54 passengers were killed, and 104 passengers were seriously injured. The Portuguese accident investigation report, prepared by the Director-General of Civil Aviation (DGAC),85 stated that the right MLG hit the runway in a right-wing down attitude on the left side of the runway. The right MLG collapsed inboard and the “right engine and right wing tip contacted the runway,” the report stated. “The right wing suffered total rupture 85 Director-General of Civil Aviation. 1992. McDonnell Douglas Corporation DC-10-30F, Martinair Holland NV, Final Report on the Accident Occurring at Faro Airport—Portugal, on 21 December 1992, Report no. 22/Accid/GD1/92. The report was translated from Portuguese into English by the Netherlands Aviation Safety Board.

Factual Information 42 Aircraft Accident Report between the fuselage and the right engine. The aircraft slid along the runway for about 30 meters [98 feet] and gradually moved to the right, supported by the center landing gear.” The DGAC report added the following: After the rupture of the right wing, fire developed and enveloped the fuselage from the right to the left. The right wing followed a trajectory next to the aircraft up to the area [where] it came to rest. The aircraft [departed] the runway at the right-hand side, with a track of about 120 degrees, in an inverted position. When leaving the runway and entering the runway edge…the aircraft rolled left and the left wing bottom side dug into the ground and disintegrated partially, and the fuselage broke into…sections. It came to rest with the rear section in a normal position and the front section on the left side with the windows and doors [contacting] the ground. The fuel flowing from the tanks caused explosions followed by fire, causing the destruction of the rear fuselage up to the rear pressure bulkhead. The airplane came to rest about 3,609 feet from the runway threshold and about 328 feet to the right of the runway centerline. The DGAC report stated that numerous thunderstorms were reported in the vicinity of the airport and concluded that the airplane had encountered turbulence “associated with microburst and downburst phenomena”86 on final approach at an altitude of about 750 feet radio altitude. The report stated that the approach then became unstable with a descent rate that varied from 100 fpm to 1,300 fpm. The report stated that as the airplane crossed the runway threshold, it “encountered a crosswind component of 40 knots, and a tailwind component of 10 knots.”87 The airplane landed with a 7° crab angle to the right, a 8.79° nose-up pitch angle, a 5.62° left-wing-up roll and 1.95 g vertical acceleration, the report stated. A postaccident metallurgical examination of the right MLG determined that “the gear parts and the associated mechanisms were, at the time of the accident, without fatigue defects or defects of any other type and had no previous fatigue damage.” The report concluded that the “rupture happened exclusively due to the impact on landing which produced the overload which induced in the components and critical zones instantaneous levels of tension which exceeded the material static limit resistance.” The DGAC determined that the probable causes of the accident were “the high rate of descent in the final phase of the approach and the landing made on the right landing gear, which exceeded the structural limitations of the aircraft, [and] the crosswind, which exceeded the aircraft limits and which occurred in the final phase of the approach and during landing.” In connection with its work on the Newark accident, Boeing calculated that the airplane involved in the Faro accident landed on its right MLG at a vertical speed of 86 A downburst is a strong, concentrated downdraft that creates an outward burst of damaging winds at the surface and is usually associated with convective showers and thunderstorms. A microburst is a downburst that has a maximum horizontal extent of 2.5 miles. 87 Winds at the time were reported from 220°, gusting to 35 knots.

Factual Information 43 Aircraft Accident Report 17 fps, or 263 percent greater than its energy certification limit. The Boeing submission stated that “because of the difference in potential energies into the respective [right] MLG, the Newark landing, at 13.5 fps, was a more severe test of the landing gear than the Faro accident at 17 fps.” The Boeing submission also stated the following regarding the accident at Faro: [A]t a landing weight of 353,000 [pounds], lift at start of touchdown of approximately 1.1 times the aircraft weight, and descent rate at the aircraft [c.g.] of approximately 15 fps and roll rate of 6 [degrees per second], the kinetic energy, 1,259,300 ft-lbs, was decreased by potential energy (from increased lift) by approximately 106,000 ft-lbs, for a total energy of approximately 1,153,000 ft-lbs on the [right] MLG. Comparing the Faro accident energy with the DC-10-30’s [right] MLG energy required for certification shows that the energy developed during the Faro accident landing was over 2 and a half times the reserve energy (ultimate) certification requirements for a single [MLG]. Figure 10 shows Boeing’s calculations of the energy imparted to the right MLG in the Faro accident. 1.18.6 Lockheed L-1011 Hard Landing Accident in New York On July 30, 1992, a Trans World Airlines (TWA) L-1011 experienced an aborted takeoff shortly after liftoff from John F. Kennedy International Airport, Jamaica, New York, and a subsequent hard landing.88 The airplane came to rest, upright and on fire, Figure 10. Boeing calculations of right MLG energy in the Faro accident.

Factual Information 44 Aircraft Accident Report about 290 feet left of the departure end of runway 13R. There were no fatalities, but 10 of the 280 passengers on board were injured during the emergency evacuation that followed. The Safety Board’s investigation determined that immediately after the airplane lifted off the ground, the stall warning stick shaker89 activated and the airplane began to descend back to the runway. The captain retarded the throttles and executed a landing on the remaining runway. Although the Board determined that the airplane was “performing properly, had accelerated well above V2 90 and could have climbed out successfully, the airplane reached about 16 feet of altitude before descending to the runway.” The Safety Board added the following: The airplane landed hard, and the right wing sustained a fracture of the rear inboard spar because the airplane touched down with a sink rate of about 14 [fps]. The airplane’s gross weight was about 71,000 pounds over the approved maximum landing weight, and the sink rate was well over the certified design limit of 6 [fps] for the structure. The Safety Board concludes that the failure of the right wing inboard rear spar was caused by the severe overload stresses imposed at touchdown. The FDR data revealed that the airplane was banked right wing low about 1.1° at touchdown, which occurred with the centerline of the airplane just to the left of the center crown of the runway. Therefore, the right [MLG] probably touched down before the left [MLG], and the right wing took the initial violent forces, overloading the structure. The fractures noted in the right wing were consistent with such forces. Further, the forces imposed on the right wing rear spar during rotation for takeoff were calculated to be significantly less than those occurring at touchdown. Therefore, the Safety Board concludes that the fracture of the right wing rear spar occurred upon landing. In connection with its work on the Newark accident, Boeing calculated that the L-1011’s sink rate of about 14 fps and pretouchdown vertical acceleration of 0.75 g resulted in vertical loads 216 percent greater than certification limits. Boeing’s submission also noted that “the 0.25 g nose-down ‘push-over’ (1.0 g minus 0.75 g at start of accident touchdown) during [this] accident was only half of the 0.50 g nose-down ‘push- over’…during the Newark accident.” Figure 11 shows Boeing’s calculations of the energy imparted to the right MLG in the L-1011 accident. 88 National Transportation Safety Board. 1993. Aborted Takeoff Shortly After Liftoff, Trans World Airlines Flight 843, Lockheed L-1011, N11002, John F. Kennedy International Airport, Jamaica, New York, July 30, 1992. Aircraft Accident Report NTSB/AAR-93/04. Washington, D.C. 89 The stick shaker, or control column shaker, is part of the airplane’s stall warning system. An aerodynamic stall occurs when airflow over the airplane’s wings and tail is sufficiently disrupted to result in loss of lift and control. 90 V2 is takeoff safety speed.

Factual Information 45 Aircraft Accident Report 1.18.7 Other Landing Accidents The Safety Board has investigated or participated in the investigation of several accidents in which pilots mishandled the airplanes during the landing phase. For example, in 1993, an American Airlines McDonnell Douglas DC-10 was destroyed during landing at Dallas-Fort Worth International Airport, Dallas, Texas.91 The Board’s investigation found that although the touchdown was uneventful, the airplane veered off the side of the runway shortly thereafter because the captain held insufficient downward pressure on the control yoke after touchdown and attempted to steer the airplane with the tiller rather than through rudder application. The Safety Board also assisted with the international investigations of three similar landing accidents involving Boeing 767s: an Asiana Airlines 767-300 in Cheju Island, South Korea, on January 16, 1992; American Airlines flight 957 in São Paulo, Brazil, on October 27, 1992; and LOT flight 002 in Warsaw, Poland, on December 31, 1993. Each accident occurred when the pilots applied large nose-down control column deflections after MLG touchdown, which resulted in large nose-down pitch rates and high vertical velocities at the nose gear. The combination of vertical velocity and pitch rate at nose-gear contact resulted in compression loads that exceeded the design loads of the forward fuselage crown structure. Although Boeing had published landing techniques92 in its flight training manual, which were furnished to Boeing 767 operators before these accidents occurred, the Figure 11. Boeing calculations of right MLG energy in the TWA L-1011 accident. 91 National Transportation Safety Board. 1994. Runway Departure Following Landing American Airlines Flight 102 McDonnell Douglas DC-10, N139AA Dallas/Fort Worth International Airport, Texas April 14, 1993. Aircraft Accident Report NTSB/AAR-94-01. Washington, D.C.

Factual Information 46 Aircraft Accident Report techniques had not been implemented consistently or completely by all operators. The Safety Board also learned from discussions with Boeing representatives that the DC-10 and MD-11 had experienced similar instances of damage after being mishandled during the post-touchdown derotation maneuver. Consequently, on June 16, 1994, the Board issued Safety Recommendations A-94-118 and -119. Safety Recommendation A-94-118 asked the FAA to: Require that all FAA-approved Boeing 757/767 Operating Manuals, and other airplane model Operating Manuals as deemed appropriate, clearly communicate derotation techniques and the potential for excessive pitch rates after touchdown if pilots use large nose-down control column deflections. Such information should be inserted in the sections of the manual that refer to normal and crosswind approach and landing, as a cautionary note. Instructions calling for positive forward control pressure after nose wheel touchdown should be replaced with a warning to smoothly fly the nose wheel to the runway by relaxing aft control column pressure and not to use full down elevator. In an August 29, 1994, letter, the FAA stated that it had reviewed the FAA- approved Boeing 757/767 Airplane Flight Crew Training Manual and Boeing’s “guidance concerning the potential for excessive pitch rates after touchdown if pilots use large nose- down control column deflections.” The FAA noted that the derotation procedures specified in the Boeing 757/767 Airplane Flight Crew Training Manual were consistent with those outlined in Safety Recommendation A-94-118 and were “similar to the guidance contained in McDonnell Douglas pilot operating manuals.” The FAA also stated that it reviewed other actions by Boeing to “inform Boeing 757/767 pilots of proper derotation procedures,” which included specification of proper landing techniques in the 767 Flight Crew Training Manual, issuance of a technical bulletin on proper flare and landing techniques, onsite reviews of proper derotation techniques with all Boeing customers, and review of the issues at a 1993 flight operations symposium. The FAA stated that it had determined that these actions were “effective and…[were] more extensive in addressing this issue than a cautionary note in the FAA-approved Boeing 757/767 Airplane Flight Manual.” The Safety Board agreed and classified Safety Recommendation A-94-118 “Closed—Acceptable Alternate Action” on August 1, 1995. Safety Recommendation A-94-119 asked the FAA to: Modify initial and recurrent Boeing 757/767 pilot training programs, and other airplane model pilot training programs as deemed appropriate, to include discussion of derotation accidents. In response to Safety Recommendation A-94-119, the FAA issued Flight Standards Information Bulletin for Air Transport (FSAT) 95-06, “Derotation Accidents During Landings of B-757/767, DC-10, and MD-11 Aircraft,” to all FAA Flight Standards personnel. The FSAT, which was effective February 12, 1995, and expired February 29, 92 Step five in the published Boeing guidance states that after MLG touchdown, speedbrake deployment, and reverse thrust initiation, the pilot should “smoothly fly the nose wheel onto the runway by relaxing aft control column pressure [and should] not use full down elevator.”

Factual Information 47 Aircraft Accident Report 1996, reiterated the main points of the safety recommendation, including the Boeing- recommended derotation technique. Consequently, the Board classified Safety Recommendation A-94-119 “Closed—Acceptable Action.” 1.18.8 Safety Board Recommendations Relating to DC-10 and MD-11 Spoiler Pitch-up Incidents On August 2, 1992, a McDonnell Douglas MD-11, operated by Delta Air Lines, pitched nose-up after landing at Los Angeles International Airport and contacted the runway, damaging the airplane’s aft fuselage. The airplane was later ferried to Atlanta for repairs, where it again pitched nose up after landing. In that incident, the pitching moment was corrected before the tail contacted the runway. As a result of its investigation of this incident, the Safety Board issued Safety Recommendation A-93-57, on June 3, 1993, which asked the FAA to: Require McDonnell Douglas and U.S. operators of the DC-10 and MD-11 airplanes to revise their DC-10 and MD-11 [FCOM]s (or equivalent documents) to include an accurate and complete description of the ground spoiler-induced nose pitch-up tendencies of the airplanes and the specific pilot control techniques that may be required to counter those tendencies during landing. The FAA agreed with the recommendation, and the manufacturer issued temporary revisions to its MD-11 and DC-10 FCOMs on June 25, 1993, and July 1, 1993, respectively, that described the airplanes’ ground spoiler-induced nose pitch-up tendencies and specific pilot control techniques required to counter those tendencies.93 The revisions were transmitted to all MD-11 and DC-10 domestic operators and foreign airworthiness authorities. The FAA also issued Flight Standards Information Bulletin 93-36, which directed FAA principal operation inspectors (POI) to ensure that the revised material was incorporated into their assigned operators’ FCOMs. In November 1994, as a result of the FAA’s and manufacturer’s actions, the Safety Board classified Safety Recommendation A-93-57 “Closed—Acceptable Action.” As a result of the same Delta Airlines incident, the Safety Board also issued Safety Recommendation A-93-59, which asked the FAA to: Require McDonnell Douglas to study possible revisions to the DC-10 and MD-11 ground spoiler deployment logic to reduce the possibility of landing tailstrikes. The revisions should include, but not be limited to, the following general concepts: if the aircraft touches down at a pitch angle close to the tailstrike pitch angle, initial partial ground spoiler deployment should not occur until the pitch angle falls below a specified angle; and nose gear strut compression status should be maintained long enough to ensure that the nose wheel is firmly on the ground, and has not just momentarily touched the ground, before full deployment of the ground spoilers occurs. 93 The temporary revisions were incorporated into the standard revision cycle for the FCOMs of both aircraft. The applicable standard revisions for the MD-11 and DC-10 FCOMs were dated December 1, 1993, and October 15, 1993, respectively.

Factual Information 48 Aircraft Accident Report In a May 15, 1995, letter, the FAA responded that the “majority of DC-10 tailstrikes occurred early in the service life [of the DC-10 model] when ground spoilers were commanded to the full-up position by main gear spin-up” and that “some of the strikes were the result of poor pilot techniques and may have occurred regardless of the ground spoiler-induced pitch-up tendency.” The FAA added that “McDonnell Douglas in 1975 began offering a kit change notice that changed the logic to have the spoilers deploy only partially to the in-flight spoiler position on main gear wheel spin-up; and then to the full ground spoiler position following nose strut compression. This two-stage logic was incorporated into the basic design of the MD-11 as standard equipment.” The FAA concluded that “as a result of these changes and increased flight crew awareness, the potential for tailstrikes ha[d] been considerably reduced” and that no further action was warranted. On July 17, 1995, the Safety Board disagreed with the FAA's May 15 response, classifying the recommendation “Open—Unacceptable Response.” In its reply to the FAA, the Board noted that tailstrikes had continued to occur after the 1975 modification to the DC-10 and its implementation on the MD-11. The Board also noted that its review of the manufacturer's incident records showed that there had been five landing tailstrike incidents involving DC-10 and MD-11 airplanes since the August 2, 1992, incident that may have been the result of ground spoiler deployment logic. The Board asked the FAA to explain how its review concluded that ground spoiler deployment logic was not a contributing factor in those incidents. The Board reiterated its belief that “initial spoiler deployment should be inhibited until the nose of the airplane is lowered sufficiently that a tailstrike is unlikely.” In an October 10, 1995, response to the Safety Board, the FAA stated that its review indicated that the referenced tailstrike incidents “were not related solely to early spoiler deployments.” The FAA stated that it received reports from manufacturers daily and that it meets with manufacturers to investigate problems if a significant event or trend is identified, such as those referenced by the Board. The FAA stated that it had concluded that “the incidents were not caused solely by ground spoiler deployment.” The FAA reiterated its conclusion that a revision to the ground spoiler deployment logic was not warranted, adding that such a revision “would adversely affect safety by increasing the airplane's landing roll distance.” In a December 20, 1995, response to the FAA, the Safety Board noted that in three of the five incidents reviewed by the FAA, the spoiler-induced pitching moment likely contributed to the tail drag occurrences. The Board stated that the “spoiler deployment logic change could be implemented without increasing landing distances” because “high pitch attitudes after touchdown are associated with low landing speeds, which may result in shorter landing distances.” The Board added that “timely lowering of the pitch attitude, which is retarded by spoiler deployment, is probably more important for safe stopping than spoiler deployment at high pitch attitudes.” The Board further added that it had been informed by Boeing that “landing distance penalties did not occur when it changed the spoiler logic on the Boeing 757” after the company had several early Boeing 757 ground spoiler logic-related tail drag incidents. The Board noted that Boeing determined that

Factual Information 49 Aircraft Accident Report “delaying deployment of outboard spoilers” reduced the nose-up pitching moment. Based on the FAA’s decision not to take further action, Safety Recommendation A-93-59 was classified “Closed—Unacceptable Action.” 1.18.9 MD-11 Flight Control Computer Software Changes In December 1995, the MD-11 FCC-907 software certification introduced a pitch rate damper (PRD) control law to the previously certified LSAS. The -907 PRD utilized inertial reference unit (IRU) pitch rate feedback in the LSAS elevator control laws to counter pitch rate tendencies, thereby increasing the apparent static stability of the aircraft. According to Boeing, this change was implemented as a product improvement to help minimize MD-11 high-altitude upsets.94 Because it was decided during FCC-907 development not to affect the MD-11’s low-altitude, low-speed handling qualities, the PRD was designed to phase-in and phase-out on a pressure altitude schedule (15,000 to 20,000 feet). Boeing has developed an MD-11 FCC software upgrade—FCC-908—that was FAA-certified on May 23, 2000. The upgrade primarily comprises modifications to three subfunctions—PRD, pitch attitude protection (PAP), and positive nose lowering (PNL)— of the LSAS. Boeing refers to these LSAS subfunctions as a low altitude stability enhancement (LASE) package. Boeing indicates that the LASE package implementation has two design goals. The first is to employ the existing LSAS to provide deterrence against tailstrikes; Boeing indicates this goal was established in response to the Safety Board’s Safety Recommendation A-93-59. The second goal is to augment the natural aircraft longitudinal handling qualities, via LSAS, in a manner approximating the handling qualities of the existing DC-10. Both objectives are intended to facilitate a common type rating between the MD-11 and the MD-10.95 The MD-11 FCC-908 software upgrade will activate the PRD control loop below 15,000-feet pressure altitudes at a reduced gain. Whereas the -907 PRD feature was inactive at low altitudes, the -908 PRD will remain active at 30 percent strength from approximately 17,500 feet down to takeoff/landing field elevation. Because the PRD increases the apparent static stability, longitudinal handling qualities of the MD-11 will be more like those of the DC-10. 94 The Safety Board investigated some of these upsets, including the April 6, 1993, China Eastern MD-11 accident at Shemya, Alaska, and the December 7, 1992, China Air accident at Anchorage, Alaska. 95 According to information provided by Boeing, the MD-10 is a modification of the DC-10 model that was customized for FedEx. Like the MD-11, the MD-10 design incorporates a two-person flight crew complement with associated changes to flight deck displays and system controls. The basic fuselage, wing, control surface, flight control, and engine designs were not changed from those of the DC-10. On May 9, 2000, the FAA granted Boeing an amended type certificate for the MD-10 freighter. The FAA also approved a common pilot type rating and landing proficiency credit for the MD-10 and -11, provided that the MD-11 incorporates FCC-908 to render its handling similar to that of the DC-10/MD-10.

Factual Information 50 Aircraft Accident Report The PAP subfunction is being added to LSAS to mimic the tailstrike protection that the MD-11 autopilot already provides for coupled landing and go-around operations. The PAP subfunction is armed whenever an aircraft’s radio altimeter registers below 100 feet agl. The PAP uses radio altitude in conjunction with IRU pitch angle and pitch attitude rate to provide nose-down elevator commands as a pilot begins to approach or exceed the prescribed PAP pitch limit (30° pitch at 41 feet agl and 9.5° pitch at 0 feet agl). This enhancement will slightly increase the control column force required to pitch the aircraft beyond the prescribed limits, but the pilot otherwise retains full pitch-control authority. As with all LSAS functions, the elevator command authority is mechanically limited to 5° of deflection within the elevator electro-hydraulic actuator. Boeing indicates that the PNL subfunction is intended to address both design goals for the LASE package. The PNL subfunction provides a two-stage, nose-down elevator command as the main wheels spinup for landing, which counters the nose-up tendency typically experienced when landing ground spoilers are deployed. The PNL subfunction is armed when aircraft radio altitude registers below 100 feet agl. The FCC signals, which are used to command the auto ground spoilers to deploy, will cause the PNL subfunction to command the first stage of the nose-down elevator of 3°. When the ground spoilers are detected to be in excess of 10° of displacement, the second stage of the PNL increases the nose-down command to 4°. Because the closed-loop PRD acts in conjunction with the PNL, the nose derotation characteristics are essentially independent of the aircraft c.g. The PNL commands are removed from the LSAS outputs at the same time that the flight mode annunciator returns to the TAKEOFF mode (that is, after the nose wheel has been on the ground for at least 20 seconds).

Analysis 51 Aircraft Accident Report 2. Analysis 2.1 General The two flight crewmembers were properly certificated and qualified in accordance with applicable Federal regulations and company requirements. Crew duty time, flight time, rest time, and off-duty activity patterns did not indicate that medical, behavioral, or physiological factors affected the flight crew’s performance on the day of the accident. The airplane was properly certificated, equipped, and maintained in accordance with Federal regulations and approved procedures, and the airplane’s departure from ANC with the No. 1 engine thrust reverser inoperative was in accordance with approved minimum equipment list procedures (the failure of the left landing light is discussed in section 2.2.2.8). Cargo was loaded in accordance with FedEx’s FAA-approved weight and balance requirements. Although the airplane had experienced damage to its forward and rear fuselage sections during two prior hard landings in 1994, the damage was assessed and repaired in accordance with approved regulations and procedures. Detailed inspections performed after each of the two prior hard landings and during subsequent periodic maintenance did not reveal any evidence of damage to the MLG, gear attach points, or wing structure. Safety Board metallurgical staff also examined the fracture surfaces of the right MLG and right wing structure at the scene of the accident before its removal and found no evidence of preexisting structural damage or fatigue cracking. Further, the energy transmitted into the right MLG during the Newark accident landing was more than Boeing estimated to have been required to break the wing of a new, undamaged MD-11 (see section 2.5.1). Thus, the Safety Board concludes that there was no preexisting damage or degradation to the airplane structure, systems, or components that contributed to this accident. The response and actions by ARFF and area firefighting personnel were timely and adequate, despite a lack of timely information about the nature and quantity of hazardous materials on board. Clear night visual meteorological conditions with light winds prevailed at the time of the accident; weather was not a factor in the accident. This analysis examines airplane and flight crew performance and design and certification requirements for the performance of transport-category airplanes during the landing phase. The analysis concludes with an examination of problems encountered during the emergency response relating to the timely dissemination of hazardous materials cargo information.

52 Aircraft Accident Report 2.2 Accident Scenario 2.2.1 Airplane Performance During the Approach and Landing During the approach, the airplane was configured for landing, with flaps set at 50°. The captain disconnected the autopilot as the airplane descended through 1,200 feet, and the autothrottles remained engaged. According to flight crew statements and FDR data, the airplane maintained the approach speed of about 158 knots (consistent with the target approach speed specified by FedEx, Vref+5 knots or 157 knots), at a stable 800 fpm descent rate, and on the ILS localizer and glideslope for runway 22R until the landing flare. The average pitch attitude of 3° ANU was consistent with MD-11 flight manual data for descending on the ILS glideslope’s 3° flightpath angle, given the airplane’s weight, c.g., and flaps-50 configuration. The captain and the first officer also stated that the approach was routine until just before touchdown. Thus, on the basis of flight crew statements and airplane performance data, the Safety Board concludes that the airplane’s approach before the landing flare was stabilized. FDR data indicated that control inputs consistent with the start of flare occurred at about 37 feet radio altitude. Engine thrust was also decreasing about this time.96 About 1.5 seconds after the start of the flare and 2 seconds before the first of two touchdowns, pitch attitude peaked at 5° nose up. The radio altitude was 17 feet. This portion of the flare maneuver was consistent with FedEx MD-11 flight manual guidance, which called for a “smooth 2.5 degree flare” to be initiated between 30 and 40 feet radio altitude. Thus, the Safety Board concludes that the captain’s execution of the beginning of the flare maneuver was normal and not a factor in the accident. As pitch attitude peaked about 2 seconds before the first touchdown, the elevator started deflecting from about 12° nose up to near 0°, and the airplane’s pitch attitude began decreasing slightly in response to the nose-down elevator input. Further, about 1 second before ground contact, elevator deflection reversed to a nose-up elevator deflection of 26° (from about neutral elevator to about 70 percent of maximum nose-up elevator), and TRAs increased from about 40° to 70° (from near flight idle to near takeoff thrust). A small right-wing-down aileron input (4° to 5°) followed. The nose-up, throttle- up, and right-wing-down control inputs were initiated as the airplane was descending through 7 feet radio altitude. Pitch attitude and vertical acceleration had just begun to respond when the airplane contacted the ground in the first of two touchdowns. Vertical speed at the first touchdown was about 7.6 fps,97 and vertical acceleration peaked at 1.67 g. The nose-up elevator and throttle inputs also peaked about the time of the first touchdown. 96 With the MD-11 autothrottle system engaged and flaps extended to greater than 31.5°, the throttles are automatically driven to the idle stop when the radio altitude decreases through 50 feet. 97 This value is the vertical speed at the right MLG and includes 6.6 fps vertical speed at the c.g. plus 1.0 fps vertical speed at the right MLG because of nose-up pitch rate and right-wing-down roll rate.

Analysis 53 Aircraft Accident Report Within 1/2 second after the first touchdown, the captain initiated a rapid nose- down elevator input. The total elevator travel was about 40° (changing from about 70 percent of maximum nose-up elevator to about 67 percent of maximum nose-down elevator in less than 1 second). Despite the initiation of the large and rapid nose-down elevator input, the airplane began to lift off the runway as a result of landing gear strut and tire compression loads and the still-increasing pitch attitude, thrust, and airspeed. In addition, wing lift was not degraded upon touchdown because the spoilers did not deploy. After the initial touchdown, the airplane was airborne for about 2 seconds.98 During the first second, while airborne, the elevator remained about 67 percent nose down. In the next second, a large and rapid nose-up elevator input occurred (from 67 percent nose-down to 60 percent nose up), accompanied by nose left rudder and right-wing-down aileron inputs.99 About 3/4 second before the second touchdown, as the airplane was peaking at a height of 5 feet agl, lift had decreased to about 0.6 g. The pitch attitude was about 2° nose- up and decreasing rapidly. The elevator was about 15° nose-down, although it was moving rapidly toward a nose-up position. Given the nose-down elevator position at that point in the bounce, there were probably no additional crew actions that could have been taken to prevent a hard impact with the runway. The airplane touched down for the second time as vertical acceleration was decreasing through 0.5 g. The second touchdown occurred at a roll angle of 9.5° right wing down, a roll rate of approximately 7° per second right wing down, and a pitch attitude of minus 0.7°. Peak vertical speed at the right MLG was approximately 13.5 fps. The right wing failed at impact (see section 2.5.1 for a discussion of this failure). The captain’s actions during the 5 seconds preceding the second touchdown established the conditions that led to the right wing failure. When the captain rapidly moved the elevators to near neutral instead of maintaining nose-up elevator and continuing the flare (2 seconds before first touchdown), he destabilized the flare and established a greater sink rate. The large nose-up elevator and thrust inputs that the captain made with only 1 second remaining before touchdown were his reaction to the sink rate and an attempt to prevent a hard landing. From that moment on, evidence indicates that all of the captain’s control inputs were too late and too large to achieve the desired effect. He made a large nose-down elevator input, consistent with an effort to keep the airplane on the runway and ensure an early touchdown of the nose gear with maximum available stopping distance. Although he began these nose-down inputs at about the time of the first touchdown, the airplane had bounced back into the air by the time he had pushed almost all the way forward on the control column. This large nose-down input, in turn, established a very high sink rate and low g load at the time of the second touchdown. The 98 The time interval between the first touchdown and the second was about 3 seconds. During those 3 seconds, the airplane was on the ground with the struts stroking and tires compressing for about 1 second and was airborne for about 2 seconds. 99 The Safety Board could not determine why the captain commanded right-wing-down aileron and left rudder deflection before the second touchdown.

Analysis 54 Aircraft Accident Report captain’s final, large nose-up inputs were made too late to soften the impact. The airplane touched down with enough energy and at a sufficiently high roll angle to bottom the right MLG strut and break the right wing. All available data indicate that the airplane’s aerodynamic performance and flight control functionality were normal until after the second touchdown. Thus, the Safety Board concludes that the accident airplane performed normally in response to the captain's flight control inputs until after the second touchdown. The captain’s large and rapid elevator control reversals, which resulted in an increasing divergence above and below the target pitch attitude, were consistent with a “classic” pilot-induced oscillation (PIO). Essentially, the captain made each increasingly larger elevator input in an attempt to compensate for the input he had made in the opposite direction about 1 second earlier. PIO in the pitch axis can occur when pilots make large, rapid control inputs in an attempt to quickly achieve desired pitch attitude changes. The airplane reacts to each large pitch control input, but by the time the pilot recognizes this and removes the input, it is too late to avoid an overshoot of the pilot’s pitch target. This, in turn, signals the pilot to reverse and enlarge the control input, and a PIO with increasing divergence may result. Additional key elements in the onset of PIO are derived from the interaction between the pilot and the flight environment. Researchers have described the following: “...many of the reported [PIO] events have taken place during air-to-air refueling operations or approaches and landings, especially if the pilot is concerned about low fuel, adverse weather, emergencies, or other circumstances. Under these conditions, the pilot’s involvement in closed-loop control is intense, and rapid response and precise performance…are necessary. Even so, these operations usually occur routinely without [PIO] problems. [PIO] events do not occur unless there is a transient triggering event that interrupts the already highly demanding…operations or requires an even higher level of precision. Typical triggers include shifts in the dynamics of the effective aircraft (the combination of the aircraft and the [flight control system]) caused by increases in the amplitude of pilot commands, [flight control system] changes, minor mechanical malfunctions, or severe atmospheric disturbances. Other triggers can stem from mismatches between pilot’s expectations and reality.100 The environmental cues and concerns that may have served as triggering events in this accident, motivating or influencing the captain’s control inputs and decisions, are further analyzed in the following section. 100 National Research Council. 1997. Aviation Safety and Pilot Control: Understanding and Preventing Unfavorable Pilot-Vehicle Interactions, p. 3.

Analysis 55 Aircraft Accident Report 2.2.2 Flight Crew Factors During the Approach and Landing During the approach briefing, the first officer and the captain discussed the stopping distance available on runway 22R for the airplane’s weight and landing configuration. During that discussion, they expressed concerns about the approximate landing distance and the length of the runway, which they had derived from the APLC (see section 2.2.2.7 for a discussion of the flight crew’s misinterpretation of the data presented in the APLC). Additionally, during the approach, the flight crew indicated that they were aware of the inoperative No. 1 engine thrust reverser, which would have resulted in a slight reduction in deceleration capability after landing.101 The flight crew was also aware of three recent events recorded in the airplane’s maintenance log in which the airplane’s autobrakes had failed to arm at takeoff or failed to work at landing. Although maintenance personnel had checked the system after each reported failure and determined it was functioning properly, the captain told Safety Board investigators that he discussed the reliability of the autobrake system with the first officer before takeoff from ANC. The captain told investigators that the autobrakes remained armed during the departure from ANC. However, he kept the autobrake problem in mind when planning for the landing at EWR, adding that he planned to land the airplane at the start of the runway and wanted to ensure that the airplane would not float during the landing flare. Thus, on the basis of the flight crew’s comments during the approach about the relatively short runway length, the inoperative thrust reverser, the questionable reliability of the autobrake system, and the perceived need to land at the beginning of the runway, the Safety Board concludes that the captain was concerned about the airplane’s touchdown location on runway 22R and intended to take measures during the landing to achieve an early touchdown and minimize the length of the rollout on the runway after touchdown. 2.2.2.1 Nose-Down Elevator Input at 0132:16 (2 seconds before first touchdown) The Safety Board examined the captain’s 12° nose-down elevator input at 17 feet radio altitude to determine if it was consistent with FedEx guidance for landing the MD-11. The Board’s review of FedEx’s MD-11 landing guidance found only one technique that promotes the use of nose-down elevator between the initiation of flare and touchdown. Specifically, the FedEx MD-11 “advanced technique” for landing recommends that “elevator back pressure…be relaxed” about 10 feet before touchdown (to achieve a 1° decrease in pitch attitude). However, the captain’s nose-down elevator input, which moved the elevator from 12° nose-up to about the neutral position, was very rapid and much greater than is required for the maneuver. Further, the captain began his nose-down input about 1 second before the airplane reached 10 feet radio altitude, the aural annunciation of which should have served as the cue for such a pitch reduction if it 101 Although the flight crew may have been concerned about the reduction in deceleration capability, the inoperative thrust reverser did not increase the runway length requirement for the accident landing above that shown in the APLC because the deceleration effects of the thrust reversers are not used in calculating the distances required for landing.

Analysis 56 Aircraft Accident Report had been related to the FedEx “advanced” landing technique. Thus, the Safety Board concludes that the captain’s nose-down elevator input beginning at 17 feet radio altitude was not consistent with FedEx guidance for landing the MD-11. Further, the Safety Board concludes that the captain’s nose-down elevator input at 17 feet radio altitude (2 seconds before the first touchdown) was consistent with an attempt to control the point of touchdown given his concerns about the runway length. 2.2.2.2 Nose-up Elevator Input at 0132:17 (1 second before first touchdown) The captain and the first officer told Safety Board investigators that they felt the airplane’s sink rate increase shortly before the airplane touched down. They stated that these were “seat of the pants” feelings and were not based on observed indications on cockpit instruments. FDR data indicated that after the captain made the nose-down elevator input at 17 feet radio altitude, a small increase in sink rate and decrease in vertical acceleration occurred. The decreased vertical acceleration and increased nose-down pitch rate could have led to sensations of sink consistent with the pilots’ descriptions. With just more than 1 second remaining before touchdown, the captain had the following options: accept the sink rate and subsequent hard landing, attempt to salvage the landing with last-second thrust and pitch adjustments, or execute a go-around. FDR data and postaccident interviews show that the captain chose to try to salvage the landing with last-second thrust and pitch adjustments. Thus, the Safety Board concludes that the captain made a nearly full nose-up elevator input and a large throttle increase to compensate for the increased sink rate caused by his previous nose-down input. The FedEx MD-11 flight manual recommends that a “constant pitch attitude be maintained from 10 feet radio altitude until touchdown.” However, this guidance presupposes a stabilized approach and flare leading up to 10 feet radio altitude. In contrast, because the captain had destabilized the flare 1 second earlier, he perceived a need to arrest the resulting sink rate with additional thrust and nose-up pitch. FedEx’s high sink rate and bounce recovery training recommends establishing a 7.5° pitch attitude and “arresting the sink rate with thrust” as a prelude to either landing with a high sink rate, re-landing the airplane after a bounce, or executing a low-level go- around. However, FedEx’s MD-11 tailstrike awareness training also cautioned that “quickly adding up elevator” near the ground should be avoided because it can result in increased nose-up pitch rate at touchdown, increased downward vertical speed at the MLG, a hard landing, and tailstrike. To gain a better understanding of this training and its relevance to the captain’s actions, Safety Board investigators participated in FedEx classroom and simulator training for high sink rate and bounce recovery, as well as for tailstrike avoidance. This experience demonstrated to investigators that the timing and large magnitude of the captain’s nose-up elevator input just before the first touchdown were inconsistent with FedEx’s MD-11 high sink rate recovery and tailstrike awareness training.

Analysis 57 Aircraft Accident Report 2.2.2.3 Nose-Down Elevator Input Shortly After the First Touchdown The captain’s large, nose-down elevator input began within 1/2 second of the first touchdown. Based on the sequence and timing of the events, this nose-down elevator input was the captain’s response to the airplane’s rapid nose-up pitching motion, which began in the second before touchdown as a result of the captain’s immediately preceding large nose- up elevator input, and/or his attempt to rapidly land the nosewheel and begin braking immediately after touchdown. After the airplane touched down hard and bounced, the captain continued his nose-down input while the airplane continued to pitch up. A large nose-up pitch rate and high pitch attitude at touchdown would have introduced several factors that may have contributed to the captain’s subsequent large nose-down elevator input. First, MD-11 pilots are taught in training that nose-up pitch rate and high pitch attitude at touchdown are factors that lead to tailstrike. This consideration may have caused the captain to believe he should apply additional nose-down elevator to the amount that he normally applies after touchdown to counter the MD-11’s characteristic nose-up pitching moment following ground spoiler deployment.102 Second, as demonstrated by his statements on the CVR and during postaccident interviews, the captain would have continued to be concerned about the available runway length; the rapidly increasing pitch attitude just before and during the first touchdown would have increased the probability of a floating flare, which, in turn, would have decreased the amount of runway available to bring the airplane to a stop. Therefore, the Safety Board concludes that the captain’s full nose-down elevator control input at the time of the first touchdown was consistent with his continued concerns to avoid a long landing and his desire to avoid a tailstrike. 2.2.2.4 Summary of the Captain’s Elevator Control Inputs Considering the captain’s three significant elevator control inputs in sequence, it is apparent that after the first destabilization of the landing flare (from the captain’s nose- down input at 17 feet agl), each of the succeeding nose-up/nose-down elevator inputs resulted from the captain’s attempt to correct for the immediately preceding control input. His perception of a short runway and the need to constrain the pitch attitude within a very limited range (to avoid a tailstrike) would have motivated the captain to rapidly return the airplane to a stable attitude. He attempted to accomplish this goal with the quick application of large elevator inputs; however, this succession of elevator inputs and pitch oscillations rendered the landing attempt increasingly unstable. Throughout the sequence of increasingly extreme nose-down and nose-up elevator inputs, which were consistent with a “classic” PIO (as described in section 2.2.1), the captain continued to attempt to salvage the landing; however, a go-around executed by the captain at any time through the touchdown and bounce would have prevented the accident. 102 MD-11 pilots are taught and the MD-11 FCOM advises that ground spoiler deployment at touchdown creates a nose-up pitching moment that must be counteracted with pilot-induced nose-down elevator inputs. This technique is referred to in the MD-11 FCOM and operator training as “flying the nose to the runway.”

Analysis 58 Aircraft Accident Report Therefore, the Safety Board concludes that the captain’s overcontrol of the elevator during the landing and his failure to execute a go-around from a destabilized flare were causal to the accident. Further, the Safety Board’s examination of the training that FedEx provided its pilots in landing the MD-11 showed that its training was consistent with and, in some respects, exceeded that provided by many other major airlines. On the basis of comparing the captain’s control inputs with FedEx’s procedures and training for landing the MD-11, the Safety Board concludes that the captain’s control inputs during the flare and bounce were not consistent with landing procedures and techniques outlined in the FedEx MD-11 pilot training procedures, McDonnell Douglas FCOM, or with FedEx’s MD-11 tailstrike awareness and high sink rate and bounce recovery training. 2.2.2.5 The Captain’s Training History The Safety Board attempted to determine if a factor in the captain’s training history could explain his actions in attempting to control the airplane during the landing and thereafter. The Board notes that the captain received an unsatisfactory evaluation on an upgrade proficiency checkride on October 29, 1996. However, the Board obtained no other evidence that could reflect negatively on the captain’s skills. Other than the October 1996 checkride, there was no history of unsatisfactory performance or of disciplinary action in his career at FedEx. There was also no record of accident, incident, or enforcement action in his FAA records. In addition, in the 10 months after the failed checkride, the captain satisfactorily completed a proficiency check and two line checks (the last line check was 20 days before the accident). Thus, the Safety Board concludes that the captain had no previously documented skill deficiencies that contributed to this accident. 2.2.2.6 Enhanced Pilot Training The captain’s failure to properly respond to a destabilized flare and his excessive overcontrol of the airplane, as well as the accumulated evidence from previous air transport landing accidents (see sections 1.18.4 through 1.18.7), indicate that action may be warranted to improve the quality of air carrier training and guidance to pilots in performing safe landings. The circumstances of this and other accidents suggest that, although accidents before or shortly after touchdown are rare, the risk of a future catastrophic accident could be reduced if air carrier pilot training programs devote additional attention to safety issues related to landings. It is particularly important to instill in pilots the orientation to perform a go-around in the event of an unstabilized approach or destabilized landing flare. Shortly after the Safety Board conducted a special investigation103 of rejected takeoff accidents in 1990, a joint government-industry task force was formed to study the issue and develop a flight crew training aid. This training aid has led to a reduction in the 103 National Transportation Safety Board. 1990. Runway Overruns Following High Speed Rejected Takeoffs. Special Investigation Report NTSB/SIR-90-02. Washington, D.C.

Analysis 59 Aircraft Accident Report incidence of rejected takeoff accidents and incidents.104 The Board notes that other government-industry efforts have produced valuable training tools to avoid and recover from inadvertent encounters with wake vortices, windshear, controlled flight into terrain events, and aircraft upsets. The Safety Board’s review of accidents involving pilots’ control handling in the landing phase of flight, including this accident, indicates that a similar training tool development effort should be made for landings. This tool should devote specific attention to proper high sink rate recovery techniques during the landing flare, risks associated with PIOs during the landing, and the hazards associated with overcontrol and premature derotation during a bounced landing. In 1995, responding to a safety recommendation issued by the Safety Board as a result of its investigation of three Boeing 767 landing accidents as well as incidents involving DC-10s and MD-11s, the FAA issued FSAT 95-06. This document required FAA POIs to ensure that pilot training programs for the Boeing 757/767, DC-10, and MD-11 include a discussion about derotation accidents. Unfortunately, FSAT 95-06 expired in 1996. Further, in its submission to the Safety Board on the Newark accident, Boeing advocated expanding traditional approach go-around guidance to instruct that missed approaches be made if the airplane is not stabilized by 500 feet or if approaches involve “large pitch deviations.” The Board concurs with this suggestion and notes that air carrier pilots’ adoption and use of a proactive go-around philosophy would be a desirable goal for a training tool development effort on this issue. Following this accident, FedEx added instructional material and guidance on landing gear and wing structural certification to its tailstrike awareness training program. This guidance detailed the effects of vertical acceleration on the MLG and wings and explained the effects of roll and pitch rate on total sink rate. The FedEx training information describes in detail the aerodynamic effects of large nose-down elevator inputs that result in reduced-g touchdowns, which increase the loads that must be absorbed by the MLG. The Safety Board notes that one of the new FedEx training modules closely describes the acceleration, pitch, and roll factors found in the Newark accident scenario. However, based on discussions with pilots who have flown with several air carriers, the Board is concerned that this information may be lacking in other operators’ training programs and that this lack of landing guidance could contribute to similar landing accidents. Thus, based on its review of air carrier landing accidents, the Safety Board concludes that air carrier pilots’ performance would be improved by additional guidance and training in landing techniques. 104 A review of the Safety Board’s database of U.S. accidents revealed no fatal overrun events since 1990.

Analysis 60 Aircraft Accident Report Therefore, the Safety Board believes that the FAA should convene a joint government-industry task force composed, at a minimum, of representatives of manufacturers, operators, pilot labor organizations, and the FAA to develop, within 1 year, a pilot training tool to do the following: a. Include information about factors that can contribute to structural failures involving the landing gear, wings, and fuselage, such as design sink rate limits; roll angle limits; control inputs’ roll rate; pitch rate; single-gear landings; the effect of decreased lift; and structural loading consequences of bottoming landing gear struts and tires; b. Provide a syllabus for simulator training on the execution of stabilized approaches to the landing flare, the identification of unstabilized landing flares, and recovery from these situations, including proper high sink rate recovery techniques during flare to landing, techniques for avoiding and recovering from overcontrol in pitch before touchdown, and techniques for avoiding overcontrol and premature derotation during a bounced landing; and c. Promote an orientation toward a proactive go-around. 2.2.2.7 Landing Distance Calculation Errors During its investigation, the Safety Board determined that the flight crew misinterpreted the APLC stopping distance data for MED autobrakes by incorrectly comparing APLC runway data with the landing distance provided on the approach plate for runway 22R. Although there was sufficient stopping distance for a MED autobrake setting, the misinterpretation of the APLC data,105 among other factors, led the captain to believe that stopping distance would be an issue in the landing. Thus, the Safety Board concludes that the flight crew’s calculation error in determining the runway length required for landing influenced the captain’s subsequent actions during final approach and landing by creating a sense of urgency to touch down early and initiate MAX braking immediately. The Safety Board is concerned that two pilots with significant APLC experience at FedEx failed to properly interpret the calculated landing distances and that other experienced flight crews may also be deficient in their operational knowledge of how APLC systems function. The Board notes that following the accident, FedEx expanded the APLC pilot training presentation for all initial and upgrade training and also added it to recurrent flight crew training programs. The Board has learned that several operators have either adopted systems similar to FedEx’s APLC system or are considering doing so and that other electronic performance calculators are in use at other operators. Thus, the Safety Board concludes that some flight crewmembers may lack proficiency in the operation of APLCs, or similar airplane performance computing devices, and that confusion about calculated landing distances may result in potentially hazardous miscalculations of available runway distances after touchdown. Therefore, the Safety Board believes that the 105 Instead of the miscalculated 780-foot margin result that influenced his decision to set MAX autobrakes, there was actually a 1,680-foot margin.

Analysis 61 Aircraft Accident Report FAA should require POIs assigned to Part 121 carriers that use auxiliary performance computers to review and ensure the adequacy of training and procedures regarding the use of this equipment and the interpretation of the data generated, including landing distance data. 2.2.2.8 Left Landing Light The Safety Board considered whether the absence of the left landing light affected the captain’s ability to land the airplane. The ability to land an airplane from the initiation of flare to touchdown requires that the pilot rapidly detect and assess the airplane’s attitude, altitude, sink rate, velocity, and alignment with the runway. Cues used to accomplish this task include the relative size of objects, relative movement between objects, and variations in angles of convergence around the runway environment. Texture cues in the environment help pilots estimate altitude and velocity. Because of the absence of texture cues at night, estimating height may be difficult. Landing lights can increase the texture or detail available in the runway environment by illuminating the runway surface and tire marks on the runway and casting shadows in the periphery. Runway 22R’s edge lighting would have provided cues for altitude and sink rate from which the captain could extract the angular information needed to support the landing. In addition, the edge lighting system would have provided a fixed ground reference from which the captain could have gauged his drift and alignment with the runway. Runway 22R’s three-bar VASI system would have helped the captain maintain a stabilized approach as he transitioned from the electronic glideslope to the visual glidepath. The weather during the landing was clear, and there were no obstructions to visibility that would have degraded the appearance of these lighting systems. Although the left landing light was inoperative, the airplane had other external lights available during the landing, including the right landing light, turnoff lights,106 and taxi and landing lights on the nose gear. Therefore, the area normally covered by the left landing light would have been darker than normal but not without illumination because of the overlapping areas of illumination from the other lights. Moreover, the captain was aware well before landing that the landing light was inoperative and told Safety Board investigators that the inoperative left landing light did not significantly affect his ability to detect sink rate and land the airplane. The captain also told investigators that the view out the windscreen was normal and that he had landed before with a landing light inoperative. Thus, the Safety Board concludes that the inoperative left landing light did not impede the captain’s ability to land the airplane. 106 Turnoff lights are located at the wing root and are turned on below 18,000 feet according to FedEx procedures.

Analysis 62 Aircraft Accident Report 2.3 MD-11 Handling Characteristics and Flight Control System Design 2.3.1 MD-11 Nose-Up Pitching Moment Because of Ground Spoiler Deployment The MD-11’s known tendency to pitch up after ground spoiler deployment and the captain’s reference to it during interviews prompted the Safety Board to evaluate the role of the pitch-up tendency in the accident sequence. The captain told Board investigators that he was expecting the nose-up pitching moment associated with initial spoiler deployment at MLG spin-up. He stated that he remembered compensating with forward control column input and that he thought the spoilers had deployed at touchdown. Although a portion of the captain’s nose-down elevator input at the time of the first touchdown may have been in response to the pitch-up tendency, the input greatly exceeded that required to control this tendency. Therefore, the Safety Board concludes that the MD-11's tendency to pitch up at ground spoiler deployment did not contribute to the accident. Nevertheless, a reduction or elimination of the pitch-up tendency would simplify MD-11 landing techniques and may help prevent future MD-11 landing incidents and accidents. 2.3.2 MD-11 Pitch Handling Characteristics and the FCC-908 Software Upgrade The FCC-908 software package developed by Boeing will alter the handling of the airplane during landings by decreasing the pitch sensitivity through action of the PRD. The decrease in pitch sensitivity combined with additional handling improvements included in the FCC-908 upgrade should render the airplane less susceptible to overcontrol in pitch similar to that involved in this accident. Boeing’s stated goal in implementing FCC-908 is to match the handling characteristics of the MD-11 to those of the existing DC-10 and the DC-10’s newly developed two-pilot adaptation, the MD-10, thereby facilitating FAA approval of a common type rating for the MD-10 and MD-11. The DC-10 and MD-10 do not have the pitch sensitivity that, until implementation of the FCC-908 software upgrade, has been characteristic of the MD-11. Further, the MD-11 FCC-908 software upgrade may help prevent tailstrikes by providing PAP and eliminating the MD-11’s nose-up pitching tendency at touchdown through the positive nose-lowering feature of FCC-908. The Safety Board notes that changing the FCC software to eliminate the nose-up pitching tendency may be an acceptable alternate approach to changing MD-11 spoiler logic as recommended in Safety Recommendation A-93-59. The Safety Board concludes that the handling changes incorporated in the MD-11 FCC-908 software upgrade will provide valuable improvements in safety during MD-11 landings. Therefore, the Safety Board believes that the FAA should require the

Analysis 63 Aircraft Accident Report installation, within 1 year, of the MD-11 FCC-908 software upgrade on all MD-11 airplanes. 2.3.3 Digital Flight Data Recorder Update Required by FCC-908 The Safety Board notes that for an MD-11 equipped with the FCC-908 software package, the LSAS will apply elevator control inputs simultaneous with those of the pilots. The Safety Board concludes that with the information that is currently available from the FDR, it may be impossible to distinguish the control inputs of the MD-11 FCC-908 LSAS from the pilots’ control inputs. As a result of discussions with Board staff on this subject, Boeing advised the Board that it plans to issue a service bulletin and digital flight data acquisition unit upgrade kit to add some LSAS-associated parameters to the digital flight data recorder (DFDR) data stream. The Safety Board notes that a requirement for additional FDR parameters is supported by 14 CFR 25.1459(e), which states, “Any novel or unique design or operational characteristic of the aircraft shall be evaluated to determine if any dedicated parameters must be recorded on flight recorders in addition to or in place of existing requirements.” Therefore, the Safety Board believes that the FAA should require, on all MD-11s equipped with the FCC-908 software, the retrofit of DFDR systems with all additional parameters required to precisely identify and differentiate between pilot and LSAS elevator control activity, including control column force, IRU pitch rate, LSAS command signals, elevator positions, and automatic ground spoiler (AGS) command signals. 2.3.4 MD-11 Ground Spoiler Knockdown Feature The Safety Board also evaluated the role of the MD-11 ground spoiler knockdown feature in the accident sequence. MD-11 and DC-10 ground spoilers will not deploy if the No. 2 TRA is greater than 44° to 49°, or just above flight idle. This logic is intended to prevent spoiler deployment or retract spoilers during go-arounds. Go-arounds are characterized by large thrust increases near or above takeoff thrust. The Board is concerned that the MD-11’s TRA threshold may be too low to allow for power applications to accommodate moderate sink rate and airspeed control techniques near the ground without disarming the AGS system. Examination of the accident data shows that TRAs rapidly increased from near idle to about 75° (near takeoff thrust) just before touchdown, which prevented ground spoiler deployment at touchdown and contributed to the bounce. The Safety Board does not consider this large and rapid TRA increase to be consistent with a moderate attempt to control sink rate or airspeed and believes that even a modified DC-10 or MD-11 knockdown feature would likely have prevented spoiler deployment given such a large TRA increase. Further, DC-10 and MD-11 training and procedures require pilots to manually deploy ground spoilers if they do not automatically deploy. Therefore, the Safety

Analysis 64 Aircraft Accident Report Board concludes that the MD-11’s TRA-driven spoiler knockdown feature did not contribute to this accident. Nevertheless, the Safety Board notes that it is possible to modify the existing DC-10 and MD-11 spoiler deployment system to allow greater throttle movement before the spoiler knockdown feature is activated. Delaying the knockdown feature would allow pilots to make larger thrust increases just before landing without preventing ground spoiler deployment at touchdown, which may help prevent or minimize some bounces. In the event of a go-around, the higher knockdown angle would slightly delay the retraction of ground spoilers; therefore, a study to determine an optimum angle for activation of the knockdown feature would be necessary. Therefore, the Safety Board believes that the FAA should review and, if appropriate, revise the DC-10 and MD-11 TRA-driven ground spoiler knockdown feature to ensure that it does not prevent ground spoiler deployment at moderate TRAs that could be associated with sink rate and airspeed corrections during the landing phase. Further, the Safety Board believes that the FAA should require DC-10 and MD-11 operators to provide their pilots with information and training regarding the ground spoiler knockdown feature and its effects on landing characteristics and performance. 2.4 Transport-Category Airplane Stability and Control During the Landing Phase The records of previous MD-11 accidents and incidents (reviewed in sections 1.18.4 through 1.18.7), including the accident airplane’s two hard landing events that preceded the Newark accident, have drawn attention specifically to the landing characteristics of the MD-11. However, other transport airplane types, including the Boeing DC-10 and 757/767 (as cited by the Safety Board in its June 16, 1994, safety recommendation letter), also have been involved in landing accidents that were or could have been catastrophic. Although improved pilot training in landing techniques and installation of the FCC-908 software upgrade can help prevent MD-11 landing incidents and accidents (see sections 2.2.2.6 and 2.3.2), the accident history involving the MD-11 and other transport airplane types prompted the Board to consider and review existing certification criteria for airplane handling qualities during landing operations. The review indicated that, besides basic stability criteria, few objective standards exist for the assessment and acceptance of these handling qualities, including the interactions of airplane and pilot responses and the effects of adverse environmental conditions. Based on the accident and incident record, the Safety Board is concerned that certain complex system interactions, pilot input characteristics, and other factors, such as c.g. position and atmospheric conditions, may occasionally combine during the landing phase in undesirable ways that were not identified during the original certification of transport airplanes. Thus, the Safety Board concludes that additional basic research to identify undesirable landing phase combinations and to compare the overall qualitative and quantitative stability and control characteristics of widely used, large transport-

Analysis 65 Aircraft Accident Report category airplanes is needed to improve certification criteria and reduce the incidence of potentially catastrophic landing accidents. Therefore, the Safety Board believes that the FAA should sponsor a National Aeronautics and Space Administration (NASA) study of the stability and control characteristics of widely used, large transport-category airplanes to a. Identify undesirable characteristics that may develop during the landing phase in the presence of adverse combinations of pilot control inputs, airplane c.g. position, atmospheric conditions, and other factors; and b. Compare overall qualitative and quantitative stability and control characteristics on an objective basis. The study should include analyses of DC-10 and MD-11 landing accidents and any other landing incidents and accidents deemed pertinent by NASA. Further, the Safety Board believes that, based on the results of the study, the FAA should implement improved certification criteria for transport-category airplane designs that will reduce the incidence of landing accidents. 2.5 Structures 2.5.1 Right-Wing Structural Design and Failure Title 14 CFR Part 25 requires that an airplane’s landing gear and associated structure be able to withstand a 12 fps vertical speed when landing at maximum landing weight on one gear at zero roll angle and 1.0 g lift. This equates to a maximum energy capacity for a single MD-11 MLG, as required for certification, of 494,500 ft-lbs. Boeing estimates that the MD-11 landing gear strut will bottom and cause the wing rear spar to fail if approximately more than 1,500,000 ft-lbs of energy is transmitted into a single MLG. At 13.5 fps vertical speed, 0.5 g vertical acceleration, and 8° roll angle, the accident airplane’s right MLG experienced an energy input of 1,574,000 ft-lbs during the second touchdown, which was 3.2 times the maximum certification energy and slightly greater than the MD-11’s estimated ultimate capability. The MDI/Boeing structural simulations of the accident sequence indicate that the right MLG strut and outboard tires bottomed at the second touchdown. Energy not absorbed by the landing gear was then transmitted to the right wing rear spar through the right MLG attach points. A corresponding down load was introduced from the left wing and fuselage, which produced additional torsional loads on the right wing. These torsional loads then produced a shear overload condition in the right wing rear spar according to MDI/Boeing simulations. Boeing stated that the MDI simulations indicate that the failure most probably “initiated at the rear spar/bulkhead (trunnion) rib interface and progressed through the primary wing box structure. As a result of this failure, the right MLG trunnion moved substantially upward and aft with respect to the trap [trapezoidal] panel fitting.” Thus, the Safety Board concludes that the energy transmitted into the right MLG during

Analysis 66 Aircraft Accident Report the second touchdown was 3.2 times greater than the MD-11’s maximum certificated landing energy and was sufficient to fully compress (bottom) the right MLG strut and cause structural failure of the right wing rear spar. Runway sooting consistent with a fuel fire near the right MLG was also found at the area of the second touchdown. Thus, on the basis of runway evidence, analysis of performance data, and the MDI/Boeing structural simulations, the Safety Board concludes that the structural failure of the right wing rear spar resulted in the rupture of the right wing fuel tanks and fire. Although the Hong Kong Civil Aviation Department’s investigation of the August 22, 1999, China Airlines MD-11 accident at Hong Kong International Airport is ongoing, examination of the pertinent fracture surfaces suggests that the wing spar failure mode in this accident was very similar to that of FedEx flight 14. The Safety Board’s preliminary calculations of the China Airlines MD-11’s descent rate at impact, 18 to 20 fps, imply that like the FedEx accident at Newark, the wing spar failed in overload well in excess of certification requirements. 2.5.2 Landing Gear Certification The MD-11 MLG was designed to break from the wing (fuse) in a drag overload condition but not in a vertical overload condition. Boeing has stated that this design was implemented because data indicated that the most likely landing gear overload condition would occur as a result of striking an obstruction. This “sacrificial shedding” of MLG assemblies in the aft direction was intended to prevent catastrophic loads being transmitted to the wing box and causing rupture. During its investigation of the FedEx Newark accident, the Safety Board reviewed the circumstances of several accidents involving other wide-bodied airplane types that greatly exceeded aircraft structural limits. A Martinair DC-10 touched down at Faro, Portugal, with a sink rate of 17 fps, at vertical energy loads 2.6 times greater than energy certification requirements for a single MLG. A TWA L-1011 landed in New York at 14 fps, exhibiting vertical energy loads more than twice its certification requirements. Current landing phase structural design requirements only require consideration of 1.0 g vertical acceleration, small roll angles, and sink rates up to 12 fps. Manufacturers are also required to consider landing gear overloads in the up and aft directions but have the option of either fusing or overdesigning the gear for such loads. Several major landing accidents have now occurred as a result of pilots allowing their airplanes to land with more adverse combinations of lift, roll angle, and sink rate than those specified in the regulations. In each accident, a wing broke and a fuel fire erupted. Each of these accidents involved aircraft whose landing gear were not fused for upward (vertical) acting loads, which concerns the Safety Board. The Safety Board concludes that the failure modes and effects for vertically fused and overdesigned landing gear designs may have been inadequately researched to identify whether, under overload conditions, one design might provide a safer break-up sequence for the airplane than the other design. Therefore, the

Analysis 67 Aircraft Accident Report Safety Board believes that the FAA should conduct a study to determine if landing gear vertical overload fusing offers a higher level of safety than when the gear is overdesigned. If fusing offers a higher level of safety, the FAA should revise 14 CFR Part 25 to require vertical overload fusing of landing gear. Further, peak vertical acceleration values recorded by the FDR at landing may not be sufficient for maintenance personnel to determine whether structural damage may have occurred during the landing. Data from the Newark accident indicate that initial vertical acceleration, pitch and roll rates, and attitudes should also be considered during FDR readout and evaluation of a potential hard landing event. The Safety Board notes that Boeing has revised its MD-11 maintenance manual to incorporate this guidance and that the company plans to revise the maintenance manuals of its other products based on the revised MD-11 maintenance manual example. However, the Board is concerned that this guidance will not be available to operators of non-Boeing products and that it is not binding. Thus, the Safety Board concludes that current manufacturer guidance for hard landing identification and operator maintenance readouts and analysis of FDR data following suspected hard landings may not be adequate to identify landings in which structural damage may have occurred. Therefore, the Safety Board believes that the FAA should require manufacturers of 14 CFR Part 23 and Part 25 airplanes and Part 121 operators to revise their hard landing inspection and reporting criteria to account for all factors that can contribute to structural damage. The FAA should also instruct principal maintenance and operations inspectors assigned to Part 121 operators to ensure that these changes have been made to operator maintenance manuals and Flight Operations Quality Assurance exceedence monitoring programs. 2.6 Hazardous Materials Information Dissemination After the accident airplane came to a stop inverted, the flight crew evacuated the burning airplane without retrieving shipping documents and hazardous materials information that were in the cabin beside the cockpit door. This is entirely understandable given the circumstances of the accident. According to 49 CFR 172.600, hazardous materials emergency response information (including the basic description, technical name, hazard, risks, precautions, and methods for dealing with releases) is required to be “immediately available” to appropriate personnel following an accident. The North American Emergency Response Guidebook also emphasizes the importance of identifying, within 30 minutes, hazardous materials involved in a transportation accident fire or potential spill runoff so that effective downwind evacuation measures can be implemented to minimize the public’s exposure to airborne dispersion clouds and runoff effluents. However, the incident commander’s repeated requests for cargo manifest information went unanswered because FedEx personnel based in Newark did not have immediate access to this cargo information. FedEx personnel in Memphis spent hours

Analysis 68 Aircraft Accident Report tracing flight 14’s cargo documentation because information requests had to be directed first to FedEx offices in Memphis, then to Anchorage, and then to the FedEx office in Narita, Japan, where the hazardous material shipments originated. Firefighting operations had been under way for nearly 2 hours before a partial, handwritten list containing the UN/North American hazard identification numbers for five of seven hazardous materials on board, including a notation about “36 pounds of unknown hazardous materials,” was provided to the incident commander. Although he did not receive a complete list of the specific hazardous materials on board until the fire was nearly extinguished—more than 4 1/2 hours after making his initial request—the incident commander assumed, on the basis of Newark’s high volume of cargo shipments, that hazardous materials were on board the accident airplane and took precautionary firefighting measures. Thus, the Safety Board concludes that risks to firefighters and the surrounding community were minimized substantially because the incident commander assumed that hazardous materials were on board and acted accordingly. The Board notes that the incident commander’s decision to deploy firefighting units based on the assumption that hazardous materials were likely on board the airplane was prudent and in keeping with the North American Emergency Response Guidebook. The accident at Newark was the second within a 12-month period involving a FedEx cargo airplane, and both accidents involved similar problems in the dissemination of important hazardous materials information to emergency responders. The Safety Board’s investigation of the first of these accidents—the September 5, 1996, accident at Newburgh—determined that emergency response agencies in Newburgh also had to repeatedly request specific information about the hazardous materials on board the airplane and that this information was delayed because FedEx was unable to provide complete information in a timely manner. In addition, faxes of shipping documents sent by FedEx personnel in Memphis did not reach the incident commander. The Board’s investigation of the Newburgh accident concluded that FedEx did not have the capability to generate, in a timely manner, a “single list indicating the shipping name, identification number, hazard class, quantity, number of packages, and the location of each declared shipment of hazardous materials on the airplane.” The Safety Board concludes that the Newark accident demonstrates that air carriers transporting hazardous materials continue to need a means to quickly retrieve and provide consolidated, specific information to emergency responders about the identity of all hazardous materials on an airplane. Safety Recommendations A-98-75 and -80, issued on August 12, 1998, recommended to the FAA and RSPA, respectively, that, within 2 years, such a measure be required of all air carriers transporting hazardous materials (see section 1.18.1.2 for a detailed description of these recommendations). RSPA’s July 20, 2000, response indicates that, nearly at the end of the requested 2-year period, proposed action to address this safety issue is just in the beginning stages. It is apparent that the requested action is still many years from completion. Therefore, based on this delay, the Safety Board reclassifies Safety Recommendation A-98-80 “Open—Unacceptable Response” and urges RSPA to expedite the rulemaking process.

69 Aircraft Accident Report 3. Conclusions 3.1 Findings

1. There was no preexisting damage or degradation to the airplane structure, systems, or

components that contributed to this accident.

1. The airplane’s approach before the landing flare was stabilized.
2. The captain’s execution of the beginning of the flare maneuver was normal and not a

factor in the accident.

1. The accident airplane performed normally in response to the captain's flight control

inputs until after the second touchdown.

1. The captain was concerned about the airplane’s touchdown location on runway 22R

and intended to take measures during the landing to achieve an early touchdown and minimize the length of the rollout on the runway after touchdown.

1. The captain’s nose-down elevator input beginning at 17 feet radio altitude was not

consistent with Federal Express guidance for landing the MD-11.

1. The captain’s nose-down elevator input at 17 feet radio altitude (2 seconds before the

first touchdown) was consistent with an attempt to control the point of touchdown given his concerns about the runway length.

1. The captain made a nearly full nose-up elevator input and a large throttle increase to

compensate for the increased sink rate caused by his previous nose-down input.

1. The captain’s full nose-down elevator control input at the time of the first touchdown

was consistent with his continued concerns to avoid a long landing and his desire to avoid a tailstrike.

1. The captain’s overcontrol of the elevator during the landing and his failure to execute

a go-around from a destabilized flare were causal to the accident.

1. The captain’s control inputs during the flare and bounce were not consistent with

landing procedures and techniques outlined in the Federal Express MD-11 pilot training procedures, McDonnell Douglas flight crew operating manual, or with Federal Express’ MD-11 tailstrike awareness and high sink rate and bounce recovery training.

1. The captain had no previously documented skill deficiencies that contributed to this

accident.

Conclusions 70 Aircraft Accident Report

1. Air carrier pilots’ performance would be improved by additional guidance and

training in landing techniques.

1. The flight crew’s calculation error in determining the runway length required for

landing influenced the captain’s subsequent actions during final approach and landing by creating a sense of urgency to touch down early and initiate maximum braking immediately.

1. Some flight crewmembers may lack proficiency in the operation of airport

performance laptop computers, or similar airplane performance computing devices, and confusion about calculated landing distances may result in potentially hazardous miscalculations of available runway distances after touchdown.

1. The inoperative left landing light did not impede the captain’s ability to land the

airplane.

1. The MD-11's tendency to pitch up at ground spoiler deployment did not contribute to

the accident.

1. The handling changes incorporated in the MD-11 flight control computer-908

software upgrade will provide valuable improvements in safety during MD-11 landings.

1. With the information that is currently available from the flight data recorder, it may be

impossible to distinguish the control inputs of the MD-11 flight control computer-908 longitudinal stability augmentation system from the pilots’ control inputs.

1. The MD-11’s throttle resolver angle-driven spoiler knockdown feature did not

contribute to this accident.

1. Additional basic research to identify undesirable landing phase combinations and to

compare the overall qualitative and quantitative stability and control characteristics of widely used, large transport-category airplanes is needed to improve certification criteria and reduce the incidence of potentially catastrophic landing accidents.

1. The energy transmitted into the right main landing gear during the second touchdown

was 3.2 times greater than the MD-11’s maximum certificated landing energy and was sufficient to fully compress (bottom) the right main landing gear strut and cause structural failure of the right wing rear spar.

1. The structural failure of the right wing rear spar resulted in the rupture of the right

wing fuel tanks and fire.

1. The failure modes and effects for vertically fused and overdesigned landing gear

designs may have been inadequately researched to identify whether, under overload conditions, one design might provide a safer break-up sequence for the airplane than the other design.

Conclusions 71 Aircraft Accident Report

1. Current manufacturer guidance for hard landing identification and operator

maintenance readouts and analysis of flight data recorder data following suspected hard landings may not be adequate to identify landings in which structural damage may have occurred.

1. Risks to firefighters and the surrounding community were minimized substantially

because the incident commander assumed that hazardous materials were on board and acted accordingly.

1. The Newark accident demonstrates that air carriers transporting hazardous materials

continue to need a means to quickly retrieve and provide consolidated, specific information to emergency responders about the identity of all hazardous materials on an airplane. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the captain’s overcontrol of the airplane during the landing and his failure to execute a go-around from a destabilized flare. Contributing to the accident was the captain’s concern with touching down early to ensure adequate stopping distance.

72 Aircraft Accident Report 4. Recommendations 4.1 New Recommendations As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendations: To the Federal Aviation Administration: Convene a joint government-industry task force composed, at a minimum, of representatives of manufacturers, operators, pilot labor organizations, and the Federal Aviation Administration to develop, within 1 year, a pilot training tool to do the following: Include information about factors that can contribute to structural failures involving the landing gear, wings, and fuselage, such as design sink rate limits; roll angle limits; control inputs’ roll rate; pitch rate; single-gear landings; the effect of decreased lift; and structural loading consequences of bottoming landing gear struts and tires; (A-00-92) Provide a syllabus for simulator training on the execution of stabilized approaches to the landing flare, the identification of unstabilized landing flares, and recovery from these situations, including proper high sink rate recovery techniques during flare to landing, techniques for avoiding and recovering from overcontrol in pitch before touchdown, and techniques for avoiding overcontrol and premature derotation during a bounced landing; (A-00-93) and Promote an orientation toward a proactive go-around. (A-00-94) Require principal operations inspectors assigned to Part 121 carriers that use auxiliary performance computers to review and ensure the adequacy of training and procedures regarding the use of this equipment and the interpretation of the data generated, including landing distance data. (A-00-95) Require the installation, within 1 year, of the MD-11 flight control computer-908 software upgrade on all MD-11 airplanes. (A-00-96)

Recommendations 73 Aircraft Accident Report Require, on all MD-11s equipped with the flight control computer-908 software, the retrofit of digital flight data recorder systems with all additional parameters required to precisely identify and differentiate between pilot and longitudinal stability augmentation system (LSAS) elevator control activity, including control column force, inertial reference unit pitch rate, LSAS command signals, elevator positions, and automatic ground spoiler command signals. (A-00-97) Review and, if appropriate, revise the DC-10 and MD-11 throttle resolver angle (TRA)-driven ground spoiler knockdown feature to ensure that it does not prevent ground spoiler deployment at moderate TRAs that could be associated with sink rate and airspeed corrections during the landing phase. (A-00-98) Require DC-10 and MD-11 operators to provide their pilots with information and training regarding the ground spoiler knockdown feature and its effects on landing characteristics and performance. (A-00-99) Sponsor a National Aeronautics and Space Administration (NASA) study of the stability and control characteristics of widely used, large transport- category airplanes to Identify undesirable characteristics that may develop during the landing phase in the presence of adverse combinations of pilot control inputs, airplane center of gravity position, atmospheric conditions, and other factors; and Compare overall qualitative and quantitative stability and control characteristics on an objective basis. The study should include analyses of DC-10 and MD-11 landing accidents and any other landing incidents and accidents deemed pertinent by NASA. (A-00-100) Based on the results of the study recommended in Safety Recommendation A-00-100, implement improved certification criteria for transport-category airplane designs that will reduce the incidence of landing accidents. (A-00-101) Conduct a study to determine if landing gear vertical overload fusing offers a higher level of safety than when the gear is overdesigned. If fusing offers a higher level of safety, revise 14 Code of Federal Regulations Part 25 to require vertical overload fusing of landing gear. (A-00-102)

Recommendations 74 Aircraft Accident Report Require manufacturers of 14 Code of Federal Regulations Part 23 and Part 25 airplanes and Part 121 operators to revise their hard landing inspection and reporting criteria to account for all factors that can contribute to structural damage; instruct principal maintenance and operations inspectors assigned to Part 121 operators to ensure that these changes have been made to operator maintenance manuals and Flight Operations Quality Assurance exceedence monitoring programs. (A-00-103) 4.2 Previously Issued Recommendations Classified in This Report Safety Recommendation A-98-80, previously classified “Open—Acceptable Response,” is classified “Open—Unacceptable Response” in section 2.6 of this report. BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member CAROL J. CARMODY Member Adopted: July 25, 2000

75 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing 5.1 Investigation The National Transportation Safety Board was initially notified of this accident about 0200 eastern standard time, on July 31, 1997. An investigative team was dispatched to the accident site shortly thereafter. Investigative groups were formed in the following specialties: operations/human performance, aircraft performance, hazardous materials, structures, systems/powerplants, airports, flight data recorder, and cockpit voice recorder. Member John Goglia accompanied the team to Newark. Parties to the investigation were:

1. Boeing Commercial Aircraft
2. Federal Express, Inc.
3. Port Authority of New York and New Jersey
4. Federal Aviation Administration
5. Federal Express Pilots Association
6. General Electric Aircraft Engines
7. 2

Public Hearing A public hearing was not held.

76 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript

Appendix B 77 Aircraft Accident Report

Appendix B 78 Aircraft Accident Report

Appendix B 79 Aircraft Accident Report

Appendix B 80 Aircraft Accident Report

Appendix B 81 Aircraft Accident Report

Appendix B 82 Aircraft Accident Report

Appendix B 83 Aircraft Accident Report

Appendix B 84 Aircraft Accident Report

Appendix B 85 Aircraft Accident Report

Appendix B 86 Aircraft Accident Report

Appendix B 87 Aircraft Accident Report

Appendix B 88 Aircraft Accident Report

Appendix B 89 Aircraft Accident Report

Appendix B 90 Aircraft Accident Report

Appendix B 91 Aircraft Accident Report

Appendix B 92 Aircraft Accident Report

Appendix B 93 Aircraft Accident Report

Appendix B 94 Aircraft Accident Report

Appendix B 95 Aircraft Accident Report

Appendix B 96 Aircraft Accident Report

Appendix B 97 Aircraft Accident Report

Appendix B 98 Aircraft Accident Report

Appendix B 99 Aircraft Accident Report

Appendix B 100 Aircraft Accident Report

Appendix B 101 Aircraft Accident Report

Appendix B 102 Aircraft Accident Report

Appendix B 103 Aircraft Accident Report

Appendix B 104 Aircraft Accident Report

Appendix B 105 Aircraft Accident Report

Appendix B 106 Aircraft Accident Report

Appendix B 107 Aircraft Accident Report

Appendix B 108 Aircraft Accident Report

Appendix B 109 Aircraft Accident Report

Appendix B 110 Aircraft Accident Report

Appendix B 111 Aircraft Accident Report

Appendix B 112 Aircraft Accident Report

113 Aircraft Accident Report Appendix C Excerpts from the Flight Data Recorder

Appendix C 114 Aircraft Accident Report

Appendix C 115 Aircraft Accident Report

Appendix C 116 Aircraft Accident Report

Appendix C 117 Aircraft Accident Report

Appendix C 118 Aircraft Accident Report

Appendix C 119 Aircraft Accident Report

Appendix C 120 Aircraft Accident Report

Appendix D 121 Aircraft Accident Report Appendix D Prior Incident Flight Data Recorder Data for the Accident Airplane

Appendix D 122 Aircraft Accident Report

Appendix D 123 Aircraft Accident Report

124 Aircraft Accident Report Appendix E FedEx Tail Strike Awareness Information Bulletin

Appendix E 125 Aircraft Accident Report

Appendix E 126 Aircraft Accident Report

Appendix E 127 Aircraft Accident Report

Appendix E 128 Aircraft Accident Report

129 Aircraft Accident Report Appendix F FedEx Tail Strike Awareness Training Instructor’s Guide

Appendix F 130 Aircraft Accident Report

Appendix F 131 Aircraft Accident Report

Appendix F 132 Aircraft Accident Report

Appendix F 133 Aircraft Accident Report

Appendix F 134 Aircraft Accident Report

Appendix F 135 Aircraft Accident Report

Appendix F 136 Aircraft Accident Report

Appendix F 137 Aircraft Accident Report

Appendix F 138 Aircraft Accident Report

Appendix F 139 Aircraft Accident Report

Appendix F 140 Aircraft Accident Report

Appendix F 141 Aircraft Accident Report

FD07223 ｜ 2000_美国_AAR0003.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 AIRCRAFT ACCIDENT REPORT PB2000-910403 NTSB/AAR-00/03 DCA96MA070 In-flight Breakup Over the Atlantic Ocean Trans World Airlines Flight 800 Boeing 747-131, N93119 Near East Moriches, New York July 17, 1996 6788G

this page intentionally left blank

Aircraft Accident Report In-flight Breakup Over The Atlantic Ocean Trans World Airlines Flight 800 Boeing 747-131, N93119 Near East Moriches, New York July 17, 1996 NTSB/AAR-00/03 DCA96MA070 PB2000-910403 National Transportation Safety Board Notation 6788G 490 L’Enfant Plaza, S.W. Adopted August 23, 2000 Washington, D.C. 20594

National Transportation Safety Board. 2000. In-flight Breakup Over The Atlantic Ocean, Trans World Airlines Flight 800, Boeing 747-131, N93119, Near East Moriches, New York, July 17, 1996. Aircraft Accident Report NTSB/AAR-00/03. Washington, DC. Abstract: This report explains the accident involving Trans World Airlines, Inc. flight 800, which experienced an in-flight breakup and then crashed into the Atlantic Ocean near East Moriches, New York, on July 17, 1996. Safety issues in the report focus on fuel tank flammability, fuel tank ignition sources, design and certification standards, and the maintenance and aging of aircraft systems. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2000-910403 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.3 Damage to Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.4 Other Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.5 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.5.1 The Captain (Left Front Seat) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.5.2 The Captain/Check Airman (Right Front Seat) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.3 The Flight Engineer (Right Aft/Flight Engineer’s Seat) . . . . . . . . . . . . . . . . . . . . . . 5 1.5.4 The Flight Engineer/Check Airman (Left Aft/Cockpit Jump Seat) . . . . . . . . . . . . . . 5 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.6.1 Boeing 747—General Description/Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6.1.1 747-100 Wing Center Section and Center Wing Fuel Tank Description . . . . . . 12 1.6.1.2 747-100 Air Conditioning Equipment Description. . . . . . . . . . . . . . . . . . . . . . . 16 1.6.1.3 747-100 Electrical and Wiring Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.6.1.3.1 747-100 Electrical Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.6.1.3.2 747 Wiring Information—General and Specific to Accident Airplane . . . . . 22 1.6.1.3.3 Separation of 747 Wire Circuits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.6.2 747-100 Fuel System Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.6.2.1 Fuel Quantity Indication System Components and Wiring Information. . . . . . . 31 1.6.2.2 747-100 Fuel Pump System Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.6.2.3 747-100 Fuel Flow Indication Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.6.2.4 TWA Flight 800 Fueling Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.6.3 Maintenance Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.6.3.1 TWA’s 747 Maintenance Inspection Program . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.6.3.1.1 TWA’s General Inspection Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.6.3.1.2 TWA and Boeing Wiring Inspection Guidance . . . . . . . . . . . . . . . . . . . . . . . 46 1.6.3.2 Accident Airplane’s Maintenance Information. . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.6.3.2.1 Airworthiness Directives and Service Bulletins Applicable to 747 Fuel Pumps and Related Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.6.3.2.2 Airworthiness Directives and Service Bulletins Applicable to 747 Structural Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.6.3.2.3 Maintenance Accomplished Near Fuel Quantity Indication System Wiring in the Accident Airplane. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.6.3.2.4 TWA Flight 800 Predeparture Maintenance Information . . . . . . . . . . . . . . . 54 1.7 Meteorological Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.10 Airport Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 1.11 Flight Recorders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Contents iv Aircraft Accident Report 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 1.11.1.1 Sound Spectrum Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 1.11.1.2 Cockpit Voice Recorder-Related Airplane Tests . . . . . . . . . . . . . . . . . . . . . . . . 60 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 1.12 Wreckage Recovery and Documentation Information . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.12.1 Wreckage Recovered from the Red Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 1.12.2 Wreckage Recovered from the Yellow Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1.12.3 Wreckage Recovered from the Green Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.12.4 Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 1.12.5 Center Wing Fuel Tank Pumps and Other Components . . . . . . . . . . . . . . . . . . . . . 75 1.12.6 Air Conditioning Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 1.12.6.1 Brown Splatter Material on Air Conditioning Ducts . . . . . . . . . . . . . . . . . . . . . 78 1.12.7 Recovered Electrical Components/Wiring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.13 Medical and Pathological Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 1.14 Fire/Explosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 1.15

!

"!

#$%&'#( ) * !+, '- (. ) * !!

(. )) +, '-!

(/ 0 1 !22 0 %33

2 0) 4'1 ! 20 . + #+# ) . + 567

8

) .) + 56- ' . .0 + 56- 94%

..) .. + 56-% ./ + 56$ :;

. 564%+ . 56%3"

-

. 5656

. - 5 ,56

( .( , ,-'

-( / 9 -=-'

)2 /

! 56

).

/ .-

9->). / -= !

.-

9->?

)(

/)

, - @ 9-> #; A02

Contents v Aircraft Accident Report

!

" #$

%$&

' (

)*

+

,

• &

" ./! "

' "! 0

+

, "

&

"!

• &

)

+

, "

1 2

! )*

+

, ./!

3 1 2 4#*

.)'2

+

,

5 *&

'6 7

0

&

'

"

' +

)

& 7

'

2 ,

7

"

'8

.

-

7 !

+

7 $ 0!

+

9 & &

' . "

3 ' . "

" ./

3 ' %*: 0!

0 & . "

" ./

' . "

"

' . "

" 7

.

9$ ; 2 & +

866

2 :

+

,

"!

' ;

"

3 "!

7

: +"

5

16 1 7"!

<-

$ ./! =

16 8 .

0

1 3 *&)9!

& 0

1 6

& 5 *

"

1

* ,

"

11 1 ;!

& -"

"

18 1

&

18 1 ;$

+ -

18 8 &&

"

13 8 & 0 & & 5

, 4./!

!

13 8 " 0 & . 4+

"

!

8 8 &> &> & .$ $ $ . 4+

"!

8 8 7 $ * 2 & * 0 ""& 0 & .

"!

8

8 !

+

*$

! )

!

88 8' 2 * $

0 & !

+

5)" 1'1 !

9&

33=

3 8 +

!

• &

3' 8 * 0 ""& & 0! &

0 "

+

866 &

3 8 9"

33> * 0 ""& 0 &

, "" <* 0 ""& )3)1'

)11=

3

Contents vi Aircraft Accident Report 0) -"!#((#! 7

56

@! 3(3A )2. 00 #((#! -C!

! , @!

3(30.30(A )2/

-, -22

))

1. %

)) 0.) ' !<-' 7E,';)/ 0.0 $ '((3@-'!

%#-"! #+ <

1 A) 0.. - 8

$3 !

)) . ,

))( . ;,

))( .) ,

)00 .0

!,

+! )0 .0 +!)0 .0) +!)0( .0) ). .. ,

:33 !). .

!%,

). . +

3)/2 . +

= "!!)/. )/ ) ;)/ ))

1 )/ )) 3-4')/ ))

-

)/ )))

735!56

@4"+

,A )/ ))0

-< 56 ,-')/( ))) ,

D"

)) ))) 56 ,

D"

)) )))

,

)/ )))

%% ) ))))

%,

+!) ))))

,

D"

)( ))0

3-4' ) )0 5 ) )0

" B-C! ! ) )0 :')) )0) +')) )00 +

-)) )0. 56 )0 )0/ 7 ). )0 -+=! )/ )0 B 5-"4 )

Contents vii Aircraft Accident Report )0 + 9 ) )0( +

) )02 5

! ) )0

B- C! ! )( )0)

5!-C! ! )( )0)

5!-C! ! , D ,')( )0) 5

)( )0))

) )0))

"3 5! +

) )0))) 1 !56

!

)0 )0))) 4' ). )0)))) 5

)/ )0)))0 !

, )/ )0))).

:'3 5 D

, -22 ) )0))

5! ,-')(2 )0))

)(2 )0)))

7)( )0))0 3

-C! !

, )( )0))0 53

-' )() )0)). : ,-')(0 )0)0

" , -2256 )(. ). -'

)(. ).

-' )(. ).)

-"-< =-' )( )/ +

02)

02

0

02 0) "" 02

02( . $% 02( .)

!

-

02 .0

!

0) 00 6 F 7 00 64F '=

0/ 6F

!00 6F + " 0( 65F

+

0) 6-F- 0 6;F-'56

<- ?+! .) .

Contents viii Aircraft Accident Report Figures

1. Three views of the 747-100 airplane. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2. Location of some body stations and waterlines in the 747. . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3a. Location of fuselage sections 41, 42, and 44 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3b. Location of fuselage sections 46 and 48 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 4a. A cross-section of the 747-100 wing center section . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 4b. Another cross-section of the 747-100 wing center section . . . . . . . . . . . . . . . . . . . . . . . . . . 14

1. The 747-100 aerodynamic fairings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2. A schematic diagram of the 747-100’s air conditioning system . . . . . . . . . . . . . . . . . . . . . 18
3. Top and side views of the 747-100’s wing center section and air conditioning system . . . . 19
4. Underside view of the 747-100’s wing center section and air conditioning system . . . . . . . 20
5. The air conditioning ducts around the 747-100’s center wing fuel tank . . . . . . . . . . . . . . . 21
6. Diagram of a BMS13-42A Poly-X wire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
7. A schematic diagram of the 747-100 fuel tank arrangement . . . . . . . . . . . . . . . . . . . . . . . . 27
8. A layout of a typical 747-100 center wing fuel tank and left wing fuel tank vent system . . 29
9. A 747 pressure fueling flow diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
10. A diagram of the 747 pressure fueling system components . . . . . . . . . . . . . . . . . . . . . . . . . 32
11. Diagrams of a fuel quntity probe and a compensator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
12. The fuel quantity probe and compensator locations in the 747’s center wing fuel tank . . . . 36
13. A schematic diagram of the 747-100’s fuel quantity indication system wiring,

fuel flow wiring, cockpit voice recorder wiring, and other wiring information . . . . . . . . . . 38

1. Locations of the wire raceways in the 747-100. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
2. A schematic diagram of the fuel pump locations in the 747. . . . . . . . . . . . . . . . . . . . . . . . . 41
3. A diagram of the 747-100 interior. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
4. The wreckage location relative to the airplaine’s flightpath, JFK, and Long Island. . . . . . . 64

22a. Map showing the locations of the red, yellow, and green zones. . . . . . . . . . . . . . . . . . . . . . 66 22b. A 747, color-coded to indicate the debris fields from which corresponding wreckage was recovered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 22c. The accident airplane’s flightpath, color-coded to indicate the debris fields from which corresponding wreckage was recovered. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

1. A diagram of a jettison/override fuel pump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
2. A photograph showing wreckage recovered with tangled and damaged wires attached . . . 80
3. Radar data showing vehicle and/or object tracks within 10 nm of TWA flight 800

just before the accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

1. Primary radar returns that appeared near the accident airplane after 2031:12 . . . . . . . . . . . 91

Contents ix Aircraft Accident Report

1. Sequence of eight primary radar returns recorded by the Islip, New York, radar

site about the time of the accident. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 28a. Roll angle for nose off at 2031:15.2 cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 28b. Map view of nose off at 2031:15.2 cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 28c. Altitude for nose off at 2031:15.2 cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 28d. East position for nose off at 2031:15.2 cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 28e. North position for nose off at 2031:15.2 cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

1. A photograph of the right side of the large three-dimensional reconstruction,

with the support scaffolding visible . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

1. A schematic drawing of the lower portion of the fuselage skin in the area

forward of the front spar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

1. Diagram showing the approximate shape of the upper skin panel stiffener and

its location before being struck by SWB3 as the beam rotated forward . . . . . . . . . . . . . . . 107

1. A flow chart of the fuel-related research conducted to support this investigation . . . . . . . 121
2. Side view, top view, and three-dimensional view of wing center section/center

wing fuel tank bays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

1. A trip-curve chart for a typical circuit breaker (excerpted from Texas

Instruments Klixon® specification) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 35a. Sample origination locations for the 747 manufactured in 1970 . . . . . . . . . . . . . . . . . . . . 152 35b. Sample origination locations for the DC-10 manufactured in 1973 . . . . . . . . . . . . . . . . . . 152 35c. Sample origination locations for the 747 manufactured in 1973 . . . . . . . . . . . . . . . . . . . . 153

1. Chart showing the percent probability of failure of Kapton wiring in different

locations in the P-3 airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

1. A diagram of a scavenge pump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
2. Diagram showing the areas typically inspected on 747 airplanes. . . . . . . . . . . . . . . . . . . . 190
3. A chart showing the 737 fuel pump conduit wear rate that was identified by

the FAA during representative 500 wire inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

1. Map showing the witness locations and the location of the accident site. . . . . . . . . . . . . . 231
2. A map showing the debris zones and the positions of the five witnesses of

special interest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

1. Map of sight lines plotted for 11 witnesses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
2. Diagram of warhead detonation fragment pattern. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
3. Diagram showing airplane and missile launch site locations that could result in missile

selfdestruct within 40 feet of the plane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

1. A graphical illustration of the equidistance tendency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
2. Diagram of the center wing tank fuel quantity indication system wiring on the 747

and its common connectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

1. A time line of salvage operation events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366

Sooting and fracture diagrams. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378-411

Contents x Aircraft Accident Report Tables

1. Injury chart. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. TWA’s fueling records, indicating TWA flight 800’s fuel loading

when it prepared to depart JFK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

1. Winds aloft measured by a weather balloon launched

from Upton, New York . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

1. A time line of simulation scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
2. 747-100 wing center section/center wing fuel tank

SWBs and spars failure strengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

1. A summary of the maximum and minimum recorded ullage temperatures

at 13,700 feet msl during the emulation flight test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

1. Fuel/air mass ratios and ullage temperatures measured at the

bay 2 sampling port during the TWA flight emulation flight test. . . . . . . . . . . . . . . . . . . . 130

1. Results of wet short-circuit tests conducted by Lectromec. . . . . . . . . . . . . . . . . . . . . . . . . 146
2. The origin and potential environmental exposures of test samples. . . . . . . . . . . . . . . . . . . 151
3. Several fault tree analysis basic elements, as identified in Boeing’s

fault tree analysis report, with their failure rates, exposure times, and calculated event probability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

1. Some of the basic elements of Boeing’s fault tree analysis, showing

the differences between the data presented in Boeing’s graphical and tabular representations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

xi Aircraft Accident Report Abbreviations AAIB Air Accidents Investigation Branch (British) a.c. alternating current AC advisory circular ACAP Aviation Consumer Action Project ACM air cycle machine AD airworthiness directive AFCB arc-fault circuit breaker AFM aircraft flight manual AFRL U.S. Air Force Research Laboratory AIDS airborne integrated data system ALPA Air Line Pilots Association amp ampere AOA angle-of-attack API (2003) American Petroleum Institute (Recommended Practice 2003) APU auxiliary power unit ARAC Aviation Rulemaking Advisory Committee ARTCC air route traffic control center AS aircraft service (check) ASB alert service bulletin ASR airport surveillance radar ATA Air Transport Association of America ATC air traffic control ATE automated test equipment ATF Bureau of Alcohol, Tobacco, and Firearms ATP airline transport pilot ATSRAC Aging Transport Systems Rulemaking Advisory Committee AWIGG Aircraft Wiring and Inert Gas Generator BL butt line BMS Boeing Material Specification CAM cockpit area microphone CAMI Civil Aeromedical Institute (Federal Aviation Administration)

Abbreviations xii Aircraft Accident Report CDG Charles DeGaulle International Airport (Paris, France) CDL Combustion Dynamics Limited CEU central electronics unit CFR Code of Federal Regulations c.g. center of gravity CHDO Certificate Holding District Office CIA Central Intelligence Agency CIT California Institute of Technology CMR Christian Michelsen Research CVR cockpit voice recorder CWT center wing fuel tank d.c. direct current DERA Defense Evaluation and Research Agency (British) DGAC Direction Generale de L’Aviation Civile DNA deoxyribonucleic acid DoD Department of Defense DRI Desert Research Institute EDS energy dispersive spectroscopy E/E electrical/electronics EME electromagnetic environment EMI electromagnetic interference EPR engine pressure ratio F Fahrenheit FAA Federal Aviation Administration FARs Federal Aviation Regulations FBI Federal Bureau of Investigation FDR flight data recorder FMEA failure modes and effects analysis FOK Francis S. Gabreski Airport (Westhampton Beach, New York) fps feet per second FQIS fuel quantity indication system FR Federal Register FTHWG Fuel Tank Harmonization Working Group

Abbreviation xiii Aircraft Accident Report GPS global positioning system HF high frequency Hg mercury HIRF high-intensity radiated fields HP High Performance HPC high-pressure compressor HSSM Hamilton Standard Service Manual Hz hertz (cycles per second) IAM International Association of Machinists, Aerospace Workers, and Flight Attendants IOE initial operating experience J joule JAA Joint Aviation Authorities JFK John F. Kennedy International Airport (New York, New York) JSC Joint Spectrum Center (DoD) kJ kilojoule kW kilowatt LaRC Langley Research Center LBL left butt line LFL lower flammability limit LLS laser line-scanning LPC low-pressure compressor MAC mean aerodynamic chord MHz megahertz MIE minimum ignition energy mil one-thousandth of an inch mJ millijoule mm millimeter MO modification order MSFC George C. Marshall Space Flight Center MSIC Missile and Space Intelligence Center (Defense Intelligence Agency)

Abbreviations xiv Aircraft Accident Report msl mean sea level NaCl saline-water electrolyte solution NAFI U.S. Naval Avionics Facility NASA National Aeronautics and Space Administration NASIP National Aviation Safety Inspection Program NAWC-AD Naval Air Warfare Center—Aircraft Division NAWC-WD Naval Air Warfare Center—Weapons Division nm nautical mile NOAA National Oceanic and Atmospheric Administration NPRM notice of proposed rulemaking NRC Nuclear Regulatory Commission NRL Naval Research Laboratory NYANG New York Air National Guard PED personal electronic device PETN pentaerythritol tetranitrate PI production illustration (Boeing’s) PMI principal maintenance inspector P/N part number PPM partial program manager PS periodic service (check) psi (pressure expressed in) pounds per square inch PTFE polytetrafluoroethylene P&W Pratt & Whitney RADES Radar Evaluation Squadron RBL right butt line RDX cyclotrimethylenetrinitramine RF radio frequency ROV remote-operated vehicle SAE Society of Automotive Engineers SB service bulletin SDR service difficulty report SEM scanning electron microscope SFAR Special Federal Aviation Regulation SL service letter

Abbreviations xv Aircraft Accident Report S/N serial number SNL Sandia National Laboratories SS station service (check) SSS side-scan sonar STA body station STC supplemental type certificate STP surge tank protection SUPSALV Supervisor of Salvage and Diving SURVIAC Survivability/Vulnerability Information Analysis Center SWB spanwise beam SWPM Standard Wiring Practices Manual (Boeing) TC type certificate TCS time control service (check) TDR time-domain reflectometry TRU transformer-rectifier unit TSD transient suppression device TWA Trans World Airlines, Inc. UDRI University of Dayton Research Institute UL Underwriters Laboratories, Inc. USAF U.S. Air Force USCG U.S. Coast Guard UV ultraviolet ray VHF very high frequency V/m volt/meter VSCU video system control unit VSO volumetric shutoff WCS wing center section WHCASS White House Commission on Aviation Safety and Security WL body waterline WS wing station WSSIWG Wire System Safety Interagency Working Group XL-ETFE cross-linked ethylenetetrafluoroethylene

xvi Aircraft Accident Report Executive Summary On July 17, 1996, about 2031 eastern daylight time, Trans World Airlines, Inc. (TWA) flight 800, a Boeing 747-131, N93119, crashed in the Atlantic Ocean near East Moriches, New York. TWA flight 800 was operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled international passenger flight from John F. Kennedy International Airport (JFK), New York, New York, to Charles DeGaulle International Airport, Paris, France. The flight departed JFK about 2019, with 2 pilots, 2 flight engineers, 14 flight attendants, and 212 passengers on board. All 230 people on board were killed, and the airplane was destroyed. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable cause of the TWA flight 800 accident was an explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. The source of ignition energy for the explosion could not be determined with certainty, but, of the sources evaluated by the investigation, the most likely was a short circuit outside of the CWT that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system. Contributing factors to the accident were the design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources and the design and certification of the Boeing 747 with heat sources located beneath the CWT with no means to reduce the heat transferred into the CWT or to render the fuel vapor in the tank nonflammable. The safety issues in this report focus on fuel tank flammability, fuel tank ignition sources, design and certification standards, and the maintenance and aging of aircraft systems. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration.

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On July 17, 1996, about 2031 eastern daylight time,1 Trans World Airlines, Inc. (TWA) flight 800, a Boeing 747-131 (747), N93119, crashed in the Atlantic Ocean near East Moriches, New York. TWA flight 800 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 as a scheduled international passenger flight from John F. Kennedy International Airport (JFK), New York, New York, to Charles DeGaulle International Airport (CDG), Paris, France. The flight departed JFK about 2019, with 2 pilots, 2 flight engineers, 14 flight attendants, and 212 passengers on board. All 230 people on board were killed, and the airplane was destroyed. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. On the day of the accident, the accident airplane departed Athens, Greece, as TWA flight 881 about 0537, landed at JFK about 1631, and arrived at terminal 5, gate 27, about 1638. The flight crew that had flown the accident airplane from Athens, Greece, to JFK told National Transportation Safety Board investigators that it did not observe any operational abnormalities during that flight. A scheduled flight crew change occurred at JFK. The accident airplane was refueled at JFK2 and remained at gate 27 with the auxiliary power unit (APU) and two of its three air conditioning packs operating (for about 2 1/2 hours) until it departed as TWA flight 800. According to company records, flight 800 was to be the first leg of a scheduled 3-day trip sequence for the four flight crewmembers. A captain occupied the left front seat, a captain/check airman occupied the right front seat, a flight engineer occupied the right aft seat (flight engineer position), and a flight engineer/check airman occupied the left aft seat (cockpit jump seat).3 TWA flight 800 was scheduled to depart JFK for CDG about 1900; however, the flight was delayed because of a disabled piece of ground equipment4 and concerns about a suspected passenger/baggage mismatch. According to the cockpit voice recorder (CVR),5 at 1959:44, gate agent personnel advised the flight 1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 2 For additional information regarding TWA flight 881 flight crew statements about the airplane’s fuel load during that flight, refueling difficulties at JFK, and the fuel on board the accident airplane when it departed JFK, see section 1.6. 3 The flight engineer was receiving initial operating experience (IOE) training during the accident flight. 4 A disabled fleet service vehicle was blocking the accident airplane at the gate, and there was a delay obtaining the proper equipment to tow the fleet service vehicle. 5 See appendix B for a complete transcript of the CVR. The local (eastern daylight) time reference was established by correlating the last seven very high frequency (VHF) radio transmissions made by the pilots of TWA flight 800 and recorded by the flight data recorder (FDR) microphone keying parameter with the CVR and the Boston Air Route Traffic Control Center (ARTCC). The correlation points all agreed within 1 second.

Factual Information 2 Aircraft Accident Report crew that, although a passenger’s bag had been pulled because they suspected that it was unattended, they subsequently confirmed that “the passenger was on board the whole time.” The CVR recorded the sound of the cockpit door closing at 1959:59, and the flight crew of TWA flight 800 continued to prepare for departure. TWA flight 800 was pushed back from the gate about 2002. According to the CVR, between 2005 and 2007:46, the flight crew started the Nos. 1, 2, and 4 engines and completed the after-start checklist. At 2007:52, the captain/check airman advised the JFK gate hold controller that TWA flight 800 was “ready to taxi.” About 2008, the flight crew received taxi instructions from air traffic control (ATC) and began to taxi to runway 22 right (22R), the departure runway. While the airplane was taxiing (about 2014), the CVR recorded the flight crew starting the No. 3 engine and conducting the delayed engine-start and taxi checklists. At 2017:18, the CVR recorded ATC stating, “TWA 800 heavy caution wake turbulence from a 757, runway 22R, taxi into position and hold.” The CVR transcript indicated that the captain/check airman acknowledged the ATC clearance and that the airplane was taxied into position on the departure runway.6 At 2018:21, ATC advised the pilots of TWA flight 800 that the wind was out of 240° at 8 knots and cleared flight 800 for takeoff on runway 22R. The CVR recorded the flight crew conducting the before-takeoff checklist and the sound of increasing engine noise; FDR and CVR information indicated that the airplane became airborne about 2019. During the accident airplane’s departure from JFK, the pilots of TWA flight 800 received a series of (generally increasing) altitude assignments and heading changes from New York Terminal Radar Approach Control and Boston ARTCC controllers. At 2025:41, Boston ARTCC advised the pilots to “climb and maintain [19,000 feet] and expedite through [15,000 feet]”; the pilots acknowledged the instructions at 2025:47. According to the CVR, at 2026:24, Boston ARTCC amended TWA flight 800’s altitude clearance, advising the pilots to maintain 13,000 feet mean sea level (msl). At 2027:47, the CVR recorded the sound of the altitude alert tone, and the FDR data indicated that the airplane reached its assigned altitude. At 2029:15, the CVR recorded the captain stating, “Look at that crazy fuel flow indicator there on number four…see that?”7 At 2030:15, Boston ARTCC advised, “TWA 800 climb and maintain [15,000 feet msl].” The CVR recorded the captain stating, “climb thrust,” and the captain/check airman acknowledging the ATC clearance at 2030:18. At 2030:25, the captain repeated, “climb thrust,” and at 2030:35, the flight engineer responded, “power’s set.” The CVR recording of the next 30 seconds from the cockpit area microphone (CAM)8 includes the following sounds: 6 Review of the ATC and CVR transcripts from the accident flight indicated that the captain (left front seat) was performing the pilot-flying duties, while the captain/check airman (right front seat, identified as the “first officer” in the CVR transcript) was performing the radio communications and other pilot-not- flying duties during the departure. 7 For additional information regarding the fuel flow sensing and indication system on the 747-100, see section 1.6.2.3.

Factual Information 3 Aircraft Accident Report • a sound similar to a mechanical movement in the cockpit (at 2030:42), • an unintelligible word (at 2031:03), and • sounds similar to recording tape damage noise (at 2031:05).9 At 2031:12, the CVR recording ended. A sound spectrum study of the information recorded by the CVR revealed that twice within the last second of the CVR recording (about 0.73 and 0.68 seconds before the recording stopped), the captain’s channel recorded harmonic tones at the 400 Hertz10 (Hz) frequency, but it did not record other electrical system background noise that it had recorded previously throughout the recording. These other electrical system background noises were recorded on the other CVR channels without interruption.11 The CVR then recorded a “very loud sound” for a fraction of a second (0.117 second) on all channels immediately before the recording ended. The accident airplane’s last recorded radar12 transponder return occurred at 2031:12, and a review of the FDR data indicated that the FDR lost power at 2031:12. According to the Boston ARTCC transcript, at 2031:50, the captain of an Eastwind Airlines Boeing 737 (Stinger Bee flight 507) reported that he “just saw an explosion out here.” About 10 seconds later, the captain of Stinger Bee flight 507 further advised, “we just saw an explosion up ahead of us here…about 16,000 feet or something like that, it just went down into the water.”13 Subsequently, many ATC facilities in the New York/Long Island area received reports of an explosion from other pilots operating in the area. Many witnesses in the vicinity of the accident at the time that it occurred stated that they saw and/or heard explosions, accompanied by a large fireball over the ocean, and observed debris, some of which was burning, falling to the water. According to witness documents, about one-third of these witnesses reported that they observed a streak of light, resembling a flare, moving upward in the sky to the point where a large fireball appeared. Several witnesses reported seeing this fireball split into two fireballs as it descended toward the water.14 8 The audio information recorded by the CAM includes audio (airborne) sounds and vibrations picked up by the fuselage-mounted microphone. 9 Subsequent examination of the CVR tape indicated that these sounds were likely the result of water damage to the tape head. Because of the position of the tape on the reels, the portion of the tape that contained sounds from the last seconds before the CVR stopped recording was exposed to water after the accident. 10 A Hz is a unit of frequency equal to 1 cycle per second. 11 The Safety Board’s CVR sound spectrum study revealed no other such changes or other unusual electrical occurrences on the 31-minute 30-second recording. See section 1.11.1.1 for a detailed discussion of the results of the sound spectrum study and other CVR-related testing, including how the CVR system installed on the 747 would respond to various types of explosive events. 12 Examination of radar data indicated that the accident airplane’s last radar transponder return was recorded by the Federal Aviation Administration’s (FAA) radar site at Trevose, Pennsylvania. For additional information regarding radar information, see section 1.16.1. 13 Radar data and ATC records indicated that Stinger Bee flight 507 was about 20 to 25 miles northeast of TWA flight 800, on a southwesterly heading. 14 For additional information regarding witness reports, including that of the pilot of Stinger Bee flight 507, see section 1.18.4.

Factual Information 4 Aircraft Accident Report Pieces of the airplane wreckage were discovered floating on and beneath the surface of the Atlantic Ocean about 8 miles south of East Moriches, New York. The main wreckage was found on the ocean floor, between 40° 37' 42" and 40° 40' 12" north latitude and 72° 40' 48" and 72° 35' 38" west longitude. The accident occurred in dusk lighting conditions. 1.2 Injuries to Persons 1.3 Damage to Aircraft The airplane was destroyed by the explosion, breakup and impact forces, and fire. According to insurance company records, the airplane was valued at $11 million. 1.4 Other Damage No structures on the ground were damaged. 1.5 Personnel Information The Safety Board reviewed the flight crew’s flight- and duty-time limits and rest records and found no evidence that they were not within the limits established by Federal regulations. The cabin crew comprised 14 flight attendants. 1.5.1 The Captain (Left Front Seat) The captain, age 58, was hired by TWA on May 20, 1965. He held airline transport pilot (ATP) certificate No. 1453736 with multiengine land and instrument ratings. The captain’s most recent FAA first-class airman medical certificate was issued on March 22, 1996, and contained the limitation that he possess glasses for near vision. Table 1. Injury chart. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 4 14 212 0 230 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 4 14 212 0 230

Factual Information 5 Aircraft Accident Report The captain’s first assignment with TWA was as a first officer on the Convair 880. He subsequently served as first officer and captain on the Boeing 707 (707) and Lockheed 1011 before transitioning to the 747. He received a 747 type rating on February 19, 1990, and began 747 captain upgrade training on May 21, 1996; the captain’s most recent proficiency check was satisfactorily completed on June 19, 1996. According to TWA records, at the time of the accident, the captain had flown approximately 18,800 total flight hours, including 5,490 hours in the 747. 1.5.2 The Captain/Check Airman (Right Front Seat) The captain/check airman, age 57, was hired by TWA on April 13, 1964. He held ATP certificate No. 1475512 with single-engine land, multiengine land, and instrument ratings. The captain/check airman’s most recent FAA first-class airman medical certificate was issued on April 15, 1996, with no restrictions or limitations. The captain/check airman’s first assignment with TWA was as a first officer on the Convair 880. He subsequently served as flight crewmember on the 707, Boeing 727, and Lockheed 1011 before transitioning to the 747. He received a 747 type rating on December 30, 1974, and qualified as a 747 check airman on May 3, 1993. According to TWA records, at the time of the accident, the captain/check airman had flown approximately 17,000 total flight hours, including 4,700 hours in the 747. 1.5.3 The Flight Engineer (Right Aft/Flight Engineer’s Seat) The flight engineer trainee, age 24, was hired by TWA on June 22, 1996. He held flight engineer-turbo jet-powered certificate No. 306804492. The flight engineer trainee’s most recent FAA first-class airman medical certificate was issued on December 12, 1995, with no restrictions or limitations. The flight engineer trainee was hired by TWA as a 747 flight engineer, and the accident flight was the sixth leg of his IOE training. According to TWA records, at the time of the accident, the flight engineer trainee had flown approximately 2,520 total flight hours, including about 30 hours as flight engineer trainee in the 747. 1.5.4 The Flight Engineer/Check Airman (Left Aft/Cockpit Jump Seat) The flight engineer/check airman, age 62, was hired by TWA on February 26,

1. He held ATP certificate No. 1409009 and flight engineer-turbo jet-powered

certificate No. 1694661. The flight engineer/check airman’s most recent FAA first-class airman medical certificate was issued on July 17, 1996, and contained the limitation that he wear glasses for near and distant vision. The flight engineer/check airman’s first assignment with TWA was as a flight engineer on the Lockheed Constellation 749, 749A, and 1049G model airplanes. In

Factual Information 6 Aircraft Accident Report February 1967, he upgraded to the first officer position on these model airplanes. On November 19, 1986, the flight engineer/check airman received a 747 type rating. He subsequently performed 747 first officer and captain duties until he turned 60 on July 2, 1993, at which time, he became a flight engineer on the 747 rather than retire.15 According to TWA records, at the time of the accident, the flight engineer/check airman had about 3,047 hours of flight engineer experience, including 2,397 hours as flight engineer on the 747. 1.6 Airplane Information The accident airplane, N93119, a 747-100 series airplane (model 747-131),16 serial number (S/N) 20083, was manufactured by Boeing in July 1971 and purchased new by TWA. The airplane was added to TWA’s operating certificate on October 27, 1971, and, except for a 1-year period,17 was operated by TWA in commercial transport service until the accident occurred. According to TWA records, the accident airplane had 93,303 total hours of operation (16,869 flight cycles)18 at the time of the accident.19 The 747-100 is a low-wing, transport-category airplane that is about 225 feet long and 63 feet high (from the ground to the top of the vertical stabilizer), with a wingspan of about 195 feet. The 747-100 can carry about 430 passengers and cargo. Figure 1 shows three views of the 747-100 airplane. The accident airplane was equipped with four Pratt & Whitney (P&W) JT9D-7AH turbofan engines. Company maintenance records indicated that the No. 1 (outboard left) engine, S/N 662209, was installed on the accident airplane on December 31, 1995, and had operated about 47,989 hours since new; the No. 2 (inboard left) engine, S/N 662593, was installed on the accident airplane on December 6, 1995, and had operated about 80,884 hours since new; the No. 3 (inboard right) engine, S/N 662426, was installed on the accident airplane on June 18, 1996, and had operated about 80,336 hours since new; 15 Federal Aviation Regulations (FARs) stipulate a mandatory retirement age of 60 for air carrier captains and first officers; however, they allow continued airman activity in other areas, including the flight engineer position. 16 The 747-100 series airplane is one of several 747 models. Other 747 models include the -200, -300, -SP, and -SR (collectively referred to as the “Classic”) series airplanes, and the -400. The military uses derivatives of the 747, which are identified as the E-4B and VC-25. 17 On December 15, 1975, the accident airplane was ferried to the Boeing Military Aircraft Company in Wichita, Kansas, to be prepared for sale to the Government of Iran. According to the Airclaims Limited database, the accident airplane was sold to the Iranian Air Force in December 1975; however, the airplane was not delivered to Iran and was returned to TWA’s operating certificate on December 16, 1976. Maintenance records indicated that the airplane had been operated about 7 hours with four landings between December 1975 and December 1976. (See Maintenance Records Group Chairman’s Factual Report, dated October 8, 1997, for a list of the modifications and inspections accomplished in preparation for the sale of the airplane.) 18 A flight cycle is one complete takeoff and landing sequence. 19 According to a Boeing AERO magazine article, the minimum design service objective for 747 series airplanes was 20,000 flights, 60,000 hours, and 20 years.

Factual Information 7 Aircraft Accident Report and the No. 4 (outboard right) engine, S/N 662463, was installed on the accident airplane on May 11, 1996, and had operated about 77,061 hours since new. According to TWA’s dispatch documents for the accident flight, the airplane’s takeoff weight was calculated to be 590,441 pounds,20 including 19,751 pounds of cargo (6,062 pounds of cargo in the forward cargo compartment and 13,689 pounds of cargo in the aft and bulk cargo compartments)21 and 176,600 pounds of fuel. TWA dispatch records and load information recorded by the CVR indicated that there were 29 passengers in the first-class cabin, 183 passengers in the coach cabin, and 18 crewmembers (4 flight crewmembers and 14 cabin crewmembers) on board the airplane. The dispatch documents indicated that the airplane’s takeoff center of gravity (c.g.) was calculated to be 18.4 percent of the mean aerodynamic chord (MAC), and the takeoff horizontal stabilizer trim setting was 6.1 units nose up. 1.6.1 Boeing 747—General Description/Information The 747-100 fuselage comprises five major sections (referred to in Boeing manuals as sections 41 [the forward section], 42, 44, 46, and 48 [the tail section]) and consists of the external skin, internal circumferential frames, and longitudinal (fore-aft) stiffening members, called stringers.22 For ease of reference, in the airplane’s documentation, Boeing divided the airplane into reference planes, which are designated as body stations (STA),23 body waterlines (WL),24 and butt lines (BL).25 The locations of various components and fuselage areas in 747s are measured in inches from fixed points of reference. Figure 2 shows the locations of some STAs and WLs. Figures 3a and 3b show the locations of numerous STAs and other fuselage areas, including fuselage sections, doors, and wheel wells. 20 The maximum certificated takeoff gross weight for the accident airplane was 734,000 pounds. 21 According to Boeing documents, the aft cargo compartment consists of an aft containerized cargo/baggage compartment and a (farther aft) bulk cargo compartment, which have separate doors and are separated by compartment divider nets. TWA’s dispatch records use the term “rear cargo compartment” to describe the aft containerized cargo/baggage compartment and “aft cargo compartment” to describe the bulk cargo compartment. These dispatch documents specified that the “rear cargo compartment” contained 12,428 pounds of cargo and that the “aft cargo compartment” contained 1,261 pounds of cargo. 22 The 747-100 wings also contain stringers, which extend from the wing root to the wing tip, to support and reinforce the wing skin. 23 A STA is a longitudinal point along an airplane’s fuselage, identified numerically by its distance in inches from a reference point. In a classic 747, this point is 90 inches forward of the airplane’s nose. 24 A WL is a horizontal point along an airplane’s fuselage, identified numerically by its distance in inches from a parallel imaginary plane (WL 0.00) located 91 inches below the lowest body surface. 25 A BL number refers to a lateral fuselage location and reflects the number of inches the location is right or left of the airplane’s centerline.

Factual Information 8 Aircraft Accident Report Figure 1. Three views of the 747-100 airplane. 32’ 25’6” 78’11” 225’2” 10’ 231’4” 69’6” 2° TYP 12’6” 36’2” 72’9” 195’8” 63’5”

Factual Information 9 Aircraft Accident Report Figure 2. Location of some body stations and waterlines in the 747.

Factual Information 10 Aircraft Accident Report Figure 3a. Location of fuselage sections 41, 42, and 44.

Factual Information 11 Aircraft Accident Report Figure 3b. Location of fuselage sections 46 and 48. STA 1480 STA 1640 STA 1694 STA 1800 STA 1980 STA 1920 STA 2240 STA 2261 STA 2280 STA 2360 STA 2360 STA 2484 STA 2517 STA 2598 STA 2775.3 WL 366.5 WL 292.5 STABILIZER HINGE POINT STA 2658 STA 2638 STA 2742 STA 2594 ACCESS DOOR STA 2436 STA 2412 SECTION 48 SECTION 46 STA 2007 STA 1865 STA 1700 STA 1718 STA 1664 AFT CARGO DOOR BULK CARGO DOOR STA 2792 STA 2040

Factual Information 12 Aircraft Accident Report The vertical and horizontal stabilizers intersect the tail section of the fuselage between STAs 2220 and 2590. The wing leading edges intersect the fuselage (with a sweepback angle of 37 1/2º) just aft of STA 900, and the trailing edge is located just forward of STA 1480. The wing front, mid, and rear spars extend through the wing center section (WCS)26 between the right and left wings at STAs 1000, 1140.5, and 1241, respectively (see figures 3a, 4a, and 4b). The fuselage is nearly circular in cross-section where it intersects the front spar at the ring chord.27 The bottom of this portion of the fuselage is also attached to the lower end of the keel beam (see figure 4a), which is a box-shaped, load-bearing structure located along the airplane’s centerline that extends from the aft wall of the forward cargo compartment28 (STA 1000) through the main and body landing gear compartments to the forward wall of the aft cargo compartment (STA 1480). (Figure 4a shows the keel beam structure and locations of WCS lateral beams/spars, and the ring chord.) The portion of the airplane below the WCS is contained within an aerodynamic fairing29 that blends into the wing leading edge. Figure 5 shows the 747-100 aerodynamic fairings. 1.6.1.1 747-100 Wing Center Section and Center Wing Fuel Tank Description The 747-100’s WCS is located aft of the forward cargo compartment and forward of the main landing gear bay in the lower fuselage. Like the cargo compartments, the WCS is below the main cabin floor. The WCS is about 21 feet wide, 20 feet long, and varies in height from about 4 1/2 to 6 feet (with the shortest height located at the aft end). The WCS is framed by the front and rear wing spars and the side-of-body ribs that separate the WCS from the inboard wing fuel tanks. The upper and lower skin panels separate the WCS from the passenger cabin floor (which is located above the WCS and supported by longitudinal floor beams) and the airplane’s heat exchanger/air conditioning equipment (which is located beneath the WCS),30 respectively. According to Boeing, the WCS carries the wing bending forces through the airplane and supports the fuselage during flight. 26 The WCS is a large structural box located in the 747 lower fuselage between the wings and comprises the center wing fuel tank (CWT) and a dry bay directly forward of the CWT. For additional information regarding the WCS and CWT, see section 1.6.1.1. (Note: The CWT is called the wing center tank in some documents.) 27 A chord is an angle member that attaches two other pieces together, usually at an angle of about 90º. The ring chord is an angle member that attaches the bottom of the forward fuselage section to the front side of the lower-pressure bulkhead and the front spar. 28 As previously discussed, the 747 has a forward and an aft cargo compartment, each located in the lower portion of the fuselage, below the main cabin floor. 29 The fairings are composite material shaped around the fuselage and wings to make the airplane more aerodynamic. 30 For further details about the airplane’s heat exchanger/air conditioning equipment (air conditioning packs), see section 1.6.1.2.

Factual Information 13 Aircraft Accident Report Figure 4a. A cross-section of the 747-100 wing center section. Ring Chord Front Spar Vent Opening Vent Opening Forward Keel Beam Spanwise Beam 3 Intercoastal Spanwise Beam 2 Midspar Spanwise Beam 1 Rear Spar Floor Beams

Factual Information 14 Aircraft Accident Report Figure 4b. Another cross-section of the 747-100 wing center section.

Factual Information 15 Aircraft Accident Report Figure 5. The 747-100 aerodynamic fairings.

Factual Information 16 Aircraft Accident Report The WCS is divided laterally into compartments by six beams, including (from farthest aft to forward) the rear spar, spanwise beam (SWB)1, the mid spar, SWB2, SWB3, and the front spar (see figures 4a and 4b). In addition, a partial longitudinal rib divides the WCS along the airplane’s centerline (BL 0) between the mid and rear spars. The WCS compartments located between the rear spar and SWB3 comprise the CWT. In the 747-100, the compartment between SWB3 and the front spar is a dry bay that is not intended to contain fuel.31 SWBs 1 and 2, the partial ribs, and the mid spar in the CWT contain a number of cutouts and vent holes to allow air or fuel to move between the various bays and electrical tubing/conduit32 to pass through. In addition, the SWBs and mid spar contain maintenance access doors, which are attached with removable fasteners. SWB2 also contains a manufacturing access door, which was permanently fastened in place during completion of the manufacturing process. The CWT is sealed from the outside atmosphere except for two vent stringers that connect the CWT to vents in the surge tanks at each of the two wing tips. The WCS dry bay is vented to the atmosphere through two openings in the front spar (see figure 4a). Attached to the bottom of the WCS is the keel beam (see figures 4a and 10), which provides longitudinal strength to the airplane. The keel beam contains two vertical webs (located at left BL [LBL] 9 and right BL [RBL] 9), a heavy chord along its lower edge, a smaller chord along its upper edge, and various stiffeners. The keel beam upper chord is attached to the WCS lower skin panel by a series of aluminum bolts/rivets forward of the mid spar and by titanium bolts aft of the mid spar. Additionally, the keel beam upper chord is attached to each WCS lateral beam (front spar, SWB3, SWB2, mid spar, SWB1, and rear spar) by steel tension bolts. 1.6.1.2 747-100 Air Conditioning Equipment Description The 747-100 air conditioning system comprises three air conditioning packs, manufactured by Hamilton Standard, that reduce the temperature and pressure of hot bleed air from one or more of the airplane’s engines, the APU, or the high-pressure ground power carts during ground operations33 to provide environmental control (pressurization, ventilation, and temperature) to the cockpit and the main cabin. (Figure 6 is a schematic diagram of the 747-100 air conditioning system.) The air conditioning packs are located in an enclosed area (the air conditioning pack bay) under the WCS in the following locations: pack No. 1 is located to the left of the keel beam (beneath the forward left portion of the CWT); pack No. 2 is located immediately aft of pack No. 1; and pack No. 3 31 The compartment between SWB3 and the front spar was originally equipped with a bladder cell for water and plumbing to inject that water into the engines to increase engine thrust on takeoff. When the original engines were replaced with higher thrust engines, water for water injection was not needed, and the compartment between SWB3 and the front spar was converted to a dry bay. The accident airplane’s water system had been deactivated, and the bladder cell and plumbing had been removed. In some later models of the 747 and in the military (E-4B) version, this dry bay has been modified to carry fuel. 32 An electrical conduit is a rigid tube that contains electrical wires. 33 According to postaccident interviews with TWA ground operations personnel, while the accident airplane was on the ground at JFK, two of the three air conditioning packs were operated (powered by the APU) in accordance with TWA procedures.

Factual Information 17 Aircraft Accident Report is located adjacent to pack No. 1 (beneath the forward right portion of the CWT) on the right side of the keel beam (see figures 7 and 8). Each air conditioning pack includes the following major components: • A pack control valve, which controls the volume of air supplied to its respective pack (and bleed trim system).34 • Dual heat exchangers—all air going through the air conditioning pack must pass through both the primary and secondary heat exchangers. Heat exchanger cooling air is provided by ram air in flight and the air cycle machine (ACM) fan on the ground. When minimum cooling is required, ram air passing through the primary and secondary heat exchangers provides sufficient cooling and the ACM is bypassed. • An ACM, which consists of a fan, compressor, expansion turbine, and bypass valve. When partially cooled air from the heat exchangers requires additional cooling, the bypass valve closes and the air is routed through the ACM expansion turbine for maximum cooling. The air conditioning packs remove heat from the engine bleed air through the primary and secondary heat exchangers (with excess heat exhausted into the air conditioning pack bay through a set of louvers that are flush with the lower fairings). After conditioned air leaves each of the air conditioning packs,35 it is routed through ductwork to the aft side of the rear spar, then along the aft side of the rear spar (through the main landing gear wheel well) upward until it reaches the top of the CWT. The conditioned air is then routed forward between the upper skin of the WCS and the main cabin floor into a common plenum located above the CWT.36 The conditioned air then branches off to vertical risers in the airplane’s side walls and ascends to the air distribution/exchange system for the pressurized portion of the fuselage above the main cabin ceiling. (Figure 9 shows the air conditioning ducts around the CWT.) Temperature and pressure sensors located throughout the system relay information to gauges in the cockpit, permitting the flight crew to monitor the performance and operation of the air conditioning packs. 34 Some of the high-temperature engine bleed air from the air conditioning pack inlet is diverted to the air conditioning ducts on top of the WCS upper skin, where it is mixed with the conditioned air on demand to increase the temperature of the air provided to the zone being adjusted. This diverted air is termed “bleed trim” air. 35 According to the Boeing 747 Operations and Maintenance Manuals, the air conditioning pack outlet temperatures typically range from between 35° to 160° Fahrenheit (F). 36 The 747-100 cockpit/cabin has four air conditioning zones for which the flight and cabin crewmembers can select independent temperatures. The three air conditioning packs then deliver air to the plenum that has been cooled to the temperature required by the zone with the greatest cooling demand; temperatures within the other zones can be adjusted independently by adding engine bleed trim air.

Factual Information 18 Aircraft Accident Report Figure 6. A schematic diagram of the 747-100’s air conditioning system. PACK2

Factual Information 19 Aircraft Accident Report Figure 7. Top and side views of the 747-100’s wing center section and air conditioning system.

Factual Information 20 Aircraft Accident Report Figure 8. Underside view of the 747-100’s wing center section and air conditioning system. Keel Beam Ducts from Packs to Plenum Pack 1 Pack 3 Bleed Air From Right Wing Engines Pack 2 Forward Spar Spanwise Beam 3 Spanwise Beam 2 Mid Spar Spanwise Beam 1 Rear Spar Forward Left Side of CWT & Dry Bay Port for Ground Air Source Bleed Air From Left Wing Engines Louvers

Factual Information 21 Aircraft Accident Report Figure 9. The air conditioning ducts around the 747-100’s center wing fuel tank. 1.6.1.3 747-100 Electrical and Wiring Information 1.6.1.3.1 747-100 Electrical Information The accident airplane’s electrical system consists of four engine-driven generators (one per engine) and one APU-driven generator,37 all of which are capable of providing 115/200-volt,38 three-phase, 400-Hz alternating current (a.c.). These generators are driven by a constant-speed drive located on the engine/APU gearbox, as applicable. Two 36-ampere (amp)39-hour nickel cadmium batteries provide 24-volt backup direct current (d.c.) power and APU start power and electrical bus40 and switching logic for power 37 A second APU-driven generator is optional and is installed in some 747-100 airplanes. 38 A volt is the basic unit of measurement of electromagnetic force (the force that causes electrons to flow through a conductor of specified resistance). 39 An amp is the basic unit of measurement of electric current flow. 40 An electrical bus is a power distribution point to which a number of circuits may be connected. It often consists of a solid metal strip in which a number of terminals are installed; however, it can also consist of a section of wire from which power is distributed to other wires/circuits.

Factual Information 22 Aircraft Accident Report distribution. An inverter41 provides power from the batteries to flight critical equipment when primary a.c. power is not available. The airplane also has receptacles for external a.c. power. The APU generator control unit functions as an a.c. external power monitor and prevents abnormal power from an external source from entering the airplane. During normal operation, the four engine-driven generators supply power to four main a.c. buses. The generators are synchronized and connected together by the closing bus tie42 and split bus breakers.43 The galley power distribution system obtains primary 115/200-volt a.c. power from the four engine-driven generators. Step-down transformers44 are used to convert some of the primary 115/200-volt a.c. power to 28-volt a.c. power, which is then distributed to various instruments and most nongalley airplane lighting systems by four main a.c. load buses. Five separate 75-amp transformer-rectifier units (TRU), which are connected to each other through isolation relays, convert the a.c. power to 28-volt d.c. power, which is used for control circuits and various d.c. components throughout the airplane. 1.6.1.3.2 747 Wiring Information—General and Specific to Accident Airplane Boeing’s general design and performance requirements for wires installed in the 747 (as outlined in its Drawing 60B40037) states the following: all parts specified in this drawing shall provide 30,000 hours of continuous trouble-free operation when exposed to...ambient temperature extremes ranging from a low of -65° to 250° F and combined with: 1) altitudes ranging from 1,000 feet below sea level to 50,000 feet above sea level, 2) vibration as defined in D6-13014 ‘Model 747 Equipment Vibration Test Requirements; Area 7, Category A,’ 3) relative humidity varying from 0 to 100 percent, and 4) exterior contamination in the form of moisture, dust, sand, and metallic particles. Boeing’s definition of moisture includes salt water; Skydrol 500 A hydraulic fluid, as described in Boeing Document D6-1100; hydraulic fluid conforming to MIL-H-5606;45 aviation lubricating oil conforming to MIL-L-7808; and jet fuels conforming to MIL-J-5624, D1655-59, P&WA 522, or caustic cleaning fluid. Early production 747s were manufactured using Boeing Material Specifications (BMS)13-38 or BMS13-39 wiring for all nonfuel tank applications; however, Boeing 41 According to the FAA Airframe & Powerplant Mechanics General Handbook, Advisory Circular (AC) 65-9, an inverter is a mechanical or electronic device used to convert d.c. power to a.c. power, which is then used “mainly for instruments, radio, radar, lighting, and other accessories.” 42 A closing bus tie is used to electrically connect two or more electrical buses. 43 The split bus breaker is a manually operated circuit breaker used to separate the a.c. power distribution system (which normally operates with the four a.c. buses joined together as one electrical power bus) into two separate a.c. buses. 44 A step-down transformer is used to reduce higher-voltage a.c. power for use in airplane systems that require lower voltages. 45 The designation “MIL” is used to identify components and parts manufactured to the standards described in Department of Defense (DoD) documents known as Military Standards. MIL parts are commonly used in civilian transport airplanes.

Factual Information 23 Aircraft Accident Report adopted the use of BMS13-42 wiring on July 30, 1969. BMS13-42 wiring is an aliphatic polyimide (also termed “alkane-imide”) insulated wire, also known by the trade name Poly-X,46 and was manufactured by Raychem.47 Boeing’s Manufacturing Development Report 6-27037, dated April 5, 1970, stated, “Employment of the new wire was designated…because its thinner insulation provided a potential weight saving of approximately 400 to 600 pounds per airplane over that achieved with the existing BMS13-38 and BMS13-39 wire.” On April 13, 1970, Boeing’s 747 material specification for Poly-X wire of the BMS13-42/8 type used in nonfuel quantity indication system wire bundles was revised slightly to specify the use of BMS13-42A.48 BMS13-42A Poly-X wire consists of three layers of modified alkane-imide polymer coating (0.015 inch minimum thickness) over a tin-coated copper core conductor and inner and outer layers of primary insulation (0.009 inch minimum thickness). Boeing’s material specification for this type of wire states that “a coating of modified imide polymer shall be applied over the insulation. This coating shall be continuous and free from cracks, splits, blisters, and other defects when examined without the aid of magnification.”49 Figure 10 shows a BMS13-42A Poly-X wire, with typical markings specified by Boeing. A wire type table contained in the FAA’s Aging Non-Structural Systems Program documentation indicated that the use of Poly-X wire was discontinued in 747 production in 1975.50 According to FAA records, Boeing used MIL-W-81044/20 (also identified by Boeing as BMS13-42C and -42D and known by the trade name Stilan) in 747 production between 1975 and 1979. The records indicate that Boeing has used cross-linked ethylenetetrafluoroethylene (XL-ETFE, per MIL-W-22759; also identified by Boeing as BMS13-48 and known by the trade name Tefzel)51 in 747 production in various applications since 1979. However, the records also show that Boeing used MIL-W-81381 (also identified by Boeing as BMS13-51 and known by the trade name Kapton)52 in 747 production between 1985 and 1993. Most of the wiring in the accident airplane was BMS13-42A Poly-X wiring and was stamped with a green “42A,” although other types of 46 The term “Poly-X” also applies to BMS13-42A, an aliphatic polyimide insulated wire with a thicker external coating (on some larger diameter wires) than BMS13-42. For simplicity, in this report, the term “Poly-X” will be used to indicate BMS13-42/42A wiring in general. Where it is appropriate, the report will refer specifically to either BMS13-42 or BMS13-42A Poly-X. 47 Although Raychem stopped manufacturing Poly-X wire in 1975, the current Boeing Standard Wiring Practices Manual (SWPM), 20-00-13, table III, page 96, continues to specify Poly-X as an approved alternative material for use. 48 BMS13-42 was still used in woven sleeves and other protected applications. 49 Boeing required specialized tools for use with Poly-X wiring and warned that use of other tools “will result in…damage to conductor or insulation.” For additional information regarding the condition of the wiring recovered from the accident airplane and wiring in other inspected airplanes, see section 1.18.2. 50 According to the FAA’s Aging Non-Structural Systems Program documentation, “airplane manufacturers typically continue to use existing stock until it is exhausted, [and as a result, some material] changeovers may have taken considerable time. Thus, trying to determine the wire type installed based on the date of manufacture of an airplane is not necessarily accurate.” 51 For simplicity, in this report, XL-ETFE will be used to indicate cross-linked ETFE, per MIL-W-22759.

Factual Information 24 Aircraft Accident Report wire were specified and recovered. For example, the fuel quantity indication system (FQIS) wiring used in the fuel tanks was polytetrafluoroethylene (PTFE), per MIL-W-16878, which is also known by the trade name Teflon.53 52 For simplicity, in this report, the trade name Kapton (a du Pont trade name for a material that has multiple applications) will be used to indicate MIL-W-81381 wire. During an April 1999 presentation, du Pont showed that this type of wire had good abrasion/cut-through (resistance), low-smoke/nonflame, and weight and space characteristics. Du Pont indicated that its limitations were arc-track resistance and flexibility. 53 According to Boeing’s 747 specifications, PTFE (or Teflon) has been used for FQIS wiring in fuel tanks and between the CWT and gauges at the flight engineer station in the cockpit. For simplicity, in this report, the trade name Teflon will be used to indicate PTFE wiring, per MIL-W-16878. W103 -RN -1234 20 denotes Wire Bundle Number denotes System Function Number denotes Wire Serial Number denotes Gauge BMS13-42A-type Wire with Double Insulation Layer and Topcoat Figure 10. Diagram of a BMS13-42A Poly-X wire.

Factual Information 25 Aircraft Accident Report 1.6.1.3.3 Separation of 747 Wire Circuits The Safety Board’s review of FAA regulations revealed that the FARs do not contain specific guidance regarding separation of electrical circuits/wiring. However, 14 CFR Section 25.1309 states that “[t]he airplane systems and associated components, considered separately and in relation to other systems, must be designed so that…the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable.”54 Boeing Document D6-24391, “Criteria for Separation of Critical Electric Circuits,” dated March 17, 1970, provided guidelines for separation that Boeing deemed necessary for isolation of critical systems. These guidelines were applicable to “any electrical equipment or system for which the proper functioning is considered essential to safe operation” in all Boeing commercial airplanes at that time, including the 747-100 airplane. The document stated that the “object of the circuit separation is to prevent hazardous malfunctions or simultaneous loss of redundant power supplies or redundant equipment functions due to failures such as: 1) fire or damage to any wire bundle, 2) loss of any single connector, 3) fire in a junction box, or 4) engine turbine burst.” D6-24391 listed the circuits to separate in each major airplane system, the reasons for the separation, and the methods to be used for the separation. For those systems designated as protected (such as fire warning and protection system wiring, wiring to individual fuel pumps, and individual engine installation circuits), Boeing specified separation distances of at least 1/4 inch in pressurized areas and at least 1/2 inch in unpressurized areas.55 According to Boeing’s SWPM, where such separation is not possible because of space or other constraints, separation by an insulation material (as described in the SWPM) or by a fusible link circuit breaker is required. Although D6-24391 and Boeing’s SWPM indicated that wiring to individual fuel pumps needed to be protected by separation, no special separation was required for other FQIS and fuel system wiring, including the fuel quantity probes and interconnecting wiring and the fuel quantity gauges. However, Boeing incorporated an electromagnetic interference (EMI) shield on the FQIS wire bundle between the flight engineer’s panel and the CWT on 747s produced after line number 243 (the accident airplane was line number 164).56 54 For more information about 14 CFR Section 25.1309, see section 1.16.6.5. 55 In a May 25, 1999, letter to the Safety Board, Boeing indicated that it had conducted a series of tests during the design and certification of the 747 in 1969 and 1970, and again in 1980, that indicated that wire bundles separated by a minimum 1/4-inch air gap from a failed bundle will not sustain damage that compromises the electrical integrity of the wire bundle. 56 According to a May 26, 1998, letter to the FAA, Boeing stated that the shielding was added “due to fluctuating indication caused by EMI.” EMI is further discussed in section 1.16.6.4 of this report.

Factual Information 26 Aircraft Accident Report The Safety Board’s review of other manufacturers’ separation standards revealed the following: • In Douglas Aircraft Company57 specification WZZ-7002, Douglas specified that wiring for protected systems (including FQIS and other fuel system wiring, fire warning system wiring, primary generator feeder cables, and electro-explosive devices) must be isolated by at least 3 inches from other electrical wiring. Further, Douglas specified that the routing of such wires must be continuous from the tank to the cockpit gauge, with no connectors58 shared with other systems. • In a November 2, 1998, letter to the Safety Board, Airbus stated that “the design aim for AIRBUS aircraft has been for all in-tank wiring to be segregated from power sources. As such, electrical segregation exists on all aircraft together with physical segregation from 115-volt power wiring. We have found an exception with some fuel [quantity] sense wiring in A300 and A310 [airplanes] where wiring runs locally in the same routes as 115-volt wiring. This point is under review…” 1.6.2 747-100 Fuel System Description The 747-100’s fuel system consists of seven fuel tanks (three in each wing and one in the CWT), an engine crossfeed system (manifold and valves),59 a fueling station on the left wing, a fuel jettison system, and a surge tank in each wing tip. The fuel tanks include the inboard and outboard main tanks and a reserve tank in each wing and the CWT (which occupies most of the WCS in the fuselage). According to Boeing, the wing fuel tank capacities for the 747-100 are as follows: reserve tanks—3,350 pounds (500 gallons) each; outboard main tanks—29,614 pounds (4,420 gallons) each; inboard main tanks— 82,008 pounds (12,240 gallons) each; and the CWT—86,363 pounds (12,890 gallons). Figure 11 is a schematic diagram of the 747-100 fuel tank arrangement. The left and right wing fuel tanks are formed by sealing the internal wing structure so that the front and rear spars define the forward and aft limits of the tanks, respectively. The left and right wings also contain dry bays, which are located outboard of the reserve wing tanks. As previously discussed, the forward and aft limits of the CWT are defined by SWB3 and the rear spar, respectively; the space between SWB3 and the front spar in the WCS is a dry bay. A sump drain is located near the lowest point of each of the seven fuel tanks. 57 Douglas Aircraft Company merged with Boeing and is now the Douglas Products Division of the Boeing Commercial Airplane Group. 58 A connector is a device that permits in-line connection(s) between one or more wires for a continuous electrical path(s) at a location where the wires may be disconnected and reconnected without mismatching circuits. Typical multicontact electrical connectors are assembled from two subassemblies, the plug and the receptacle, which mate to connect wires with pin and socket contacts. 59 The fuel crossfeed system permits the transfer of fuel from any fuel tank to any engine; however, it does not permit the transfer of fuel from one fuel tank to another fuel tank.

Factual Information 27 Aircraft Accident Report Figure 11. A schematic diagram of the 747-100 fuel tank arrangement.

Factual Information 28 Aircraft Accident Report Each wing also contains a surge tank, located outboard of the dry bays. The surge tanks in the wing tips act as reservoirs (vent collector tanks) if the other fuel tanks are overfilled. The top of each fuel tank is vented to outside atmosphere. The vent system consists of continuous hollow spaces inside box-shaped stringers attached to the interior side of the upper skins of the wing and CWT. These vent stringers are routed outboard from the top of each fuel tank in the wings to the surge tank tip of that wing. The CWT is vented directly to the surge tanks in both wings. To complete the venting system path to outside atmosphere, a single tube connects the outboard side of each surge tank with the outside atmosphere at the lower wing tip surface.60 Figure 12 shows a typical 747-100 CWT and left wing fuel tank vent system layout. The right wing fuel tank vent system layout is similar. To protect against the propagation of a flame from the surge tank to any of the other fuel tanks through the vent system,61 the 747-100 surge tank overboard vents are equipped with a surge tank protection (STP) system. The STP system consists of an optical photocell located in each overboard vent designed to trigger the discharge of Halon (a fire extinguishing agent) into the surge tank when a flame or bright light source62 is sensed in that overboard vent. Discharge of the extinguishing agent is designed to occur about 1 millisecond after the photocell senses a flame. The 747-100 uses a pressure fueling system to distribute fuel under pressure from a fueling station in the left wing63 to all of the fuel tanks through a crossover manifold, the main distribution manifold,64 and refuel valves (one each at the reserve and outboard fuel tanks and two each at the inboard fuel tanks and the CWT). The fueling station is equipped with two fueling receptacles coupled together and connected to the crossover manifold, which extends through the outboard fuel tank to the main distribution manifold. In addition, a fueling control panel is located in the lower leading edge of the left wing, near the fueling station where ground service hoses connect to the refueling ports. Figure 13 shows the 747 pressure fueling flow diagram, excerpted from Boeing’s 747 Maintenance Manual. 60 According to Boeing, the vents are sized to permit passage of fuel if an overfill situation occurs during ground refueling. This design criterion requires a larger vent cross-section area than would be required to provide air pressure equalization alone. 61 Flames entering fuel tanks through the vent system was a factor in the December 8, 1963, accident following a lightning strike on a Pan Am Boeing 707 in Elkton, Maryland, and in the November 23, 1964, accident involving a TWA 707 in Rome, Italy. 62 According to a representative from Fenwal Safety Systems (the manufacturer of the STP system), the system has been triggered by lightning, flamefronts, and even bright flashlights (used by mechanics during maintenance or by pilots during preflight inspections). 63 Although the accident airplane only had a fueling station on the left wing, at the time of its manufacture, an optional right wing fueling station was available and installed on some 747s. 64 The main distribution manifold, which extends through the length of the wing, terminating at a fixed jettison nozzle on the wing trailing edge near each wing tip, is also used as the fuel jettison manifold. Fuel can only be jettisoned from the inboard main tanks and the CWT.

Factual Information 29 Aircraft Accident Report Figure 12. A layout of a typical 747-100 center wing fuel tank and left wing fuel tank vent system.

Factual Information 30 Aircraft Accident Report CENTER WING TANK DRY BAY M M M M P R R R 2 1 R R R R OVERRIDE/JETTISON PUMP PRIMING LINE REFUEL VALVE REFUEL VALVE JETTISON NOZZLE VALVE (REF) SURGE TANK RESERVE TANK NO. 1 MAIN TANK NO. 1 MANIFOLD DRAIN VALVES (2 PLACES) PLUGS (2 PLACES) REFUEL VALVE REFUEL VALVE REFUEL VALVE CROSSOVER MANIFOLD MAIN DISTRIBUTION MANIFOLD MANIFOLD DRAIN VALVE MANUAL SHUTOFF VALVE FUELING RECEPTACLES MANUAL DEFUELING VALVE MAIN TANK NO.2 CROSSFEED MANIFOLD CHECK VALVE REFUEL VALVE PRESSURE FUELING ALTERNATIVE INSTALLATION PREFERRED INSTALLATION REFUEL VALVE OVERRIDE/JETTISON PUMP (REF) JETTISON VALVE (REF) M P Figure 13. A 747 pressure fueling flow diagram.

Factual Information 31 Aircraft Accident Report The wing refueling control panel contains fuel quantity indicators,65 refuel valve control switches, valve position indicator lights, a refuel power switch, and a test switch and indicators for the volumetric shutoff (VSO) control. (Figure 14 shows the pressure fueling system components.) The VSO control unit can be set to automatically close the refuel valves when a preselected amount of fuel is loaded. The preselected amount of fuel can range in the tanks from any partial quantity to full fuel tanks.66 Refueling can also be controlled by ground personnel, who can close the refueling valve manually when the fuel quantity indicator shows that the desired quantity of fuel is on board the airplane. The VSO will also shut the valves when fuel enters the surge tanks if a fuel tank is overfilled. 1.6.2.1 Fuel Quantity Indication System Components and Wiring Information The amount of fuel in each of the 747-100’s seven fuel tanks is measured by a set of FQIS probes and compensators,67 with the number of fuel quantity probes and compensators differing for each tank. The 747-100 has 65 fuel quantity probes and 13 fuel quantity compensators. The fuel quantity probes are positioned as follows: 4 each in the Nos. 1 and 4 reserve fuel tanks; 13 each in the Nos. 1 and 4 main fuel tanks; 12 each in the Nos. 2 and 3 main fuel tanks; and 7 in the CWT. The fuel quantity compensators, located near the low point of each fuel tank, are positioned as follows: two in the No. 1 reserve tank; one in the No. 4 reserve tank; one in each surge tank; two each in the Nos. 1 and 4 main fuel tanks; two in the No. 2 main fuel tank; one in the No. 3 main fuel tank; and 65 The fuel quantity indicators at the wing refueling control panel are repeater type indicators; they share information with corresponding primary indicators on the flight engineer’s lower instrument panel for display in the cockpit. For additional information regarding FQIS components/indicators, see section 1.6.2.1. 66 While the accident airplane was being fueled at JFK, the fuel system’s automatic VSO activated before the fuel tanks were full. According to postaccident interviews, a TWA mechanic examined the fuel system and “[overrode] the system, pull[ed the] volumetric [shutoff valve or VSO] fuse and an overflow circuit breaker.” After the fueler finished fueling the airplane manually, the TWA mechanic reset the fuse and circuit breaker. According to the fueler and TWA maintenance personnel, activation of the VSO is a common occurrence. According to maintenance records, the accident airplane had numerous VSO-related maintenance writeups during the weeks before the accident. For additional information about the accident airplane’s previous refueling difficulties, see section 1.6.3. 67 The 747-100 FQIS measures changes in the capacitance of tubular fuel quantity probes located in each fuel tank for the display of fuel quantity on cockpit indicators and on repeater indicators located at the refueling station in the left wing. The system is also connected to systems that require fuel quantity information, including the gross weight/total fuel weight indicator, airborne integrated data system (AIDS), and VSO (ground refueling) systems. Fuel quantity probes are components of the FQIS, a set of which is positioned in each of an airplane’s fuel tanks to measure the quantity of fuel in each tank through a range of levels within the tank. Fuel quantity compensators are used in the FQIS and VSO systems. For FQIS applications, compensators are used to compensate for variations in the electrical properties (the dielectric constant) of fuel, which vary from one type of fuel to another (and even within the same type of fuel, depending on the “batch” and the age of the fuel) to ensure consistent fuel quantity indications. About 90 percent of the 747-100, -200, and -300 series airplanes are equipped with FQIS components manufactured by Honeywell Corporation; the remaining 10 percent of the 747-100, -200, and -300 series airplanes and all 747-400 airplanes have been retrofitted with FQIS components manufactured by BFGoodrich Aerospace Corporation (formerly Simmonds Precision) or Smiths Industries.

Factual Information 32 Aircraft Accident Report Figure 14. A diagram of the 747 pressure fueling system components.

Factual Information 33 Aircraft Accident Report one in the CWT. Figure 15 shows a fuel quantity probe and a compensator. Figure 16 shows the fuel quantity probe and compensator locations in the CWT. The fuel quantity probes in the 747-100 fuel tank contain two metallic electrodes, which are assembled as inner and outer tubes and are oriented vertically within the probe. A hard plastic terminal block is located near the top of the fuel quantity probe for wiring connections, and two brackets mount the probes vertically in the fuel tank. The diameter of the inner electrode varies, based on the contours of the fuel tank, and the length of each fuel quantity probe is determined by the height of the fuel tank at that location. Because the capacitance68 of air is different than that of fuel, capacitance values for each fuel quantity probe are different when air, instead of fuel, fills the gap between the inner and outer tubes. Thus, the capacitance of the fuel quantity probe varies linearly, depending on the depth of fuel in the tank. The fuel quantity compensators in the 747-100 fuel tank contain three metallic electrodes, an external mounting tube, a hard plastic terminal block near the top of the mounting tube for wiring connections, and two mounting clamps. A fuel’s density (and, therefore, its dielectric constant) changes with temperature and other variables; the compensators provide a “0” reference for the FQIS. Therefore, the fuel quantity compensators are mounted at the lowest point in the fuel tank so that they remain in contact with fuel until the tank is almost empty. The fuel quantity probes and compensators in the 747-100 fuel tanks are connected in series by wires, and the entire set is then connected to a fuel quantity gauge on the flight engineer’s panel in the cockpit. The cockpit fuel quantity gauge generates an electrical voltage, and the resulting electrical capacitance between the probes’ inner and outer tubes is measured. The measurements of fuel in the gaps between the tubes are summed, and the amount is calibrated so that the flight engineer’s fuel quantity gauge indicates the weight of the remaining fuel instead of the capacitance. (Weight is the common measurement for fuel quantity in transport airplanes.) A gauge at the left wing pressure refueling control panel repeats at the cockpit display. Although most of the wiring for the accident airplane was BMS13-42A Poly-X, the wiring used for the 747 FQIS wires in the fuel tanks and from the CWT to a wire splice located behind the flight engineer’s panel was silver-plated copper wiring with Teflon insulation. Specifically, Teflon wires were routed from the fuel quantity probes and compensators in the fuel tanks, through the interior of the fuel tank supported by numerous nylon clips, to the electrical connector located on the aft side of the rear wing spar for the CWT and on the forward side of the forward wing spar for the main fuel tanks. Outside of the fuel tanks, FQIS wires were routed from the connectors on the wing spars to a splice located near each of the fuel quantity indicators (one for each fuel tank) located on the flight engineer’s panel in the cockpit,69 then to the fuel quantity totalizer indicator and the VSO unit.70 Seven fuel quantity repeater gauges are mounted at the left wing refueling panel;71 wires to these gauges are routed through the wing fuel tanks from the 68 Capacitance is the property of conductors separated by a dielectric material (for example air or fuel) that permits the storage of electricity when potential differences exist between conductors.

Factual Information 34 Aircraft Accident Report cockpit gauges. The only electrical wiring/components located inside the 747 CWT (or any 747 fuel tanks) are those associated with the FQIS (including the ground refueling system).72 According to representatives from Honeywell and Boeing, electrical power is supplied to the FQIS components through the cockpit fuel gauges and is intended to be limited to 0.02 millijoule (mJ).73 Wiring diagrams for the 747 indicate that FQIS and fuel flow indication wire bundles74 were routed along common raceways75 from the flight engineer station to the electrical equipment compartment located between the nose landing gear wheel well and the forward cargo compartment. The diagrams also show that the left wing and CWT FQIS wires were routed in a raceway with a wire bundle containing wires leading to the CVR for part of their path through the upper left fuselage and adjacent to a wire bundle containing wires leading to the right main wing fuel tank for part of their path behind the flight engineer station (upper right fuselage). Additionally, the diagrams indicate that, if Boeing’s PI 61B7010376 were followed for the accident airplane,77 the left wing FQIS wires would have been corouted in a raceway with wires from other systems (such as lights) that were bundled with both the CVR and the No. 4 fuel flow indicator wires for a portion of their paths. Further, the wiring diagrams show that the right wing FQIS wires were routed to a connection at the T347 terminal strip in the CWT. Figure 17 is a 69 The primary indicators convert fuel quantity probe and compensator capacitance into dial and counter indications of fuel quantity. Each primary indicator has two variable resistor adjustment shafts for calibrating the indicator so that it displays the proper zero and full indications for empty and full fuel quantity probe values. 70 The fuel quantity totalizer indicator (termed the “gross weight/total fuel weight indicator” in the TWA 747 Operations Manual) is a dual-counter display device located on the flight engineer’s panel. It converts signals from the seven primary fuel quantity indicators into an indication of total fuel weight, which is displayed on the lower of the two counters. The second counter display indicates the airplane’s gross weight. 71 Each repeater indicator converts a signal from the associated primary indicator into a duplicate indication of fuel quantity. The repeater indicators are used for refueling operations and are deenergized whenever the door to the refueling panel is closed. Each repeater indicator has two variable resistor adjustment shafts for calibrating the indicator so that it displays the proper zero and full indications for empty and full fuel quantity probe values. 72 Although the fuel pump motor cavities contain wiring, they are separated from the CWT by flame suppression passages and other parts. 73 A joule (J) is a unit of measurement of electrical work or energy; 1 J is the amount of work done by 1 watt of power in 1 second. The power supplied to the FQIS components through the cockpit fuel gauge (0.02 mJ) is about 10 percent of the minimum ignition energy (MIE) requirement (0.25 mJ) for hydrocarbon fuels, referenced by the American Petroleum Institute Recommended Practice 2003 (API 2003), “Protection Against Ignitions Arising out of Static, Lightning, and Stray Currents,” fifth edition, December 1991. 74 The Boeing SWPM refers to wires that are tied in a group as a “harness”; the TWA Master Wire Bundle Document and Boeing production illustrations (PI) refer to wires that are tied in a group as a “bundle.” In this report, the term “bundle” will be used to refer to wires that are tied in a group, except where a reference source is being quoted. 75 “Raceway” is the term used for areas in the 747 where wire bundles are grouped into a common route. 76 The most recent revision to PI 61B70103 was dated November 10, 1971. 77 According to an October 13, 1999, letter from Boeing, the original wiring installation diagram had been superseded by a more direct wiring path for the No. 4 fuel flow indicator wires when the accident airplane was manufactured. No documentation of this change was provided. The actual wiring route of the No. 4 fuel flow indicator wires in the accident airplane could not be determined.

Factual Information 35 Aircraft Accident Report Figure 15. Diagrams of a fuel quntity probe and a compensator.

Factual Information 36 Aircraft Accident Report FQISWIRING CONNECT OR Figure 16. The fuel quantity probe and compensator locations in the 747’s center wing fuel tank.

Factual Information 37 Aircraft Accident Report schematic diagram of the FQIS wiring, fuel flow wiring, CVR wiring, and other wiring information from the 747-100, and figure 18 shows the locations of the wire raceways in the 747-100. Boeing’s PIs also indicated that the CWT FQIS wires were routed from the front of the airplane to the CWT, VSO, totalizer, and the AIDS in and next to bundles carrying numerous other power and signal wires. Although most airplane systems operated on 115-volt power, the Safety Board’s review of wiring in other airplanes78 indicated that the FQIS and engine fuel flow wire bundles are routed near, and occasionally bundled with, wires that provide 350-volt a.c. power to the cabin fluorescent lights.79 According to TWA, the fuel quantity probes and compensators (and most other electrical and fuel system components, including wiring and connectors) are condition-monitored items, which means that they are removed and replaced only when inoperative. Unless a malfunction of the FQIS requires unscheduled maintenance, the units are inspected only during the scheduled D check.80 According to TWA maintenance records, the fuel quantity probes and compensators installed in the accident airplane’s fuel tanks were the original units installed when the airplane was manufactured in 1971, except for four of the fuel quantity probes in fuel tank No. 1, which records indicate were replaced during a 5B check in September 1987.81 1.6.2.2 747-100 Fuel Pump System Description The 747-100 has 16 fuel pumps, including 4 fuel boost pumps in each wing (2 per engine),82 2 fuel jettison/override pumps in each wing,83 2 fuel jettison/override pumps in 78 For more information about the Safety Board’s review of wiring in other airplanes, see section 1.18.2. 79 Although the Safety Board is not aware of instances in which FQIS wires shared connectors with wires carrying more than 115 volts, Boeing specifications permit FQIS wiring to be mixed in common connectors with airplane system wires carrying up to 350 volts. 80 For additional information regarding the scheduled D check, see section 1.6.3.1. 81 Although there was no maintenance record indicating that any other fuel quantity probes or compensators had been replaced, an April 20, 1993, maintenance record indicated that maintenance was conducted to correct fuel quantity discrepancies in the No. 1 main fuel tank; this maintenance record showed capacitance measurements for each No. 1 main fuel tank probe. There was no record of probe removal with this maintenance action. According to the Maintenance Records Group report, a review of maintenance records from other TWA airplanes indicated that malfunctioning probes were removed and sent to the overhaul shop for cleaning. 82 Fuel boost pumps move fuel from the fuel tanks to the engines or the APU. 83 The jettison/override pumps have two uses in the 747, one of which is to jettison fuel from the airplane when this function is selected at the flight engineer station. The jettison/override pumps also provide fuel to the engine manifolds at a higher pressure than the fuel boost pumps; thus, fuel pressure from the jettison/override pumps in the CWT closes the main fuel tank check valves, ensuring that the fuel from the CWT is consumed before the fuel in the main wing fuel tanks.

Factual Information 38 Aircraft Accident Report Fragments of VSO and FF4 wires (Ref. Sta 360 frame) Main deck floor (Ref. WL200) Flight Engineer Station (Ref.) Volumetric Shutoff Control Unit (VSO) (Ref. E3-1 Rack, Sta. 460) Fuel Flow Computer (FF4) (Ref. E3-1 Rack) Cockpit floor edge (Ref.) Fuel totalizer Fuel quantity gauge Right wing fuel tank wire route (ref.) Wire routes through left wing fuel tanks to refueling panel Tank Unit (probe) Fragments 16 15 13 13 12 12 14 Aircraft integrated data system (AIDS) (Ref. E11 Rack, Sta. 472) Background illustration shows major wire bundle raceways & identification letters. Right wing FQIS & fuel flow #4 wire routes (ref.) CVR wire route (ref.) FF#4 wire route shown on Production Illustration (ref.) Compensator Figure 17. A schematic diagram of the 747-100’s fuel quantity indication system wiring, fuel flow wiring, cockpit voice recorder wiring, and other wiring information.

Factual Information 39 Aircraft Accident Report FLIGHT ENGINEER STATION H IK SHOWN IJ OPPOSITE IM SHOWN IN OPPOSITE CC P G CWT REAR SPAR CONNECTION FOR FQIS Figure 18. Locations of the wire raceways in the 747-100.

Factual Information 40 Aircraft Accident Report the CWT, 1 fuel scavenge pump in the CWT,84 and an APU d.c. fuel pump in the left wing. (Figure 19 is a schematic diagram of the fuel pump locations in the 747.) The fuel scavenge pump, APU fuel pump, and fuel boost pumps are condition-monitored items. According to TWA maintenance records, TWA established a hard-time life limit of 9,000 hours for the fuel jettison/override pumps.85 According to TWA, the company’s maintenance facility in Kansas City, Missouri, conducted all 747 fuel pump overhauls and repairs in accordance with the manufacturer’s overhaul manuals and (as in the case of the jettison/override pump’s 9,000-hour hard-time limit) specifications established by TWA’s engineers and accepted by the FAA. Examination of the maintenance history of the fuel pumps installed in the accident airplane’s CWT at the time of the accident revealed the following: • Fuel scavenge pump, CWT—S/N M285; this pump’s most recent overhaul was signed off on October 18, 1994, and the unit passed a functional test on October 20, 1994. The pump was installed on the accident airplane on April 22, 1996. At the time of the accident, the pump had accumulated 1,040 flight hours since overhaul. • Jettison/override pump, CWT—S/N 690469A; this pump’s most recent overhaul was signed off on March 14, 1996, and the unit passed a functional test on March 18, 1996. The pump was installed on the accident airplane on March 27, 1996. At the time of the accident, the pump had accumulated 1,270 flight hours since overhaul and had an estimated (9,000-hour) removal date of February 10, 1998. • Jettison/override pump, CWT—S/N 690394; this pump’s most recent overhaul was signed off on December 6, 1994, and the unit passed a functional test on December 8, 1994. The pump was installed on the accident airplane on May 15, 1995. At the time of the accident, the pump had accumulated 4,412 flight hours since overhaul and had an estimated (9,000-hour) removal date of June 24, 1997. 84 The scavenge pump is designed to remove the last amounts of usable fuel from the CWT and pump it into the left inboard (No. 2) fuel tank. The intake opening for this pump is located very close to the bottom of the tank between the mid spar and SWB2. Although the scavenge pump removes fuel that is unobtainable by the jettison/override pumps, a small amount of residual fuel will remain in the fuel tank that the scavenge pump is not able to remove (unusable fuel). In the 747 CWT, the jettison/override and scavenge pumps are mounted on the rear spar such that the pump motor is external to the tank but contains fuel-cooled windings. Fuel for cooling is supplied to the windings through a small-diameter tube in series with a check valve, both of which are intended to suppress flames. The pumps also contain a thermal fuse designed to open at less than 400º F. 85 More than 17 years before the accident, TWA established the hard-time limit to reduce the number of unscheduled removals, after the company determined that the mean time between unscheduled removals for the pumps was 11,352 hours. The 9,000-hour scheduled removal occurs at every second C check and at every D check. For more information about C and D checks, see section 1.6.3.1.

Factual Information 41 Aircraft Accident Report Figure 19. A schematic diagram of the fuel pump locations in the 747.

Factual Information 42 Aircraft Accident Report 1.6.2.3 747-100 Fuel Flow Indication Information According to TWA’s Maintenance Manual, the 747-100 has a fuel flow sensor/transmitter mounted on each of the airplane’s four engines. Fuel flowing through each sensor/transmitter turns an impeller; information regarding the rotational speed of the impeller is transmitted and displayed in the cockpit to indicate the fuel flow. Other major components of the indication system are a fuel flow computer located adjacent to the VSO computer in the electrical/electronics (E/E) bay, a fuel flow indicator located near the fuel quantity indicators at the flight engineer station, and a repeater indicator located in the cockpit near the center of the forward instrument panel. The fuel flow components are connected by wires that are routed from the engines to the main fuselage through raceways along the forward wing spars. The wires are then routed forward through the fuselage, in raceways beneath the cabin floor, to the computer in the E/E, then along the fuselage frame at STA 360, and upward to the flight engineer’s station. The wires routed from the fuel flow and VSO computers to the cockpit are tied into larger bundles that include wires from other systems (including cabin lighting wires, which carry voltage as high as 350-volts a.c.).86 Figure 17 shows the routing of fuel flow wires through the 747-100. In a May 2, 2000, letter, Boeing stated that the following are possible causes for an erratic fuel flow indication (as referenced in the CVR—see section 1.1 or appendix B) in a 747-100:

1. The aircraft transmitters had low-speed motors, and the motor drive circuitry in

the signal conditioner was failing;

1. Significant contamination was present in the affected transmitter;
2. There was a fault in the signal circuitry; or
3. There was a fault in the indicator.

Further, with regard to the fuel flow meters in the 747-100, Boeing’s letter stated that “the portion of the mechanism which is in fuel is lubricated by fuel. The motor has sealed bearings, which [are removed and replaced only when inoperative], not on a schedule.” 1.6.2.4 TWA Flight 800 Fueling Information TWA’s fueling records indicated that the accident airplane was refueled at Athens and that its fuel load for the trip to JFK included a full CWT. TWA’s records further indicated that upon arrival at JFK, the accident airplane’s CWT contained about 300 pounds of fuel; when the airplane was refueled at JFK, no additional fuel was added to the CWT.87 According to TWA’s fueling records, the accident airplane was fueled at 86 Three hundred fifty volts is the root mean square voltage (average amplitude) of the 400-Hz electric waves in the cabin lighting circuit’s wires. The peak voltage of a 350-volt a.c. circuit is slightly more than 450 volts.

Factual Information 43 Aircraft Accident Report JFK using the underwing pressure method. Table 2 shows TWA’s fueling records, which indicate TWA flight 800’s fuel loading when it prepared to depart JFK. On the basis of the airplane’s dispatch fuel load information and performance data, the Safety Board calculated that the fuel on board the airplane at takeoff was about 176,600 pounds (consistent with TWA’s dispatch records) and at the time of the accident was about 165,000 pounds. 1.6.3 Maintenance Information 1.6.3.1 TWA’s 747 Maintenance Inspection Program During its investigation of the TWA flight 800 accident, the Safety Board reviewed TWA’s maintenance program and maintenance recordkeeping procedures and conducted a detailed examination of the accident airplane’s maintenance records. The Board’s review of TWA’s FAA-accepted continuous airworthiness maintenance inspection program for its 747 fleet revealed that it included the following inspections and intervals: 87 During postaccident interviews, the flight engineer from the Athens-JFK flight (TWA flight 881) told Safety Board investigators that all of the usable fuel in the CWT was used during the flight to JFK and that the fuel pumps appeared to work normally. He stated that he did not observe any change in the CWT fuel quantity indication after the usable fuel was consumed. (According to Boeing, the CWT capacity includes 50 gallons [300 pounds] of unusable fuel.) Table 2. TWA’s fueling records, indicating TWA flight 800’s fuel loading when it prepared to depart JFK. Fuel Tank Indicated Fuel Load Before Fueling (pounds) Indicated Fuel Load After Fueling (pounds) No. 1 Reserve 0 3,400 No. 1 Main 5,400 24,600 No. 2 Main 5,300 62,900 CWT 300 300a a. The cockpit indicator has an analog scale and a digital (rotating drum) scale. When the digital display indicates 300 pounds, the analog needle would indicate near “0.” No. 3 Main 6,900 62,700 No. 4 Main 6,300 24,600 No. 4 Reserve 0 3,300 Total 24,200 181,800

Factual Information 44 Aircraft Accident Report • Periodic service (PS) inspection—includes the cockpit and cabin, airplane exterior, and a final check. Accomplished at scheduled layovers of 6 hours or more at stations staffed by TWA mechanics, or every other operating day maximum, unless a higher maintenance level is accomplished. The accident airplane’s most recent PS was accomplished on July 17, 1996, at JFK before the departure of TWA flight 800. • Aircraft service (AS) inspection—includes all PS items, plus routine AS inspection items (including checks for cockpit and cabin; exterior fuselage, wings, gear, and empennage; engines and struts; oil, hydraulic fluid, and water servicing; and fuel tank sumping), which are identified as AS-1 through AS-6. AS-1 through AS-6 are accomplished in sequence at intervals not to exceed 100 hours of airplane time in service, until a time control service (TCS) inspection is accomplished. The accident airplane’s most recent AS inspection (an AS-1 inspection) was accomplished on July 13, 1996, at JFK, at an airplane total flight time of 93,253 hours. • TCS inspection—includes, to a greater degree and depth than the AS inspection, the following: the cockpit and cabin; exterior fuselage, wings, gear, and empennage; engines and struts; oil, hydraulic fluid, and water servicing; and fuel tank sumping. TCS inspections are accomplished at intervals not to exceed 1,200 hours of airplane time in service. The accident airplane’s most recent TCS was accomplished on April 15, 1996, at JFK, at an airplane total flight time of 92,231 hours. • Station service (SS) inspection—interim cabin refurbishment program with limited external airplane inspection. SS inspections are accomplished at intervals not to exceed 800 hours of airplane time in service. The accident airplane’s most recent SS inspection was accomplished on May 11, 1996, at JFK, at an airplane total flight time of 92,466 hours.88 • C inspection—includes checks of the integrity and airworthiness of the airframe, fluid quantities, security of components, operational checks, overhaul of specified components, the accomplishment of principal structure elements per the structural inspection program, and the Corrosion Prevention and Control Program. The C check consists of three blocks designated as 1E, 2E, and 3E, accomplished in sequence at intervals not to exceed 13 months. The accident airplane’s most recent C inspection (3E) was accomplished on November 6, 1995, at an airplane total flight time of 91,084 hours. 88 Although the SS inspection was to be accomplished at intervals not to exceed 800 hours of airplane time in service, on July 12, 1996, the FAA had granted TWA a one-time 100-hour extension to this interval for the accident airplane. Thus, the accident airplane’s next SS was due within 900 hours of the previous SS inspection.

Factual Information 45 Aircraft Accident Report • D inspection—a more in-depth inspection of the structure and systems than the C inspection to ensure the integrity and airworthiness of the airframe, fluid quantities, security of components, operational checks, and overhaul of specified components. D inspections are accomplished at intervals not to exceed 4 years. The accident airplane’s most recent D inspection was accomplished on December 14, 1992, at an airplane total flight time of 80,267 hours. The routine work is accomplished as defined in TWA’s Operations Specifications Manual, TWA’s approved engineering reports, structural inspection programs and documents approved for control of repair, overhaul, parts replacement, periodic inspections, and routine checks. 1.6.3.1.1 TWA’s General Inspection Policies According to the TWA General Policies and Procedures Manual, dated May 15, 1994, TWA had the following three levels of airplane and powerplant inspection: A. Visual Inspection: Visual airframe and power plant inspection constitutes a check of visible or exposed areas, usually external, as specified on the appropriate inspection forms. A visual inspection may include those items which are partially hidden, plus those that might be readily accessible through quick access panels. B. Detailed Inspection: A detailed inspection is covered by two complementary inspection concepts—the area concept and the specific item concept. Area Concept—The area inspection concept constitutes a very detailed inspection of the designated area, including, but not limited to structures, tubing, cables, wiring and any units exposed or visible through routine open up. Normal assistance to visual inspection will be used as required and may consist of mirrors, magnifying glasses, dye penetrant checks or specialized non-destructive test equipment where applicable. Specific Item Concept—The specific item concept is a very detailed inspection of a specific item as detailed on the work forms or by inspection supervision. It is limited to the defined item(s) and does not cover the associated area. C. Final Inspection: Upon completion of all maintenance and service work at [C inspection] and higher maintenance as outlined on the appropriate maintenance work forms, the airframe and powerplant shall be given a final check by an inspector. The airframe final inspection is intended as a visual safety check to ensure that all access covers, inspection doors, and panels are installed; that tools, rags, loose hardware, etc., have been removed from the cabin, cockpit, cargo compartments, wheel wells, and engine inlets; and that all loose equipment and furnishings have been properly stowed. The Safety Board’s review of TWA maintenance documents indicated that inspection of the 747 CWT was to be accomplished by an area concept-type of detailed inspection. The manual did not specifically define the area to be inspected, nor did it provide specific inspection instructions for the various compartments of the CWT or the various components within the CWT, such as FQIS wiring, connectors, and probes.

Factual Information 46 Aircraft Accident Report 1.6.3.1.2 TWA and Boeing Wiring Inspection Guidance The Safety Board’s Maintenance Records Group asked TWA and Boeing personnel to describe any procedures and guidance that they provided to maintenance personnel regarding the protection of wire bundles in 747s while maintenance was being accomplished near them. Boeing had published general inspection guidelines, which advised operators to assess the existing condition of wires and use good judgment and common sense during maintenance to prevent injury and damage. Boeing’s guidance indicated that wire bundles and equipment should be moved to avoid unnecessary damage when any type of repair is being accomplished in the area. According to Boeing Service Letter (SL) 747-SL-20-048, dated January 25, 1995, “As a general rule, wiring that is left undisturbed will have less degradation than wiring that is reworked. As wiring and components become more brittle with age this effect becomes more pronounced.” Boeing had also issued Service Bulletin (SB) 747-53-2272, “Fuselage—Nose Section 41 Body Frame Structural Replacement and Reinforcement,” which advised operators to “[f]abricate a suitable work platform as required to protect wire bundles.” According to Boeing engineers,89 most operators cover nearby wire bundles with bubble wrap or tape a clean cloth over the bundle while making repairs in the area. At the Safety Board’s request, TWA provided the Maintenance Records Group with a copy of its Boeing Commercial Jet Standard Overhaul Practices Manual (most recently revised in September 1997), which TWA indicated it had developed based on Boeing documents. Chapter 20 of this manual included guidance regarding the following: repair and replacement procedures for metal and electrical work, inspection procedures, cleaning procedures, finishing procedures, installation procedures, specifications, and materials. According to TWA, these subjects were also addressed in its maintenance classroom training sessions, and maintenance/fleet service personnel were expected to use general housekeeping procedures in performing their duties. TWA personnel indicated that the company did not have a written policy concerning the use of protective covers over or around wire bundles when performing metal work near the wire bundles; instead, maintenance personnel were expected to determine (on a case-by-case basis) whether a protective covering was necessary and whether the wire bundle needed to be moved to accomplish a maintenance task. 1.6.3.2 Accident Airplane’s Maintenance Information Investigators reviewed the following records for the accident airplane: aircraft maintenance logs for the accident airplane from December 1992 to the accident date; C inspection routine and nonroutine work cards from June 3, 1986, to November 6, 1995 (the most recent C inspection); D inspection routine and nonroutine work cards from February 8, 1986, to December 11, 1992 (the most recent D inspection);90 engineering maintenance liaison records; and all records regarding airworthiness directives (AD), SBs, and modification orders (MO)91 for the accident airplane. TWA maintenance records indicated that the company had complied with all applicable FAA ADs,92 accomplished all 89 Similar information was also obtained in writing from TWA personnel.

Factual Information 47 Aircraft Accident Report scheduled maintenance items, and maintained its continuous airworthiness maintenance program on the accident airplane. The Safety Board’s examination of the accident airplane’s maintenance records revealed that the airplane had experienced several intermittent problems during fueling operations in the 2 years before the accident, including one that occurred before the accident airplane departed JFK. After the accident, a TWA mechanic advised the Board that while the accident airplane was being fueled at JFK for TWA flight 800, the fuel system shut down. The mechanic reported that the VSO fuse and an overflow circuit breaker93 were pulled and the pressure fueling process was continued. After the airplane was fueled, the mechanic reset the fuse and circuit breaker.94 In addition to the refueling difficulties noted, the Safety Board’s review of the accident airplane’s maintenance records revealed three logbook entries regarding fuel leaks during the preceding 2 years. The Board also noted 25 maintenance logbook entries regarding fuel flow; fuel gauge indications, inaccuracies, and fluctuations; and inoperable fuel system equipment. Appendix E contains descriptions of the fueling discrepancies observed and the resultant maintenance actions. 1.6.3.2.1 Airworthiness Directives and Service Bulletins Applicable to 747 Fuel Pumps and Related Wiring FAA AD 79-06-02, effective April 19, 1979, required compliance with Boeing Alert Service Bulletin (ASB) 747-28-A2092, dated February 12, 1979, which recommended a one-time main fuel tank pump wiring inspection, repair, and modification to preclude electrical arcing95 into the Nos. 2 and 3 main fuel tanks.96 The AD described a 90 According to TWA personnel, in accordance with the company’s FAA-accepted maintenance recordkeeping program, TWA retains its aircraft maintenance logs for 30 months, its C inspection routine and nonroutine work cards for 10 years, and its D inspection routine and nonroutine work cards for 25 years. (The FAA requires operators to retain inspection records until the next similar inspection or higher-level inspection occurs.) 91 MOs authorize the expenditure of funds and accomplishment of physical changes to an airplane or components, one-time inspections and their resulting rework, and special scheduled work beyond normal overhaul or maintenance. They also authorize funds for associated tooling, outside services, and initial spares. MOs may be used to authorize service evaluations for the improvements in performance of TWA airplanes, installation of new equipment, and extension of service life of airplanes and engine accessories and components. 92 See section 1.6.3.2.1 for information regarding ADs and SBs for the 747 fuel pumps and FQIS wiring and section 1.6.3.2.2 for information regarding ADs and SBs for 747 structural inspections. 93 A circuit breaker is a mechanical device designed to open a circuit (stop the current flow) when the current flow within that circuit exceeds a set limit for a length of time. 94 The TWA 747 Maintenance Manual states that if dispatch timing precludes repair of a malfunctioning VSO control unit, “the shutoff system can be disabled by removing the fuse in the VSO control unit in the right main equipment center on shelf E3. This permits operation of the refuel valves and fuel quantity indicators, but disables the automatic VSO control unit. The fuel level shutoff must be controlled by the individual refuel valve switches for all tanks.” 95 Arcing is defined by Underwriters Laboratories, Inc. (UL), as “a luminous discharge of electricity across an insulating medium.” The electrical discharge of an arc can involve temperatures of several thousand degrees Celsius. For additional information regarding arcing, see section 1.16.6.1.

Factual Information 48 Aircraft Accident Report method of alleviating wire chafing that involved installing a double layer of Teflon sleeves97 over the wiring where it was routed within the fuel tanks. TWA maintenance records indicated that the AD was accomplished on the accident airplane on June 6, 1979.98 On August 3, 1995, Boeing issued ASB 747-28-A2194, “Fuel-Distribution-Fuel Boost and Override/Jettison Pumps-Inspection.” The ASB stated that operators had removed eight fuel pumps from service that had fuel leaks at the pump/wire bundle interface and recommended that all operators test the resistance on each 747 boost and jettison/override pump “at the next opportunity,” replacing those that did not pass the insulation check. The SB stated the following: after a long time, water can get inside the potting of the wire terminal assembly and cause corrosion. The corrosion in the wire terminal assembly can cause arcing between the power pins and the pump case. The arcing causes thermal expansion of the materials inside the cap. This expansion causes failure of the cap attachment flange or the attaching screws and a subsequent fuel leak. According to TWA maintenance personnel, at the time of the accident, ASB 747-28-A2194 had not been accomplished on the accident airplane because the FAA had subsequently issued Notice of Proposed Rulemaking (NPRM) 96-NM-57-AD, which proposed an AD that would “require repetitive visual inspections to detect discrepancies of the wire terminal assembly, electrical connector, and wire insulation on the fuel pump; and replacement of the fuel pump with a new fuel pump, if necessary” and “repetitive insulation resistance test of the fuel pump wiring.” The resultant AD (AD 97-03-17) became effective on March 14, 1997, and TWA’s corresponding MO (72F57) was finalized on April 1, 1997. 1.6.3.2.2 Airworthiness Directives and Service Bulletins Applicable to 747 Structural Inspections Nose Section (Section 41)—Internal Inspections On January 31, 1986, the FAA issued AD 86-03-51, which required structural inspection of the nose section (section 41) on certain 747 airplanes, including the accident airplane, “to prevent sudden decompression of the fuselage.” On February 14, 1986, Boeing issued SB 747-53A2265, “Fuselage-Nose Section 41-Body Frame Structure Inspections and Crack Repairs,” which provided additional information regarding inspection and repair of this area.99 According to the SB, “numerous body frame and other internal structure cracks in the upper deck, main deck and lower lobe of the [nose section], 96 These fuel pumps are located in the outboard end of fuel tank Nos. 2 and 3 and draw fuel from the lowest points of fuel tank Nos. 1 and 4. 97 A sleeve is a woven or flexible jacket that protects electrical wiring. 98 AD 79-06-02 (and postaccident superseding ADs) are discussed further in section 1.18.3.4. 99 At the time of the accident, eight revisions to SB 747-53A2265 had been issued. The most recent revision was issued on April 14, 1994, and specified that all frame cracks must be repaired before further flight.

Factual Information 49 Aircraft Accident Report were reported by several operators on a number of airplanes with 7,000 to 20,002 flight cycles....The body internal structure cracking is attributed to cabin pressure cyclic loading.” The SB further stated that continued operation with undetected or unrepaired frame cracks “may cause two or more adjacent frames to crack through near the same stringer, which could lead to extensive body skin cracking and rapid cabin decompression.” Therefore, the SB recommended inspections of the affected area to be accomplished within specified flight cycle limits, with repairs as needed, and repeat inspections at intervals not to exceed 3,000 flight cycles.100 The Safety Board’s review of TWA’s maintenance records indicated that the accident airplane was inspected in accordance with SB 747-53A2265 on May 8, 1986. On December 15, 1986, the FAA issued AD 86-23-06, which superseded AD 86-03-51 and required repetitive inspections of several areas in the 747 nose section. TWA maintenance records indicated that the company accomplished the resulting initial inspection on the accident airplane on April 15, 1988. On June 24, 1991, the FAA issued AD 91-11-01, which superseded AD 86-23-06 and required several repetitive inspections in accordance with Boeing SB 747-53A2265 to detect and repair body frame and other internal structure cracks and possible adjacent skin cracks in the 747 nose section. AD 91-11-01 further stated, “installation of new and improved body frame structure in accordance with FAA approved procedures or Boeing SB 747-53-2272, dated January 12, 1987…is considered terminating action for the repetitive inspections required by this AD for the structure (considered to be stringers, clips and skin associated with the frame).” Boeing SB 747-53-2272, “Fuselage-Nose Section 41-Body Frame Structure Replacement and Reinforcement,” stated, in part, “fabricate a suitable work platform as required to protect any wire bundles disconnected in the upper deck area between STA 420 and 520.” According to TWA maintenance records, an MO was written to direct and schedule accomplishment of SB 747-53-2272. In accordance with this MO, the work platform structure was fabricated on 17 of TWA’s 747s, including the accident airplane, terminating the need for the repetitive inspections required by AD 91-11-01. The MO also directed modifications in accordance with Boeing’s Document D6-35999, “Aging Airplane SB Structural Modification Program-Model 747,” dated March 1989, which required replacement of trailing edge flap tracks, reinforcement of the APU cutout, installation of a splice strap at the STA 1241 bulkhead, and modification of longitudinal floor beams. Sections 42 and 46 Lower Lobe—Internal Inspections On September 17, 1986, the FAA issued AD 86-18-01, requiring 747 operators to inspect STAs 540 to 760 and 1820 to 1900 and stringers S-35 to S-42 on the left side of the airplane “to detect cracking of body frame structure in the lower lobe (sections 42 and 46) of the fuselage.” AD 86-18-01 applied, in part, to all 747 series airplanes listed in Boeing ASB 747-53A2237, Revision 1, dated March 28, 1986, which included the accident airplane. According to TWA maintenance records, the accident airplane was inspected in 100 The SB indicated that operators should reduce the repeat inspection interval to 2,000 flight cycles on airplanes with more than 20,000 flight cycles.

Factual Information 50 Aircraft Accident Report accordance with AD 86-18-01 on November 19, 1991, and the next repetitive inspection was due on November 19, 1996. Nose Section (Section 41)—External Inspections On January 22, 1991, the FAA issued AD 90-26-10, requiring 747 operators to conduct external inspections of the fuselage skin from STA 220 to 520 and between stringers S-6 and S-14 on both sides of the airplane “to prevent rapid decompression of the airplane.” Inspections were to be accomplished in accordance with Boeing ASB 747-53A2321, dated October 31, 1989, and repeated thereafter at intervals not to exceed 2,000 flight cycles. The AD required detected cracks to be repaired “prior to further flight.” According to TWA maintenance records, the accident airplane was inspected in accordance with AD 90-26-10 on November 6, 1995, and the next repetitive inspection was due on October 20, 1998. 1.6.3.2.3 Maintenance Accomplished Near Fuel Quantity Indication System Wiring in the Accident Airplane The Safety Board’s review of TWA’s maintenance records for the accident airplane revealed several instances in which repairs and other maintenance items were accomplished near the FQIS wiring paths during the 10-year period that preceded the accident, including the following: • In February 1986, during an inspection, a new forward cargo compartment fitting was installed between the upper front spar chord and the cabin floor at STA 1000, LBL 9. In addition, maintenance personnel cleaned the “exposed areas of all E1, E2, and E3 equipment shelves, wire bundles and terminal strips” and the wiring outboard of (behind) the flight engineer’s panel in the cockpit and removed metal shavings from the interior of the P-6 panel and the right-side body landing gear wheel well (STAs 1350 to 1394). (The fuel flow computer and VSO unit were located in the E3 equipment rack.) • In May 1986, during escape light path modification maintenance, a clamp was installed on the right sidewall just above the main deck floor level in the forward E/E compartment, securing a wire bundle, and a crack in the left-side bulkhead at STA 440 was repaired. (The wire bundle that contained the fuel flow computer and VSO unit wires was routed down the side of the airplane from the flight engineer’s position along STA 360, then turned aft beneath the floor, passing through this area.) • In April 1987, during an inspection, TWA maintenance personnel replaced two cracked stringers and repaired a cracked former flange between STAs 420 and

1. Additionally, maintenance records from this visit indicated that debris

(including dirt, metal shavings/cuttings, and loose hardware) was cleaned from the E/E compartments, and several loose/unclamped wires/wire bundles were secured. (As previously indicated, the fuel flow computer and VSO unit were located in the E3 equipment rack, and associated FQIS-related wiring is routed through this area, between E3 and STA 360.)

Factual Information 51 Aircraft Accident Report • In September 1988, during a C inspection, TWA maintenance personnel observed evidence of electrical arcing at the cannon plug for the service carts in galley C; two electrical cords were removed and replaced. Galley C is located in the center of the airplane, just aft of the L2/R2 main cabin doors, between STAs 850 and 880. Figure 20 is a diagram of the 747-100 interior. (The CWT FQIS wire bundles [W480] were routed in a raceway beneath the floorboards slightly aft of galley C.) • In November 1988, during a D inspection, TWA maintenance personnel removed numerous floor and wall panels located between STAs 360 and 1265 so that “metal work” repairs could be accomplished. (The areas addressed during these repairs contained FQIS-related wire bundles that are routed forward from the CWT rear spar, past the aft edge of galley C, to the fuel flow computer and VSO unit.) • In October 1990, during an inspection, TWA maintenance personnel observed corrosion at STA 1241, LBL 57, removed the corroded metal, and repaired the area. Subsequently, TWA maintenance personnel reinstalled wire bundles and the wire bundle tray (which had been removed to gain access to the canted pressure bulkhead) under the floor at STA 1241, LBL 70, after “metal work” was completed. (W480 FQIS wires passed above and beneath this repair area.) • In December 1991, during an inspection, TWA maintenance personnel repositioned the wiring on the rear of the cockpit fuel quantity panel. (These wire bundles included both power wires and FQIS circuit wires from each fuel tank, including the CWT.) • In December 1992, during a D inspection, the last of several tasks required by a 747 structural modification program mandated by AD 90-06-06 was accomplished. These tasks generated several nonroutine work cards, which indicated that corrosion and cracks were found, and repairs were accomplished in accordance with maintenance manual instructions. Several of these work cards indicated that wire bundles and ducting were removed to gain access to repair areas and reinstalled upon completion of repairs. Numerous wire bundle clamps were found deteriorated and were replaced. At STA 920, a wire bundle that was chafing was repositioned. (The work cards were not specific as to which wire bundles were removed. The CWT FQIS wire bundle [W480] is routed laterally along the floorbeam101 at STA 920 [crossing wires in the raceway], en route to the cockpit.) • On May 24, 1994, during scheduled ground maintenance at JFK (to perform a cabin seating reconfiguration), the left potable water bottle cap burst and separated from the cap attachment ring, resulting in damage to the area above and around the potable water bottles. The CWT FQIS wire bundle was routed through the area just outboard of the potable water compressor. According to maintenance records, corrective actions included the following: 101 Although the floorbeams above the WCS are oriented longitudinally, floorboards in the rest of the airplane are oriented laterally.

Factual Information 52 Aircraft Accident Report The potable water bottle air compressor pressure switch and connector, water system pressure relief valve, plus 3 feet of associated wiring were removed from the airplane for testing.102 The air compressor pressure switch was reinstalled, and the connector and relief valve were replaced. Both potable water bottles were removed, and the area, including the bulkhead aft of the bottles, was inspected. Most of the potable water bottles’ support rods and fittings were broken and/or bent and were replaced or repaired. The potable water bottles were replaced with serviceable potable water bottles. Several damaged ceiling and floor panels, baggage restraint bars, passenger service units, and trim panels were observed near seat rows 19 through 22, seats 4, 5, 6, and 7, and were removed and replaced. At STA 980, the floor beam above the left potable water bottle was removed, repaired, and reinstalled. The ceiling support in the forward cargo compartment was bent at LBL 24 between STAs 960 and 980, and the floor support was bent and cracked at STA 984, between LBL 12 and LBL 32; both supports were removed, repaired, and reinstalled. Wire bundles forward and aft of STA 970 were removed from the support clamps for sheet metal repair (forward and above the potable water bottle area) and were resecured upon repair completion. The wire bundle for the potable water bottle air compressor was disconnected just forward of the compressor during repairs, and was reconnected and secured after the metal repairs were completed. The forward cargo compartment between STAs 980 and 1000 was cleaned of water, dirt, and debris. • In November 1995, TWA maintenance personnel accomplished AD 89-12-07, “Overwing Center Section Cavity Drain Inspection,” during which the main cabin floor panels were removed to expose the STA 1240 cavity drain. (The FQIS wire bundle that was routed from the cockpit to the CWT is located beneath the floorboards near this work.) During its examination of recovered wreckage, the Safety Board found evidence of repairs accomplished near FQIS wire routing areas for which no associated maintenance records were found. For example, wires carrying FQIS signals to the upper deck AIDS unit were routed across the top of the airplane through an area where replacement fasteners and differences in paint were observed. The interior of the airplane skin in this area had a note, handwritten in green paint, that stated, “OCT 1, 1992 1:47 AM.” The Maintenance Records Group did not find a maintenance record that it could associate with this handwritten note. 102 As a result of this potable water bottle event and subsequent tests, on May 31, 1994, Boeing advised TWA to replace the tested relief valve with a different part number (P/N) pressure relief valve. On October 27, 1994, Boeing issued SB 747-38A2105, which advised all 747 operators (line numbers 1 through 1,013) to replace the potable water system pressure relief valve at the earliest opportunity. On June 23, 1995, the FAA issued AD 95-11-03, which required replacement of the potable water system pressure relief valve.

Factual Information 53 Aircraft Accident Report Figure 20. A diagram of the 747-100 interior.

Factual Information 54 Aircraft Accident Report 1.6.3.2.4 TWA Flight 800 Predeparture Maintenance Information The flight and cabin crew of TWA flight 881 (the accident airplane’s inbound flight segment, from Athens, Greece, to JFK) entered several maintenance writeups in the logbook, which were addressed by TWA maintenance personnel at JFK before TWA flight 800 departed. These writeups included the following: • The Nos. 1 and 2 engines exceeded the exhaust gas temperature limits of 925° F for 2 seconds. The overtemperature was caused by an unanticipated rapid spool-up of the engines during takeoff out of Athens. Maintenance personnel checked the inlet and exhaust on both engines, and no abnormalities were found. • A deferred item from July 7, 1996, indicated that maintenance personnel had to physically check the No. 3 engine oil quantity because of an oil quantity gauge discrepancy. The No. 3 engine oil tank was checked and serviced with oil. No malfunctions were found. • The splash guard in the aft upper deck lavatory was missing. Maintenance personnel reset the splash pan. • The drain in galley C had leaked, and the surrounding area of the floor was soaked. Maintenance personnel cleared an obstruction from the drain. • The No. 1 engine pressure ratio (EPR)103 indicator was sticking. Maintenance personnel replaced the EPR module. As previously indicated, maintenance personnel also accomplished a PS inspection and checked the landing gear tire pressure before the accident airplane departed JFK. The most recent TWA All Open Item Work Sheet for the accident airplane indicated that the following maintenance items had been deferred: • A June 9, 1996, maintenance logbook entry indicated that a 30-inch crack was observed in the fiberglass panel on the underside of the left wing, between the fuselage and the wing landing gear at the trailing edge, forward of the flap. Maintenance personnel performed a repair;104 however, the item remained open until a new panel could be produced and installed. • A June 30, 1996, maintenance logbook entry indicated that a tear was observed in the arm rest cover at row 31, seat 7. The item was deferred with a note that stated that the entire seat should be recovered. • A July 4, 1996, maintenance logbook entry indicated that the rear attachment on the left-side canoe fairing for the No. 2 trailing edge flap was broken. The fairing was removed, flap carriage was reported to be otherwise normal, and 103 EPR is a measurement of the engine’s power output as a ratio of total pressure of the gases in the exhaust pipe divided by the total pressure of the air entering the engine inlet. 104 This time-limited repair would typically have been considered an airworthy repair until the airplane’s next scheduled higher maintenance check; in the case of the accident airplane, this would have been a D check scheduled for December 1996/January 1997. However, TWA had scheduled the panel for replacement when the new panel was available, at the next SS inspection.

Factual Information 55 Aircraft Accident Report replacement of the fairing was deferred on the basis of the Minimum Equipment and Dispatch Procedures, Configuration Deviation List. The following operational stipulations were associated with this deferment: (1) for takeoff, reduce runway zero wind and climb limit weights 2,700 pounds; (2) for landing, reduce critical temperature 1° F. A placard listing these limitations was affixed in the cockpit. • A July 5, 1996, maintenance logbook entry described spots on the upper deck carpets. The item was deferred because there was insufficient time to perform the corrective action. • A July 7, 1996, maintenance logbook entry indicated that the No. 3 engine failed to go into reverse thrust and that the thrust reverser lever interlock failed to release. Maintenance personnel were unable to complete the repair because they did not have the necessary cables in stock. The item was deferred until July 17, 1996, when a mechanic was scheduled to install the cables while the airplane was on the ground at JFK. However, the mechanic told Safety Board investigators that he was unable to complete the repair before the airplane’s scheduled departure, so he mechanically locked the thrust reverser in the forward position, and the item was again deferred for 10 days. The Minimum Equipment and Dispatch Procedures indicated that the flight crew must be notified, associated systems for stopping the airplane must be operational, and affected systems must be placarded “INOP.” Records indicated that these procedures were followed. • A July 7, 1996, maintenance logbook entry indicated that maintenance personnel replenished the oil supply in the No. 3 engine, after which the flight engineer’s oil quantity gauge indicated that the engine contained 4 quarts of oil. After the engine was started, the flight engineer’s No. 3 oil quantity gauge indicated 2.3 quarts. The flight engineer’s oil quantity gauge was placarded “INOP,” and the item was deferred. TWA’s minimum equipment and dispatch procedures indicate that the items must be repaired within 10 calendar days. The procedures state that “one (oil quantity gauge) may be inoperative if it is verified before each takeoff that the oil tank is filled to the maximum recommended capacity; there is no evidence of above normal oil consumption or leakage; and oil pressure indicating, low oil pressure warning, and oil temperature indicating systems operate normally and are monitored.” The affected gauge (flight engineer’s panel) was to be placarded “INOP.” Before the departure of TWA flight 800, these procedures were signed off as accomplished. • A July 11, 1996, maintenance logbook entry indicated that the drain in galley C was clogged and drained very slowly. Maintenance personnel cleared the drain and signed off the maintenance item. However, a July 12, 1996, maintenance logbook entry indicated that the drain was still clogged. Maintenance personnel again cleared the drain, blew air through the line, and signed off the maintenance item. Later that day, at JFK, a logbook entry indicated that the drain was still clogged; however, because maintenance personnel did not have time to address the item, it was deferred.

Factual Information 56 Aircraft Accident Report • A July 15, 1996, maintenance logbook entry indicated that the No. 3 left leading edge flap amber (cautionary) light illuminated when the leading edge flaps were in the retracted position. The item was deferred because maintenance personnel did not have time to complete the task. The Minimum Equipment and Dispatch Procedures indicated that the affected lights must be placarded “INOP” and that the item must be repaired within 10 calendar days. • A July 15, 1996, maintenance logbook entry indicated that the R3 door emergency chute pressure gauge was not visible. Maintenance personnel deferred the item, indicating that the emergency chute cover needed to be “reworked.” • A July 17, 1996, maintenance logbook entry indicated that the captain’s weather radar display was inoperative, indicating no range markings or antenna sweeps. The item was deferred. The Minimum Equipment and Dispatch Procedures indicated that the indicator must be placarded “INOP” and that the item must be repaired within 10 calendar days. 1.7 Meteorological Information The surface weather observation taken about 1951 at JFK on July 17, 1996, located 52 nautical miles (nm) west of the accident site, stated the following: Winds 220° at 8 knots; visibility 10 miles; clouds at 6,000 feet scattered, ceiling 7,000 feet broken, 9,000 feet broken; temperature 82° F; dew point 70° F; altimeter setting 30.07 inches of Hg [mercury]; wind shift 1906; rain began 1918 and ended 1929; precipitation 0.00 inch between 1927 and 1951. The surface weather observation taken about 2051 at JFK stated the following: Winds 240° at 9 knots; visibility 10 miles; few clouds at 10,000 feet; temperature 80° F; dew point 69° F; altimeter setting 30.08 inches of Hg. The surface weather observation taken about 1945 at Francis S. Gabreski Airport (FOK) Westhampton Beach, New York, located 12 nm north of the accident site (the nearest reporting station to the accident site), stated the following: Winds 240° at 4 knots; visibility 4 miles; haze; clouds at 6,000 feet scattered; temperature 73° F; dew point 66° F; altimeter setting 30.08 inches of Hg; total sky cover 3/8. The surface weather observation taken about 2045 at FOK stated the following: Winds calm; visibility 6 miles; haze; clouds at 6,000 feet scattered; temperature 72° F; dew point 66° F; altimeter setting 30.09 inches of Hg; total sky cover 3/8. The winds aloft measured by a weather balloon launched from Upton, New York, on July 17, 1996, about 2000, are shown in table 3. (Upton is located about 15 nm from the accident site.)

Factual Information 57 Aircraft Accident Report These numbers were used during the Safety Board’s trajectory study.105 Review of the meteorological data revealed no record of significant meteorological conditions in the area or at the time of the accident. 1.8 Aids to Navigation No difficulties with the navigational aids were known or reported. 1.9 Communications No difficulties with communications were known or reported. Table 3. Winds aloft measured by a weather balloon launched from Upton, New York. Altitude (feet msl) Wind Direction (degrees) Wind Speed (knots) 1,000 270 12 2,000 280 14 3,000 285 17 4,000 290 17 5,000 303 19 6,000 310 19 7,000 315 17 8,000 320 16 9,000 330 12 10,000 335 12 11,000 320 12 12,000 295 16 13,000 290 16 14,000 300 17 15,000 303 19 16,000 305 21 17,000 315 29 18,000 315 33 105 For additional information regarding the trajectory study, see section 1.16.2.1.

Factual Information 58 Aircraft Accident Report 1.10 Airport Information JFK is located 1/2 mile southeast of the New York City limits and has an airport elevation of 13 feet. The airport has five runways. Runway 14/32 is 2,560 feet long and 75 feet wide; runway 13R/31L is 14,592 feet long and 150 feet wide; runway 13L/31R is 10,000 feet long and 150 feet wide; runway 4R/22L is 8,400 feet long and 150 feet wide; and runway 4L/22R is 11,351 feet long and 150 feet wide. The accident airplane departed from runway 22R. 1.11 Flight Recorders The two flight recorders on the accident airplane had been mounted in the aft fuselage, above and aft of the L5 door. According to wiring diagrams and maintenance documents and personnel, 115-volt a.c. power (provided by the engine-driven generators) was routed to the recorders through wiring along the upper right side of the passenger cabin from the a.c. essential bus/flight engineer panel. The recorder signal wires were routed along the upper left side of the passenger cabin. The recorders were recovered from the Atlantic Ocean by surface-supplied U.S. Navy divers operating from the U.S.S Grasp on the evening of July 24, 1996. They were immediately packed in water to prevent/delay the onset of corrosion and shipped to the Safety Board’s laboratory in Washington, D.C., for readout. 1.11.1 Cockpit Voice Recorder The CVR installed on the accident airplane was a Fairchild model A-100.106 Although the CVR unit exhibited external and internal structural damage and the recording medium (magnetic tape) was wet (which, as noted in section 1.1, resulted in sounds similar to recording tape damage noise to be recorded at 2031:05), the tape was otherwise in good condition, and the quality of the recording was good.107 The CVR recording consisted of four channels of audio information: one channel contained audio information recorded by the CAM, and the other three channels contained audio information recorded through the radio/intercom selector panels at the captain, first officer, and flight engineer positions. The accident airplane was not equipped with noise-activated (“hot”) microphones at the flight crew positions (nor was it required to be so equipped). Therefore, the audio information recorded at the flight crew positions consisted of air-to-ground communication and navigation radio audio information and did not include flight crew conversations and sounds in the cockpit. However, depending on 106 The CVR identification plate and S/N were missing and were not recovered. 107 The Safety Board uses the following categories to classify the levels of CVR recording quality: excellent, good, fair, poor, and unusable. A good recording is one in which most of the crew conversations can be accurately and easily understood. The transcript that is developed may indicate several words or phrases that are not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to a large number of simultaneous cockpit/radio transmissions that obscure each other.

Factual Information 59 Aircraft Accident Report their nature and volume, these sounds could be recorded by the CAM. The cessation of the CVR recording at 2031:12 was consistent with the loss of electrical power to the recorder. A transcript was prepared of the entire 31-minute 30-second recording. See appendix B for a complete transcript of the CVR recording. 1.11.1.1 Sound Spectrum Study The Safety Board further examined the audio information recorded by the four CVR channels using a sound spectrum analyzer (which provides a visual presentation of the frequency of the sound signals) and a computer signal analyzer (which allows analysis of the analog wave form and frequency content of the sounds and provides detailed timing information of the events).108 Examination of the CVR sound spectrum information indicated that throughout most of the accident flight, all of the CVR flight crew position channels recorded an electrical background noise that consisted primarily of a 400-Hz frequency electrical system power “hum,” with harmonic tones109 at multiples of up to 13 times the 400-Hz frequency.110 However, 0.73 and 0.68 seconds before the CVR recording stopped, there were brief (2 microseconds) changes in the electrical system background noise hum recorded by the captain’s position CVR channel. The harmonic tones of multiples greater than 800 Hz were not recorded (were “dropped out”), whereas the 400-Hz electrical background noise was still recorded on the captain’s position channel. There was no evidence of any other power disturbances on any channel of the CVR recording. The Safety Board contracted with the Naval Air Warfare Center-Aircraft Division (NAWC-AD), Patuxent River, Maryland, to measure the voltage harmonics of the captain’s CVR channel under various electrical load conditions.111 According to the NAWC-AD report,112 the baseline total harmonic distortion113 of the voltages measured at the captain’s CVR channel input was approximately 33 percent. The NAWC-AD testing indicated that application of an electrical load resulted in a reduction in the total harmonic distortion voltages measured at the captain’s CVR channel. The electrical load adjustment 108 For additional details and graphs, see Sound Spectrum Group Chairman’s Factual Report, dated November 15, 1997. 109 Most noises, including electrically generated tones, are made up of a fundamental frequency (in this case, 400 Hz) and multiples of that fundamental frequency, which are known as harmonic tones. 110 The CVR wiring is routed from the cockpit to the tail of the airplane with numerous wires and cables that are powered by the airplane’s 115-volt (400-Hz) electrical system, which results in the CVR recording a 400-Hz background noise. Most airplanes’ a.c. electrical systems operate on a 400-Hz frequency; this background noise hum is a common feature on CVRs. 111 The Safety Board also contracted with the NAWC-AD to determine whether electrical power transients could induce sufficient energy into the FQIS wiring through capacitive and inductive coupling to ignite fuel in a 747-100’s CWT. For additional information regarding these tests, see section 1.16.6.4.2. 112 See NAWC-AD Report No. NAWCADPAX/TR-2000/33, Boeing 747-100 Fuel Quantity Indication System (FQIS) Susceptibility to Induced Energy from Capacitive and Inductive Cable Coupling, dated June 12, 2000. 113 Total harmonic distortion is used to compare an electrical waveform to a pure sine-wave, expressed as a percentage of pure sine-wave voltage output. A total harmonic distortion score of 0 percent is the equivalent of a perfect sine-wave and indicates no harmonic distortion.

Factual Information 60 Aircraft Accident Report required to attain the minimum value of total harmonic distortion voltages observed in the NAWC-AD tests (less than 12 percent) occurred under the following conditions: immediately after closing all generator circuit breakers; when the circuit breaker for TRU 2 was opened; when the essential power selector was switched to either electrical bus 1, 2, or 3; and when all six TRU circuit breakers were opened. As previously discussed in section 1.1, the CVR recorded an event (a “very loud sound”) that was about 40 percent louder than the previous signals during the last few tenths of a second of the CVR recording, which continued until the CVR recording abruptly stopped.114 This event was recorded by all four CVR channels; however, examination revealed that the very loud sound was recorded by the captain’s position channel 7.25 microseconds before it was recorded by the other three channels. 1.11.1.2 Cockpit Voice Recorder-Related Airplane Tests The Safety Board documented the CVR’s response to various types of explosive events during a series of controlled tests on a decommissioned 747-100 airplane.115 The test series included the following conditions: detonation of four simultaneous explosions in four different cargo container locations on board the pressurized airplane, controlled high explosive detonations at various locations inside and outside the unpressurized fuselage, and 15 fuel/air mixture explosions at various locations on board the unpressurized airplane. The fuel/air mixture explosion tests included one test in which a known fuel/air mixture was exploded in the airplane’s CWT.116 Sound spectrum analysis plots from these airplane tests were compared with those from the TWA flight 800 CVR recording. For further comparisons, the Safety Board plotted the CVR recordings from other known in-flight explosions/breakups (such as Pan Am flight 103, a 747-100 airplane that crashed at Lockerbie, Scotland, after a bomb on board exploded;117 an Air India 747-100 that crashed in the Atlantic Ocean southwest of Ireland after a bomb on board exploded;118 and United flight 811, a 747-100 that lost its forward cargo door in flight.119 The Board also plotted the CVR recording from a Philippine Airlines 737-300 that experienced a fuel/air mixture explosion in the CWT as it 114 This sound cannot be discerned simply by listening to the CVR but was identified through the sound spectrum study; therefore, it is not indicated in the CVR transcript. 115 This airplane was obtained by the FAA and the British Civil Aeronautic Administration to conduct explosive hardening trials on cargo containers. The airplane fuselage was structurally intact, with all exterior doors and windows in place; therefore, it could be pressurized. However, the airplane’s engines, the cabin interior, and the cockpit instruments had been removed. For the Safety Board’s tests, the airplane was equipped with additional instrumentation (including multiaxis accelerometers, pressure sensors, flash or detonation sensors, cabin microphones, and CAMs) and several CVRs, one of which approximately duplicated the CAM and recorders that were installed on TWA flight 800. 116 For the CWT fuel/air mixture explosion test, additional instrumentation was added to record the acceleration, pressures, and the gas mixture inside the tank. For additional information regarding these tests, see section 1.16.5.6. 117 See Air Accidents Investigation Branch. 1990. Report on the Accident to Boeing 747-121, N739PA at Lockerbie, Dumfriesshire, Scotland, on 21 December 1988. Aircraft Accident Report 2/90. 118 See Report of the Court Investigating. February 26, 1986. Accident to Air India Boeing 747 Aircraft VT-EFO, “Kanishka” on 23 June 1985. Honorable Mr. Justice B. N. Kirpal, Judge, High Court of Delhi.

Factual Information 61 Aircraft Accident Report was being pushed back from the gate at Ninoy Aquino International Airport, Manila, Philippines, on May 11, 1990.120 The CVRs recovered from these airplanes all recorded very loud sound events just before they stopped recording. The sound signatures from these events were compared with the sound signatures recorded at the end of the TWA flight 800 CVR recording. Generally, the sound signatures could be characterized based on how quickly the loud noise event rose from the background noise (rise time), the duration of the loud noise event, and how quickly the loud noise event decreased (fall time).121 The TWA flight 800 CVR recorded noise characteristics that were most similar to those recorded by the CVRs on board the United flight 811 and Philippine Airlines airplanes. The loud noise events recorded by these three CVRs were characterized by longer rise times, durations, and fall times than the loud noises recorded by the CVRs on board the Pan Am and Air India airplanes; the Pan Am and Air India CVR recordings exhibited very fast rise times, very short durations, and very fast fall times. The TWA flight 800 CVR was the only CVR that recorded the change in the airplane’s electrical system background noise described in section 1.11.1.1. 1.11.2 Flight Data Recorder The FDR was a Sundstrand model UFDR, S/N 10291, which recorded 18 parameters of airplane flight information on a 1/4-inch magnetic 8-track tape capable of retaining 25 hours of data. The accident airplane’s FDR system included a data acquisition unit, which gathered and converted analog flight information to digital data for transmission to the central electronics unit (CEU). The CEU provided a serial binary data stream to the FDR. The 18 recorded parameters included time (Greenwich mean time), pressure altitude, indicated airspeed, magnetic heading, vertical acceleration, longitudinal acceleration, angle-of-attack (AOA), pitch attitude, roll attitude, pitch trim (stabilizer) position, aileron position (sensed at the right inboard aileron), elevator position (sensed on right and left sides), rudder position (sensed for upper and lower panels), flap position (sensed for inboard and outboard flaps on both wings), leading edge devices (sensed for each device—four on each wing), EPR for all four engines, thrust reverser position for all four engines, and VHF microphone keying. Although the FDR exhibited external and internal impact and water damage, the crash enclosure and recording medium were intact and yielded data of good quality. Examination of the recorded data indicated that although the FDR operated normally until 119 See National Transportation Safety Board. 1990. United Airlines Flight 811, Boeing 747-122, N4713U, Honolulu, Hawaii, February 24, 1989. Aircraft Accident Report NTSB/AAR-90/01. Washington, DC. 120 The Safety Board assisted in the Philippine Government’s investigation of this accident. Damage to float switch wiring and a defective fuel quantity sensor were identified as possible sources of ignition; however, a definitive ignition source was not confirmed. For information about the safety recommendations that resulted from this investigation, see section 1.18.1. 121 The amplitude of the noise was not a reliable means of comparison because these noise events typically overloaded the CVR recording system when they occurred.

Factual Information 62 Aircraft Accident Report it stopped recording at the time of the power loss, some parameters recorded anomalous or erratic values. The following parameters contained frequent data anomalies recorded during the accident and previous flights: • Aileron position – Recorded values were noisy and erratic. • Thrust reverser engine No. 3 – During the landing at JFK that preceded the accident, the “transit” indication was displayed while the other three engines indicated a “deployed” condition. (The thrust reverser on engine No. 3 had been mechanically locked in the retracted position by maintenance personnel at JFK before TWA flight 800 departed on the day of the accident. Corrective maintenance was deferred for up to 10 days.) • Altitude (coarse) – Indicated erroneous altitude values and was unusable. • Altitude (fine) – Occasionally displayed noisy values. • Leading edge flap left No. 3 – With the flaps retracted, the “transit” indication remained on. With the flaps extended, the “transit” condition indicated “extended.” The maintenance log contained the following entry: “July 15th, 3L LE flap amber [light] stays on with LE flaps up and retracted electrically. [Forward] panel lights ops check ok.” • Indicated airspeed – The recorded values were occasionally erratic. Examination of the FDR data indicated that the data recorded during the accident airplane’s approach and landing at JFK before the accident flight (as TWA flight 881) did not reveal any anomalous airplane or flight conditions. During the first 12 1/2 minutes of the accident flight (from the start of the takeoff roll until 2031:12, when the recording stopped abruptly), the FDR operated continuously and recorded data consistent with a normal departure and climb. The data indicated that the airplane was in a wings-level climb, and the vertical and longitudinal acceleration forces were consistent with normal airplane loads when the recording stopped. Examination of the FDR data revealed that the interruption of the recording at 2031:12 was consistent with the loss of electrical power to the recorder.122 1.12 Wreckage Recovery and Documentation Information Pieces of the wreckage were distributed along a northeasterly123 path about 4 miles long by 3 1/2 miles wide in the Atlantic Ocean off the coast of Long Island. (Figure 21 shows the wreckage location relative to the airplane’s flightpath, JFK, and Long Island.) 122 For additional information, see Flight Data Recorder Group Chairman’s Factual Report (Revision 1), Flight Data Recorder Group Chairman’s Factual Report—Addendum I, and Flight Data Recorder Group Chairman’s Factual Report—Addendum II, all of which are dated February 15, 2000. 123 At the last point of radar contact, the airplane’s true course was about 75°; the wreckage was generally oriented along a path of about 60° from that last point of radar contact.

Factual Information 63 Aircraft Accident Report The first priority of the early search and recovery efforts was the recovery of victims; wreckage recovery was the second priority.124 Throughout most of the search and recovery operation, remote-operated vehicles (ROV), SSS, and laser line-scanning equipment were used to search existing underwater debris fields. This equipment was also used to explore areas outside existing debris fields that might contain victims and wreckage and to videotape the wreckage and ocean floor. Scuba divers and ROVs were used to recover victims and wreckage. In the late stages of wreckage recovery, scallop trawlers were used to recover pieces of wreckage that had become embedded in the ocean floor. (Search and recovery efforts are described in detail in appendix C.) When pieces of wreckage were recovered, they were typically tagged and numbered according to their wreckage recovery location. Although most tagged pieces of wreckage were tagged on the ship as they were recovered, it occasionally became necessary to cut or separate objects (previously tagged as a whole) into more than one piece. Additionally, some objects were extracted from an entangled group of debris (recovered and tagged as a unit); in some cases, pieces were received in a bag, net, or box full of other items with one tag assigned to the container. Finally, some parts simply broke during handling/transport, leaving some parts untagged. In all of these situations, the recovery position information on the ship tag from the original object or group of objects was transferred to the hangar tag(s) assigned to the separated object(s). The documentation/tagging process is described in detail in appendix D.125 Pieces of wreckage were then typically transported by boat to shore through the Shinnecock Inlet, where they were loaded onto trucks and transported to leased hangar space at the former Grumman Aircraft facility in Calverton, New York.126 Upon arrival at the hangar, investigators worked to identify and document the pieces of wreckage. 124 Very few pieces of wreckage were recovered during the first 2 days after the accident; those that were recovered during this time were found floating on the ocean’s surface. Several days of side-scan sonar (SSS) searching preceded the underwater wreckage recovery operations. 125 During the wreckage recovery phase, an extensive database of recovery information was created. This database contained a variety of information collected during the search and recovery operation, including recovery position data for thousands of parts. Extensive efforts involving representatives from the parties to the investigation were undertaken to cross-check and validate the information in this database. Nonetheless, not all of the recovery positions listed in the database are known with the same degree of certainty. A detailed Data Management Report was prepared to fully document this issue and to ensure proper use of the database. When used in accordance with the provisions of this report, the tags database provides a highly accurate source of recovery data. Recovery position data from the tags database were used in the trajectory study and were mentioned in the Sequencing Group’s study report. Safety Board investigators audited the recovery data used in the trajectory and sequencing studies to confirm the quality of the data extracted from the tags database. This validation work confirmed that the data were used appropriately in both of these studies. For additional information regarding the tags database, see appendix D or the Data Management Report, dated November 17, 1997. 126 Although almost all of the recovered wreckage was transported by boat to shore through the Shinnecock Inlet, during the first few days of recovery, some recovered wreckage was transported to shore through the Moriches Inlet. Additionally, some pieces of wreckage were flown from the ships to the hangar at Calverton.

Factual Information 64 Aircraft Accident Report Figure 21. The wreckage location relative to the airplaine’s flightpath, JFK, and Long Island.

Factual Information 65 Aircraft Accident Report The recovery effort took more than 10 months and involved personnel and equipment from multiple agencies and companies. Most of the examination, documentation, and (where pertinent) reconstruction of the recovered pieces of wreckage were completed within 1 year of the accident. However, some wreckage examination was ongoing until mid-2000. More than 95 percent of the accident airplane wreckage was eventually recovered. Throughout the wreckage recovery and documentation processes, fire and explosives experts and/or metallurgists from the Safety Board, DoD, Federal Bureau of Investigation (FBI), Bureau of Alcohol, Tobacco, and Firearms (ATF), FAA, and parties to the investigation thoroughly examined all recovered pieces of the wreckage for evidence of damage characteristic of a bomb,127 missile, or high-order explosive (such as hot-particle penetration, pitting, petalling, hot-gas erosion of metal, high degree of fragmentation, hole penetration from outside to inside).128 No evidence of such damage was found. Where areas of small missing pieces of the airplane were observed in the reconstructions, pieces of wreckage that would have been adjacent to or nearby those areas were reexamined closely. These adjacent or nearby pieces of wreckage contained no evidence of damage from a bomb, high-order explosive (bomb or missile warhead), or from missile warhead entry or detonation. As previously noted, a few pieces of the airplane structure were recovered floating in the water. The most prominent of these pieces was a very large portion of the right wing, from just outboard of the outboard engine to the wing tip. However, most of the pieces of airplane wreckage were recovered from the ocean floor, predominantly in three identified debris fields labeled by investigators the red, yellow, and green zones, from farthest west to farthest east, respectively. (Figure 22a shows the location of the three debris zones and the Long Island shoreline. Figures 22b and 22c show a 747 and the accident airplane’s flightpath, respectively, color-coded to indicate the debris fields from which corresponding wreckage was recovered.) The following subsections provide a general description of the pieces of wreckage (and their major characteristics) recovered from each zone. Additionally, these subsections describe the recovered condition of the accident airplane’s engines, CWT fuel pumps and other CWT components, the air conditioning equipment, and the electrical components and wiring. Details of damage and specific characteristics of the various structural pieces are given, as necessary, to support the discussion of the breakup sequence in section 1.16.3. See appendix F for fire damage129 and soot deposit diagrams for recovered pieces of wreckage from the wings, aft fuselage, CWT, and other selected areas. For additional information, see Fire and Explosion Group Chairman’s Factual Report, dated August 22, 1997. 127 For the purposes of this report, the term “bomb” means an explosive device designed to release destructive material at high velocity upon detonation, but does not include an explosive device designed only to set off a small charge of sufficient strength to penetrate the fuel tank and ignite explosive vapors. 128 Several factors led to speculation that the accident might have been caused by a bomb or missile strike, including heightened safety and security concerns because of the 1996 Olympics then being held in the United States, the fact that TWA flight 800 was an international flight, and the sudden and catastrophic nature of the in-flight breakup. 129 During the hours after the accident, there were numerous fuel-fed fires on the surface of the water around debris in the green zone. Thus, some of the fire damage and soot deposits found on pieces of wreckage discovered in the green zone may have occurred postimpact.

Factual Information 66 Aircraft Accident Report Figure 22a. Map showing the locations of the red, yellow, and green zones.

Factual Information 67 Aircraft Accident Report Figure 22b. A 747, color-coded to indicate the debris fields from which corresponding wreckage was recovered.

Factual Information 68 Aircraft Accident Report Figure 22c. The accident airplane’s flightpath, color-coded to indicate the debris fields from which corresponding wreckage was recovered.

Factual Information 69 Aircraft Accident Report 1.12.1 Wreckage Recovered from the Red Zone The red zone was the largest of the three zones and was located farthest west (closest to JFK) in the wreckage distribution. Pieces recovered from the red zone generally included pieces from between about fuselage STA 840 and about fuselage STA 1000 (the aft portion of section 42—see figure 3a for station references); the structure from the aft end of the forward cargo compartment; and pieces from the WCS, including most of the front spar, a large portion of SWB3, and the manufacturing access door from SWB2. Other pieces of wreckage recovered from the red zone included three of the four nose landing gear doors (the fourth nose landing gear door was located in the yellow zone),130 the forward portion of the keel beam, main cabin floor beams, flooring material from above the WCS, galley C, several passenger seats, two cargo containers, and the two forward air conditioning packs131 (packs 1 and 3—pack 2 was recovered from the green zone).132 None of the pieces of wreckage recovered from the red zone exhibited crushing damage133 as severe as that found on many pieces of the structure recovered from the yellow and green zones.134 In addition, although some of the pieces recovered from the red zone contained light soot deposits, none of the pieces contained moderate or heavy soot deposits or any other evidence of exposure to fire. Specifically, no fire damage was observed on the forward portion of the keel beam, air conditioning pack debris, and the fairing material located beneath the CWT. Two of the four cargo containers that had been loaded in the accident airplane’s forward cargo compartment (those located on the left side of the forward cargo compartment) were recovered from the red zone. The sides of these two containers were largely intact, and the damage observed was consistent with water impact. Examination of the forward cargo compartment containers and recovered portions of the forward cargo compartment and forward cargo compartment equipment (including the potable water bottles, floor tracks, cargo container stops)135 revealed no evidence of preimpact damage to the forward cargo compartment ceiling and/or wiring routed along the ceiling.136 There was no evidence that the potable water bottles had contacted the cargo containers, and all 130 For more information about the yellow zone, see section 1.12.2. 131 For specific descriptions of the air conditioning packs, see section 1.12.6. 132 According to wreckage recovery documentation, some of the earliest red zone pieces recovered were LF14A and RF1 (pieces of fuselage from the CWT area, left and right sides, respectively), which were recovered on July 24, 1996; CW504 (piece of the front spar), which was recovered on August 7, 1996; and RF35 (piece of right-side fuselage near CWT), which was recovered on August 14, 1996. Many of the pieces recovered from the red zone were recovered several weeks after the accident. For more information about the green zone, see section 1.12.3. 133 See section 1.16.3 for a discussion of the significance of crushing damage. 134 See sections 1.12.2 and 1.12.3, respectively. 135 The floor tracks and the track support structure from the front of the forward cargo compartment were not recovered. 136 FQIS wiring clips (without FQIS wires) were located along the cargo compartment ceiling at the aft end of the forward cargo compartment.

Factual Information 70 Aircraft Accident Report recovered cargo container stops were found intact and affixed to their respective cargo compartment floor tracks. 1.12.2 Wreckage Recovered from the Yellow Zone The yellow zone was the smallest of the three zones and was contained within the red zone on its northeastern side (see figure 22a). This zone contained pieces of the airplane’s forward fuselage, from about STA 840 to the nose of the airplane (STA 90). The wreckage recovered from the yellow zone included nearly all of fuselage section 41 (the nose section) and the forward portions of fuselage section 42. Overall examination of the fuselage pieces recovered from the yellow zone revealed severe crushing damage that extended from the left-side main cabin floor (about 3 feet below the left-side main cabin windows), across the bottom of the fuselage, and to just above the right-side main cabin windows. Pieces of fuselage structure from the top of this portion of the fuselage were found broken into pieces much larger than those from the bottom. Pieces of wreckage recovered from the yellow zone did not exhibit any evidence of soot deposits or fire or heat damage. No evidence of foreign-object impact to the cockpit windows was found. The two cargo containers that had been loaded on the right side of the accident airplane’s forward cargo compartment were recovered from the yellow zone. These containers were more fragmented than the two left-side containers.137 Examination of cockpit components recovered in the yellow zone revealed that the altimeters at the captain and first officer positions (which are powered by engine-driven generators on different wings) displayed 13,820 and 13,800 feet, respectively. The clocks at the captain and first officer positions (which are independently set and powered by the airplane battery in the cockpit) stopped at 2031:30 and 2031:20, respectively. The fuel quantity gauges at the flight engineer position indicated the following fuel quantities: 3,100 pounds in the No. 1 reserve fuel tank; 22,200 pounds in the No. 1 main fuel tank; 57,500 pounds in the No. 2 main fuel tank; 640 pounds in the CWT (indicated by both the electrical and mechanical gauge mechanisms);138 60,100 pounds in the No. 3 main fuel tank; 27,300 pounds in the No. 4 main fuel tank; and 3,300 pounds in the No. 4 reserve fuel tank. The fuel-used indicators for the Nos. 1, 2, 3, and 4 engines showed 2,680; 2,710; 23,570;139 and 2,830 pounds, respectively. The fuel quantity totalizer 137 For more information, see section 1.12.1. 138 TWA flight 800 dispatch paperwork indicated that the CWT contained 300 pounds of fuel. This reading, which would have been recorded by the ground refueler at JFK, would have been obtained from a repeater gauge at the left wing refueling station; the repeater gauge would register the same quantity as the cockpit gauge. The difference between the 300- and 640-pound readings exceeded the accuracy tolerance allowed by the manufacturer and recorded during certification tests. Tests conducted by the Safety Board during this investigation showed that the application of power to a wire leading to the fuel quantity gauge could cause the digital display to change at a rate of about 1,000 pounds per second (direction and rate of change varied, depending on which wires were shorted). According to circuit breaker trip curve data (see figure 34 in section 1.16.6.2.1), more than 1,000 percent of the rated current could pass through a properly functioning circuit breaker in 0.34 second, indicating that the digital display could change by several hundred pounds in less time than is required to trip the circuit breaker.

Factual Information 71 Aircraft Accident Report indicator140 indicated a gross weight of between 587,000 and 588,000 pounds and a total fuel-on-board weight of between 169,000 and 170,000 pounds. The Nos. 1, 2, and 3 crossfeed valve switches were found in the “On” (open) positions, and the No. 4 crossfeed valve switch was found in the “Off” (closed) position.141 The Nos. 1, 2, and 3 engine fuel flow indicators showed zero fuel flow, whereas the No. 4 engine fuel flow indicator showed 900 pounds per hour. The Safety Board examined the recovered caution and warning lightbulb indicators142 for indications of a preaccident malfunction. Lightbulb filaments were examined with 10 X or 15 X monocular microscope magnification or with a variable (75 X maximum magnification) binocular microscope. These examinations revealed that most of the lightbulb filaments, whether intact or broken, exhibited no evidence of distortion or stretching of the filament or individual coils. The cabin zone temperature control panel (which is located at the flight engineer’s position) was severely damaged. The temperature control for Zone 1 was found in the “Cool” position (the coolest setting of the temperature controls). The trim valve indicator for Zone 2 (see figure 6) was found at the “Mid-Heat” position (the warmest setting of the temperature controls). The instrument panel was broken and bent where the air conditioning pack selector switches should have been attached, and the pack selector switches were attached by their respective wire bundles. All three switches were bent upward toward the 12 o’clock position. Although postaccident examination revealed that the cockpit flap control lever was located between the 10° and 20° extended positions, physical damage to recovered leading and trailing edge flap components indicated that the flaps were in the retracted positions at the time of water impact. The landing gear handle in the cockpit was in the center position, marked “Off,” and physical damage indicated that the landing gear was retracted at the time of water impact. The pitch-trim jackscrew was found about 3/4 up from the bottom of the jackscrew (10 screw threads visible above the carriage, 35 threads visible below), which, according to Boeing, is consistent with a climb-trim position. 1.12.3 Wreckage Recovered from the Green Zone The green zone was located farthest east (farthest from JFK) in the wreckage distribution. Most of the airplane wreckage was recovered from this zone, including most of the pieces of both wings, all four engines, and the fuselage aft of about STA 1000 139 The fuel-used indicator for the No. 3 engine was heavily damaged. 140 As previously indicated, the TWA 747 Operations Manual describes this flight engineer station indicator as a gross weight/total fuel weight indicator. 141 Although individual switch positions throughout the cockpit wreckage were documented, most of the switches were not locked in position, and many had strands of wire wrapped around the switch toggle. 142 Many of the caution and warning lightbulb indicators were not recovered, and some of those that were recovered were badly damaged. Loss of power can also affect filament analysis. See Systems Group Chairman’s Factual Report, dated November 17, 1997, for detailed information.

Factual Information 72 Aircraft Accident Report (fuselage sections 44, 46, and 48—see figures 3a and 3b for reference). In addition, some pieces from the aft portion of fuselage section 42 were recovered from the green zone. The green zone also contained most of the WCS/CWT, including all recovered pieces from the rear spar, SWB1, the mid spar, SWB2 (except the SWB2 manufacturing access door, which was recovered from the red zone), and the upper and lower skin panels of the WCS. Portions of SWB3 and the front spar were also recovered from the green zone, as were the aft portion of the keel beam, the aft air conditioning pack, the main landing gear, and the tail section. Examination revealed that some pieces of wreckage recovered from the green zone exhibited heavy soot deposits and severe heat damage. Fire and heat damage (including blackened structure, melted wiring and aluminum materials, and burned composite materials) and heavy soot deposits were found on the following: some pieces from the aft CWT; floor beams and some of the passenger seats located just aft of the CWT rear spar; the portion of the fuselage above the right wing root, including the airplane’s external skin, parts of the right wing (including the front spar), and portions of the left wing outboard of the No. 1 engine.143 Appendix F contains soot deposit/fracture diagrams for the WCS, wings, and fuselage. The fire damage was particularly severe on a portion of the right-side fuselage structure that remained attached to the inboard section of the right wing (including the fuselage area surrounding the R3 cabin door, located just above the right wing root). Heavy soot deposits were found on the top surface of the right wing. The R3 cabin door, which had separated from the fuselage and was recovered separately, exhibited fire and heat damage and soot deposits on the inside and outside surfaces with some areas of melted-through aluminum. Portions of the door normally shielded by the door frame and portions of the door frame normally shielded by the door also exhibited heavy soot deposits. In addition, severe fire damage was observed on the left side of SWB2, large portions of which appeared to have been melted away. Examination of the WCS upper skin panel pieces revealed that pieces from the forward left side of the panel exhibited no soot deposits, whereas pieces from the right side of the upper skin panel exhibited moderate to heavy soot deposits. Inspection of pieces of the WCS lower skin panel and the aft portion of the keel beam revealed substantial deformation and some soot deposits. Specifically, most of the lower surface of the WCS lower skin panel exhibited widespread moderate to heavy soot deposits, with the soot accumulation generally heavier on the right side; most of the upper surface of the lower skin panel exhibited light soot deposits, with localized areas of heavy soot deposits. Most right and left wing wreckage pieces, including the wing tip antennas, were recovered from the green zone, although some small internal pieces of the left wing were recovered from the red zone during trawling operations (late in the recovery process), and some pieces of the right and left wings, including the outboard portion of the right wing, were found floating (early in the recovery process) and were not associated with a specific 143 The fire and heat damage observed outboard of the No. 1 engine on the left wing is discussed further later in this section.

Factual Information 73 Aircraft Accident Report debris zone. The wing landing gear and engines were not attached to the wings when they were recovered. Most pieces of the right and left wing flight control surfaces (including leading and trailing edge flaps, ailerons, and spoilers) were recovered from the green zone144 and exhibited general impact damage. Many portions of the trailing edge flaps, ailerons, and spoilers and some portions of the leading edge flaps exhibited fire damage and soot deposits. The outboard sections of both wings had separated from their respective wings just outside of the outboard engines, near wing station 1224. Both separated outboard wing sections were recovered relatively intact; they were about 29 feet long and extended from about wing station (WS) 1224 to the wing tip. Examination of pieces of the right wing revealed the presence of soot deposits in the fuel tank vent stringers in the right wing structure, the separated outboard portion of the wing, and in the surge tank in the wing tip. Heavier soot deposits were observed on the outboard portions of the attached wing structure, while the separated outboard portion of the right wing and the vent stringers closer to the right wing root contained light soot deposits. Additionally, fire (heat) damage was observed on the upper skin of the right wing section outboard of the No. 4 engine to the location where the most-outboard portion of the wing separated. No fire (heat) damage was observed on the separated outboard portion of the right wing. Most of the left wing stringers (including vent stringers) between the left side-of- body rib and WS 1224 had separated from the upper and lower skin pieces; these stringers were bent and curled in various directions. The left wing outboard of the No. 1 engine was fragmented and was recovered in many pieces. The most-outboard piece of the left wing that was recovered was a piece of the left wing tip that included the top and bottom wing surface near the surge tank. Light soot deposits were observed on the interior of this piece of wreckage, near the front spar and on the lower surface of the surge tank, near the vent stringer. The fracture surfaces in these areas did not contain soot deposits. Additionally, a relatively large piece of the lower left wing surface from just outboard of the No. 1 engine was recovered; although the internal and fracture surfaces on this piece were clean, light soot deposits were observed on its external surface. The lower surface of the left wing contained soot deposits, with moderate to heavy soot deposits just inboard of the bottom fairing. The upper surface of the left wing was mostly free of soot. The upper skin of the inboard section of the left wing was fractured into numerous pieces, whereas most of the lower skin on the inboard portion of the left wing was recovered in larger pieces. Fuselage section 44 is located above the wings and extends from the front spar to the aft end of the wheel wells (STA 1480). The 16 main landing gear tires were recovered from the green zone and examined at the hangar in Calverton. All of the tires were found burst with evidence of external forces and exhibited cuts and gouges that were consistent with the recovered wheel well wreckage. No evidence of internally generated failures associated with heat was found on any of the tires.145 144 Some pieces of flight control surfaces were recovered floating on the ocean’s surface and were not associated with a specific debris zone.

Factual Information 74 Aircraft Accident Report All seven cargo containers that had been loaded in the accident airplane’s aft container cargo compartment were recovered from the green zone and were severely damaged in a manner consistent with impact forces. Six of these seven cargo containers were constructed of aluminum and exhibited a similar degree and nature of damage. The seventh cargo container was constructed of fiberglass-reinforced plastic, instead of aluminum, and was shattered. Fuselage section 46 extends between STA 1480 and 2360. The recovered pieces of the fuselage from this section exhibited a fragmentation pattern similar to that observed on the forward portion of the fuselage, which was recovered in the yellow zone. The upper fuselage structure in this section was found broken into relatively large pieces, while the lower fuselage structure (below the window belt on the right side of the fuselage and below stringers 28 to 31 on the left side of the fuselage) was fragmented into smaller pieces. Most upper fuselage skin pieces were totally or partially separated from the frames and stringers. The lower fuselage pieces exhibited inboard bulging in the skin bays (the area between adjacent stringers and frames), with stringers broken or damaged at most frame stations. Fuselage section 48 broke into large sections, the majority of which did not exhibit substantial compression damage. Minimal evidence of soot deposits or heat damage was found on pieces of wreckage from the aft portion of sections 46 and 48. 1.12.4 Engines The four engines were found in the green zone separated from the wings. The No. 1 engine had crushing damage along the bottom of the nacelle and the low-pressure compressor (LPC), high-pressure compressor (HPC), and diffuser cases; the No. 2 engine had crushing damage along the right side of the nacelle and the LPC, HPC, and diffuser cases; the No. 3 engine inlet and fan blades were crushed rearward, and the LPC and HPC cases had crushing damage from the front and along the bottom; and the No. 4 engine inlet was crushed rearward, the LPC and HPC cases were crushed axially from the front and inward from the right side, and the diffuser case was crushed along the right side. All of the fan cases and cowls were separated from their respective engines. All engine thrust reversers were also separated from their respective engines; however, examination of the recovered thrust reverser actuators showed that the drive mechanisms were at the head end of the jackscrew, consistent with a thrust reverser stowed position at the time of impact. The Safety Board’s disassembly and examination of the four engines revealed LPC damage consistent with a minimal amount of low-pressure rotor rotation (if any) at the time of impact and HPC damage consistent with some high-pressure rotor rotation at the time of impact. No evidence of uncontainment, case rupture, fire, penetration of an object from outside into the engine, or preimpact damage was found in any of the engines. 145 Although there was no evidence of heat-related damage, investigators observed marks on the surfaces of the four tires mounted on the left wing main landing gear that were not seen on the other tires. (In their stowed positions, these tires would have been located just aft of the CWT.) These marks appeared similar to light soot deposits on the rubber material and exhibited no evidence of exposure to sustained heat or fire.

Factual Information 75 Aircraft Accident Report Additionally, the Board’s examination of the APU revealed no evidence of uncontainment, case rupture, fire, penetration of an object from outside into the APU, or preimpact damage.146 1.12.5 Center Wing Fuel Tank Pumps and Other Components Both jettison/override pumps from the CWT were recovered, examined, and tested. The jettison/override pumps were impact damaged (especially at the aft ends, where they had been attached to the rear spar), but exhibited no evidence of electrical shorts, arcing, preimpact breaching of the housing, or discoloration of the pump shaft. (Figure 23 is a diagram of a jettison/override fuel pump.) Examination revealed that the jettison/override pumps’ thermal fuses and flame arrestor tubes were intact and exhibited no evidence of thermal or flame exposure. The CWT jettison/override pump motors exhibited no evidence of heat-related discoloration; the motor windings were the same tan color as those from the wing fuel tanks. (A similar jettison/override pump was heated in a laboratory test until the thermal fuse melted at slightly less than 400° F, and the motor windings were subsequently found to have darkened substantially.) The CWT jettison/override pump control switches in the recovered cockpit wreckage were found in the “Off” position. Investigators examined the possibility that any one or all of these switch positions might have been altered during the accident sequence. Unlike the scavenge pump switch (which was recovered damaged in the “Off” position), the jettison/override switches did not have a locking feature, and the recovered switch positions could not be positively related to a preimpact position. The jettison/override switch base damage was consistent with the toggle switch being in the position to which it was spring-loaded and not at the “Off” position. However, according to TWA procedures, with only unusable fuel remaining in the CWT, these pump switches should have been off at the time of the accident. Further, the CVR did not record any comments regarding activation of these pumps. Although the general condition of the left CWT jettison/override pump was clean, two pieces of a clear, soft, rubberlike foreign material were found on the outside diameter of the motor/impeller housing. Infrared examination by the National Aeronautics and Space Administration (NASA) determined that the material was a silicone-based substance. Additionally, the right jettison/override pump exhibited evidence of rubbing between the impeller edges and adjacent housing surfaces. Overhaul records from Crane Company, Hydro-Aire, Inc. (the pump manufacturer), described similar damage in other pumps and attributed it to worn shaft bearings.147 146 For additional information, see Powerplants Group Chairman’s Factual Report, dated February 25, 1997. 147 Similar, but extensively deeper rubbing damage was found in jettison/override pumps in the Philippine Airlines 737 that had a CWT explosion on May 11, 1990. The Safety Board conducted tests for 2 weeks to determine whether galling between aluminum surfaces within the pump could have ignited flammable vapors. The investigative group was not able to ignite flammable vapors by impeller rubbing or by other types of contact between internal fuel pump components.

Factual Information 76 Aircraft Accident Report Figure 23. A diagram of a jettison/override fuel pump. FORWARD

Factual Information 77 Aircraft Accident Report The CWT scavenge pump motor and impeller were not recovered. However, examination of the recovered fragments of related components, including the flange/spacer that was mounted between the scavenge pump and the rear spar, did not reveal evidence that the scavenge pump could have been an ignition source. Examination of the rear spar where the flange would have been mounted revealed a flange-shaped clean area, surrounded by an area of heavy sooting, with evidence of heat damage. There were no soot or fire patterns emanating from the scavenge pump mounting hole in the rear spar, and there was no indication that the heat detectors in the main landing gear wheel well had detected heat. A 10 3/4-inch-long section of fuel tube assembly with a P/N unique to the CWT scavenge pump pick-up tube was recovered. According to an installation drawing, the tube assembly would have been installed near an opening in the mid spar. Although the outside of the tube contained soot deposits, the internal surfaces had a slightly golden color, similar to the anodize finish seen on other fuel tubing. No evidence of soot deposits or flame flow patterns were observed in the tube that could be related to an ignition source. 1.12.6 Air Conditioning Equipment Air conditioning packs 1 and 3 (the forward-most air conditioning packs) were recovered from the red zone, and pack 2 was recovered from the green zone. Examination of recovered pieces of the three conditioned air systems revealed that numerous ducts and the heat exchanger headers exhibited flattening on the upper surfaces. However, there was no evidence of preimpact leaks that may have abnormally heated the CWT or of an uncontained rotor burst from the ACMs. Disassembly of the ACMs revealed no evidence of preimpact rotational scoring in housing areas adjacent to the impellers. Where the ducting that routed conditioned air from the air conditioning packs to the plenum was found broken or ripped, no localized color changes were observed on the ducting or adjacent materials. Where breaks occurred in heat-affected weld zones on this ducting, the Safety Board’s metallurgists found no evidence of fatigue failures. Some of the titanium ducts that transport hot bleed air from the engine(s) or APU to the air conditioning packs were examined in the Safety Board’s Materials Laboratory and found to contain preexisting cracks. According to Boeing, the blue coloration on the exterior surface of the ducts and on the preexisting crack areas indicated that the fractures existed when the ducts were stress relieved during manufacture. On some of the duct fractures, the preexisting cracks extended all the way through the duct wall thickness. The circumferential length of these cracks ranged from between 0.1 to 0.5 inch. There was no evidence that the cracks that extended through the duct wall had extended around the circumference of a duct before the accident. The turbine bypass valves for the three air conditioning packs were positioned about 10° from the fully closed position. The two recovered ram air inlet doors were found in the fully open position, and the two recovered ram exit actuators were found in the fully retracted (door open) position. According to the Hamilton Standard Service Manual

Factual Information 78 Aircraft Accident Report (HSSM), these positions indicated that the three air conditioning packs were operating to cool the airplane cabin. The recovered flow control valves were found in the closed position. According to the HSSM, a spring would move the flow control valve to the closed position if it did not have positive pneumatic pressure. In the 747-100, some conditioned air is moved forward from the air duct/plenum chamber (which is located above the WCS and beneath the cabin floor) through what investigators referred to as “the air conditioning long duct,” which begins about STA 1000 (above the front spar) and continues to about STA 1080 (between SWB3 and SWB2). The forward portion of the air conditioning long duct had broken, and three pieces (totaling about 67 inches in length) were recovered and examined. Most of the polyurethane insulation that normally surrounds the air conditioning long duct was missing from these pieces. 1.12.6.1 Brown Splatter Material on Air Conditioning Ducts The forward-most piece of the air conditioning long duct was about 14 inches long and exhibited little evidence of fire or heat damage. There was brown splatter material on the outside of the left and lower duct surfaces and on the inside lower surface, extending 3 inches forward from the aft end of this piece of duct. The splatter material continued across the aft fracture surface. The middle piece was about 28 inches long (with the aft end extending to above SWB3) and contained some soot deposits. Brown splatter material extended aft from the forward end of this piece as follows: about 6 inches aft on the right-side inside duct surface, about 12 inches aft on the inside lower surface, and about 16 inches aft (intermittently) on the left-side inside duct surface. The aft-most piece was about 25 inches long and contained darker soot deposits than the middle piece. Brown splatter material extended aft about 4 inches from the forward end on the inside surface of this piece. Some brown splatter material was observed on the inside upper and lower surfaces at the aft end of this piece of duct; the splatter material on the inside upper surface extended forward 8 to 10 inches in spots. At its forward end (above the front spar), the air conditioning long duct connects to what investigators called the S duct, which curves upward and outboard from the long duct. The aft portion of the S duct, extending 21 inches forward of the air conditioning long duct, was recovered and examined. The polyurethane insulation surrounding the recovered portion of the S duct was damaged and, in some places, missing. In areas where the insulation was missing, the duct appeared to have been scraped. The forward end of the recovered S duct piece was split longitudinally, and the inside surface of the duct exhibited numerous brown splatter material. Similar brown splatter material was also observed on the air conditioning long duct, the left side of the forward upper WCS and the front spar, and on some cabin passenger seats located above and/or forward of the WCS. The brown splatter material on the upper WCS extended aft along the air conditioning long duct to the point where it met the trim air “Y” inlet. At that location, the insulated metal trim air pipe is attached to the air conditioning long duct by a connector. Examination of the recovered trim air pipe revealed that a portion of the connector was

Factual Information 79 Aircraft Accident Report still attached to the end of the pipe, and no evidence of an overheated condition was found.148 1.12.7 Recovered Electrical Components/Wiring The Safety Board thoroughly examined all recovered and identified electrical and FQIS components and wiring (including connections, repairs, bundling, bundle fragments, various loose wires).149 Almost every piece of recovered wire exhibited damage, including numerous cracks in the insulation (many of which penetrated to the core conductors), extensive abrasions, twists, and cuts; further, salt deposits were found on insulation and on copper where insulation had been breached. (Figure 24 shows wreckage recovered with tangled and damaged wires attached.) Some of the recovered wiring exhibited evidence of electrical arcing; however, there was no evidence of electrical arcing to recovered CWT FQIS wiring (about half of the CWT FQIS wiring was recovered and identified). Microscopic examination (up to 70 X) revealed that the ends of most wires were necked or sheared. Blackened insulation was observed on many wires; however, many of these wires had been routed through the burned areas of the fuselage and right wing root. Figure 18 in section 1.6.1.3 is a general illustration of 747 wire raceways between the cockpit and the aft fuselage, taken from TWA’s Electrical/Electronic Wiring Raceway Identification [91-00-00]. Most of the wiring recovered from the accident airplane was found separated from its mounting structure. Some wire fragments in the wings remained attached to the wing structure by production clips, and other wires got tangled with structural wreckage. The majority of the forward fuselage wiring was received at the hangar in Calverton in two sections. Both of these sections were tangled with other debris, which included structural materials and other electrical components; one section included material from the cockpit and upper deck, whereas the other section included material mostly from the E/E bay that had been located between the nose landing gear wheel well and forward cargo compartment. Because the right side (the flight engineer’s side) of the accident airplane’s forward fuselage (including the wiring and electrical/FQIS components in that area) was severely fragmented, recovery and documentation of all of the electrical and FQIS components and airplane wiring from that area were not possible. Recovered electrical components from the flight engineer station included the CWT fuel panel (including the quantity gauge and fuel flow indicators), the FQIS wiring connector at the flight engineer station, the resistor installed between the FQIS wire and the attached AIDS wiring,150 and most circuit breakers (most of which were broken). 148 For additional information regarding the brown splatter material, see section 1.16.4.6. 149 For additional information regarding wiring in transport-category airplanes, see section 1.18.2. 150 Resistors are used in circuits to limit the amount of current (amperage), and thus power, that can pass through them. According to Boeing, protective resistors connected to 747 CWT FQIS wiring (including the fuel quantity gauges, VSO unit, AIDS, and fuel quantity totalizer gauge) limit the amperage from an internal short circuit to about 1 milliamp.

Factual Information 80 Aircraft Accident Report Some wiring from the upper left fuselage aft side of the cockpit was recovered in loose fragments, whereas other wiring from this area was recovered tangled with structural debris. The upper deck electronics rack (E11) was recovered as an independent piece of wreckage, with fragments of wire bundles attached. No evidence of fire damage or soot deposits was observed on the recovered forward fuselage electrical components or wiring. The BMS13-42A Poly-X wire from the accident airplane was stiff and inflexible, whereas recovered Teflon wires (used in the accident airplane’s fuel tanks) and samples of BMS13-42A Poly-X wire obtained from a retired 747 (N93117) were supple and pliable. Recovered wiring from the area near the CWT was tangled and exhibited fire damage and soot deposits. About half of the original FQIS wires (as shown in Boeing’s 747-100 engineering and production records) were recovered and identified. Although no evidence of arcing was observed on any of the recovered components connected to the CWT FQIS (the fuel quantity indicator, totalizer gauge, AIDS, VSO, and left wing refueling station), examination of other FQIS wires and wires routed adjacent to the FQIS wires revealed possible evidence of arcing in several locations. For example, examination of the recovered wiring and wreckage from the right wing revealed evidence of arcing on Figure 24. A photograph showing wreckage recovered with tangled and damaged wires attached.

Factual Information 81 Aircraft Accident Report generator cables routed with a wire bundle in the leading edge of the right wing, near the wing root. The right wing front spar was fractured and exhibited evidence of heat damage in the area. The wire bundles had melded into a mass that included wires leading to the right main wing tank (No. 4) fuel flow gauge and also included right wing FQIS wiring that would have been routed through the right wing fuel tanks to a common connection with the CWT FQIS at terminal strip T347. In addition, two non-FQIS wires that would have been corouted in the same raceway with the CWT FQIS were found with possible arcing or heat damage at STA 955.151 Copper strands on these two wires had melted and rehardened. The wire bundle fragment had fire damage. None of the adjacent wires in this section of the raceway, including some recovered FQIS wiring, exhibited the same melting/resolidification; however, some FQIS wiring from this area was not recovered.152 Fragments from all seven of the CWT fuel quantity probes were recovered; two of these fuel quantity probe fragments contained pieces of their respective terminal blocks. Examination of the recovered terminal block fragments revealed that they exhibited characteristics of the Honeywell Series 4 and subsequent terminal blocks (for example, smooth [unknurled] surface areas and a nylon strain relief clamp instead of a metal clamp).153 An intact compensator was recovered still attached to fuel tank structure from the No. 4 reserve fuel tank; the compensator and fuel tank structure exhibited evidence of fire damage. In addition, a large fragment of another compensator, exhibiting evidence of heat and fire damage, was recovered. This compensator fragment had no identification markings that would associate it with a specific fuel tank; however, the only pieces of fuel tank structure near compensator installations that exhibited evidence of fire damage were from the No. 4 reserve fuel tank and the CWT. Further examination of this compensator fragment revealed that electrical parts inside the attached support tube had soot deposits and exhibited evidence of melting and resolidification and blackening at the bottom edges 151 Maintenance records revealed that several repairs had been conducted in this area, including structural repairs from a burst potable water tank and numerous other floor repairs. Metal shavings were found adhered to recovered fragments of a floor beam from STA 920, within 2 inches of where the CWT FQIS wiring would have been routed in the raceway. 152 Another location in which evidence of possible arcing might have been observed involved three left wing FQIS wires from a bundle near STA 510. Investigators located a note, written by a member of the Systems Group, which indicated that he observed evidence of “arching (sic)” on the FQIS wires. (The 747-100 CWT FQIS is not isolated from left wing FQIS wiring; during postaccident evaluation of wiring paths on a retired 747, an electrical signal placed on the CWT FQIS wiring was also detected on wiring from the left wing FQIS wiring.) However, subsequent attempts to locate the relevant portion of this wire bundle to confirm this observation were not successful, and some Systems Group members did not recall seeing any such evidence of arcing. (Some other Systems Group members did recall seeing evidence of arcing.) Some parties to the investigation did not believe that this note should be considered significant evidence of arcing. 153 Honeywell Series 1 to 3 fuel quantity probe terminal blocks had knurled surfaces (relatively sharp pointed cones in the hard plastic) that resulted in sharp edges resembling saw teeth at the terminal block edges. Honeywell Series 4 (and subsequent series) fuel quantity probe terminal blocks did not have these knurled surfaces. Additionally, wires were attached to Series 1 to 3 fuel quantity probe terminal blocks with metal clamps, whereas wires were attached to Series 4 fuel quantity probe terminal blocks with nylon-lined clamps.

Factual Information 82 Aircraft Accident Report of the plastic parts. The soot deposits exhibited an upward flow pattern and were located at the lowest edges of a plastic sleeve that covers a wire shielding connection, two plastic insulators on connectors, and the plastic lead wire support. The general features of each plastic part did not appear to have been molten, and away from the blackened edges each part retained its color. (Recovery records indicated that this intact compensator and the compensator fragment were recovered from the green zone.) Investigators found that Boeing and TWA wiring documents for the accident airplane did not show all of the wires that were recovered.154 Additionally, examination of wire configurations in the accident airplane revealed that they did not match those shown in Boeing’s technical diagrams. For example, Boeing’s PI 61B70126 showed separated wire bundles in a tray located above the CWT. Portions of these bundles recovered from the accident airplane’s wreckage were found twisted in a single mass of wires, with no evidence that they had been separated into wire bundles as illustrated in Boeing’s PI. Further, the Safety Board’s examination of this area of wiring in other 747s (N93117 and N93105), including some operated by TWA, revealed that the wires were apparently not bundled as shown in the PI but were randomly laid in trays.155 Examination revealed black spots on crimped FQIS wire connectors, including one on a damaged fuel probe from the accident airplane’s CWT. (During the Safety Board’s participation in the investigation of a May 1976 Iranian Air Force 747 crash near Madrid, Spain, investigators observed a similar black spot on a wire located adjacent to the site of this crimped wire connector.)156 X-ray energy dispersive spectroscopy (EDS) examination of the black spot revealed that it contained copper, sulfur, and trace amounts of silver.157 According to fuel experts at the U.S. Air Force (USAF) Research Laboratory (AFRL) at Wright Patterson Air Force Base, this residue was similar to silver-sulfide deposits158 that they observed during previous examinations of fuel probes from military airplanes. The Safety Board’s examination of wiring from the accident airplane revealed evidence of damage to electrical insulation on wires that had been attached to FQIS fuel quantity probe terminal blocks. Sulfide deposits were found on some exposed conductors. Much of the damage, which included exposed conductors, was not visible until the wiring was removed from the fuel quantity probe terminal blocks for inspection.159 154 Investigators recovered unmarked wiring, which was not shown on the Boeing or TWA documents. 155 For additional information about the Safety Board’s inspections of other airplanes, see section 1.18.2. 156 See National Transportation Safety Board. 1978. Special Investigation Report – Wing Failure of Boeing 747-131, Near Madrid, Spain, May 9, 1976. NTSB/AAR-78/12. Washington, DC. 157 For the purposes of this report, deposits containing copper, sulfur, and silver will be called silver-sulfide deposits. Silver-plated copper wiring is used in the 747 FQIS. Sulfur is commonly contained in jet fuel. In April 1998, Boeing provided the Safety Board with laboratory reports and other documents that described the presence of sulfur in turbine fuel as early as September 1970 (Budd, B. J. and Sanger, R. P. Silver Corrosion by Aviation Turbine Fuel. Institute of Petroleum.). 158 For additional information regarding sulfide deposits, see section 1.16.6.9. 159 Similar damage was observed on several other 747 airplanes during postaccident inspections. Some of the exposed core conductors apparently resulted from cold flow (migration or displacement) of the Teflon insulation material, whereas others were apparently the result of mechanical damage.

Factual Information 83 Aircraft Accident Report Additionally, investigators noted that various methods had been used to route wires to and secure them at the fuel quantity probe terminal blocks. In general, two different types of fuel quantity probe terminal blocks were recovered in the accident airplane wreckage—those with knurled surfaces and those without knurled surfaces. (See figure 15.) Investigators observed instances in which adjacent FQIS insulation had been breached near the knurled area of some terminal blocks. Honeywell documents (the Component Maintenance Manual and Overhaul Manual) indicated that both terminal block designs were in service at the time that the accident airplane was manufactured. According to an October 27, 1997, letter from Boeing, “[a] production change was made at Boeing that installed the Series 4 probes in line number 65 and on. [The accident airplane] was line number 164 and was delivered 10/27/71, so it is improbable that it was delivered with Series 3 terminal block probes.” Examination of the recovered FQIS wires revealed wires that had been repaired for damage that existed before the accident, evidenced in some cases by splices of various types. Several wire repairs were also found that did not comply with standards for repairs or installations used by Boeing or TWA, including the following:160 • An oversized strain relief clamp was used on the terminal block of the compensator in the No. 1 fuel tank. The cable harness passing through the clamp was wrapped around to pass through the clamp twice and still was not firmly secured. Chafing was observed on some wires. • Numerous wire splices were covered by a plastic insulating sleeve over metal barrels, such that the ends of the wire splices were open, with no other wrapping. These wire splices were noted at locations throughout the airplane (including areas exposed to fluid contamination, such as above the potable water tanks on the front spar) and occasionally showed evidence of corrosion. • Several wire bundles contained numerous wire splices on adjacent wires at the same location. Boeing’s SWPM recommended that wire splices be separated by a minimum of 0.25 inch, and Boeing SL 747-SL-20-048, dated January 25, 1995, stated that “[wire s]plices should be staggered throughout the bundle, this reduces the potential for wire-to-wire chafing and bundle interference.” • The connector pins in the recovered fuel totalizer gauge contained excessive solder, which appeared to have inadvertently joined connecting pins/wires from the right wing main fuel tank and CWT FQIS. The excessive solder had cracked between the connecting pins.161 160 During accident-related inspections of other transport-category airplanes, the Safety Board observed conditions and repairs similar to these in a variety of other airplanes operated by different airlines. For additional information, see section 1.18.2. Also see Systems Group Chairman’s Factual Report, dated November 17, 1997; Systems Group Chairman’s Factual Report—Addendum for Aircraft Wire Inspections and Historical Reports, dated July 28, 1999; and System Group Chairman’s Factual Report—Addendum for Fuel Quantity Indicators, dated February 5, 2000. 161 Although the cause of the cracking in the solder is unknown, postaccident tests conducted at Honeywell (the manufacturer of the fuel totalizer gauge) revealed that when slightly more than 270 volts was applied to one of the connecting pins, electrical energy would cross the crack in the solder.

Factual Information 84 Aircraft Accident Report 1.13 Medical and Pathological Information The bodies of 99 of the 230 airplane occupants were recovered from the surface of the ocean by various civilian, military, and police vessels during the first 24 hours after the accident. U.S. Navy and local police divers discovered most of the remaining victims during the next 3 months; however, some remains were recovered during the trawling operations (the final stage of search and recovery operations, which continued until April 30, 1997). The last recovered human remains were retrieved by a fishing trawler on May 22, 1997. In most cases, when victims were recovered, they were transferred from the dive boats and/or salvage ships to a Suffolk County Police Department boat and transported to the Suffolk County Medical Examiner’s Office in Hauppauge, New York.162 In some cases, victims were transported to shore by helicopter. Most identifications of occupants were accomplished through the use of fingerprints or dental records. However, in 29 cases, neither of these methods was successful; these cases required the use of deoxyribonucleic acid (DNA) protocols or forensic radiography as the primary means of identification. (Nineteen occupants were identified solely by DNA, and 10 were identified by forensic radiography, either by the medical examiner or the Armed Forces Institute of Pathology.) Toxicological samples (muscle tissue) from the captain (left front seat), the flight engineer trainee, and the check flight engineer were sent to the FAA’s Civil Aeromedical Institute (CAMI) in Oklahoma City, Oklahoma, for examination. Suitable toxicological specimens were not available for the captain/check airman (right front seat). The toxicological results for all submitted specimens were negative for all drugs of abuse163 and for prescription and over-the-counter medications. CAMI’s toxicological report indicated that the presence of small amounts of alcohol in some of the specimens was most likely “from postmortem ethanol production” caused by decomposition. During the investigation of the accident, the Medical Forensic Group, which included medical/forensic experts from the USAF, the U.S. Navy, the U.S. Army (retired), the FBI, the Safety Board, and the Suffolk County Police Department, was formed to review the available medical and forensic documentation for evidence that an explosive device (bomb or missile) had detonated near any passenger or crewmember. The review revealed no localized areas of damage or injuries in the airplane.164 In addition, investigators used biomechanical analysis and correlated medical and forensic data with passenger seat assignments165 and recovered seat damage (422 of the 455 seats on the 162 A temporary morgue at the U.S. Coast Guard (USCG) station at East Moriches was used during the first several weeks of the investigation. The remains of the occupants of TWA flight 800 that were recovered subsequently were transported to the Suffolk County Medical Examiner’s Office in Hauppauge, New York, for identification and examination. 163 The five drugs of abuse tested in postaccident analysis are marijuana, cocaine, opiates, phensyslidine, and amphetamines. 164 If an explosive device had detonated inside the airplane, localized areas of damage/injuries would be expected.

Factual Information 85 Aircraft Accident Report airplane were recovered) to reconstruct injury events as they occurred during the explosion, breakup, and water impact of the accident airplane. A Medical Forensic Investigation Analysis Report, dated January 28, 1999, and prepared for the Department of Justice/FBI by a medical/forensic expert,166 concluded the following: • Exhaustive analysis of all available medical data on the victims of TWA Flight 800 by an experienced team of forensic pathologists, biomechanicists and criminal investigators failed to find any evidence that any victim was directly exposed to a bomb blast or missile warhead detonation. This finding makes it highly unlikely that a localized explosion occurred within the passenger cabin of TWA Flight 800. • All injuries found in the victims were consistent with severe in-flight break up and subsequent water impact. • Injury and burn patterns to the victims as well as some body locations suggest that there was a severe break up of the passenger cabin early in the crash sequence. • Fire propagated in the [cabin zone located above the CWT] after most occupants [of this section] had been ejected. The small number of passengers with burn injuries exhibited only superficial burns consistent with exposure to a flash flamefront. 1.14 Fire/Explosion Physical evidence indicated that an overpressure event167 occurred in the airplane’s CWT.168 During the resultant airplane breakup, additional fires occurred. Witness documents169 and physical evidence also indicated that, after the wreckage impacted the water, fuel on the water’s surface continued to burn for several hours. Subsequent examination of the recovered airplane wreckage revealed that significant fire damage was observed only in specific areas, including components from within the CWT, floor beams and some of the passenger seats that had been located above and just aft of the WCS, the portion of the fuselage adjacent to and above the right wing 165 The Safety Board notes that passenger seat assignments may not reflect the seats actually used by all passengers. The accident flight was not a full flight, and passengers may have moved during the ground delay at JFK. 166 Shanahan, Dennis F., M.D., M.P.H., Colonel, U.S. Army, Medical Corps (retired). For additional information, see Dr. Shanahan’s complete report and the Medical Forensic Group Chairman’s Factual Report, dated October 17, 1997. 167 In this report, the Safety Board uses the term “overpressure event” to connote an event in which the pressure in the CWT is increased in a relatively short time to a level at which the structural integrity of the CWT was compromised. 168 For breakup sequence information, see section 1.16.3.2 169 For additional information regarding witnesses and witness documents, see section 1.18.4.

Factual Information 86 Aircraft Accident Report root, portions of the right wing, and portions of the left wing outboard of the No. 1 engine. Soot deposits on the fuselage aft of the front spar were only observed on the external fuselage skin; however, heavy soot deposits were observed on the aft portion of the keel beam.170 Additional fire and explosion information is contained in other sections of this report, as pertinent. For example, section 1.12 contains descriptions of the fire, heat, and soot damage observed on recovered wreckage. Additionally, sections 1.16.1, 1.16.2, and 1.16.3 contain radar, trajectory study, and sequencing study information, respectively, regarding the airplane’s breakup. Also, sections 1.16.5 and 1.16.6 contain additional information regarding heat- and fire-related damage/evidence, research into the fuel/air mixture on board the accident airplane at the time of the accident, the characteristics and combustion behaviors of Jet A vapors,171 and research and testing to identify the potential ignition location. See appendix F for documentation of soot patterns on pieces of wreckage and appendix G for a list of other fire/explosion-related airplane accidents. 1.15 Survival Aspects Although individuals in various civilian, military, and police vessels reached the accident site and initiated a search for survivors within minutes of the initial water impact, no survivors were located. The accident was not survivable.172 170 For more detailed information regarding fire and explosion damage, see Fire and Explosion Group Chairman’s Factual Report, dated August 22, 1997. Also, see Fire and Explosion Group Chairman’s Factual Report—Appendixes I and II (Sooting/Fracture Diagrams). 171 Jet A fuel is a kerosene fuel used in civilian turbine engine airplanes. It is composed of a mixture of more than 100 distinct types of hydrocarbon molecules; the precise composition often varies between refinery and by season. Jet A fuel is specified to have a minimum flash point of 100º F. Jet A-1 is a similar fuel, but has a slightly lower freezing point. Although Jet A fuel is available in some other countries, it is used primarily in the United States. 172 Although some of the accident airplane occupants may not have received injuries that were instantaneously fatal, all occupants received fatal injuries; therefore, the accident was considered nonsurvivable. Sufficient remains were recovered of 202 of the 230 occupants for investigators to make a determination of the level of severity of the injuries received. The following severity criteria was used: severe trauma was defined as “trauma that resulted in instantaneously fatal injuries”; moderate trauma was defined as “trauma that resulted in fatal injuries that could not be determined with certainty to be instantaneously fatal”; and minimal trauma was defined as “trauma in which fatal injuries were present, but not considered instantaneously fatal.” On the basis of these criteria, investigators determined that 183 of the 202 occupants received severe trauma injuries, 15 of the 202 occupants received moderate trauma injuries, and 4 of the 202 occupants received minimal trauma injuries. Occupants identified as receiving minimal trauma injuries were all assigned to seats in zone C of the airplane passenger cabin; two of these four occupants were recovered from the surface of the ocean during the first hours after the accident.

Factual Information 87 Aircraft Accident Report 1.16 Tests and Research 1.16.1 Radar Data Information The Safety Board reviewed radar data obtained from the FAA (long-range and airport surveillance radar [ASR]), military, and private sites for evidence of a missile or a midair collision. Additionally, the Board used radar information, where possible, to locate and track pieces of the airplane as they fell to the water, to help define the path of the airplane wreckage. The Board used long-range radar data recorded at FAA radar sites at Trevose, Pennsylvania; Riverhead, New York; and North Truro, Massachusetts. The long-range radar systems at each of these sites are capable of recording data within about a 200-nm radius of the site and completing a 360° sweep about every 12 seconds.173 In addition, the Board used ASR data from five FAA radar sites, which are located at the following airports: JFK; Newark International Airport, Newark, New Jersey; Long Island MacArthur Airport, Islip, New York; Westchester County Airport, White Plains, New York; and Stewart International Airport, Newburgh, New York. Each ASR site is capable of recording data within about 60-nm radius of the site and completing a 360° sweep about every 4.7 seconds. The Board also reviewed radar data recorded at the Sikorsky Aircraft plant in Stratford, Connecticut. These radar data were fed into the Sikorsky plant from the FAA’s Riverhead, New York, radar site and from Sikorsky’s own radar site in Shelton, Connecticut. The Sikorsky radar site is capable of recording data within about a 60-nm radius of the site and completing a 360° sweep about every 4 seconds. At the Safety Board’s request, recorded radar data were also obtained from the sites of the USAF’s 84th Radar Evaluation Squadron (84 RADES). The 84 RADES uses the same long-range antennas as the FAA (at Trevose, Riverhead, and North Truro) to gather the raw radar returns. However, the USAF had modified the radar system at North Truro and used its own processing software, which allowed the 84 RADES to estimate the altitude of primary targets.174 The North Truro radar system recorded a primary target at a location that was consistent with the trajectory of the accident airplane just after the last transponder return from the accident airplane was recorded; this target had an estimated altitude of 14,400 feet. Because of accuracy limitations,175 this radar data could not be used to determine whether the accident airplane climbed after the nose separated. (Many of the subsequent primary returns recorded a value of 102,000 feet, which, according to the 84 RADES, is a flag denoting that the radar was unable to estimate the height of the target even though a position was determined.) 173 The data recorded at these three radar sites were fed to Boston, New York, and Washington, D.C., ARTCCs; to U.S. Navy sites; and to a private site operated by Sikorsky Aircraft. 174 At the time of the TWA flight 800 accident, only the North Truro radar system had been modified to record altitude data for primary returns. 175 The published accuracy for the recorded altitude values is +/- 3,000 feet; however, the error can increase significantly when the range of the radar target increases beyond 100 nm, as was the case with the accident airplane. According to the 84 RADES, the height estimations of higher targets (that is, 20,000 feet msl and above) were more accurate than the recorded height estimations of targets near the accident airplane’s altitude.

Factual Information 88 Aircraft Accident Report Recorded radar data from ground-based radar antenna sites can be either primary or secondary in nature. A primary radar target is recorded when a primary radar signal reflects off of an object’s surface and returns to the site for processing and display. Primary radar returns contain no identification or altitude information. A secondary radar target is produced when a radar signal is detected by an airplane’s transponder,176 which transmits a coded message in response to interrogation by a ground-based transmitter. Secondary radar returns contain airplane identification and altitude data. All radars reviewed by the Safety Board during this investigation were transmitting and recording primary and secondary data, except the Sikorsky radar, which transmitted and recorded secondary data only. Although radar used in ATC is intended to display returns from airplane surfaces, unassociated primary radar returns (those that are not associated with any airplane track) are common and can be caused by other surfaces, such as trucks, boats, buildings, weather, flocks of birds, smoke, temperature inversions, and ground/sea clutter. According to FAA Order 6300.13, “Radar Systems Optimization and Flight Inspection Handbook,” chapter 3, paragraph 24, dated March 10, 1992, “[t]errain, fixed structures, and surface traffic within line-of-sight range of the ASR antenna system reflect radar energy which can degrade performance of the system. Such reflections can produce…false target displays.” Using the recorded radar data, the Safety Board was able to track TWA flight 800’s secondary radar returns from the time that the airplane departed JFK (about 2019) until the time that the airplane’s last secondary radar return was recorded (2031:12). The radar data review also revealed multiple sets of primary and secondary radar returns from other airplanes/objects in the area as the accident airplane climbed after takeoff and at the time of the accident. Examination of the radar data showed the following vehicle and/or object tracks within 10 nm of TWA flight 800 just before the accident (see figure 25): • A U.S. Navy P-3 antisubmarine airplane was less than 3 nm south-southwest of TWA flight 800 at an altitude of about 20,000 feet msl,177 moving to the southwest at more than 250 knots ground speed. • USAir (now USAirways) flight 217 was about 3 nm south-southwest of TWA flight 800, descending through an altitude of about 21,700 feet msl and moving northward. 176 A transponder is the airborne receiver/transmitter portion of a radar system that responds to interrogation signals received from ground-based equipment. 177 Most of the radar returns for the P-3 were primary radar returns because its transponder was malfunctioning such that secondary signals were available intermittently. During postaccident interviews, Boston ARTCC personnel stated that they were actively monitoring the P-3’s primary radar returns, despite the malfunctioning transponder. According to ATC transcripts and postaccident interviews with the P-3 flight crew, the P-3 was at an assigned altitude of 20,000 feet msl when the accident occurred. Further, one secondary radar return with the P-3’s assigned transponder beacon code was identified among the primary returns along the P-3’s flightpath, and the 84 RADES primary altitude data showed that the P-3 was about 20,000 feet msl.

Factual Information 89 Aircraft Accident Report • TWA flight 900 was about 9 nm west of TWA flight 800 at an altitude of about 19,000 feet msl, moving to the east-northeast. • An unidentified (primary radar) track was recorded less than 3 nm south-southeast of TWA flight 800, moving southwest about 30 knots ground speed, consistent with the speed of a boat. • An unidentified (primary radar) track was recorded about 5 nm west of TWA flight 800, moving east-southeast about 15 knots ground speed, consistent with the speed of a boat. • An unidentified (primary radar) track was recorded about 5 nm west-northwest of TWA flight 800, moving to the south-southwest about 12 knots ground speed, consistent with the speed of a boat. • An unidentified (primary radar) track was recorded about 6 nm northwest of TWA flight 800, moving to the southeast about 20 knots ground speed, consistent with the speed of a boat. The radar data also showed several isolated primary returns not associated with any track. (As previously noted, primary radar returns are often recorded from surfaces other than airplane surfaces.) The Safety Board’s examination of all of the available radar data revealed no sequence of primary or secondary radar returns that intersected TWA flight 800’s position at any time, nor did it reveal any radar returns consistent with a missile or other projectile traveling toward the accident airplane. No secondary radar returns were received from TWA flight 800 after 2031:12; however, after 2031:12, numerous new primary radar returns appeared near the accident airplane’s last recorded radar position, some of which were visible for up to 20 minutes after the last secondary radar return was received from the accident airplane. The primary radar returns that appeared near the accident airplane after 2031:12 were recorded largely in two areas of dense concentration, located about 1 to 1 1/2 miles east-northeast and 1 1/2 to 2 1/2 miles northeast of the last secondary radar return, respectively (see figure 26). 1.16.1.1 Information Regarding Certain Primary Radar Targets Recorded by the Islip, New York, Radar Site The Islip, New York, radar data showed one particular sequence of eight primary radar returns about the time of the accident (see figure 27) that warranted further review. On the basis of the times of and distances between these primary radar returns, the target appeared to be moving away from TWA flight 800’s position at a ground speed of more than 400 knots. The first of the eight radar returns was recorded at 2030:15, more than 6 nm southeast of the accident airplane. The last of these returns was recorded at 2031:30 (18 seconds after TWA flight 800’s last secondary return), about 15 miles southeast of TWA flight 800.

Factual Information 90 Aircraft Accident Report Figure 25. Radar data showing vehicle and/or object tracks within 10 nm of TWA flight 800 just before the accident.

Factual Information 91 Aircraft Accident Report Figure 26. Primary radar returns that appeared near the accident airplane after 2031:12.

Factual Information 92 Aircraft Accident Report Figure 27. Sequence of eight primary radar returns recorded by the Islip, New York, radar site about the time of the accident.

Factual Information 93 Aircraft Accident Report Although most of the radar systems from which the Safety Board obtained data were capable of recording radar targets in the geographic area in which these primary radar returns were recorded, this sequence of eight primary radar returns was only observed in the data from the Islip radar site. Further examination of the returns recorded in that geographic area by the Islip site between about 2030 and 2040 revealed two additional sequences of primary radar tracks with apparent ground speeds greater than 300 knots. One of these sequences indicated a radar target movement away from TWA flight 800 to the southeast, whereas the other sequence indicated a target movement away from TWA flight 800 to the southwest. In all three cases, the sequences of primary radar targets appeared with no radar track leading to them and disappeared after four to eight intermittent returns. The returns in each of these sequences were irregularly spaced and had varying signal strengths. The azimuth of each of the sequences was 150° to 160° relative to the radar, and there were no primary or secondary tracks leading to or away from them. None of the three sequences intersected TWA flight 800’s position at any time. Investigators learned from air traffic controllers and radar technicians that ground or building reflections of primary radar returns from airplanes flying in one geographic area can cause “false primary” targets to be recorded as though the airplanes were flying in another geographic area. FAA documentation and review of the area around the Islip radar site showed numerous buildings and structures that could create such reflections. Investigators identified commercial airplanes traveling through other areas within the coverage of the Islip radar at the same time that the three sequences of primary radar returns were recorded; these airplanes had similar ground speeds to those indicated by and flightpaths that were not inconsistent with the three sequences of primary radar returns. During its investigation of this accident, the Safety Board became aware of several allegations of potentially suspicious radar targets, including the following: (1) that the Islip primary radar data showed evidence of groups of military surface targets converging in a suspicious manner in an area around the accident site and (2) that a southwesterly bound 30-knot primary track just south-southeast of the accident site was involved in foul play, as evidenced by its failure to divert from its course and assist with the search and rescue operations. With regard to the first of these radar targets, the Safety Board examined the U.S. military records for the time of the accident, which showed that there were no military surface vessels within 15 nm of the accident site at the time of the accident. In addition, the U.S. military “Warning and Restricted Areas Information Log” dated July 17 and 18, 1996, indicated that all warning areas in the area of the accident were available on July 17, 1996, for concurrent use by nonmilitary aircraft (not scheduled for exclusive military use) except for the following: • Air operations were scheduled in warning area W-387A/B (closest point about 160 nm south of the accident site) between 2030 and 2230. • Air operations were scheduled in warning area W-107 (closest point about 60 nm south of the accident site) between 1330 and 1600.

Factual Information 94 Aircraft Accident Report With regard to the second potentially suspicious radar target, the Safety Board reviewed the 30-knot primary target recorded by the Islip radar site on the night of the accident to determine why it did not divert from its course and proceed to the area where the TWA flight 800 wreckage had fallen. The Board’s examination of radar data showed that at the time of the last TWA flight 800 secondary return (2031:12), the 30-knot target was about 3 nm south-southeast of TWA flight 800 and headed south-southwest. On the basis of the target’s position relative to TWA flight 800 and the likely forward-looking perspective of the target’s occupant(s), the occupants would not have been in a position to observe the accident airplane’s breakup and/or subsequent explosions/fireball(s). Additionally, it is unlikely that the occupants would have been able to hear the TWA flight 800 event over the sound of its engines and the ambient noise associated with the hull’s displacement of water. Further, if the occupants were in an enclosed bridge or cabin, the chance of seeing or hearing the TWA flight 800 event would be even further diminished. Further, the Board reviewed the Islip radar data for other similar summer days and nights in 1999 (3 years after the accident) and found numerous slow offshore primary tracks consistent with those found at the time of the accident. The Board’s review indicated that such tracks were consistent with normal commercial fishing, recreational, and/or cargo vessel traffic. 1.16.2 Trajectory and Main Wreckage Flightpath Studies 1.16.2.1 Trajectory Study Description and Results During its investigation of the TWA flight 800 accident, the Safety Board conducted a trajectory study in which it used the known winds aloft and the weights and estimated aerodynamic characteristics of selected pieces of wreckage178 to help predict the likely timing of those pieces’ separation from the airplane and their motion during the subsequent descent to the water. The results of the trajectory study were used in combination with other information, such as radar data, wreckage recovery locations, and the metallurgical experts’ examination of the wreckage reconstruction, to help determine the sequence179 of the airplane’s structural breakup. A ballistic object’s180 trajectory is determined by its ballistic coefficient, which is the weight of an object divided by the product of its drag coefficient multiplied by its area.181 Thus, a foam ball (which has a very low ballistic coefficient) would fall slowly when released from an initial point in space, moving almost exclusively with the wind to its ground location. In contrast, a bowling ball (which has a high ballistic coefficient) would fall rapidly when released from an initial point, with very little displacement resulting from the wind. 178 The trajectory study concentrated on items recovered from the red zone, the westernmost search area along the wreckage path. 179 For further information about the Safety Board’s sequencing study, see section 1.16.3.2. 180 For the purposes of this report, a ballistic object is one that has no stable lift. 181 For specific information regarding individual objects’ ballistic coefficients, see the Trajectory Study Group Chairman’s report, “Trajectory Study, Supporting Material,” dated October 14, 1997.

Factual Information 95 Aircraft Accident Report The Safety Board used time-step simulation182 to calculate the paths of selected pieces of wreckage from the airplane’s position at the time of the initial event (based on FDR data) to that object’s recovery location.183 The Board used its BREAKUP computer program184 to determine the trajectories of pieces of wreckage that had separated from the airplane.185 The program begins with the pieces of wreckage at an altitude and airspeed consistent with the airplane’s last recorded FDR data, then predicts the movement of those pieces through the air, and generates coordinates for the impact location of these pieces of wreckage.186 In general, the trajectory study indicated that pieces of wreckage recovered from the red zone departed the airplane during the first few seconds after the initial event, followed shortly thereafter by the separation of the forward fuselage (recovered from the yellow zone). As outlined in the following section, the remainder of the airplane flew for a time in crippled flight and did not exhibit ballistic behavior until about 40 seconds after the initial event (when the WCS failed); pieces of wreckage from this portion of the airplane were recovered from the green zone. In general, the results obtained in the trajectory study were consistent with other evidence, including the Metallurgy Structures/Sequencing Group’s (Sequencing Group) findings regarding the airplane’s breakup.187 However, the trajectory study’s results for two wreckage pieces (RF35 and CW504)188 suggested that these pieces separated before the airplane’s last secondary radar return, which was not consistent with other (CVR, FDR, radar data, and sequencing study) evidence. The Safety Board’s trajectory study indicated that these pieces of wreckage did not behave ballistically.189 1.16.2.2 Main Wreckage Flightpath Study Description and Results The Safety Board conducted a series of computer simulations to examine the flightpath of the main portion of the fuselage (including the wings, most of the WCS, aft 182 Time-step simulation calculates a new position, velocity, flightpath angle, etc. for each piece of wreckage using accelerations calculated for the previous iteration. 183 According to Oceaneering personnel, the documented wreckage recovery locations were estimated to be accurate to within 100 meters. However, the accuracy of documented recovery locations varied depending on recovery platform and global positioning system (GPS) equipment type and wreckage type. (Some small pieces were collected in baskets and then lifted to the ship; only the basket location was documented.) 184 The BREAKUP computer program is a FORTRAN program developed at the Safety Board that, given an initial position and velocity vector, calculates the time history of the trajectory of a piece of wreckage (defined by its drag and weight). 185 The winds used in the trajectory study were interpolated from upper air data measured by a radiosonde balloon launched from Upton, New York, on July 17, 1996, at 1934 (see table 3 in section 1.7). 186 For more details regarding this process, see the Trajectory Study Group Chairman’s report, “Trajectory Study,” dated October 14, 1997. 187 For more information, see 1.16.3.2. 188 For additional information regarding CW504 and RF35, see the Trajectory Study Group Chairman’s report, “Trajectory Study,” dated October 14, 1997. Also, see the Data Management Group Chairman’s report, “Data Management Report,” dated November 17, 1997. 189 See the trajectory study for possible explanations for this nonballistic behavior.

Factual Information 96 Aircraft Accident Report fuselage, and empennage) after the forward fuselage separated. Investigators configured the Board’s workstation-based flight simulation computer program to enable simulations that would reflect the thrust, mass, and longitudinal aerodynamic characteristics of an intact 747-100, based on Boeing’s 747-100 engineering data. Then, investigators modified the engineering code so that the simulation would reflect the aerodynamic and mass property changes that Boeing estimated would have occurred when the forward fuselage separated.190 The separation of the forward fuselage would result in significant changes to the weight and balance and aerodynamic characteristics of the airplane, substantially modifying its flight characteristics. Boeing’s engineers estimated that the airplane’s c.g. would move aft from 21.1 to 57.8 percent MAC; the airplane’s total weight would decrease by almost 80,000 pounds; and the airplane’s moments of inertia would decrease significantly when the forward fuselage separated. Further, the aerodynamic loads that would normally result from air impacting and flowing over the smooth forward fuselage would be replaced by the loads created by air impacting and flowing over the blunt open fuselage, which would result in increased drag and altered airflow across the inboard sections of the wings. When the predicted weight and balance changes were considered with the predicted aerodynamic effects, an initial net nose-up pitching movement was indicated. After the Safety Board’s flight simulation computer program had been modified to account for the changes in the 747-100’s mass and aerodynamic characteristics, investigators conducted simulations to identify the airplane’s motion during the seconds before and after the separation of the forward fuselage. The simulation “airplane” was positioned at the altitude, airspeed, and pitch angles last recorded by the FDR and then flown through the loss of forward fuselage without further flight control input. The modified mass and aerodynamic characteristics were applied to the remaining fuselage until it began to break up,191 after which the remaining pieces of wreckage exhibited ballistic behavior. Because investigators could not positively determine engine power settings after the FDR stopped recording, the Board performed simulations using each of the following engine power settings: (1) the accident airplane’s last recorded power setting (climb power), (2) engine power off, and (3) full engine power. The results of these simulations indicated that variations in engine power would not have significantly affected the path of the crippled airplane. Rather than develop a simulation for all combinations of aerodynamic characteristics, the Safety Board bracketed the estimated range of effects by conducting a “fast” simulation (using maximum nose-down pitching moment and minimum drag and lift coefficients), a “slow” simulation (using minimum nose-down pitching moment and maximum drag and lift coefficients), and an “intermediate” simulation (using midrange 190 Because it is not possible (with existing technology) to precisely quantify these changes, Boeing’s engineers estimated a range of values for the airplane’s aerodynamic characteristics after the forward fuselage separated. 191 Physical evidence described in the sequencing report (see section 1.16.3.2) indicates that the wings failed and separated outboard of the outboard engines followed by failure of the WCS adjacent to the left wing.

Factual Information 97 Aircraft Accident Report data). Further, the Board varied the timing of the forward fuselage separation, conducting simulations with nose departure times at the beginning, middle, and end of the 4-second interval indicated for possible forward fuselage separation by the trajectory study. Table 4 shows scenarios involved in the simulations. The Safety Board’s simulations indicated that the longitudinal response of the airplane to the loss of the forward fuselage (with no flight control input) was to climb to above 16,000 feet msl. However, the airplane’s lateral response to the loss of the forward fuselage (with no flight control input) was less clear. Evaluation of primary radar return data (from radar sites at White Plains, Islip, and JFK) indicated that after the initial event, the main portion of the airplane may have turned north after the forward fuselage separated and then turned south toward the main wreckage recovery site in the green zone. However, there was considerable scatter in the radar data after the in-flight breakup, and the recorded radar tracks differed, such that data from the Islip and White Plains radar sites indicated a more pronounced turn to the north followed by a turn back south, while data from the JFK radar site indicated a much straighter path to the wreckage site. Simulations were run using bank angle inputs to match the radar data. The slow and intermediate simulations that used a nose departure time at the beginning of this interval did not match the radar data, nor did any of the simulations that used a nose departure time at the end of this interval. The fast simulation that used a nose departure time at the beginning of the interval could provide close matches with data from all three radar sites with different bank angle inputs. Simulations with a nose departure time in the middle of the interval did not match the Islip and White Plains radar points; however, intermediate and fast simulations with a nose departure time in the middle of the interval matched the JFK radar data. (See figures 28a through 28e.) The Safety Board’s simulations indicated that the maximum altitudes that might have been reached by the TWA flight 800 aft fuselage after separation of the nose section ranged between 15,537 and 16,678 feet msl. In addition to the uncertainties caused by radar track variation, radar data scatter, and imprecise aerodynamic characteristics previously discussed, there are uncertainties in the timing and physics of the final breakup that affect the final seconds of the simulations. The timing of the wing tip and WCS failure were based largely on witness statements;192 therefore, they are not precise to the second. Further, the change in aerodynamics caused by the wing tip failure at a high AOA is uncertain, as is the effective ballistic coefficient of the main body after the WCS failure. Table 4. A time line of simulation scenarios. Clock Time(s) Event 2031:12 Initial event 2031:15.2, 2031:17.2, 2031:19.2 Forward fuselage separation 2031:46 Wing tip failure 2031:50 WCS failure adjacent to left wing 192 For more information, see section 1.18.4 and appendix H.

Factual Information 98 Aircraft Accident Report Figure 28a. Roll angle for nose off at 2031:15.2 cases. Figure 28b. Map view of nose off at 2031:15.2 cases. 20:31:00 20:31:10 20:31:20 20:31:30 20:31:40 20:31:50 20:32:00 20:32:10 -180 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 180 fast simulation nose departure at 20:31:15.2 Simulation for ISP radar Simulation for JFK radar Simulation for HPN radar TWA 800 Main Wreckage Simulation Time (hr:min:sec) Roll Angle (deg)

Factual Information 99 Aircraft Accident Report Figure 28c. Altitude for nose off at 2031:15.2 cases. Figure 28d. East position for nose off at 2031:15.2 cases.

Factual Information 100 Aircraft Accident Report Figure 28e. North position for nose off at 2031:15.2 cases. 1.16.3 Sequencing Study Information In December 1996, the Safety Board formed the Sequencing Group, which comprised Safety Board investigators and representatives from the parties to the investigation, to evaluate the sequence of the airplane’s structural breakup and correlate and compare proposed accident scenarios with the structural observations. To this end, the Sequencing Group examined individual pieces of the recovered structure, two-dimensional reconstructions or layouts of sections of the airplane, and various-sized three-dimensional reconstructions of portions of the airplane.193 The Sequencing Group also evaluated the relationship of the location of pieces of wreckage at the time of recovery194 to differences in fire effects (soot deposits on surfaces and fractures, changes in electrical conductivity) noted on pieces that are normally mated or adjacent to each other. The following subsections discuss the two- and three-dimensional reconstructions of the recovered airplane wreckage, the Sequencing Group’s examinations of the wreckage, and the accident airplane’s breakup sequence identified by the Sequencing Group. 193 For additional information regarding the reconstructions, see the Reconstruction Group Chairman’s Factual Report, dated October 7, 1997; the Medical Forensic Group Chairman’s Factual Report, dated October 17, 1997; and the Fire and Explosion Group Chairman’s Factual Report, dated August 22, 1997. 194 For descriptions of most of the pieces of wreckage found in the red, yellow, or green zones, see sections 1.12.1, 1.12.2, and 1.12.3.

Factual Information 101 Aircraft Accident Report 1.16.3.1 Two- and Three-Dimensional Reconstructions Several two-dimensional grids were marked on the hangar floor in Calverton, corresponding to Boeing’s drawings of the 747’s various major structures and components (fuselage, right and left wing structures, cabin interior [including seats, galleys, and lavatories], empennage, landing gear, and WCS). After the individual pieces of wreckage were identified and placed in the appropriate location on the corresponding grid, the structure was examined by the Sequencing Group. Between August 1996 and January 1997, the WCS/CWT was reconstructed in the following three separate small three-dimensional mockups: (1) the rear spar, SWB1, mid spar, SWB2, SWB3, centerline rib, and the WCS upper panel; (2) the front spar, forward lower panel pieces, keel beam, and adjacent fuselage pieces; and (3) the remaining WCS lower panel. Investigators also assembled separate three-dimensional reconstructions of the forward and aft cargo compartments, air conditioning packs, underwing fairing, nose landing gear wheel well, fragments of fuel tank assemblies and components, and the cockpit instrument panels. These three-dimensional reconstructions were assembled informally, with investigators grouping various combinations of parts, in an attempt to understand spatial relationships between damaged components. Additional documentation of individual components and pieces of wreckage was conducted while the pieces were in these reconstructions. In the spring of 1997, investigators assembled a 93-foot-long, three-dimensional reconstruction of the center portion of the airplane’s fuselage (from about STA 520 to about STA 1632, including the CWT, the main landing gear bay, the surrounding fuselage, and the furthest inboard pieces of the wings) in the hangar in Calverton.195 Pieces from smaller three-dimensional reconstructions were incorporated into the large three- dimensional reconstruction. Additionally, the Airplane Interior Documentation Group inventoried, examined, and identified all recovered airplane interior components and (where possible) placed those interior parts in the interior of the 93-foot long, three-dimensional reconstruction. This larger three-dimensional reconstruction of the center portion of the fuselage provided the Sequencing Group with useful information about damage patterns and failure sequences. (Figure 29 is a photograph of the right side of the large three-dimensional reconstruction, with the support scaffolding visible.) Examination of the 93-foot long, three-dimensional reconstruction revealed that the largest area of unrecovered or unidentified fuselage structure in the vicinity of the CWT was about 1 square foot. However, the underlying structural pieces (stringers and/or frames) were recovered in each area of missing fuselage and revealed no evidence of through penetration. 195 In December 1996, the Safety Board contracted with Wiss, Janney, Elstner, and Associates, Inc., to design, fabricate, and assemble the required framework, devise the means by which the various pieces of airplane wreckage could be attached to the framework, and connect the pieces of airplane wreckage to the framework. Some truss fabrication and erection tasks were subcontracted to Syracuse Rigging, and steel fabrication was performed by Delhi Steel Corporation. The reconstruction of this portion of the airplane occurred between February and late May 1997.

Factual Information 102 Aircraft Accident Report Figure 29. A photograph of the right side of the large three-dimensional reconstruction, with the support scaffolding visible.

Factual Information 103 Aircraft Accident Report 1.16.3.2 Airplane Breakup Sequencing Study Information As previously discussed, pieces of the forward portion of the WCS (including some pieces from the CWT) and the fuselage directly forward of the wing front spar were recovered from the red zone and (consistent with the Safety Board’s trajectory study) were, therefore, among the first pieces to separate from the airplane. Pieces of wreckage from forward of about STA 840 were found primarily in the yellow zone. Further, most of the remainder of the airplane (including the wings, major portions of the WCS, the aft fuselage, and the empennage) was found in a relatively small area in the green zone, indicating that this portion of the airplane remained intact for some time after the separation of the forward fuselage section. The Sequencing Group also conducted detailed visual examinations, occasionally with magnifications up to 30 X, of the separated structure, with primary emphasis on the WCS and fuselage pieces recovered from the red zone. Fracture directions, deformations associated with pieces adjacent to the fractures, and witness marks were evaluated on many of these pieces of wreckage. The group determined fracture directions based on visible fracture features that indicated local fracture propagation direction (such as chevron marks and river patterns [a series of small steps in a fracture that indicate the local direction of crack propagation]), the presence of branching cracks, and rivet-to-rivet fracture features.196 Deformation associated with a fracture indicated how the pieces on each side of the fracture were moving relative to each other as the fracture occurred.197 Witness marks demonstrated the direction of motion of the structure as it separated and deformed. All of these evaluations provided the Sequencing Group with information about initial areas of separation. The Sequencing Group also used stress analysis198 to reinforce that the proposed scenarios for the breakup sequence were consistent with structural properties and expected failure modes.199 196 Rivet-to-rivet fracture direction was determined by identifying a smaller crack that usually initiated from a rivet hole in front of the main (larger) crack and then turned to meet the main crack. With fractures thus divided into longer and shorter legs between rivet holes, the longer leg would indicate the primary direction of fracture propagation. 197 Fuselage skin fractures that did not contain out-of-plane deformation were classified by the Sequencing Group as “having occurred earlier in the sequence because these fractures must have occurred while the associated fuselage pieces were still aligned with each other nearly in the correct position.” Fuselage skin fractures that did contain out-of-plane deformation (either bending or tearing) were classified by the group as “having occurred later in the sequence because the associated pieces of fuselage must have been out of alignment with each other before the fracture occurred.” Fuselage skin fractures along a row of rivet holes that were consistent with in-plane loading (hoop or longitudinal tension with the possible presence of in-plane shear) were classified by the group as “having occurred earlier in the breakup sequence than fractures with out-of-plane bending or shear deformation.” 198 Stress analysis is the science of using calculations to estimate stress. Inputs into the calculations include information on, for example, material properties, component dimensions, structural conditions, and load amounts and directions. 199 In addition, Boeing calculated failure strengths for the various CWT components (spars and beams) and the pressures at which the CWT components would fail and provided the results to the Safety Board. For more information about the these calculated failure strengths and pressures, see section 1.16.4.9.

Factual Information 104 Aircraft Accident Report The Sequencing Group examined portions of the structure in great detail and then developed localized sequence segments based on the observable features in each portion. The group agreed that any proposed sequence for an individual portion of the structure had to comport with the general breakup sequence indicated by the overall recovered structure, including the early separation of forward portions of the WCS and a ring of fuselage material from forward of the WCS. Individual sequence segments were combined, until a cohesive and comprehensive breakup sequence, consistent with the overall body of evidence, was generated. The detailed examinations of the fuselage red zone pieces are an example of how these examinations were successful in determining an important segment of the breakup sequence. Figure 30 shows a schematic drawing of the lower portion of the fuselage skin in the area forward of the front spar. In this figure, the earlier fuselage skin fractures have been highlighted, and arrows have been added to indicate the direction of cracking in these earlier fractures. Of all of the fuselage fractures examined, only a limited number (all of which were on pieces recovered from the red zone) could be classified as earlier fractures (that is, consistent with in-plane loading). Further detailed examination of the rivet-to- rivet fracture pattern in these earlier fuselage fractures generated information on crack propagation directions and indicated that the earliest fracturing was of the lower fuselage, beginning at the front spar of the WCS. (The methodology used to determine the sequence of fracture in the fuselage red zone pieces was typical of the approach used for the entire airplane structure.) On the bases of its detailed examination of the recovered airplane structure (which, as previously indicated, considered fracture features and other physical evidence, recovery locations, etc.),200 the Sequencing Group determined that the initial failure of the airplane structure was the spanwise fracture of SWB3 at its upper chord. The sequencing report identified an overpressure event within the CWT as the cause of the fracture of SWB3. According to Boeing’s calculations, SWB3 is the weakest of the boundary members of the CWT and would be the first member expected to fail as pressure within the tank increased. As discussed in the next several paragraphs, evidence of the overpressure event within the CWT was apparent in the upward lifting of the center of the CWT upper skin as SWB3 failed at its upper chord, in the subsequent forward rotation of SWB3, and in the forward bowing of the front spar as it fractured. As the upper portion of SWB3 rotated forward, hinging on the still-attached lower chord, the upper chord impacted the aft side of the upper skin panel stiffener immediately forward of SWB3. (Figure 31 shows the approximate shape of this stiffener and its location before being struck by SWB3 as the beam rotated forward.) A geometrical layout of SWB3 and the upper and lower skin panels indicates that the forward rotation of SWB3 about its lower chord would result in an impact on the vertical flange of the stringer about 1.8 inches above the lower edge of the stringer (assuming no relative motion between the upper skin panel and SWB3). However, in the center of this stiffener, a witness mark was 200 See Metallurgy/Structures Sequencing Group Chairman’s Factual Report Sequencing Study, dated April 8, 1997.

Factual Information 105 Aircraft Accident Report Figure 30. A schematic drawing of the lower portion of the fuselage skin in the area

Factual Information 106 Aircraft Accident Report noted at a distance of only 0.9 inch above the lower edge of the stringer. The difference between these values represents an upward vertical displacement of 0.9 inch between the upper and lower skin panels along the airplane’s centerline when SWB3 impacted the stringer. The distance of the witness mark from the bottom of the stringer’s vertical flange gradually increased at positions further outboard, indicating lesser amounts of upward vertical displacement outboard of the centerline. According to the sequencing study, the location of the marks left on the stiffener by SWB3 indicate that the upper skin of the CWT was likely bowed upward, apparently also as a result of an overpressure event within the CWT. Continued forward and downward rotation of the top of SWB3 caused the upper end of SWB3 to impact the stiffeners on the aft surface of the front spar about 12 inches below the upper skin panel. This impact left a distinct set of marks on the front spar and initiated multiple failures near the top of that spar. (Figure 31 also shows the approximate orientation between the front spar and SWB3 as the aft side of the front spar was impacted by the upper end of SWB3.) Geometric evaluation and physical evidence indicated that the front spar was intact and in place when it was contacted by the upper end of SWB3. (The location of these SWB3 impact marks on the front spar was a major factor in the Sequencing Group’s determination that fracture of the upper portion of SWB3 was the initial failure in the airplane structure.) According to the sequencing study, impact of SWB3 with the aft side of the front spar severely damaged the front spar stiffeners and initiated fractures in the front spar’s upper chord. Overpressure escaping from the CWT caused the front spar to bulge forward as it failed along the upper chord; this bulging resulted in two forward-protruding lobes on the front spar, one on each side of the spar centerline. The sequencing report attributed the formation of the two lobes to the inertial resistance provided by the two potable water bottles attached to the center of the forward side of the front spar. These bottles were full when the airplane left JFK, and their combined weight was more than 3,000 pounds. As the front spar bulged forward, fractures developed near the center of each of the two lobes. In addition, the front spar was further damaged when portions of SWB3 penetrated the aft side of the front spar as SWB3 continued to rotate forward and down. The Sequencing Group determined that the upper chord of the front spar then completely separated from the WCS upper skin panel, and the overpressure within the CWT forced the WCS lower skin panel and the forward end of the keel beam downward. Stress analysis performed as a part of the sequencing study showed that the continuing downward keel beam motion increased the stresses in the ring chord and fuselage skin adjacent to the front spar. The front spar stiffener at LBL 18 was not bent as far forward as the others, indicating that there was limited forward rotation of the front spar in this area before the ring chord separated at the bottom of the stiffener. Fractures on the right side of the front spar continued into the lower pressure bulkhead,201 then continued through the ring chord and into the fuselage skin just in front of the front spar, at stringer 40 right (see figure 30). 201 The lower pressure bulkhead extends between the lower chord of the front spar and the ring chord.

Factual Information 107 Aircraft Accident Report Front Spar SWB 3 (Rotated Forward) WCS Lower Skin Top of Intercostal STA 990,42 WL 17.78 Approximate location of witness marks on the aft side of the upper skin panel stiffener located just forward of the upper end of SWB3 Location of witness marks on the aft side of front spar stiffeners Initial Position of SWB3 Figure 31. Diagram showing the approximate shape of the upper skin panel stiffener and its location before being struck by SWB3 as the beam rotated forward.

Factual Information 108 Aircraft Accident Report On the basis of cracking directions of the fuselage skin, the Sequencing Group determined that the initial fuselage skin cracking (at stringer 40 right just forward of the front spar, about STA 1000) propagated forward and toward the bottom center of the airplane, then continued circumferentially in both directions and back toward the front spar on the lower left side. This fuselage cracking then quickly progressed202 around three sides of a large piece of fuselage belly structure (subsequently identified primarily as piece LF6A). See figure 30 for a diagram of this cracking in the fuselage; piece LF6A is located in the center of this figure. According to the sequencing study, the combined load of normal cabin pressurization and vented overpressure from the CWT/WCS generated a downward force on this large section of the fuselage belly structure and resulted in additional downward loading on the keel beam. Stress analysis showed that these loads were sufficient to cause separation of the forward portion of the keel beam from the WCS lower skin panel and then to cause the keel beam to fracture about 22 inches aft of the mid spar. The report indicated that when the large piece of fuselage belly structure (primarily piece LF6A) separated, a large opening in the bottom of the fuselage resulted. Pieces from the WCS (primarily pieces from SWB3, the front spar, and the manufacturing access door from SWB2) exited the airplane through this large opening. As previously discussed, SWB2 contains a removable maintenance access door (located just to the left of the SWB2 centerline) and a “permanently” sealed manufacturing access door (located just to the right of the SWB2 centerline). The Sequencing Group noted that the manufacturing access door (with an attached piece of the web of SWB2) was recovered from the red zone and identified the following three possible reasons for the separation of this door early in the accident sequence: (1) internal pressure generated as a part of the initial overpressure event created a load that resulted in the separation of the door; (2) the downward movement of the forward portion of the keel beam as it separated from the lower surface of the WCS created a downward loading on SWB2, resulting in separation of the door; or (3) a combination of (1) and (2). The sequencing study indicated that, as the belly structure separated, adjacent pieces of the remaining fuselage skin and structure continued to crack and tear. Nearly symmetric pieces of fuselage skin above the right side and left side of the large hole in the belly separated from the rest of the airplane in an outward, upward, and aft direction. A curl of metal was created on both of these two pieces at the final point of separation (the upper aft corner). After these pieces of fuselage skin separated, the hole in the fuselage extended across the entire bottom of the airplane between the main cabin window belts. According to the Sequencing Group, as the airplane continued to depressurize through the large hole in its underside, the nose of the airplane began to bend down, 202 Although the Sequencing Group did not determine specific timing for the events that it identified, explosive decompression testing showed that normal cabin pressure differentials would cause this type of crack in the fuselage skin to propagate in fractions of a second. (The experts involved in Fire and Explosion Group testing calculated that this fuselage cracking occurred in about 24 milliseconds.) In addition to normal cabin pressurization loads, the accident airplane’s fuselage structure was subjected to loads from the venting of the WCS overpressure.

Factual Information 109 Aircraft Accident Report creating compression stresses, in the window belts above the hole. The window belts collapsed from these compression stresses and compression buckling spread upward toward the crown of the airplane, where evidence of tension failure was found. Subsequently, pieces of fuselage skin began to separate from right to left across the top of the airplane; some of these pieces had curls similar to the two symmetric curls below the window belt. This loss of fuselage structure around the airplane’s circumference forward of the WCS resulted in the separation of the airplane’s forward fuselage from the remainder of the airplane, which included most of the WCS, the wings, the aft fuselage, and the empennage. According to the Sequencing Group, fire damage and soot deposit patterns on recovered wreckage indicated that some areas of fire existed on the main portion of the airplane as it continued in crippled flight after the loss of the forward fuselage.203 The study indicated that, after some period of crippled flight (about 34 seconds, based on information from witness documents), the right and left wings outboard of the outboard engines failed in upward bending overload. Next, the WCS failed in upward bending adjacent to the left wing. (The upper skin panel buckled in compression, and the lower skin panel failed in tension.) The compression buckling in the left side of the WCS upper skin panel continued aft through the left side of the horizontal pressure deck above the wing landing gear wheel well and into the body landing gear wheel well. The main landing gear beam was separated in upward bending below this area of compression buckling (about LBL 75), consistent with the upward bending failure of the WCS. The Sequencing Group determined that the external and internal soot deposit patterns revealed a distinct difference between structure that separated with the left wing (as a result of the upward bending failure of the WCS) and the remainder of the airplane. Lack of soot deposits on the large fuselage piece above the left wing and other fuselage pieces from the crown of the airplane indicated that these pieces separated with the left wing. A review of soot deposit patterns, fracture characteristics, and interface of the rear spar with upper and lower skin panels (see the earlier discussion in this section regarding evidence from the reconstruction of the remaining WCS upper panel) indicated that the pickle fork fitting204 on the left side of the rear spar remained attached to the left wing’s lower chord and that the portion of the rear spar located to the right of LBL 21.5 remained attached to the right wing. Soot deposit patterns on the remaining right wing and aft fuselage pieces indicated that these pieces of the airplane remained together for some time after the left wing separated. However, damage characteristics and differences in soot deposit patterns indicated that the remaining aft fuselage separated from the right wing in stages.205 The sequencing study stated that upward crushing damage found on the lower portion of the aft fuselage (aft of about STA 1480) indicated that most of this portion of 203 This information is also consistent with observations recorded in witness documents (see section 1.18.4) and the Fire and Explosion Group Chairman’s Factual Report, dated August 22, 1997. 204 The rear spar body bulkhead is commonly termed the “pickle fork fitting.” The pickle fork fitting is a complex machined forging that provides one of the primary vertical load paths connecting the spars of the outboard wings and the WCS to the fuselage structure.

Factual Information 110 Aircraft Accident Report the fuselage struck the water as a large single piece. On the basis of the location of the crushing damage, the Sequencing Group determined that the aft portion of the fuselage was rolled slightly to the right and relatively flat when it impacted the water. Similar crushing damage was found on the lower portion of the fuselage on the nose section (forward of about STA 840). The location of the crushing damage indicated that this portion of the airplane was rolled about 45° to the right when it impacted the water. As previously discussed, severe crushing damage was not found on any of the pieces found in the red zone. According to the sequencing study, some aft fuselage pieces and wheel well structure (including the aft portion of the keel beam, the right main landing gear beam, and the right portion of the STA 1350 bulkhead) remained with the right wing for a period of time,206 accumulating additional soot from a fire source on the right wing, after the separation of the fuselage aft of STA 1480. Several right-side fuselage pieces contained heavy soot deposits and fire damage, indicating that they remained attached to the right wing during an intense fire. A right-side fuselage piece that was recovered attached to the right wing was severely burned. According to the sequencing study, severe fire damage on many portions of the WCS that were not recovered from the red zone (including the far right side of SWB3, the right two-thirds of SWB2, the right portion of the WCS upper skin panel, and the rear spar near BL 0) indicated that these areas remained attached to the right wing during the most intense fire. Although very heavy soot deposit and severe fire damage were noted on the exterior surfaces of the right rear portion of the WCS, the interior surfaces in this area (including the aft portion of the right side-of-body rib) did not contain fire damage or soot 205 Before, during, and after the Sequencing Group’s study of the airplane’s breakup sequence, Boeing conducted separate analyses of several portions of the breakup sequence using a computer model of the 747-100 fuselage from STA 540 to 1480, which included most of the WCS box. The computer model was adapted to simulate the failure of SWB3 and the front spar as described in the previous section. For the purposes of these analyses, a sustained overpressure of 25 pounds per square inch (psi) was assumed in the WCS. According to Boeing, it used 25 psi because it was somewhat higher than the pressure at which Boeing personnel would expect the SWBs to fail (see section 1.16.4.9). The fuselage was pressurized to 4 psi cabin pressure differential. Boeing also performed wing bending moment analyses to determine the effects of the separation of the forward section of the fuselage. These analyses assumed that the aft fuselage and wings would pitch up as a result of the sudden aft movement of the c.g. Boeing’s analyses showed that at a high AOA and a 5.5 to 6 G load factor, the wing tips would fail, and the WCS would continue to carry the predicted loads. When the aerodynamic loading assumptions in the analyses were modified to account for the wing tip separation, the simulation showed that an additional 1 G increase in load factor would result in buckling (and ultimate failure) of the upper skin panel of the WCS, consistent with the upward bending failure of the WCS described by the Sequencing Group. According to Boeing’s wing bending analyses (wing tip on and wing tip off), SWB2 must have been sufficiently intact (after separation of the forward fuselage) to provide substantial support to the WCS upper skin panel. According to a January 20, 2000, letter from Boeing, its computer modeling and wing bending moment analyses did not reveal any inconsistencies with the basic findings described in the Safety Board’s sequencing report. 206 The Sequencing Group was unable determine how long each of these pieces remained with the right wing as the pieces of wreckage fell to the water.

Factual Information 111 Aircraft Accident Report deposits. The Sequencing Group determined that this was evidence that the right rear portion of the WCS remained largely intact until water impact. The sequencing study established that the most intense fire effects were limited to the right wing, portions of the WCS, and a limited amount of fuselage structure above the right wing and that the most likely source of fuel for this fire was the right wing inboard fuel tank. Many of the fractures from the portion of the airplane with the most intense fire effects did not contain soot deposits, indicating that significant breakup damage occurred as the intensely fire-damaged structure impacted the water. In summary, according to the sequencing study report, the breakup sequence was as follows: • An overpressure within the CWT initiated a failure at the top of SWB3. • The top of SWB3 rotated forward and down and impacted the aft side of the front spar. • The front spar bulged forward in two lobes, one on each side of the potable water bottles mounted in the center of the forward side of the front spar. • Cracking on the right side of the front spar progressed downward, through the lower-pressure bulkhead and ring chord, and entered the fuselage. • Fuselage cracking propagated dynamically around a large piece of belly structure, which separated, creating a hole through which WCS structure was ejected from the airplane. • The forward portion of the keel beam was peeled off of the lower surface of the WCS, and the keel beam separated in two pieces aft of the mid spar. • Fuselage pieces on each side of the hole in the belly structure began to separate upward, outward, and aft. • The window belts above the hole in the lower fuselage buckled, and this compression buckling spread toward the top of the airplane. • Pieces of fuselage separated across the top of the airplane, thereby completely separating the forward fuselage from the remainder of the airplane. • The main portion of the airplane (including the wings, most of the WCS, and the aft fuselage) continued in crippled flight for a period of time. • The wing tips separated at the outboard engines. • The WCS separated adjacent to the left wing. • The fuselage aft of STA 1480 separated from the remainder of the WCS and the right wing. • Other structure separated from the right wing and remaining portion of the WCS. The Sequencing Group also examined the reconstructed portion of the airplane in areas where structure appeared to be missing. For example, an apparent hole (2 to 3 feet long with about a 5 feet circumference) was visible in the fuselage structure above the

Factual Information 112 Aircraft Accident Report main portion of the pickle fork fitting at the upper left rear corner of the WCS. However, the Sequencing Group’s report indicated that examination of the fuselage skin surrounding the apparent hole revealed that most, if not all, of the fuselage skin that appeared to be missing was present in folded skin attached to adjacent structure. All of the structural pieces in the vicinity of this “hole” were recovered from the green zone, indicating that none of the pieces from this area separated early in the breakup sequence. The Sequencing Group determined that the features of the apparent hole were consistent with the compression buckling failure of the left side of the WCS associated with the loss of the left wing later in the breakup sequence. The Sequencing Group report did not associate any of the apparent large holes in the structure with the initiation of the airplane breakup. In addition, the sequencing study report stated that “one noteworthy aspect of the structural breakup characteristic is the exceptional degree of symmetry between right and left sides. Starting with SWB3 and forward in the sequence there is the suggestion of a very uniform driving force.” 1.16.4 Additional Metallurgical, Material, and Structural Testing and Information 1.16.4.1 Metallurgical Examination of Several Small Holes in the Accident Airplane’s Structure The Safety Board examined the recovered wreckage for evidence that the airplane’s breakup was initiated by penetration of the CWT by a small, high-velocity fragment (generated, for example, by explosion of a missile warhead near the airplane or of a high-energy explosive within the airplane). Members of the Structures Group identified 196 relatively small holes in the accident airplane’s structure that they considered to be in an appropriate location and of an appropriate size and shape to have resulted from such a fragment. These holes were then examined in detail by Safety Board metallurgists and others to determine if they had characteristics of high-velocity penetrations. At the Safety Board’s request, Boeing created test plates with a variety of high- and low-velocity penetration characteristics, which were then compared with the holes in the accident airplane wreckage. To produce these test plates, Boeing personnel fired fragments of various sizes and materials (to simulate missile warhead fragments) at target plates of various thicknesses and materials (corresponding to those found in the accident airplane’s WCS). Boeing also measured each fragment’s velocity when it impacted the test plate. Examination of the holes and impact marks on the test plates revealed that holes resulting from high- and low-velocity penetrations each had distinctive damage characteristics. The approximate impact velocity at which the features transitioned from high- to low-velocity (as defined below) was a function of the thickness of the impacted material and the size and material of the impacting fragments. For example, it was determined that 1/4-inch to 3/8-inch steel cubes impacting a 0.10-inch-thick aluminum plate would produce low-velocity characteristics at impact speeds less than or equal to 1,000 feet per second

Factual Information 113 Aircraft Accident Report (fps) and would produce high-velocity characteristics at impact speeds greater than or equal to 1,500 fps. Characteristics of high-velocity penetrations were as follows: • Splashback—high-velocity penetrations caused material around the perimeter of the hole on the entry side of the plate to deform in the direction opposite to the motion of the penetrating fragment. This feature occurred for high-velocity impacts regardless of whether they resulted in full penetration, partial penetration, or just impact marks. • Exit deformation or breakout—similar to splashback but on the exit side of the test plate. Passage of the fragment through the test plate generated local deformation or shear breakout of material around the hole. • Hole wall characteristics—high-velocity penetrations created hole walls that exhibited melted and resolidified material adjacent to the entry side (including transferred material from the penetrating fragment), severe shear deformation, and multiple shear cracks. • Overall deformation—high-velocity penetrations did not produce significant overall membrane deformation in the direction of motion of the penetrating fragment. Characteristics of low-velocity penetrations were as follows: • Splashback—low-velocity penetrations did not cause splashback. • Hole wall characteristics—low-velocity penetrations created hole walls that appeared to be generated by fracture of the test plates, resulting in elongated ductile dimples throughout the entire thickness of the plate. No melting was found on the low-velocity holes. • Overall deformation—low-velocity penetrations produced more overall membrane deformation in the direction of motion of the penetrating fragment. An initial evaluation showed that many of the holes in the recovered airplane wreckage were obvious penetrations from the inside of the structure outward, contained substantial deformation adjacent to them, and generally had some amount of impact damage associated with them consistent with low-velocity penetration by a structural member. Other holes were actually tears or penetrations in the structure with minimal associated missing material. On the basis of these observations, all but 25 of the 196 holes were determined not to have characteristics of high-velocity penetration. The Safety Board’s more detailed examinations of the remaining 25 holes revealed that 23 of the holes—all associated with the WCS—did exhibit characteristics of low-velocity penetration. These holes exhibited no evidence of splashback, and significant deformation was observed in the surrounding material. Only two holes had any characteristics of high-velocity penetration, and these holes also exhibited some low-velocity penetration characteristics. Both holes were about 3/16 inch in diameter and were located in the horizontal pressure deck above the main landing gear bay (aft of the WCS/CWT). The hole in piece LF137 was located in the pressure deck at STA 1457 and LBL 110. The chipped-out metal on the lower surface of

Factual Information 114 Aircraft Accident Report and the exit deformation associated with this hole were consistent with penetration by a fragment moving downward and slightly aft. The hole in piece RF60 was located in the pressure deck at STA 1452 and LBL 62. The chipped-out metal on the lower surface of and the exit deformation associated with this hole were consistent with penetration by a fragment moving downward and slightly inboard. Both holes exhibited the following features: • lack of overall deformation in the sheets around the holes; • no splashback; • chipped-out metal on the lower surface of the sheets on one side of the holes; and • smooth hole walls, generally perpendicular to the surface, with some exit deformation on the lower surfaces. Because these holes contained features characteristic of both low-velocity holes (no splashback) and high-velocity holes (lack of overall deformation), it was difficult to determine the likely impact velocity in that area. However, on the basis of the direction of the penetrations and their locations relative to each other, it was determined that the penetrating objects for the two holes did not originate from a common point, nor did they originate from a point outside the airplane. A portion of piece LF137 that contained one of the holes was cut from the piece and sent to the Safety Board’s Materials Laboratory for further examination.207 A bench binocular microscopic examination (using magnifications of up to 70 X) of this portion of piece LF137 revealed a crescent of deformed material on the upper surface of the piece, adjacent to one side of the hole. The hole was slightly elongated in the direction of the crescent; the hole diameter at the crescent was 0.19 inch, whereas the perpendicular diameter was 0.17 inch. Examination of the hole using a scanning electron microscope (SEM) revealed that much of the hole wall was covered by deposits that were mostly composed of mud-covered oxides. Portions of the hole with fewer deposits within the deformed crescent exhibited parallel lines consistent with metal deformation smearing. EDS examination of various areas on the removed piece generated spectra typical of 7075-T6 aluminum alloy,208 the specified material for the piece. In some places, spectra showed traces of oxygen, sulfur, and chlorine. No evidence of melted and resolidified metal was noted on any portion of the hole wall. 1.16.4.2 Metallurgical Examination of Fatigue Cracking During their examination of the recovered pieces of the WCS, investigators observed evidence of several fatigue cracks.209 All of the fatigue cracks detected during structural examinations were evaluated by the Sequencing Group as a part of the 207 The hole in piece RF60 was directly adjacent to the steel framework supporting the reconstructed airplane and was much more difficult to cut out without removing the entire piece. Therefore, because the holes in pieces RF60 and LF137 were so similar in appearance, only the hole in LF137 was examined in the laboratory. 208 7075-T6 is an aluminum alloy with primary alloying elements of zinc, magnesium, and copper.

Factual Information 115 Aircraft Accident Report determination of the breakup sequence. Small preexisting fatigue cracks were observed in the front spar vertical stiffener shear ties at RBL 83.24 (lower), RBL 75.92 (upper and lower), LBL 75.92 (upper and lower), and LBL 83.24 (lower). These cracks were all located in the shear tie radius near the base of the leg that attaches to the vertical stiffener near the aft edge and had a maximum length of 0.20 inch. These shear ties are subject to inspection per Boeing SB 747-57-2249.210 Small fatigue cracks were also found in the shear tie of the LBL 75.92 and LBL 33.99 longitudinal floorbeams where they intersected the front spar upper chord at STA 1000.211 The LBL 75.92 shear tie had a 0.15-inch fatigue crack emanating from the aft side of the bolt hole and a possible 0.125-inch fatigue crack emanating from the forward side of the hole. The LBL 33.99 shear tie had a 0.25-inch fatigue crack emanating from the forward side of the bolt hole. Additionally, fatigue cracks were found in the lower chord of the front spar. The cracks were in the horizontal leg of the chord and initiated from the chord’s fillet radius just outboard of the underwing longeron splice fittings at both RBL and LBL 80. The fatigue crack at RBL 80 was about 1.2 inches long and about 0.10 inch deep, whereas the fatigue crack at LBL 80 was about 1.45 inches long and about 0.12 inch deep (about 1/3 of the chord’s thickness). This region of the accident airplane had been modified in 1982 (in accordance with SB 747-53-2064, which addressed adjacent ring chord cracking) by incorporating two fittings on the WCS lower skin panel and a corresponding double fitting on the fuselage skin. These fittings are adjacent to the underwing longeron splice fitting and provide an alternate load path for the longeron forward/aft loads. The sequencing report noted that the postmodification configuration was very stiff and significantly limited further deflection; without continued deflection, fatigue crack growth cannot continue. Therefore, the Sequencing Group determined that the fatigue cracking observed in the recovered pieces of the accident airplane existed before these fittings were installed. The Sequencing Group further noted that the propagation of the overstress fracture through the fillet radius during the overpressure event coincidentally exposed these two areas of localized, preexisting fatigue cracking in the front spar lower chord. 209 Although the accident airplane’s structure contained minimal preexisting corrosion damage, the Sequencing Group’s study indicated that this damage would not have affected the breakup of the airplane. Further, the Sequencing Group determined that none of the small fatigue cracks that were found on some parts of the airplane (as discussed in this section) had coalesced into a propagating crack that could have led to the in-flight breakup. 210 According to Boeing personnel, the company has received reports from 747 operators observing cracks ranging from 0.50 to 1.5 inches long without complete part failure. 211 According to the sequencing report, the front spar upper chord at STA 1000 is a secondary attachment for the floor structure and was not involved in carrying primary airframe loads.

Factual Information 116 Aircraft Accident Report 1.16.4.3 Metallurgical Examination of the Fuselage Joint Between Sections 41 and 42 The Safety Board was aware of concern about possible assembly problems with the fuselage joint between sections 41 and 42 (which extend forward and aft, respectively, from STA 520) on 747s212 and considered the possibility that a failure at this joint might have occurred, initiating the breakup sequence. This joint area was wholly contained within the forward fuselage section that the Sequencing Group identified as having separated from the airplane early in the breakup sequence. Overall examination of the forward portion of the airplane showed that sections 41 and 42 exhibited uniform crushing damage that extended across the bottom of the fuselage from about 3 feet below the left-side main cabin windows (S-39L) to above the right-side main cabin windows (S-14R). This damage was consistent with this section of the airplane impacting the water intact in a right-wing-low attitude. The structures examination also revealed that portions of the joint between sections 41 and 42 were separated during the water impact, whereas some portions remained intact.213 The portions of the STA 520 joint that separated were examined for evidence of preexisting fatigue or other preexisting damage. The Safety Board’s examination of this joint revealed that all fractures were typical of overstress separations, with no evidence of fatigue, fretting, or significant corrosion. 1.16.4.4 Metallurgical Examination of the Forward Cargo Door The Safety Board also considered the possibility that the forward cargo door (the forward edge of which is located several feet aft of STA 520 on the lower right side of the fuselage) separated from the accident airplane in flight and that this separation initiated the breakup sequence. The Board examined the pieces of the forward cargo door, which were recovered from the yellow zone. All eight of the latching cams at the bottom of the door were recovered attached to pieces of the lower end of the door and were in the latched position. Additionally, the latching cams and pieces of the cargo door remained attached to the pins along the lower door sill. The hinge at the top of the door was broken into several pieces, but the hinge pin still held the various pieces of the hinge together. There was no evidence to suggest that this hinge separated. The forward cargo door exhibited severe crushing deformation and fragmentation, very similar to damage observed on the adjacent fuselage structure. 212 In conversations with Safety Board staff, Boeing personnel indicated that because the shape and size of the ends of sections 41 and 42 could vary during the manufacturing process, extra effort was sometimes required to fit these sections exactly together. 213 The fuselage joint between sections 41 and 42 was not separated across the top of the airplane (between S-2L and S-5R) or along portions of the right and left sides (between S-18L and S-39L, S-44L and S-47L, S-19R and S-28R, and S-40R and S-45R).

Factual Information 117 Aircraft Accident Report 1.16.4.5 Metallurgical Examination of Nose Landing Gear Doors and Surrounding Structure The left aft nose landing gear door was heavily damaged in a manner consistent with other parts recovered from the yellow zone and with many other pieces from the forward portion of the fuselage. However, the right and left forward and the right aft nose landing gear doors exhibited relatively little damage and were recovered from the red zone with other airplane pieces that the sequencing report indicated had separated early in the breakup sequence. Further, the hinges from some of these doors appeared to have overtravel damage, indicating that the doors may have been forced inward. After careful examination of the nose landing gear doors and pieces of the surrounding structure, the Sequencing Group determined that the doors did not overtravel inward a significant amount and that the apparent overtravel damage to the hinges could have occurred after the doors opened or separated. Subsequent teardown inspection of the nose landing gear door actuator revealed that the actuator’s locking mechanism was not damaged and was within specifications, consistent with the Sequencing Group’s failure scenario that the nose landing gear doors may have opened during the initial stages of the breakup and then been torn off by exposure to the air stream.214 1.16.4.6 Examination of Brown Splatter Material As previously discussed, parts of the WCS and portions of the cabin interior above and forward of the WCS were found to have splatterlike deposits of a dark brown rubbery (spongy) material. The highest concentration of these deposits appeared on the top surface of the WCS near a long duct that was fastened to the top surface of the CWT. Samples of this brown splatter material were examined, the features of the deposits were recorded in detail, and their composition and physical characteristics were determined by chemical analyses. At the Safety Board’s request, several independent laboratories performed analyses on this splatter material.215 Chemical analyses by the laboratories were consistent and showed that the dark brown splatter material was consistent with a polyurethane elastomer. This material was consistent with the flexible polyurethane material with which the long air conditioning duct located above the CWT was insulated. However, microscopic examination of the splatter material showed that some of the deposits were not uniform and had fiberlike materials embedded in the dark material. According to the splatter report, the other embedded materials or fibers were consistent with a “Nylon™ 6 series. The discolored fiber…appeared to be a fibrous material much like Azlon.”216 Examination of a long air 214 Cable and hydraulic lines for the nose landing gear control system are routed through the CWT area. It is likely that these systems would be disrupted early in the airplane’s break up sequence, resulting in a loss of hydraulic power. 215 For additional information about the splatter material, splatter pattern and chemical analyses, see Factual Report on Splatter Deposits, dated October 2000. 216 According to the Federal Trade Commission, Azlon is a generic name for a manufactured fiber in which the fiber-forming substance is composed of any regenerated naturally occurring protein (for instance, proteins from corn, peanuts, and milk have been used in such manufacturing applications). Azlon is commonly used in airplane carpeting and seat fabrics.

Factual Information 118 Aircraft Accident Report conditioning duct removed from the same area on a 747 airplane of similar age revealed the presence of similar fibers adhering to the outside surface of the duct. These fibers were determined to be consistent with the fibers in the carpeting and seat fabrics from that airplane. 1.16.4.7 Examination of Red/Brown-Shaded Substance Found on Passenger Seats During the Safety Board’s examination of recovered wreckage, investigators observed red/brown-shaded substances on several damaged passenger seats. These substances appeared as a thin coating, which covered the surfaces of interior components of the seatbacks. Specifically, these substances were found on the forward face (inside) of the plastic seatback, on the backward face (backside) of the metal seatback frame, and on the plasticized foam strips used to attach these components together. Examination revealed that similar-looking substances were found in other seatbacks throughout the airplane, many of which did not exhibit thermal and/or significant mechanical damage. According to Weber,217 the location and appearance of the red/brown-shaded substance was consistent with an adhesive used in the construction of the seats. Subsequent laboratory testing at NASA of several samples of the substance taken from the seatbacks identified these substances as being consistent with adhesives.218 1.16.4.8 Examination of Explosive Residue Examination of recovered wreckage revealed trace amounts of explosive residue on three samples of material from three separate locations in the airplane wreckage. These material samples were submitted to the FBI’s laboratory in Washington, D.C., with many other material samples for analysis. The pieces on which these traces were found were described by the FBI as a piece of canvaslike material and two pieces of floor panel; however, the exact locations of the traces were not documented. According to the FBI’s laboratory report,219 analysis of each of the three material samples revealed that they contained traces of different explosives: one contained cyclotrimethylenetrinitramine (RDX), one contained nitroglycerin, and one contained a combination of RDX and pentaerythritol tetranitrate (PETN). Subsequent investigation revealed that the accident airplane had been used for a dog-training explosive detection exercise at St. Louis-Lambert International Airport (STL), St. Louis, Missouri, on June 10, 1996. During that exercise, an airport police officer placed five training aids containing explosives (one of which was cracked and could have released small amounts of explosives) in various locations inside the passenger cabin. Training aids were placed in the following locations: (1) in row 1, in the center armrest compartment separating seats 1 and 2; (2) in a small closet at the rear of the upper 217 Weber is the manufacturer of the seats located in the passenger cabin region located above the CWT, in zone C. 218 For further information, see the Factual Report on Red/Brown-Shaded Substance Found on Passenger Seats, dated October 2000. 219 See FBI file No. 265A-NY-259028, dated March 4, 1997.

Factual Information 119 Aircraft Accident Report deck; (3) in row 10, inside the rear pouch of the seat back in front of seat 9; (4) in row 20, in the overhead compartment above seats 1 and 2; and (5) beside exit door R3 (see figure 20 in section 1.6.3.2 for an airplane diagram).220 1.16.4.8.1 FAA Studies on the Effects of Sea Water on Explosive Residue Contamination FAA personnel at the FAA’s William J. Hughes Technical Center in Atlantic City, New Jersey, conducted tests to study the effects of sea water on cloth and aluminum airplane parts that had been exposed to explosives contamination.221 Pieces of aluminum from the wing of a commercial airplane and pieces of airplane seat covers were contaminated with explosive residue by manually deposited explosives and by exposure to an actual explosion and were then immersed in sea water. In both cases, when the cloth and aluminum airplane parts were examined after 2 days of immersion in sea water, the explosive residues were completely dissipated. The FAA’s report concluded, “our experiments have shown that their [sic] is very little likelihood that blast deposited explosive materials remain very long on cloth or aluminum aircraft parts after immersion in [sea water].” The FAA attributed this, in part, to the explosive residues being “somewhat soluble in [sea water].” 1.16.4.9 Wing Center Section and Center Wing Fuel Tank Structural Response and Failure Information Boeing performed structural response calculations to determine the failure pressures and response frequency222 for the beams and spars in the WCS/CWT.223 On the basis of their calculations, Boeing engineers generated a range of pressure differentials required to fail these members.224 The failure pressure differentials for the SWBs and spars of the WCS/CWT are summarized in table 5. The “minimum” pressure column in the table corresponds to the “minimum initial failure strength” determined by conventional stress analysis methods used in commercial airplane design to ensure that minimum strength will always exceed regulatory requirement. The “maximum” pressure column in the table corresponds to the “estimated maximum initial failure strength” determined by using detailed finite element computer models. 220 For additional information, see the Hazardous Materials—Security Group Chairman’s Factual Report, dated April 27, 1999. 221 For additional information, see the FAA’s report, “Immersion Studies of Aircraft Parts Exposed to Plastic Explosives,” which is appended to the Safety Board’s Hazardous Materials—Security Group Chairman’s Factual Report. 222 Frequency analysis of the structural members indicated that these members would respond statically to the rates of pressure differences generated by the combustion processes. 223 Because nobody has tested a WCS to failure, the failure strengths predicted by Boeing were based entirely on traditional analytic methods and numerical computations. 224 See Safety Board Memorandum to the TWA docket, “Boeing Submission,” dated June 5, 2000. In addition to the assumptions identified in the memorandum, it should be noted that the failure pressures that were calculated do not account for progressive failures in which the failure pressure for a beam may be decreased because of failure or damage of a neighboring beam.

Factual Information 120 Aircraft Accident Report 1.16.5 Jet A Fuel Vapor and Fuel Tank Research and Testing During its investigation of the TWA flight 800 accident, the Safety Board was hampered by the lack of available pertinent research data regarding the flammability and other characteristics of Jet A fuel and its behavior in airplane fuel tanks. In an attempt to develop data that would be useful in the investigation, the Board assembled a team that included the most renowned experts in the combustion and fuel-related fields and, with the help of these experts, developed and implemented a research program. The objectives of this research program were to (1) develop an understanding of the thermal and vapor environment within the 747 CWT; (2) determine the chemical and physical properties, flammability, and combustion behavior of Jet A fuel; and (3) develop computer models of the combustion process within the 747 CWT to assist in the determination of the ignition location. The researchers performed laboratory experiments, scale-model tests, and numerical simulations to examine the explosion of Jet A fuel/air vapor under conditions similar to those that existed within TWA flight 800’s CWT at the time of the accident. Specifically, the researchers wanted to identify the flammability limits and combustion behavior of Jet A fuel and the propagation of flames through the compartments within the CWT structure. Figure 32 shows a flow chart of the fuel-related research conducted to support this investigation. The FAA has certificated commercial jet airplanes based on the assumption that fuel tanks are considered to always be flammable and has required manufacturers to demonstrate that any energy inside the tank would be below the MIE for Jet A vapors to ensure safe operation of the airplane. However, at the time of this accident, specific information about fuel tank flammability and Jet A thermochemistry was largely unavailable. The research conducted during this investigation enabled analysis of the flammability of aircraft fuel tanks and provided a scientific basis for evaluating methods of reducing fuel tank flammability, as identified in safety recommendations previously issued to the FAA.225 Table 5. 747-100 wing center section/center wing fuel tank SWBs and spars failure strengths. Component Minimum (psi) Maximum (psi) Front spar 20 25 to 30 SWB3 20 25 SWB2 20 30 to 35 Mid spar 20 35 to 40 SWB1 25 45 to 50 Rear spar 30 45 to 50 225 For more information about these safety recommendations, see section 1.18.3.

Factual Information 121 Aircraft Accident Report Figure 32. A flow chart of the fuel-related research conducted to support this investigation. Probable Ignition Location Full-scale computations 1/4 scale CWT combustion experiments Fuel Chemistry Characterization Early Event Damages in Wreckage Structural Failure Analysis Indicates areas of basic research that were developed for the investigation. Flame-front quenching experiments Flammability of Jet A fuel vapors Fuel weathering Fuel Mass Loading Ignition Energy of Jet A Vapors Ground testing Flight testing Rules-based system analysis Combustion properties of Jet A CWT thermal and vapor environment In-tank vapor sampling Flammability Exposure and Reduction Analysis Safety Board Recommendations to Reduce Flammability Code Development and Validation Accident Investigation of CWT Explosion

Factual Information 122 Aircraft Accident Report The research associated with this accident investigation included the use of standardized tests, engineering models, state-of-the-art scientific techniques, development of new methods, and extension of existing methods. For example, the research team adapted numerical tools and developed computational models for use in full-scale simulations of 747 CWT combustion that explored the effects of various parameters and assumptions (such as ignition locations within the CWT). Additionally, a computational rules-based analysis method was developed to compare the simulations against the observed damage to the recovered wreckage. (The goal of this computational effort was to narrow down the number of probable ignition source locations within the CWT.)226 Flight and ground tests were performed to determine, as accurately as possible, the thermal and vapor conditions that were present inside the accident airplane’s CWT at the time of the accident. These tests, in part, identified specific conditions present in the accident airplane’s CWT (temperature, altitude [pressure], mass loading,227 and weathering)228 considered important in identifying the behavior of the combustion that took place within the accident airplane’s CWT. Using this information, all subsequent analyses and tests were focused on conditions that best approximated those of the accident airplane at the time of the accident. Analysis of the fundamental chemical and physical properties of Jet A liquid and vapor, calculation of vapor pressure, and molecular weight produced information that was then used to predict fuel vapor concentrations in the accident airplane’s CWT at the time of the accident. On the basis of hundreds of tests, conducted over a wide range of conditions, the research team was able to identify the conditions (ignition energies, fuel/air mixtures) under which Jet A fuel combustion could occur and to quantify the behavior (flame speeds and peak pressures) that would likely result from such combustion. Two independent computer models, using different numerical codes (selected to complement each other), were developed to predict the propagation of combustion in a scale model and full-scale model of the 747 CWT. Hundreds of computer simulations were performed to develop and validate the models. The results of the tests conducted with the models showed the pressure differences that developed across the structural members that divide the 747 CWT into compartments. These models were then used to make calculations of Jet A combustion in a full-scale CWT geometry, for many different combustion scenarios. 226 The research efforts and their results are discussed further in subsections of this section. Additionally, the research efforts were extensively documented in a series of reports that were submitted to the Safety Board and are available in the public docket for this accident investigation. See subsections for specific report references. 227 Fuel mass loading refers to the measure of the amount of fuel relative to the entire volume of its container. 228 Weathering is the change in a liquid fuel chemical composition as a result of exposure to environmental conditions. An example involves heating and pressure changes to a vented aircraft fuel tank, where preferential evaporation of the lower molecular weight components of the jet fuel occurs, resulting in a redistribution of the chemical composition of the remaining liquid fuel.

Factual Information 123 Aircraft Accident Report Scale-model experiments were also used to validate the numerical analyses and to demonstrate the propagation of an explosion in a multicompartment fuel tank. During the scale-model testing, quenching229 was identified as an issue because of the complex nature of the CWT. As a result, additional experiments and engineering modeling were accomplished to address the issue of quenching. Ultimately, the results of the computer model research were used in an attempt to identify the location of probable ignition within the CWT. That effort required the use of physical evidence, data, and estimates derived from the investigation despite substantial uncertainties and possible interpretative bias. To address these issues, a quantitative technique based on statistical reasoning, called a rules-based analysis method, was developed. Before the rules-based analysis could be used to compare the results of the numerical simulations of the explosion process with the observations of damage to the airplane and estimates of structural responses within the 747 CWT, it was necessary to identify the damages that resulted from the initial combustion event. Because damages observed in the wreckage could have been caused by the initial overpressure event, the subsequent in-flight breakup, impact with the ocean, and/or fire, it was necessary to develop a consensus as to which damages resulted from the initial combustion event. Thus, Safety Board investigators and Boeing engineers identified these initial damages and assigned levels of confidence to each; these damages and levels of confidence were then coded into the rules-based analysis method. Additionally, Safety Board investigators and Boeing engineers estimated the pressures at which various CWT structural members would fail and assigned levels of certainty to each. (These uncertainties existed because a CWT had never been tested to failure. As a result, Boeing’s estimates provided a range of estimated failure pressures.) Through incorporation of numerical simulations, observed damages, and structural failure analysis, the rules-based analysis method provided an indication of how consistent each numerical scenario was with the observable damage to the wreckage and provided investigators with a means of comparing and evaluating each possible ignition source location within the CWT. Further, the rules-based analysis resulted in a scientifically based, quantitative method of analyzing the CWT combustion event in general. The following subsections describe the ground and flight tests, vapor sampling, Jet A fuel and vapor experiments, 1/4- and full-scale model tests, computer modeling, and the rules-based analysis method in greater detail. Additionally, sections 1.16.5.6 and 1.16.5.7 describe the full-scale 747 CWT explosion test conducted in Leicestershire, England, and the Boeing/USAF E-4B CWT fuel heating study, respectively. 229 Quenching is the extinguishment of a combustion flamefront; often as a result of decreased temperature or propagation through a passageway, such as an orifice or a vent.

Factual Information 124 Aircraft Accident Report 1.16.5.1 Testing Conducted to Identify the Conditions that Existed in the Accident Airplane at the Time of the Accident 1.16.5.1.1 747 Flight Tests at JFK In mid-July 1997, the Safety Board conducted a series of flight tests230 to obtain data regarding the operating temperatures, pressures, and accelerations within and around a 747-100 series airplane’s CWT under conditions similar to those that existed on TWA flight 800. The airplane used for these flight tests was a 747-121 leased from Evergreen Airlines.231 The Safety Board determined the type and location of additional sensors and instrumentation to be installed and developed the flight test procedures for its series of flight tests, with input from parties to the investigation. Additional instrumentation was installed in the test airplane (by Boeing)232 to measure the following: CWT ullage and fuel temperatures at 48 locations,233 internal and external CWT surface temperatures at 42 locations, air conditioning pack bay temperatures at 20 locations (beneath the CWT), air conditioning pack surface temperatures at 13 locations,234 vibration measurements of the CWT lower skin panel,235 and EMI data. In addition, temperature sensors were installed in the No. 3 fuel tank at each vent and near the high point of each fuel pump power conduit, on the inside surface of the top wing skin in the No. 3 fuel tank vent 230 In total, nine flight tests were conducted. Six flight tests were performed by the Safety Board and are documented in the Flight Test Group Chairman’s Factual Report, dated November 19, 1997. The remaining three flight tests were performed by Boeing and FAA personnel. The purpose of these three flight tests was to examine the effects of certain hardware modifications on heating in fuel tanks; the data from these flights are considered proprietary. 231 The 747-100 series included the -121 variant used in these flight tests and the -131 variant (the accident airplane). According to Boeing, the fuel systems in these two 747 variants are the same, except for the method of vent stringer flame protection—the accident airplane had an STP system (which was developed by Boeing for TWA after a TWA 707 fuel tank explosion in Rome, Italy), whereas the flight test airplane used a flame suppression canister. The 747-121 test airplane was flown by Boeing pilots under an experimental airworthiness certificate during the flight tests. In addition to the Boeing flight crew, the Safety Board’s Flight Test Group Chairman and Program Test Director and Boeing’s Test Director, Flight Analysis Engineer, and Flight Instrumentation Engineer were on board the airplane for all flight tests. For those tests during which vapor sampling was accomplished, a vapor sampling operator was also on board the airplane. Evergreen Airlines staff were used for mechanical dispatch, maintenance, operations, and ground support for the flight tests. 232 For additional information regarding instrumentation, see the Flight Test Group Chairman’s reports (Exhibit 23B), “Flight Test Plan” and (Exhibit 23E) “Test Item Requirements List (TIRL), Instrumentation Locations and Flight Test Schedule,” dated November 19, 1997. 233 Each fuel bay was instrumented individually to identify temperature variations throughout the CWT. 234 Temperature sensors were placed in the following locations on each air conditioning pack: on the engine bleed air duct near the flow control valve, at the water separator outlet, on the top of the heat exchanger inlet, and on the top of the compressor outlet. In addition, a temperature sensor was placed on the side support housing and on the heat exchanger exhaust louver. 235 It was postulated that the CWT might have been exposed to sufficient vibration to result in very small droplets of the remaining CWT fuel becoming airborne (known as lofting), resulting in a more flammable fuel/air mixture in the CWT. Examination of the vibration measurement data revealed that the CWT lower skin panel was not subject to vibration of the energy or frequency that would be necessary to produce fuel lofting.

Factual Information 125 Aircraft Accident Report stringer, and in the surge tanks (at four locations in the right surge tank and at three locations in the left surge tank). Evergreen Airlines provided ballast weight and arranged fueling such that the airplane’s weight and balance, dispatch fuel load, and takeoff fuel load matched those of TWA flight 800, as closely as possible, for test flights in which duplication of conditions was required. The Jet A fuel loaded in the CWT during the flight tests was originally loaded on an Olympic Airways 747 in Athens, Greece, and flown to JFK on a regular service flight, similar to the flight flown by the accident airplane before the accident flight. The fuel was purchased from Olympic Airways, unloaded from the Olympic Airways 747 CWT into a fuel truck, then loaded into the flight test airplane CWT before the first test flight. Six Safety Board flight tests were conducted with multiple variations in aircraft operations. One of these six tests, the TWA flight 800 emulation flight test, was designed to replicate the configuration, ground operation, and flight profile of the accident airplane as closely as possible. The following is an explanation of this flight test:236 • TWA Flight 800 Emulation Flight Test—During this flight test, the pilots attempted to duplicate TWA flight 800’s preflight actions/operations, takeoff, and ascent as closely as possible. The flight test airplane took off within 1 minute of the time of day that the accident airplane took off, 2 days before the 1-year anniversary of the accident flight. Slight variations from the TWA flight 800 climb profile were necessary to comply with ATC instructions; however, the overall climb profile matched that of the accident airplane within 1,000 feet, elapsed times within 1 minute, and airspeeds within 20 knots throughout the climb. • The flight test airplane’s CWT contained 50 gallons of Jet A fuel (obtained from the Olympic Airways 747 from Athens, Greece),237 and the main wing fuel tanks were refueled at JFK to approximate TWA flight 800’s fuel loads. During the refueling, the outside air temperature (measured on the tarmac near the airplane) was 88° F.238 The temperature of the fuel loaded on the airplane ranged from 88° to 91° F. Air conditioning pack Nos. 1 and 3 were operated at the “full-cold” setting for about 2 3/4 hours before the flight test pilots began to start the airplane’s engines. The airplane began to taxi for takeoff about 1957 and took off about 2021. The air conditioning packs were turned off for takeoff, and all three air conditioning packs were started after takeoff (in accordance with TWA procedures) and remained operational for the remainder of the flight. As the airplane climbed through 10,000 feet msl, the pilots initiated a crossfeed procedure outlined in the TWA Flight Handbook for fuel management. During the next 5 minutes, fuel tank No. 3 provided fuel to the 236 As previously stated, additional information regarding the other five flight tests is included in the Flight Test Group Chairman’s Factual Report, dated November 19, 1997. 237 Fuel from the Olympic Airways 747 CWT was used so that vapor samples taken from the test airplane’s CWT during the flight tests would more closely represent the weathered fuel in the accident airplane’s CWT. This fuel was tested after the flight test; its flash point was determined to be 116° F. 238 Meteorological records indicate that the temperature at JFK when the accident airplane departed was 82° F.

Factual Information 126 Aircraft Accident Report Nos. 1, 2, and 3 engines with both No. 3 boost pumps operating, while fuel tank No. 4 provided fuel to the No. 4 engine with both No. 4 boost pumps operating. For the remainder of the flight, the pilots performed the fuel management procedures described in the TWA Flight Handbook. The pilots flew the ascent profile recorded by the accident airplane’s FDR (as closely as possible) until the airplane passed through 13,700 feet msl, then continued to climb at a constant rate. The airplane leveled off at 19,000 feet msl and remained there for about 2 hours before it returned to JFK about 2241. Three CWT fuel/air vapor samples were taken during this flight test (during taxi for takeoff and as the airplane climbed through 10,400 and 14,200 feet msl). Examination of the temperature data collected during the emulation flight test indicated that the highest ullage temperature measured within the CWT was 145° F and that it occurred in the left mid bay just before the airplane began to taxi for takeoff. Examination of the temperature data also indicated that the highest ullage temperature measured at 13,700 feet msl was 127° F and that it occurred in the left mid bay (see figure 33). Table 6 shows the maximum and minimum recorded ullage temperatures at 13,700 feet msl during the emulation flight test.239 The Safety Board also measured the ambient air and component surface temperatures within the air conditioning pack bay. At the time that the flight test airplane was pushed back from the gate (after operating on the ground for 2 3/4 hours with the Nos. 1 and 3240 air conditioning packs operating), air conditioning pack component surface temperatures ranged from 250° to 350° F, and ambient air temperatures within the pack bay ranged from 148° to 228° F.241 239 Temperature sensors were located in the middle of each bay at three height locations: 3 inches below the top of the CWT (upper CWT), 3 inches above the bottom of the CWT (lower CWT), and halfway between the top and bottom of the CWT. Bays 1 and 2 also had temperature sensors located 3 inches in from the left sidewall and 3 inches in from the right sidewall, at the same height locations. 240 These are the farthest forward air conditioning packs, mounted just aft of the front spar on either side of the keel beam. 241 These temperature ranges reflect variations in the temperature sensor’s proximity to the operating air conditioning components. For example, the temperatures measured near the bleed air inlets to air conditioning pack Nos. 1 and 3 were at the high end of the range, whereas temperatures measured near the bleed air inlets to air conditioning pack No. 2 were at the lower end of the range, and the temperatures measured at the compressor outlets for air conditioning pack Nos. 1 and 3 were in the low- to mid-temperature range. After the airplane became airborne, these temperatures decreased, but not significantly enough to rapidly change the temperatures within the CWT.

Factual Information 127 Aircraft Accident Report Figure 33. Side view, top view, and three-dimensional view of wing center section/center wing fuel tank bays. Dry Bay Bay 1 Bay 2 Left Mid Bay Right Mid Bay Left Aft Bay Right Aft Bay Side View Top View 3D View Forward Forward Forward

Factual Information 128 Aircraft Accident Report As previously discussed, the CWT is configured within the airframe such that the air conditioning packs are located in an enclosed bay, directly below and very near242 the bottom surface of the CWT.243 Because of the high temperatures at which the air conditioning packs operate, the ambient air temperature within the pack bay increases when the air conditioning packs are operated. As a result of these elevated temperatures, heat in the pack bay is transferred into the CWT through its bottom surface. Some of this heat is transferred out of the CWT (for example, into the wing main fuel tanks or the main landing gear wheel well), and some of it remains in the CWT. This heat flow results in a significant increase in the temperature of the CWT fuel and ullage, which was shown in table 6. The temperature variations within the CWT are illustrative of this heat flow. In general, the hotter temperatures in the CWT ullage were located in the lower, center portions of the CWT (nearest the heat source), whereas cooler temperatures were measured around the sides and top of the CWT (where heat was transferred out of the CWT). Examination of the temperatures measured in the surge tanks, vent stringers, and the No. 3 fuel tank during the TWA flight 800 emulation flight test indicated that these temperatures were about the same or slightly warmer than the outside air temperature during the ground portion of the flight test (airplane temperatures of 85° to 90° F versus Table 6. A summary of the maximum and minimum recorded ullage temperatures at 13,700 feet msl during the emulation flight test. Ullage Bay Location Maximum Temperature in ° F (including temperature sensor height location) Minimum Temperature in ° F (including temperature sensor height location) Bay 1a—Center 117 (lower CWT) 114 (upper CWT) Bay 1—Left side 111 (lower CWT) 107 (lower CWT) Bay 1—Right side 110 (lower CWT) 101 (upper CWT) Bay 2b—Center 120 (lower CWT) 117 (upper CWT) Bay 2—Left side 110 (lower CWT) 102 (upper CWT) Bay 2—Right side 109 (lower CWT) 102 (upper CWT) Left Mid Bay 127 (lower CWT) 114 (upper CWT) Right Mid Bay 114 (lower CWT) 106 (upper CWT) Left Aft Bay 120 (lower CWT) 113 (upper CWT) Right Aft Bay 112 (lower CWT) 103 (upper CWT) a. In this section, the term “bay 1” refers to the fuel bay between SWB3 and SWB2. b. In this section, the term “bay 2” refers to the fuel bay between SWB2 and the mid spar. 242 The air conditioning packs’ distance from the bottom of the CWT varies from about 2 to about 12 inches. See figure 7 for a side-view diagram of the air conditioning packs/CWT. 243 The air conditioning packs are also located under the CWT in other Boeing and Airbus airplanes; however, in some Airbus airplanes, the air conditioning pack bays are ventilated. In contrast, in the DC-10, MD-11, and L-1011 series airplanes, the air conditioning packs are located in the nose, and in the Fokker F-100 and MD-80 airplanes, the air conditioning packs are located in the tail.

Factual Information 129 Aircraft Accident Report outside air temperatures of 82° to 88° F [depending on the time and location of the temperature reading]). As the test airplane’s altitude increased after takeoff, the temperatures measured in the surge tanks, vent stringers, and No. 3 fuel tank decreased. When the TWA flight 800 emulation flight test climbed through 13,800 feet, the temperatures in the surge tank and vent stringers had decreased to 68° F, whereas the temperatures measured in the No. 3 fuel tank had decreased to 65° to 75° F (depending on the temperature sensor location).244 1.16.5.1.1.1 Fuel Vapor Sampling and Analysis from 747 Flight Tests at JFK—Desert Research Institute Personnel from the Desert Research Institute (DRI), Boeing, and the Safety Board designed a vapor sampling system, which was installed and functionally tested on the flight test airplane before the first test flight.245 The sampling system consisted of preevacuated, 1-liter stainless steel sampling bottles,246 which were plumbed through a central manifold and mounted in the airplane’s forward cargo compartment. A stainless steel sampling tube extended from the manifold in the forward cargo compartment through the front spar and an access panel on SWB3. This sampling tube had an outside diameter of 1/8 inch, was 25 feet long, and terminated with an open end located about 12 inches aft of SWB3 within bay 2 (about 30 inches above the bottom of the tank and 35 inches left of the CWT centerline), where the fuel vapor samples were drawn. Vapor samples were collected during taxi and as the airplane climbed through about 10,000 and 14,000 feet msl during the emulation flight test. The vapor sample bottles were subsequently transported to DRI, where scientists measured the vapor samples for hydrocarbon fuel concentrations. Review of the data obtained from the emulation flight test revealed that the CWT vapor samples had fuel/air mass ratios247 of 0.034, 0.046, and 0.054 on the ground during taxi and as the airplane climbed through about 10,000 and 14,000 feet msl (see table 7). According to scientific literature248 and tests conducted by experts at the California Institute of Technology (CIT), the lower flammability limit (LFL) of Jet A fuel is at a fuel/air mass ratio of 0.032 to 0.038.249 244 For additional information regarding the flight test results, see Flight Test Results: TWA 800 Emulation Flight (Exhibit 23F). 245 For additional information regarding the vapor sampling mechanism and the handling and testing of the vapor samples collected, see the Flight Test Group Chairman’s Factual Report, dated November 19,

1. Also, see the DRI report, “Sampling and Analysis of Vapors from the Center Wing Tank of a Test

Boeing 747-100 Aircraft,” dated November 1997. 246 Two sampling bottles were used for each vapor sample acquisition. One bottle was used to purge the sampling line and manifold, and the other, subsequently, was used to collect a valid vapor sample. 247 The fuel/air mass ratio is a measure of the mass of fuel in a mixture divided by the mass of the air in that mixture. In the context of this flight test sample, it is a measure of the mass of the fuel in the ullage divided by the mass of the air in the ullage. 248 Nestor, L. 1967. Investigation of Turbine Fuel Flammability within Aircraft Fuel Tanks. Final Report DS-67-7. Naval Air Propulsion Test Center, Naval Base, Philadelphia, Pennsylvania. Also, Shepherd, J. E.; Nuyt, C. D.; and Lee, J. J. 2000. Flashpoint and Chemical Composition of Aviation Kerosene (Jet A). Graduate Aeronautical Laboratories, CIT. Explosion Dynamics Report FM99-4.

Factual Information 130 Aircraft Accident Report During subsequent flight tests, investigators collected additional vapor samples from the CWT ullage. The fuel in the CWT was not consumed, nor was the CWT refueled during the series of flight tests in which vapor samples were collected. Examination of the series of vapor samples showed that the vapor composition gradually changed through a process known as fuel weathering. Subsequent flash point testing (conducted at CIT)250 of liquid fuel samples collected at each flight test did not indicate a significant change in flash point (less than 3° F) as the fuel weathered during the series of flight tests. 1.16.5.1.2 Testing of Fuel Samples from TWA Flight 881 (Arriving at JFK from Athens, Greece) On October 1, 1996, a fuel sample (about 50 milliliters) was obtained from the CWT of a TWA 747 that had just arrived at JFK from Athens, Greece, as TWA flight 881. Because TWA flight 881’s CWT had been refueled in Athens and was believed to have encountered conditions (flight profile, thermal environment, and weathering) similar to those encountered by the accident airplane during its flight from Athens to JFK (before it departed as TWA flight 800), the Safety Board considered this fuel sample to be representative of the fuel in the accident airplane’s CWT when the overpressure event occurred. This fuel sample was taken to Saybolt International’s laboratories for standardized fuel testing. The flash point of this fuel was measured at 114° F, and it was noted that the sample contained an antistatic additive that resulted in the sample having 90 picosiemens/meter electrical conductivity.251 249 From May 29 to 31, 1998, Boeing performed additional ground tests, with technical support from the Safety Board, to investigate the 747-100 CWT thermal and vapor environment. These tests were conducted at Pinal Air Park in Marana, Arizona, using a 747-100 series airplane leased from Evergreen Airlines and were similar in scope to the JFK flight tests conducted by the Safety Board. Testing was performed in a hot ambient environment (outside air temperatures above 95° F), with all three of the airplane’s air conditioning packs operating. The tests were conducted in the following conditions: (1) a nearly empty fuel load in the CWT (50 gallons, similar to TWA 800), with uninsulated air conditioning packs; (2) 50 gallons of fuel in the CWT, with thermally insulated air conditioning packs; and (3) 12,000 pounds of fuel in the CWT, with uninsulated air conditioning packs. Temperature and vapor measurements of the CWT indicated that a flammable condition existed during ground operations during each of the three tests. For additional information, see Summary Data Report: B-747-100 Center Wing Tank Ground Testing at Marana, Arizona, dated January 20, 2000. Table 7. Fuel/air mass ratios and ullage temperatures measured at the bay 2 sampling port during the TWA flight emulation flight test. Sample Temperature of Ullage at Sample Location in ° F Fuel/air Mass Ratio Emulation flight test, taxi 123 0.034 Emulation flight test, about 10,000 feet msl 115 0.046 Emulation flight test, about 14,000 feet msl 117 0.054 250 Shepherd, Nuyt, and Lee.

Factual Information 131 Aircraft Accident Report 1.16.5.2 Laboratory Testing of Jet A Fuels—California Institute of Technology A review of Jet A combustion data available when the TWA flight 800 accident occurred revealed that insufficient research data were available to adequately address the specific issues germane to the characteristics of a CWT explosion.252 Therefore, the Safety Board contracted with explosion dynamics experts at the CIT Graduate Aerodynamics Laboratory to conduct a comprehensive experimental and analytical investigation of the combustion behavior of Jet A fuel. This included flammability research to identify conditions under which Jet A fuel/air mixtures are flammable and combustion research to determine the characteristics (for example, explosion peak pressures and flame speeds) of Jet A fuel combustion. The issues of ignition energy, temperature, altitude (pressure), mass loading, weathering, and fuel chemistry253 were investigated because of their criticality to the explosion of the CWT. The flammability research focused on defining the conditions at which Jet A fuel vapor was found to be flammable.254 A precision test fixture was developed to generate fuel vapors over a large range of temperature and pressure conditions, and an electronic spark system was developed to ignite the vapors while accurately measuring the ignition energy supplied. Hundreds of tests were performed255 to determine the flammability limits of the fuel vapor, as a function of ignition energy, fuel temperature, pressure (to simulate altitude), fuel mass loading, and fuel weathering. The test conditions were selected to 251 Electrical conductivity for fuel is the ability of the fuel to dissipate a static charge, and the unit of measure is picosiemens per meter. For additional information regarding the results of fuel tests conducted during this investigation, see Powerplants Group Chairman’s Factual Report, dated February 25, 1997. This fuel sample was also analyzed for chemical composition. For additional information, see the University of Nevada report, “Sampling and Analysis of Vapors from the Center Tank of a Test Boeing 747-100 Aircraft,” dated November 1997. 252 According to the experts at CIT, the Jet A flammability data at the time of the accident included limited data on flammability properties found in the industry standard references (Kuchta, J. M. et. al. 1985. Aircraft Mishap Fire Pattern Investigations. Final Report APWAL-TR-85-2057. Aero Propulsion Laboratory.; and Zabetakis, M. G. 1965. Flammability Characteristics of Combustible Gases and Vapors. Bulletin 627. Bureau of Mines.), much of which was without direct attribution. However, the CIT experts indicated that much of the Jet A flammability data that existed at the time of the accident appeared to have been derived from the following three technical reports: Nestor; Ott, E. 1970. Effects of Fuel Slosh and Vibration on the Flammability Hazards of Hydrocarbon Turbine Fuels within Aircraft Fuel Tanks. Technical Report AFAPL-TR-70-65. Fire Protection Branch of the Fuels and Lubrication Division. Wright Patterson Air Force Base, Ohio; and Kosvic et. al. 1971. Analysis of Aircraft Fuel Tank Fire and Explosion Hazards. Technical Report AFAPL-TR-71-07. Air Force Aero Propulsion Laboratory, Wright Patterson Air Force Base, Ohio. 253 Fuel chemistry variations commonly result from different formulations of Jet A fuel and can be affected by variations in fuel supply, fuel supplier, fuel handling, and/or mass loading. 254 For additional information regarding these tests, see CIT/Graduate Aeronautical Laboratory. 1999. Spark Ignition Energy Measurements in Jet A. Explosion Dynamics Laboratory Report FM97-9. Also, see CIT/Graduate Aeronautical Laboratory. 2000. Spark Ignition Measurements in Jet A: Part II. Explosion Dynamics Laboratory Report FM99-7. 255 Initially, these tests were performed using single component hydrocarbon fuels (methane and propane) to validate the experimental procedures and test results when compared to previously published research on these fuels. However, subsequent tests were performed using Jet A fuel/fuel vapors.

Factual Information 132 Aircraft Accident Report thoroughly document Jet A fuel vapors’ characteristics under conditions that were determined to have existed in the accident airplane. The explosion dynamics experts at CIT also conducted research to determine the combustion characteristics of Jet A fuel and how those characteristics are affected by different fuel temperatures, pressures (simulating different altitudes), fuel mass loading, fuel batch source, and fuel weathering.256 Combustion characterization required hundreds of experiments257 of the ignition of Jet A fuel vapors in various size test vessels. Measurements of pressure histories and explosion peak pressures were made during tests conducted under a multitude of conditions. Flame speeds were calculated over the range of conditions. The flame speeds and explosion peak pressures were compared to theoretical calculations under ideal conditions. The resultant information allowed researchers to make more accurate theoretical calculations of the combustion of Jet A fuel under nonidealized conditions. Additionally, this information was critical to the development of computer models of Jet A combustion within the CWT.258 Upon completion of the tests and research, the experts evaluated the applicability of the data acquired in relation to the TWA flight 800 accident conditions. The conclusions specific to the accident conditions were based on the examination of a similar flash point Jet A fuel, at a temperature range of 104° to 122° F at 13,800 feet msl, with a fuel mass loading equivalent to 50 gallons in the CWT. The explosion dynamics experts from CIT and the Safety Board determined the following: • The flammability limits of Jet A fuel are variable and depend (at least) on ignition energy level, temperature, pressure, and mass loading. The magnitude of the ignition energy of the fuel vapor for the accident airplane’s conditions (50 gallons of Jet A fuel in the CWT at a pressure equivalent to 13,800 feet msl) is estimated to vary from 0.5 J at 104° F to less than 0.5 mJ at 122° F. • At 13,800 feet msl, with fuel mass loading conditions simulating those of the accident airplane, Jet A fuel259 vapors could be ignited at temperatures as low as 96.4° F. • Published research involving pure hydrocarbon fuels260 estimated the LFL of these fuels at sea level to be a fuel/air mass ratio of 0.036 to 0.041. Published research involving Jet A fuels261 estimated the LFL for Jet A to be a fuel/air 256 For additional information regarding this research, see Jet A Explosions—Experiments: Laboratory Testing, dated November 21, 1997. 257 Similar to the previously discussed flammability research, initial tests were performed using single component hydrocarbon fuels for validation purposes, with subsequent tests performed using Jet A fuel/fuel vapors. 258 For more information, see section 1.16.5.5. 259 The fuel used in this test was obtained from the Los Angeles International Airport (LAX), Los Angeles, California, and was determined to have a flash point of 116.6° F. As previously indicated, on the basis of tests conducted on fuel obtained from the same fuel source in Athens, Greece, the fuel on board the accident airplane was determined to have a flash point of 114° F. 260 Kuchta. (The data were taken at sea level.) 261 Nestor.

Factual Information 133 Aircraft Accident Report mass ratio of 0.032 to 0.035, for pressure between 0.4 and 1.0 atmospheres. Although the LFL was not explicitly tested for during CIT’s research, the lowest fuel/air mass ratio ignited was calculated at 0.038 at 13,800 feet msl, using 80 J spark energy. • Most existing Jet A vapor pressure data are highly contradictory and based on correlations rather than measurements. Vapor pressure varies between fuel batches, and measurements can easily be contaminated by dissolved air. The vapor pressure measurements obtained in the CIT research and the fuel vapor characterization made by Woodrow262 represent a significant portion of the available Jet A vapor pressure and chemical composition data. • Simulating the altitude and fuel mass loading conditions of TWA flight 800 in a laboratory test cell, explosion peak pressures of Jet A vapors were measured at 39.2 psi (at 104° F) and 52.2 psi (at 122° F) above ambient pressure at 13,800 feet (8.6 psi). • Ignition of Jet A vapors (at sea level) can occur at temperatures significantly below their flash point temperatures. A survey of Jet A fuels used in the current research indicated that fuel/air mass ratios calculated at the flash point temperature range from 0.0354 to 0.0488, which indicates that the flash point temperature of the fuel would be higher than its temperature at the LFL. Therefore, flash point temperatures are not a reliable guide for assessing the explosion hazards of Jet A fuels. Flammability tests in vessels or tubes with the appropriate mass loading factor, ignition source, test and analysis procedures, and instrumentation must be used to determine flammability limits. 1.16.5.3 Jet Fuel Vapor Chemistry—University of Nevada The Safety Board contracted with the University of Nevada’s Center for Environmental Sciences and Engineering to analyze the properties of Jet A fuel vapor.263 The objective of these analyses was to characterize fuel vapor chemistry and determine the vapor concentrations (fuel/air mass ratios) generated by jet fuels under various conditions. Many different sources of Jet A fuel were tested over a range of temperatures and fuel mass loadings, encompassing the conditions that existed when the TWA flight 800 accident occurred. These analyses were also able to quantify the effects of fuel weathering and altitude on fuel vapor concentrations. One analysis was made of Jet A fuel obtained from Athens, Greece, shortly after the TWA flight 800 accident.264 This analysis showed that for the temperature range (104° to 122° F) and fuel mass loading in the accident airplane’s CWT at the time of the accident, the fuel/air mass ratios were between 0.036 and 0.066. 262 Woodrow, J. and Seiber, J. 1997. The Laboratory Characterization of Jet Fuel under Simulated Flight Conditions. Center for Environmental Sciences and Engineering. University of Nevada. Reno, Nevada. 263 Woodrow and Seiber. 264 As stated previously in section 1.16.5.1.2, this fuel came from TWA flight 881 and was believed to most closely represent the fuel within the accident airplane’s CWT at the time of the accident.

Factual Information 134 Aircraft Accident Report 1.16.5.4 Quarter-Scale Center Wing Fuel Tank Model Combustion Experiments—California Institute of Technology The Jet A explosion tests discussed in section 1.16.5.2 were conducted in laboratory explosion chambers. The Safety Board determined that it also needed to investigate the phenomena associated with flame propagation in multicompartment, interconnected, and vented tanks representative of the accident airplane’s CWT. The Board contracted with CIT and Applied Research Associates to conduct a comprehensive series of combustion tests using a 1/4-scale model of the CWT. The objectives for these tests were to (1) provide a definitive set of combustion data for the development and validation of computer code models265 of the combustion process within the CWT and (2) demonstrate the combustion of Jet A fuel vapor at the temperature, pressure (altitude), and fuel mass loading present in the accident airplane at the time of the accident in a simplified yet representative CWT model. Accordingly, the explosion dynamics experts at CIT designed an experimental test program in which a CWT model was constructed with length, width, and height measurements that were roughly one-fourth the size of a full-size 747-100 CWT.266 (The 1/4-scale CWT model was 5 feet long and wide and 1 1/2 feet high.) The 1/4-scale model was constructed with a steel top and bottom, removable steel partitions, and transparent high-strength plastic (Lexan) sides, which enabled observation of the combustion event. Later modifications to the model included temperature and pressure controls, which allowed researchers to simulate the temperature and altitude of the accident airplane’s CWT.267 The model was instrumented with pressure and temperature gauges, and an external camera system was incorporated to view the combustion event. Seventy-two tests were conducted, in three separate test phases, over a 2-year period. The initial phase of testing was conducted using a simulant fuel.268 The second and third phases of testing were conducted using Jet A fuel. Variations in model configurations, ignition locations, and fuel vapor conditions were examined. Because the primary intent of these tests was to provide a validation database for computer model 265 For a description of the computational modeling effort, see section 1.16.5.5. 266 This size difference results in the volume of the model tank being one sixty-fourth that of the full-scale CWT. For additional information, see CIT/Graduate Aeronautical Laboratory. 1997. Jet A Explosions – Field Test Plan, 1/4-Scale Experiments. Explosion Dynamics Laboratory Report FM97-17. 267 For additional information regarding these tests, see CIT/Graduate Aeronautical Laboratory. 2000. Results of 1/4-Scale Experiments—Vapor Simulant and Liquid Jet A Tests. Explosion Dynamics Laboratory Report FM98-6. Also, see CIT/Graduate Aeronautical Laboratory. 2000. 1/4-Scale Testing, Part II— Simulant Repeatability Series, Jet A Vapor and Quenching. Explosion Dynamics Laboratory Report FM99-7. 268 The simulant fuel (1.4 percent propane, 7 percent hydrogen, and 91.6 percent air) was developed and used in this test series to permit the observation of multicompartment fuel vapor explosions at the local ambient temperature and pressure conditions of the test site (near Denver, Colorado), simulating the combustion behavior of the Jet A fuel vapor in the accident airplane’s CWT at the conditions that existed at the time of the accident. Using the simulant fuel greatly reduced the experimental effort required (compared to using Jet A fuel). Using Jet A fuel during the second and third phases of tests required significant modifications to the test model to elevate the temperature to between 104° and 122° F at a reduced pressure equivalent to an altitude of 13,800 feet msl.

Factual Information 135 Aircraft Accident Report development (which required that the essential physical phenomena of the CWT combustion event be represented), researchers did not require experimental duplication of all of the conditions on board the accident airplane. Important distinctions between the 1/4-scale test model and the full-scale CWT and the limitations of the testing were the following: • The complexities of the full-scale CWT were simplified in the 1/4-scale model. The features believed to be most significant—bay volumes and lengths and vent and passageway areas—were scaled from the full-scale CWT, with some simplifications. For example, variations in tank height and the finer geometric details of stiffeners and stringers were not included in the model. • It is not clear if the results of the 1/4-scale model testing can scale directly to replicate full-scale results. The effects of scaling on some features (such as flow turbulence and flame quenching) are not well understood. • The effects of temperature and fuel vapor concentration variations within a single bay and between bays could not be examined in this limited experimental program.269 • Other simplifications of the 1/4-scale model included the even distribution of fuel between the bays and a smooth floor geometry. Thus, the role of liquid layer participation may not be accurately demonstrated. • The testing did not attempt to simulate partition failures, representative of full- scale CWT structural dynamic behavior during the combustion event, and the effects of such failures upon the combustion dynamics. Because of the differences between the 1/4-scale test model and the full-scale CWT, the interpretations that could be made by directly comparing these experimental results to a full-scale explosion were limited. Within these limitations, however, analysis of the experimental results led the researchers to reach the following conclusions regarding direct application of the 1/4-scale test results to TWA flight 800: • Jet A fuel ignited and combusted during every test using conditions approximating those that existed in the accident airplane’s CWT at the time of the accident. 269 Temperature and vapor concentration variations within a single bay and between bays were observed in the JFK flight test results. Subsequent ground tests were conducted in Marana, Arizona, in which CWT temperatures and vapor concentrations were measured with higher resolutions than those measured during the JFK flight tests. These tests confirmed the existence of temperature and vapor concentration variations within a single bay and between bays. For additional information, see Summary Data Report: B-747-100 Center Wing Tank Ground Testing at Marana, Arizona, dated January 20, 2000, and the Flight Test Group Chairman’s Factual Report, dated November 19, 1997.

Factual Information 136 Aircraft Accident Report • The ignition of Jet A fuel in one bay of the 1/4-scale model resulted in transmission of the flame through the bay passageways and vent stringers and ignition in neighboring bays, illustrating the behavior of multicompartment flame propagation.270 Flamefront quenching was also observed to be a characteristic of flame propagation. • After the combustion flamefront propagated from the ignition bay to a neighboring bay, the combustion process dramatically accelerated, allowing explosion pressures to increase rapidly. • In certain tests, pressure levels in bay 1 (the bay between SWB2 and SWB3) of the 1/4-scale model exceeded those needed to fail SWB3 (as indicated by Boeing’s structural analysis of the full-scale geometry).271 1.16.5.5 Computational Research of Center Wing Fuel Tank Combustion The Safety Board contracted with two research laboratories—Sandia National Laboratories (SNL) and Christian Michelsen Research (CMR)—to develop computer code models of the combustion process that occurs in a 747 CWT. Both research laboratories had extensive experience in large-scale explosion modeling and possessed existing combustion codes that could be applied to the task of modeling the CWT combustion process. This research was intended to develop computer models capable of generating accurate solutions for different full-scale CWT combustion scenarios.272 Rules-based analysis,273 which compared the results from each computer solution to the physical evidence, was then to be applied to these computer solutions to determine the probability that a particular combustion scenario might have occurred in the accident airplane. The Safety Board hoped that research involving this combination of computer modeling and rules-based analysis would indicate the most probable ignition source for the CWT overpressure event. The combustion model development was conducted concurrently by the two laboratories for 2 years. During this period, model development was continually being validated using the data generated in the 1/4-scale experimental test program. Additionally, because each computer model used a different approach toward calculating the combustion process, the researchers were able to develop and verify their work in conjunction with each other.274 During the initial development stages, both research laboratories produced computer models of the 1/4-scale CWT geometry and provided solutions using both the 270 Multicompartment flamefront propagation refers to the progression of a flamefront through the fuel/air vapor space within and between fuel tank compartments. 271 For more information, see section 1.16.4.9. 272 Each scenario represents a unique combination of ignition location, ullage temperature, and structural failure timing, for which a computer solution was calculated. 273 For additional information regarding the rules-based analysis, see section 1.16.5.5.1.

Factual Information 137 Aircraft Accident Report simulant and Jet A fuel. Subsequently, auxiliary computer models and supplemental experimental tests were conducted to refine the accuracy of certain characteristics of the Jet A combustion process. The most significant of these involved the issue of modeling flamefront quenching through compartment passageways. Considerable effort was spent on this issue, and a simple, limited model was developed to describe this behavior. In the final developmental stages, each computer model was revised to model the full-scale CWT geometry. Two full-scale calculations were performed using the SNL model, and 32 full-scale calculations were conducted using the CMR model. On the basis of their analysis of the full-scale computer modeling calculation results, the experts from both research laboratories concluded the following: • The combustion behaviors of multicompartment flame propagation exhibited in the full-scale model calculations were consistent with those observed in the 1/4-scale modeling tests. • During some scenarios, the pressures developed in bay 1 exceeded the pressure required to fail SWB3.275 • In all of the computer solutions, conditions were calculated that indicated that quenching could have occurred in some of the vents and passageways of the full-scale CWT geometry (which has 89 intercompartment passageways connecting the 6 fuel bays and 2 vent stringers connecting the CWT to the wing tip vents). • Incorporating the effects of quenching in the calculations appeared to significantly affect the differential pressure histories that developed across the internal CWT structural members. This resulted in the solutions having an enhanced sensitivity to ignition location. Because the full-scale computer modeling results indicated that the conditions for flamefront quenching appeared to exist, and because this behavior affects the development of compartment pressures, the ability to accurately predict quenching was very important. However, because the research data regarding the quenching phenomena are limited, a complete understanding of quenching behavior was not possible, and the issue of quenching remains unresolved. 1.16.5.5.1 Study of Computer Model Calculations of Full-Scale Center Wing Fuel Tank Combustion The Safety Board contracted with Combustion Dynamics, Limited (CDL) to evaluate the consistency between the computer calculations of the full-scale CWT combustion model and other information and evidence obtained during the investigation. 274 The code used by SNL determines pressure histories from global mass, momentum, and energy balances. Flame propagation is represented as a moving interface that separates the burned and unburned gases. The CMR model uses a finite volume technique for solving the mass, momentum, energy, and kinetic turbulent energy production and dissipation. This model follows the motion of the flamefront, separating burned and unburned gases. 275 For more information about the pressures required to fail SWB3, see section 1.16.4.9.

Factual Information 138 Aircraft Accident Report The Board hoped that by conducting this evaluation for each computer model solution or scenario (each involving a different combination of ignition location within the CWT, ullage temperature, and timing of structural failure), it would be possible to narrow the number of probable ignition location(s) within the CWT. CDL used the rules-based analysis to evaluate this consistency.276 As previously discussed, the rules-based analysis required the development of the following areas of the investigation: • identification of damage (or nondamage) observed in the recovered CWT wreckage that could be attributed to an early event in the breakup sequence,277 such as the failure of SWB3 in the forward direction and the rupture and forward deflection of the SWB2 manufacturing access door; and • mechanical failure analysis of the CWT structural members, which defined a range of pressure differentials that could cause failure of each of the CWT SWBs and spars.278 Using information from these areas, the rules-based analysis developed probabilities of damage/failure events for the actual (observed in wreckage) and simulated (calculated by the computer) events. These probabilities were then used to develop a consistency estimate, which was an indication of how consistent an observed failure/damage was with the computer model’s calculations for that failure/damage (for example, pressure differential across that panel). The consistency estimates for each individual failure/damage event were then combined to produce an overall consistency estimate, which would indicate the overall agreement between that computer scenario’s combination of events and the total of the observed damages. The rules-based analysis was used to examine each of the 32 scenarios of full-scale CWT calculations provided by the CMR model. The results showed a positive overall consistency value between each scenario that was modeled and the observed damages. Although scenarios involving certain ignition locations produced results with higher consistency estimates than scenarios involving other ignition locations, none of the differences in consistency estimates were high enough to permit a determination of the most probable ignition location with a high degree of confidence. The experts at CDL attributed this to the uncertainties associated with the full-scale model calculations,279 the limited amount of airplane damage that could conclusively be considered the result of early events,280 and the difficulties involved in determining the failure modes and failure pressure loads of the complex geometries of the CWT structural members (even with full 276 For additional information, see Thibault, P. 2000. Evaluation of Explosion Scenarios. Combustion Dynamics, Limited. Report CDL-1010. 277 The early event damage considered in this study/evaluation included damage caused by the CWT overpressure event and did not include damage caused by the subsequent in-flight breakup of the airplane, fire, or water impact. 278 For more information, see section 1.16.4.9 and Safety Board Memorandum to the TWA flight 800 Docket, “Boeing Submission,” dated June 5, 2000. 279 For more information about the full-scale model calculations, see section 1.16.5.5.

Factual Information 139 Aircraft Accident Report utilization of modern computer resources). Therefore, the rules-based analysis did not provide a definitive determination regarding the probability that any given location within the CWT was the ignition location. However, the rules-based analysis did reveal that the pressure differentials produced by an internal fuel/air explosion were consistent with the overall level of damage observed in the CWT. Further, the experts at CDL indicated that this conclusion was supported by a simple analysis based on the peak pressures that were experimentally observed for the combustion of Jet A fuel/air mixtures at the (temperature, pressure, and mass loading) conditions that existed in TWA flight 800’s CWT at the time of the accident. 1.16.5.6 Bruntingthorpe Full-Scale Center Wing Fuel Tank Explosion Tests Between July 28 and August 2, 1997, the Safety Board, with the assistance of the British Defense Evaluation and Research Agency (DERA), conducted a CWT fuel/air explosion test by igniting a propane/air mixture in the CWT of an out-of-service 747 located at Bruntingthorpe Airfield, Leicestershire, England. The Board also detonated explosive charges at different locations inside and outside of the CWT and documented the resulting damage.281 Examination of the damage indicated that when metal of the same type and thickness as the CWT walls was penetrated by a small charge, there was petalling of the surface on which the charge was placed, pitting on the adjacent surfaces, and visible hot gas washing damage in the surrounding area. Documentation of the damage (direct and collateral) patterns was conducted as a group activity, with the involvement of technical representatives from several parties to the investigation, including Boeing and TWA. The tests enabled the Safety Board to examine the explosion, deformation, and failure processes (crack paths and failure sequences) produced by the ignition of a fuel/air mixture within the CWT and detonation of explosive charges. It was not possible for the tests (nor was it intended) to exactly reproduce the explosion of TWA flight 800’s CWT.282 However, weight was added to the test airplane to simulate some of the loads on the accident airplane as closely as possible. For example, water was added to the main wing fuel tanks to reproduce the accident airplanes’ fuel loads, the potable water bottles forward of the front spar were filled with water, and sandbags were placed in some of the passenger seats over the WCS. (The Safety Board 280 Although nearly all of the wreckage has been recovered and, where pertinent, reconstructed, much of the early event-related damage was altered or affected by the events following the overpressure event, including the in-flight breakup of the airplane, water impact, fire, and handling during the recovery efforts. 281 Each of the explosive charges used PE4, a type of plastic explosive using RDX combined with a plasticizer. In some cases, the charge was coupled with various amounts of bare shot. 282 For example, it was not possible to simulate the atmospheric pressure, load factors, and/or slipstream encountered by the accident airplane in flight at nearly 14,000 feet msl nor was it possible to pressurize the fuselage. As a result of damage from the explosive charge testing (which had taken place previously), the test airplane exhibited significant damage to the aft fuselage beginning with the STA 1480 bulkhead; missing sidewall panels, ceilings (including overhead bins), windows, and doors (including the cockpit door and several main cabin doors); and damage to many other doors (including the forward cargo door) that precluded closing or latching those doors. However, the airplane’s CWT and wing structure were repaired, as necessary.

Factual Information 140 Aircraft Accident Report notes that, despite these adjustments, the loading of the test airplane was significantly different from that of the accident airplane. These differences made a direct comparison of the results of the fuel/air explosion of the CWT in the test airplane with the results of the fuel/air explosion in the accident airplane of limited use.) Portions of the cabin floor structure on the test airplane were modified to accommodate test hardware and instrumentation.283 The openings in the CWT tank (including the tank vents to the wings) were hermetically sealed, and a predetermined amount of propane284 was loaded in the CWT to approximate the amount of fuel vapor in the accident airplane’s CWT at the time of the explosion. The propane/air mixture in the test airplane’s CWT was ignited by detonating an explosive device located on the right side of the rear spar (about RBL 82). According to the DERA report, this detonation “triggered a major event or events in the [CWT]….a relatively slow deflagration was evident from the audible output accompanied by a limited flash, visible externally. Deformation and holing of the fuselage roof was obvious, even from a distance.” Safety Board investigators and representatives from DERA and several parties to the investigation examined the postexplosion damage to the test airplane and developed a summary of the failure sequence that they believed showed the progression of the overpressure resulting from the propagation of the propane/air explosion. The Board observed that the test parameters used resulted in a significantly more dynamic and destructive explosion within the test airplane’s CWT than was indicated by the accident airplane’s wreckage.285 (The catastrophic nature of the damage to the test airplane indicated that if such an event occurred in flight, it would likely result in the airplane instantaneously separating into four major components: left wing, right wing, forward fuselage, and aft fuselage.) 1.16.5.7 Boeing/U.S. Air Force E-4B Center Wing Fuel Tank Fuel Heating Study In March 1999, the USAF Safety Center, Directorate of Engineering and Technical Services advised the Safety Board of a USAF E-4B fuel tank heating study that had been conducted by Boeing for the USAF from 1979 to 1980.286 The E-4B is a military variant of the commercial 747, manufactured by Boeing, which has a larger CWT fuel capacity 283 Test hardware and instrumentation installed for the tests included pressure, flamefront propagation, and propane/air concentration sensors throughout the CWT; accelerometers in the passenger seats above the fuel tank to measure the acceleration forces applied to the seats; a CAM; cockpit and airplane skin accelerometers; and various pressure gauges in the passenger cabin to obtain complete CVR documentation of the effects of the explosion. Associated cables and connectors were located within the CWT bays where necessary. 284 A propane/air mixture was used because it was very portable and would stay in the vapor state for the period of time needed for the test, despite the cold climate. 285 For example, on the test airplane, the force of the explosion shattered SWB3 into a large number of small pieces, which were propelled forward, whereas on the accident airplane, SWB3 initially only fractured at its upper chord and then rotated forward into the front spar.

Factual Information 141 Aircraft Accident Report than the 747-100.287 The E-4B is also equipped with a 4th air conditioning pack beneath the CWT. According to the Boeing study, the E-4B fuel heating study resulted from USAF concerns that CWT fuel temperatures could exceed the maximum allowable fuel temperature (a limit imposed for fuel pump performance, not flammability). Boeing’s study indicated that these concerns were based on the USAF’s finding288 CWT temperatures in excess of the allowable limit. The study also stated that the USAF’s concern regarding the potential problem of high fuel temperatures was supported by “reports of a Japan Airlines commercial aircraft operating out of Hawaii that was experiencing loss of CWT fuel feed during the ascent to altitude.” Boeing’s study stated that the purpose of the study was, in part, “the identification of aircraft operational procedures and hardware modifications which will extend the duration of aircraft operation before a [CWT] overheat condition occurs.” Boeing’s study analyzed CWT temperatures during extended periods of ground operation in extreme (hot, humid) environmental conditions. The study included an experimental phase, during which fuel temperatures in the CWT were measured, and an analytic phase, during which computer modeling was used to predict CWT temperatures under various conditions. CWT fuel temperatures exceeding the allowable limit were measured during the experimental phase and were predicted under certain operating conditions by the computer models used in the analytic phase. The study also determined that although the increase in CWT fuel temperatures was the net effect of several heat sources and sinks, “the major heat load appears to be due to the high temperatures in the air conditioning equipment [bay].” As a result of this experimental and analytic work, the Boeing study proposed manipulating CWT fuel loads/initial fuel temperatures and ground operation with the air conditioning pack doors open as operational methods to reduce CWT temperatures. The Boeing study also concluded that thermal insulation should be installed between the air conditioning packs and the CWT in the air conditioning pack bay and included 286 The report, “Center Wing Tank Fuel Heating Study,” was prepared by Boeing for the USAF, was, Document No. D226-20582-1. Boeing personnel associated with the TWA flight 800 investigation indicated that they did not become aware of this study until late in the investigation because the study pertained to the military variant of the 747 and did not focus directly on flammability. Thus, they were not able to provide the Safety Board (or the FAA or 747 operators) with the potentially relevant information about 747 CWT overheating and corrective measures during the early stages of the investigation. According to Boeing, as a result of this event, the company revised its procedures such that all company reports and resources (military and/or civilian) are now electronically accessible through key-word searches. Further, Boeing has reported that its accident investigation procedures have been revised and now include the ability to electronically search the company’s technical documents. 287 The E-4B has a CWT capacity of 110,812 pounds (about 17,000 gallons of Jet A at 6.51 pounds per gallon). This CWT capacity is equivalent to that of a 747-200 (and subsequent 747) model airplanes. The CWT capacity for the 747-100 is 12,890 gallons. According to Boeing, the increased CWT capacity in the E-4B/747-200 models was created by using the area between SWB3 and the front spar as a fuel bay, not as a dry bay, as it was used on 747-100s. 288 For additional information regarding USAF testing, see IOT and E Environmental Testing at Howard Air Force Base. January 1979.

Factual Information 142 Aircraft Accident Report preliminary designs for the installation of thermal insulation. Further, the Boeing study discussed several possible methods that would provide an insulating air layer between the air conditioning pack bay components and the CWT, including baffling of the air conditioning pack bay (also termed “directed” ventilation)289 and general forced air conditioning pack bay ventilation (using either an outside air source or recirculating air conditioning pack bay air). 1.16.6 Potential Ignition Source Research and Testing During its investigation of the TWA flight 800 accident, the Safety Board evaluated numerous potential ignition sources of the fuel vapor within the CWT, including those in which the energy entered the CWT through the FQIS wiring290 and those in which the energy entered the CWT through other mechanisms. Potential ignition sources in which the energy may have entered the CWT through the FQIS included radiated electromagnetic energy from transmitters outside the airplane that coupled to FQIS wiring; a transfer of electromagnetic force from personal electronic devices (PED) or other potential emitters within the airplane to the FQIS wiring; a transient voltage/current spike from wiring associated with other, higher-voltage aircraft systems induced onto corouted FQIS wiring; or a transfer of voltage from a short circuit from wires carrying higher voltage to adjacent wires carrying lower voltages, including the FQIS wires (this short circuit could occur if the insulation covering the conductors is compromised or through a bridge created by contaminants, such as metal shavings or fluid). Other potential ignition mechanisms (those not related to the FQIS) examined by the Safety Board included a lightning or meteorite strike; a missile fragment; a small explosive charge placed on or in the CWT; auto ignition or hot surface ignition,291 resulting from elevated temperatures (caused by either engine bleed air leaks, a fire in the main landing gear wheel well, or a fire in the air conditioning pack bay beneath the CWT);292 a fire migrating from another fuel tank through the vent (stringer) system; an uncontained engine failure or a turbine burst in an air conditioning pack; a malfunctioning jettison/override pump; a malfunctioning CWT scavenge pump; and static electricity. 289 A concept similar to baffling/directed ventilation is used on Airbus A300, A310, A319, A320, and A321 airplanes. 290 According to the FAA’s Aging Non-Structural Systems Research Plan, electrical failures can occur in the following ways: (1) interruption of current in a circuit (also called an open circuit), which the FAA considered the “most benign failure mode…[although they] may result in more serious failure in some other part of the electrical system”; (2) a bolted short circuit, which will generally trip the airplane’s thermal circuit breakers and prevent their reset; (3) an intermittent short circuit—the FAA indicated that “a high frequency of intermittent failure may eventually lead to serious consequences either by the more critical failure of components or by a more critical failure of the interconnect system (e.g., electrical arcing)”; (4) an intermittent instantaneous discharge (arcing), which the FAA indicated may be “the most serious failure mode for electrical…components”; and (5) degraded shielding, which the FAA indicated may result in “the introduction of undesirable noise or electrical energy with potential adverse affects to the safety of the systems.” 291 For additional information regarding auto ignition and hot surface ignition, see section 1.16.6.10. 292 The Safety Board is aware of at least one report of fuel leaking into the air conditioning pack bay in a 747.

Factual Information 143 Aircraft Accident Report 1.16.6.1 Arcing Information As previously indicated, electrical arcing is defined (in an article published by UL) as “a luminous discharge of electricity across an insulating medium.” UL indicated the following: The electrical discharge of an arc can involve temperatures of several thousand degrees Celsius. In determining the heating effects of an arc, the classical Joule heating equation involving current squared multiplied by resistance (I2R), however, does not fully explain the heating effects. Although the total power dissipated in the arc is equal to the total voltage drop in the arc multiplied by the arc current, power dissipation is not uniform throughout the arc. In general, arcing can be divided into two categories: (1) non-contact arcing, and (2) contact arcing. Non-contact arcing is arcing that does not require direct physical contact between the conductors or “electrodes” where the arcing is taking place. Two types of non- contact arcing involving lower voltages are: a) arcing between conductors separated by insulation that occurs across the surface of the insulation, and b) arcing between conductors separated by pyrolized (carbonized) insulation. With arcing between conductors separated by insulation, the mechanism of initiating an arc between stationary conductors separated by insulation will depend on the type and geometry of the conductors and insulation between them. In the case of typical air clearances found in an electrical residential distribution system, many kilovolts may be required to initiate arcing. With arcing between conductors separated by carbonized insulation, also known as an “arc-tracking event,” arcing can occur at normal operational voltages. The resulting fault-current causes the carbon path to open and an arc is established similar to parting the conductors, as with contact arcing. Carbonized insulation between opposite polarity conductors or between a line-voltage conductor and ground can lead to an across-the-line arcing fault or a line-to-ground arcing fault. Contact arcing is arcing that involves direct or indirect physical contact between the conductors, known as electrodes, where the arcing is taking place, such as arcing between closing or parting conductors making or breaking a circuit. With this type of arcing, the arc initiation mechanism involves a hot point (essentially from I2R heating) at the last point of contact when a circuit is being interrupted (i.e., conductors initially in contact are parting), or at the first point of contact where a circuit is being established (i.e., conductors that are initially separated and subsequently come into contact). Contact arcing is associated with normal operational arcing that occurs with any kind of air-gap type electrical switching device. Properly designed switching devices are capable of withstanding such arcing without excessive contact damage or generation of excessive heat. Contact arcing may also be associated with arcing faults due to the unintentional creation or interruption of current. 1.16.6.2 Wire Short-Circuit Characteristics and Protection The contamination observed by investigators on the wiring recovered from the accident airplane prompted the Safety Board to contract with Lectromechanical Design

Factual Information 144 Aircraft Accident Report Company (Lectromec) to conduct laboratory research into the short-circuit behaviors of the following commonly used aircraft wiring: BMS13-42 and -42A Poly-X wires and Kapton wires.293 The Poly-X wires used for these tests were the most pliable (best case) samples obtained from a retired 747 (N93117) that was manufactured in 1971 and retired after 25 years in service, whereas the Kapton wires used for these tests were obtained from a reel of new wire.294 According to the Lectromec report, “Electrical Arcing of Aged Aircraft Wiring,” three types of tests were conducted: wet short-circuit tests in which a 1 percent saline-water electrolyte solution (NaCl)295 or lavatory fluid was used as a conductor; dry short-circuit tests in which metal shavings (steel and/or aluminum)296 were used as conductors; and dry abrasion tests in which metal shavings were placed between oscillating wires. In all test cases, the test wire bundles were connected to a generator that provided three-phase, 400-Hz power at 120-volt a.c., in a circuit with 7.5- or 10-amp circuit breakers and a 1-ohm297 resistor.298 Lectromec’s report indicated that during these tests, three categories of electrical activity were observed—scintillations, flashing, and strong arcing—which it described as follows: • Scintillations are high-frequency, micro-discharges that appeared as pinpoints of light that flickered at the edge of cracks in the wiring insulation. Scintillations did not result in circuit breakers opening;299 however, during more lively scintillations, an electrical buzzing or crackling sound could be heard, and char, or soot, formed on the wire (and adjacent wires) over time. Lectromec was not equipped to accurately measure the small amounts of energy in these scintillations. 293 Poly-X wires were tested more extensively than the Kapton wires. For additional information regarding Kapton and/or Poly-X wiring, see section 1.6.1.3.2 and the Systems Group Chairman’s Factual Report—Addendum for Electrical Wiring Information, dated February 10, 2000. Additionally, Poly-X and Kapton wires are compared in the U.S. Naval Avionics Facility (NAFI) report NAFI-TR-2210, dated October 19, 1977, which is discussed further in section 1.16.6.3.1. 294 The types of wires used for individual tests are indicated in the individual test results discussions and/or tables. As previously discussed, BMS13-42 and -42A Poly-X wires are basically the same except for the thickness of the external coat (insulation); the BMS13-42 Poly-X used in these tests had an insulation thickness of about 7 (one thousandth of an inch) mil, whereas the BMS13-42A Poly-X tested had an insulation thickness of about 11 mil. The Kapton wire used in these tests had an insulation thickness of about 8 to 9 mil. For additional information regarding these types of wires, see Systems Group Chairman’s Factual Report–Addendum for Electrical Short Circuit/Arcing of Aged Aircraft Wiring, dated October 7, 1999, and section 1.6.1.3.2. 295 These tests were conducted to Society of Automotive Engineers (SAE) test standard AS4373 4.5.9 (Method 509) with variations, such as the use of lavatory fluid as an electrolyte. 296 The metal shavings used in these tests were produced using a 3/16-inch drill bit. The steel shavings tended to be longer and stronger than the aluminum alloy shavings. 297 An ohm is the unit of resistance of an electrical conductor, at which the fall of potential is 1 volt when the current is 1 amp. 298 Although in this case a resistor was used to simulate the resistance associated with a long run of wire, typically resistors are used in circuits to limit the amount of current (amperage), and thus power, that can pass through it. 299 For additional information regarding circuit breakers, see section 1.16.6.2.1.

Factual Information 145 Aircraft Accident Report • Flashing is an arcing discharge, seen as a single flash of light with an accompanying popping sound that usually occurred after a test sample had been scintillating for some time. Rapid, repeated flashing could continue for several seconds (but not for extended periods of time) and was followed by periods of dormancy. Typically, 2 to 4 J of electrical energy were transferred between the source and the target wire, although electrical energy transfers as high as 90 J were observed. In an April 20, 2000, letter to the Safety Board, Lectromec stated that the peak power available to the victim wire during a 3/4-millisecond flashing event was 1.3 kilowatts (kW), with a possible energy dissipation of 400 mJ. During one series of flashing events, Lectromec measured 8.25 J of energy available in less than 20 milliseconds. Flashing did not cause the 10-amp circuit breakers protecting the circuit to open,300 but did result in erosion of insulation and conductors in the wire and adjacent wires over time. • Strong arcing is an arcing discharge that could continue for hundreds of cycles, typically involving 5 kilojoules (kJ) of electrical energy and that could cause significant collateral damage to the insulation of adjacent wires. Strong arcing events often, but not always, resulted in the interruption of power when the circuit breakers opened (“tripped”). Strong arcing was observed in one of three tests involving a BMS13-42 Poly-X wire that had a relatively thin layer of insulation (about 7 mil). Tests involving BMS13-42A Poly-X wiring did not result in the strong arcing that was observed in wet-short testing of Kapton or BMS13-42 Poly-X.301 According to the report, most of the flashing and strong arcing that occurred varied widely in intensity and range. In addition, the discharges were observed to be directional (not a ball-shaped discharge), with sufficient directionality that they missed an adjacent piece of aluminum in some tests. Wet Short-Circuit Tests The wet short-circuit tests involved a bundle of seven wires, five of which were attached to the generator and were considered “active,” whereas the other two wires in the bundle were not attached to the generator and were considered “passive.” The wire bundle was suspended horizontally in a test chamber, with both ends secured to stable platforms. The insulation on two active wires at the top of the bundle had been intentionally damaged (cut or sliced) circumferentially, exposing the conductors. The cuts in the two wires were placed in the bundle such that the cuts were separated by about 6 millimeters (mm). Then, with the generator providing 120-volt a.c. power, separate tests were conducted with electrolyte solutions of 1 percent NaCl solution or lavatory waste water dripped on the wires such that the fluids landed between the cuts in the wire insulation at a rate of 6 to 300 According to a circuit breaker manufacturer, if the current in a circuit rises abruptly (within a few milliseconds), it can exceed the rated current by more than 1,000 percent before the circuit breaker trips. 301 Lectromec noted that the strong arcing of BMS13-42 Poly-X was not as energetic as the strong arcing exhibited by the Kapton.

Factual Information 146 Aircraft Accident Report 10 drops per minute. The experiment was allowed to run for up to 25 minutes or until a circuit breaker tripped. In some cases circuit breakers were reset and, the test continued.302 Table 8 shows the results of the wet short-circuit tests conducted by Lectromec. According to the Lectromec report, during these tests, scintillations were generally visible soon after the tests were started. During the tests in which flashing occurred, flashing events frequently repeated at various intervals (ranging from several flashes per second to more than 1 minute apart) throughout the test. Oscillogram measurements indicated that the peak electrical energy dissipation (about 90 J, with power peaks between 3 and 6 kW)303 during these flashing events occurred during a test in which a wet-short was initiated by dripping lavatory fluid onto Poly-X (BMS13-42A) wiring. The estimated peak electrical energy dissipated before the circuit breakers tripped during the tests in which strong arcing was observed was about 2 kJ. 302 The 25-minute limit was selected because it exceeded the length of the accident airplane’s flight; most of the tests also exceeded the 2 1/2-minute interval between the CVR-recorded comment regarding the “crazy fuel flow” and the explosion. In one undocumented wet short-circuit test, the test continued with some intense flashing observed for more than 8 hours without tripping a circuit breaker. This test was eventually terminated at the end of the Lectromec work day. Table 8. Results of wet short-circuit tests conducted by Lectromec. Type of Wire Electrolyte Duration Qualitative Description of Visual Effect No. of Circuit Breakers that Tripped Length of Damage/Char Buildup Poly-X (BMS13-42A) 1 percent NaCl 20 minutes Some intense flashing 0 1/2 inch 1 percent NaCl 25 minutes Some intense flashing 0 5/8 inch Lavatory fluid 10 minutes Some intense flashing 0 1/4 inch Lavatory fluid 16 minutes Some intense flashing 0 3/8 inch Poly-X (BMS13-42) 1 percent NaCl 5 minutes Some intense flashing 0 1/2 inch 1 percent NaCl Less than 1/2 minute Some intense flashing 0 1/4 inch 1 percent NaCl About 3 minutes Strong arcing 1 (reset, then 3) 1/2 inch Kapton 1 percent NaCl About 1.5 minutes Strong arcing 3 (reset) 2 inches 1 percent NaCl Less than 1/2 minute Strong arcing 3 (no reset) 7/8 inch 303 Oscillogram measurements taken during one of the pretests indicated that current peaks of 75 amps occurred and more than 350 J of electrical energy was dissipated. Subsequent examination of the wire bundle revealed about 1/4 inch of damage and a char buildup around the cut in the insulation; both conductors were still intact.

Factual Information 147 Aircraft Accident Report Lectromec also conducted wet dielectric tests304 on the wires after seven of the wet short-circuit tests to determine whether the wires that had not been intentionally cut had been damaged. Multiple wires within the bundle failed six of the seven wet dielectric tests. Metal Shaving Abrasion Tests (Dry) Most of the metal shaving abrasion tests were conducted in two experimental configurations305—two tests were conducted with the wire bundle secured to surfaces such that the bundle had a 90°-angle bend in it, and four tests were conducted with wires in a common bundle, aligned longitudinally with each other. In both configurations, one of the surfaces to which the wires were attached was stable, and the other surface was movable. The movable surface was attached to an “oscillator,” which had a 1/2-inch movement stroke. When activated, the oscillator moved the wires to which it was attached. The two 90°-angle metal shaving abrasion tests were conducted with a seven-wire bundle and a metal shaving at least 0.5 inch long woven between the wires (one bundle had a steel shaving, the other had an aluminum shaving). The bundles were secured to a stationary platform at one end and to a movable bar at the other end, in a manner that resulted in a 2-inch radius, 90° bend in the wire bundle. The linear motion of the oscillator caused the wires in the bundle to squeeze together with the metal shaving and then relax repeatedly. These tests were run concurrently, for 19 1/4 hours, with no electrical events (that is, scintillations, flashing, or arcing) observed and no circuit breakers tripped. Post-test examination revealed some damage to the wires. Damage observed where the shavings had been woven into the wire bundles appeared to be mostly superficial damage to the insulation topcoat (with the steel shaving resulting in slightly more damage). Lectromec reported that the damage resulting from the flexing and moving of the 25+ year-old wires in the bundles was more severe, including broken and cracked wires, with exposed conductors in both bundles; these wires subsequently failed wet dielectric tests. During the four longitudinal metal shaving abrasion tests, two identical wire bundles (four wires in each) were secured together with nylon ties along their midsections, and several metal shavings were placed between the two bundles. Both ends of one of the bundles were then secured to a stationary platform, while the ends of the other bundle were secured to a movable bar. The results of these tests varied from cases in which the 304 Wet dielectric tests provide an indication of the integrity of a wire’s insulation. These tests were conducted by placing individual wires in a water bath with both ends out of the water, then applying 1,000-volt d.c. to the wire conductor while the water bath was grounded. If a current was measured in the circuit, it was an indication that the wire had short-circuited through its insulation to the water bath, and the wire failed the test. 305 Several different configurations of drill shaving abrasion tests were considered and tried before Lectromec decided to use the two configurations described in this section. Lectromec reported that during these early trial tests, the shape and size of drill shavings had a significant effect on the test results. For example, in most cases thin aluminum shavings often broke apart and fell out of the wire bundles and did not interact with individual wires, whereas larger metal shavings resulted in the tripping of circuit breakers. Further, thin metal shavings often acted as fuses and evaporated after carrying an initial current between wires (thus ending the short-circuit condition), whereas shavings with relatively large cross-sections could support a larger current without evaporating.

Factual Information 148 Aircraft Accident Report wire bundle shed the metal shavings without a short circuit, to others in which the metal shavings cut through the insulation, exposed the conductor, and caused a transfer of energy to occur. For example, one 2.5-millisecond pulse melted the metal shaving without tripping circuit breakers, whereas another test resulted in prolonged flashing events with power peaks of greater than 10 kW, damaging all the wires in the test bundle. Post-test examination of the wires revealed that bundles containing aluminum alloy shavings were less damaged by contact with the shavings than those containing steel shavings. However, as with the 90°-angle metal shaving abrasion tests, movement of these wires resulted in cracked and damaged wires that subsequently failed wet dielectric tests. Examination revealed that cracks had appeared in the insulation. No circuit breakers were tripped during these tests. Dry Short-Circuit Tests, with Metal Shavings Eight tests were conducted to document the dry short-circuit capability of the metal shavings when a Poly-X wire’s conductor was exposed. In these tests, two of seven wires in a bundle were cut circumferentially (about 1 mm wide) to a depth that exposed the conductor, placed on opposite sides of the bundle, and positioned so that the exposed conductor was visible. Aluminum or steel metal shavings of various thicknesses were then woven through the bundles so that they touched both of the exposed conductors. The bundles were then suspended horizontally in the test chamber and attached to the generator, and 120-volt a.c. power was applied. According to the Lectromec report, all but one of these tests resulted in short flashes of various intensity, none of which tripped a circuit breaker. Strong arcing was not observed in any of the eight tests of Poly-X wire, but one test with a steel shaving resulted in what Lectromec described as an “intense flash.” During four of the tests, a visible flash was observed and then the sample became dormant (no current flow was measured). In these four cases, minimal or no damage was observed to the wire insulation; all (non-predamaged) wires passed wet dielectric tests after these tests. However, the other three dry short-circuit tests resulted in flashing events of longer duration and in additional damage to adjacent wires after the flash/arc event. After three of the eight tests, several (one to five) non-predamaged wires failed wet dielectric tests. Oscillogram measurements indicated that the peak current during these tests was 140 amps and that the peak electrical energy dissipated was 18 J. 1.16.6.2.1 Circuit Breaker Protection Information According to the USAF Aircraft Mishap Investigation Handbook for Electronic Hardware, the typical thermal circuit breaker contains a bimetallic strip and two electrical contacts (one of which is spring-loaded) in a circuit. When the circuit is heated, the electrical contacts heat the bimetallic strip, causing it to bend. The amount of bending is a function of the amount of heat, which is dependent on the time and amount of current flowing through the circuit. When the heat exceeds a preset amount, the bending of the bimetallic strip causes the release of the spring-loaded contacts to open the circuit. The circuit can be opened or reset by manually pulling or pushing on the circuit breaker button, respectively. The position of the button denotes the state of the circuit breaker. Figure 34

Factual Information 149 Aircraft Accident Report shows a “trip-curve” chart for a typical circuit breaker (excerpted from Texas Instruments Klixon® specification), which depicts the relationship between the amount of current that can pass through a circuit breaker and the amount of time until the circuit breaker opens. The USAF handbook also describes typical circuit breaker failure modes, including welding and erosion/wear of the electrical contacts, material transfer, overcurrent, and contamination. Further, the handbook states that “the mechanical structures have changed over many years; therefore, age is also a factor.” Boeing Document D6-40359 describes a study, “Impact of Electrical Overloads on Wire and…Circuit Breakers Used on 707, 727, and 737 Airplanes,” dated February 2,

1. The document stated that “early in 1971, [an air carrier] reported a failure of

a…circuit breaker. As a result of this failure and subsequent investigations, there has been consideration given to the need for electrically checking all [similar] circuit breakers which are in service.” The document further stated that circuit breakers that have been in service “could not reasonably be expected to meet the overload current versus trip time calibration curves of a new breaker” and contained a description of how the bimetallic strips may lose integrity and degrade with exposure to high internal temperatures. Subsequently, Boeing studied about 1,200 circuit breakers that had been removed from service during a fleetwide survey306 and found that “initial results of on-board testing showed that 72 percent of all breakers tested satisfied the procurement specifications.” Further laboratory testing of the 28 percent that did not meet procurement specifications Figure 34. A trip-curve chart for a typical circuit breaker (excerpted from Texas Instruments Klixon® specification).

Factual Information 150 Aircraft Accident Report revealed that an additional 9 percent of the circuit breakers originally tested (for a total of 81 percent) satisfied the procurement specifications, despite initial results indicating that they did not. Boeing speculated that the test equipment and methods used during the initial tests might have resulted in erroneous failure indications for the 9 percent. Further, Boeing speculated that the test equipment and methods used in the initial tests might have damaged circuit breakers within the remaining 19 percent that did not satisfy procurement specifications. After Boeing revised the pass-fail criteria and retested the circuit breakers, test results showed that 99.2 percent of the tested circuit breakers could function in time to protect the wires. After a European 757 experienced an arc-tracking event in Kapton wiring on May 10, 1985, Boeing investigated methods to protect against arc-tracking events. Boeing document D045Y41102TR, “270 [volt d.c.] Wet Dielectric Arc Tracking Tests,” described development of a 270-volt-d.c. trip curve that would provide protection equivalent to that provided by a thermal circuit breaker with an a.c. power source. Boeing found that starting loads and in-rush current required circuit protection levels to be set higher than the rating of available circuit breakers. Boeing discovered that the trip characteristics to interrupt arc-tracking events below the 1,000 percent (rated) current level of d.c. circuits were the same as those of a.c. circuit breakers.307 Therefore, Boeing designed an electronic circuit breaker to eliminate the arcing problems associated with d.c. switches. However, Boeing also found that application of 270-volt d.c. electricity to 115/200-volt a.c. circuit breakers resulted in the melting of the breaker contacts. To offer additional protection to electrical circuits against the unwanted effects of electrical arcing, nonaerospace manufacturers have begun incorporating arc-fault detection technology into products known as arc-fault circuit breakers (AFCB, also known as arc-fault circuit interruptors). According to UL,308 an AFCB is a device intended to reduce the number of arcing-fault fires by opening the electrical circuit when an arc fault is detected. An AFCB differs from a typical thermal-based circuit breaker in that the AFCB has complex electronic circuitry that can identify specific characteristics or signatures of the current or voltage waveform that are unique to electrical arcing. In 1998, in conjunction with the National Electrical Manufacturing Association, UL began working with manufacturers and other interested parties to form an Industry Advisory Group to develop a standard for safety for AFCB products. In February 1999, UL published the First Edition of the Standard for Safety for Arc-Fault Circuit Interruptors. The USAF, FAA, and Boeing have been working to develop AFCBs for aerospace use, but no AFCBs are currently certificated for use in airplanes. 306 The 1,200 circuit breakers were removed from 50 airplanes and were considered representative of the circuit breakers in the fleet. 307 Current may briefly exceed 1,000 percent, as shown in figure 34. 308 This paragraph is reprinted with the permission of UL, from “AFC[B]s Show Promise to Save Lives by Preventing Electrical Fires.” 1999. On the Mark, Vol. 5. No. 3-4.

Factual Information 151 Aircraft Accident Report 1.16.6.3 Aging Effects on Material Properties of Wires To better understand the condition of wiring in aging transport-category airplanes, the Safety Board contracted with Raytheon Systems Company (Raytheon) to test aged wire samples to the specifications for newly manufactured wire of that type. The aged wire samples were similar in age and type to the wiring on TWA flight 800 and were obtained from three recently (not more than 6 months before the wire samples were obtained) retired airplanes—two 747s, one manufactured in 1970 and the other in 1973, and a Douglas DC-10 manufactured in 1973.309 The wire samples ranged in length from 1 foot to more than 26 feet and in size from small, partial bundles with just a few wires to large bundles with many wires. The samples were taken from pressurized fuselage locations, most of which were relatively protected from traffic, exposure to light, or other potential environmental stresses. Figures 35a, 35b, and 35c show the sample origination locations for the 747 manufactured in 1970, the DC-10, and the 747 manufactured in 1973, respectively. Table 9 further describes the origin and potential environmental exposure of each sample. Table 9. The origin and potential environmental exposures of test samples. 309 According to the Raytheon report, the wires tested were “essentially identical.” Raytheon described all of the tested wires as tin-coated copper conductors with a dual layer of cross-linked extruded alkane-imide polymer insulation and a topcoat or Poly-X type wire. There was only one manufacturer (Raychem) qualified to produce wire for either the Boeing or MIL specifications during the wire usage period. When Raychem stopped producing this wire type in 1977, the associated MIL specification was cancelled. Aircraft Sample Origin of Wire Potential Environmental Exposure 747, Delivered 1973 Samples 1, 2, 3, and 4 Flight engineer’s panel in cockpit Possible ultraviolet (UV) ray exposure Sample 5 STA 380, right side of flight crew exit door Possible UV ray exposure Sample 6 STA 1438, directly beneath floor panel of seats 37A, B, and C Benign Sample 7 Just forward of the CWT on the right side Benign DC-10, Delivered 1973 Samples 1 and 3 Cockpit overhead center panel Hot, dry, no UV ray exposure Sample 2 STA 770, a 12-foot long section from above the R2 door Benign Sample 6 Not marked Not known Sample 7 Underneath flooring in cockpit Benign Sample 8 STA 919 to 1570, on the right side, overhead R2 door Elevated temperatures 747, Delivered 1971 Sample 1 Forward cargo compartment Benign

Factual Information 152 Aircraft Accident Report STA 90 STA 140 OVERHEAD HATCH TOP OF PILOTS FLOOR STA 520 STA 700 STA 830 KEEL BEAM ACCESS DOOR NO. 1 CARGO DOOR STA 134.75 NOSE CARGO DOOR STA 1480 STA 1000 STA 1140 STA 1241 STA 1350 Sample 6 Sample 1 SEC 44 SEC 42 SEC 41 FRONT SPAR MID SPAR REAR SPAR Figure 35a. Sample origination locations for the 747 manufactured in 1970. Figure 35b. Sample origination locations for the DC-10 manufactured in 1973.

Factual Information 153 Aircraft Accident Report In addition to visual examinations, Raytheon tested the wire samples against the following performance requirements for new wire: • Mechanical and electrical tests, including concentricity tests (to measure the thickness of the insulation layers and the overall sample geometry), dielectric tests (to determine the integrity of wire insulation), insulation resistance tests (to measure the electrical resistance that the insulation imparts between the conductor and ground), insulation tensile strength and elongation tests (to identify materials that have weakened because of thermal breakdown, UV degradation, or other mechanisms), and notch sensitivity tests (to measure the ability of a wire insulation to resist the propagation of a nick or cut through the insulation layers to the conductor). • Thermal tests, including blocking tests (to ensure that the insulation does not adhere to itself after heating), low-temperature (cold-bend) tests (to ensure that the wire retains physical and electrical integrity through mechanical and electrical stress at the temperature extremes), shrinkage tests (to indicate whether the wire insulation is physically and dimensionally stable when exposed to short-term high temperature), thermal shock tests (to measure an insulation’s ability to resist shrinkage and expansion following several thermal cycles to temperature extremes), and wrapback tests (to evaluate the wire’s ability to withstand thermal stress while under mechanical stress). STA 90 STA 140 OVERHEAD HATCH TOP OF PILOTS FLOOR STA 520 STA 700 STA 830 KEEL BEAM ACCESS DOOR NO. 1 CARGO DOOR STA 134.75 NOSE CARGO DOOR STA 1480 STA 1000 STA 1140 STA 1241 Samples 1, 2, 3, 4 Sample 5 Sample 7 SEC 44 SEC 42 SEC 41 STA 1350 FRONT SPAR MID SPAR REAR SPAR Figure 35c. Sample origination locations for the 747 manufactured in 1973.

Factual Information 154 Aircraft Accident Report • Thermal aging tests, including accelerated aging tests (to evaluate a wire’s ability to withstand a higher temperature under mechanical stress for a short period of time), lifecycle tests (to evaluate a wire’s ability to withstand slightly elevated temperatures under mechanical stress for a longer exposure time), and electrical integrity tests (to evaluate a wire’s electrical integrity during forced hydrolysis and mechanical properties and electrical integrity during heat aging). According to the Raytheon report, in general, the wire samples obtained from the three airplanes appeared to be in similar, “generally decent” condition; however, the condition and performance of the specific wire samples varied within and across the airplanes. Raytheon’s report indicated that visual examination of the wire samples revealed a variety of conditions: the presence of debris, such as lint and small chips, paint residue, and possibly foam or adhesive residue; contamination by what appeared to be oil or grease and a dark brown film; mechanical damage, such as insulation cracking, indentations caused by tight clamps or nylon tie wraps, abrasion of the insulation, and various nicks and cuts; and deep hot-stamp marking, which resulted in cracking of the insulation. The wire insulation was also observed to be brittle in all cases, and, in some cases, the outer layers cracked as a result of routine handling in the laboratory. About 20 percent of the wires received with damage failed in dielectric testing, indicating that the wires’ insulation did not meet the integrity requirements for new wire and that fluid could reach core conductors. Further, although the wire samples met most of the performance requirements for new wire when subjected to tests for insulation resistance, notch sensitivity, blocking, cold-bend shrinkage, thermal shock, and accelerated aging, problems/failures were noted during concentricity, elongation, dielectric, and lifecycle tests. For example, the Raytheon report indicated that several wire samples from different airplanes failed concentricity tests, “indicating that the insulation was degrading with layer separation.” Additionally, in several cases the elongation of the outer insulation was extremely low, indicating that “the wire became more brittle with age....None of the wire samples tested passed the lifecycle test, indicating that the long-term life of all samples may be limited. Additional thermal life testing…showed that the samples had some limited life remaining before beginning to fail physically and electrically.” The Raytheon report included the following conclusions:

1. Most wire samples tested had definitely aged as indicated by the outer jacket

[insulation layer] failures in accelerated aging and lifecycle.

1. The inner insulation continued to provide electrical integrity, as it was

designed to do, although the outer jacket [insulation layer] was losing its ability to mechanically protect the wire. [See figure 10.]

1. The wire submitted for testing would be expected to perform adequately in the

short term, provided there was no added stress beyond what it had experienced.

Factual Information 155 Aircraft Accident Report

1. The weak point in this wire type appears to be the lack of ability to maintain

physical and electrical integrity during extended elevated thermal exposure with mechanical stress. As the wire ages, there is an increased risk of dielectric problems [breakdown of wire insulation integrity], mechanical damage and loss of electrical integrity.

1. No wire was submitted that was exposed to high levels of environmental

exposure (such as wires from wheel wells, wing leading edges, etc.). Wire from these areas, would be expected to perform worse than the wire submitted. [See figures 35a, 35b, and 35c for sample locations.] Investigators found original Boeing markings (such as green W42A lettering) on the recovered wiring for most of the accident airplane’s systems,310 and many of the recovered FQIS wiring throughout the airplane had the darkened appearance of similar wire materials found in similar-aged airplanes. (As previously stated, the accident airplane had 93,303 total hours of operation at the time of the accident.) Raytheon found wires other than Kapton and single- and dual-layer insulation Poly-X in the sample wire bundles that it examined. These wires were insulated with single- and dual-layer Teflon and cross-linked polyalkene/polyvinylidene fluoride (an earlier type of wire that had been manufactured per MIL-W-81044/9).311 The Safety Board extended its contract with Raytheon to include testing of these additional three wire types and some various connectors found with the wire samples.312 As with the previous wire tests, Raytheon tested these materials to the acceptance standards for new material. Raytheon indicated that although the wire samples were in “generally decent condition for having 25 years service life, there were problems evident during the inspection and performance testing.”313 Although these wire samples passed most of the tests to which they were subjected, test failures were found. For example, the wire sample with a single layer of Teflon insulation exhibited two dielectric failures, the wire sample with a dual layer of Teflon of insulation failed the low-temperature (cold-bend) tests, and the MIL-W-81044/9 wire sample failed the low-temperature (cold-bend) and lifecycle tests. Specifically, Raytheon’s report regarding the second set of wire tests concluded the following: • The three wire types evaluated have degraded in different manners during service life. 310 TWA personnel installed some galley, lighting, and navigation/communication avionics wiring shortly after the airline took possession of the airplane and again during a modification in 1992. 311 A few short lengths of another wire (BMS13-38) were also found, but insufficient wire was available for testing. According to a Raychem technical paper presented at the 18th International Wire and Cable Symposium in Atlantic City, New Jersey, from December 3 to 5, 1969, Poly-X wire provided improved mechanical strength and fluid resistance at elevated temperatures, whereas “some of the newer hydraulic fluids attacked the MIL-W-81044 wires at elevated temperatures.” 312 For additional information, see Systems Group Chairman’s Factual Report—Addendum for Aging Aircraft Wire Testing by Raytheon, Report 2, dated January 28, 2000. 313 Although Raytheon’s statement indicated that the wire samples had 25 years of service life, some of the wires tested had not been available for use for that long.

Factual Information 156 Aircraft Accident Report • Single layer BMS13-48 [XL-ETFE, such as Tefzel] type wire developed dielectric failures, possibly due to the thinner wall thickness providing less mechanical protection to the wire. • Dual layer BMS13-48 [XL-ETFE, such as Tefzel] type wire passed dielectric tests without failures, but the outer layer has lost strength and flexibility as evidenced by the results of tensile, elongation, and low temperature cold bend tests. • Dual layer MIL-W-81044/9 type wire failed two tests. The outer layer cracked during the low-temperature cold bend test even though retaining electrical integrity. The wire failed lifecycle tests, indicating that the wire has aged significantly and has limited additional life. • The BMS13-48 [XL-ETFE, such as Tefzel] wire appeared to be in better physical shape than the [BMS13-42 Poly-X] wire tested [previously]. • None of the wire samples tested had been exposed to high levels of environmental stresses. Wire from areas exposed to high levels of environmental stress (such as wires in landing gear wheel wells, wing leading edges, etc.) would be expected to perform worse than the wire submitted. • The connectors from all three aircraft showed signs of aging, such as the presence of corrosion and hardening grommets. • Connectors from all three aircraft passed dielectric testing indicating they insulated the contacts from each other and the shell, but several of the connectors did not have the ability to have maintenance performed on the connectors. Contacts were not retained, grommets began to crumble, and some contacts were not removable. 1.16.6.3.1 Previous Reports about Wire Degradation and Aging In May 1976, Boeing published document D6-42974, “Investigation of Wire on Wire Abrasion Testing,” in which it documented the wear characteristics for several wire types. The results indicated that the resistance of the tested wire types was rated as follows, from best to worst: BMS 13-51 (Kapton), BMS13-13 (PVC Nylon), BMS13-42C (Stilan), BMS13-31 (mineral-filled PTFE), BMS13-48 (Tefzel), and BMS13-42A/B (Poly-X). Boeing’s report stated that “the results are more or less as would be expected and agree with predictions based on in-service experience by Boeing and others and with other evaluations of these wires.” Reports from NAFI noted that Poly-X was adopted for use on January 2, 1970, because MIL-W-81044/16 and /18 were phased out. Poly-X was first installed in the F-4N Phantom II, and the first wire insulation malfunctions were recorded in September 1975.314 The NAFI report also stated that failures of Poly-X in F-14 aircraft had been reported about 3 years after installation. On the basis of its observations of Poly-X failures, NAFI established that the time to field failures for Poly-X in U.S. Navy 314 For additional information, see U.S. Naval Avionics Facility. 1977. Investigation of Poly-X Wire Deterioration on F-4N Aircraft. NAFI Report No. 01-76, NARF-NORIS.

Factual Information 157 Aircraft Accident Report operations was between 3 and 5 years in service.315 Additional laboratory tests conducted by NAFI and historical evidence indicated that Poly-X wires aged 2.3 to 7 times faster than Kapton. The NAFI report stated, “if it is assumed that there is reasonable correlation between laboratory tests and service experience, then Kapton-insulated wire may fail after 7-21 years of service. The use of milder cleaning compounds…should extend the service life of the installation.” After the NAFI reports were published and the U.S. Navy switched to milder cleaning compounds, the military, the aviation industry, and Boeing continued to study the wire-aging process. A 1997 Lectromec report316 documented the aging of Kapton wire insulation in various locations in U.S. Navy P-3 airplanes. This report indicated that wire insulation in areas exposed to sunlight and moisture could reach the end of its service life (chemically) within 1 year, whereas wire insulation in protected areas in the same airplane could survive for up to 10 years. Figure 36 shows the percent probability of failure of Kapton wiring in different locations in the P-3 airplane. The Safety Board also found that Boeing documented and described cracked wire insulation in SL 747-SL-20-048, issued January 25, 1995. Boeing described “the virtue of a wire by wire inspection” of wing leading edge and engine strut areas. However, the SL also stated that “Boeing generally does not recommend special wiring inspections unless a fault is experienced or an area is disturbed for other reasons.” 315 The Safety Board notes that airplanes flown by the U.S. Navy may experience environmental conditions to which civilian airplanes may not be subjected, including continuous operations in humid salt-air environments and frequent washings with acidic cleaning solutions. Further, wires in the wing-fold area (which are nonexistent on civilian airplanes) were often exposed to more vibration and environmental conditions (such as sunlight, wind, rain) than wiring in a like location on a civilian airplane. 316 For additional information, see the following Lectromec reports/papers: Aging Measurements of Operating Aircraft Wiring; Implications for Specification Writing and Aircraft Reliability, dated July 10, 1997; and Description of Lectromec WIDAS Aging Support Program, dated November 11, 1998. Also, see Eaton, D. R. and Bruning, A. 1999. Economic Aircraft Wire Maintenance, Inspection and Repair: Performance Implications.

Factual Information 158 Aircraft Accident Report Figure 36. Chart showing the percent probability of failure of Kapton wiring in different locations in the P-3 airplane. Location Bomb Bay Wing, Outboard Trailing Edge Galley/Aft Cabin Wing Center Leading Edge Forward Electrical Load Center Avionics Bay C1 Wing Inboard/Ro Leading Edge Avionics Bay H1 Hydraulic Service Center Under De Main Wheel Well Nose Wheel Well Wing Center Trailing Edge 1 2 5 10 20 0 0 0 0 0 0 15 21 20 38 31 0 0 0 0 0 0 0 20 23 26 42 57 74 0 0 0 15 24 43 32 40 39 50 89 91 24 28 41 23 35 57 46 46 56 72 100 100 33 53 61 30 48 68 60 78 64 100 100 100 Years Percentage of Failures

Factual Information 159 Aircraft Accident Report 1.16.6.4 Electromagnetic Interference 1.16.6.4.1 Electromagnetic Interference from External Sources The Safety Board requested that the DoD Joint Spectrum Center (JSC) conduct research into and calculate the electromagnetic environment (EME) in which TWA flight 800 was likely to have been operating at the time of the accident (that is, the electromagnetic field strength from the external emitters to which the airplane was exposed during its flight). Fixed and mobile radio frequency (RF) emitters317 in the TWA flight 800 environment were identified. Ground-based emitters with frequency assignments318 for the eastern United States (as identified in the JSC-maintained frequency assignment databases) comprised the fixed emitters. These ground-based emitters included the following equipment types: ASR, air route surveillance radar, airport surface detection equipment, military navigation radar, weather radar, terminal Doppler weather radar, long-range tracking radar, U.S. Navy radar shore installations, space object tracking radar, over-the-horizon radar, and research and development emitters.319 The RF equipment on board air and sea platforms near TWA flight 800 (as identified by the Safety Board, FAA, U.S. Navy, USCG, and Air National Guard records) comprised the mobile emitters. After the RF characteristics of the fixed and mobile emitters were collected, the electrical field strengths and energy densities these emitters could generate at the accident airplane’s position and altitude were calculated for the time of its last secondary radar return. The calculations were based in part on the emitter’s distance from that location and the propagation path losses associated with those distances. The JSC report indicated that the following assumptions were used in calculating the potential electric field strengths at the TWA flight 800 location: All fixed and mobile transmitters were assumed to be emitting except commercial airline high frequency (HF) communication…equipment. Commercial airline HF [communication] equipment are typically not employed when…VHF air traffic control is available.[320] Military HF [communication] transmitters were assumed to be active at the time of the accident. In calculating the peak and average electric field strengths generated at TWA flight 800, maximum values of peak power, duty cycle, and antenna mainbeam gain were assumed. Where the duty cycles of pulsed emitters were unavailable, 317 According to an April 13, 2000, letter from the JSC, emitters are “pulsed sources of low duty cycle and narrow antenna beamwidths.” 318 The agencies responsible for ensuring that there are no conflicts between different emitters (the Federal Communications Commission for civilian emitters, the JSC for military emitters) assign frequencies that can be used for various functions. 319 Although television, radio, and cellular telephone ground emitters also contribute to the EME, the electromagnetic field strengths and energy densities generated by these emitters are significantly weaker than the other emitters considered during this research. 320 Because commercial airline HF equipment is typically not used and to limit the scope of the JSC analysis, it was assumed that this equipment was not emitting at the time of the accident.

Factual Information 160 Aircraft Accident Report the JSC compared combinations of pulsewidths and pulse repetition rates to determine the highest duty cycle. The avionics on board USAir[ways] flight 217 [located about 2.5 nm southwest of TWA flight 800 at 17,000 feet msl] were assumed to be representative of the commercial aircraft in the vicinity of TWA flight 800. Since USAir[ways] flight 217 was the closest commercial aircraft to TWA flight 800, the electric field strength predictions due to the emitters on board USAir[ways] flight 217 were assumed to represent the worst case for the EME due to commercial aircraft emitters. [To reduce the size of the list of emitters to be further analyzed,] a peak electric field strength of 1 volt/meter (V/m) at the accident location was selected as a conservative threshold for the minimum field strength that needed to be considered.[321] The JSC report stated that when it included terrain and antenna pattern data in its electric field strength calculations, it identified 40 fixed ground-based emitters that had the potential to generate peak electric field strengths greater than 1 V/m at the accident location. Two of the 40 fixed ground-based emitters were identified as having the potential to generate an average electrical field strength322 greater than 1 V/m at the accident location: the Westford, Massachusetts, tracking radar and the Brookhaven, New York, weather radar emitters. According to the JSC report, its calculations revealed that no mobile emitters, shipboard or airborne, could generate average electric field strengths greater than 1 V/m. The JSC report further stated, “although many classified emitters were identified in the environment, none of them were close enough or powerful enough to generate peak or average electric field strengths greater than 1 V/m.” The energy density values (in mJ/m2) were calculated to help relate the field strength values to units which the investigators could more readily compare with the MIE. According to the April 13, 2000, letter from the JSC, it is possible for the energy density from emitters to overlap in time and space, having an additive effect on the energy density available at that time and space. However, according to JSC, the probability of the energy density from any two emitters to precisely overlap in time and space at the accident site was less than 1.85 x 10-4 and would result in an energy density increase (for the highest energy density emitter) from 0.013 mJ/m2 to 0.02 mJ/m2. Further, the likelihood of additional emitters overlapping in time and space at the accident site decreased exponentially with each additional emitter. For example, the calculated probability of 3 dominant emitters overlapping in time and space at the accident site was 7.1 x 10-9 (with a resultant energy density increase to 0.024 mJ/m2), whereas the probability of 11 dominant emitters overlapping in time and space at the accident site was less than 1.1 x 10-83 (with a resultant energy density increase to 0.043 mJ/m2). 321 The 1 V/m threshold was used based on the judgement of JSC engineers that there was no way to induce an explosion in the CWT with field strengths under that level. Subsequent NASA Langley Research Center (LaRC) research confirmed this engineering judgement (see section 1.16.6.4.1.1). 322 Average field strengths are the ones that would better create the energy required to create a spark. The peak field strengths exist for such a short period of time (microseconds) that there is not enough time to affect wires in a way that would create a spark with enough energy to ignite a fuel/air mixture.

Factual Information 161 Aircraft Accident Report 1.16.6.4.1.1 NASA’s Report Regarding Electromagnetic Interference from External Sources At the Safety Board’s request, NASA’s LaRC conducted tests (using the data developed by the JSC) to determine the worst-case energy levels from external RF transmitters that could be induced to fuel tank FQIS components. To this end, LaRC researchers developed and validated a new computer code that was used to predict the passenger cabin shielding effectiveness and to model signal-to-wire coupling within the cabin.323 The researchers used a dominant external emitter identified by JSC324 as the input signal for their computer code. The LaRC report indicates the following: the maximum available energy inside the TWA 800 passenger cabin from any identified dominant emitter was determined to be less than 0.1 [mJ], which is below estimates of the minimum ignition energy required for ignition of Jet A fuel vapor. Energy coupled to aircraft wiring within the passenger cabin will be several orders of magnitude (approximately 10-4 times) less than this. 1.16.6.4.2 Electromagnetic Interference from Internal Sources The Safety Board contracted with the NAWC-AD to measure the voltage harmonics on the captain’s channel of the CVR325 and determine if electrical power transients could induce sufficient energy into the FQIS wiring through capacitive and inductive cable coupling to ignite fuel in a 747-100 airplane’s CWT.326 In November 1999, NAWC-AD conducted electrical ground tests at AAR Aircraft Services, Inc.’s, facilities in Roswell, New Mexico. The tests in Roswell, New Mexico, were inspired by laboratory tests conducted at Boeing in 1997,327 which created transient voltages in CWT FQIS wires by switching on and off the power (simulating large power relays or motor loads) in wires that had been laid parallel to the CWT bundle. The tests induced up to 0.6 mJ of energy into a CWT harness, exceeding Boeing’s specification of 0.02 mJ and the MIE of 0.25 mJ referenced 323 Note: The EMI would be induced on wires outside the CWT, and the energy would then be transferred into the CWT. 324 The JSC identified the dominant external emitter as the Brookhaven, New York, weather radar and an airborne radar emitter as a close second. The emitter used by the LaRC researchers was the search radar at Riverhead, New York, which had the third highest field intensity levels. This emitter was used to allow for a decreased computation time for the numerical computer code developed by LaRC. Even at this lower frequency, the calculations required 182 central processing unit hours to complete. To perform the calculations using the dominant emitter would have taken on the order of 14,000 central processing unit hours. 325 For more information, see section 1.11.1.1. 326 For the purposes of this investigation, the Safety Board examined the effects of EMI as a potential ignition source for the CWT overpressure event. The Board did not examine the potential effects that EMI might have on an airplane’s navigation/communication systems. 327 These tests were described by a Boeing engineer during his testimony at the Safety Board’s public hearing in December 1997. They are also discussed in the FAA’s NPRM 97-NM-272-AD and in Boeing’s May 26, 1998, comments on that NPRM.

Factual Information 162 Aircraft Accident Report in API 2003. The tests were conducted using maximum source voltages of 800 volts with resultant voltage transients in excess of 1,000 volts.328 The Safety Board contracted with NAWC-AD to conduct tests similar to those conducted by Boeing, except that they were to be conducted on an airplane using actual airplane systems to generate the switching transients. To prepare for these tests, NAWC-AD and Safety Board personnel examined and analyzed Boeing drawings and documents and examined more than 900 wires from systems in a 747-100 to determine the electrical loads (components) to which they were attached and to determine which of these loads would have the highest potential for coupling energy to CWT FQIS wiring if their wires were corouted. The wires connected to loads with the highest coupling potential were repositioned within wire bundles/trays so that they were adjacent to the FQIS wiring329 to provide a “worst-case” routing situation. Because the CWT access doors in the 747-100 did not provide adequate access for instrumentation for these tests, the researchers used a surrogate CWT330 that provided better instrumentation access. The surrogate CWT was positioned on the ground by the test airplane’s main landing gear, and the airplane’s FQIS wiring was disconnected from the airplane’s CWT and connected to the surrogate CWT. The airplane’s systems were powered using engine-driven generators, and the FQIS was energized.331 Voltage and current measurements were taken at fuel probes in the surrogate CWT as the airplane systems’ electrical loads were cycled. Additional measurements were taken with conductive debris (a few strands of aluminum wool) placed either across terminals of a fuel probe or from a terminal of a fuel probe to the simulated CWT to create and calculate the energy dissipation through the debris. According to the NAWC-AD report,332 the maximum energy calculated for a transient through conductive debris (a few strands of aluminum wool) was 0.125 mJ. 328 The 800 volts were much higher than the 25 to 125 volts found in wiring corouted with the 747 FQIS wiring system; however, it prompted further tests. 329 The wires for the high coupling potential loads were only moved to be adjacent to the FQIS wiring when they were corouted in the same bundle or tray. In portions of their runs where the two sets of wires were not corouted, they were not moved. 330 According to a NASA report, although the surrogate tank had a similar overall volume to the 747-100 CWT, the surrogate tank had different overall dimensions, was made of steel (not aluminum), and was not divided into bays like the CWT. 331 To avoid igniting fuel in the airplane’s wing tanks during these tests, nitrogen gas was continuously pumped into the on-board fuel tanks through the pressure-refueling receptacle on the left wing. The inertness of the on-board tanks was continuously monitored throughout the tests by measuring the oxygen content from the outflow vents at the tip of each wing. 332 See Naval Air Warfare Center–Aircraft Division. 2000. Boeing 747-100 Fuel Quantity Indication System (FQIS) Susceptibility to Induced Energy from Capacitive and Inductive Cable Coupling. NAWCADPAX/TR-2000/33.

Factual Information 163 Aircraft Accident Report 1.16.6.4.2.1 Electromagnetic Interference from Personal Electronic Devices On Board TWA Flight 800 The Safety Board was aware of cases in which signals from PEDs reportedly adversely affected airplane systems.333 Therefore, to determine whether EMI from PEDs on board the accident airplane may have been involved in this accident, it requested that scientists at NASA LaRC evaluate the effects of signals from PEDs on board the airplane (such as laptop computers, video games, AM/FM and other handheld [CB, police, fire, business, maritime] radios, tape players, compact disc players, cellular telephones, garage door openers, remote control toys, and pagers) on airplane wiring. The report noted the following: [the electromagnetic] environment [created by a transmitter] is highly dependent upon distance from the transmitter. This relationship changes as the inverse of the distance squared (1/R2). For example, if you move from 1 meter to 100 meters away, the available power [from a transmitter] is reduced by 10,000. Alternatively, it can be demonstrated that a portable radio transmitting about 5 watts may generate field levels in excess of 100 Volts/meter very close to its antenna…[PEDs] are typically operated over a wide range of frequencies and power levels, and can often be set to radiate continuously. When used inside an aircraft, PEDs can be placed very close to aircraft wiring, and their emissions are not subject to airframe attenuation as [external sources are]. The NASA LaRC research into the effect of PEDs on the FQIS system was designed to study whether a typical portable device could possibly create an ionization event (spark) or excessive heating, if all available power is applied directly to the FQIS wiring. To support this effort, LaRC researchers performed the following analysis and experimental testing: • determined the worst-case electromagnetic threat that could have been created by commercially available PEDs in terms of power and frequency; • determined the electrical characteristics of the CWT and FQIS wiring in a retired 747-100 airplane; • removed the fuel probes and FQIS wiring from a retired 747-100 airplane, installed them in a laboratory test chamber, and conducted tests to determine the RF power required to achieve a spark or excessive heating of the laboratory installation; • determined scaling factors required to compare the laboratory with the airplane FQIS installations; and • assessed existing guidelines and references for understanding how continuous RF signals may impart sufficient energy to ignite fuel vapors. 333 For example, a June 29, 1998, NASA Aviation Safety Reporting System report (98-30/10-2) cited anomalous displays on navigation instruments at both pilot positions of a DC-9 during the approach to landing. The report indicated that after landing, a flight attendant reported that a passenger “received a pager call while the airplane was on base leg, and refused to turn it off.”

Factual Information 164 Aircraft Accident Report The NASA LaRC report concluded that the strongest electrical signal that could be coupled to the FQIS from PEDs in the passenger cabin and then cause a spark in the CWT was about 1.5 watts (about one-tenth of the minimum power level required to induce a spark from the FQIS).334 This was obtained during laboratory testing by applying a simulated intermittent fault (an arc-gap between the FQIS components and a ground lead)335 at a worst-case location for voltage enhancements. Without an intermittent fault, no detectable discharge event was observed, even when applying more than 10 watts of RF power. The report further stated that the worst-case coupling from PEDs in the passenger cabin would be coupled to the FQIS wires, not directly to the tank volume. Although the FQIS coupled power levels predicted to result from a PED signal vary as a function of emitter frequency, LaRC researchers reported that the maximum predicted power level was about 0.06 watt. 1.16.6.5 Boeing’s Center Wing Fuel Tank Ignition Fault Tree Analysis336 Computations Although the FAA regulations regarding the certification of new airplanes in December 1969, when the 747-100 airplanes were certificated, did not require manufacturers to conduct a quantitative evaluation of probability levels for system failures, the FAA currently does require manufacturers to perform such an evaluation for certification. The regulatory guidelines addressing quantitative evaluation of failure modes were adopted in April 1970 as amendment 25-23 to 14 CFR Part 25; the quantitative evaluation procedures were subsequently detailed in AC 25.1309-1A. The probability levels are described in terms of the consequences of minor, major, and catastrophic failures. For example, Section 25.1309 states the following: (b) The airplane systems and associated components, considered separately and in relation to other systems, must be designed so that— (1) the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable….[337] 334 For these tests, the NASA LaRC researchers were limited by their laboratory equipment to using continuous wave signals instead of pulsed signals. Power measurements were used to characterize continuous wave signals, and they were proportional to energy measurements over the short term. Energy measurements from continuous wave signals were a function of how long the signal was maintained and would not have represented the conditions present during the accident. 335 A ground connects electrical circuits to a large common conductor considered to be at zero electrical potential (such as the earth or, in the case of an airplane, the skin of the airplane and then overboard to the atmosphere). 336 A fault tree analysis is designed to examine an end event through consideration of assumed precipitating events. Each of these precipitating events is in turn broken down until a level is attained in which no additional precipitating events will occur. The total of all of the events and the way in which they are tied together creates the fault tree analysis. 337 AC 25.1309-1A defines the term “extremely improbable” failure conditions as conditions that are “so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type.” These type of conditions are further defined as “those having a probability on the order of 1 x 10-9 or less” for each flight hour based on a flight of mean duration for the airplane type.

Factual Information 165 Aircraft Accident Report (d) Compliance with the requirements of paragraph (b) of this section must be shown by analysis, and where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider– (1) Possible modes of failure, including malfunctions and damage from external sources; (2) The probability of multiple failures and undetected failures; (3) The resulting effects on the airplane and occupants, considering the stage of flight and operating conditions, and (4) The crew warning cues, corrective action required, and the capability of detecting faults. Similarly, Section 25.901(c) requires the following: [f]or each powerplant and auxiliary power unit installation [including the fuel tank system], it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane except that the failure of structural elements need not be considered if the probability of such failure is extremely remote. Although no fault tree analysis report was required (nor was one conducted) for the accident airplane’s certification, as part of its involvement in the Safety Board’s investigation of the TWA flight 800 accident, Boeing developed and submitted a CWT ignition fault tree ananlysis report on November 25, 1996; this report was subsequently revised on December 20, 1996.338 The assumptions made in developing Boeing’s fault tree analysis report included the following: • Only events considered germane to the TWA event were quantified. • Aircraft was assumed to be in climb/cruise configuration. • The CWT FQIS worked normally on the previous flight. • The delivery schedule of this report required that many of the failure rates developed for events in this report be subjectively established. Using the qualitative criteria contained in…AC 1309-1A as shown below, best engineering judgement used qualitative risk assessment and then assigned [the following] quantitative values: probable = 1 x 10-05; improbable = 1 x 10-06 to 1 x 10-09; and extremely improbable = 1 x 10-10. • Quantitative rates assigned were the result of experience with [the] system and discussion with subject matter specialists. • Failure rates will be reviewed for refinement as the final fault tree is constructed.[339] • Air conditioning packs were…intact at impact. 338 For additional information, see Systems Group Chairman’s Factual Report—Addendum for Fault Tree Data, dated May 19, 2000. 339 After the December 1996 revision, no further fault tree analysis reports were received from Boeing.

Factual Information 166 Aircraft Accident Report • A combustible fuel/air mixture existed in all fuel tank air spaces as modeled. • Scavenge pump switch was turned off at the time of the event. Boeing’s CWT ignition fault tree analysis report identified the ignition of the CWT as the top-level failure mode, and the impact of all lower-level elements that compose the tree was evaluated using mathematical probability relationships. The fault tree analysis was constructed downward from the top-level event by progressively determining the conditions required for each lower-level event. Eventually, the tree reached a level where an event had no preceding events; this event was termed a “basic element.” Boeing’s CWT fault tree analysis report identified 167 basic elements. According to Boeing, each basic element was assigned a failure rate and an exposure time (the maximum time presumed by Boeing that the condition could go undetected) based on either in-service data or engineering estimates. These failure rates and exposure times were combined to produce a probability of failure for each element, using the following formula: probability of failure = 1 x e(-failure rate x exposure time). Some of the basic elements identified in Boeing’s fault tree analysis report are shown (with their failure rates, exposure times, and calculated event probability) in table 10. Table 10. Several fault tree analysis basic elements, as identified in Boeing’s fault tree analysis report, with their failure rates, exposure times, and calculated event probability. Basic Element Failure Rate (events/hour) Exposure Time (hours) Basic Element Probability Fuel/air mixture in CWT will support explosion N/A N/A 1 x 10-00 Metallic object capable of creating spark in CWT 1 x 10-06 8.0 8 x 10-06 Tank sealant decays, resulting in exposed metal surface 1 x 10-07 8.0 8 x 10-07 Electrical faults in surge tank 1 x 10-07 8.0 8 x 10-07 Fire propagates from surge tank to CWT 1 x 10-06 8.0 8 x 10-06 Conductive material bridging terminals 3.55 x 10-07 8.0 2.64 x 10-06 Unique wire-to-wire faults route to FQIS leads in right wing 2.44 x 10-07 8.0 1.95 x 10-06 Fuel probe contacts CWT structure 3.55 x 10-07 8.0 2.84 x 10-06 Unique wire-to-wire faults route to FQIS leads in left wing 2.44 x 10-07 8.0 1.95 x 10-06 Fire propagates from WCS dry bay to CWT 1 x 10-05 8.0 8 x 10-05 Combustible fuel/air mixture in air conditioning pack bay N/A N/A 1 x 10-00 Explosion-proofed equipment does not operate as designed 1 x 10-08 60000 6 x 10-04 Fire propagates from air conditioning pack bay to WCS dry bay 1 x 10-05 8.0 8 x 10-05 Fuel leak to air conditioning pack bay 1 x 10-05 8.0 8 x 10-05 VSO unit internal fault results in power to FQIS lead 1.4 x 10-07 8.0 1.12 x 10-06 FQIS wiring fault produces ignition source in main tank 1 x 10-6 8.0 8 x 10-06

Factual Information 167 Aircraft Accident Report Boeing’s fault tree analysis report contained a graphical representation of the fault tree and a table showing the failure rates and exposure times for the fault tree’s basic elements. During its review of the fault tree analysis report, the Safety Board noted that, in some cases, the information in the graphical representation of the fault tree did not agree with the information in the table. For some elements, the disagreement was several orders of a magnitude. According to Boeing’s graphical representation, the probability of an ignition event in the CWT (the top-level failure mode) was 8.45 x 10-11. Although Boeing did not calculate the top-level failure mode probability using the table values, when Safety Board investigators substituted the table values into the appropriate positions in the fault tree and completed the calculations, the table values showed that the probability of an ignition event in the CWT was 1.46 x 10-5. Table 11 shows the differences between the data presented by Boeing in a graph and a table for of the some basic elements of its fault tree analysis. Table 11. Some of the basic elements of Boeing’s fault tree analysis, showing the differences between the data presented in Boeing’s graphical and tabular representations. Description Failure rate (graphical) Failure rate (tabular) Exposure time (graphical) Exposure time (tabular) Probability of failure (graphical) Probability of failure (tabular) Optimum air gap exists 4 x 10-07 4 x 10-07 0.22 8 8.8 x 10-08 3.2 x 10-06 Optimum air gap existsa 4 x 10-07 4 x 10-07 0.22 0.2 8 x 10-08 8 x 10-08 Leak through side-of-body rib from web fatigue crack 7.69 x 10-07 1 x 10-05 8 8 6.15 x 10-06 8 x 10-05 Air gap to ground exists 4 x 10-07 N/A 0.22 N/A 8 x 10-08 1 x 10-00 Scavenge pump deterioration or pump wear results in loss of protection 3.4 x 10-08 6.9 x 10-07 8 8 2.72 x 10-07 5.52 x 10-06 Foreign object provides ground in CWT N/A N/A N/A N/A 1 x 10-06 1 x 10-00 Current limit circuit failure (no indication) 1.1 x 10-07 8 x 10-07 8 8 8.8 x 10-07 6.4 x 10-06 Circuit breaker fails closed 4.76 x 10-06 4.76 x 10-06 60000 60000 2.86 x 10-01 2.48 x 10-01 Short to power on lead in wire bundle 2.44 x 10-08 4.07 x 10-08 8 8 1.95 x 10-07 3.26 x 10-07 Wire-to-wire short 4.07 x 10-09 2.44 x 10-07 8 8 3.26 x 10-08 1.95 x 10-06 Sufficient energy created to ignite fuel/air mixture 1 x 10-07 1 x 10-05 8 8 8 x 10-07 8 x 10-05

Factual Information 168 Aircraft Accident Report Because of these inconsistencies in Boeing’s fault tree analysis report, because of other questions the Safety Board had regarding the detailed information used to construct the fault tree,340 and because the fault tree did not reflect the findings of the ongoing investigation, on June 4, 1998, the Board requested that Boeing further review and revise the fault tree analysis report, as necessary. On July 29, 1998, Boeing responded and indicated the following, stating that although the Board was correct in some of its points: we [Boeing] do not believe that revising the [fault tree analysis] by incorporating new data or changing the probability numbers will help identify new areas to inspect or help identify the cause of the accident. We believe it would be more productive to continue the various inspection and modification programs that are presently underway. The Safety Board subsequently asked NASA’s George C. Marshall Space Flight Center (MSFC) to review Boeing’s fault tree analysis report and the Board’s concerns. In a November 25, 1998, letter, NASA MSFC personnel stated the following: Many of the probabilities, failure rates, and/or exposure times were much lower than would reasonably be expected. The probability of occurrence should be higher and/or exposure times should be longer on many of the basic events…Based on our evaluation of the tree and the information provided by the [Safety Board], the subject fault tree analysis quantification cannot stand up to peer review and should not be viewed as realistic. It should be noted that the logic of the tree could not be fully evaluated since we did not have access to the engineering drawings and schematics of the system. However, based on previous systems experience, we would expect the tree to be constructed differently. NASA MSFC personnel further indicated that the exposure time numbers used in Boeing’s fault tree analysis report appeared to be overly optimistic and that the use of more realistic numbers would result in an increased probability of a top-level failure. Tank sealant decays, exposing metal 1 x 10-07 1 x 10-06 8 8 8 x 10-07 8 x 10-06 Scavenge pump burnthrough results in ignition source 1.15 x 10-08 1 x 10-07 8 8 9.2 x 10-08 8 x 10-07 Scavenge pump internal friction results in ignition source 3.45 x 10-07 2 x 10-06 8 8 2.76 x 10-06 1.6 x 10-05 a. This event was listed in the fault tree two separate times with different values. 340 For example, the Safety Board questioned the exposure times listed for some of the basic elements in Boeing’s fault tree analysis report. According to Boeing, most of the items listed in tables 8 and 9 had exposure times of 0.22 to 8 hours; however, the Board notes that some of these items would likely go undiscovered until heavy maintenance inspections (a potential exposure time of more than 2,000 hours), whereas others might never be detected during the life of the airplane. Table 11. Some of the basic elements of Boeing’s fault tree analysis, showing the differences between the data presented in Boeing’s graphical and tabular representations.

Factual Information 169 Aircraft Accident Report In its submission, Boeing stated that, because the fault tree analysis was developed only to support the accident investigation, it did not go through the “iterative review process with the FAA normally associated with certification of a system, nor were the underlying [failure modes and effects analyses] FMEAs developed that normally would be the source of data to build the [fault tree analysis].” 1.16.6.5.1 Other Fault Tree Analysis Information During its evaluation of the FMEA/fault tree process for this investigation, the Safety Board noted several other accidents/incidents in which failures occurred that either had not been anticipated or had not been perceived as catastrophic and, therefore, had not been appropriately addressed in the manufacturer’s fault tree analysis. For example, after a series of accidents and incidents in the 1990s involving uncommanded rudder movements on 737s, the Board recommended that the FAA convene an engineering test and review board to evaluate the 737 rudder system.341 The resultant engineering test and review board, which convened in 1999, identified catastrophic failure modes that had not been identified through the FMEA and fault tree analyses submitted by Boeing in 1997 in connection with certification of the 737-NG airplanes. The recent in-flight failure of a horizontal stabilizer actuator on an Alaska Airlines MD-80 may be another example of a failure that was not anticipated through the FMEA/fault tree analysis process.342 Further, the Safety Board observed that fault tree analyses used in noncommercial aviation industries do not always anticipate every failure. As evidenced by the Space Shuttle Challenger disaster, even systems that have undergone NASA’s failure analysis review can experience unexpected failure modes. In addition, the nuclear power accident that occurred on March 28, 1979, at the Three Mile Island nuclear power plant near Harrisburg, Pennsylvania, was attributed to a series of unanticipated failures that were, therefore, not considered during development. According to the October 30, 1979, “Report of the President’s Commission on the Accident at Three Mile Island,” the valve failure that initiated the accident sequence was not detected by the operators in the control room, who relied on the indicator light indicating that the valve had closed as intended. The operators did not heed other indications that the valve had not closed. The report stated, “Prior to [the Three Mile Island accident], the NRC [Nuclear Regulatory Commission] had paid insufficient attention to [loss of coolant accidents] of this size and the probability of their occurrence in licensing reviews.” Similarly, the NRC’s January 1980 “Report to the Commissioners and to the Public” noted the following: 341 For additional information, see National Transportation Safety Board. 1999. Uncontrolled Descent and Collision with Terrain, USAir Flight 427, Boeing 737-300, N513AU, near Aliquippa, Pennsylvania, September 8, 1994. NTSB/AAR-99/01. Washington, DC. 342 The investigation of the January 31, 2000, Alaska Airlines flight 261 accident is still ongoing (as of the date of report publication).

Factual Information 170 Aircraft Accident Report The greatest risk of an accident comes not from the design basis accidents…but from small loss of coolant accidents and relatively routine transients compounded by multiple failures or human error, having a higher probability of occurring than a large pipe break. These types of potential accident sources have, however, been all but ignored by the NRC in the regulatory review process. 1.16.6.6 Compensator Probe Testing at the FAA’s William J. Hughes Technical Center During June/July 1999, the Safety Board conducted a series of tests at the FAA’s William J. Hughes Technical Center, in Atlantic City, New Jersey, to determine the physical effects that the ignition and explosion of Jet A fuel vapor would have on a CWT compensator probe assembly.343 Specifically, the tests were designed to correlate observed damage to the compensator lead wire assemblies to the location of an ignition source in Jet A vapor. To accomplish this goal, the tests were conducted with four different ignition source locations. Video documentation of the tests showed that it was possible for a combustion flamefront to traverse the interior of the compensator. After the tests, the test compensators were compared with the recovered TWA flight 800 compensator. In many instances, evidence of thermal damage (including soot deposits to lead wires and lead wire guides and slight melting of the lead wire guide) was observed after the tests. However, in all cases, the thermal damage observed on the test compensators was much less severe than that observed on the recovered TWA flight 800 compensator lead wire assembly. 1.16.6.7 Fuel Pump Tests (Motor Cavity Explosions) The Safety Board’s review of the scavenge pump design revealed that the scavenge pump motor was mounted on the aft surface of the rear spar (external to the CWT, in the main landing gear wheel well) but contained fuel-cooled windings. Fuel supplied to cool the windings passed through a flame suppression system consisting of a small-diameter tube in series with a check valve. Further, the scavenge pump contained a thermal fuse designed to open at less than 400° F. (The review indicated that the scavenge pump had satisfactorily completed qualification tests during which the pump was operated without cooling fuel until the thermal fuse opened. The Board’s review of qualification test results and service records revealed no evidence of fuel vapor igniting inside or outside the scavenge pump motor.) During its investigation of the TWA flight 800 accident, the Safety Board conducted tests to determine the explosion-proof characteristics of an old and a new scavenge pump with intact flame arrestor tubes and check valves. When vapors in the motor housings of both the old and new scavenge pumps were ignited, no sparks or flames escaped from the pump motor to ignite the explosive atmosphere in the representative laboratory fuel tank adjacent to the pump. Further, the scavenge pumps successfully 343 For additional information, see the FAA’s Summary Data Report: Investigation of the Effects of Combustion on a Fuel Quantity Indicating System Fuel Compensator Probe, dated January 19, 2000.

Factual Information 171 Aircraft Accident Report contained multiple explosions that were intentionally ignited within the pump motor cavity, preventing the ignition from transferring to the fuel tank. (Figure 37 is a diagram of a scavenge pump.) Because the Board became aware of instances in which the flame arrestor tube was broken or missing, investigators also conducted a series of tests to determine whether the scavenge pump motor housing would contain explosions with only one of the flame suppression system components (either the flame arrestor tube or the check valve) functioning. In all tests, the scavenge pump housing contained the explosions, and the explosive atmosphere surrounding the test pump did not ignite. During its postaccident examination of other transport-category airplanes, the Safety Board observed that components in the electrical connector on a scavenge pump in a retired 747 were deteriorated. (Boeing ASBs 747-28A2194 and 747-28A0043, both dated January 18, 1996, “encouraged” operators to inspect for degradation in connectors.) Investigators observed that several scavenge pump electrical connectors had been manufactured of a material that degraded with long-term exposure to fuel. Boeing provided the Board with a service history for the 747 scavenge pump for the 10 years preceding the accident. When queried about the brevity of this history, Boeing indicated that most operators did not return the scavenge pumps to the manufacturer for overhaul. CHECK VALVE FLAME SUPPRESSION PASSAGE (TUBE) (LANDING GEAR BAY SIDE) REAR SPAR FORWARD (CWT SIDE) MOTOR IMPELLER Figure 37. A diagram of a scavenge pump.

Factual Information 172 Aircraft Accident Report As a result of these findings, Boeing issued ASB 747-28A2206, dated September 25, 1997, and AD 97-25-06, effective December 16, 1997. AD 97-25-06 contained the following summary: The actions specified in this AD are intended to prevent potential failures within the electrical motor assembly of the scavenge pump, which could result in leakage of fuel from an electrical connector into the main landing gear well, or electrical arcing within the scavenge pump motor; those conditions could result in a fuel fire in the wheel well. The AD required disconnection of the electrical connector, a one-time inspection to identify the P/N of the electrical connector, and possible scavenge pump replacement. The FAA subsequently received a report about damage to the internal wiring of a scavenge pump after a replacement connector was found to have a longer backshell component. (The longer backshell provided insufficient clearance for parts inside the pump, which could cause arcing in the motor and fuel leakage into the wheel well.) As a result, Boeing issued ASB 747-28A2215, dated May 14, 1998, which called for another one-time inspection of the scavenge pump motor-impeller P/Ns, with part replacement if necessary. The FAA made this action mandatory by releasing AD 98-14-17, effective July 23, 1998. 1.16.6.8 Electrostatic Research Electrostatic hazards have been recognized for many years and have resulted in numerous publications, including the previously discussed API 2003 and the FAA Aircraft Lightning Protection Handbook, DOT/FAA/CT-89/222.344 The Safety Board contracted with the AFRL at Wright Patterson Air Force Base and the Naval Research Laboratory (NRL) to conduct research into fuels, fuel additives, and electrostatic charging of fuels. The AFRL tests revealed that, of the various items tested, Teflon-cushioned wire clamps (known as Adel clamps)345 were most susceptible to electrostatic charging and achieved the highest voltage potentials. These clamps, which are used to hold tubing in the CWT, are among those parts in the CWT that are electrically isolated (unbonded).346 (Safety Board investigators documented more than 30 megohms of resistance between fuel tube couplings on the test airplane, as well as between isolated metal clamps and the fuel tubes that the clamps were mounted on, indicating inadequate bonding.) 344 On page 198, illustration 7.27, the FAA’s lightning protection guidance indicates that unbonded clamps could present an ignition hazard if a lightning strike occurred. 345 Teflon-cushioned, or Adel, wire clamps are used with other hardware (such as screws, washers, and nuts) to secure electrical wires and tubing. 346 Certification standards require that “major components” of the powerplant installation be electrically bonded to the other parts of the airplane. (For more information about certification requirements, see 14 CFR 25.901[b][4].) According to a June 2, 2000, letter, to the Safety Board Boeing design practices permit parts that are less than 3 inches in any direction (including some types of clamps and connectors installed in fuel tanks) to be electrically unbonded, presumably because such parts are not believed to have enough capacitance to retain hazardous levels of static electricity under expected operating conditions. Boeing 747 fuel tank assembly drawings show Adel clamp installations in which the clamp does not have a grounding strap.

Factual Information 173 Aircraft Accident Report Testing demonstrated that when the electrically isolated Adel clamp was exposed to a fuel spray or drip, an electrical charge was created on the clamp. The fuel spray or drip replicated a pressurized fuel leak. Fuel spraying or dripping onto clamps that were not thoroughly wet (thus, not permitting the fuel to create a wet path to the ground through antistatic additives) created higher voltage potentials than spraying or dripping onto clamps that were thoroughly wet. However, the highest voltage potential attained in testing was 650 volts, which would produce a discharge energy of only 0.0095 mJ. Voltage potentials of 1,150 volts were produced in tests using fuel of a higher conductivity than that in the accident airplane’s CWT, which could produce a discharge energy of 0.030 mJ.347 The Safety Board learned that Boeing had accumulated almost 5 J of energy on clamps during tests that followed two explosions in Boeing 727 fuel tanks during ground refueling at Minneapolis, Minnesota, in 1970.348 Subsequently, research conducted by NRL personnel also found that the Adel clamp retained up to 5,800 volts (capable of producing 0.84 mJ in a spark) when exposed to a fast drip of fuel containing commercially unavailable additives. However, to obtain a discharge exceeding the MIE of Jet A fuel vapor from a charged, isolated Adel clamp, the fuel used in the tests had to contain high-conductivity additives that are no longer manufactured and not available in fuel from JFK or the Athens airport at the time of the accident. 1.16.6.9 Sulfide-Deposit Tests and Research Safety Board investigators found dark deposits on FQIS fuel quantity probes, compensators, and wiring that had been recovered from various fuel tanks in the accident airplane and in similar locations in three other airplanes that were inspected during this investigation (N93105, N93117, and F-BPVE [all 747s]). The Board’s examination of several of these deposits using an SEM identified copper, silver (silver-plated copper wiring is used in fuel tanks), and sulfur (a contaminant in jet fuel), a combination also known as silver-sulfides.349 The Safety Board became aware that the AFRL fuel specialists had conducted research on similar deposits in the late 1980s/early 1990s. According to the AFRL specialists, the silver-sulfide deposits on components from the accident airplane were similar to deposits that they had identified previously on fuel quantity probes in military airplanes. For example, in 1990, silver-sulfide deposits were observed on a fuel quantity probe from a USAF trainer in 1990. During electrical bench tests involving this probe, 347 Although voltage potentials of more than 5,000 volts were obtained in some laboratory tests, these tests simulated extreme worst-case ground refueling conditions and did not use materials or fuel that would have been present on the accident airplane. 348 The Aviation Rulemaking Advisory Committee (ARAC) Fuel Tank Harmonization Working Group (FTHWG) and API 2003 cite several previous fuel tank explosions that were believed to have been caused by static electricity. 349 Although for the purposes of this report, these deposits will be called silver-sulfide deposits, they are sometimes referred to as “copper sulfide deposits,” “sulfides,” or “sulfidation.” According to a 1991 Boeing engineering report, silver should never contact sulfur-containing liquids because of its susceptibility to sulfidation.

Factual Information 174 Aircraft Accident Report flammable vapor ignited when voltages higher than those encountered during normal fuel system operation were applied. The AFRL research indicated that these deposits could break down and result in arcing when exposed to a 170-volt pulse. Further, the AFRL fuel specialists noted that the silver-sulfide deposits were semiconductive and, thus, gradually reduced insulation resistance between electrical connections. The AFRL report concluded that the accumulation of silver-sulfide deposits “is most likely the result of a long-term degradation or corrosion process…[and that] as the probes age, more probe failures [calibration errors] can be expected.”350 As a result of Safety Board requests351 for any documents pertaining to silver or copper sulfides, on April 23, 1998, Boeing provided the Board with several documents, including the following: • Boeing Materials Technology Engineering Report MS21053, dated June 17, 1988, that described the examinations of arcing damage in 18 fuel pumps. One of the 18 fuel pumps exhibited evidence of arcing at the location of sulfide deposits (the other 17 were too badly damaged to identify the origin of arcing). • Boeing Analytical Engineering Report 2-5323-WP-91-97, dated March 20, 1991, that described Boeing’s examination of sulfide deposits on a harness from a fuel quantity indicator from the right wing tank of a 757. The fuel quantity indicator had a documented history of irregularities after only 750 hours in service. The report noted “it is readily observed…that the…contaminant has migrated up into the…connector even after only 750 hours in service.” • A Parker Bertea Aerospace memorandum, dated August 18, 1992, which documented sulfide deposits on FQIS components removed from DC-10 airplanes. • Boeing Laboratory Report 9-5576-P+CA-025P, dated March 30, 1993, that described sulfide deposits on electrical hardware from the fuel tanks of 737, 747, and DC-10 airplanes. • Boeing Laboratory Report 9-5576-P+CA-025P1, dated April 29, 1993, that also described sulfide deposits on electrical hardware from the fuel tanks of 737, 747, and DC-10 airplanes and included two additional reports (obtained through a literature search): Silver Corrosion by Aviation Turbine Fuel, dated September 1970, written at the Journal of the Institute of Petroleum; and Copper and Silver Corrosion by Aviation Turbine Fuels, dated April 22, 1973, written at the Indian Institute of Petroleum. • Boeing Analytical Engineering Report 9-5576-WP-97-272, dated August 5, 1997, that described electrical tests of FQIS parts containing sulfide deposits. 350 See Slenski, George. 1990. Analysis of Trainer Aircraft Fuel Probes I. U.S. Air Force Research Laboratory. Materials Integrity Branch, Systems Support Division, Materials Directorate. 351 The Safety Board requested the above-mentioned information from Boeing in letters dated December 19, 1997, and March 6, 1998.

Factual Information 175 Aircraft Accident Report At the Safety Board’s request, AFRL specialists at the Wright Laboratory further examined the deposits on numerous parts from the accident airplane (including fuel quantity probe units and an FQIS compensator fragment) and other airplanes in which similar deposits were observed on fuel system components. In May 1998, the Safety Board became aware of a similar deposit found on a Tower Air 747 CWT T347 terminal strip.352 According to Tower Air management, maintenance personnel had been troubleshooting refueling problems (including premature and delayed refueling shutoff) and problems with FQIS wiring when they observed the deposits on the terminal strip and removed it. The Board subsequently requested that several independent laboratories examine and test the deposits on the terminal strip. In response to the Board’s request, the AFRL in Dayton, Ohio, tested the electrical resistance of and documented the deposits; Evans-East Laboratories in Plainsboro, New Jersey, tested the chemical properties of the deposits in greater depth; and the AFRL/University of Dayton Research Institute (UDRI) documented the deposits’ reaction to electrical loads. In addition, tests conducted at the AFRL Electronic Failure Analysis Laboratory and the Fuels Branch Laboratory used a portion of the Tower Air T347 terminal strip to observe and document the deposits’ breakdown in the presence of flammable jet fuel vapor. The results of this research, described in reports from Evans-East Laboratories353 and the AFRL/UDRI,354 revealed that these silver-sulfide deposits accumulate over time355 as a result of exposure to jet fuel (and jet fuel vapor), which contains sulfur.356 These deposits were typically found on FQIS wire at terminations and where damaged insulation resulting in exposed wire conductor. Additionally, AFRL was able to ignite lighter fluid using a sulfide deposit sample from the Tower Air T347 terminal strip. Additionally, during tests conducted at UDRI, researchers were readily able to create numerous sulfide deposits in a laboratory setting. According to UDRI, this research indicated that increased temperatures enhanced the formation of silver-sulfide deposits and that fuel washing could slow the accumulation of these deposits. 352 Of the many FQIS components with sulfide deposits from other airplanes examined during this investigation, the two that had been removed from the airplane because of FQIS anomalies were both 747 CWT T347 terminal strips. 353 For additional information, see the Evans-East Laboratories reports dated April 22, 1998, and April 24, 1998. 354 For additional information, see the following AFRL reports: AFRL/MLSA 99-2, dated January 26, 1999; AFRL/MLSA 99-33, dated June 21, 1999; and AFRL/MLSA 99-68, dated October 18, 1999. Additionally, an earlier AFRL report (WL/MLS 97-102) documented residues on FQIS components from the accident airplane (see Systems Group Chairman’s Factual Report, dated November 17, 1997). 355 UDRI research revealed that the time required for sulfide deposits to accumulate can vary considerably and is related to factors, such as sulfur content of the fuel, temperature. 356 Where wiring is connected to a fuel quantity probe in a 747-100 fuel tank (for example, at the terminal block connectors), the silver-plated copper conductor of the connected wire is exposed to fuel and fuel vapor. (The FQIS design for all 747 Classic series airplanes results in exposed conductors at terminal blocks.)

Factual Information 176 Aircraft Accident Report During FAA-sponsored tests conducted in response to Safety Recommendation A-98-37 (issued as a result of this accident), researchers at the University of Arizona also used the method developed by UDRI to create silver-sulfide deposits in a laboratory. During subsequent tests, these deposits served as an ignition mechanism for Jet A fuel vapor. The results of these tests were discussed at a November 9, 1999, meeting involving FAA, Safety Board, and industry personnel. According to University of Arizona personnel, the formation of sulfur-containing conductive deposits from Jet A fuel on silver wire occurred with both a.c. and d.c. current. Additional tests in this area are ongoing.357 According to a BFGoodrich representative at the November 9, 1999, meeting, on the basis of the AFRL findings in the early 1990s, BFGoodrich had developed a means of improving the accuracy and reliability of FQIS wiring used in military applications through design changes that began in 1993 and involved the use of (1) nickel-plated wire, (2) gold-plated ring connectors, (3) sealant in shrink tubes, and (4) separate inner and outer layers of shrink tube. The BFGoodrich representative stated that previously reported inaccuracies in the FQIS had largely resulted from current leakages through the sulfide deposits and that the design changes resulted in a large reduction in reported FQIS problems.358 According to Boeing personnel, Boeing uses nickel-plated, instead of silver-plated, wiring in its newly manufactured 777 and 737-NG airplanes. However, in a December 7, 1999, letter, Boeing indicated that “overall, the wholesale replacement of FQIS bundles in the tank is not recommended.” 1.16.6.10 Auto Ignition and Hot Surface Ignition Information The Safety Board considered the possibility that elevated temperatures within the CWT (resulting from engine bleed air leaks, a fire in the main landing gear wheel well, or a fire in the air conditioning pack bay) increased the temperature of the fuel/fuel vapor or the CWT structure/components to a sufficiently high temperature to result in ignition. This ignition could occur as a result of ignition mechanisms known as hot surface ignition and auto ignition. Hot surface ignition of Jet A fuel can result when a very high temperature surface comes into contact with fuel or fuel vapor and is highly dependent upon many factors, including the geometric aspects of the hot surface and the environmental conditions affecting the fuel/fuel vapor. Existing research359 indicates that hot surface ignition of fuels similar to Jet A can occur at temperatures ranging between 900° and 1,300° F.360 357 For information about Safety Board recommendations regarding sulfide deposits, see section 1.18.3. 358 In a January 20, 2000, letter to the Safety Board, Boeing indicated that at least two additional companies were manufacturing wire harnesses that have terminations resistant to sulfidation. 359 Kuchta. 360 If an individual hot spot within the CWT were to reach temperatures between 900° and 1,300° F, it is likely that the CWT surface in this area would also have been this hot. These temperatures are at or near the melting temperature of the CWT’s aluminum skin (aluminum softens/melts at 800° to 1,200° F, depending on the specific aluminum alloy).

Factual Information 177 Aircraft Accident Report Tests conducted by Boeing indicated that strands of steel wool can be ignited by as little as 32 milliamps from a 25-volt 400-cycle a.c. source. Auto ignition of Jet A fuel can result when a large volume of fuel/air vapor is sufficiently elevated in temperature for ignition to occur without direct contact with an ignition source (such as a spark, arc, hot surface, or hot filament). Auto ignition is also highly dependent on many factors, including the size of the heated volume and container and environmental conditions affecting the vapor. The lowest temperature that can result in auto ignition is called the auto ignition temperature. Existing research indicates that the auto ignition temperature for Jet A fuel vapor at sea level is about 460° F. The auto ignition temperature tends to increase as the altitude increases. Data provided by Boeing indicated that multiple engine malfunctions (concurrent failures of the (1) engine bleed air pressure relief valve, (2) precooler cooling airflow control valves, and (3) pylon shutoff and regulating valve would be required) could result in bleed air temperatures above 800° F at the engines. The failures required to produce such excessive bleed air temperatures would have resulted in an engine malfunction warning, and the excessive bleed air temperatures would have been sensed by temperature sensors installed inside and outside of bleed air ducts, resulting in cockpit warnings. Further, according to engineering data from Hamilton Standard (the manufacturer of the air conditioning system) and Boeing, the combination of failures required to produce such elevated temperatures would have resulted in overpressure leading to an air conditioning duct burst.361 The FAA’s certification regulations regarding fuel tank temperatures (Section 25.981) state the following: • The highest temperature allowing a safe margin below the lowest expected auto ignition temperature of the fuel in the fuel tanks must be determined. • No temperature at any place inside any fuel tank where fuel ignition is possible may exceed the temperature determined under paragraph (a) of this section. This must be shown under all probable operating, failure, and malfunction conditions of any component whose operation, failure, or malfunction could increase the temperature inside the tank. 1.16.6.11 Meteorite Strike Information During the evenings after the TWA flight 800 accident, many meteorites were observed in the northeastern United States. Therefore, the Safety Board considered the possibility that TWA flight 800 was struck by a meteorite, which then caused the CWT explosion. The Board consulted an expert in the study of meteorites, a professor from the University of Pittsburgh’s Department of Geology and Planetary Science, to evaluate the possibility of a meteorite hitting an airplane.362 According to the professor’s testimony, 361 Examination of the recovered wreckage revealed no evidence of damage that would have resulted from such extreme temperatures. Further, the CVR did not record any audible cockpit warning or any flight crew discussion that would indicate that such a condition existed in the accident airplane.

Factual Information 178 Aircraft Accident Report knowing the frequency with which meteorites have struck cars and dwellings over the past several decades, and based on a comparison of estimates of (1) the area of the earth’s surface represented by cars and dwellings with (2) the area of the earth’s surface represented by airplanes in the air at any given time, he calculated that a meteorite could be expected to strike an aircraft once every 59,000 to 77,000 years. 1.17 Operational and Management Information 1.17.1 Trans World Airlines, Inc. TWA holds an air carrier certificate, No. TWAA017A, and is authorized to conduct operations in accordance with 14 CFR Part 121 as a domestic and flag air carrier. TWA’s main maintenance facility and maintenance overhaul facility is located at the Kansas City International Airport (MCI), Kansas City, Missouri. Additionally, at the time of the accident, TWA maintained major station maintenance bases that serviced the 747 at JFK; LAX; MCI; STL; and San Francisco International Airport, San Francisco, California. TWA’s main operations base is located at STL. TWA conducts flight crew training at its facilities at STL, JFK, and LAX. 1.17.2 FAA Oversight of TWA Maintenance The FAA principal maintenance inspector (PMI) assigned to the TWA certificate at the time of the accident was located at the Certificate Holding District Office (CHDO) in Kansas City, Missouri. He was hired by the FAA in July 1988 and was initially assigned as a partial program manager (PPM) for TWA’s 747, 757, and 767 fleets. The PMI was an Assistant PMI for TWA for 2 years before he was assigned to the PMI position in 1990. He stated that he had no certificate oversight responsibilities other than TWA and that he had an assistant PMI and four PPMs to assist him with the oversight of the TWA certificate. According to the PMI, he had adequate staffing for the oversight of TWA’s maintenance operations and did not have any concerns about the company’s maintenance program. He stated that TWA personnel were receptive to feedback and made corrections in a timely manner when discrepancies were identified. TWA’s most recent National Aviation Safety Inspection Program (NASIP) was conducted in September and October 1995. The TWA NASIP involved airworthiness inspectors from Kansas City, Missouri, who traveled to other TWA maintenance facilities to accomplish their assignments. In addition, geographic inspectors in Atlanta, Georgia; Dallas/Fort Worth, Texas; and Salt Lake City, Utah, assisted in ramp inspections. The Safety Board’s review of the NASIP inspection’s airworthiness findings revealed that none of the findings 362 During his testimony at the Safety Board’s public hearing for TWA flight 800, the professor defined a meteor as a “visual phenomenon caused by a body plunging through the atmosphere. You don’t see the body itself, you see the glow of compressed air and ionized gases in front of the meteorite,” and a meteorite as a “chunk of silicate rock or nickel-iron alloy, believed to originate in the asteroid zone of the solar system.”

Factual Information 179 Aircraft Accident Report pertained to 747-100 fuel systems, fuel tanks, wiring, or structural inspections. (The accident airplane was not inspected during the NASIP.) The National Program Tracking and Reporting Subsystem indicated, with regard to the listed airworthiness items, that TWA corrected the items. In all cases, the Flight Standards CHDO concurred with TWA’s actions to correct the findings. 1.18 Additional Information 1.18.1 Accident Record and History of Fuel Tank Fires/Explosions on Airplanes The Safety Board has participated in the investigation of several aviation accidents/incidents involving fuel tank explosions. According to a list prepared by the FAA, since 1959 there have been at least 26 documented fuel tank explosions/fires in military and civilian transport-category airplanes (including TWA flight 800). Appendix G lists these fuel tank explosions/fires, several of which are discussed in greater detail in this section.363 The Safety Board conducted a special investigation of the May 9, 1976, accident involving an Iranian Air Force 747-131, as it approached Madrid, Spain, following a flight from Iran. All 17 people on board the airplane were killed, and the airplane was destroyed. Witnesses reported seeing lightning strike the left wing, followed by fire, explosion, and separation of the outboard wing before the airplane crashed. Examination of the wreckage revealed evidence of an explosion that originated in at least one of the left wing fuel tanks near a fuel valve installation. The airplane’s fuel tanks contained a mixture of JP-4 and Jet A fuel.364 The Board’s report noted that almost all of the electrical current of a lightning strike would have been conducted through the aluminum structure around the ullage365 but discussed how some energy might have entered the fuel tanks.366 Although the Board’s report did not identify a specific point of ignition within the tank, it noted that discharges 363 Although not listed in appendix G, the Safety Board is also aware of an in-flight fuel tank explosion in a wing tank on a U.S. Navy C-130 that occurred on January 15, 1972, near Cambridge, Maryland. The U.S. Navy’s investigation concluded that “an arc occurred in the fuel tank airspace from either…the #10 fuel quantity probe to an unknown ground…[or] from [chafing of] the coax[ial] cable in the immediate vicinity of the #10 fuel quantity probe to an unknown ground.” 364 Although the Safety Board’s report indicated that the airplane’s fuel tanks contained a mixture of JP-4 and Jet A fuel, it is likely that the airplane’s fuel tanks actually contained a mixture of JP-4 and Jet A-1 fuel. Jet A-1 fuel is commonly used by air carriers throughout the world, and Jet A has relatively limited availability outside the United States. 365 The Safety Board did not determine the probable cause of this foreign accident because it had no statutory authority to do so. However, several hypotheses addressing the sequence of events and possible causes of the accident were presented in the Board’s report. Further, in a February 13, 1979, memorandum, the FAA stated, in part, “[the Safety Board’s report indicated] that ‘energy levels required to produce a spark will not necessarily damage metal or leave marks’…The enclosed photographs show the localized burned and melted portions of the plastic sleeves of the compensator wiring harness….In view of the fact that flammable vapors can be ignited by very low electrical energy which is less than that required to produce any physical evidence and in consideration of the internal condition of the compensator, we suggest that a careful review should be given of the compensator as a possible ignition source.”

Factual Information 180 Aircraft Accident Report could produce sufficient electrical energy to ignite the fuel/air mixture and that energy levels required to produce a spark will not necessarily damage metal or leave marks at the point of ignition. Upward flowing burn patterns were observed on the compensator that the FAA considered a potential ignition source for the surge tank fire.367 The Safety Board also assisted in the investigation of the crash of Avianca flight 203, a 727, on November 27, 1989, which killed all 107 people on board the airplane. The airplane had departed Bogota, Colombia, about 5 minutes before the crash. Examination of the wreckage revealed that a small bomb placed under a passenger seat, above the CWT, had exploded.368 According to the Colombian Government’s report regarding this accident, the bomb explosion itself did not compromise the structural integrity of the airplane; however, the explosion punctured the CWT and ignited the Jet A fuel/air vapor369 in the ullage, resulting in the destruction of the airplane. The Safety Board also participated in the investigation of a May 11, 1990, accident, involving a Philippine Airlines 737-300 at Ninoy Aquino International Airport, Manila, Philippines, in which the Jet A fuel/air mixture in the CWT exploded as the airplane was being pushed back from the gate. Of the 120 people on board the airplane, 8 were killed, and 30 were seriously injured. As a result of this accident, the Safety Board issued Safety Recommendations A-90-100 through -103 to the FAA. In its safety recommendation letter, the Board noted that the exact source of ignition had not been established. However, lightning damage and damaged FQIS wires were found. The Board stated that “it is possible that the combination of a faulty float switch and damaged wires providing a continuous power supply to the float switch may have caused an electrical arc or overheating of the switch leading to the ignition of the center fuel tank vapor.” 366 Additional information regarding the amount of energy from lightning that might reach conductive components in fuel tanks is contained in Lightning Protection Handbooks published by the FAA and NASA. 367 The damage was described in an undated FAA memo as follows: “localized burned and melted portions of the plastic sleeves of the compensator wiring harness where the black unshielded leadwire joins the HI Z leadwire. This is the same area where flashover to the HI Z terminal was observed at 6.9 kilovolts during voltage breakdown tests on new compensators….Evidence of arcing was difficult to detect following these tests. It may be noted in the photographs that the bottom edge of the leadwire plastic support is also burned and that a side of the plastic sleeve around the HI Z and black leadwires is not burned. This type of localized damage tends to indicate that a brief flame stream could have been initiated at the lug end of the HI Z leadwire which was directed upward through the compensator as the unit is mounted in the surge tank.” 368 Evidence of a bomb explosion included deformation of materials away from a location at the height of the passenger seat pan, hot-gas pitting damage on multiple pieces of wreckage that formed a pattern radiating from the same location (including into the CWT), punctures radiating from the same location, and shrapnel. Further, according to the FBI’s laboratory report, No. 91204034 S YQ YB/91207052 S YQ YB, dated January 30, 1990, chemical analysis of a piece of wreckage from the right side of the CWT identified the presence of RDX and PETN high explosive. These two explosives comprise about 86 percent of the composition of SEMTEX, which is a rubberlike material manufactured by Synthesia Corporation of Semtin, Czechoslovakia, primarily for use in mining and other civil engineering activities. According to the FBI, SEMTEX has been used by criminal and terrorist elements in Europe since 1966. (SEMTEX was identified as the material used in the bomb placed on Pan Am flight 103. For additional information, see section 1.11.1.2.) 369 As indicated with regard to the Iranian Air Force 747, because Jet A fuel has limited availability outside the United States and because Jet A-1 is commonly available outside of the United States, it is likely that this airplane’s fuel tanks contained Jet A-1 fuel.

Factual Information 181 Aircraft Accident Report Safety Recommendations A-90-100 through -102 addressed the inspection of float switch wiring on 737-300, -400, and -500 airplanes, the inspection of other wiring bundles on all 14 CFR Part 121 airplanes, and the development and utilization of testing techniques to detect defective float switches (with a requirement to replace all defective units). On the basis of the FAA’s responses indicating that it intended to take no action on these recommendations, the Safety Board classified all three safety recommendations “Closed—Unacceptable Action” on March 24, 1992. The Board also recommended, in Safety Recommendation A-90-103, that the FAA conduct a detailed engineering design review and testing of the fuel pumps used in the 737-300, -400, and -500 to verify that overheating and interference between the rotating components of the pump and its case will not cause a fire hazard (tests should be conducted with the jet fuel at its flash point). The Board determined that subsequent testing and research conducted by the FAA satisfied the intent of this recommendation and classified it “Closed—Acceptable Alternate Action” on March 24, 1992. 1.18.2 Information Regarding Electrical/Wiring Anomalies on Airplanes 1.18.2.1 Accidents, Incidents, and Events Involving Electrical/Wiring Components During its investigation of the TWA flight 800 accident, the Safety Board examined its aviation accident/incident database for records of previous accidents and incidents involving transport-category airplanes in which the Board had used the words “wire” or “wiring” in the probable cause. In addition, the Safety Board reviewed other available records involving wiring- and/or fire/smoke-related air carrier events, including the following: • Boeing laboratory reports, SBs, and SLs; • AFRL reports; • Safety Board preliminary, airworthiness factual, and accident brief reports; • AIR 2000 air safety reports; • British Air Accidents Investigation Branch (AAIB) reports; • FAA service difficulty reports (SDR);370 and • a Civil Aviation Administration of China investigation report. The results of these reviews are discussed in this section. Wiring-Related Accidents/Incidents In an October 21, 1996, fax, the Civil Aviation Authority of Singapore described an event that occurred on October 12, 1996, in which an operator reported that arcing in a wire bundle on a 747-200 cargo airplane had resulted in a fire at the aft bulkhead of the forward cargo compartment about STA 1000. The airplane was undergoing maintenance at the time of the fire, and subsequent inspection revealed damage to wire bundles W834,

Factual Information 182 Aircraft Accident Report W846, W1524, and W370; the insulation blanket; the aft bulkhead of the forward cargo compartment; and (possibly) the CWT sealant. The operator removed the affected components from the airplane and shipped them to Boeing for examination and evaluation. A December 16, 1996, letter from Boeing stated that “X-ray microanalysis and chemical identification of the damaged wire suggest that the insulation of the wire was damaged and that arcing had occurred between the damaged wires or that arcing between the damaged wires and ground had occurred.” The Safety Board’s database research revealed 15 Board-investigated air carrier accidents/incidents that occurred between 1983 and 1999 in which wiring was a factor in the probable cause. These events occurred on a wide variety of airplane types/manufacturers (including a 727, two 737s, a 747, a 767, a DC-8, a DC-9, an MD-88, three DC-10s, an L-1011, an A320, a DeHavilland DHC-8, and an ATR) and various air carriers. A review of these records indicated the following anomalous electrical/wiring conditions: • On May 27, 1983, near Kansas City, Missouri, a wire bundle behind the L-1011’s flight engineer’s panel electrically short-circuited—the flight engineer extinguished the resultant fire with a portable fire extinguisher. Smoke in the cockpit abated naturally. • On October 7, 1983, at Juneau, Alaska, a taxi light switch on the departing 727-247 series airplane failed and burned the insulation on an adjacent wire. • On May 17, 1984, near Minneapolis, Minnesota, the first officer on a DC-10 observed sparks and smoke from the left-side panel. Cockpit lights were turned off, and the smoke dissipated. Subsequent inspection revealed that a wire bundle located between the center of the instrument panel and a fluorescent light beneath the first officer’s glare shield exhibited evidence of fire damage. This wire bundle was stretched tightly across a sharp metal edge on the side of the fluorescent light. Insulation and a fabric sleeve around the wires were burned, exposing the wires. Investigation revealed that the wire bundle was removed and reinstalled 4 days before the event. 370 Although the FAA collects a significant amount of data about mechanical failures through its SDR program, the Safety Board has noted that these data are often incomplete. In a June 3, 1993, letter to the FAA, the Board stated that “the SDR program is often used during aviation accident/incident investigations to research the history of aircraft failures, malfunctions, and defects. However, attempts to effectively use the SDR database in recent Safety Board investigations have revealed that the current program is incomplete and of limited value in identifying service defect histories because many reportable service difficulties are not reported to the FAA.” In the same letter, the Board issued Safety Recommendations A-93-61 through -63 to the FAA, which proposed changes to improve the SDR program. On August 4, 1995, the FAA issued NPRM 95-12, “Operational and Structural Difficulty Reports,” proposing to revise the reporting requirements, but no final rule was ever issued. In subsequent investigations, the Board continued to find incomplete information in searches of the SDR database and on January 9, 1998, issued Safety Recommendation A-97-125, which asked the FAA to modify the SDR reporting system so that it would contain more complete and accurate information about component failures. On April 15, 1999, the FAA agreed that improved reporting was needed and published a supplemental NPRM to update the proposed changes. On October 26, 1999, Safety Recommendations A-93-61 and A-97-125 were classified “Open— Acceptable Response,” pending issuance of the final rule. The FAA issued the final rule on September 15, 2000.

Factual Information 183 Aircraft Accident Report • On October 5, 1986, at Seattle, Washington, the internal power feeder cables on a DC-10 short-circuited and melted during an attempt to apply ground power to the airplane. According to the Safety Board’s report, the investigation revealed “poor workmanship” in a modification installation. • On July 12, 1987, near Boston, Massachusetts, faulty wiring in the throttle quadrant of the 767 airplane resulted in an uncommanded go-around. • On March 30, 1988, at Boston, Massachusetts, a loosened battery ground connection on a DC-10 airplane resulted in an electrical arc and ignition of pooled fuel in the center accessory compartment. There was fire damage to the compartment, wires, and insulation blanket. • On April 15, 1988, near Seattle, Washington, an electrical wire in the DHC-8 airplane chafed against a hydraulic line and arced, resulting in a hydraulic fluid leak, a subsequent fire, and hydraulic system failure. • On December 30, 1989, at Tucson, Arizona, a 737 experienced an in-flight fire and loss of hydraulic power. Inspection revealed that an electrical wire chafed against a hydraulic line; the wire arced, resulting in a hole in the hydraulic line and a hydraulic fluid leak. Subsequent arcing ignited the leaking fluid, resulting in a fire and loss of hydraulic power. • On November 13, 1991, near Toledo, Ohio, damaged wires in the DC-8 airplane wire bundle resulted in a faulty indication that the main cargo door was closed and locked. The main cargo door subsequently opened in flight. • On November 20, 1991, while departing Atlanta, Georgia, a passenger on board the MD-88 observed fire coming from the right-side overhead compartment. Subsequent inspection revealed that a damaged cannon plug connector adjacent to a cabin overhead light assembly resulted in an electrical short circuit. • On January 3, 1992, near Denver, Colorado, the flight crew on a 737 noted an “electrical-type” burning odor, followed by a loud arcing sound and a small fire at the flight deck aft overhead panel. The flight crew reported that it easily extinguished the fire. Subsequent inspection revealed that a wire bundle chafed against the cockpit door frame and short-circuited, resulting in electrical arcing and the small fire. This wire bundle was not shielded or anchored to protect against chafing, as was the other wire bundle routed through this compartment. • On February 25, 1994, the flight crew on the ATR observed smoke in the cockpit during descent near Mosinee, Wisconsin. Subsequent inspection revealed that a push-button selector indicator switch in the cockpit had melted and resolidified, and adjacent wiring exhibited evidence of heat damage. Records indicated previous malfunctions associated with water/fluid contamination near the switches, and the manufacturer had issued two SBs addressing the problem.

Factual Information 184 Aircraft Accident Report • On March 18, 1996, near Detroit, Michigan, the flight crew on the Airbus A320 airplane received a series of elevator/pitch-related computer fault messages. Subsequent inspection revealed an intermittent fault in the elevator servo controller electrovalve coil and a defective diode in an electronic module for one of the stabilizer actuators. • On July 5, 1997, near Flint, Michigan, the DC-9 flight crew observed smoke beneath the instrument panel glareshield. Subsequent inspection revealed burned wiring and a charred position light switch behind the cockpit instrument panel/glareshield. Further examination revealed an electrical short in the left wing tip oscillating position light autotransformer. • On May 18, 1998, near Minneapolis, Minnesota, the 747 flight crew experienced several uncommanded “kicks” of the yaw damper while troubleshooting a fire warning indication. The flight crew disengaged the yaw damper but continued to experience uncommanded “kicks,” although they were less severe. Subsequent inspection revealed that a VHF transceiver coax connector located near the yaw damper control box was not properly shielded, resulting in EMI with the yaw damper system. FAA Service Difficulty Report Data Regarding Wiring and/or Fire/Smoke-Related Events The Safety Board also searched the FAA’s SDR database for wiring and/or fire/smoke-related events involving 747s and found 21 events.371 These events are summarized in the SDRs as follows: • Electrical fire in a galley. Investigation revealed that the source of the fire was damaged wires in a coffeemaker. (FAA control No. 00013, December 21, 1986.) • Electrical fire started in a passenger entertainment control box near the R4 door. (FAA control No. 00030, June 12, 1987.) • Thirteen burned wires in a 6- by 8-inch area at the cabin floor line were found at STA 1200. Circuit breaker for pallet drive wheels tripped. (FAA control No. 00029, December 2, 1988.) • Electrical fire from an electrical short circuit in a galley. (FAA control No. 00119, February 2, 1990.) • Electrical fire below aft galley personnel elevator. (FAA control No. 0008, October 29, 1990.) • Electrical fire in the upper control module of the first-class galley. Found a split capacitor in the oven controller. (FAA control No. 00135, December 21, 1990.) 371 This list does not include events involving light ballasts, failures to light sockets, reseated electrical connectors that cleared faults, and secondary damage to wires caused by failure of other components.

Factual Information 185 Aircraft Accident Report • The No. 2 leading edge device position switch was short-circuited to the ground, resulting in a malfunction indication (amber light) in the cockpit. (FAA control No. 0015, March 15, 1996.) • R4 door emergency lights were inoperative because of loose wiring on a cannon plug at the battery charging unit. (FAA control No. 00466, April 5, 1996.) • R4 and L2 emergency lights were inoperative. Maintenance actions included repairs to the emergency light pin and wiring. (FAA control No. 00199, June 20, 1996.)372 • The No. 3 engine fire loop wires were worn through at the hydraulic box forward bracket. (FAA control No. 00263, August 8, 1996.) • During a daily check, maintenance personnel found zone E right-side emergency path light inoperative. Replaced fuse and repaired chafed wire. (FAA control No. 00572, August 15, 1996.) • Left main landing gear microswitch wires were chafed, resulting in cockpit indication that the left landing gear was down and locked when the landing gear was retracted. (FAA control No. 00662, August 15, 1996.) • During a daily check, maintenance personnel found two lavatory smoke detectors inoperative. Found and repaired broken wiring. (FAA control No. 00621, August 15, 1996.) • Floor emergency lights inoperative on the left side of the cabin at seat rows 51 to 66 and on the right side of the cabin at seat rows 35 to 43. Secured emergency light wiring. (FAA control No. 00112, August 29, 1996.) • During a daily check, maintenance personnel found 5L emergency light inoperative. Repaired wiring. (FAA control No. 00760, August 29, 1996.) • A wire short circuited to the ground and resulted in inoperative upper deck floor evacuation lights. (FAA control No. 00525, September 5, 1996.) • Electrical arcing sounds and sparks were observed near the overhead passenger service unit at seat 4B. Examination revealed that the wiring harness that runs parallel with the sidewall light assembly above 4A and B was burned. (FAA control No. 00231, September 5, 1996.) • During a daily check, maintenance personnel found No. 2L (main entry door) upper light inoperative. Found chafed wire at bustle light connector. (FAA control No. 00405, September 12, 1996.) • Disconnected wiring resulted in inoperative floor evacuation path emergency lights from cabin seat row 3 to 27. Maintenance personnel reconnected wiring and installed light assembly. (FAA control No. 00633, September 19, 1996.) 372 Maintenance records indicated that this SDR pertained to repairs performed on the accident airplane. The repaired wire was part of a bundle that branched off from a larger bundle that included CWT and left wing FQIS wires leading to the upper deck AIDS unit and also contained high-voltage wiring for lighting. Because condensation is a common problem in transport airplanes, the 747 design includes drip shields to protect critical elements (including cockpit wiring) from condensation.

Factual Information 186 Aircraft Accident Report • Electrical arcing and smoke were observed from work light wiring for a galley coffeemaker. (FAA control No. 00668, September 26, 1996.) • Floor evacuation path light wiring short-circuited near cabin seat 50H. (FAA control No. 00747, October 10, 1996.) 1.18.2.2 Previous Safety Board Safety Recommendations Regarding Electrical Components The Safety Board reviewed its safety recommendation database for recommendations that involved electrical components by searching for key words, such as “breaker,” “circuit,” “circuitry,” “electrical,” “wire,” and “wiring.” The safety recommendations identified in the Board’s review were evaluated, and several nonpertinent recommendations were eliminated.373 This section discusses the pertinent safety recommendations. On January 12, 1967, the Safety Board issued Safety Recommendation A-67-003 to the FAA, which addressed electrical cockpit heaters and related circuitry in Convair 340, 440, and 580 model airplanes. The safety recommendation letter indicated that “while examining the aircraft, loose nuts, screws, drill shavings, and trash were found inside the circuit breaker panel compartment.” The FAA responded in a February 2, 1967, letter that “to preclude accumulation of trash and unwanted items in the circuit breaker panel compartment, Allegheny Airlines is in the process of issuing an inspection card calling for vacuuming this compartment each 300 hours.” On January 1, 1975, the Safety Board classified Safety Recommendation A-67-003 “Closed—Acceptable Action.” On June 2, 1983, an in-flight fire occurred on board a McDonnell Douglas DC-9-32, operated as Air Canada flight 797, and, after an emergency landing, the cabin interior continued to burn. Five crewmembers and 19 passengers were able to evacuate the burning airplane; the remaining 23 passengers died in the fire. On July 19, 1983, the Safety Board issued Safety Recommendation A-83-047, which recommended that the FAA require the inspection and periodic reinspection of the lavatory flush pump motors and associated wiring; Safety Recommendation A-83-048, which recommended that the FAA develop a procedure to inspect lavatory flush pump motors; and Safety Recommendation A-83-049, which recommended that the FAA require bulletins for frequent removal of waste from lavatories, “which gives sufficient emphasis to areas susceptible to the accumulation of fluids in the vicinity of wire harnesses and other electrical components which can cause corrosion.” On June 12, 1984, the Safety Board classified Safety Recommendation A-83-049 “Closed—Acceptable Action.” On November 17, 1986, the Safety Board classified Safety Recommendations A-83-047 and -048 “Closed—Acceptable Alternate Action.”374 On June 27, 1988, the Safety Board issued Safety Recommendation A-88-064, which recommended that the FAA conduct a directed safety investigation to determine the 373 Nonpertinent safety recommendations included those in which the electrical component key words were only indirectly referenced in the discussion of other systems (for example, circuit breakers were referenced in a safety recommendation regarding CVRs).

Factual Information 187 Aircraft Accident Report reliability of circuit breakers and the mechanisms by which failures internal to the circuit breakers can disable operating systems and to identify appropriate corrective actions, as necessary. The FAA agreed with the intent of the recommendation and reported that an examination had been made. On October 24, 1989, the Safety Board classified Safety Recommendation A-88-064 “Closed—Acceptable Alternate Action.” On August 8, 1990, the Safety Board issued Safety Recommendation A-90-102, which recommended that the FAA issue an AD “applicable to all 14 CFR Part 121 airplanes to require, at the next scheduled maintenance inspection, an inspection of the wires in wire bundles in the wings where additional wiring has been added since the airplane was manufactured. The inspection should be directed to the determination of insulation damage where the bundle is under clamps and inside vapor seals and pressure seals.” The FAA refused to issue the recommended ADs and cited the Boeing 737 Maintenance Planning Document, which recommended a zonal visual inspection of the interior CWT that would include wires and wire bundles at every 7C check (approximately 21,000 flight hours). On March 24, 1992, the Safety Board classified Safety Recommendation A-90-102 “Closed—Unacceptable Action.” On August 14, 1991, the Safety Board issued Safety Recommendation A-91-070, which recommended that the FAA require “specific quality control and inspection procedures for wire bundle installations on transport-category aircraft to verify proper bend radii, chafe protection, and routing practices by aircraft manufacturers during fabrication and by airlines during maintenance operations that expose wire bundles.” The FAA agreed with the intent of this safety recommendation and required the recommended quality control and inspection procedures. On February 10, 1994, the Safety Board classified Safety Recommendation A-91-070 “Closed—Acceptable Action.” Also on August 14, 1991, the Safety Board issued Safety Recommendation A-91-071, which recommended that the FAA “notify…[PMIs] and operators of transport-category aircraft of the fire hazard posed by accumulations of lint and other debris on wire bundles.” The FAA subsequently issued Handbook Bulletin 91-15, “Origin & Propagation of Inaccessible Aircraft Fire Under In-Flight Airflow Conditions,” and recommended that PMIs ensure that operators of transport-category airplanes clean wiring in inaccessible areas. On October 20, 1992, the Safety Board classified Safety Recommendation A-91-071 “Closed—Acceptable Action.” On April 9, 1992, the Safety Board issued Safety Recommendation A-92-021, which recommended that the FAA “require that the electrical actuating systems for nonplug cargo doors on transport-category aircraft provide for the removal of all electrical power from circuits on the door after closing (except for any indicating circuit power necessary to provide positive indication that the door is properly latched and locked) to eliminate the possibility of uncommanded actuator movements caused by wiring short 374 On May 10, 1985, lavatory fluid was found to have contaminated the wire bundles near improper (deep) hot-stamp markings, resulting in an in-flight fire aboard a Monarch Airlines 757. Additionally, on October 22, 1995, lavatory fluid-contaminated electrical components (specifically a connector in the yaw damper circuit) resulted in uncommanded roll/yaw oscillations in a 737.

Factual Information 188 Aircraft Accident Report circuits.” The FAA agreed with the intent of this safety recommendation and required that all such electrical power be removed before taxi. On August 10, 1993, the Safety Board classified Safety Recommendation A-92-021 “Closed—Acceptable Alternate Action.” 1.18.2.3 Inspection of Wiring in Several Transport-Category Airplanes Postaccident inspection of recovered wiring from the accident airplane and other transport-category airplanes revealed numerous notable conditions in both older and newer transport-category airplanes, including damage to wire insulations, fluid stains on wires, and metal shavings resting on and between wires in wire bundles. The Safety Board is aware of several prior incidents that resulted from short circuits apparently caused by contaminants. For example, after a January 9, 1998, short-circuit incident aboard a United Airlines 767, copper conductors from wires within the damaged wire bundle were found with melted aluminum (consistent with metal shavings found immediately beneath the wire bundle), indicating that a metal shaving acted as a bridge to form a short circuit. Another example is the October 22, 1995, incident involving roll/yaw oscillations on a 737 near Manchester, England. The incident was attributed to a short circuit in the rudder circuitry resulting from lavatory fluid bridging the pins within an electrical conductor. Additional similar incidents are described in the Systems Group Chairman’s Factual Report—Addendum for Aircraft Wire Inspections and Historical Reports, including the following: a July 19, 1997, incident involving a Lufthansa 747 (after circuit breakers opened while on approach to JFK, drill shavings were found in an area of burned and damaged wiring in the front cargo hold) and a May 10, 1985, incident involving a Monarch Airlines 757 (after generators tripped and smoke appeared in flight, lavatory fluid was found on a burned area of a wire bundle, and insulation was found damaged by out-of-tolerance hot-stamp markings).375 In connection with the TWA flight 800 investigation, the Safety Board examined the wiring in 25 transport-category airplanes that had been maintained by various air carriers. The inspected airplanes included 18 Boeing airplanes (13 747-100, -200, and -300 “Classic” series airplanes;376 a 747-400; 2 737s; a 757; and a 767), 4 Douglas airplanes (a DC-9-30, an MD-90, and 2 MD-11s), 2 Lockheed L-1011s, and an Airbus A300. The airplanes examined ranged in age from new (not yet delivered to the operator) to 28 years old (retired by the operator) and in total flight time from 4 to 102,712 hours. The Safety Board used manufacturer and air carrier wiring diagrams as references during its inspections of these airplanes. Although different airplane types and series were inspected, the same general areas were inspected in each airplane when accessible. These areas included the main electrical equipment center,377 circuit breaker panels, the area behind the flight engineer’s panel and forward of the cockpit escape door, the area near the 375 Additional cases in which contamination was found are discussed later in this section and in sections 1.18.2.1 and 1.18.2.2. 376 The airplanes examined were from various sources. The investigative group agreed that the general condition (extent of contamination and workmanship) of the wiring observed in airplanes of a given operator was similar to that of other operators’ airplanes with similar flight times.

Factual Information 189 Aircraft Accident Report water bottles in the forward cargo compartment, and the pressure seal-to-wing wire route.378 Figure 38 shows the areas typically inspected on 747 airplanes. Metal debris was observed on or near the wire bundles of all airplanes except for one new 737, which was only examined by investigators for about 10 minutes. A 9-month-old airplane had light lint “fuzz” beginning to accumulate on wires behind an avionics rack. Additionally, accumulations of foreign materials were observed on and between wires/wire bundles in many of the airplanes in many locations. The foreign materials included lint (fiber and dust particles), metal shavings, hardware (washers, screws, rivets [drilled and undrilled]), structural corrosion preventive compound, blue and brown fluid stains, paint, and pieces of paper. Wire insulation was damaged and/or cut where metal debris was found between individual wires within a wire bundle. In some cases, the core conductors of the wires were exposed to the grounded shielding of other wires. Wire bundles in wheel wells were typically black and oily, and fluid was found on wires located near hydraulic actuators in wings; grease was found on wires near flap actuators and on landing gear struts. Wire bundles were found adhered into solid, stiff masses with additional wires strapped to the outside of the existing bundle. The inspections also revealed crumbled rubber cushions in clamps, cracked O-rings, kinked wires, and wires with cracked and/or chafed insulation. Further, investigators identified several instances in which the wires and/or wire bundle routing, clamping, and/or tension in various series 747 airplanes did not appear to be in accordance with Boeing’s 747 manuals or PIs. For example, in some airplanes, parallel small wire bundles were tied into larger wire bundles differently than shown in the PIs. Additionally, in some airplanes, wires were stretched tightly between clamps and rubbed/chafed against clamps, other brackets, and around bends. This rubbing/chafing often resulted in abraded wire insulation. In one airplane, three blackened rub marks were found on two wire bundles. In one 747, a set of twisted wires in a woven jacket (similar to that used for FQIS wires) had chafed through the jacket, wire topcoat, and into the base of the insulation. Further, in other inspected airplanes, wires/wire bundles that were supposed to be segregated in separate parallel bundles (according to Boeing 747 PIs) were in contact with each other. 377 The term “main electrical equipment center” is used in Boeing’s 747 Systems Handbook to refer to a compartment located aft of the nose landing gear bay that contains avionics and electrical distribution components. Although Boeing describes similar compartments in its airplanes by various terms, they are generally referred to as “E/E bays.” 378 For detailed information regarding the individual airplane inspections, see Systems Group Chairman’s Factual Report—Addendum for Aircraft Wire Inspections and Historical Reports, dated July 28, 1999.

Factual Information 190 Aircraft Accident Report Figure 38. Diagram showing the areas typically inspected on 747 airplanes. FLIGHT ENGINEER STATION (RIGHT) COCKPIT ESCAPE DOOR (RIGHT) STA 920 STA 100 WATER BOTTLES ON FORWARD SPAR PRESSURE SEALS TO WING WIRE ROUTE FORWARD CARGO COMPARTMENT AVIONICS STA 400 NOSE LANDING GEAR COMPARTMENT

Factual Information 191 Aircraft Accident Report In one airplane (its last known flight was in January 1997), wires in the raceway over the CWT were not bundled (as indicated by Boeing’s PIs) but were randomly laid in a tray, such that individual wires crossed from one side of the tray to the other. Higher-voltage generator and galley power cables were clamped to the adjacent structure (not routed in the tray). Inspection of the inside of this airplane’s CWT revealed the following: the scavenge pump inlet screen contained a nearly 1-inch-long uninsulated wire fragment, a vertically routed FQIS wire was chafed where it contacted a horizontal structural flange, and a horizontally routed FQIS wire was chafed where it contacted a vertical row of rivets between two supporting clamps. Examination of this airplane’s CWT fuel quantity probes by the AFRL experts revealed sulfide deposits on the bare wire ends and terminal sleeves, and some of the wires were loose under the clamps; two of the wires exhibited striation marks that resembled jaw marks of a wire stripping tool. Five of the 25 airplanes inspected by Safety Board and other investigators during this investigation exhibited signs of fire and heat damage, as evidenced by the following: • In the 767 E/E bay near the galley chiller unit, investigators observed melted and resolidified wires, charred insulation and burned foam, black and crispy wire insulation adjacent to a woven fabric sleeve around a small wire bundle, and copper balls consistent with arcing on wires more than 1 inch from wires exposed through melted holes in wire insulation. Additionally, an AAIB inspector was in the compartment when the mechanic applied electrical power to the airplane during the inspection, and the wiring aft of the galley chiller began to arc.379 (Investigation revealed that the galley chiller had been replaced the previous day. Water was found on a thermal insulation blanket beneath the galley chiller and wire bundle. Metal shavings, coins, screws, copper wire, locking wire, plastic cable ties, and dust/dirt were also found on or beneath wire bundles.) • In one of the L-1011’s mid-electronics-service-center,380 two wire bundles of about 3-inch diameter were found burned. Examination of the area revealed blue-fluid stains and dust accumulations on wire bundles and generator feeder cables. In the burned area of the bundles, melted and resolidified copper provided evidence of wire-to-wire arcing; there was no evidence of arcing to other structure or areas.381 379 After this incident, the FAA issued AD 98-07-26, which required 767 operators to inspect the airplanes’ wiring and to wrap the wires for additional protection. The FAA indicated that its examinations of 150 other 767 airplanes revealed similar damage to wiring near the galley chillers in 13 of the airplanes. 380 Lockheed uses the term “mid-electronics-service-center” to describe an area located forward of the forward wing spar, beneath the aft edge of the 2L lavatory in the cabin. As noted previously, Boeing refers to similar areas in its airplanes as “E/E bays.” 381 After this damage was found, the operator inspected the remainder of its L-1011 fleet (35 airplanes). The operator reported the following findings: 5 airplanes exhibited evidence of blue-fluid contamination of wires in the inspection area; 11 airplanes exhibited “some signs of feeder to bundle rubbing” in the inspection area; 17 airplanes “demonstrated excessive dirt and dust” in the inspection area; and 13 airplanes had metal shavings and/or paper debris in the inspection area. Further, the operator reported that it was aware of three or four previous occurrences involving blue-fluid contamination of wire bundles below the midlavatories on its L-1011s.

Factual Information 192 Aircraft Accident Report • Examination of the video system control unit (VSCU) near one of the MD-11’s R2 door revealed melted and resolidified plastic and a low-resistance path between pins in the cannon plug electrical connector that had been attached to the unit. Teardown of the VSCU revealed liquid stains on the top and bottom surfaces of internal circuit boards. The manufacturer stated that the circuit connected 115-volt a.c. power to circuits designed for 28 volts or less. • Beneath the other MD-11’s floorboards (between STAs 1661 and 1681), a metalized mylar insulation blanket (a 60 inch X 20 inch area) was burned/partially burned. Detailed examination of this area revealed that a wiring harness containing 20-gauge insulated wire was routed across the frame at STA 1681. One wire was separated, and seven other wires exhibited damaged and chafed insulation where they contacted the frame. A 1 1/4-inch hole in the insulation blanket was located beneath the chafed wire bundle. • Behind the circuit breaker panel to the right of the flight engineer’s station on the other L-1011, an Adel clamp and circuit breaker exhibited evidence of thermal damage (blackening). One circuit breaker (CB 3F1) was found popped, and the circuit breaker’s post appeared to have arced to an Adel wiring clamp that held a bundle of wires. Maintenance personnel noted that the wire stand-off associated with this Adel clamp was about 1/8 inch long. They indicated that the wire bundle worked its way close to the circuit breaker lug until the Adel clamp contacted the lug and shorted. 1.18.2.4 Boeing Service Letter Regarding Inspection of Wiring on High-Time 747 Airplanes (747-SL-20-048, Dated January 25, 1995) Boeing indicated that after being “requested by operators to provide guidance on areas of wiring that warrant special attention on high time 747 airplanes,” it inspected several high-time 747 airplanes. On the basis of these inspections, on January 25, 1995, Boeing issued SL 747-SL-20-048, which stated that “overall, Boeing has found that most airplane wiring exceeds the economic design goal of the airplane.”382 Further, the SL stated that Boeing “believe[d] that the wiring on high time 747 airplanes is holding up exceptionally well,” and noted that “[w]iring damage is hard to predict but some areas of wiring experience degradation more frequently.” Boeing indicated that it considered “the principal causes of wiring degradation” to be vibration (and vibration in conjunction with other factors), maintenance (proper and improper),383 indirect damage (damage resulting 382 Boeing indicated that the 747’s economic design goal was 50,000 flight hours; however, it noted that many in-service 747s significantly exceed (in some cases, more than double) this flight time. (According to Airclaims, as of November 30, 1999, 469 of the 747s operated worldwide had more than 50,000 hours, including 14 with more than 100,000 hours. Airclaims data indicated that 154 of the 747s operated at that time by U.S.-based operators had more than 50,000 hours, including 3 with more than 100,000 hours.) Although Boeing indicated that the 747’s economic design goal was 50,000 flight hours, Boeing’s design documentation for the electrical system indicated that the design goal of electrical system components was “30,000 hours of continuous trouble-free operation.” 383 SL 747-SL-20-048 noted that although improper maintenance can contribute to long-term wiring problems and wiring degradation, even proper maintenance can disturb wiring, resulting in increased degradation. According to Boeing, “as wiring and components become more brittle with age this effect becomes more pronounced.”

Factual Information 193 Aircraft Accident Report from events not directly related to wiring, such as pneumatic duct ruptures), chemical contamination,384 and heat.385 SL 747-SL-20-048 stated that operators should be particularly attentive to the following areas during wiring inspections: • Clamping points—damaged clamps, clamp cushion migration, or improper clamp installations can aggravate wire chafing. • Connectors—worn seals, missing seal plugs or dummy contacts, or lateral pressure on connector grommets can compromise connector integrity and allow contamination to enter the connector, resulting in corrosion or grommet degradation. • Terminations—terminal lugs and wire splices are susceptible to mechanical damage, corrosion, heat damage, and chemical contamination. Also, the buildup and nut torque on large-gauge wire studs are critical to their performance. • Backshells386—wires may break at backshells because of excessive flexing, static pressure, or missing build up. • Sleeves and conduits—damage to sleeving and conduits, if not corrected, will often lead to wire damage. SL 747-SL-20-048 also stated that a special inspection of high-time 747 airplane wiring should include the following areas: wings, engine and nacelle, landing gear, electrical panels, and power feeders. Boeing noted that the wings, engine and nacelle areas, and landing gear are high vibration areas. The SL further stated that “the wing leading edge and pylons are…difficult environment[s] for wiring installations” and, in attachment 2 to 747-SL-20-048, Boeing indicated that it could “see the virtue of a wire by wire inspection” of these areas. The attachment described such an inspection as follows: Wiring is released, cleaned, bundle clamps…and bundle ties removed. However, environmentally sealed and potted installations and wiring in conduit should be left undisturbed unless damage is suspected. Wiring should be closely inspected for damage from vibration and exposure to environmental damage. Wire bundles are separated to allow inspection of individual wires. 384 SL 747-SL-20-048 stated that “certain chemicals commonly found in an air carrier operating environment (for example, hydraulic, cleaning, corrosion-inhibiting, and/or deicing fluids) can result in wiring component degradation.” 385 According to Boeing, wiring that was not designed for high temperatures will degrade more rapidly when exposed to heat. SL 747-SL-20-048 stated that exposure to even low levels of heat can degrade wiring over long periods of time. 386 A backshell is a mechanical component that provides protection and support for wires attaching to an electrical connector, relieving strain from the electrical pins to which the wires attach.

Factual Information 194 Aircraft Accident Report 1.18.2.5 Wiring Inspection Methods Currently, aircraft wiring is usually visually inspected during an air carrier’s detailed inspection of the area through which it is routed.387 This method of wire inspection requires a visible defect to develop before detection is possible. However, as previously stated, a large portion of an airplane’s electrical wiring is not readily visible (and, therefore, not readily inspectable) because it is bundled with dozens of other wires (of which, only the portions of the wires on the surface of the bundles would be visible) or blocked from view by other structures or components (including other wire bundles, airframe structure, and avionics or other system components). Other obstructions to visual inspection of wires include protective sleeves installed on wires, clamps, potting material or sealant, and limited viewing angles because of confined inspection areas. Although many wire defects may be difficult or impossible to detect through visual inspection alone, automated test equipment (ATE) inspection systems are available to supplement visual inspections. These systems include electrical continuity or resistance tests, insulation resistance and capacitance tests, and time-domain reflectometry (TDR).388 According to the manufacturers, ATE inspection systems would be capable of quick, thorough, and reliable inspections of electrical system components, such as wiring and connectors, on commercial airplanes. ATE inspection systems can be connected to an airplane’s electrical system through electrical connectors to perform a series of computerized inspections of every wire within a bundle—even those that would not be visible to the human eye. ATE inspection systems could be used to establish baseline properties of individual wires within a wire bundle and to detect any differences in the properties of those wires (possible indications of the presence of short circuits, chafing, abrasions, cuts, or cracks in the insulation) during subsequent inspections. Using ATE inspection systems would allow air carriers to evaluate the condition of electrical wiring and detect defects before they become visually apparent and cause an electrical malfunction. Further, the location of the degradation could be determined from these test sets, which would allow specific repairs to be performed before failures (such as electrical arcing) could occur (known as proactive inspection). However, ATE inspection systems have some limitations and disadvantages, including equipment cost, size, and weight; the need for specially trained test equipment personnel and numerous cables long enough to attach the ATE to the airplane at the furthest ends of individual circuits; unique electrical connectors that must mate with connectors in the airplanes to be tested;389 and preprogrammed software requirements. According to observers, the time required to set up the test equipment, then disconnect the test equipment and reinstall airplane components that had been removed for access to connectors, exceeded the time it took to run the test. 387 For a description of TWA’s general inspection procedures, see section 1.6.3.1.1. 388 TDR is an ATE inspection technique that involves injecting small electrical pulses into each wire and then measuring the reflected energy. 389 There are numerous electrical connectors available to manufacturers and operators, and the specific connectors used may vary from airplane to airplane and within an airplane, making it difficult to match with ATE connectors.

Factual Information 195 Aircraft Accident Report The Safety Board has learned that since the TWA flight 800 accident, the FAA, U.S. Navy, and USAF have (independently and jointly) conducted research into ATE aircraft wiring inspection systems/techniques. These research efforts include the following: • Through the Aging Transport Systems Rulemaking Advisory Committee (ATSRAC),390 the FAA has tested/evaluated ATE systems from several manufacturers at the FAA’s Validation Center (SNL) in Albuquerque, New Mexico. Recent evaluation of an ATE system revealed that interpretation of the test results could result in the identification of many wiring faults, by type and location that were not visually observable. However, a trained system operator was required to differentiate installation characteristics (such as clamps and other structure adjacent to wires) from defects. The FAA concluded that further research should be initiated to optimize the test systems for commercial aircraft use and to develop appropriate acceptance and failure criteria for the electrical properties of a wire. • The U.S. Navy contracted with Lectromec to compare visual wire inspections with an electronic wire inspection technique. According to the resultant report (Report N193-RPT14MY9), during the inspections of U.S. Navy P-3 airplanes, visual inspections detected only 25 to 39 percent of the defects that were subsequently identified using the electronic inspection technique. • The U.S. Navy has been developing an aircraft wiring system with embedded diagnostic and prognostic capabilities (on board ATE), which is known as smart wire. • The U.S. Navy has initiated the Aircraft Wiring and Inert Gas Generator (AWIGG) Group and has hosted a series of meetings in which Government and industry representatives discuss AWIGG-related problems and solutions. Many ATE system manufacturers have provided presentations regarding ATE products and developments. • The USAF AFRL has been conducting research into ATE systems and has issued Small Business Innovation Research contracts to fund ATE research and development.391 The FAA and the USAF’s Office of Productivity, Reliability, Availability, and Maintainability are jointly sponsoring an effort to enhance ATE inspection systems currently being developed. Additionally, in June 2000, the White House Office of Science and Technology organized a Wire System Safety Interagency Working Group (WSSIWG) to examine the condition of wires (and other interconnections) in various transportation and industry modes392 and to evaluate wire inspection/maintenance methods that may help maintain safe conditions. The WSSIWG provides an opportunity for discussion and sharing of 390 For additional information regarding the ATSRAC, see section 1.18.3.4.4. 391 According to an AFRL representative, studies of USAF wire failures and inspection techniques indicated that maintenance/inspection personnel did not always use ATE inspection methods because of their limitations. As a result, the USAF has been seeking more user-friendly ATE inspection techniques.

Factual Information 196 Aircraft Accident Report information among representatives from agencies with a wide range of possibly unrelated uses for wire. 1.18.3 Safety Recommendations and Responses and Actions Resulting From the TWA Flight 800 Accident 1.18.3.1 December 13, 1996, Safety Recommendations Regarding Fuel Tank Flammability (Safety Recommendations A-96-174 through -177) During its investigation of the TWA flight 800 accident, the Safety Board became concerned about the operation of transport-category airplanes with potentially explosive fuel/air mixtures in the fuel tanks, noting that this was inconsistent with the basic tenet of transport aircraft design that no single-point failure should prevent continued safe flight. As a result of its concerns, the Safety Board issued Safety Recommendations A-96-174 through -177 to the FAA on December 13, 1996. Safety Recommendations A-96-174 and -175393 asked the FAA to Require the development and implementation of design or operational changes that will preclude the operation of transport-category airplanes with explosive fuel/air mixtures in the fuel tanks: (a) Significant consideration should be given to the development of airplane design modifications, such as nitrogen-inerting systems[394] and the addition of insulation between heat-generating equipment and fuel tanks. Appropriate modifications should apply to newly certificated airplanes and, where feasible, to existing airplanes. (A-96-174) (b) Pending implementation of design modifications, require modifications in operational procedures to reduce the potential for explosive fuel/air mixtures in the fuel tanks of transport-category aircraft. In the 747, consideration should be given to refueling the…CWT before flight whenever possible from cooler ground fuel tanks, proper monitoring and management of the CWT fuel temperature, and maintaining an appropriate minimum fuel quantity in the CWT. (A-96-175) In its February 18, 1997, response, the FAA stated that these safety recommendations proposed major changes in the requirements for fuel tank design and fuel management on transport-category airplanes. The FAA noted that (as previously discussed) existing airworthiness standards assume that fuel vapor in the tank is flammable and that design requirements dictate eliminating potential fuel tank ignition sources. The FAA stated that controlling the flammability characteristics of fuel vapor in airplane fuel tanks would require a major change in design concept and that to control fuel temperatures to the extent necessary to ensure that the fuel tank vapor is nonflammable 392 For example, the WSSIWG includes representatives from the FAA, U.S. Navy, USAF, NRC, and Department of Commerce (National Institute of Standards and Technology). 393 Safety Recommendation A-96-175 was designated “Urgent.” 394 Fuel tank inerting involves using inert gases in fuel tanks to lower the potential for explosions.

Factual Information 197 Aircraft Accident Report under all operating conditions would be a major task with significant economic implications. The FAA indicated that to evaluate these safety recommendations adequately, it would solicit public comments regarding the technological practicality and economic reasonableness of the Safety Board’s recommendations. A notice to solicit public comment was published on April 3, 1997, in 62 Federal Register (FR) 16013. Comments were required to be submitted to the FAA by August 1, 1997.395 In a June 27, 1997, letter, the FAA stated that it shared the Safety Board’s goal of minimizing the risk of fuel tank explosions and believed that reducing fuel volatility and ignition sources was the most promising path to this objective. However, the FAA indicated that more research on the chemistry of fuel vapor and the energy needed to ignite the vapor and additional flight tests to obtain data on fuel and vapor temperatures were needed to determine the best actions to be taken. The FAA also stated that it was pursuing an aggressive program to further minimize ignition sources within fuel tanks, including providing ground-fault protection to wires in fuel tanks and more focused maintenance programs for fuel tank components. On July 1, 1997, the Safety Board advised the FAA that Safety Recommendation A-96-174 addressed the current FAA policy of preventing fuel tank explosions by eliminating ignition sources because this policy has not been 100 percent effective. The Board’s letter further noted that it is unlikely that TWA flight 800 would have experienced the catastrophic explosion and breakup if the CWT had not contained explosive fuel/air vapor. The Board indicated its belief that it is unacceptable to allow explosive fuel/air vapor to exist in fuel tanks of passenger-carrying aircraft. The Board stated that, although it was concerned about the length of time it took for the FAA to publish the request for comments, it recognized the value in the FAA seeking and evaluating input from the industry before mandating policy change that could require significant modifications to aircraft designs. Therefore, Safety Recommendation A-96-174 was classified “Open— Acceptable Response.” Regarding Safety Recommendation A-96-175, the Safety Board noted that it called for operational changes that could be instituted quickly and that neither limiting air conditioning use on the ground nor reapportioning initial fuel loading to the CWT from the wing tanks would require the purchase of additional equipment or fuel. The Board 395 According to this notice to solicit public comment, the FAA had initiated research into the feasibility of nitrogen inerting as a method of “reducing the likelihood of fuel tank explosion due to post crash ground fire” in 1969. This research involved the installation and use of a nitrogen inerting system in a DC-9. The FAA concluded that although “the system provided adequate inerting of the fuel tanks….the costs of such a system were shown to outweigh the benefits at that time.” The notice to solicit public comment also cited Safety Recommendation A-71-59, which was issued by the Safety Board in 1971 as a result of an accident in New Haven, Connecticut, in which 27 of 28 airplane occupants survived the initial ground impact but died as a result of the postcrash fire/explosion. Safety Recommendation A-71-59 urged the FAA to “require fuel system fire safety devices which will be effective in prevention and control of both in flight and postcrash fuel system fires and explosions.” On November 13, 1985, Safety Recommendation A-71-59 was classified “Closed—Acceptable Action.” The notice to solicit public comment also stated that the military has used nitrogen inerting systems in C-5 and C-17 military transport-category airplanes, the F-22 fighter, and the V-22 tiltrotor. The military also uses foam filler explosion suppression systems in several of its airplanes.

Factual Information 198 Aircraft Accident Report noted that, although reducing fuel tank temperatures by only a few degrees may seem insignificant, incremental reductions of fuel/air temperatures could keep them below the lower explosive limits of the fuel. Because the FAA had not initiated any immediate action in response to Safety Recommendation A-96-175, it was classified “Open—Unacceptable Response.” In a December 3, 1997, letter, the FAA stated that it had received 976 pages of comments from 340 commenters regarding the Safety Board’s recommendations in response to its notice to solicit public comment. The FAA indicated that comments from the public generally expressed a concern that action be taken to improve safety, whereas industry comments focused on the technical merits and costs associated with implementing the recommendations. The FAA noted that commenters did not agree on the reliability of possible long-term methods of reducing or eliminating explosive fuel/air mixtures or on the weight and cost implications. The FAA indicated that it intended to establish an ARAC working group396 to evaluate both reducing or eliminating explosive fuel/air vapors and potential ignition sources within airplane fuel tanks and to identify specific methods to implement improvements in transport airplane fuel tank safety for the current and future fleet. The FAA stated that the ARAC working group would be given 6 months to provide the FAA with a report describing all technical issues and specific solutions. Regarding short-term methods of reducing exposure time to explosive fuel/air mixtures, the FAA stated that its analysis indicated that loading cool fuel into the CWT and controlling the use of the air conditioning packs on the ground would have little effect on the overall level of exposure to operation with explosive fuel/air mixtures and that it did not see a significant safety benefit from adding fuel to the CWT when it would normally be empty. However, the FAA stated that removing heat from the pack bay through dedicated ventilation, coupled with insulating the tank from heat sources, may significantly reduce the exposure to operation with explosive fuel/air mixtures. The FAA indicated that design modifications, such as insulation or inerting, were among the long-term solutions that would be evaluated by the ARAC working group. The FAA also stated that, in the short-term, it would further reduce the likelihood of fuel tank explosions by the following actions: • proposing to require periodic inspections of 747 fuel tanks and equipment inside fuel tanks; • continuing to correct design or maintenance-related deficiencies in 747 fuel tanks that may lead to ignition sources being present; and 396 The FAA stated that the ARAC working group would be composed of industry experts, as well as a number of passenger, union, and public interest group members.

Factual Information 199 Aircraft Accident Report • proposing to require, for the fleet of all large air transport airplanes, that (1) each type certificate holder develop a fuel tank maintenance and inspection program, (2) each operator have an FAA-approved fuel system maintenance program, (3) original certification compliance findings be reviewed to revalidate that failures within the fuel system will not result in ignition sources, and (4) operation of electrically driven fuel pumps in fuel tanks with adjacent heat sources be prohibited when the pump inlet is not fully submerged in liquid fuel, unless a flame arrestor is installed in the fuel pump inlet line. In a March 3, 1998, letter, the FAA indicated that the notice to establish the new ARAC working group (the FTHWG) was published in the FR on January 23, 1998. The notice gave the FTHWG until July 23, 1998, to provide the FAA with a technical report.397 The FAA further noted that Safety Board-sponsored testing at CIT indicated that reducing the temperature of the fuel in the CWT significantly increased the energy level required to ignite the fuel and that this information conflicted with industry-standard data traditionally used by the military and the FAA in establishing the flammability of vapors within fuel tanks. The FAA stated that it had established a team of fuel experts to review all available data on the relationship of fuel temperature to MIE and that a report of the team’s conclusions and recommendations was expected by the end of March 1998. The FAA further stated that, upon review of that report, it intended to reevaluate whether a significant safety improvement could be achieved through practical changes in fuel loading and fuel usage procedures. The FAA also reported on the status of the short-term actions (outlined it its December 3, 1997, letter) to reduce the likelihood of fuel tank explosions. Specifically, in addition to several planned actions, the FAA stated that it had already completed the following actions: • Issued AD 97-26-07, effective December 29, 1997 (superseding AD 96-26-06), which required a repetitive inspection of Teflon sleeves that protect wiring to the outboard main tank boost pumps on all 747 series airplanes. (The FAA noted that similar AD action was planned for 767 series airplanes.) • Issued NPRM 97-NM-272-AD on November 26, 1997, which proposed to require modification of 747 FQIS wiring to incorporate separation, shielding, and/or electrical transient suppression features to prevent electrical signals with excessive energy from entering the fuel tanks. (The FAA noted that a similar NPRM was being developed for FQIS wiring on 737s.) In a September 21, 1999, response, the Safety Board expressed concern that in the 2 1/2 years since the safety recommendations were issued, no design modifications to airplanes had been made. Noting that the FAA had taken no action toward implementing Safety Recommendation A-96-174, and it appeared that no action was contemplated, the 397 For additional information regarding the FTHWG’s technical report, conclusions, and recommendations, see section 1.18.3.4.2.

Factual Information 200 Aircraft Accident Report Board classified the recommendation “Open—Unacceptable Response.” With regard to short-term actions, the Board noted that its July 1997 flight tests had demonstrated that the potential flammability of vapors in CWTs could be reduced through fuel management and limiting the use of air conditioning packs. The Board stated that, although the overall reduction in flammability was not as great as originally thought, the reductions represented a safety improvement that could be achieved at minimal cost and in a very short time. Because the FAA had not taken any action directly responding to Safety Recommendation A-96-175 in nearly 3 years, the Board classified it “Open— Unacceptable Response.” In a November 3, 1999, letter, the FAA noted that the FTHWG, whose report had been issued on July 23, 1998, concluded that reducing flammability in all fuel tanks to the level of wing tanks on most airplanes (which the FTHWG calculated to be approximately 7 percent of the fleetwide operational time) as a worthwhile goal. After evaluating various design concepts, the FTHWG concluded that retrofitting the existing fleet was not currently feasible but that changes could be made for new airplane designs that would reduce the flammability of CWTs. The FAA stated that it may not agree with everything contained in the FTHWG’s report398 but that it did agree with the conclusion that further study is needed to determine if a method can be shown to be feasible that would eliminate or reduce the flammability of fuel tanks on in-service airplanes. The FAA indicated that it had therefore initiated studies of directed ventilation and ground-based inerting methods and that, after equipment requirements for ground-based inerting had been determined, it intended to task the ARAC to perform a detailed study of inerting options. The FAA also stated that, on the basis of conclusions of a team of fuel experts and the FTHWG, it had determined that the information available still showed that there was no significant safety benefit from adding fuel to 747 CWTs. However, the FAA indicated that it was continuing to take short-term actions to reduce the likelihood of fuel tank explosions by proposing airworthiness actions to correct any design or maintenance-related deficiencies in fuel tank systems that may lead to an ignition source being present. In a May 17, 2000, letter, the FAA indicated that it was continuing to make progress toward taking action to significantly reduce the exposure of transport-category airplane fuel tanks to flammable vapors in both newly certificated and existing airplanes and that methods under evaluation were cooling of the CWT using directed ventilation and fuel tank inerting using on-board nitrogen or ground-based nitrogen sources. According to the FAA, initial temperature data provided by airplane manufacturers indicated that directed ventilation systems would not reduce the temperature of heated CWTs as much as previously expected or predicted in the FTHWG’s report. However, the FAA stated that it would reach a final conclusion after it received additional temperature data. 398 During a February 29, 2000, meeting with Safety Board staff, FAA staff indicated that the FAA did not intend to endorse the FTHWG’s proposed exposure criteria of 7 percent and would convene another ARAC to study methods of protecting fuel tank vapors. The tasking for this ARAC was published in the FR on July 14, 2000.

Factual Information 201 Aircraft Accident Report The FAA also stated that its study indicated that the cost to implement ground-based inerting was significantly less than the FTHWG’s estimate. The FAA’s analysis indicated that ground-based inerting would reduce the fleetwide average flammability exposure for affected CWTs to approximately 2 percent. The FAA indicated that it planned to conduct ground and flight tests to determine how long ground-based inerting would remain effective during flight and whether vent system modifications would be required to ensure its effectiveness. The FAA stated that these tests and its ground-based inerting report would be completed by mid-2000. The FAA further stated that a new ARAC working group would be established to perform a detailed study of ground-based inerting and on-board inerting methods for in-service, newly manufactured, and newly designed airplanes and to develop further data required for the FAA to determine if a method of inerting fuel tanks could be practical for these airplanes. The FAA also stated that on October 29, 1999, it had proposed regulatory changes (in NPRM 99-18)399 that would require minimizing the flammability of fuel tanks in newly designed transport-category airplanes. The FAA stated that the proposed regulation was intended as a short-term measure to require that fuel tanks are not heated and that they cool to below the ignition temperature at a rate equivalent to that of a wing tank. With regard to operational procedures, the FAA stated that, in response to recent suggestions from Safety Board staff, it had evaluated the use of ground sources for conditioned air instead of using the airplane’s air conditioning packs and had determined that this would provide a greater reduction in the exposure of those CWTs to flammable vapors than adding cooler fuel to the CWT before flight. The FAA further stated that its analysis indicated that the use of ground-conditioned air on days when temperatures exceeded 60° F400 would reduce the exposure from approximately 35 percent401 to approximately 25 percent, whereas adding cooler fuel to the CWT would result in a reduction to only approximately 30 percent. The FAA also determined that a combination of refueling the CWT with cooler fuel and using ground-conditioned air did not result in any additional reduction in exposure to flammability. The FAA noted that a May 5, 2000, Boeing SL, dated May 5, 2000, recommended that operators use ground-conditioned air when available and practical and when ambient ground temperatures are greater than 60° F and that they evaluate opening the pack bay doors to provide additional ventilation. The FAA stated that it would issue an information bulletin to FAA representatives assigned to each air carrier encouraging the application of the Boeing SL. Safety Recommendations A-96-174 and -175 and their current classifications are discussed further in section 2.4 of this report. 399 For additional information about NPRM 99-18, see section 1.18.3.4.3. 400 The FAA stated that analysis showed that using ground-conditioned air would provide little or no reduction in CWT flammability, which would already be low, when ambient temperatures are below 60° F. 401 Although the FTHWG had estimated that CWTs with air conditioning packs located beneath them would be flammable an average of 30 percent of the fleetwide operational time, the FAA’s estimate of 35 percent was based on an analysis that considered the results of research completed after the FTHWG.

Factual Information 202 Aircraft Accident Report Safety Recommendation A-96-176 asked the FAA to Require that the 747 Flight Handbooks of TWA and other operators of 747s and other aircraft in which fuel tank temperature cannot be determined by flight crews be immediately revised to reflect the increases in…CWT fuel temperatures found by flight tests, including operational procedures to reduce the potential for exceeding CWT temperature limits. (Although the FAA’s February 18 and June 27, 1997, letters referenced Safety Recommendations A-96-174 through -177, they did not specifically address Safety Recommendation A-96-176.) In its July 1, 1997, letter to the FAA, the Safety Board noted that correcting these and similar flight handbook errors would not have required a delay while the FAA sought public comment. Accordingly, Safety Recommendation A-96-176 was classified “Open— Unacceptable Response.” In its December 3, 1997, letter, the FAA acknowledged that the Safety Board’s flight tests had shown that it was possible for the temperature of the fuel in the CWTs of Boeing 747s to rise significantly during extended periods of air conditioning pack operation on the ground. However, the FAA stated that it had not required that such information be provided to operators in the FAA-approved aircraft flight manual (AFM) and that the information in the Boeing 747 TWA Flight Handbook is considered by the FAA to be advisory only. The FAA also noted (in its December 3, 1997, and March 3, 1998, letters) that the fuel tank temperature limits given in the FAA-approved AFM for the Boeing 747 were intended to prevent freezing of the fuel and to ensure that the fuel feed system will perform in hot weather without any anomalous operation caused by excessive fuel vapor/liquid ratios within the fuel feed system, not to preclude operation of the airplane with a flammable fuel/air mixture in the fuel tanks. In a September 21, 1999, letter, the Safety Board noted that the information in the TWA 747 Flight Handbook about temperature limits was incorrect in that it states that air conditioning pack operation can elevate the CWT temperature by 10° to 20° F, whereas flight tests found increases from the baseline fuel tank temperature of 40° to 60° F during air conditioning pack operation. Because the FAA had taken no action directly responding to Safety Recommendation A-96-176, it was again classified “Open—Unacceptable Response.” In its May 17, 2000, letter, the FAA noted that TWA no longer operates 747s and that the TWA flight handbooks that were the subject of this recommendation are no longer active. According to the FAA, Boeing had reviewed its flight and operations manuals and polled operators regarding the content of their flight handbooks and determined that none of those documents provided CWT temperature correction information for flight crews.402 On the basis of this information, in an August 3, 2000, letter, the Safety Board classified Safety Recommendation A-96-176 “Closed—No Longer Applicable.”

Factual Information 203 Aircraft Accident Report Safety Recommendation A-96-177 asked the FAA to Require modification of the…[CWT] of 747 airplanes and the fuel tanks of other airplanes that are located near heat sources to incorporate temperature probes and cockpit fuel tank temperature displays to permit determination of fuel tank temperatures. (Although the FAA’s February 18 and June 27, 1997, letters referenced Safety Recommendations A-96-174 through -177, they did not specifically address Safety Recommendation A-96-177.) In its July 1, 1997, letter to the FAA, the Safety Board noted that without temperature probes and indicators, 747 flight crews could not be alerted to hazardous temperatures in the CWT. The Board stated that these changes, if implemented, would allow flight crews to reduce exposure to high CWT temperatures and that neither change would have significant economic impact. Although the Board expressed concern about the length of time it took the FAA to publish its request for comments on the Board’s recommendations, it recognized the value in seeking and evaluating input from the industry. Accordingly, Safety Recommendation A-96-177 was classified “Open— Acceptable Response.” As previously discussed, in its December 3, 1997, letter, the FAA stated that the purpose of the fuel tank temperature limits in Boeing's AFM was not for the management of fuel tank temperature to preclude the presence of a flammable mixture in the fuel tank ullage and that it considered the current tank temperature indication scheme used on transport-category airplanes to be adequate for the purposes for which it was intended. The FAA indicated that comments on this recommendation from industry, operators, and manufacturers questioned the usefulness of providing such information to flight crews. On the basis of those comments, the FAA indicated that the management of fuel tank temperature on existing airplane configurations through the creation of a tank temperature “red-line” associated with tank flammability is not considered to be practical. It also noted that the addition of another set of electrical components and wiring inside the fuel tank would create another possible source of tank ignition. In a March 3, 1998, letter, the FAA stated that, as additional technical data and information were developed through the ongoing activities (including the FTHWG and Safety Board-sponsored fuel research at CIT), it would further evaluate the need to take the specific actions identified by the Board in Safety Recommendation A-96-177. In its September 21, 1999, letter, the Safety Board stated that, because the FAA had taken no action to implement Safety Recommendation A-96-177, it was classified “Open— Unacceptable Response.” In a November 3, 1999, letter, the FAA indicated that the work of the FTHWG and researchers at CIT was complete. The FAA stated that it had concluded that no practical 402 Boeing found that one non-U.S. operator had a note similar to the one found in the TWA Flight Handbook, and it requested that the operator remove that note.

Factual Information 204 Aircraft Accident Report means of reducing fuel temperatures in fuel tanks existed but that, as stated in response to Safety Recommendation A-96-174, it had begun studies of directed ventilation methods to determine if they could be effective in cooling CWTs and be feasible for retrofit on the existing fleet of transport-category airplanes. The FAA stated that it would reevaluate this recommendation after the conclusion of the studies of methods that could significantly reduce the flammability of fuel tanks. The FAA stated that, although certain military airplanes incorporate fuel temperature indications with cockpit temperature displays for each tank, those displays are not used to determine fuel tank flammability; instead, they are used to monitor fuel tank temperatures during extended ground operation to ensure that the fuel temperatures in the main fuel tanks (wing tanks) do not rise to a range that would cause degraded fuel pump performance or pump cavitation when the engines are operating at high thrust levels that require high fuel flow from the fuel pumps. The FAA reiterated its belief that no benefit would be gained from additional fuel tank temperature probes. In its May 17, 2000, letter, the FAA stated that its evaluations of directed ventilation and fuel tank inerting systems indicated that flight crews would not require CWT temperature information in connection with those methods of controlling flammability. Further, the FAA stated that the use of ground-conditioned air would not require that information either. In an August 3, 2000, letter, the Safety Board agreed that using these methods to reduce flammability could obviate flight crews needing fuel tank temperature information but noted that neither directed ventilation nor fuel tank inerting systems are currently in use and, although a Boeing SL recommends the use of ground-conditioned air when available, it is not required. Accordingly, pending implementation of adequate methods for reducing fuel tank flammability or for determining fuel tank temperatures, Safety Recommendation A-96-176 was classified “Open—Unacceptable Response.” 1.18.3.2 February 18, 1997, Safety Recommendation Regarding the Handling and Placement of Explosive Training Aids (Safety Recommendation A-97-11) During the TWA flight 800 investigation, the Safety Board became aware that on June 10, 1996, a dog handler, working under the auspices of the FAA’s Explosives Detection Canine Team Program, had spilled trace amounts of explosives while placing training aids on board the accident airplane during a proficiency training exercise. As a result of this finding, on February 18, 1997, the Board issued Safety Recommendation A-97-11, which asked the FAA to Develop and implement procedures, including a checklist of safety-related items, for the handling and placement of explosive training aids by K-9 explosives detection teams to prevent contamination of aircraft and airport facilities and to ensure an effective K-9 explosives detection program.

Factual Information 205 Aircraft Accident Report In its April 18, 1997, February 9 and December 14, 1998, letters, the FAA stated that it had developed several initiatives to safeguard and account for canine explosives training aids used by participants in the FAA’s Explosives Detection Canine Team Program. For example, the FAA indicated that on May 19, 1997, it initiated a national database to record explosives training conducted on aircraft. In addition, during August and September 1997 and January 1998, the FAA provided updated and detailed training for all FAA canine coordinators regarding proper safe handling, storage, and accountability for explosives training aids. The FAA’s letter further stated that it procured explosives magazines approved by the ATF for each of the FAA’s Explosives Detection Canine Team Program participants. According to the FAA, these magazines are secured with two high-security locks and provide a greater degree of security while reducing contamination problems. The FAA also indicated that it had developed procedures for the use of barrier material(s) to prevent leaving explosives residues on surface areas when placing explosives training aids on aircraft or within the airport environment. In addition, the FAA developed an Explosives Detection Canine Team Training Log (in lieu of the checklist suggested in Safety Recommendation A-97-11) to aid in monitoring training requirements by requiring documentation of the type and number of training aids used and verification that the training aids were removed from the aircraft/airport environment. Further, the FAA’s letter indicated that on October 28, 1998, FAA staff briefed the Safety Board on the contents of the FAA Explosives Detection Canine Team Program Standard Operating Practices and explained how the procedures described therein addressed the intent of Safety Recommendation A-97-11. On February 8, 1999, the Safety Board responded that, because the FAA’s actions satisfied the intent of Safety Recommendation A-97-11, it was classified “Closed— Acceptable Action.” 1.18.3.3 April 7, 1998, Safety Recommendations Regarding Fuel Quantity Indication System Wiring and Components (Safety Recommendations A-98-34 through -39) As a result of its concerns about the potential for excessive energy to enter airplane fuel tanks through the FQIS and result in possible fuel tank ignition sources, the Safety Board issued Safety Recommendations A-98-34 through -39 on April 7, 1998. Safety Recommendation A-98-34 asked the FAA to Issue, as soon as possible, an…[AD] to require a detailed inspection of… [FQIS] wiring in Boeing 747-100, -200, and -300 series airplane fuel tanks for damage and the replacement or the repair of any wires found to be damaged. Wires on Honeywell Series 1-3 probes and compensators should be removed for examination.

Factual Information 206 Aircraft Accident Report Safety Recommendation A-98-35 asked the FAA to Issue an…[AD] to require the earliest possible replacement of the Honeywell Corporation Series 1-3 terminal blocks used on Boeing 747 fuel probes with terminal blocks that do not have knurled surfaces or sharp edges that may damage…[FQIS] wiring. In a June 10, 1998, letter, the FAA stated that Boeing had issued SB 747-28-2205, Revision 1, calling for inspections and testing to verify that the wiring, tubing, and component installations inside the CWT are in satisfactory condition and electrically bonded to the airplane structure. The FAA indicated that Boeing had also issued SBs calling for the replacement of Series 1-3 probes with Series 4 or later probes (SB 747-28-A2208) and installation of a flame arrestor in the inlet line of the electrical motor-operated scavenge pump located in the CWT (SB 747-28-A2210). The FAA stated that it would issue an NPRM proposing to require compliance with these SBs, including a requirement to replace CWT fuel probes at a specified period of time. On July 24, 1998, the FAA issued NPRM 98-NM-163-AD, which proposed to require compliance with SBs 747-28-2205, Revision 1, and 747-28-A2208 and to require replacement of FQIS components within 20 years of manufacture. In a February 9, 1999, letter, the Safety Board stated that it did not believe the referenced Boeing SBs contained sufficiently detailed instructions to ensure that the inspections were adequately thorough. For example, the Board noted that, although much of the damage it observed during its airplane wiring inspections was not visible until wiring was removed from its installation, the SBs did not specify the removal of wires for inspection. The Board further noted that the SBs did not address the issue of migration (cold-flow) of insulation material or the presence of localized blackening on the wire surfaces, which might indicate breaches in the insulation and, thus arcing, inside the tank. This, in turn, could ignite the flammable fuel vapors.403 The Board also noted that the FAA had provided no statistical basis for its proposed requirement to replace FQIS components within 20 years of their manufacture. Therefore, pending information from the FAA indicating that adequate and thorough inspections would be required and described and demonstrating the appropriateness of a 20-year service life for FQIS components, Safety Recommendation A-98-34 was classified “Open—Unacceptable Response.” Pending final rulemaking to remove Series 1-3 terminal blocks (which have knurled surfaces) from the 747 fuel tanks within 2 years of the AD’s effective date, Safety Recommendation A-98-35 was classified “Open— Acceptable Response.” In a November 3, 1999, letter, the FAA acknowledged the Safety Board’s concern about hidden damage to wires going undetected during inspections but expressed concerns that the removal and replacement process might cause additional wire damage. The FAA stated that it believed that “inspections that minimize the amount of disturbance of wiring are the best compromise between the risks associated with wire removal and hidden damage.” The FAA indicated that it believed that the in-tank inspections and 403 Conductors exposed as a result of migration or displacement of the wire insulation (cold-flow) was one of the suspected ignition mechanisms for the 1990 Philippine Airlines 737 CWT explosion.

Factual Information 207 Aircraft Accident Report modifications (including the replacement of FQIS probes with knurled surfaces or sharp edges) required by AD 99-08-02 R1,404 issued on June 29, 1999, in combination with the shielding/separation of FQIS wiring outside the fuel tanks required by AD 98-20-40405 would provide the level of safety intended by Safety Recommendation A-98-34. The FAA also stated that, on October 26, 1999, it issued a Special Federal Aviation Regulation (SFAR),406 which proposed to require a design review revalidating the fuel tank system designs to ensure that failures could not create ignition sources within the fuel tanks and to require manufacturers to design specific fuel tank maintenance and inspection programs to ensure the continued safety of fuel tank systems.407 Regarding the proposed 20-year life limit for FQIS components, the FAA agreed that there was little technical basis for the selection of that life limit and stated that it had hoped to gather additional information on an appropriate life limit through the NPRM comment process. However, on the basis of the comments that it had received, the FAA determined that additional study of sulfide deposits was necessary before any life limit could be imposed. On the basis of the FAA’s actions, in an August 3, 2000, letter, the Safety Board classified Safety Recommendations A-98-34 and -35 “Closed—Acceptable Action.” Safety Recommendation A-98-36 asked the FAA to Conduct a survey of…[FQIS] probes and wires in Boeing 747s equipped with systems other than Honeywell Series 1-3 probes and compensators and in other model airplanes that are used in Title 14…[CFR] Part 121 service to determine whether potential fuel tank ignition sources exist that are similar to those found in the Boeing 747. The survey should include removing wires from fuel probes and examining the wires for damage. Repair or replacement procedures for any damaged wires that are found should be developed. 404 In response to AD 99-08-02 R1, on June 27, 1997, Boeing issued SB 747-28-2205, which described fuel tank inspection procedures for 747 operators. Eight of the nine inspection tasks described involved visual inspections, and none of the inspection tasks required removal of wiring from fuel quantity probes or compensators. (During this investigation, Safety Board investigators repeatedly found that it was not possible to detect damage on the concealed side of wiring.) On September 25, 1997, Boeing issued a Notice of Status Change for SB 747-28-2205. And on October 27, 1997, Boeing notified 747 operators by telex (M-7220-970-1725) that it was developing a new SB that would provide operators with details regarding the inspection of 747 fuel quantity probes and FQIS wires. In an October 30, 1997, letter to the Board, Boeing indicated that the new SB would require the removal of wiring from terminal blocks for inspection, replacement of Series 1-3 fuel quantity probes, reporting of damage found at Series 4 and subsequent fuel quantity probes, replacement of certain CWT FQIS wire harnesses, inspection for proper wire routing and existing damage, establishment of an electrical resistance check of very low voltage, and establishment of standards for permissible FQIS repairs. 405 AD 98-20-40 is discussed further in connection with Safety Recommendation A-98-98. 406 For more information about the proposed SFAR, which was issued as part of NPRM 99-18, see section 1.18.3.4.3. 407 The FAA reiterated these actions in its May 17, 2000, letter.

Factual Information 208 Aircraft Accident Report In its June 10, 1998, letter, the FAA indicated that it was working with an industry team to develop plans to survey the condition of fuel tank systems on large transport-category airplanes and that the survey would include a review of historical data, including maintenance data. The FAA stated that the industry team had indicated that although it did not intend to remove wiring from FQIS probes (for fear of causing damage that would go undetected), FQIS wires in fuel tanks would be inspected for damage from chafing and abrasion under the clamps. The FAA indicated that it would review the industry team’s plans for the survey, evaluate the benefit of removing wires from fuel probes, and monitor the results of the inspections. The FAA further indicated that it planned to issue an NPRM proposing an SFAR that would require a design review of the fuel tank system in all large transport-category airplane fleets. In its February 9, 1999, response, the Safety Board expressed its concern that the industry team did not intend to remove the FQIS wires to avoid the potential for undetected damage to the wiring. The Board emphasized that in several cases its staff detected damage to 747 wire insulation only after the wires were removed from their installed locations; the damage subsequently observed included compression ruptures, cold-flow, chafes, and cuts. The Board urged the FAA to reconsider the benefits of removing the wiring from the fuel probes to allow a thorough inspection for damage. Pending the results of the FAA’s inspections and the issuance of the SFAR, Safety Recommendation A-98-36 was classified “Open—Acceptable Response.” In a November 3, 1999, response to the Safety Board, the FAA indicated that although the manufacturers’ instructions for the surveys of FQIS wiring in transport-category airplanes did not include removal of FQIS wiring, all FQIS wires in fuel tanks would be visually inspected for damage from chafing, abrasion under clamps, etc. The FAA further stated that it did not see a need to mandate removal of FQIS wires in airplanes other than 747s with FQIS probes that have knurled surfaces or sharp edges. The FAA indicated that it would continue to monitor the industry team’s findings and evaluate the need for future actions. In November 3, 1999, and May 17, 2000, letters, the FAA noted that on October 26, 1999, it had issued the planned SFAR, which proposed a design review to revalidate the fuel tank system designs to ensure that failures could not create ignition sources within the fuel tanks.408 In an August 3, 2000, letter, the Safety Board stated that, pending completion of the inspections currently in progress and the proposed fault tolerance evaluation and the implementation of the maintenance programs that will result from the SFAR, Safety Recommendation A-98-36 was classified “Open—Acceptable Response.” 408 For further details about the SFAR, see section 1.18.3.4.3.

Factual Information 209 Aircraft Accident Report Safety Recommendation A-98-37 asked the FAA to Require research into copper-sulfide deposits on…[FQIS] parts in fuel tanks to determine the levels of deposits that may be hazardous, how to inspect and clean the deposits, and when to replace the components. In its June 10, 1998, response, the FAA indicated that it was establishing a fuel tank system copper-sulfide research program, which it intended to conduct in partnership with the DoD. The FAA stated that the research program would address the identification of the conditions required for film deposit formation, determination of film properties, and diagnostics and film deposit removal. In February 9, 1999, letter, the Safety Board stated that it supported the FAA’s plan and provided the FAA with information gathered during the TWA flight 800 investigation that might be useful to its research. Pending further information about the FAA’s current and planned actions, Safety Recommendation A-98-37 was classified “Open—Acceptable Response.” In a November 3, 1999, letter, the FAA indicated that in April 1999, it had initiated a research program (through the FAA Aviation Assurance Center of Excellence Program) into the effects of sulfur-compound deposits on fuel system components. Participants in the research program included the FAA, Boeing, BFGoodrich, Arizona State University, and the UDRI. The Safety Board attended meetings as an observer and provided information pertaining to sulfides that was obtained during the TWA flight 800 investigation. The FAA indicated that it expected a report from the research team by the end of January 2000. In its May 17, 2000, letter, the FAA stated that it was continuing to make progress in understanding copper-sulfur and silver-sulfur deposits and the potential hazards that they may cause. The FAA indicated that the researchers had grown deposits in a laboratory but had not found indications of significant deposits occurring in in-service airplanes to compare with the laboratory-grown deposits. The FAA indicated that the research program had been extended so that the team could complete its evaluation. Safety Recommendation A-98-37 and its current classification are further discussed in section 2.3.2.2.3.1 of this report. Safety Recommendation A-98-38 asked the FAA to Require in Boeing 747 airplanes, and in other airplanes with…[FQIS] wire installations that are corouted with wires that may be powered, the physical separation and electrical shielding of FQIS wires to the maximum extent possible.

Factual Information 210 Aircraft Accident Report Safety Recommendation A-98-39 asked the FAA to Require, in all applicable transport airplane fuel tanks,…[STPs] to prevent electrical power surges from entering fuel tanks through…[FQIS] wires. In its June 10, 1998, letter, the FAA stated that NPRM 97-NM-272, issued on November 26, 1997, proposed to adopt an AD applicable to 747-100, -200, -300, -SP, and -SR airplanes which would require installation of electrical transient suppression devices (TSD) and/or the installation of shielding and separation of the electrical wiring of the FQIS located outside the fuel tanks. The FAA stated that it also issued a similar NPRM (98-NM-50-AD) applicable to 737-100, -200, -300, -400, and -500 series airplanes. Regarding other transport-category airplanes, the FAA indicated that the team developed to work on the fuel tank design review SFAR was developing advisory material for conducting the design reviews, which would include information on the use of wire separation and electrical shielding and/or TSDs to protect the FQIS wiring inside fuel tanks when applicable to the different airplane designs. In its February 9, 1999, response, the Safety Board noted that on September 30, 1998, the FAA issued AD 98-20-40, which required the installation of shielding and separation of the electrical wiring of the FQIS wiring located outside the fuel tanks in 747 airplanes. In addition, the Board acknowledged the FAA’s NPRM proposing a similar AD applicable to 737s. However, the Board expressed concern that the degree of separation required by AD 98-20-40 might not adequately protect fuel tanks from FQIS wiring deficiencies that might allow excessive energy into the tanks. The Board stated that information from several investigations indicated that Boeing’s minimum separation standard of 1/4409 inch might be insufficient. For example, as previously discussed, when the Board assisted in the AAIB’s investigation of a January 9, 1998, wiring fire on board a United Airlines 767, investigators found insulation melted away from wires located more than 1 inch from the location of the electrical arc. Balls of copper were found embedded into insulation and other materials. The Board expressed a similar concern about adequate separation of FQIS wiring in other large transport-category airplanes, including the Airbus 300 and 310 airplanes, in which powered cables and FQIS wiring are also corouted. The Safety Board also noted that, although the NPRM preceding AD 98-20-40 had proposed a requirement for installation of electrical TSDs, the AD did not require such devices. The Board stated that it did not believe that wire separation and shielding alone would protect against the entry of power from sources attached to FQIS wires. The Board noted that, for example, in a 747, 115-volt a.c. power and FQIS circuits are contained in common electrical connectors at the fuel gauges and in other components, such as the VSO. The Board stated that surge suppression systems would protect against damage that could affect numerous wires at once and against unforeseen circumstances. Pending receipt of further details regarding the wiring separation that would be accomplished by AD 98-20-40 and planned activities for other airplane models, Safety Recommendation 409 The Safety Board cited the lesser of Boeing's required separation distances—1/4 inch in pressurized areas and 1/2 inch in unpressurized areas.

Factual Information 211 Aircraft Accident Report A-98-38 was classified “Open—Acceptable Response.” However, noting that the FAA had apparently decided against TSDs in AD-98-20-40, Safety Recommendation A-98-39 was classified “Open—Unacceptable Response.” In its November 3, 1999, and May 17, 2000, letters to the Safety Board, the FAA acknowledged that, although the NPRM that led to AD 98-20-40 proposed TSDs as an optional or additional requirement to the shielding and separation requirement, that requirement was not included in the AD. The FAA stated that, when the AD was issued, it had determined that TSD technology was not fully developed for application to in-service airplanes and that wire separation and shielding could provide the required level of protection. However, the FAA indicated that it had since determined that either separation and shielding or TSD technology, executed properly, will adequately ensure that high- energy signals are not introduced on wiring inside fuel tanks. The FAA further stated that, to comply with the ADs,410 the design must include separation and shielding of wires between FQIS components and separation of the connectors to the components and circuits inside the components. The FAA stated that it was also evaluating the acceptability of TSD technology and, although the evaluations of proposed designs were not complete, it indicated that TSDs could be used to meet the intent of the ADs. However, the requirements for approval of a design using TSD technology would include demonstrating that the device would limit the transfer of electrical energy and power through the wires that enter a fuel tank to intrinsically safe levels (that is, limit to less than spark energy and filament heating energy limits that could create an ignition spark or a hot surface ignition source in a piece of wire, such as a strand of steel wool, which could short between FQIS circuits in the tanks).411 For other transport-category airplanes with FQIS, the FAA stated that draft AC 25.981.1X, prepared as guidance material for compliance with the fuel tank design SFAR, included information on the design and maintenance lessons learned in connection with the TWA flight 800 investigation and described the use of wire separation and shielding, or TSD technology, to protect FQIS wiring from short-circuits to other system wiring and other failures and malfunctions that could induce high electrical energy on FQIS wires that enter fuel tanks. Safety Recommendations A-98-38 and -39 and their current classifications are further discussed in sections 2.3.2.1.2.2.3 and 2.3.2.1.2.2.4 of this report, respectively. 410 The FAA also noted that a similar AD, requiring separation and shielding of FQIS wires and circuits on 737s, was issued on January 26, 1999. 411 For additional information, see Federal Aviation Administration. 2000. FQIS Transient Suppression Device/Unit for Installation on Boeing Model 747-100, -200, -300, SP, and SR Series Airplane. Issue Paper P-1. Washington, DC. This issue paper stated that the FAA would require “no single failure, or combination of failures not shown to be extremely improbable [not anticipated to occur during the entire operational life of all airplanes of that type], will allow 200 microjoules and/or 30 milliamps, or greater, into the fuel tank assuming the conditions for spark energy or filament heating exist.”

Factual Information 212 Aircraft Accident Report 1.18.3.4 Actions Resulting From the TWA Flight 800 Accident 1.18.3.4.1 Airworthiness Directives As part of the TWA flight 800 investigation, the FAA examined earlier ADs for issues that might potentially have been related to the accident. This examination revealed that (as previously discussed) on March 8, 1979, the FAA issued AD 79-05-04, which required (among other actions) inspections of wires in main fuel tanks on a limited number of 747 airplanes, with installation of Teflon sleeves on the effected wires (in accordance with Boeing ASB 747-28A2091) required to terminate repeat inspections. AD 79-05-04 was issued as a result of the FAA’s investigation of a report that fuel pump wires in an aluminum conduit that was routed through the fuel tank from a wing spar to a fuel pump had chafed through the insulation, resulting in electrical arcing. The arcing from the chafed wire to the conduit created a hole; however, the arcing did not result in fire or explosion because of the level of the fuel. After the FAA issued AD 79-05-04, an FAA fleetwide survey indicated that wires in these conduits were chafing against the conduit and that up to 80 percent of the total insulation thickness was missing on numerous wires in many airplanes. On the basis of these findings, on March 19, 1979, the FAA issued AD 79-06-02, which made the inspections and possible replacement actions applicable to other airplanes. During the investigation of the TWA flight 800 accident, the FAA determined that an environment conducive to vibration existed in the conduit and wire bundles of the fuel boost pumps and the auxiliary fuel tank jettison pumps, which could cause abrasion of the Teflon sleeving and subsequent abrasion of the wires in the bundles. Thus, on January 21, 1997, the FAA issued AD 96-26-06, which required the removal of wires from conduits in all 747s’ Nos. 1 and 4 main fuel tanks and inspections and replacement of damaged sleeving or wires. The FAA superseded AD 96-26-06 with AD 97-26-07 (applicable to all 747 airplanes) on December 29, 1997. AD 97-26-07 required the inspection of the auxiliary fuel tank jettison pumps as well as of the wiring and Teflon sleeves in conduit for the Nos. 1 and 4 main fuel tanks. After these ADs were issued, the FAA became aware of “severe wear” of the fuel boost pump wiring in two model 737-200 airplanes that had accumulated 54,000 and 67,000 total flight hours, respectively. Additionally, the FAA received a report about pin-sized holes in the conduit of a 737-200 that had 75,000 total flight hours. As a result of these reports, on April 24, 1998, Boeing issued ASB 737-28A1120, which described procedures for removal of the 737 fuel boost pump wiring and inspection or replacement (with the addition of Teflon sleeves) of that wiring. Further, the FAA issued Telegraphic AD T98-10-51, which required removal of the 737 fuel boost pump wiring and inspection or replacement (with the addition of Teflon sleeves) of that wiring and was applicable to 737-100, -200, -300, -400, and -500 airplanes with more than 50,000 flight hours. After it received additional reports and information about arcing on boost pump wiring on airplanes of various ages and flight-hour accumulation, the FAA issued the following ADs to revise the pertinent requirements: (1) AD T98-11-51, which broadened the inspection requirements outlined in AD T98-10-51 to include wires in 737 wing

Factual Information 213 Aircraft Accident Report conduits, on May 10, 1998; (2) AD 98-11-52, which revised the flight-hour requirement outlined in AD T98-11-51 to include airplanes with more than 40,000 flight hours, on June 24, 1998; and (3) AD 99-21-15, which further revised the flight-hour requirement outlined in AD T98-11-51 to include airplanes with more than 20,000 flight hours, on October 8, 1999. Figure 39 shows the 737 fuel pump conduit wear rate that was identified by the FAA during representative 500 wire inspections.412 Similar data for 747 inspection results were not released. The FAA also received a report of corrosion on bonding jumper wires located within a concentrated area in the wing fuel tanks on an in-service Airbus A300. Further inspections of other Airbus model airplanes did not reveal similar extensive corrosion or damage to bonding jumper wires; however, they did reveal evidence of the accumulation of deposits composed of copper, sulfur, and silver (also known as silver-sulfide deposits) around the outer braid of some jumper wires. Tests conducted by the manufacturer showed that these deposits did not affect the bonding function of the leads. Airbus has developed a one-time inspection SB for its airplanes to determine the extent of the silver-sulfide deposits and to ensure that the level of jumper wire damage found on the A300 is not widespread. On November 26, 1997, the FAA issued NPRM 97-NM-272-AD, which proposed a requirement for operators of 747-100, -200, and -300 airplanes to install components for the suppression of electrical transients and/or the installation of shielding and separation of FQIS wiring from other airplane system wiring. On September 23, 1998, the FAA issued AD 98-20-40, which required the installation of shielding and separation of the FQIS wiring on 747-100, -200, and -300 airplanes. This action was intended to preclude high levels of electrical energy from entering the airplane fuel tank wiring because of EMI or electrical short circuits. (On April 14, 1998, the FAA issued NPRM 98-NM-50-AD, which proposed a similar requirement for 737-100, -200, -300, -400, and -500 airplanes; the resultant AD 99-03-04 was issued on January 26, 1999.) According to the FAA, the FQIS wiring in all later model 737s and 747s has wire separation and fault isolation features that may meet the intent of these ADs. Rulemaking currently under consideration (Docket No. 99-18, discussed later in this section) will require evaluation of the more recent designs. On March 30, 1998, the FAA received reports of three instances of electrical arcing within fuel pumps installed in Lockheed L-1011 fuel tanks. In one case, the electrical arc had resulted (as previously mentioned) in a hole in the side of the pump. According to the FAA’s AD-related text, “the internal electrical failures in the wing fuel tank fuel boost pumps could result in either electrical arcing or localized overheating, which could breach the protective housing and expose it to fuel vapors and consequent potential fire or explosion in the wing fuel tank.” On April 3, 1998, the FAA issued emergency AD 98-08-09, which required that fuel be carried in the fuel tanks to cover the fuel pumps thereby precluding ignition of vapors within the fuel tank (by this mechanism) until a corrective action was developed. 412 For additional information, see the FAA’s Web site at http://www.faa.gov/apa/737iu.htm.

Factual Information 214 Aircraft Accident Report W ear R ate Found by 737 Fuel P um p C onduit W ire Inspections 0 5 10 15 20 25 30 35 30-40,000 40-50,000 50-60,000 60-70,000

70,000

A irplane Flight H ours Percentage of Wear Through Insulation U pper Line D enotes Exposed C onductor, Low er Line D enotes 50% Insulation W ear Figure 39. A chart showing the 737 fuel pump conduit wear rate that was identified by the FAA during representative 500 wire inspections.

Factual Information 215 Aircraft Accident Report The Direction Generale de L’Aviation Civile (DGAC) received three reports of CWT pumps in Airbus A300s with cracked canister legs caused by fatigue. In one case, this led to separation of the pump canister from its lower housing. As a result of these events, on November 30, 1998, the DGAC issued French Telegraphic AD T98-476-272(B), which required inspection and possible replacement of the fuel pumps on Airbus A300-B4-600R and A300-F4-600R airplanes. T98-476-272(B) stated that the cracked canister legs could result in loss of flame trap capability and could provide an ignition source in the CWT. As a result of the DGAC action, the FAA issued AD T98-25-93 on December 7, 1998, requiring similar action. The FAA became aware of another unanticipated fuel tank system failure condition as a result of reported incidents involving 767 airplanes in which parts from fuel pump assemblies contacted the rotating fuel pump impeller. In two reported cases, objects from a broken fuel pump inlet diffuser assembly were ingested into the fuel pump, causing damage to the pump impeller and pump housing. Because this condition could have resulted in sparks or hot debris in the presence of fuel vapor, the FAA issued AD 97-19-15, which required revision of the 767 AFM to include procedures to switch off the fuel pumps when the CWT is nearly empty. According to the FAA, the intent of this action is to maintain liquid fuel over the pump inlet so that any debris generated by a failed fuel pump would not come into contact with fuel vapors. 1.18.3.4.2 Aviation Rulemaking Advisory Committee/Fuel Tank Harmonization Working Group On April 3, 1997, the FAA published a notice in the FR that requested comments about the Safety Board’s Safety Recommendations A-96-174 through -177 regarding reduced flammability. As previously discussed, on the basis of its review of comments that it had received, the FAA determined that additional information was needed before it would initiate rulemaking action to address the Board’s recommendations. Therefore, on January 23, 1998, the FAA established an ARAC working group, the FTHWG, which was tasked with gathering the information needed. Representatives from the Aerospace Industries Association, Air Transport Association of America (ATA), International Air Transport Association, European Association of Aerospace Industries, Air Line Pilots Association, API, General Aviation Manufacturers Association, Joint Aviation Authorities (JAA), Aviation Consumer Action Project (ACAP), and FAA were involved in the FTHWG. The FTHWG was tasked with recommending regulatory changes that would “eliminate or significantly reduce the hazards associated with explosive vapors in transport-category airplane fuel tanks [of]…new type designs, in-production airplanes and the existing fleet.” Its objectives included the following: (1) analyze the history of the world transport-category aircraft fleet, the safety status of the existing fleet, various means of reducing exposure to flammable fuel vapors, and the means to eliminate the resultant hazard if ignition does occur; (2) recommend regulatory text for new rulemaking aimed at controlling flammability of fuel vapors in fuel tanks; and (3) assess the cost benefit of those means.

Factual Information 216 Aircraft Accident Report On July 23, 1998, the FTHWG submitted its final report to the FAA. The report indicated that the FTHWG’s studies showed that flammability exposure varied across airplane types and depended on fuel tank location. According to the report, some fuel tanks already have a low exposure to flammable conditions. For example, the FTHWG calculated that wing tanks are flammable approximately 7 percent of the fleetwide operational time. Further, results from the FTHWG’s thermal analysis indicated that the flammability exposure for fuel tanks that were not adjacent to such heat sources approximated that of wing tanks, whereas CWTs heated by air conditioning equipment located beneath them are flammable an average of 30 percent of the fleetwide operating time.413 The FTHWG concluded that the safety record of wing tanks was adequate and if the same level could be achieved in all CWTs, an adequate overall safety objective would be achieved. Accordingly, reducing flammability in all fuel tanks to the level of the wing tanks on most airplanes was seen by the FTHWG as a worthwhile goal. Various possible means to achieve this goal were evaluated for technical and economic merits, and the FTHWG reached the following conclusions: • Techniques to reduce or eliminate heat input to the tanks from nearby heat sources were evaluated. Of these techniques, directed ventilation and relocation of the significant heat sources reduce the exposure to an acceptable level. However, relocation is only feasible for new airplane designs. Directed ventilation for in-service aircraft is estimated to have an overall cost of $3.5 billion over a 10-year period. • To reach the goal by changing fuel properties, a minimum flash point specification of 140° F would be required. A change of this magnitude falls outside of the current experience base and may require engine re-design/re- qualification. The overall fuel manufacturing cost increase for a 10-year period is estimated at $15 billion in the USA and $60 billion for the rest of the world and could result in a significant shortfall of jet fuel. • Techniques such as on board fuel tank inerting or installation of foam in the tanks would also achieve the goal, but at a cost estimated to be at least $20 billion over the next 10 years and would be very difficult to retrofit in current airplanes. Ground inerting, wherein specific tanks are made inert before flight, at specific airports, is an option that needs future study to determine; (a) the logistical costs of such a system, and (b) if retrofit installation of the distribution system internal to the airplane could be achieved in a cost effective manner. • The Working Group considered several concepts that were determined to be insufficiently advanced technically at this time, for transport airplane fuel tank use. These included ullage sweeping and explosion suppression systems. 413 As previously discussed, the FAA subsequently determined that 35 percent was a more accurate estimate.

Factual Information 217 Aircraft Accident Report The FTHWG made the following recommendations to the FAA and JAA: • Adopt the proposed new regulatory action on new aircraft designs that would limit the development of flammable conditions in the fuel tanks, based on the intended fuel types, to less than 7 percent of the expected fleet operational time, or provide means to mitigate the effects of an ignition of fuel vapors within fuel tanks such that any damage caused by an ignition will not prevent continued safe flight and landing. • Continue to investigate means to achieve a cost-effective reduction in flammability exposure for the in-service fleet and newly manufactured aircraft. • Pursue the studies associated with directed ventilation and ground-based inerting systems to improve their cost effectiveness. • If a practical means of achieving a cost effective reduction in flammability exposure can be found for the in-service fleet, either at the level specified in the rule or at some intermediate level (recommendations 2 and 3 above), consider application of that solution, in combination with other actions (e.g., SFAR). • If a practical means of achieving a cost effective reduction in flammability exposure can be found for newly manufactured aircraft, either at the level specified in the rule or at some intermediate level (recommendations 2 and 3 above), consider application of that solution, in combination with other actions (e.g., SFAR).[414] 1.18.3.4.3 Notice of Proposed Rulemaking 99-18 (Fuel Tank System Design Review, Flammability Reduction, and Maintenance/Inspection Requirements) On October 29, 1999, the FAA published NPRM No. 99-18,415 “Transport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance and Inspection Requirements.” The NPRM indicated that the TWA flight 800 accident and resulting Safety Board recommendations had prompted the FAA to examine the 414 One FTHWG representative, the representative from the ACAP, submitted a letter, dated July 23, 1998, expressing his dissenting view regarding the final report and recommendations prepared by the FTHWG. He stated, in part, “I opposed acceptance of the Report and its recommendations (a) because some of its key factual findings regarding costs of fixing the problem are unsupported and apparently flawed, (b) because its recommended rule changes are wholly inadequate to eliminate or significantly reduce the risk of fuel tank explosions and fires in the near or mid-term future, and (c) because I strongly disagree with the policy position…that a cost benefit analysis which found that doing nothing for the existing air carrier fleet would cause the equivalent of three TWA 800 disasters over ten years…” was acceptable. In his letter, the ACAP representative further indicated that the ARAC/FTHWG found that a significant danger exists for fuel tank explosions, especially for CWTs with adjacent heat sources. He stated that the ARAC/FTHWG’s final report indicated that “the best available technology to eliminate the risk of fuel tank explosions is in flight nitrogen inerting which regardless of the ignition source virtually eliminates the risk and has been successfully used for years on military [transport airplanes]….” 415 For additional information, see NPRM, “Transport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance and Inspection Requirements.” Notice No. 99-18. 64 FR 586644 (October 29, 1999).

Factual Information 218 Aircraft Accident Report underlying safety issues surrounding fuel tank explosions, the adequacy of existing regulations, the service history of airplanes certificated to those regulations, and existing fuel system maintenance practices. The NPRM proposed to amend the current regulations to address prevention of ignition sources and minimization of flammable vapors in fuel tanks in future airplane designs. Prevention of Ignition Sources According to NPRM 99-18, the regulatory authorities and aviation industry have always presumed that a flammable fuel/air mixture exists in fuel tanks at all times and have adopted the philosophy that the best way to ensure airplane fuel tank safety is to preclude ignition sources within fuel tanks. This philosophy has been based on the application of fail-safe design requirements to the airplane fuel tank system to preclude ignition sources from being present in fuel tanks when component failures, malfunctions, or lightning encounters occur. The NPRM noted that airplane fail-safe requirements are provided in 14 CFR Sections 25.901 (c) and 25.1309416 and that, in general, the FAA’s policy has been to require applicants to assume the presence of foreseeable latent (undetected) failure conditions when demonstrating that subsequent single failures will not jeopardize the safe operation of the airplane. However, the NPRM noted that the requirements of these sections “have not been consistently applied and documented when showing that ignition sources are precluded from transport category airplane fuel tanks.” The FAA also reviewed SDRs for the transport-category airplane fleet, evaluated the certification and design practices used on previously certificated airplanes, initiated an inspection of fuel tanks on existing 747 airplanes, and evaluated the results of an industry-led inspection of a representative sampling of transport-category airplanes. The FAA indicated that inspections revealed debris (including lockwire, rivets, and metal shavings) within the fuel tanks and in scavenge pumps of in-service 747 airplanes. Further, the FAA observed corrosion and damage to insulation on FQIS probe wiring on six out of eight probes removed from in-service airplanes. Inspection of fuel tank system components from out-of-service 747 airplanes revealed damaged (worn, chafed) wiring and a buildup of conductive sulfide deposits on the FQIS wiring.417 On the basis of its work, the FAA identified the following conditions as possible contributors to the development of ignition sources within the fuel tanks: aging of fuel tank system components, contamination (debris), corrosion of components, and sulfide deposits on components. NPRM 99-18 noted that the intent of existing inspection and maintenance programs is to ensure that the inherent level of safety that was originally designed into the system is maintained. The NPRM further noted that historically, FAA-required inspection programs for fuel tank systems included operational checks, functional checks following 416 These sections are quoted in section 1.16.6.5, in connection with Boeing’s CWT ignition fault tree analysis and report. 417 As previously discussed, tests conducted by the Safety Board during this investigation indicated that conductive deposits or damaged wiring may result in a location where arcing could occur if high-power electrical energy was transmitted to the FQIS wiring from another airplane source.

Factual Information 219 Aircraft Accident Report maintenance actions, overhaul of certain components to prevent dispatch delays, and general zonal visual inspections conducted concurrently with other maintenance actions. However, the NPRM noted that specific maintenance instructions to detect and correct conditions that degrade fail-safe capabilities had not been deemed necessary because it had been assumed that the original fail-safe capabilities would not be degraded in service. NPRM 99-18 stated that typical transport-category airplane fuel tank systems are designed with redundancy and fault indication features such that single component failures do not result in any significant reduction in safety. Therefore, fuel tank systems historically have not had any life-limited components or specific detailed inspection requirements, unless mandated by an AD. Most of the components are inspected “on condition,” meaning that some test, check, or other inspection is performed to determine continued serviceability, and maintenance is performed only if the inspection identifies a condition requiring correction. Visual inspection of fuel tank system components is by far the predominant method of inspection for components such as boost pumps, fuel lines, couplings, wiring. Typically these inspections are conducted concurrently with zonal inspections or internal or external fuel tank structural inspections. These inspections normally do not provide information regarding the continued serviceability of components within the fuel tank system unless the visual inspection indicates a potential problem area. For example, certain degraded fuel tank system conditions, such as worn wiring routed through conduit to fuel pumps, debris inside fuel pumps, corrosion to bonding wire interfaces, would not be detected without dedicated intrusive inspections that are much more extensive than those normally conducted.418 After its review of the 747 design, the FAA determined that during initial certification of the fuel tank system, the degree of tank contamination and the significance of certain failure modes of fuel tank system components had not been considered to the extent that recent events/service experience indicated was needed. For example, during initial certification, the manufacturer had demonstrated that the FQIS had been shown to preclude arcing if FQIS wiring came in contact with the highest electrical voltage produced on the airplane in the absence of contamination. However, testing conducted during this investigation has shown that if contamination, such as conductive debris (for example, lockwire, nuts, bolts, steel wool, corrosion, sulfide deposits, and metal filings), is located within gaps in the fuel probe, the voltage needed to create an arc is within values that could result from an electrical short-circuit or current induced in the FQIS probe wiring by adjacent wiring. According to NPRM 99-18, “if any of these anomalies were combined with a subsequent failure within the electrical system that creates an electrical short, or if [high-intensity radiated fields, or HIRF] or electrical current flow in adjacent wiring induces EMI voltage in the FQIS wiring, sufficient energy could enter the fuel tank and cause an ignition source within the tank.” On the basis of its review of SDRs and accident and incident reports, the FAA identified numerous fuel tank system design features, malfunctions, failures, and 418 For more information regarding TWA’s visual inspections, see section 1.6.3.1.1.

Factual Information 220 Aircraft Accident Report maintenance-related actions that would result in a degradation of the systems’ safety features, including the following: Fuel pump-related items • ingestion of components (the pump inlet check valve or the pump inducer) in the pump impeller, resulting in debris in the fuel tank; • stator winding failures during operation of the fuel pump, resulting in arcing through the fuel pump housing; • inappropriate wrapping of the fuel pump windings, resulting in deactivation of the pump’s thermal protective features; • absence of cooling port tubes between the pump assembly and the pump motor (has occurred as a result of improper fuel pump overhaul); • extended fuel pump operation in empty fuel tanks (dry-running fuel pumps); • use of steel impellers that could produce sparks if debris enters the fuel pump; • exposure of electrical connections within the fuel pump housing with inadequate clearance to the fuel pump cover, resulting in arcing; • internal wires contacting the pump rotating group, energizing the rotor and causing arcing at the impeller/adapter interfaces; • poor bonding of components to structure and/or across component interfaces; • insufficient ground fault current protection capability; Wiring inside fuel tanks • chafing/wearing of Teflon sleeve and wire insulation, allowing arcing through metallic conduits into fuel tanks; Fuel pump connectors • electrical arcing at connections within electrical connectors because of bent pins or corrosion; • corrosion of electrical connectors in the fuel pump motor, resulting in fuel leakage and subsequent fuel-fed fire outside the fuel tank and electrical arcing through the connector housing (outside the fuel tank); • improper materials in connector design; FQIS wiring • degradation of wire insulation (cracking), corrosion, and sulfide deposits at electrical connectors; • unshielded FQIS wires routed in wire bundles with high-voltage wires.

Factual Information 221 Aircraft Accident Report FQIS probes • corrosion and sulfide deposits, resulting in reduced breakdown voltage in FQIS wiring; • terminal block wiring clamp features at electrical connections on fuel probes, damaging wire insulation; • contamination in fuel tanks, causing reduced arc path between FQIS probe walls; Bonding straps • corrosion to bonding straps; • loose or improperly grounded attachment points; • static bonds on fuel tank system plumbing connections inside the fuel tank worn by wing movement and/or corrosion; Electrostatic charge • use of nonconductive reticulated polyurethane foam that holds electrostatic charge buildup; and • spraying of fuel into fuel tanks through inappropriately designed refueling nozzles or pump cooling flow return methods. NPRM 99-18 stated that the FAA’s “review of service history, design features, and maintenance instructions of the transport airplane fleet indicated that aging of fuel tank system components and unforeseen fuel tank system failures and malfunctions have become a safety issue for the fleet of turbine-powered transport category airplanes.” NPRM 99-18 proposed an SFAR that would require transport-category airplane type certificate (TC) holders for transport-category airplanes and holders of supplemental type certificates (STC) that affect the transport-category airplane’s fuel system419 to conduct a safety review of the fuel tank system designed to show that fuel tank fires or explosions will not occur. Specifically, the TC or STC holder would be required to determine whether the fuel system design meets the existing requirements of 14 CFR Section 25.901420 and the requirements of Section 25.981(a) and (b), which would include several provisions added by the NPRM. If the design does not meet these requirements, 419 The proposed rule would apply to airplanes that had TCs issued after January 1, 1958, and that have a certificated passenger capacity of at least 30 people or payloads of 7,500 pounds or more and proposed a 12-month compliance period for the review and an 18-month compliance period for the maintenance and inspection instructions development. The FAA has determined that 35 TCs and 168 STCs would need a fuel tank system design assessment. 420 Section 25.901 requires, in part, that major components of airplane powerplant installations (including fuel tanks) be electrically bonded to the other parts of the airplane and that for each powerplant installation, no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane.

Factual Information 222 Aircraft Accident Report the SFAR would require the TC or STC holder to develop the necessary corrective design changes. As previously discussed, Section 25.981 currently requires that “a safe margin” exist between the temperature at any place inside a fuel tank where fuel ignition is possible and the lowest expected auto ignition temperature of the fuel in the fuel tank. NPRM 99-18 proposed to revise Section 25.981 so that subsection (a) would prohibit an ignition source from being present at any point in the fuel tank system “where catastrophic failure could occur due to ignition of fuel or vapors.” The new rule would require that this be shown by demonstrating (1) compliance with the existing requirement regarding auto ignition temperature and (2) that an ignition source in the fuel tank system could not result from any single failure, from any single failure in combination with any latent failure condition not shown to be extremely remote, or from any combination of failures not shown to be extremely improbable.421 The revised Section 25.981 would also require, in subsection (b), that critical design configuration control limitations, inspections, or other procedures be established as necessary to prevent development of ignition sources. According to NPRM 99-18, the TC and STC design approval holder would be expected to do the following to comply with the SFAR: develop a failure modes and effects analysis (FMEA) for all components in the fuel tank system. Analysis of the FMEA would then be used to determine whether single failures, alone or in combination with foreseeable latent failures, could cause an ignition source to exist in a fuel tank. A subsequent quantitative fault tree analysis should then be developed to determine whether combinations of failures expected to occur in the life of the affected fleet could cause an ignition source to exist in a fuel system.[422] The SFAR would also require TC and STC holders to develop all maintenance and inspection instructions necessary to maintain the design features required to preclude the existence or development of an ignition source within the fuel tank system.423 According to NPRM 99-18, the FAA anticipates that the safety review would identify critical areas of the fuel tank and other related systems that would require maintenance actions to account for the effects of aging, wear, corrosion, and possible contamination of the fuel tank system. The NPRM noted, for example, that service history indicates that copper-sulfide 421 According to the NPRM, for the purposes of the new rule, extremely remote failure conditions are those not anticipated to occur to each airplane during its total life but that may occur a few times when considering the total operational life of all airplanes of the type. Extremely improbable failure conditions are those not anticipated to occur during the entire operational life of all airplanes of one type. 422 The Safety Board identified numerous potential ignition hazards (including, but not limited to, aging components, contamination and corrosion of components, and sulfide deposits on components) during the TWA flight 800 investigation. The NPRM stated that these failure conditions and any other foreseeable failures should be assumed when performing the FMEA analysis. However, the NPRM indicated that uncontained engine failures; terrorist actions, such as bombs; and the effects of postcrash or other fires from outside the tank would be outside the purview of the proposed FMEAs. 423 The SFAR also states that “no person may operate a turbine-powered transport category aircraft…unless instructions for maintenance and inspection of the fuel tank system are incorporated into its inspection program.”

Factual Information 223 Aircraft Accident Report deposits may form on fuel tank components and that this could degrade the intended design capabilities by providing a possible arcing mechanism. Therefore, the NPRM noted that it might be necessary to provide maintenance instructions to identify and eliminate such deposits. Minimizing Development of Flammable Vapors in Fuel Tanks NPRM 99-18 noted that, in addition to its review of potential fuel tank ignition sources, the FAA had “undertaken a parallel effort to address the threat of fuel tank explosions by eliminating or significantly reducing the presence of explosive fuel air mixtures within fuel tanks of new type designs, in-production [airplanes], and the existing fleet of transport airplanes.” According to the NPRM, the FAA agreed with the intent of the regulatory text recommended by the FTHWG. However, because no economic evaluation had been completed to determine if practical means were available to reduce the exposure below the 7 percent of fleetwide operational time proposed by the FTHWG, the NPRM stated that the FAA was proposing a more objective regulation intended to minimize exposure to operation with flammable conditions in fuel tanks. NPRM 99-18 proposed to add a new subsection (c) to 14 CFR Section 25.981, which would require that fuel tank installations in newly designed airplanes include a means to minimize the development of flammable vapors in fuel tanks, or to mitigate the effects of an ignition of fuel vapors within fuel tanks, such that no damage caused by an ignition will prevent continued safe flight and landing. According to the NPRM, the proposal was not intended to prevent the development of flammable vapors because total prevention has not been found to be feasible; instead, the proposal is intended as an interim measure to preclude, in new designs, the use of design methods that result in a relatively high likelihood that flammable vapors will develop in fuel tanks. (The NPRM noted that certain design methods, such as the location of air conditioning packs directly below a fuel tank without provisions to reduce transfer of heat from the packs to the tank, increase the likelihood that flammable vapors will develop in fuel tanks.) The NPRM further stated that the intent of the proposal is to require that fuel tanks are not heated and that they cool at a rate equivalent to that of a wing tank in the transport-category airplane being evaluated. Draft Advisory Circulars In connection with regulatory changes proposed in NPRM 99-18, on January 12, 2000, the FAA issued two draft ACs. FAA Draft AC 25.981-1X, “Fuel Tank Ignition Source Prevention Guidelines,” “provides guidance for demonstrating compliance with the [proposed] certification requirements for prevention of ignition sources within the fuel tanks of transport category airplanes.” The draft AC states that “[p]rior to conducting a fuel system safety assessment, each applicant should assemble and review relevant lessons learned from their previous products, their suppliers, and any other available sources, to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source.”424 The draft AC provides detailed guidance about potential fuel tank ignition sources, accepted design practices, ignition source failure analysis, electrical sources, friction sparks, surface ignition, and instructions for continued airworthiness.

Factual Information 224 Aircraft Accident Report Further, the draft AC states that the ignition source failure analyses required by the proposed SFAR are intended to address system failures that may result in the presence of an ignition source in the fuel tanks. These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors from such sources as uncontained engine debris, external fires following engine separation or failure, damage resulting from explosive materials, such as bombs, or post crash fire heating of tank surfaces or propagation of fire through the airplane vent system into the fuel tanks. These hazards are addressed by other regulations. FAA Draft AC 25.981-2X, “Fuel Tank Flammability Minimization,” “provides information and guidance concerning compliance with the [proposed] airworthiness standards for transport category airplanes pertaining to minimizing the formation or mitigation of hazards from flammable fuel air mixtures within fuel tanks.” The draft AC reiterates, as noted in NPRM 99-18, that the intent of the proposed regulation is to require that the exposure to formation or presence of flammable vapors is equivalent to that of an unheated wing tank in the transport-category airplane being evaluated. The draft AC contains detailed guidance about methods for minimizing fuel tank flammability and acceptable means to mitigate the effects of an explosion. Safety Board Comments on NPRM 99-18 In a March 23, 2000, letter, the Safety Board submitted its comments on NPRM 99-18. The Board stated that it generally supported the proposed regulatory changes but urged the FAA to give further consideration to some issues. Specifically, with regard to the proposed requirement for FMEAs, the letter stated that the “Safety Board generally supports the intent of the SFAR in requiring an FMEA analysis, but is concerned about the construction of the FMEAs, as well as the thoroughness and integrity of the data that will be used.” The Board cited the concerns expressed by Safety Board investigators and NASA specialists about the Boeing fault tree analysis report submitted to the Board in connection with the TWA flight 800 investigation.425 The Board further stated the following: the Safety Board’s concerns about the FMEAs are amplified by the fact that no single source exists for reliable and comprehensive data on component failures or malfunctions. Because the calculations in an FMEA are based on failure rates, incomplete or inappropriate failure data can skew the results of an examination. The Board is aware that service history data maintained by manufacturers do not capture data from all operators. Further, the Board has found that the amount of data provided by the manufacturers of replacement component parts sometimes greatly exceeds the data provided by the aircraft manufacturers (possibly because replacement parts suppliers can sell parts directly to operators and repair facilities). Although the FAA collects a significant amount of data about mechanical failures through its Service Difficulty Report (SDR) program, even 424 The draft AC also states that “service history has shown that ignition sources have developed in airplane fuel tanks due to unforeseen failure modes or factors that were not considered at the time of original certification of the airplane, including sparks, or hot surfaces within the fuel tanks.” 425 For more information about this fault tree analysis report, see section 1.16.6.5.

Factual Information 225 Aircraft Accident Report these data are incomplete.[426] Other sources of potentially relevant data are the service histories maintained by the military of its variants of commercial airliners and the Board’s accident and incident investigation database; however, neither of these sources provides complete data either. Further, the many affected TC and STC holders (some of which are not the original designers or manufacturers) may have varying levels of experience with developing FMEAs. In addition, the Safety Board is concerned that engineers working for TC and STC holders may not recognize the existence or significance of certain hazards and that potentially competing interests may affect the quality and thoroughness of some FMEAs. In cases in which the TC or STC holder no longer exists, FAA personnel with varying levels of skill and experience may have to conduct the FMEAs. Finally, the Board is concerned that the FAA may have an insufficient number of staff who are trained to properly evaluate an FMEA. Therefore, to ensure the integrity and effectiveness of the fuel tank system safety review, the Safety Board urges the FAA to develop and provide adequate standards and criteria to guide the development of the FMEAs and fault tree analyses. In particular, because there is no single comprehensive collection system that contains data on the failure of airplane components and because of the inadequacies that exist in each source of data, those guidelines should specify that the data used for the FMEAs must be collected from all available sources, including operators, manufacturers, and appropriate government agencies. The FAA needs to provide adequate oversight and auditing of the FMEA analysis results to ensure their technical accuracy and integrity. In particular, such oversight and auditing should include a review of the data sources used to ensure that all available and appropriate sources of failure data have been taken into account. FAA oversight and auditing can also provide a method to identify potential deficiencies in the FMEAs that might be overlooked or not recognized by engineers and designated engineering representatives who work with these systems on a daily basis. Regarding the proposed requirement for maintenance and inspection instructions, the Safety Board indicated that it strongly endorses continuing airworthiness through improvements to maintenance, inspection, and minimum equipment lists. However, given the very general nature of some current inspection criteria pertaining to fuel tank safety (as documented by the FAA in its Transport Non-Structural Systems Plan), the Board is concerned that the instructions resulting from the SFAR requirement may be similarly broad and, therefore, potentially ineffective. Many potential ignition sources (such as hidden cracks in wiring, sulfide deposits, and use of inappropriate materials) may not be apparent during a general visual inspection. Therefore, the Board urges the FAA to ensure that the maintenance and inspection instructions developed as a result of this SFAR are detailed and specific enough to provide mechanics with useful inspection criteria and to ensure that they are properly trained about how to effectively carry out those instructions, including a requirement for a detailed inspection of each component in any area that may be exposed to fuel or fuel vapors. 426 For additional information regarding the Safety Board’s concerns about and recommendations made pertaining to the SDR program, see section 1.18.2.1.

Factual Information 226 Aircraft Accident Report Regarding the regulatory proposal to minimize development of flammable fuel vapors in new designs, the Safety Board indicated that it was “concerned that the NPRM does not propose any regulatory changes that address fuel tank flammability in current designs and in the existing fleet” and that “[t]his is especially disturbing because some operational measures (such as limiting the on-ground operating time of air conditioning packs and substituting a ground-based cool air supply and cooling or ventilating the pack bay) that can reduce current levels of flammable vapors could be accomplished immediately.” The Board stated that it was “aware that the FAA is conducting research into on-ground fuel tank inerting systems for the existing fleet,[427 and that because] the Board believes that fuel tank inerting is a promising, near-term method that could dramatically reduce fuel tank flammability in the existing fleet, it strongly supports the FAA’s continued work in this regard and looks forward to regulatory implementation.” Finally, the Safety Board stated the following: [a]lthough FAA staff have indicated to Safety Board staff that the FAA does not intend to endorse the FTHWG’s proposed exposure criteria [of 7 percent of the fleet operational time], the Board nonetheless wishes to register its concerns about those criteria. Because it is a fleetwide average, it does not account for increased risks that may exist at specific locations, during certain time periods, or for certain flights.[428] In addition, the premise that transport airplane fuel tanks located in the wings have an acceptable safety record is unacceptable because wing fuel tanks have exploded.[429] The Safety Board believes that the goal should be to completely eliminate the development of flammable vapors in fuel tanks to the greatest extent technically feasible (such as would result from the use of on- ground inerting systems). 1.18.3.4.4 FAA’s Aging Transport Non-Structural Systems Plan On July 25, 1996, White House Commission on Aviation Safety and Security (WHCASS) was chartered. The WHCASS subsequently recommended that the FAA expand its aging aircraft program to cover nonstructural systems by (1) conducting full and complete teardowns of selected aircraft scheduled to go out of service, (2) establishing a “lead-the-fleet” research program, (3) expanding the FAA-DoD-NASA cooperative aging aircraft program, (4) expanding programs of the Airworthiness Assurance Working Group to include nonstructural components, and (5) encouraging the development of modern technical means to ensure and predict the continued airworthiness of aging nonstructual systems. 427 The Safety Board noted that the FAA is also engaged in research regarding on-board inerting systems for future designs. 428 The Safety Board noted that of the 16 fuel tank explosions documented by the ARAC, 11 occurred in the months of May, June, and July, and only 2 occurred outside of warm climates or summer months. Further, short flights in warm climates can have a dramatically higher exposure time than the fleetwide average. For these flights, attempting to reduce the flammability of CWTs to the level of wing tanks would be of little benefit. 429 For example, as previously indicated, the Board noted that wing tank explosions caused the May 9, 1976, accident involving a 747 operated by the Iranian Air Force near Madrid, Spain, and the January 15, 1972, accident involving a U.S. Navy C-130 near Cambridge, Maryland.

Factual Information 227 Aircraft Accident Report The FAA participated in the Safety Board’s inspections 26 airplanes in January 1998, then inspected additional airplanes by the end of March 1998. The FAA’s examinations revealed deterioration of wiring components (wires, bundles, connectors, grounds, clamps, shielding), contamination of wire bundles with excessive dust and fluids, cracking of outer layers of multilayer insulation, ground terminals with resistance measurements outside specifications, corrosion on connector pins, and improper wire installations/repairs. The FAA also found that aging wire becomes stiff and easily cracked; wire bundles are often difficult to inspect; and contamination of wire bundles with metal shavings during maintenance is a common occurrence. In response to these findings and the WHCASS’s recommendation, in July 1998, the FAA issued the Aging Transport Non-Structural Systems Plan. The FAA’s plan concluded that current maintenance practices do not adequately address wiring components; inspection criteria are too general (for example, “perform a general visual inspection”); unacceptable conditions are not described in sufficient detail; repair instructions/data are hard to locate and extract from Boeing’s SWPM, as currently presented; wire replacement criteria may not be adequate; and current incident/maintenance reporting procedures do not allow for easy identification of failures. The FAA then identified the following tasks: • establish an Aging Transport Systems Oversight Committee to coordinate the various aging systems initiatives within the FAA; • conduct an in-depth review of the aging transport fleet (including service history) and make model-specific safety recommendations related to airplane systems; • enhance airplane maintenance to better address aging airplane systems; • improve inspection criteria for wiring (need more complete descriptions of undesirable conditions); • define acceptance criteria for corrosion on flight control actuators, associated linkages, and hydraulic fittings; • revise [Maintenance Symposium Group] MSG-3 process to address catastrophic events associated with wire failures as MSG-3 review items and identify maintenance tasks/intervals to address; • establish a means to minimize contamination of wiring from metal shavings (vacuuming is not sufficient, can cause shorting of wires and failure of electrical systems, may become a serious problem for new airplanes where 0.008-inch insulation thickness wire is used versus 0.020-inch insulation in current aging airplanes); • review inspection/repair training to ensure it adequately addresses recognition and repair of aging wiring components; • develop guidance material to address electromagnetic compatibility, lightning, and HIRF protection in maintenance programs; • review and update Chapter 20 of manufacturer’s standard practices of wiring;

Factual Information 228 Aircraft Accident Report • add aging systems tasks to the aging airplane research program, determine if a service life for airplane wire is appropriate, establish condition of aging wiring components and validate the adequacy of visual inspections, develop nondestructive testing tools for inspection of wiring systems,430 establish aging effects on lightning and HIRF protection systems, develop arc fault circuit breaker, and perform destructive testing of flight control linkages; • improve reporting of accident/incident and maintenance actions involving wiring system components (wires, connectors, wire shields, grounds, circuit breakers), urge ATA to establish appropriate codes, improve formats, add data to National Aviation Safety Data Analysis Center databases, and recommend that aging components removed during maintenance be examined for safety implication of failure; • evaluate the need for additional maintenance of transport-category airplane fuel system wiring and address any unsafe conditions, review fleetwide service problems to identify any unsafe fuel system wiring conditions, and develop an SFAR to address fuel system wiring design and maintenance practices; and • improve wiring installation drawings and instructions for continuing airworthiness, task SAE to write an aviation recommended practice to define best practices for modification of existing wiring on transport-category airplanes, develop training aids in wiring installation practices for certification engineers and designees, develop job aid for certification engineers and designees to use in evaluation of adequacy of wire systems installation drawings and instructions for continuing airworthiness. In November 1998, the FAA established the ATSRAC, and on January 19, 1999, defined its charter in FAA Order 1110.127. According to the charter, the ATSRAC’s task is to propose FARs revisions and associated guidance material as appropriate to ensure that nonstructural systems in transport-category airplanes are designed, maintained, and modified in a way that ensures their continued operational safety throughout the service life of the airplanes. Its duties are to recommend standardization clarification and to upgrade regulations, standards, and procedures related to aging systems as necessary to institutionalize lessons learned from aging systems review and recommend mandatory retroactive rules (ADs) to ensure safety of the transport-category airplane fleet. On January 11, 1999, the FAA issued “Terms of Reference,” which identified the following five major tasks for the ATSRAC: (1) conduct an in-depth survey of the condition of aging transport-category airplane fleetwide systems and propose model-specific safety recommendations related to airplane systems that will eliminate or significantly reduce the hazards associated with the types of age-related degradation 430 In this regard, the FAA plan noted that “[w]ire is difficult to inspect in several areas of the airplane due to inaccessibility. Wire inside conduits is not inspectable by visual means. These difficulties, associated with the inspection of aging wiring bundles and connectors, can be overcome by the development and use of non-destructive testing tools to assess the state of the wiring in an airplane. The FAA will explore what tools already exist for these purposes. Where tools do not exist, promising technologies will be explored for adoption to the problems associated with inspection of aging wiring systems.”

Factual Information 229 Aircraft Accident Report displayed by the fleet; (2) review the service history, manufacturer’s SBs and SLs, and applicable ADs for the aging transport-category airplane fleet and identify information that pertains to aging systems for possible mandatory action; (3) improve general maintenance criteria for airplane systems to ensure that aging systems-related problems are identified and corrected; (4) review, update, and simplify manufacturer’s standard practices for wiring; and (5) review air carrier and repair station training programs for nonstructural systems inspection and repair to ensure that they adequately address aging wiring system components and other nonstructural systems. In connection with improvement of maintenance criteria, the FAA noted that “maintenance procedures currently in use in the air transport industry may not adequately or proactively address aging non-structural systems.” The FAA specified several subtasks associated with this task, including defining improved inspection criteria for wiring, connectors, and associated components; defining practices to eliminate wire bundle contamination (with metal shavings, fluids, or other damaging materials) during maintenance; defining acceptance criteria for corrosion of systems components; and proposing a process to ensure that components removed during maintenance are examined for safety implications of the observed failures and the results are tracked to the original service problem. 1.18.4 Witness Information 1.18.4.1 General Witness Information In the days immediately following the accident, the Safety Board announced its intention to form a Witness Group to interview witnesses to the accident. However, the Board deferred to the concerns expressed by Federal criminal investigators regarding the need for confidential treatment of eyewitness information while the criminal investigation was ongoing. Hence, the Board did not initially share witness information with private sector parties and did not use its party system to conduct witness interviews in its traditional fashion. Instead, a Safety Board investigator reviewed FBI interview notes and briefed other Board investigators on their contents. In November 1996, the FBI agreed to provide the Safety Board with access to witness documents in which personally identifying information had been blacked-out (redacted). A Witness Group was formed to review these documents and conduct a limited number of witness interviews in cooperation with the FBI.431 Upon completion of these interviews and the group’s review of the redacted witness documents, this Witness Group was disbanded. The FBI concluded its active criminal investigation of the crash in November 1997,432 and in April 1998, it provided redacted witness documents433 to Safety Board investigators. The Board formed a second Witness Group to study the documents 431 The Safety Board intended to present information about the witnesses at its December 1997 public hearing; however, the FBI objected, and the Board did not address this topic at its hearing.

Factual Information 230 Aircraft Accident Report and prepare them for inclusion in the public docket. (Unless otherwise specified, all subsequent references to the “Witness Group” are to the second Witness Group.) The witness documents were summaries of information434 collected by FBI agents during interviews with potential witnesses. The Witness Group determined that the documents contained 736 witness accounts.435 Because group members believed that it was not necessary and because of the amount of time that had elapsed (about 21 months) when the Safety Board received information about the identity of the witnesses,436 the Witness Group chose not to reinterview most of the witnesses;437 instead, the group chose to rely on the original FBI documents as the best available evidence of the observations initially reported by the witnesses. According to these documents, 670 witnesses reported seeing something that the Witness Group determined was probably related to the accident, and nearly 250 reported hearing something that was determined to be likely related to the accident.438 Figure 40 is a map that shows the witness locations and the location of the accident site. The Witness Group determined that of the 736 witnesses, 239 were sound witnesses,439 179 were sight and sound witnesses, 258 were streak-of-light440 witnesses, 432 Although the FBI ceased its active investigative efforts in November 1997, it indicated that it remained prepared to resume the investigation at any time, should information indicate that such resumption was warranted. 433 The FBI provided the Safety Board with witness documents that the Board could release in the public docket; to this end, FBI personnel removed personal information that would have identified the witnesses from the documents. For additional information, see the Witness Group Chairman’s Factual Report, dated February 9, 2000. 434 The FBI stated that no verbatim records of the witness interviews were produced. The summaries provided to the Safety Board were generally written in the words of the agents who conducted the interviews and not necessarily in the words of the witnesses themselves. Witnesses were not asked to review or correct the documents. 435 A witness was defined by the Witness Group as “anyone who reported hearing a sound and/or seeing an event or object or objects (including smoke or fire) in the sky in the general vicinity of the accident site, on July 17, 1996, at the approximate time of the accident.” 436 Research indicates that the most accurate witness information is obtained immediately after an event is observed. See section 1.18.4.3 for additional information regarding the effects of time on witness recollections. 437 One exception was the captain of Eastwind flight 507, who, because of his vantage point relative to TWA flight 800 and his experience as an airline pilot, was reinterviewed by the Witness Group on March 25, 1999. 438 For additional information, see the Witness Group study report, dated February 9, 2000. 439 The documents for these witnesses reported that they heard sounds such as a boom, a roar, or a thunderlike rumble. Two hundred seventy-five of the witness documents pertaining to the 670 sight witnesses did not mention hearing any sounds, and 216 of the remaining sight witnesses did not hear anything that the Witness Group judged to be related to the accident. 440 The Witness Group defined a streak of light as “an object moving in the sky that could be variously described in witness documents as a point of light, fireworks, a flare, a shooting star, or something similar.” The definition noted that a streak of light was usually described as ascending, but could also be described as arcing over and/or descending. The Witness Group agreed that the streak of light definition must not meet the definition of a fireball and that it must precede any report of a fireball by that witness.

Factual Information 231 Aircraft Accident Report Figure 40. Map showing the witness locations and the location of the accident site.

Factual Information 232 Aircraft Accident Report and 599 were fireball witnesses. Of the 258 streak-of-light witnesses, 38 reported that the streak was ascending vertically or nearly so,441 18 indicated that it originated from the surface of the earth, and 7 reported that it originated at the horizon.442 Of the 599 fireball witnesses, 264 reported seeing the fireball originate, 200 reported seeing the fireball split into two fireballs, and 217 reported observing the fireball hit the surface of the water (or disappear below the horizon). In addition, 210 witnesses reported seeing both a fireball and a streak of light. Sufficient information was present in the materials provided by the FBI for the Witness Group to plot the reported position (approximate latitude and longitude) of 591 witnesses and the situation (land, sea, or air) of 699 witnesses.443 Of the 591 witnesses whose reported positions were plotted, seven were positioned within 5-nm ground distance of the last secondary radar return from TWA flight 800. About 200 witnesses were positioned between 5- and 10-nm ground distance of the last secondary radar return. More than 200 witnesses were positioned between 10- and 15-nm ground distance of the last secondary radar return. About 80 witnesses were positioned between 15- and 20-nm ground distance of the last secondary radar return. Nearly 100 witnesses were positioned more than 20-nm ground distance from the last secondary radar return. Of the 699 witnesses whose witness documents contained sufficient information to determine their reported situation at the time of the accident,444 460 were on land, 202 were on or in the water, and 37 were in aircraft. Most of the witnesses on land were outside, and most of the witnesses on the water were in boats. Of the 460 witnesses on land, 172 reported seeing a streak of light,445 and 365 reported seeing a fireball (122 of these witnesses reported seeing the fireball split into two fireballs during its descent). 441 The Witness Group determined that of the 220 streak-of-light witnesses who did not characterize the motion of the streak as vertical or nearly so, 126 provided some information about the lateral motion of the streak. Of these, 45 witnesses reported that the streak moved to the east, 23 reported that it moved to the west, 18 reported that it moved to the south, and 4 reported that it moved to the north. Thirty-six of the streak-of-light accounts contained no information about the direction of travel. 442 Some of the 38 witnesses who reported the streak ascending vertically or nearly so may also have reported that it originated from the surface of the earth or from the horizon. Thirteen of these 38 witnesses were in vehicles (including boats), and one was paddling a surfboard at the time of the reported observation. A total of 56 witnesses reported seeing a streak of light ascending vertically or nearly so and/or a streak of light that originated from the surface of the earth or the horizon. 443 Six calculations were made for each of the witnesses for whom a position could be determined: ground distance, slant range, elevation angle, initial azimuth, final azimuth, and sound time. Ground distance was defined as “the linear distance in feet along the surface from the witness’s location to the surface of the water directly under the last secondary radar return for flight 800.” Slant range was defined as “the elevated distance in feet from the witness’s position and the position of flight 800 at altitude at the time of the last secondary radar return, calculated using ground distance and the airplane’s altitude.” Elevation angle was defined as “the angle in degrees formed from the witness’s line of sight to flight 800.” The initial azimuth was defined as “the bearing (in degrees true) from the witness to the accident airplane at the time of the last secondary radar return.” The final azimuth was defined as “the bearing in degrees true from the witness to a point in the northeast corner of the debris field.” The sound time was defined as “the approximate time required for sound to travel to the witness from flight 800’s position at the time of the last secondary radar return.” 444 The witness document(s) for 2 of the 258 streak-of-light witnesses, 15 of the 599 fireball witnesses, and 1 of the 200 witnesses that reported seeing the fireball split in two did not contain sufficient information to determine that witness’s situation at the time of the accident.

Factual Information 233 Aircraft Accident Report About one-third of the witnesses on land reported hearing something related to the accident. Of the 202 witnesses who were on or in the water, 78 reported seeing a streak of light, and 182 reported seeing a fireball (61 of whom reported seeing the fireball split). About 25 percent of those witnesses on or near the water reported hearing something related to the accident. All of the 37 airborne witnesses reported seeing a fireball (16 of whom reported seeing the fireball split in two), and 6 of the 37 reported seeing a streak of light. A witness document pertaining to a professional fisherman who, according to the document, had been fishing in the area of the accident for about 5 or 6 months preceding the accident, indicated that there had been “a lot of flare activity” in the area during that time. A document pertaining to another witness, who was on board a USCG cutter that responded to the accident, indicated that by the time the cutter arrived at the accident site about 30 minutes after the accident, “fishing boats in the area had already begun to set off flares.” 446 The Witness Group reached 17 conclusions, including the following: • The streak of light reported by many (of the 258 streak-of-light witnesses) may have been the accident airplane during some stage of its flight447 before the fireball developed. Most of the streak-of-light accounts are generally consistent with the calculated flightpath of the accident airplane; however, 38 witnesses described a streak of light rising straight up or nearly so. These 38 witness accounts seem to be inconsistent with the calculated flightpath of the accident airplane. • The descending fireball (observed by 599 witnesses) was the accident airplane. In all likelihood, the witnesses who watched this fireball split were observing the final stages of the structural breakup of the aircraft. 1.18.4.2 Witness Document Issues According to the Witness Group study report, the Witness Group identified several aspects of the witness documents that made it difficult to extract accurate and reliable information from them, including possible interviewer and/or interviewee bias (for example, the assumption that a missile was used against the airplane), potentially flawed 445 The 38 witnesses who characterized the motion of the streak of light as vertical or nearly so were found to be widely dispersed throughout Long Island. The closest of these witnesses was situated about 7.8-mn slant range from TWA flight 800, and the farthest was about 47-nm slant range from TWA flight 800. 446 For more information about this witness document, see section 1.18.4.4. 447 Central Intelligence Agency (CIA) analysts, who initially evaluated certain witness information provided by the FBI, also concluded that the majority of the witness observations must have occurred well after the initial explosion and, consequently, none of those observations could have been of a missile that caused the explosion. The CIA analysts concluded that the remaining eyewitness accounts described events fully consistent with observations expected if only the aircraft in various stages of crippled flight were being observed. The CIA analysts concluded that there was absolutely no evidence that a missile was employed to shoot down TWA flight 800.

Factual Information 234 Aircraft Accident Report distance and direction information, multiple witness reports summarized in a single account, recording of witness speculations and conclusions, imprecise or vague language, conflicting information, and errors concerning the origin of the streak of light. According to an FBI Special Agent involved with the FBI’s earlier criminal investigation who met with the Witness Group on September 30, 1998,448 the FBI initially suspected that a missile might have been used against TWA flight 800; therefore, FBI agents tended to use the witness documents to capture information that appeared relevant to its criminal investigation involving a missile rather than to record a complete accounting of the events described by the witness. In addition, missile experts were present at some interviews. According to the Special Agent, FBI agents were provided with suggested interview questions pertaining to missiles. These questions, which were included in the documents provided by the FBI pertaining to Witness 32 (and which the Special Agent indicated were asked in several cases), included the following: • “How long did the missile fly?” • “What does the terrain around the launch sight look like? Were scorch marks visible?” • “Where was the sun in relation to the aircraft and the missile launch point?” The Witness Group study report cited the presence of missile experts and questions such as these as potential sources of interviewer or interviewee bias that could influence the outcome of the interview. Other examples of possible interviewer/interviewee bias cited in the Witness Group study report included the following: • According to a witness document, a witness located about 10.4-nm slant range from TWA flight 800449 described an ascending red ball. The document further states, “Upon impact, [witness' name redacted] observed a large fireball.” Neither the witness document nor the attached interview notes450 stated that the witness saw anything other than the red ball in the sky; thus, it is unclear what the “impact” mentioned in the document is. Although this incongruity could be because of other reasons, the witness appears to have described an ascending red ball and a large fireball, which the interviewer related using the word “impact.” It is also possible that the witness used the word “impact,” but the original interview notes used to generate the witness document do not contain the word “impact.” 448 On September 30, 1998, an FBI agent who had been substantially involved in the FBI’s missile investigation met with the Witness Group to discuss the witness-related processes used by the FBI during this investigation. 449 For more information about individual witnesses, see the Witness Group study report, which contains witness numbers that can be correlated to witness documents. 450 Interview notes were not available for most witness documents.

Factual Information 235 Aircraft Accident Report • Two other witnesses (both of whom were 8.2-nm slant range from TWA flight 800), described seeing a flarelike object but, according to the document, “they did not see what [the] flare struck, but it exploded in air into a large orange fireball.” This characterization may suggest that the interviewer and/or the interviewees believed that the flarelike object was a missile, which must have struck something. According to the Witness Group study report, some witness documents noted that witnesses acknowledged that they did not realize that they had observed an airplane accident until they saw media accounts of the accident, and some documents specifically stated that witnesses made conclusions about what they observed after learning about the accident in the media. For example, one document stated that a witness (located about 13.2-nm slant range from TWA flight 800) did not think anything about his observation until he learned about the TWA flight 800 accident while watching the evening news. Another document indicated that a witness located 31-nm slant range from TWA flight 800 concluded that he had observed a missile after hearing news accounts about the crash. The Witness Group study report noted that media coverage about the crash and the associated criminal investigation might have led to bias on the part of some interviewees.451 Examination of the witness documents also indicated that distance estimates and direction of travel information varied considerably. For example, two witnesses who were in the same location observing the accident described seeing an ascending flarelike object. One witness estimated that the flarelike object was about 30 miles away, whereas the other witness estimated that it was 5 or 6 miles away. (Subsequent calculations indicated that the accident site was located about 26 statute miles ground distance away from their location.) Additionally, in general, there were notable variations in the witness accounts regarding the direction of motion of the streak of light—as mentioned in section 1.18.4.1, 38 documents reported that the streak of light moved vertically, 45 reported that it moved to the east, 23 reported that it moved to the west, 18 reported that it moved to the south, and 4 reported that it moved to the north. (Thirty-six witness documents that reported a streak of light did not contain information about the direction of travel.) Combined accounts (multiple witness reports summarized in a single document or series of documents) presented another challenge. Although the Witness Group assigned witness numbers to each witness identified in the documents, it was not always possible to attribute specific observations to specific individual witnesses. The accounts of witnesses who were interviewed in small groups, and especially married couples, were often reported as if each person saw, remembered, and reported exactly the same events. The Witness Group also determined that some documents included speculation and conclusions about what witnesses observed without stating what the witness reported observing. For example, one witness document stated, “He saw what he thought at the 451 It is also noteworthy that the documents recording the initial interviews of some witnesses, who have since indicated that they believe a missile was used against the airplane, did not indicate that the witnesses initially reported seeing a missile.

Factual Information 236 Aircraft Accident Report time to be a large bright flare in the sky.” In this case, a description of exactly what the witness observed was not provided, nor were other details, such as whether the flare was moving, ascending, or descending, and if so, at what speed. The document only states what the witness, located about 14.8-nm slant range from TWA flight 800, thought he was observing. The Witness Group study report also noted that some witness documents contained imprecise language. For example, one witness document stated that the witness reported seeing fire falling from the sky and “when it hit the water, approximately 8 to 10 seconds later, there was a big explosion,” without clarifying whether the 8 to 10 seconds referred to the amount of time between when the witness first saw the fire and when it hit the water or between when the fire hit the water and the explosion. Another witness document stated that the witness “only saw the object ascending for a split second when he observed an orange or light colored object ascending from the southwest direction. He stated it ascended for approximately five seconds,” without resolving whether the witness observed one or two objects and whether it (or they) ascended for a split second or 5 seconds. In addition, documentation pertaining to some witnesses was internally inconsistent. For example, one witness document indicated that the witness “observed what appeared to be a USCG flare” and also that “he observed what he thought was a shooting star.” Further, the document refers to the object as “the missile.” The Witness Group study report determined that the witness documents indicated that at least three witnesses characterized the origin of the streak of light differently over two interviews. One witness document, based on a July 22, 1996, interview, stated that a witness who was located about 22.3-nm slant range from TWA flight 800 observed a flare rise straight up from the ocean. FBI agents reinterviewed this witness on June 26, 1997, and the witness document based on that interview stated that the witness first observed the flare about 15° to 20° above the horizon. Another witness (located about 14.7-nm slant range from TWA flight 800) also characterized the origin of the streak of light differently in two interviews. The witness document based on a July 23, 1996, FBI interview reported that the witness saw a flare come from the water, whereas the witness document based on an FBI interview conducted on July 15, 1997, reported that the witness saw a flare begin ascending from 3 inches above the horizon. A third witness, interviewed by the FBI on July 23, 1996, reported seeing “what appeared to be cheap fireworks coming off the beach.” The witness document based on a second FBI interview with this witness, conducted on July 29, 1996, reported that the witness observed “a white light that was traveling skyward from the ground.”452 During subsequent interviews, this witness stated that when he first observed the white light it was in the sky just above a house. 452 During an April 30, 1999, briefing for the Witness Group, CIA analysts said that during a careful reinterview by FBI agents, it became clear that the firework-like streak was in midflight when it was first observed by this witness. The Safety Board received no documentation concerning this interview from the FBI.

Factual Information 237 Aircraft Accident Report 1.18.4.3 Research Regarding Accuracy of Witness Memory Research into human memory and its accuracy has demonstrated that human memory is subject to error and that these errors occur for a variety of reasons.453 Further, people tend to be unaware of their memory errors and may be overconfident in the accuracy of their memories,454 and this confidence may increase over time.455 The Safety Board’s own investigative experience has confirmed that witness reports are often inconsistent with the known facts or with other witnesses’ reports of the same events.456 1.18.4.3.1 Perception and Storing Information in Memory People use their eyes, ears, and other sensory organs to take in information from the environment; however, the raw data from the sensory organs are “processed,” or acted on, by the brain before people become aware of what their organs have sensed.457 The brain receives and rapidly processes the sensory information such as light or sound that is detected by the sensory organs.458 This processing occurs involuntarily459 and results in the mental representation of sensation, which is called perception.460 In other words, the brain forms perceptions from raw sensory data (for example, the brain perceives music or words from sound energy). This processing is necessary because it filters and organizes the many sights and sounds that people are exposed to into useful auditory and visual images. However, because perception is not perfectly faithful to reality, people are subject to illusions.461 453 Roediger, R. 1996. “Memory Illusions.” Journal of Memory and Language. Vol. 35. p. 76-100. 454 Lindsay, R. C.; Wells, G. L.; and Rumpel, C. M. 1981. “Can People Detect Eyewitness Identification Accuracy Within and Across Situations?” Journal of Applied Psychology. Vol. 67. p. 79-89. 455 Woocher, F. D. 1977. “Did Your Eyes Deceive You? Expert Psychological Testimony on the Unreliability of Eyewitness Identification.” Stanford Law Review. Vol. 29. p. 969-1,030. 456 For example, following the June 6, 1971, midair collision of a DC-9 with a Marine Corps F-4B, some witnesses reported having seen the F-4B doing rolls and circling the area, although a surviving occupant of the F-4B indicated that the only roll was performed at 15,500 feet, too far away to have been observed by ground witnesses. (See NTSB/AAR-72/26.) Also, following the September 6, 1985, crash of Midwest Express Airlines flight 105, a pilot witness reported seeing the airplane pitch up 20º, then down 12º, and back up 20º, although the FDR data indicated no such pitch changes. (See NTSB/AAR-87/01.) In addition, after the August 31, 1988, crash of Delta Airlines flight 1141 at Dallas Fort Worth International Airport, a passenger on board the airplane stated that he saw the flaps extended, although the physical evidence from the wreckage and airplane performance studies demonstrated, and the Board concluded, that the wing flaps and slats had not been extended. (See NTSB/AAR-89/04.) Similarly, following the August 16, 1987, crash of Northwest Airlines flight 255 at Detroit, Michigan, two pilot-rated witnesses reported seeing the flaps extended, although the FDR indicated, and the Board concluded, that the flaps and slats were not extended. (See NTSB/AAR-88/05.) 457 Coren, S. and Ward, L. M. 1994. Sensation and Perception. Harcourt Brace College Publishers. Fort Worth, Texas. 458 Goldstein, E. B. 1989. Sensation and Perception. Wadsworth Publishing. Belmont, California. 459 Treisman, A. 1986. “Features and Objects in Visual Processing.” Scientific American. Vol. 255. p. 114-125. 460 Goldstein. 461 Coren and Ward.

Factual Information 238 Aircraft Accident Report Perception of distance and motion The visual image sensed by the eye is two dimensional, but the brain uses a variety of cues to perceive depth and distance.462 These cues include information from binocular disparity (the phenomenon that different views of the world are seen by each of a person’s two eyes) and the perception of perspective and texture gradients, which are present in any feature-rich visual scene (such as looking down a busy city block).463 In the absence of such depth-perception cues (for example, when looking across a desert or out over a large body of water), people cannot judge distance accurately, and an object viewed under such circumstances usually appears to be closer to the observer than it actually is.464 Further, in the absence of depth perception cues, if structures, trees, or other objects are present near an observers’ line of sight to a critical object, people tend to perceive the critical object and the intervening objects as equally distant from the observer.465 For example, a distant tall building viewed along with several closer small buildings will appear to be located about the same distance from the observer as the short buildings. This illusion has been termed the equidistance tendency.466 Research also indicated that, if the critical object is in motion, the equidistance tendency can also have the effect of exaggerating the perceived motion of the object. Further, any motion of the observer’s head may result in concurrent motion of the critical object. Under viewing conditions that cause the critical object to appear closer to the observer than it actually is, the critical object will appear to move in the same direction as the observer’s head moves.467 The closer the object appears to the observer, the greater the amount of apparent motion.468 In other words, the perceptual error magnifies any concurrent motion of the object caused by motion of the observer’s head. Further, if the critical object is actually in motion, the apparent motion that results from movement of the observer’s head may enhance, cancel out, or even reverse the motion of the critical object.469 Storing information in memory Researchers of human memory have recognized that in addition to memory for specific events (episodic memory), human memory also contains memories that are not 462 Bruce, V. and Green, P. R. 1992. Visual Perception: Physiology, Psychology and Ecology. Lawrence Erlbaum. London, England. 463 Goldstein. 464 Gogel, W. C. 1963. “The Visual Perception of Size and Distance.” Vision Research. Vol. 3. p. 101-120. 465 Gogel, W. C. 1965. “Equidistance Tendency and Its Consequences.” Psychological Bulletin. Vol. 64. p. 153-163. 466 Gogel. 467 Gogel, W. C. and Tietz, J. D. 1973. “Absolute Motion Parallax and the Specific Distance Tendency.” Perception and Psychophysics. Vol. 13. p. 284-302. 468 Gogel, W. C. and Tietz, J. D. 1977. “Eye Fixation and Attention as Modifiers of Perceived Distance.” Perception and Motor Skills. Vol. 45. p. 343-362. 469 Gogel, W. C. 1990. “A Theory of Phenomenal Geometry and Its Applications.” Perception and Psychophysics. Vol. 48. p. 105-123.

Factual Information 239 Aircraft Accident Report associated with specific events and places (semantic memory).470 These semantic memories include generic information about the concepts that underlie everyday activities. Humans use elements of semantic memory in an attempt to understand sensory input. 471 This may occur without the observer’s awareness.472 For example, someone reading a newspaper does not carefully decipher the features of each letter to discover the words that they form. Rather, the reader’s knowledge of the subject matter and experience with the language helps him or her anticipate the words and their meanings; this speeds reading and allows it to become an almost automatic task. Perception of events is driven by context cues and the observer’s experience and expectations,473 including semantic memory. This results in a fairly immediate interpretation of the event. Thus, what is stored in memory about an event includes fragments of the event itself and elements of interpretation.474 1.18.4.3.2 Retrieving Information from Memory According to I. E. Hyman, a psychologist, “People do not simply retrieve a memory and replay the experience—memory is not like a videotape. Instead people combine…knowledge from various sources with their own personal experiences…to create memories.”475 Hyman has indicated that all memories are constructions. Research has also shown that memories may correctly convey the gist of an event or a conversation; however, some of the reported details are likely to be inaccurate and may reflect the witness’s own beliefs or expectations about the event witnessed.476 Further, vivid and confidently held memories of important events can change over time.477 Hyman has identified several types of memory errors, such as conjunction errors, memory intrusions, time slice errors, and postevent information errors.478 Conjunction 470 Tulving, E. 1972. “Episodic and Semantic Memory.” Organization of Memory. Academic Press. New York, New York. 471 Spiro, R. J. 1975. Inferential Reconstruction for Memory for Connected Discourse. Tech. Report No. 2. Laboratory for Cognitive Studies in Education, University of Illinois. Urbana, Illinois. 472 Schneider, W. and Shiffrin, R. M. 1977. “Controlled and Automatic Human Information Processing I: Detection, Search and Attention.” Psychological Review. Vol. 84. p. 1-66. 473 Lindsay, P. H. and Norman, D. A. 1972. Human Information Processing. Academic Press. New York, New York. 474 Rumelhart, D. E., and Ortony, A. 1977. “The Representation of Knowledge in Memory.” Schooling and the Acquisition of Knowledge. Lawrence Erlbaum Associates. Hillsdale, New Jersey. 475 Hyman, I. E. 1999. “Creating False Autobiographical Memories: Why People Believe Their Memory Errors.” Ecological Approaches to Cognition: Essays in Honor of Ulrich Neisser. Lawrence Erlbaum Associates. Hillsdale, New Jersey. 476 Neisser, U. 1981. “John Dean’s Memory.” Cognition. Vol. 9. p. 1-22. Also, Hyman, I. E. and Neisser, U. 1992. “The Role of the Self in Recollections of a Seminar.” Journal of Narrative and Life History. Vol. 2. p. 81-103. 477 Neisser, U. and Harsch, N. 1992. “Phantom Flashbacks: False Recollections of Hearing the News about Challenger.” Affect and Accuracy in Recall: Studies of “Flashbulb” Memories. Cambridge University Press. New York, New York. 478 Hyman refers to postevent information errors as “misinformation errors.”

Factual Information 240 Aircraft Accident Report errors occur when a witness blends information from different events into a single memory. Memory intrusions (inclusion of specific information that was not originally present) occur when people incorporate their general knowledge and experiences into their memories and tend to occur in situations in which the recall of details is required or expected.479 Time slice errors occur when people are asked to recall information about an event, but they erroneously recall information about an event that took place at a different time.480 In other words, they recall something that may be a true event, but something that occurred before or after the event in question. Postevent information errors occur when people receive some postevent information about an event that they have observed and then later report the information as if they actually experienced it.481 Hyman has proposed three conditions that must exist for memory errors to occur: witnesses must (1) believe that the event is plausible, (2) construct an image of the event, and (3) believe that the event is a memory of something that they actually observed.482 A plausible event is one that the witness believes could have actually occurred. For example, research has demonstrated that people form false memories only when they consider them to be plausible.483 As further discussed below, the more reliable or knowledgeable that the witness believes the source of a suggested event is, the more likely the witness is to believe that the event is plausible. Hyman has indicated that plausible information only becomes a false memory if witnesses construct a mental image of it. Other research supports the concept that imagining an event increases the chances of witnesses erroneously claiming that they recall it actually occurring.484 In fact, Hyman believes that almost any activity that causes people to think about, imagine, or discuss events will lead to construction of images and, thus, memories. Finally, Hyman notes that for a false memory to occur, the witness must begin to believe that the event is a memory of something that he or she actually observed. In other words, the witness must misattribute the source of the incorrect information. Researchers 479 Hyman, I. E. and Rubin, D. C. 1990. “Memorabeatlia: A Naturalistic Study of Long-term Memory.” Memory and Cognitio. Vol. 18. p. 205-214. 480 Brewer, W. F. 1988. “Memory for Randomly-selected Autobiographical Events.” Remembering Reconsidered: Ecological and Traditional Approaches to the Study of Memory. Cambridge University Press. New York, New York. 481 Belli, R. F. 1989. “Influences of Misleading Postevent Information: Misinformation Interference and Acceptance.” Journal of Experimental Psychology: General. Vol. 118. p. 72-85; Loftus, E. F. 1979. “The Malleability of Human Memory.” American Scientist. Vol. 67. p. 312-320; Loftus, E. F. 1979. “Mentalmorphosis: Alterations in Memory Produced by the Bonding of New Information to Old.” Attention and Performance IX. Lawrence Erlbaum Associates. Hillsdale, New Jersey. p. 417-434; and Loftus, E. L. and Loftus, G. R. 1980. “On the Permanency of Stored Information in the Human Brain.” American Psychologist. Vol. 35. p. 409-420. 482 Hyman. 1999. 483 Hyman, I. E. and Pentland, J. 1995. “Guided Imagery and the Creation of False Childhood Memories.” Journal of Memory and Language. Vol. 35. p. 101-117. 484 Goff, L. M. and Roediger, H. L. 1996. “Imagination Inflation: Multiple Imaginings Can Lead to False Recollection of One’s Actions.” Paper presented at the 37th annual meeting of the Psychonomic Society. Chicago, Illinois.

Factual Information 241 Aircraft Accident Report have demonstrated that people also often misattribute the source of information that they have learned.485 That is, they may recall a particular piece of information, but not the source of that information. For example, someone may read about an event in a newspaper and also hear about it on television. Later, he or she may correctly recall details about the event, but incorrectly recall from which source he or she learned the details. Researchers have termed such events “source monitoring errors,” and research has shown that eyewitness susceptibility to postevent information errors may result in part from source monitoring errors.486 It has also been demonstrated that even when witnesses may be able to accurately attribute information to a particular source (such as an interviewer or a television news report), unless carefully questioned about the source of the information, they may still report the information as if it had been personally observed.487 1.18.4.3.2.1 Postevent Information Postevent information can be acquired in a variety of ways, including from interviewers during official questioning, other witnesses, media information, and even from the witness’s own thoughts as he or she “replays” the event in memory. Research has shown that an interviewer’s phrasing of questions can have a considerable effect on the information elicited from people.488 For example, the use of a definite article versus an indefinite article in questioning (that is, “Did you see the broken headlight?” versus “Did you see a broken headlight?”) is sufficient to increase the likelihood of a positive report.489 In another example, researchers found that people’s estimates of speed were affected by substituting different verbs (for example, “contacted,” “bumped,” and “smashed”) for the word “hit” in the question “How fast were the cars going when they hit each other?”490 Researchers have also found that a witnesses’ perception of the level of knowledge or credibility of the interviewer affects their susceptibility to postevent information. Witnesses who are asked a biased question by an interviewer whom they believe is knowledgeable about the event are more likely to give an incorrect answer than (1) witnesses who are asked a biased question by an interviewer whom they believe to be naïve or (2) witnesses who are asked unbiased questions.491 Smith and Ellsworth conducted a study in which participants viewed a videotape of a simulated bank robbery 485 Johnson, M. K.; Hashtroudi, S.; and Lindsay, D. S. 1993. “Source Monitoring.” Psychological Bulletin. Vol. 114. p. 3-28. 486 Lindsay, D. S. and Johnson, M. K. 1989. “The Eyewitness Suggestibility Effect and Memory for Source.” Memory and Cognition. Vol. 17. p. 349-358. 487 Lindsay and Johnson. 488 Horgarth, R. M. (Ed.) 1982. Question Framing and Response Consistency. Jossey-Bass. San Francisco, California. 489 Loftus, E. F., and Zanni, G. 1975. “Eyewitness Testimony: The Influence of the Wording of a Question.” Bulletin of the Psychonomic Society. Vol. 5. p. 86-88. 490 Loftus, E. F. and Palmer, J. P. 1974. “Reconstruction of Automobile Destruction: An example of the Interaction Between Language and Memory.” Journal of Verbal Learning and Verbal Behavior. Vol. 13. p. 585-589. 491 Smith, V. L. and Ellsworth, P. C. 1987. “The Social Psychology of Eyewitness Accuracy: Misleading Questions and Communicator Expertise.” Journal of Applied Psychology. Vol. 72(2). p. 294-300.

Factual Information 242 Aircraft Accident Report committed by more than one perpetrator.492 The participants who were asked, “What did the other guy’s gun look like?” by a knowledgeable interviewer (one they who knew had seen the videotape) in reference to an unarmed perpetrator were much more likely to report a nonexistent gun than those participants who were asked the same question by a naïve interviewer (one who they believed had not seen the videotape), or those who were asked, “Did the other guy have a gun?” (regardless of the assumed/presumed knowledge status of the interviewer). In addition to information provided by interviewers, research has shown that people will incorporate false information provided by other witnesses on a later recall test of details about a written story.493 It has also been demonstrated that people may incorporate details provided by others into their own descriptions of human faces.494 Research has also documented that, in a group interview about an event that the entire group has observed, if misinformation is reported as a memory by a member of the group, the likelihood is increased that others will also report this false information as if they had also witnessed it.495 This research also showed that if an interviewer claims that other witnesses to the same event (who are not present at the interview) have reported that a given detail was part of the event, the witness being questioned is more likely to report having seen the same detail, even though the detail was not part of the event. The effect of subsequent repeated testing of the memories of subjects who were exposed to misleading postevent information has also been studied. Research has demonstrated that if witnesses reported the misinformation on the first test, they were likely to repeat the misinformation on a second test.496 This, and other research497 appears to show that repeated retrieval increases the probability of creating false memories. Researchers have also found that likelihood of false memory creation is increased when the postevent information is presented in multiple forms (reading, hearing, or seeing the information).498 1.18.4.4 Witnesses of Special Interest Because of their unique vantage points and/or the level of precision and detail provided in the documentation pertaining to these witnesses, the following five witnesses 492 Smith and Ellsworth. 493 Betz, A. L.; Skowronski, J. J.; and Ostrum, T. M. 1996. “Shared Realities: Social Influence and Stimulus Memories.” Social Cognition. Vol. 14. p. 113-140. 494 Loftus, E. F. and Green, E. 1980. “Warning: Even Memory for Faces May be Contagious.” Law and Human Behavior. Vol. 4. p. 323-334. 495 Shaw, J. S.; Garven, S.; and Wood, J. M. 1997. “Co-witness Information Can Have Immediate Effects on Eyewitness Memory Reports.” Law and Human Behavior. Vol. 21. p. 503-523. 496 Roediger, H. L. et. al. 1996. “Misinformation Effects in Recall: Creating False Memories Through Repeated Retrieval.” Journal of Memory and Language. Vol. 35. p. 300-318. 497 Mitchell, K. J. and Zaragoza, M. S. 1996. “Repeated Exposure to Suggestion and False Memory: The Role of Contextual Variability.” Journal of Memory and Language. Vol. 35. p. 246-260. 498 Mitchell and Zaragoza.

Factual Information 243 Aircraft Accident Report have generated special interest. Figure 41 is a map showing the debris zones and the position of these five witnesses. The pilot of Eastwind Airlines flight 507 According to radar data, about the time of the last secondary radar return from TWA flight 800, Eastwind flight 507 was located about 24 nm northeast of TWA flight 800’s location at an altitude of about 15,400 feet.499 According to a statement that he prepared on the night of the accident, the captain of Eastwind flight 507 reported seeing what looked like an off-colored “landing light” that at first he thought might be an engine fire.500 He subsequently identified the “landing light” as an airplane that he needed to monitor. According to documents pertaining to an interview the day after the accident, the captain of Eastwind flight 507 estimated that he observed the airplane for about 2 to 3 minutes.501 To signal the flight crew of the other aircraft that they were in sight, the Eastwind captain switched on his own landing lights. As he flicked on his own landing lights, the aircraft that he had been watching “exploded into a very large ball of flames.”502 According to the statement that he prepared on the evening of the accident, “[a]lmost immediately two flaming objects, with flames trailing about 4,000 feet behind them, fell out of the bottom of the ball of flame.” At 2031:50, the captain of Eastwind flight 507 reported to Boston ARTCC Sardi Sector, “we just saw an explosion out here stinger bee five oh seven.” At 2037:20, he further reported, “ah yes sir it just blew up in the air and then we saw two fireballs go down to the to the water…also ah there seemed to be a light…I thought it was a landing light…and it was coming right at us at about I don’t know about fifteen thousand feet or something like that and I pushed on my landing lights ah you know so I saw him and then it blew.”503 In the written statement that he made on the night of the accident, the captain of Eastwind flight 507 stated that he immediately called ATC after seeing the “explosion.” However, during an interview on March 25, 1999, he told Safety Board investigators that after seeing the explosion, he paused for about 10 seconds before reporting the explosion to ATC. In the statement that he made on the night of the accident, the captain of Eastwind flight 507 also indicated that “prior to the explosion I did not see any missile, air to air or 499 For each of the pilot witnesses mentioned in this section, the Safety Board used radar data to determine positions and altitudes for witness aircraft relative to the last secondary radar return received from TWA flight 800. 500 He indicated that he dismissed this possibility because he saw no smoke trail. 501 In a transcribed interview by the Safety Board’s Witness Group conducted about 3 years after the accident, the witness indicated that he watched the light “on and off for over two minutes, minimum but I probably had seen him [the light] for over five minutes.” 502 The captain indicated that the explosion occurred below his airplane at an altitude he estimated to be between about 13,000 and 15, 000 feet msl. 503 The captain of Eastwind flight 507 was the first airborne witness to report seeing the accident to the air traffic controller at the Boston ARTCC.

Factual Information 244 Aircraft Accident Report Figure 41. A map showing the debris zones and the positions of the five witnesses of special interest.

Factual Information 245 Aircraft Accident Report ground to air....” The pilot stated in a subsequent interview with the Safety Board that he did not see anything coming up at or hitting the other airplane. The witnesses in the HH-60 helicopter Crewmembers (the pilot, copilot, and flight engineer) in a New York Air National Guard (NYANG) HH-60 helicopter, who at the time of the accident were performing instrument approaches about 11 nm from where the main portion of the wreckage fell into the ocean, were interviewed by the FBI shortly after the accident. According to documentation of those interviews, the pilot of the NYANG helicopter stated that he first observed a red streak of light moving very fast from right to left504 and that it was traveling in a gradually descending arc—almost horizontally. He stated that he observed the streak for about 1 to 2 seconds after which he saw an explosion. He described the streak as having the trajectory and image of a shooting star. In an interview with the Safety Board’s initial Witness Group (conducted on January 11, 1997), he indicated that he observed a red-orange streak of light moving horizontally for about 3 to 5 seconds in a gradually descending arc that he described as a “gentle descending trajectory”—similar to a shooting star. He then saw what he described as an explosion, followed 1 to 2 seconds later by a second and possibly a third explosion.505 He stated that he then saw a fireball, which he described as “four times the size of the sun,” that hit the ocean’s surface about 10 seconds after he first saw the fireball.506 The HH-60 pilot indicated that the fireball followed the same trajectory as the streak. According to the witness documents, the pilot stated that he had no idea what it was and that he never saw anything that he identified as an airplane. The witness documents indicated that the copilot and flight engineer from the HH-60 stated that their first observation of the event was of flaming debris at an estimated altitude of 4,000 to 5,000 feet and that this flaming debris hit the water about 8 seconds after they first spotted it. According to the witness documents, the copilot stated that, although he did not remember it on the evening of the accident, the next day he remembered seeing an object streaking from his left to his right just before the appearance of the fireball. He characterized this object as being like an “incendiary device” or a “pyrotechnic.” He stated that he then saw a succession of three explosions, each longer than the last. The streak-of-light witness aboard USAirways flight 217507 Witness documents pertaining to interviews with a passenger seated in a window seat on the right side of USAirways flight 217 (which was flying on a generally northerly 504 During his interview with the initial witness group, the pilot of the NYANG helicopter told investigators that the helicopter was on a heading of 238º. 505 The witness described the explosions as being “like flak…a hard explosion.” 506 During questioning about a missile by TWA’s representative to the Safety Board’s initial Witness Group, the pilot stated, “and when I looked up at this thing in the air, nothing said ‘missile.’” However, in subsequent statements to the media, the pilot has stated that he saw an “ordinance explosion” and that he believed that a missile was used against the airplane.

Factual Information 246 Aircraft Accident Report heading about 2.5 nm southwest of and about 8,000 feet above TWA flight 800 at the time of the last secondary radar return) indicated that he “observed some blinking lights on a small plane flying underneath the [USAirways flight 217] aircraft…[and] approximately 15-20 seconds later, he observed a light which appeared to be a ‘flare’” for about 10 seconds moving from right to left. According to the witness documents, the witness “then observed an initial small explosion in the same area that he last observed the flare. Within a second later, the small explosion turned into a large explosion” and then a descending fireball. Safety Board investigators used radar data to determine that the “small plane” seen passing underneath USAirways flight 217 by this witness was a U.S. Navy P-3 Orion.508 According to radar data and a visibility study done by Safety Board investigators, the P-3 would have passed under USAirways flight 217 and out of view of the witness about 1 to 1 1/2 seconds before the end of the FDR data and the last radar transponder return from TWA flight 800 (that is, about the time of the explosion in the CWT). The radar data and visibility study also indicated that TWA flight 800 would not have been visible to passengers seated on the right side of USAirways flight 217 when the CWT overpressure event occurred.509 The witness on the Beach Lane Bridge in Westhampton Beach, New York Witness documents pertaining to a witness who was standing on a bridge on Beach Lane over Quantuck Canal in Westhampton Beach, New York (9.6-nm slant range from the position of TWA flight 800’s last secondary radar return), stated that he saw “a white light that was traveling skyward from the ground at approximately a 40° angle.” He stated that it looked like “cheap fireworks” or a meteor that went up and “‘arched over’ and disappeared,” traveling in a south/southeasterly direction. However, in subsequent interviews this witness apparently acknowledged that he did not see the light originate at the surface of the earth because the light appeared in the sky above the house.510 The witness documents further indicated that the witness reported that he first saw the light above the fourth or fifth house511 west of the bridge on the south side of Dune Road and that the light was visible for about 15 seconds. He said that 2 or 3 seconds after 507 There were six additional witnesses aboard USAirways flight 217, five of whom were seated on the right side of the airplane. (It could not be determined where the sixth witness was seated.) None of these witnesses was classified by the Witness Group as having reported seeing a streak of light, but the documents indicated that all of these witnesses reported seeing a large fireball on the right side of USAirways flight

1. The document pertaining to one of these witnesses (who was seated in seat 6F) stated that before the

witness saw a fireball, he saw an aircraft that “had what he took to be its landing lights on, and [he] could observe cabin lights on the vessel.” According to the document, the witness reported watching the airplane with “cabin lights” for 30 to 40 seconds, then seeing it bank to the left. The document then states, “The aircraft exploded and a large round orange fireball appeared.” The document contains no mention of any other light in the sky. 508 The CIA reached the same conclusion. 509 For additional information regarding the radar data and visibility study, see Witnesses 4–Witness Visibility Study, dated June 22, 2000, and Witnesses 4–Viewing Angles Study, dated July 7, 2000. 510 When asked how high above the house the light was, the witness indicated that, if one were to imagine a flag pole on top of the house, the light would have appeared at the top of the flag pole.

Factual Information 247 Aircraft Accident Report the white light disappeared he saw an orange fireball and “the fireball descended at approximately a 30° angle and left a fire trail burning behind it.” The witness reported that he saw the fireball descend behind the second house on the south side of Dune Road west of the public parking lot and, seconds after first observing the fireball, he felt and heard an explosion followed by three others. The Safety Board obtained aerial imagery of the bridge and the houses and used it to draw sight lines. A sight line drawn from the witness position through the fourth or fifth house intersected the flightpath of TWA flight 800 near the last transponder return from the accident airplane. A sight line drawn from the witness position through the second house intersected the green zone near where the aft fuselage was recovered. The witnesses on a boat near Great Gun Beach Witness documents indicated that three witnesses were fishing in a boat about 1 to 1 1/2 miles512 from the shoreline (about 6 1/2 to 7 1/2 nm from the accident site). One of those witnesses stated that he looked up and observed a faint yellow object, which he thought might possibly be a meteor. This witness directed the attention of his companions to the object. He stated that it looked like a “shooting star” moving in a downward, 45° sloping arc and that it that grew larger and brighter. He stated that he then heard a “rushing roar” type of sound and at that moment realized that he was watching an airplane and that he saw one wing separate from the fuselage and remaining wing513 at the same time as he heard and felt514 an explosion. The witness reported, “It [the airplane] had rolled over onto its left side, and seemed to be hooking northward and downward.” He stated that he then saw what he believed was the right wing separate from the fuselage. The other two witnesses in the boat reported that, before the object broke apart, it seemed to turn toward the north. One of the other two witnesses estimated that he observed part of the object separate from the remainder about 8 seconds after he first sighted the light. (The witness who saw the “shooting star” estimated that he began observing it before his companions saw it.) 1.18.4.5 Witness Line-of-sight Study A line-of-sight study was conducted by the Suffolk County Police Department’s Marine Bureau to determine the geographical area from which witnesses reported seeing a flarelike object.515 The study was accomplished between July 20 and 30, 1996, during FBI reinterviews of several witnesses who reported seeing a streak of light or flarelike object 511 The witness document pertaining to a July 23, 1996, FBI interview states that the witness stated that he “saw what appeared to be cheap fireworks coming off the beach about 4 or 5 houses west of the bridge.” A document pertaining to a more detailed FBI interview on July 29, 1996, states that the “white light came in to view just above the roof top of the fourth house west of the public parking area on Dune Road.” 512 In one document of an interview with the witness who first saw the object, the witness estimated that he was about 1 1/2 miles from the shoreline. In a second document, the witness stated that he was about 1 mile offshore. 513 The witness stated that he saw the right wing separate from the fuselage; however, the Sequencing Group determined that the left wing separated from the fuselage and right wing. 514 He reported that he felt a concussion on his chest at the same time as he saw the wing separate.

Factual Information 248 Aircraft Accident Report on the evening of July 17, 1996. During these reinterviews, the witnesses were taken to the locations from which they made their observations. The position (latitude and longitude) of each witness and the horizontal direction (azimuth) were recorded for each witness location to the area where he or she observed the streak of light or flarelike object.516 Data from witnesses who could describe their positions and their observations of the flarelike object relative to fixed reference points (such as a flagpole or a building) were recorded and then plotted on a map of the accident debris fields. Lines depicting the azimuth from the witness’s position to the area that the witness reported seeing the streak of light or flarelike object were also drawn. The line-of-sight study determined the latitude and longitude of two points at which the sight lines appeared to intersect (according to the Suffolk County Police Department’s Marine Bureau) and recommended that the FBI search a 1-nm area around these points for evidence of a missile.517 Safety Board investigators also plotted these data, developed a sight line plot map using computer map-making software, and determined that 7 of the 11 sight lines intersected the green zone debris field and that two passed just north of it. Figure 42 shows a map of the sight lines plotted for 11 of the witnesses. 1.18.4.6 Central Intelligence Agency Review of the Witness Data Early in the investigation, at the FBI’s request, the CIA reviewed data regarding the TWA flight 800 accident (including witness reports and information; FDR, CVR, ATC, and radar data; and infrared sensor information from a U.S. satellite) to determine if the streak of light reported by many of the witnesses might have been a missile. The CIA’s video518 stated that “not surprisingly, most eyewitnesses saw only the most conspicuous segment of the disaster—the fire trail and cascade of flames in the 10 to 15 seconds before the aircraft hit the water.” The CIA video indicated that because “sound from the aircraft’s explosion took more than 40 seconds to reach each of the 58 eyewitnesses [that they evaluated519] who reported hearing sounds associated with the disaster. Therefore, any events eyewitnesses reported seeing at about the time they heard the first sound took place well after the explosion.” The CIA video concluded that “most [witnesses] describe observations made only during the final moments of the disaster—well after the aircraft exploded….To date, there is no evidence that anyone saw a missile shoot down TWA flight 800.” 515 The FBI requested this study as part of its investigation of the possibility that a missile had been used against the accident airplane. 516 A Garmin Model 45 GPS receiver was used to determine position (in degrees, minutes, and seconds), and a hand-held magnetic compass was used to determine azimuth (in magnetic degrees). 517 These two locations were well within the undersea area covered by the 9-month search and recovery operation that concluded in April/May 1997. (See appendix C for information regarding the search and recovery operation.) 518 For additional information, see the CIA video, “TWA Flight 800: What did the witnesses see?,” first shown at the November 18, 1997, FBI press conference. 519 The FBI provided the CIA with only some of the witness documents that were later provided to the Safety Board.

Factual Information 249 Aircraft Accident Report Figure 42. Map of sight lines plotted for 11 witnesses.

Factual Information 250 Aircraft Accident Report 1.18.4.7 Missile-Related Information At the Safety Board’s request, the Naval Air Warfare Center—Weapons Division (NAWC-WD) at China Lake, California, provided assistance in identifying possible missile impact damage on the accident airplane wreckage. NAWC-WD experts conducted detailed examinations of the recovered wreckage and reconstructions and analyzed other data to evaluate the possibility that a shoulder-launched missile destroyed the airplane.520 According to a ballistics/warhead testing expert from the NAWC-WD, if a missile521 with a live warhead impacted the airplane and detonated, the wreckage would likely have exhibited extensive damage to the impact area from the initial penetration of the missile and the subsequent dispersion of high-velocity postdetonation fragments. He described the following four regions522 of warhead damage as being typical for nearly all missile warheads: • The first region, which is in the immediate vicinity of the detonation, is characterized by complete removal of the structure…due to weakening by fragment penetrations and dislocation by the blast pressure wave. • The second region contains numerous high-velocity[523] fragment penetrations, soot residue from the explosive, and may exhibit distortion, but not widespread removal, of structure…due to the pressure wave. • The third region contains more widely spaced high-velocity fragment penetrations, usually with little evidence of sooting or pressure wave damage. • The fourth region contains only occasional high- and low-velocity fragment penetrations. 520 For detailed information, see the NAWC-WD report, “TWA Flight 800 Missile Impact Analysis,” dated December 1997. 521 The expert considered it most likely that, if a missile were involved in the TWA flight 800 accident, it would be a shoulder-launched missile (a Man Portables Air Defense System) because (1) shoulder-launched missiles are available and are effective terrorist weapons and (2) larger surface-to-air and air-to-air missile systems are expensive, require training and equipment not readily available, and leave clearly identifiable evidence over larger areas of the target than shoulder-launched systems. 522 According to the NAWC-WD expert, these regions did not have distinct boundaries between each other, and overlapping of characteristic damage between regions is common. 523 The expert defined high-velocity as “in excess of around 4,000 feet per second” and indicated that holes resulting from high-velocity penetrations would be “visually quite different from low-velocity impacts.”

Factual Information 251 Aircraft Accident Report According to the NAWC-WD ballistics/warhead testing expert, although some types of damage inflicted by warheads can be caused by other events524 high-velocity fragment penetrations are unique to explosive events and give investigators a conclusive method of identifying these encounters when they occur. Previous testing on both commercial and military aircraft has shown that even with small shoulder-launched weapons, high-velocity fragmentation damage to the aircraft will exist over large areas of the target….Based on previous testing performed by the military and [FAA], it is inconceivable that a warhead could have detonated in or near the fuselage without leaving evidence of high-velocity fragmentation damage somewhere on the recovered wreckage. NAWC-WD also performed infrared signature measurements of 747s on approach to a commercial airport to identify the most likely tracking points for a shoulder-launched missile. According to the NAWC-WD report, infrared seekers on shoulder-launched missiles typically aim for hot spots, such as engine exhausts or inlets. The NAWC-WD infrared measurements showed that the four engines and the underside of the fuselage where the air conditioning pack bay is located (under the CWT) were the “hot spots” on the 747. The NAWC-WD report indicated that its experts observed no evidence of high-velocity fragmentation damage on the accident airplane. Specifically, the report indicated that no such damage was observed on the accident airplane’s engines or air conditioning pack components. The NAWC-WD report concluded the following: No conclusive evidence of missile impacts exists on any of the recovered wreckage of TWA flight 800. No evidence of high-velocity fragment impacts exists, which indicates a live warhead did not detonate within or near the exterior of the aircraft....The possibility that a shoulder-launched missile was launched at TWA flight 800, failed to intercept it, self-destructed in close proximity,[525] and initiated the breakup of the aircraft is highly improbable.” The Safety Board used missile performance data provided by NAWC-WD, warhead detonation data from the Defense Intelligence Agency’s Missile and Space Intelligence Center (MSIC), and damage tolerance data from the Survivability/Vulnerability Information Analysis Center (SURVIAC) in a computer simulation study to further evaluate the possibility that a shoulder-launched missile aimed at the accident airplane did not reach its target but selfdestructed at a point close enough for a fragment to enter the CWT.526 According to the Safety Board’s study, for missile selfdestruction to be a possible source of CWT ignition for TWA flight 800, the missile must be (1) close enough at detonation for a fragment to enter the CWT, (2) oriented such that the fragmentation 524 For example, soot deposits may be caused by a fuel-fed fire, and low-velocity penetrations may be caused by ground/water impacts. 525 According to missile warhead experts, shoulder-launched missiles will selfdestruct their warheads about 15 to 17 seconds after they are launched if they do not reach a target. 526 For additional information, see Missile Self Destruct Performance Study, dated April 13, 2000.

Factual Information 252 Aircraft Accident Report pattern intersects the CWT, and (3) far enough away at detonation that the airplane was not peppered with holes.527 In an effort to bracket the possible missile performance range, NAWC-WD provided the Safety Board with data for a low-performance and a high-performance missile.528 According to NAWC-WD personnel, a typical missile flight would consist of about 8 seconds of engine burn (7.8 and 8.4 seconds for the two missiles the Board received data for) followed by a high-speed coast of about 7 to 9 seconds to selfdestruction if no target has been hit. During the 15- to 17-second flight, the missile would track to a heat source on the airplane. According to the MSIC, warhead detonation typically results in about 1,000 fragments of various sizes, with an average mass of less than 10 grains (0.0229 ounce), and a mass as large as 40 grains (0.0916 ounce) in the pattern shown in figure 43. MSIC reported that warhead fragments could have an initial velocity of up to 9,000 fps. Data obtained from the SURVIAC indicated that 10- and 40-grain fragments would require velocities of 3,500 fps and 2,000 fps, respectively, to penetrate the CWT if they impacted the bottom of the CWT at a right angle. Using the initial speed and speed decay rate for the warhead fragments, the Safety Board calculated that a detonation would have to occur 40 feet or less below the airplane’s CWT for a fragment to retain sufficient velocity to penetrate the CWT. SURVIAC’s data indicated that an even greater velocity would be required for a fragment to penetrate the CWT if it struck the bottom of the CWT at an angle. For example, a 40-grain fragment impacting the CWT at a 60° angle would require a velocity of more than 4,500 fps to penetrate the bottom of the tank. Using the initial speed and speed decay rate for the warhead fragments, the Safety Board calculated that a detonation would have to occur within 17 feet of the airplane’s CWT for a fragment to retain sufficient velocity to penetrate the CWT at a 60° angle. Further, SURVIAC data showed that a fragment loses both velocity and mass when it must pass through other layers of material (such as metal or fiberglass) before penetrating the component of interest (in this case, the CWT). Additionally, when the fragment speed decay rate was adjusted to represent a fragment passing through Jet A fuel, calculations indicated that the fragment would slow from 9,000 fps to 2,000 fps in less than 1 inch. The Board notes that, regardless of where the detonation occurred, a missile fragment would have had to have penetrated multiple layers of material to enter the CWT. 527 As previously discussed, examination of the wreckage revealed only two holes in the horizontal pressure deck (above the left side of the wing landing gear bay) that contained some features of both high-velocity and low-velocity penetrations. However, the features of these penetrations indicated that they were made by objects coming from different directions; therefore, it is not likely that they originated from a common location. Moreover, the physical features of both holes indicated they were made by objects traveling from inside the airplane out, rather than the reverse. 528 Because of the sensitive nature of the data, the missiles for which data were provided were not identified.

Factual Information 253 Aircraft Accident Report The Safety Board’s computer simulations (using this missile performance data and taking into account the winds at the time of the accident) showed that the locations on the surface from which a missile launched at TWA flight 800 would result in selfdestruction within 40 feet of the airplane were extremely limited. Figure 44 shows airplane locations at which, if a high-performance missile were launched at the airplane, the missile would selfdestruct within 40 feet of the airplane. Note that, at the scale shown, the launch area that would result in a selfdestruction within 40 feet of the airplane is not as wide as the line showing the 15-second perimeter in this figure. Simulations further showed that, because of the pattern in which missile fragments are dispersed after selfdestruction (see figure 43), launches from many of these positions would result in no fragments having a trajectory that would result in penetration of the CWT. For example, because of the nature of missile guidance, a launch from most positions on the perimeter shown in figure 44 would result in the missile catching the aircraft from behind. The area in front of the missile is not in the fragment dispersal area. Figure 43. Diagram of warhead detonation fragment pattern.

Factual Information 254 Aircraft Accident Report Figure 44. Diagram showing airplane and missile launch site locations that could result in missile selfdestruct within 40 feet of the plane. 1.18.4.7.1 Missile Visibility Study On the basis of performance data for a fairly high-performance, shoulder-launched missile, to collide with TWA flight 800, a hypothetical missile would have had to have been launched between about 4.5 nm and 11 nm from shore. Safety Board investigators consulted with missile experts in U.S. intelligence and defense communities to determine if the launch and flight signatures of a shoulder-fired missile would be detectable at those distances. Weapons systems experts indicated that there were no data available on which to base an answer to this question. Consequently, the Board conducted (and videotaped) missile visibility tests on April 28, 2000, at Eglin Air Force Base, Fort Walton Beach, Florida, to determine if observers could see and describe the characteristics of a missile launch. The missiles were launched just after sunset on April 28, 2000, when the surface weather conditions and the position of the sun were similar to the conditions on Long Island at the time of the accident. Observer groups were positioned every 2 nm from the launch point out to 14 nm.529 The observers were told where to look, and they listened to the launch countdowns via handheld radios. Although nine countdowns were TWA flight 800 position at launch for encounter at 15 sec Launch site TWA flight 800 Sam2 Missile Footprint

Factual Information 255 Aircraft Accident Report accomplished, only three missiles were launched. The observers did not know which countdowns would lead to launches and which would not. Statements and other information were obtained from the observers between countdowns. The three missile launches were easily detected by all of the observers. There were four false alarms (reports of something moving in the sky after a countdown that was not followed by a missile launch). According to the observers, the launched missiles appeared as a bright light or flame rising from the surface. The observers also indicated that the light was only visible during the (about 7 to 8 second) burn, and then they observed nothing until the missile selfdestructed about 7 to 8 seconds later.530 Observers who reported seeing the missile selfdestruct described it as an abrupt flash of light. Some of the closest observers reported hearing a muffled boom about 20 to 30 seconds after they observed the flash of light. All observers reported that they were unable to see the body of the missile from any range.531 529 The observers who were positioned 14 nm from the launch site were originally positioned closer to the missile launch site (12 nm out), with instructions to move farther out for subsequent launches if the missile was visible from the closer position during the first observed launch. Thus, the lighting conditions for the tests during which these witnesses were positioned 14 nm from the launch site were darker than in earlier tests. For the first launch, which was conducted under lighting conditions that were comparable to those that existed at the time of the TWA flight 800 accident, no observers were positioned farther than 12 nm from the launch site. 530 Not all observers reported observing the missile selfdestruct. For example, during the first launch, five of the six observers positioned within 6 nm of the launch site reported observing the missile selfdestruct. None of the observers positioned more than 6 nm from the launch site reported observing the missile selfdestruct. 531 For the second launch, one observer at 10 nm replied, “maybe,” when asked if he saw the missile body. He answered negatively for the other two launches, including the first launch, which was conducted under lighting conditions comparable to those that existed at the time of the TWA flight 800 accident.

256 Aircraft Accident Report 2. Analysis 2.1 General The flight crew was properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. The airplane was certificated, equipped, and dispatched in accordance with Federal regulations and approved TWA procedures. (Maintenance issues relating to airplane wiring are discussed in section 2.5.) At the time of the accident, there were light winds and scattered clouds in the area, but there were no significant meteorological conditions that might have disrupted the flight. 2.2 The Accident Sequence 2.2.1 The In-Flight Breakup On July 17, 1996, about 2019, TWA flight 800 took off from John F. Kennedy International Airport (JFK), New York, New York, destined for Charles DeGaulle International Airport, Paris, France. The airplane climbed over the Atlantic Ocean without incident and leveled off at its assigned altitude of 13,000 feet about 2027. At 2030:18, in response to an air traffic control (ATC) instruction to climb to 15,000 feet, the flight crew increased the airplane’s engine thrust. The airplane was ascending through 13,760 feet at 2031:12 when both the cockpit voice recorder (CVR) and the flight data recorder ceased recording without warning. Many witnesses in the area of the accident at the time that it occurred reported that they saw and/or heard an explosion, accompanied by a fireball over the ocean, and observed debris falling to the water. These witness reports and the widespread distribution of the wreckage indicated that TWA flight 800 had experienced a catastrophic in-flight structural breakup. In addition, a noise recorded on the CVR in the last few tenths of a second before the CVR recording stopped was similar to the last noises heard on CVR recordings from other airplanes that had experienced structural breakups (including fuel tank explosions).532 On the basis of this initial information, investigators considered several possible causes for TWA flight 800’s in-flight structural breakup: a structural failure and decompression; detonation of a high-energy explosive device, such as a bomb 532 For more information about CVR-related tests, see section 1.11.1.2.

Analysis 257 Aircraft Accident Report exploding inside the airplane or a missile warhead exploding upon impact with the airplane; and a fuel/air explosion in the center wing fuel tank (CWT). 2.2.1.1 Consideration of a Structural Failure and Decompression Close examination of the wreckage revealed no evidence of preexisting airplane structural faults (such as fatigue, corrosion, or mechanical damage) that could have contributed to the in-flight breakup. The examination revealed that the structure did have minimal preexisting corrosion damage, none of which could have led to or affected the breakup of the airplane. Small fatigue cracks were found in some parts of the airplane, including in the lower chord of the front spar and in the shear ties for the floor beams and stiffeners at the front spar; however, none of these cracks had coalesced into a propagating crack that could have led to the in-flight breakup. Further, although the joint between fuselage sections 41 and 42 on some 747s purportedly had been subject to manufacturing assembly problems, there was no evidence that it had separated in any locations before impact. It was also suggested that the breakup could have been initiated by the in-flight separation of the forward cargo door. However, all eight of the latching cams along the bottom of the door (and some pieces of the cargo door itself) remained attached to the pins along the lower door sill, and there were no indications of preimpact failure of the hinge at the top of the door. This evidence indicates that the door was closed and locked at impact. Further, deformation and fracture patterns on the door matched damage to the adjacent fuselage structure, confirming that the door was in the closed position at the time of impact. Therefore, the Safety Board concludes that the in-flight breakup of TWA flight 800 was not initiated by a preexisting condition resulting in a structural failure and decompression. 2.2.1.2 Consideration of a High-Energy Explosive Device Detonation (Bomb or Missile Warhead) Several factors led to speculation that the accident might have been caused by a bomb or missile strike. These factors included heightened safety and security concerns because of the 1996 Olympics then being held in the United States, the fact that TWA flight 800 was an international flight, and the sudden and catastrophic nature of the in-flight breakup. In addition, numerous witnesses to the accident reported seeing a streak of light and then a fireball, which some people believed represented a missile destroying the airplane.533 Further, some anomalous primary radar targets were recorded by the Islip, New York, radar site in the general vicinity of TWA flight 800 at the time of the accident that apparently could not be explained.534 Accordingly, the Safety Board considered the possibility that a bomb535 exploded inside the airplane or that a missile warhead from a shoulder-launched missile exploded upon impact with the airplane.536 Testing performed by the Federal Bureau of Investigation (FBI) found trace amounts of explosives on three separate pieces of airplane wreckage (described by the FBI 533 For more information about these witness reports, see section 2.2.2.

Analysis 258 Aircraft Accident Report as a piece of canvaslike material and two pieces of floor panel). However, none of the damage characteristics typically associated with a high-energy explosion of a bomb or missile warhead (such as severe pitting, cratering, petalling, or hot gas washing) were found on any portion of the recovered airplane structure, including the pieces on which the trace amounts of explosives were found. Only about 5 percent of the airplane’s fuselage was not recovered, and none of the areas of missing fuselage were large enough to have encompassed all of the damage that would have been caused by the detonation of a bomb or missile. Although several large holes are visible in the reconstructed portion of the airplane fuselage, almost all of the structure that originally filled in these holes is attached to the remaining structure but is folded either inward or outward. No area of structure in the reconstructed portion of the airplane contained any unexplained holes large enough to represent the entry point of a missile.537 Further, the victims’ remains showed no evidence of injuries that could have been caused by high-energy explosives,538 nor was there any damage to the airplane seats and other interior components consistent with a high-energy explosion. Investigators considered several scenarios to determine how the trace amounts of explosive residue might have gotten on the wreckage from the accident airplane. Trace amounts of explosive residue could have been transferred to the contaminated pieces from the military personnel (and their associated clothing, boots, and equipment) that were on 534 Investigators closely evaluated three sequences of primary radar returns recorded by the Islip radar site around the time of the accident (from about 1 minute before the accident to 9 minutes after), which appear to show three targets moving at 300 to 400 knots ground speed about 10 nautical miles (nm) southwest of the accident. None of the three sequences intersected TWA flight 800’s position at any time, and all of them were moving away from the accident airplane. For each of these three sequences of primary returns, investigators found that the signal strengths varied randomly from very high to very low, the azimuth was always 150º to 160º relative to the radar, and there were no primary or secondary tracks leading to or away from them. Further, Islip was the only radar site out of six primary radar sites covering this airspace that recorded these primary returns. Investigators learned from air traffic controllers and radar technicians that ground or building reflections of primary radar returns from aircraft flying in one geographic area can cause “false primary” targets to be recorded as though the aircraft were flying in another geographic area. Numerous buildings and structures in the area around the Islip radar site could have created such reflections. Investigators identified commercial airplanes traveling through other areas within the coverage of the Islip radar at the same time that the three sequences of primary returns were recorded; these airplanes had similar ground speeds and flightpaths as the three sequences of primary radar returns. These findings indicate that the three sequences of 300 to 400 knot primary radar returns recorded by the Islip radar site between about 2030 and 2040 do not represent unexplained objects (such as a missile) but, rather, represent false or reflected returns from actual aircraft in other geographic areas. 535 For the purposes of this discussion, the term “bomb” means an explosive device designed to release destructive material at high velocity upon detonation. The term does not refer to an explosive device designed only to set off a small charge of sufficient strength to penetrate the fuel tank and ignite explosive vapors. The possibility that such a device might have ignited the fuel/air vapor in the CWT is discussed in section 2.2.1.2. 536 The possibility that the CWT was ignited by a missile fragment from a missile warhead that exploded at a sufficient distance from the airplane such that most of the other fragments would not have caused the type of damage typically left by an exploding missile warhead is discussed in section 2.3.1.3. 537 The largest missing area in the portion of the airplane fuselage recovered from the red zone (where the first pieces to depart the airplane would have landed) was about 1 square foot. A missile warhead is about 3 inches in diameter; however, the underlying structural pieces (stringers and/or frames) in each of the areas of missing fuselage showed no signs of penetration by a missile warhead.

Analysis 259 Aircraft Accident Report board the accident airplane when it was used to transport troops during the Gulf War in

1. In addition, explosives were placed and then removed from several locations in the

accident airplane during a dog-training explosive detection exercise about 1 month before the accident.539 However, testing by the Federal Aviation Administration’s (FAA) Technical Center indicated that residues of explosives found on the accident airplane would dissipate completely after 2 days of immersion in sea water.540 Very few pieces of airplane wreckage were recovered during the first 2 days after the accident, and those pieces that were recovered were found floating on the ocean’s surface; several days of side-scan sonar searching preceded any underwater wreckage recovery operations. Therefore, it is very likely that the pieces on which the explosive residues were found were immersed in ocean water for considerably more than 2 days before they were recovered. Thus, it is quite possible that the trace amounts of explosive residue detected on wreckage pieces from the accident airplane were not present before the airplane entered the water but, rather, were deposited during or after recovery operations. The military personnel, ships, and ground vehicles used during the recovery operations had come into frequent previous contact with explosives. Trace amounts of those substances could have been transferred from the surfaces of the ships or ground vehicles, or from clothing and boots of military personnel, onto wreckage pieces during the recovery operations or through subsequent contact with the pieces in the airplane hangar where the airplane wreckage was later assembled and laid out. Despite being unable to determine the exact source of the trace amounts of explosive residue found on the wreckage, the lack of any corroborating evidence associated with a high-energy explosion indicates that these trace amounts did not result from the detonation of a high-energy explosive device on TWA flight 800. Accordingly, the Safety Board concludes that the in-flight breakup of TWA flight 800 was not initiated by a bomb or a missile strike. 2.2.1.3 Consideration of a Fuel/Air Explosion in the Center Wing Fuel Tank It was clear from the wreckage recovery locations that the first pieces to depart the airplane were from the area in and around the airplane’s wing center section (WCS), 538 According to a medical/forensic analysis report prepared for the Department of Justice/FBI by a medical/forensic expert, all injuries were consistent with a severe in-flight breakup and subsequent water impact. 539 During that exercise, an airport police officer placed five training aids containing explosives (one of which was cracked and could have released small amounts of explosives) in various locations inside the passenger cabin. The officer’s activities were limited to the forward portion (forward of row 30) of the airplane. Training aids were placed in the following five locations: (1) in row 1, in the center armrest compartment separating seats 1 and 2; (2) in a small closet at the rear of the upper deck; (3) in row 10, inside the rear pouch of the seatback in front of seat 9; (4) in row 20, in the overhead compartment above seats 1 and 2; and (5) beside exit door R3. 540 The testing included both cloth and aluminum airplane pieces that were contaminated by manually deposited explosives and by exposure to an actual explosion. In both cases, no trace of explosives remained after 2 days of immersion in sea water.

Analysis 260 Aircraft Accident Report which includes the CWT, and, therefore, that the breakup must have initiated in this area. Specifically, wreckage found in the red zone (the wreckage zone closest to JFK along the airplane’s flightpath and, therefore, containing the earliest pieces to depart the airplane) consisted primarily of pieces from the WCS front spar and spanwise beam (SWB) 3, the manufacturing access door from SWB2,541 the two forward air conditioning packs, large pieces of a ring of fuselage structure just in front of the wing front spar, and main cabin floor beams and flooring material from above the WCS and from the fuselage in front of the WCS. None of these pieces showed evidence of prolonged fire exposure. (There was insufficient fuel in the CWT for its destruction to have resulted in a significant fire.)542 However, some pieces were lightly sooted, indicating that there was some fire associated with the initial event in this area. As discussed in section 1.16.3, the Metallurgy Structures/Sequencing Group’s sequencing study concluded (in part because pieces from inside the CWT were among the first pieces to depart the airplane) that the initial event in the breakup sequence was an overpressure event543 within the CWT and that the earliest piece of the airplane to be disturbed was SWB3. Specifically, the Sequencing Group concluded that SWB3 fractured at its upper end and that overpressure within the CWT caused it to rotate forward about its lower end. As the upper end of SWB3 rotated forward, it impacted the aft surface of the front spar, leaving distinct witness marks across most of the front spar. Analysis of the wreckage further indicated that when SWB3 impacted the front spar, it initiated multiple fractures along the upper chord of the front spar. Overpressure escaping from the CWT caused the front spar to bulge forward on either side of the two potable water bottles attached next to each other at the center of the front spar. The upper end of the front spar then completely separated from the upper skin of the WCS. After the upper end of the front spar was completely separated from the upper skin, the overpressure remaining within the CWT forced the WCS lower skin and the forward end of the keel beam downward. Downward loading of the forward end of the keel beam greatly increased the stress in the ring chord and in the fuselage skin adjacent to the front spar. As the keel beam was forced downward, cracking propagated down through the lower pressure bulkhead and ring chord and immediately entered the fuselage skin at stringer 40 right. This initial fuselage skin crack at stringer 40 right propagated forward at an angle to the left (toward the bottom center of the airplane), then branched circumferentially left and right, and then (from the left branch) propagated back toward the front spar on the lower left side. Thus, at this point, the fuselage skin had cracked 541 The remainder of SWB2 was found in the green zone (the wreckage zone farthest from JFK along the airplane’s flightpath, and, therefore, containing the last pieces to depart the airplane). The manufacturing door was only lightly sooted, whereas the sooting on the remainder of SWB2 was moderate to heavy, indicating that the remaining portion of the WCS was subjected to a more substantial fire after the early departure of the manufacturing door. 542 Therefore, the large “fireball” described by some witnesses could not have been caused by the initial destruction of the CWT. For additional discussion about the nature of the reported fireball, see section 2.2.2.1. 543 As previously mentioned, the Sequencing Group defined an overpressure event as “one that would create sufficient pressure in a relatively short time to a level at which the structural integrity of the CWT is compromised.”

Analysis 261 Aircraft Accident Report around three sides of a large piece of fuselage structure (including the piece identified after recovery operations as “LF6A”); only the side adjacent to the lower pressure bulkhead (beneath the front spar) remained attached to the other structure. Downward loading (from normal cabin pressurization and vented CWT overpressure) on this weakened fuselage piece was transmitted to the forward end of the keel beam, which caused it to separate from the WCS lower skin panel and fracture about 22 inches aft of the mid spar. The separation of the large piece of fuselage created a large opening in the fuselage, just forward of the front spar, through which pieces of the front spar, SWB3, and the manufacturing access door from SWB2 exited the airplane. (The apparent forward and upward motion of the manufacturing access door after it separated from SWB2 at its lower edge indicates that, at that time, the pressure on the aft surface of the door was greater than on the forward surface, consistent with venting of the overpressure forward of SWB2 through the large opening in the bottom of the fuselage.) The sequencing study determined that the breakup sequence was initiated by an overpressure inside the CWT. Because there was no evidence that a high-energy explosive device detonated in this (or any other) area of the airplane, this overpressure could only have been caused by a fuel/air explosion in the CWT. Safety Board flight tests that recreated, to the extent possible, the conditions experienced by the accident airplane indicated that fuel vapor temperatures within the CWT at the time of the accident ranged from 101° to 127° F. Further, Safety Board-sponsored testing at the CIT showed that Jet A fuel vapors under conditions simulating the pressure, altitude, and fuel mass loading of TWA flight 800 are flammable at these temperatures and at those as low as 96.4° F. Therefore, the Safety Board concludes that the fuel/air vapor in the ullage of TWA flight 800’s CWT was flammable at the time of the accident. Early in the investigation, questions were raised about whether a Jet A fuel/air explosion in the CWT, without any additional forces, could generate sufficient pressure to break apart the fuel tank and lead to the destruction of the airplane. This issue was explored in July and August 1997 when, as part of a series of tests using an out-of-service 747 at Bruntingthorpe Airfield, Leicestershire, England, investigators simulated a fuel/air explosion in the CWT by igniting a propane/air mixture. Evaluation of the resulting damage indicated that the tank structure failed as a result of overpressure. The Safety Board recognizes that the test conditions at Bruntingthorpe were not fully comparable to the conditions that existed on TWA flight 800 at the time of the accident;544 however, previous fuel/air explosions in the CWTs of commercial airliners that had used Jet A fuel (such as the November 1989 accident involving a 727 operated by Avianca and the May 1990 accident involving a 737 operated by Philippine Airlines) confirm that a CWT explosion involving Jet A fuel can break apart the fuel tank and lead to the destruction of an airplane. 544 For example, those tests were conducted near sea level (rather than at 13,800 feet altitude), did not account for the effects of aerodynamic loads and pressurization on the accident airplane, used a small charge as an ignition source, and used a propane/air mixture as a surrogate for Jet A fuel, which released more energy than the mixture in TWA flight 800’s CWT.

Analysis 262 Aircraft Accident Report Further, in the laboratory testing at CIT simulating the altitude, temperature, and fuel mass loading conditions of TWA flight 800, peak pressures of 39.2 to 52.2 pounds per square inch (psi) (above ambient pressure)545 were measured from the combustion of a fuel/air mixture similar to the one that existed in the CWT of TWA flight 800. These pressures exceed the structural limitations of SWB3 (which, according to Boeing, will fail when subjected to a pressure differential of between 20 to 25 psi) and, therefore, would be sufficient to initiate failure of the CWT structure. Finally, analysis of the results of computer modeling of combustion in a full-scale CWT under conditions simulating those of TWA flight 800 indicated that a localized ignition of the flammable vapor could have generated pressure levels that, based upon structural failure analysis, would cause the damages observed in the wreckage of the accident airplane’s CWT. Accordingly, the Safety Board concludes that a fuel/air explosion in the CWT of TWA flight 800 would have been capable of generating sufficient internal pressure to break apart the tank. 2.2.2 Reported Witness Observations As discussed in section 2.2.1.2, the physical evidence indicated that a missile did not strike the airplane.546 However, numerous witnesses in the vicinity of the accident reported seeing a streak of light547 before the appearance of a fireball.548 There was intense public interest in these witness reports and much speculation that the reported streak of light was a missile that eventually struck TWA flight 800, causing the airplane to explode.549 However, because the physical evidence indicates that a missile did not strike the airplane, the witnesses must have been observing something other than a missile. In an attempt to determine what these witnesses were observing, Safety Board investigators studied all of the witness accounts in the context of the other information gathered during this investigation. 2.2.2.1 Potential Explanations for Reported Witness Observations The Witness Group concluded that the streak of light reported by witnesses might have been the accident airplane during some stage of its flight before the fireball developed, noting that most of the 258 streak-of-light accounts were generally consistent with the calculated flightpath of the accident airplane after the CWT explosion. The group 545 At 13,800 feet, the ambient pressure would have been 8.6 psi. The dry bay area in front of SWB3 is unpressurized and, therefore, at ambient pressure. 546 As will be discussed in section 2.3.1.3, a scenario in which the vapor in the CWT was ignited by a missile warhead fragment is also very unlikely. 547 According to the witness documents provided to the Safety Board by the FBI, 258 of the 736 witnesses described seeing (about the time of the accident) a streak of light, a flarelike object, or fireworks in the sky. These and similarly described observations were referred to by the Witness Group as a “streak of light.” For more information about witness observations, see section 1.18.4. 548 Of the 736 witnesses, 599 reported seeing a descending fireball; 200 of those reported seeing the fireball split into two fireballs before hitting the surface of the water. 549 The witnesses who reported observing a streak of light were the only witnesses who described seeing something that could have been consistent with a missile. None of the documents pertaining to the other witnesses provided any information suggestive of a missile.

Analysis 263 Aircraft Accident Report also determined that the descending fireball observed by 599 witnesses was the accident airplane and that the 200 witnesses who reported seeing the fireball split into two fireballs were observing the final stages of the structural breakup of the airplane. On the basis of computer simulations and witness information, the Safety Board determined that the entire breakup sequence of the airplane (from the time of the CWT explosion until the time that the aft portion of the airplane impacted the water) lasted about 47 to 54 seconds. The sequencing study established that the nose portion of the airplane separated from the remainder of the airplane after the initial explosion in the CWT. Computer simulations indicated that this occurred about 3 to 5 seconds after the initial explosion.550 Computer simulations based on radar data, trajectory calculations, and airplane performance factors indicate that after the separation of the nose portion, the remainder of the airplane (including much of the WCS, the wings, the aft fuselage, and the tail) continued in crippled flight and pitched up while rolling to the left (north), ascended from 13,800 to about 15,000 or 16,000 feet,551 and then rolled into a descending turn to the right (south). It is likely that, after the nose portion separated from the aft fuselage, a fuel-fed fire within the breached CWT (or any other fire that might have existed, such as from fuel that might have been leaking at the wing roots) would have been visible to witnesses from some distance and was likely the streak of light reported by many of the witnesses. It is also likely, based on the wreckage, computer simulations, and witness documents, that shortly after the descending turn to the right, the outboard left and right wings simultaneously separated at the outboard engines in upward bending. (The recovery positions of the antennas from the wing tips confirm that the outboard portions of the wings separated from the airplane significantly after the nose portion.) The separation of the outboard portions of the wings probably precipitated fuel-fed fires at both outboard main wing tanks and most likely was the beginning of the developing fireball described by witnesses. This fireball probably began to develop about 34 seconds after the CWT explosion.552 On the basis of witness documents, the sequencing study, and computer simulations, shortly after the outboard portion of the wings separated, the WCS separated adjacent to the left wing, causing the left wing to separate from what remained of the airplane structure. These failures would have resulted in the continuing development of a 550 The Safety Board’s computer simulations using airplane performance data indicated that the nose could have separated from 3.23 to 5.25 seconds after the initial event. (See Main Wreckage Flight Path Study.) The Safety Board also conducted a trajectory study to calculate how long after the initial event the nose separated from the airplane. However, because of the uncertainties inherent in such a study (for example, the effect of winds and ocean currents), this time could not be precisely determined. Results of the study initially indicated that the nose separation could have occurred from 3.9 to 7.5 seconds after the initial event. Additional computer simulations conducted after the trajectory study indicated that poor matches with known radar and wreckage location data were obtained with scenarios in which the nose separated more than 5 seconds after the initial event. Therefore, the nose separation most likely occurred from about 3 to 5 seconds after the initial event. 551 Computer simulations indicated that the maximum altitude that the accident airplane’s aft portion could have ascended after the separation of the nose portion ranged from 15,537 to 16,678 feet. See addendums 1 and 2 to the Main Wreckage Flight Path Study.

Analysis 264 Aircraft Accident Report larger fuel-fed fireball.553 The development of a severe fire associated with what remained of the airplane (portions of the WCS, the right wing, and a few pieces of attached fuselage) after the separation of the burning left wing is probably what witnesses reported as a “splitting” of the fireball. Several witnesses have become prominent because of their unique vantage points and/or the level of precision and detail provided in their accounts.554 Advocates of the missile-attack scenario have asserted that some of these witnesses observed a missile. However, as further explained below, analysis of these witnesses’ reported observations demonstrated that those observations are not consistent with their having observed a missile attack on TWA flight 800. Rather, they are consistent with these witnesses having observed some part of the in-flight fire and breakup sequence after the CWT explosion. For a missile to have initiated the TWA flight 800 breakup sequence, it would have had to have been fired at least 41 to 49 seconds before the initial development of a fireball.555 However, the pilot of the HH-60 helicopter indicated that he saw a fireball developing just 1 to 5 seconds after he first saw the streak of light.556 Therefore, he must have been observing the late stages of the airplane’s breakup and not a missile attack.557 The captain of Eastwind Airlines flight 507 also could not have seen a missile attack because the explosion that he reported having seen occurred about 34 seconds after the CWT explosion. Therefore, he must have seen the development of the fireball, not the earlier CWT explosion. Further, the Eastwind captain stated that he did not see a missile or anything coming up at or hitting the airplane. The CWT explosion also occurred before the time that the passenger aboard USAir flight 217558 reported seeing a “flare.”559 In fact, TWA flight 800 was not in this witness’s field of view at the time of the CWT explosion. Therefore, this flare could not have been a missile attacking TWA flight 800; however, this witness’s description is consistent with his having observed burning fuel from the accident airplane (in crippled flight) and the airplane’s subsequent breakup after the CWT explosion. 552 The captain of Eastwind flight 507 reported to the Boston Air Route Traffic Control Center that he saw an explosion (at 2031:50, about 38 seconds after TWA flight 800 lost power [2031:12] as a result of the explosion in the CWT). Assuming it took about 4 seconds for the captain to realize that he saw an explosion, confer with the first officer, and contact ATC, it follows that he first saw the developing fireball about 34 seconds after the explosion. Four seconds is a compromise between what the pilot first reported on the night of the accident (that he called ATC “immediately”) and what he stated to Safety Board investigators almost 3 years later (that he waited about 10 seconds before calling ATC) that favors his initial impression but provides adequate response time. 553 Many witness accounts describe a fireball developing after the streak of light arched over and began to descend. Analysis of the witness accounts suggests that the occurrence of this fireball was not a discrete event, but a transition from a streak of light to a fireball that occurred over a relatively brief period. 554 For more information about these witness accounts, see section 1.18.4.4. 555 This would comprise a 7- to 15-second missile flight plus about 34 seconds from the time of the CWT explosion to the outboard wing separations. 556 Although the Safety Board recognizes that witnesses frequently provide inaccurate estimates of time, the Board considers it highly unlikely that the HH-60 pilot would have reported seeing the streak of light for only 1 to 5 seconds if he had actually seen the streak of light for 41 to 49 seconds. 557 In addition, the HH-60 pilot stated that the fireball followed the same trajectory as the streak, which is consistent with the streak and the fireball both representing the airplane.

Analysis 265 Aircraft Accident Report The witnesses on the boat near Great Gun Beach were close enough to the accident airplane, with an unobstructed view, to have seen a missile if one had been launched. However, they did not describe a sequence of events consistent with a missile attack. Rather, their observations of the northward turn and wing separation are consistent with their having seen the accident airplane after the CWT explosion. The reported observations of the witness on the Beach Lane Bridge are also fully consistent with his having seen the accident airplane from about the time of the CWT explosion until the aft portion of the airplane descended into the green zone. Further, he did not describe a sequence of events consistent with a missile strike. Most notably, this witness did not describe any abrupt change in the streak of light’s speed or direction, which likely would have been evident if a missile strike had occurred. 2.2.2.1.1 Anomalous Witness Accounts Although most of the observations reported in the witness documents are consistent with the witnesses having observed some portion of the airplane’s crippled flight and breakup sequence,560 the Safety Board recognizes that a small percentage of the reported witness observations cannot be explained so readily. The Witness Group noted that documents pertaining to 38 witnesses described a streak of light ascending vertically, or nearly so, and that these accounts seem to be inconsistent with the accident airplane’s calculated flightpath. The Board recognizes that, in addition to these reports, 18 witnesses reported seeing a streak of light that originated at the surface or from the horizon, which also does not appear to be consistent with the airplane’s calculated flightpath and other known aspects of the accident sequence. In an attempt to reconcile these 56 witness accounts with the calculated accident sequence, the Board considered the effect of potential deficiencies in the interviewing and documentation process and of errors in witness memory and/or perception. 558 As noted in section 1.18.4.4, there were six additional witnesses aboard USAir flight 217, one of whom (seated in seat 6F) stated that he saw an aircraft that “had what he took to be its landing lights on, and [he] could observe cabin lights on the vessel.” According to the document, the witness reported watching the airplane with “cabin lights” for 30 to 40 seconds, then seeing it bank to the left. The document then states, “the aircraft exploded and a large round orange fireball appeared.” The document contains no mention of any other light in the sky. Because the CWT explosion aboard TWA flight 800 (and the subsequent loss of electrical power) would have occurred before TWA flight 800 could have been visible to the witness seated in seat 6F, the passenger in seat 6F could not have seen TWA flight 800’s cabin lights, nor could he have witnessed any missile attack. Further, his observations are consistent with his having observed the accident airplane in crippled flight and its subsequent breakup after the CWT explosion. 559 The witness reported seeing the flare about 15 to 20 seconds after he saw a small airplane, which had to have been the U.S. Navy P-3 Orion, pass under his airplane. The P-3 passed under USAir flight 217 about the time of the CWT explosion; therefore, if a hypothetical missile or warhead fragment had struck TWA flight 800, it would have had to have been fired about 7 to 15 seconds before the witness reported seeing the flare. 560 This is consistent with the results of the FBI-sponsored line-of-sight study in which a Deputy Inspector from the Suffolk County Marine Bureau drew a line of sight from the location of 11 witnesses through a fixed reference point where they each reported having seen a streak of light. (See figure 42.) The sight lines for 7 of the 11 witnesses studied intersected the green zone (and two passed just north of it), where the main portion of the wreckage was recovered from the ocean. These sight lines are consistent with these witnesses observing only the last portion of crippled flight.

Analysis 266 Aircraft Accident Report 2.2.2.1.1.1 Issues Associated with Interviewing and Documentation It should be noted that almost all of the witness interviews were conducted by the FBI during its criminal investigation primarily to determine whether a missile had been used against TWA flight 800.561 The Safety Board is aware that FBI agents generally did not record all of the information provided by witnesses but, rather, focused on information that might have been relevant to the possibility that a missile was used against TWA flight 800.562 This focus is evident in some of the suggested interview questions provided by the FBI to its agents, which include assumptions about a missile attack.563 Research has shown that how interview questions are phrased can have a considerable effect on the information elicited during an interview.564 Research has also shown that other types of word choices can affect the answers to questions.565 Further, witnesses who believe that their interviewer is knowledgeable about the event in question are more likely to be influenced by such suggestive questioning than those who do not think that their interviewer is knowledgeable. Some witnesses may have believed that the FBI agents were more knowledgeable than they actually were about whether a missile was used against TWA flight 800. This may have been especially true during those interviews in which Department of Defense (DoD) missile experts were present. Therefore, the scope and phrasing of the FBI agents’ questions and possible witnesses’ beliefs that the agents were more knowledgeable about the event than they actually were (each of which could have suggested the possibility of a missile) could have biased the interviewees answers to some questions.566 561 As noted in section 1.18.4.1, because of the amount of time that had elapsed by the time the Safety Board received information about the identity of the witnesses, the Witness Group chose not to reinterview most of the witnesses; instead, the group chose to rely on the original FBI documents as the best available evidence of the observations initially reported by the witnesses. 562 During a September 30, 1998, meeting with the Witness Group, an FBI agent who had been involved with the FBI’s earlier criminal investigation indicated that, because of suspicions that a missile might have been used against TWA flight 800, FBI agents frequently did not record a complete account of the visual and aural events described by the witnesses but, rather, concentrated on information that appeared relevant to its criminal investigation. 563 For example, some of the suggested interview questions included the following: “How long did the missile fly?”; “What does the terrain around the launch site look like?”; and “Where was the sun in relation to the aircraft and the missile launch point?”. For more information about other possible sources of interviewer or interviewee bias, see section 1.18.4.2. 564 For example, the use of a definite article (for example, “did you see the broken headlight?”) instead of an indefinite article (for example, “did you see a broken headlight?”) is sufficient to increase the likelihood of a positive answer. For more information about this research and other issues associated with the accuracy of witness memory, see section 1.18.4.3. 565 For example, substantially differing answers were received to the question “how fast were the cars going when they hit each other?” when the word “hit” was replaced with “contacted,” “bumped,” or “smashed.” 566 For example, one witness described the streak of light as “going straight up, not zig zag.” It is possible that this witness and others may have used the term “straight up” to denote the absence of obvious course corrections in response to interviewer questions about such corrections, not to indicate that the streak of light was ascending vertically.

Analysis 267 Aircraft Accident Report It is also possible that some of the witnesses who were classified “streak-of-light witnesses” by the Witness Group did not, in fact, report observing a streak of light. For example, a witness may only have observed a fireball falling from the sky; however, because of deficiencies inherent in the documentation process, the description recorded in the witness document may have met the Witness Group’s definition of a streak of light. (The potential for inaccurate witness classification is illustrated by the fact that at least three streak-of-light witnesses explained during reinterviews by the FBI or media that, contrary to what was reported in connection with their earlier interview, they did not observe the streak of light originate at the surface of the earth.) 567 In addition, the Witness Group identified several other issues that made it difficult to extract accurate and reliable information from the witness documents, including potentially flawed distance and direction information, multiple witness reports summarized in a single account, recording of witness speculations and conclusions, imprecise or vague language, conflicting information, and errors concerning the origin of the streak of light.568 2.2.2.1.1.2 Issues Associated with Witness Perception and Memory Perception569 It is possible that, from some witnesses’ locations, the burning airplane might have appeared to be rising vertically. Specifically, some witnesses who were standing on Long Island looking to the southwest would have been in a position to see the airplane coming nearly directly toward them, which could have resulted in the appearance of a rising (perhaps even near-vertical to some witnesses) flightpath for a portion of the time that the airplane was in crippled flight. Because of the angle at which these witnesses were positioned, any fire coming from the CWT could have appeared to them as a streak of light moving vertically. It should also be noted that witnesses observing the accident from Long Island would have been viewing it against a featureless background and, therefore, would have had few, if any, depth perception cues. Consequently, because of the tendency to perceive more distant objects as being about the same distance away as intervening objects (the equidistance tendency), the streak of light could have appeared closer to them than it actually was. The equidistance tendency is illustrated in figure 45, which depicts a person at point “c” observing an object at point “a” that appears at point “b” at the same perceptual distance as an intervening building at point “d.” This phenomenon possibly explains why the witness on the Beach Lane Bridge stated that the streak of light came into his view just above the roof of a house and why he reported that it appeared to have originated on the beach just beyond that house. For some observers, the equidistance tendency would have caused the streak of light to appear lower 567 For further information about these three witnesses, see section 1.18.4.2. 568 For more information about these issues, see section 1.18.4.2. 569 For more information about perception of distance and motion, see section 1.18.4.3.1.

Analysis 268 Aircraft Accident Report in the sky than it actually was, which explains why the streak of light may have been reported by some witnesses as having originated at the surface of the earth. It should be noted that almost all of the witnesses who reported that the streak of light originated at the surface viewed the streak of light on the far side of intervening terrain features, such as houses or the barrier island. These witnesses would have perceived the streak of light to be about the same distance as the intervening object because the elevation angle of the object would have been perceptually reduced. Further, if an observer views an object for which few or no depth perception cues are available, the motion of the observer’s head will cause the observer to perceive the object moving concurrently with the observer’s head. At the time of the reported observations, 13 of the 38 witnesses who reported that the streak of light ascended vertically or nearly so were in vehicles (including boats) and one of the witnesses was paddling a surfboard. Other witnesses may also have been moving. The effect of the concurrent motion of the observer’s head and the observed object would have caused the streak of light to appear to have been moving differently than it was actually moving, and this effect could have caused the streak of light to have appeared to rise vertically or nearly so. The closer that the streak of light appeared to a given witness, the greater the apparent motion of the streak of light to that witness. Further, the airplane’s relatively low elevation above the horizon570 could have led many witnesses to believe that they were observing a flare or fireworks. (As discussed previously, because of the absence of depth perception cues, witnesses who saw the airplane in crippled flight could not be expected to provide good information about how far away it was or its direction of travel.)571 As discussed in section 1.18.4.3, a witness’s perception of events is driven by context cues, experience, and expectations. The fact that it was July (a month often associated with fireworks) and that several flares had been launched in the area during the week preceding the accident could have led witnesses to 570 For example, to witnesses located 10 nm, 15 nm, or 20 nm (slant range) from the accident airplane, the airplane would appear about 13.1º, 8.7º, and 6.5º, respectively, above the horizon. Figure 45. A graphical illustration of the equidistance tendency.

Analysis 269 Aircraft Accident Report believe that they were seeing a flare or fireworks, which could also have led witnesses to believe, and subsequently report, that what they observed had originated from the surface, even though they did not actually see the object’s origination point. It is also possible that some of these witnesses may have actually observed one or more of the flares launched from boats in the area shortly after the wreckage impacted the water to direct attention to the accident site.572 Memory573 Research has shown that a person may unintentionally, and without awareness, create an inaccurate memory because of exposure to postevent information provided by other witnesses or media reports or because of expectations and beliefs. If misinformation is received from one of these sources, there is an increased likelihood that this misinformation will be assimilated and reported by the witness as a memory. Some witnesses’ recollections might have been influenced by exposure to other witnesses’ accounts; being interviewed together; engaging in conversations with other people; or hearing, watching, or reading media accounts of the crash (which included interviews with eyewitnesses and speculation about a missile strike.)574 In this regard, it is noteworthy that the documents recording the initial interviews of some witnesses did not indicate that these witnesses initially reported seeing a missile; however, these same witnesses have since indicated that they believe that a missile was used against TWA flight 800. Research has also shown that a witness’s confidence in the accuracy of his or her memory (even when it is inaccurate) increases over time and with repeated retrieval, which possibly explains why some witnesses displayed a high level of confidence in the accuracy of their reported observations. 2.2.2.2 Conclusion Regarding Reported Witness Observations Given the potential deficiencies in the witness documents, the potential inaccuracies in witnesses’ recollections, and the large number of witnesses whose observations were documented and studied in this case, the Safety Board did not expect all of the documented witness observations to be consistent with one another. Therefore, the 571 This is illustrated by the variation in the witness accounts regarding the direction of the motion of the streak of light (38 reported that it moved vertically; 45 reported that it moved to the east; 23 reported that it moved to the west; 18 reported that it moved to the south; and 4 reported that it moved to the north. Thirty-six of the streak-of-light accounts contained no information about the direction of the motion of the streak of light). 572 Although flares were launched after the accident sequence (and, therefore, would have appeared after the fireball), witnesses who also reported seeing a fireball may have recalled seeing the streak of light (flare) before the fireball because their memories of the accident sequence were influenced by postevent information provided by media reports or other witnesses or by other factors. (As discussed in section 1.18.4.3.2, research has shown that when asked to recall information about an event, people sometimes recall information about an event that occurred at a different time than the event about which they are questioned.) 573 For more information about storing information in and retrieving it from memory, see sections 1.18.4.3.1 and 1.18.4.3.2. 574 Many witnesses acknowledged that they did not even know that they had observed an airplane accident until after seeing media accounts of the accident.

Analysis 270 Aircraft Accident Report Board did not view these apparently anomalous witness reports as persuasive evidence that some witnesses might have observed a missile. Investigators determined that if witnesses had observed an actual missile attack on TWA flight 800 (beginning about the time that an airborne missile would have become visible to the time that the wreckage from TWA flight 800 fell into the ocean), they would have seen the following: (1) a light (the burning of the missile motor) ascending very rapidly and steeply for about 8 seconds (this rapidly moving light, which would have been visible for at least 12 nm575 from the launch point, would not descend like a firework or flare); (2) the light disappearing576 for up to about 7 seconds;577 (3) upon a missile (or warhead fragment) striking the airplane and igniting the fuel/air vapor in the CWT, another light (flames coming from the CWT), moving considerably slower and more laterally than the first light (although ascending somewhat for a short time), for about 30 seconds; (4) this light descending while simultaneously developing into a fireball falling toward the ocean. It is noteworthy that none of the witness documents included a description of such a scenario. Therefore, the Safety Board concludes that the witness observations of a streak of light were not related to a missile and that the streak of light reported by most of these witnesses was burning fuel from the accident airplane in crippled flight during some portion of the postexplosion, preimpact breakup sequence.578 The Board further concludes that the witnesses’ observations of one or more fireballs were of the airplane’s burning wreckage falling toward the ocean. 575 Although during some of the missile visibility tests the light from the burning missile motor was visible to witnesses who were positioned up to 14 nm from the launch point, the lighting conditions during those tests were darker than in earlier tests and, therefore, were not comparable to the lighting conditions at the time of the TWA flight 800 accident. For the tests conducted under lighting conditions that were comparable to those that existed at the time of the TWA flight 800 accident, no witnesses were positioned farther than 12 nm away from the launch site. 576 The Safety Board’s missile visibility tests indicated that, after completion of the motor burn, observers saw no visible evidence of the missile until it selfdestructed. 577 Because of the distance from which a hypothetical missile would likely have been launched, most direct-strike scenarios and any self-destruct scenario (for further discussion of a missile self-destruct scenario, see section 2.3.1.3) would require that the missile travel about 7 seconds in “coast” mode; therefore the missile would have been invisible before striking the airplane. Only if a missile had been launched from almost directly underneath the accident airplane (as close to vertically as possible) would the “coast” time have been significantly reduced or eliminated. 578 Central Intelligence Agency (CIA) analysts, who initially evaluated witness information provided by the FBI, also concluded that the majority of the witness observations must have occurred well after the initial explosion and, consequently, that none of those observations could have been of a missile causing the explosion. The CIA analysts concluded that the remaining witness accounts described events fully consistent with observations expected if only the airplane were being observed in various stages of crippled flight. The CIA analysts concluded that there was absolutely no evidence that a missile was employed to shoot down TWA flight 800.

Analysis 271 Aircraft Accident Report 2.2.3 Cause of the In-Flight Breakup On the basis of the accident airplane’s breakup sequence; wreckage damage characteristics; scientific tests and research on fuels, fuel tank explosions, and the conditions in the CWT at the time of the accident; and analysis of witness information, the Safety Board concludes that the TWA flight 800 in-flight breakup was initiated by a fuel/air explosion in the CWT. 2.3 Evaluation of Potential Ignition Sources In an attempt to determine what ignited the flammable fuel/air vapor in the CWT and caused the explosion, investigators evaluated numerous potential ignition sources. Possible ignition source scenarios fell generally into two main categories: (1) energy entered the CWT by way of fuel quantity indication system (FQIS) wiring (discussed in section 2.3.2) or (2) energy entered the CWT by other means (discussed in section 2.3.1). The minimum ignition energy (MIE) for Jet A fuel has been generally accepted to be about 0.25 millijoule (mJ)579 based on testing done by the American Petroleum Institute (API) and is documented in API Recommended Practice 2003 (API 2003), “Protection Against Ignitions Arising out of Static, Lightning, and Stray Currents,” fifth edition, December 1991. However, laboratory testing conducted at CIT using fuel similar to that used on the accident flight indicated that the energy needed to ignite Jet A fuel at an altitude of 13,800 feet ranged from 0.5 mJ (at 122° F) to 500 mJ (at 104° F). Therefore, this higher range of ignition energies was used as a reference for evaluating whether a particular potential ignition source could have ignited the fuel/air vapor in TWA flight 800’s CWT. However, investigators also considered the lower, generally accepted, MIE of 0.25 mJ to be relevant in evaluating whether a potential ignition source might pose an ignition hazard in other airplanes under different circumstances (for example, at different altitudes and temperatures). 2.3.1 Possible Ignition Sources Unrelated to the Fuel Quantity Indication System The Safety Board evaluated numerous potential ignition sources that could have ignited the fuel/air vapor in TWA flight 800’s CWT. Among the potential ignition sources considered by investigators that were unrelated to the FQIS were the following: a lightning or meteorite strike; a missile fragment; a small explosive charge placed on the CWT; auto ignition or hot surface ignition, resulting from elevated temperatures produced by sources external to the CWT; a fire migrating to the CWT from another fuel tank via the vent (stringer) system; an uncontained engine failure or a turbine burst in the air conditioning packs beneath the CWT; a malfunctioning CWT jettison/override pump; a malfunctioning CWT scavenge pump; and static electricity. 579 A mJ is one-thousandth of a joule (J), which is a measurement of electrical energy (1 J is the work done by 1 watt in 1 second).

Analysis 272 Aircraft Accident Report 2.3.1.1 Lightning Strike No witnesses reported that lightning struck the accident airplane or that lightning was in the area of TWA flight 800 at the time of the accident. Further, recorded meteorological data indicated no atmospheric disturbances in the area of TWA flight 800 at the time of the accident. Therefore, it is very unlikely that a lightning strike ignited the fuel/air vapor in the CWT. 2.3.1.2 Meteorite Strike An expert in the study of meteorites testified at the Safety Board’s public hearing that no report exists of a meteorite ever having struck an airplane. He testified that, given the known frequency with which meteorites have struck cars and dwellings over the past several decades and based on a comparison of estimates of (1) the area of the earth’s surface represented by cars and dwellings with (2) the area of the earth’s surface represented by airplanes in the air at any given time, he calculated that a meteorite could be expected to strike an aircraft once every 59,000 to 77,000 years. Further, none of the holes in the CWT or fuselage structure exhibited characteristics of high-velocity penetration through the exterior (such as outward metal deformation around the perimeter of the entry and exit sides of the hole, lack of overall deformation, and distinctive features of the hole wall surface) that would be expected from a meteorite strike.580 Therefore, it is very unlikely that a meteorite ignited the fuel/air vapor in the CWT. 2.3.1.3 Missile Fragment Although, as discussed in section 2.2.1.2, a missile-strike scenario was not supported by the physical evidence, investigators considered whether a missile might have selfdestructed close enough to TWA flight 800 for a missile fragment to have entered the CWT and ignited the fuel/air vapor, yet far enough away that it would not have left any damage features characteristic of a missile strike. According to missile performance data provided to the Safety Board by the Naval Air Warfare Center—Weapons Division (NAWC-WD), Survivability/Vulnerability Information Analysis Center, and Missile and Space Intelligence Center (MSIC), the warhead from a shoulder-launched missile will selfdestruct about 15 seconds after launch if no target has been hit,581 and missile warhead fragments are always dispersed in a predictable fragmentation pattern. Using the initial speed and decay rate for the missile warhead fragments, the Board calculated that a detonation would have to occur within 40 feet of an airplane for a fragment traveling perpendicular to the CWT to retain sufficient velocity to penetrate the CWT. In the case of a fragment traveling at an angle to the CWT, a detonation would have to occur even closer to the airplane. 580 Two holes in the horizontal pressure deck (above the left side of the wing landing gear bay) contained some features of both high-velocity and low-velocity penetrations. However, the physical features of both holes indicated that they were made by objects traveling from inside the airplane out, rather than the reverse. Therefore, neither hole could have been made by a meteorite. 581 The exact number of seconds after launch that a missile warhead will selfdestruct varies slightly, depending on the type of missile. The Safety Board’s analysis of the likelihood of this scenario would apply equally to missiles with a slightly longer or shorter self-destruct range.

Analysis 273 Aircraft Accident Report The Safety Board’s computer simulations using this missile performance data, which took into account the winds at the time of the accident, showed that the number of locations on the surface (all of which were on water) from which a missile launched at TWA flight 800 could have resulted in selfdestruction within 40 feet of the airplane were extremely limited. Simulations further showed that, because of the pattern in which missile warhead fragments are dispersed after selfdestruction, launches from many, if not most, of these positions would not result in fragments with a proximity and orientation sufficient to penetrate the CWT. Further, simulations also showed that a missile launch from one of the few sites that could potentially have resulted in a detonation at the proximity and orientation for a fragment to penetrate the tank and ignite the fuel/air vapor would have resulted in numerous fragments impacting the surrounding airplane structure with sufficient force to leave distinctive impact marks.582 No such impact marks were found on the accident airplane’s wreckage. In addition, a missile fragment would have had to penetrate multiple layers of material to enter the CWT, and, although some areas of fuselage skin and CWT structure are missing, possible straight-line entry paths were extremely limited. Further, as previously mentioned, none of the holes in the CWT or fuselage structure exhibited characteristics of high-velocity penetration through the exterior that would have resulted from a missile fragment.583 Therefore, it is very unlikely that a missile warhead selfdestructed at a distance close enough to the accident airplane that at least one fragment could have entered the CWT with sufficient force and velocity to have ignited the fuel/air vapor in the CWT, yet far enough from the airplane that almost none of the remaining fragments impacted its structure.584 2.3.1.4 Small Explosive Charge Another potential ignition source that investigators considered was the detonation of a small explosive charge585 that had been placed on the CWT that could have breached the fuel tank and ignited the flammable fuel/air vapor. However, testing by the Safety Board and the British Defense Evaluation and Research Agency in August 1997 at Bruntingthorpe Airfield, Leicestershire England, demonstrated that when metal of the 582 According to data from MSIC, upon detonation a warhead will release about 1,000 fragments of varying sizes, up to 40 grains (equivalent to 0.0916 ounce). 583 The features of the two holes in the horizontal pressure deck that displayed some features of high-velocity penetration indicated that they were made by objects coming from different directions; therefore, it is not likely that they originated from a common location. Further, as previously mentioned, the physical features of both holes indicated that they were made by objects traveling from inside the airplane out, rather than the reverse. Therefore, neither hole supports a scenario in which the fuel/air vapor in the CWT was ignited by the entry of a missile fragment. 584 A study by the NAWC-WD for the DoD’s Office of Special Technology also concluded that the probability of such a scenario was “extremely low.” According to the report, “[f]or a missile shooter to launch the weapon, the weapon to fly at the target, the target to be just beyond the kinematic envelope of the weapon, the warhead to be properly positioned at self-destruct, and one of the very few heavy fragments to impact in an area to penetrate the thick wing skin with enough residual energy to initiate an explosion is stretching credulity to the point that this scenario must be considered a low-priority area of concern.” 585 A small explosive charge is a minimal amount of a highly explosive material (such as a plastic explosive) detonated by a fusing device.

Analysis 274 Aircraft Accident Report same type and thickness as the CWT walls was penetrated by a small charge, there was petalling of the surface on which the charge was placed, pitting on the adjacent surfaces, and visible hot gas washing damage in the surrounding area. As discussed in section 2.2.1.2, none of these damage characteristics were found on the recovered CWT wreckage, and none of the areas of missing skin were large enough to represent the damage that would have been caused by the detonation of a small explosive charge. Therefore, it is very unlikely that a small explosive charge detonated on the CWT, breached the fuel tank, and ignited the fuel/air vapor. 2.3.1.5 Auto Ignition or Hot Surface Ignition Investigators also evaluated whether the surface of the CWT might have been heated to a high enough temperature to have caused ignition of the fuel/air vapor inside the tank as a result of auto ignition586 or hot surface ignition.587 Investigators considered whether an external mechanism, such as a bleed air leak near the CWT, a fire in the air conditioning pack bay beneath the CWT, or a fire in the main landing gear wheel well, could have raised a large volume of the CWT ullage above the auto ignition temperature or caused a localized hot spot on the interior of the CWT skin that could have reached hot surface ignition temperatures. However, a scenario in which a significant portion of the CWT volume was heated to auto ignition temperatures was not considered a credible possibility because the amount of heat that would have been necessary to raise the temperature of the entire (or at least most of the) CWT to 460° F or more would have almost certainly left significant evidence of thermal damage on the CWT.588 Further, for a hot spot approaching hot surface ignition temperatures (900° to 1,300° F) to have developed on the inside surface of the CWT, the temperature on the outside surface would have had to have been at least as high as these temperatures. However, these temperatures are near the softening and melting temperatures of the CWT’s aluminum skin; therefore, the CWT would have shown evidence of having been heated to these temperatures. As further discussed below, no evidence was found that indicated that the CWT reached auto ignition or hot surface ignition temperatures. Analysis of Boeing data indicates that multiple engine malfunctions could produce bleed air temperatures above 800° F at the engines. However, the accident airplane’s 586 Auto ignition can occur when a large volume of Jet A fuel/air vapor is sufficiently elevated in temperature without direct contact with an ignition source, such as a spark, arc, or hot surface or filament. Auto ignition is highly dependent upon many factors, including the size of the heated volume and container and other environmental conditions that affect fuel vapor. Existing research indicates that the auto ignition temperature at sea level for Jet A fuel is about 460° F. Auto ignition temperature increases as the altitude increases. 587 Hot surface ignition can occur when a very high temperature surface comes into contact with Jet A fuel or fuel/air vapor. Hot surface ignition is highly dependent upon many factors, including the geometric aspects of the hot surface and other environmental conditions that affect fuel and fuel/air vapor. Existing research indicates that hot surface ignition temperatures at sea level for fuels similar to Jet A range from 900° to 1,300° F. Hot surface ignition temperature increases as the altitude increases. 588 Knowledge of the CWT thermodynamic environment, derived in part from the JFK flight tests and the Marana, Arizona, ground tests, indicates that such temperatures would most likely not be reached.

Analysis 275 Aircraft Accident Report engines, all of which were recovered and extensively examined, showed no evidence of any failure or malfunction. Further, engineering data from Hamilton Standard (the manufacturer of the air conditioning system) and Boeing indicated that the combination of failures required to produce such elevated bleed air temperatures589 would also have caused an overpressure leading to an air conditioning duct burst. However, the reconstructed air conditioning packs showed no evidence of leakage in the packs or ducts. In addition, no discussion of an overheat or other warning590 was recorded by the CVR, which would be expected if excessive bleed air temperatures or any other failure occurred, especially with two flight engineers in the cockpit.591 Investigators also considered whether a fuel leak from the CWT or the inboard fuel tanks onto the hot air conditioning packs beneath the CWT could have caused a fire in the pack bay or main landing gear wheel well and subsequent auto ignition or hot surface ignition of the fuel/air vapor in the CWT. (The Safety Board is aware of at least one report of fuel leaking into the air conditioning pack bay in a 747.) However, no fire damage was observed on the first two packs (and surrounding material) to depart the airplane (those found in the red zone),592 nor on the fairings from underneath the packs, which would be expected if the packs had been exposed to a fire of sufficient heat and intensity to have raised a large volume of the temperature inside the CWT to 460° F or to have heated a spot on the interior surface to more than 900° F. Although there was fire damage to the wheel well, the burning and soot in that area had a flow pattern that could be traced from the fuel tank to the wheel well, indicating that the fire in the CWT preceded the fire in the wheel well. Further, the tires from the wheel well showed only limited localized heat damage, contrary to what would be expected if they had been exposed to a fire of sufficient heat and intensity to have raised a large volume of the temperature inside the CWT to 460° F or to have heated a spot on the interior surface to more than 900° F. Therefore, it is very unlikely that the fuel/air vapor in the CWT ignited as a result of either auto ignition or hot surface ignition caused by elevated temperatures produced by sources external to the CWT. 2.3.1.6 Fire Migration Through the Vent System Because the fuel vent system on the 747 permits communication between fuel tanks, investigators considered the possibility that a fire originating in one of the other fuel tanks might have entered the CWT through the fuel vent system. However, the fuel vent system’s design is such that if a flame had propagated through the vent system, it would 589 Concurrent failures of the (1) engine bleed air pressure relief valve, (2) precooler cooling airflow control valves, and (3) pylon shutoff and regulating valve would be required. 590 The failures required to produce such excessive bleed air temperatures would have activated engine malfunction and excessive bleed air temperature warnings from sensors installed both inside and outside the bleed air ducts. 591 It is evident from the captain’s remark on the CVR about the “crazy” No. 4 fuel flow that the flight crew was attentive to the gauges and other indications on the instrument panel. 592 The third pack, which was recovered from the green zone, had fire damage. However, this damage was likely the result of the severe fire(s) that affected the WCS and surrounding structure during the remainder of the breakup sequence, most notably after the separation of the left wing.

Analysis 276 Aircraft Accident Report have had to have traveled through the wing tip surge tank to meet the vents from the other fuel tanks. The surge tank overboard vents are equipped with a surge tank protection (STP) system, which includes a photocell in each overboard vent designed to trigger the discharge of Halon (a fire extinguishing agent) into the surge tank when a flame or bright light source is sensed at an overboard vent. The accident airplane’s Halon bottles were found undischarged.593 More importantly, temperature measurements taken during the 1997 flight tests at JFK showed that at 13,800 feet, the fuel/air vapor in the section of the vent system leading to the wing tips would have cooled to the point that it could not sustain a flame. Therefore, it is very unlikely that a fire originating in another fuel tank migrated through the fuel vent system to the CWT and ignited the fuel/air vapor. 2.3.1.7 Uncontained Engine Failure or Turbine Burst Investigators also considered the possibility that an uncontained engine failure or a turbine burst in the air conditioning packs beneath the CWT caused debris to enter the tank with sufficient velocity to ignite the vapors. However, the engines and reconstructed packs showed no evidence of an uncontained engine failure or turbine burst. Therefore, it is very unlikely that an uncontained engine failure or a turbine burst in the air conditioning packs ignited the fuel/air vapor in the CWT. 2.3.1.8 Malfunctioning Jettison/Override Pump Investigators also considered the possibility that a jettison/override pump malfunction produced a spark that ignited the fuel/air vapor in the CWT. Both pumps from the CWT were recovered and tested. One pump had evidence that indicated that the impeller had contacted the impeller housing. However, tests conducted in connection with the investigation of the May 11, 1990, accident involving a CWT explosion on a Philippine Airlines 737 indicated that galling of the aluminum impeller against the impeller housing would not result in ignition of flammable vapor. The other pump showed no evidence of any malfunction or overheating that could have caused the vapor in the pump to ignite. There were no comments or sounds on the CVR indicating that the pumps were used (and there would have been no reason for them to have been used because there was no usable fuel in the CWT). However, even if the pumps were used and a pump motor had malfunctioned or overheated, this would not likely have ignited the fuel/air vapor in the CWT because of the flame suppression system incorporated into the pump design. When vapors in the motor housings of both an old and a new scavenge pump (which have a flame suppression system similar to that in the jettison/override pumps) were ignited in postaccident testing, the test pump flame suppression systems consistently functioned as designed and prevented sparks or flames from escaping from the pump motors and igniting flammable vapors outside the pumps. (In some tests, even after investigators 593 It should be noted that the STP system is designed, and the Halon bottles are configured, to protect against flames entering the airplane from the outside. Therefore, even though the passage of a flame through the surge tank would likely have triggered discharge of the Halon, the flames would not likely have been extinguished by the Halon.

Analysis 277 Aircraft Accident Report removed part of the flame suppression system to simulate conditions found in some malfunctioning pumps,594 the remaining parts of the system still prevented ignition of the surrounding flammable vapor.) Further, in previous instances in which arcing has occurred in jettison/override pump motors, the flame suppression system has prevented a flame from entering the fuel tank and igniting the fuel/air vapor.595 Therefore, it is very unlikely that a jettison/override pump malfunction ignited the fuel/air vapor in the CWT. 2.3.1.9 Malfunctioning Scavenge Pump Investigators also considered the possibility that a scavenge pump malfunction could have produced the ignition energy for the CWT explosion. The motor and impeller were not recovered and, therefore, could not be examined for signs of fire or overheating. However, the recovered control switch had damage indicating that it was in the “Off” position at impact, suggesting that the pump was not operating at the time of the explosion and, therefore, could not have provided an ignition source. However, even if the pump had been on596 and a flame had developed inside the pump’s motor housing, it is still unlikely that the flame could have entered the tank.597 Although examination of a section from the recovered scavenge pump inlet tube (which draws fuel from the CWT into the pump) revealed some darkened areas on the tube, there was insufficient evidence to determine whether this damage occurred as part of the initial event or later in the accident sequence. However, as previously discussed, when vapors in the motor housings of both an old and a new scavenge pump were ignited in postaccident testing, the test pump flame suppression systems consistently functioned as designed and prevented sparks or flames from escaping from the pump motors and igniting flammable vapors outside the pumps. Examination also found no evidence of extreme localized overheating (such as heat damage or discoloration to the flange/spacer between the pump and the rear spar or splatter on surrounding structure from a hole arced through the motor housing), which could have resulted in ignition of the fuel/air vapor inside the CWT. Therefore, although a CWT scavenge pump malfunction could not be entirely ruled out as a possible ignition source for the CWT explosion, there is no evidence that such a malfunction ignited the fuel/air vapor in the CWT. 594 The flame suppression system consists of a small-diameter tube in series with a check valve. Tests were run with one or the other component removed. 595 For example, 18 jettison/override pumps that had experienced arcing in the motor were examined by Boeing for evidence of sulfide deposits. (See Systems Group Chairman’s Factual Report Addendum, “Deposits on Fuel Tank Electrical Components.”) None of these pumps had ignited the vapor in the pump. 596 Investigators recognized the possibility that the switch might have moved to the “Off” position sometime during the breakup sequence. However, there were no comments on the CVR indicating that the flight crew was activating the CWT scavenge pump. Such an action would have been highly unusual given that the tank was not in use and, therefore, would likely have generated some comment from one or both of the flight engineers. 597 The scavenge pump motor is mounted on the outside of the CWT, on the aft of the rear spar, and cooling fuel is drawn from the tank through small-diameter tubes.

Analysis 278 Aircraft Accident Report 2.3.1.10 Static Electricity Investigators also theorized that electrically isolated parts in the CWT598 could become so highly charged from static electricity (generated by fuel striking the part or from fuel moving through the fuel lines) that a discharge between such a part and a nearby grounded fuel tank component could create a spark of sufficient energy to ignite the fuel/air vapor in the tank. The Safety Board contracted with the U.S. Air Force (USAF) Research Laboratory (AFRL) at the Wright Patterson Air Force Base and with the Naval Research Laboratory to conduct tests to assess the electrostatic charging capabilities of several electrically isolated components commonly found in aircraft fuel systems. This testing revealed that unbonded Teflon-cushioned wire clamps (found in the 747 CWT and inboard main fuel tanks) were particularly susceptible to electrostatic charging. However, the highest voltage potential attained in testing that used fuel similar to that used on the accident flight was 650 volts, which it was estimated would produce a discharge energy of only about 0.0095 mJ.599 Even assuming that the clamp could attain a voltage of 1,150 volts (which was produced in tests using fuel of a higher conductivity than the fuel in the CWT on TWA flight 800), the highest discharge energy that voltage could produce was estimated to be about 0.030 mJ, which is still well below the 0.25 mJ MIE for Jet A fuel vapor. Therefore, on the basis of the evidence from the TWA flight 800 investigation and research and testing to date, it is very unlikely that static electricity ignited the fuel/air vapor in the CWT. Nonetheless, the Board recognizes that the discharge of static electricity has resulted in prior fuel tank explosions600 and cannot rule out the possibility that, under some conditions, static electricity could produce sufficient energy to ignite the flammable vapor in a fuel tank. The findings from this investigation raised concerns regarding the adequacy of bonding protection against high-energy discharges, such as from lightning (or perhaps from refueling). The Safety Board is concerned about the Boeing design practice that permits parts that are less than 3 inches long in any direction (including some types of clamps and connectors installed in fuel tanks) to be electrically unbonded. Tests conducted by Boeing after two fuel tank explosions in 1970 found that a single unbonded clamp could store up to 5 mJ of energy during the increased fuel flow rates associated with ground refueling.601 Further, according to the FAA’s Aircraft Lightning Protection Handbook, unbonded clamps could present an ignition hazard in the event of a lightning 598 Certification standards only require that “major components” of the powerplant installation be electrically bonded to the other parts of the airplane. See 14 Code of Federal Regulations (CFR) 25.901(b)(4). According to a June 2, 2000, letter to the Safety Boeing, Boeing design practices permit parts that are less than 3 inches long in any direction (including some types of clamps and connectors installed in fuel tanks) to be electrically unbonded, presumably because such parts are not believed to have enough capacitance to retain hazardous levels of static electricity under expected operating conditions. 599 A volt is the basic unit of measurement of electromotive force (the force that causes electrons to flow through a conductor). As previously mentioned, a J is a measurement of electrical work or energy. Power (watts or J/seconds) is related to voltage through V2/R, or the square of the voltage divided by the resistance, measured in ohms. 600 The July 23, 1998, report of the Aviation Rulemaking Advisory Committee (ARAC) Fuel Tank Harmonization Working Group (FTHWG) and API 2003 cite several previous fuel tank explosions believed to have been caused by static electricity.

Analysis 279 Aircraft Accident Report strike. The Safety Board concludes that Boeing’s design practice that permits parts less than 3 inches long in any direction to be electrically unbonded may not provide adequate protection against potential ignition hazards created by static electricity or electricity generated by lightning. Because the Board is concerned that other manufacturers’ design practices may not be adequate, the Safety Board believes that the FAA should examine manufacturers’ design practices with regard to bonding of components inside fuel tanks and require changes in those practices, as necessary, to eliminate potential ignition hazards. 2.3.1.11 Conclusion Regarding Ignition Sources Unrelated to the Fuel Quantity Indication System In summary, the Safety Board concludes that it is very unlikely that the flammable fuel/air vapor in the CWT on TWA flight 800 was ignited by a lightning or meteorite strike; a missile fragment; a small explosive charge placed on the CWT; auto ignition or hot surface ignition, resulting from elevated temperatures produced by sources external to the CWT; a fire migrating to the CWT from another fuel tank via the vent (stringer) system; an uncontained engine failure or a turbine burst in the air conditioning packs beneath the CWT; a malfunctioning CWT jettison/override pump; a malfunctioning CWT scavenge pump; or static electricity. 2.3.2 Introduction of Ignition Energy Through the Fuel Quantity Indication System The only electrical wiring located inside the CWT is the wiring associated with the FQIS.602 According to Boeing design specifications, the voltage to the FQIS wiring is limited so that it cannot discharge energy in excess of 0.02 mJ. Therefore, for the FQIS to have played a role in igniting the flammable fuel/air vapor in the CWT, the following two events would have had to have occurred: (1) a transfer of a higher-than-intended voltage onto FQIS wiring from a power source outside of the fuel tank and (2) the release of the energy from that FQIS wiring into the inside of the tank in a way that could ignite the fuel/air vapor in the tank. 2.3.2.1 Transfer of Energy to the Fuel Quantity Indication System Wiring Outside the Center Wing Tank 2.3.2.1.1 Electromagnetic Interference Investigators examined several possible ways by which energy (from either outside or inside the airplane) might have been transferred to the FQIS by electromagnetic interference (EMI). One possibility explored was that radiated electromagnetic energy 601 These test results were reported to the FAA during a March 11, 1971, meeting regarding electrostatics during refueling and were summarized in a March 16, 1971, FAA memorandum that documented the results of that meeting. 602 Although the fuel pump motor cavities contain wiring, they are separated from the CWT by flame suppression passages and other parts.

Analysis 280 Aircraft Accident Report from radio frequency (RF) transmitters outside the airplane could couple to FQIS wiring. However, the National Aeronautics and Space Administration’s (NASA) Langley Research Center (LaRC) study of the RF sources present in the electromagnetic environment (EME) at the time of the TWA flight 800 accident concluded that, even assuming that the highest possible electromagnetic signal levels were being emitted by these sources at the time of the accident, the maximum available energy inside the airplane (but not on the wires) from these signal levels would be less than 0.1 mJ. The study further noted that any such energy that coupled to aircraft wiring inside the airplane would be several orders of magnitude less than 0.1 mJ. Therefore, although it is conceivable that under different circumstances a significantly stronger EME than was present at the time of the TWA flight 800 accident might present an ignition hazard, the Safety Board concludes that EMI from RF sources external to TWA flight 800 did not produce enough energy to ignite the fuel/air vapor in the CWT. The Safety Board also considered the possibility that power was transferred from personal electronic devices (PED) to the FQIS wiring. Therefore, at the Board’s request, NASA LaRC scientists also studied the electromagnetic force that could be generated by PEDs. The study found that the strongest electrical signal that could be coupled to the FQIS wiring from PEDs was about one-tenth of the minimum power level required in laboratory tests to induce a spark from the FQIS by applying a simulated arc gap.603 Therefore, the Safety Board concludes that EMI from PEDs played no role in igniting the fuel/air vapor in TWA flight 800’s CWT. Finally, the Safety Board examined the possibility that a transient voltage/current spike from wiring associated with higher-voltage aircraft systems could be induced onto corouted FQIS wiring. Early in the investigation during laboratory tests, Boeing was able to induce transient voltages in excess of 1,000 volts (estimated to be capable of producing 0.6 mJ of energy) in FQIS wiring. However, these tests did not accurately represent the voltage sources that would exist in an actual airplane. More comprehensive testing was conducted by the Naval Air Warfare Center–Aircraft Division on an airplane using actual airplane systems, in which transient voltages were created in an energized FQIS by switching the power to the aircraft systems on and off. In those tests, the maximum energy released by FQIS wiring inside the fuel tank when a discharge mechanism was provided (by placing conductive debris across FQIS fuel probe terminals) was 0.125 mJ. This is significantly less than the 0.5 to 500 mJ that would have been needed to ignite the Jet A fuel/air vapor in TWA flight 800’s CWT and only half of the generally accepted MIE level for Jet A fuel (0.25 mJ). Therefore, the Safety Board concludes that it is unlikely that EMI from aircraft system wiring played a role in igniting the fuel/air vapor in TWA flight 800’s CWT. 603 One watt was required to induce a spark during laboratory tests.

Analysis 281 Aircraft Accident Report 2.3.2.1.2 Short Circuiting 2.3.2.1.2.1 Possible Short-Circuit Energy Transfer Mechanisms Excess voltage from a short circuit can be transferred from wires carrying higher voltage to wires carrying lower voltage if the wires are near each other. Wires carrying high voltage can be placed near FQIS wires both in common wire bundles and at connectors in various locations. The investigation found that Boeing design specifications permit FQIS wiring to be bundled with, or routed next to, higher-voltage airplane system wires, some carrying as much as 350 volts.604 In addition, Safety Board examinations of other transport-category airplanes, including several 747s, found that high-voltage wires can be corouted with FQIS wires in ways that do not comply with the manufacturer’s production illustrations (PI) and/or are not consistent with the guidance in Boeing’s Standard Wiring Practices Manual (SWPM). These noncompliant wiring configurations can be installed at the time of manufacture or during subsequent maintenance activities. The CWT FQIS wiring in the 747 terminates at common connectors with the fuel quantity indicator, the totalizer gauge, the airborne integrated data system (AIDS), the volumetric shutoff (VSO), and the left wing refueling station; each of these connectors also includes terminating wires from circuits that carry 115 volts.605 (See figure 46.) Short circuits in connectors have caused incidents in the past. For example, an October 22, 1995, incident involving roll/yaw oscillations on a 737 near Manchester, England, was attributed to a short circuit in the rudder circuitry of the incident airplane that resulted from lavatory fluid bridging the pins within an electrical conductor. A short circuit can occur if the wire’s internal conductors are accessible/exposed and there is either (1) direct contact between the conductors or (2) a bridge between the conductors, created by contaminants, such as metal shavings or fluid.606 Conductors inside electrical connectors are, of necessity, always accessible (because a connector is designed to join wires in a continuous electrical path), and conductors outside connectors can become exposed as a result of cracking or other damage to wire insulation. The investigation found that damaged and/or contaminated wire insulation is widespread in older transport-category airplanes and also exists in new airplanes. Specifically, Safety Board examinations of wiring on 26 airplanes of varying ages (ranging from new to 604 Most airplane systems carry 115 volts, but in the Safety Board’s examinations of numerous transport- category airplanes, lighting circuits of 192 and 350 volts were found in bundles that also contained wiring associated with the FQIS. Even higher voltage wires exist in these airplanes (such as for strobe lights, fluorescent lighting starting circuits, and radios), but none were found routed with FQIS wires. 605 Although the Safety Board is not aware of FQIS wires sharing connectors with wires carrying more than 115 volts, Boeing specifications also permit FQIS wiring to be mixed in common connectors with airplane system wires carrying up to 350 volts. 606 Testing conducted for the Safety Board by Lectromec demonstrated that current peaks of more than 100 amperes (amp), which released 2 to 4 J of energy (of which about 400 mJ could be transferred to a victim wire), could be produced on wires protected by 10-amp circuit breakers when short circuits were created by dripping either water or lavatory fluid onto damaged wires. (For more information about this testing, see section 1.16.6.2.)

Analysis 282 Aircraft Accident Report Components:

1. Depicts seven capacitive fuel probes wired in parallel.
2. CWT Compensator
3. T347 Terminal Strip
4. Splice located behind Flight Engineer panel
5. Resistor
6. Fuel Flow #4 wire bundle route to forward panels,

as shown in Production Illustration. Notes: A. Wires shown parallel are routed together or in parallel bundle. B. Component locations and wire relationships are approximate and shown for relation (not to scale). C. Lighter areas depict where wires were not recovered. D. Bold line depicts HI-Z circuit and circuits directly connected. Parallel CVR Wires Pressure Refueling Panel 4. 6. CWT GAGE TOTAL- IZER FUEL FLOW VSO CMPTR FUEL FLOW CMPTR Left Wing Right Wing Wiring Behind Galley C, Beneath Floor AIDS UNIT 3. 5. 2. 1. To Engine #4 Figure 46. Diagram of the center wing tank fuel quantity indication system wiring on the 747 and its common connectors.

Analysis 283 Aircraft Accident Report 28 years old) revealed that all of the older airplanes exhibited numerous examples of mechanically damaged, chafed, cracked, and contaminated wires. The examinations also found sharp-edged metal drill shavings (which can damage wire insulation), fluid stains, and other potentially hazardous material in or near the aircraft wiring of old and new airplanes. The Safety Board is aware of several incidents that resulted from short circuits apparently created by contaminants.607 In addition, Board-sponsored testing at Lectromec showed that contaminants, such as water, lavatory fluid, and metal shavings, can create a mechanism that can allow energy to inadvertently transfer between wires with cracked or damaged insulation. The tests demonstrated that fluids could migrate between wires with cracked or damaged insulation, reaching copper conductors at the sites of existing insulation damage, and become a mechanism for the intermittent transfer of short bursts of energy (referred to by Lectromec as “flashing” or “scintillations”) for as long as 25 minutes without tripping circuit breakers. Further, the tests revealed that metal shavings could cut through insulation and unintentionally transfer energy from one wire to another wire in a bundle (or at a connector) when the shavings contacted two bare conductors. Finally, in addition to the possibility of a short circuit to the CWT’s FQIS wiring, there are several ways in which a short circuit to FQIS wires associated with fuel tanks other than the CWT could transfer energy to the CWT. First, in the totalizer gauge on the accident airplane, the wires attached to the connector pins for the right wing main tank FQIS and the CWT FQIS had been improperly soldered together and had subsequently cracked apart. During examination of the gauge at Honeywell, it was determined that electrical energy would cross the crack in the solder between the connector pins when slightly more than 270 volts (less than is used in lighting circuits) was applied to one of the pins.608 Second, the routing of the right wing FQIS wires to a connection in the CWT (at terminal strip T347)609 created another possible mechanism by which a short circuit from a higher-voltage wire in the right wing FQIS wiring could have carried excessive voltage to the CWT. A third way in which excess energy from another tank’s FQIS wiring could enter the CWT was demonstrated during postaccident evaluation of wiring paths on a retired 747; an electrical signal that was placed on the CWT FQIS wiring was also detected on wiring from the left wing FQIS, indicating that the two sets of wiring were not electrically isolated. Thus, a short circuit from a higher-voltage wire to left wing FQIS wiring could result in excess energy being transferred to the CWT. 2.3.2.1.2.2 Adequacy of Existing Circuit Protection Systems As previously discussed, short circuits can transfer energy from higher-voltage wires to lower-voltage FQIS wires and become a potential fuel tank ignition hazard. More 607 For more information about these incidents, see section 1.18.2.3. 608 Although no 270-volt circuits were identified in the wings of any airplanes examined, the PIs for the accident airplane showed right wing FQIS wires were routed through the fuselage in bundles that contained 350-volt lighting circuits. 609 This same terminal strip installation was found to have sulfide deposits in two other 747s.

Analysis 284 Aircraft Accident Report commonly, short circuits can cause sparks that can ignite lint or other flammable materials and cause secondary damage to other aircraft system wires. To minimize or eliminate the damage caused by short circuits, wiring circuits can be protected by one or more of the following methods: (1) circuit breakers (either the standard, thermally activated type or the recently developed processor-based arc-fault circuit breakers [AFCB]); (2) electrical resistors; (3) shielding and/or physical separation of wires; and (4) transient suppression devices (TSD), such as surge protection systems. The Safety Board evaluated each of these methods to determine whether they could provide adequate protection to FQIS wiring circuits by preventing short circuits to those wires from becoming potential fuel tank ignition hazards. 2.3.2.1.2.2.1 Circuit Breakers The design of thermally activated circuit breakers permits higher-than-desired current to pass through the wire during normal operation before sufficient heat is generated to interrupt the circuit (trip the circuit breaker). The level of heat required to trip the circuit breaker is a function of not only amperage and voltage, but also the duration of the event. Thus, higher-than-desired current may flow through the wire, intermittently, for long periods of time without tripping the circuit breaker. As previously mentioned, testing conducted for the Safety Board by Lectromec demonstrated that current peaks of more than 100 amps, which released 2 to 4 J of energy610 (of which about 400 mJ could be transferred to a victim wire), could be produced on wires protected by 10-amp circuit breakers when short circuits were created by dripping either water or lavatory fluid onto damaged wires. Further, intermittent short circuits existed for as long as 25 minutes without tripping circuit breakers. Therefore, because the energy levels transmitted during these types of electrical activity are high enough to ignite flammable fuel/air vapor in a fuel tank, thermally activated circuit breakers cannot be relied upon to prevent short circuits to FQIS wires from becoming potential fuel tank ignition hazards. The Safety Board is aware that the FAA and industry have been working to develop processor-based AFCBs that would trip the circuit breaker within the first milliseconds of a higher-than-desired energy transfer. Such protection systems would represent an improvement over thermally activated circuit breakers because they would minimize the amount of time that current would be permitted to flow through a short circuit (such as occurs in arc-tracking) and, therefore, also minimize the amount of fire and system damage following a short-circuit event. Therefore, the Board supports the continuation of efforts to develop this technology and will follow those efforts with interest. However, the Board remains concerned that even the short duration of time that energy is permitted to transfer by such systems might still allow the transfer of enough energy to FQIS wiring to ignite flammable fuel/air vapor in a fuel tank. Therefore, it is unclear whether processor-based AFCBs could adequately prevent short circuits to FQIS wiring from becoming potential fuel tank ignition hazards. 610 On one occasion, 90 J were released during a 40-millisecond succession of flashes.

Analysis 285 Aircraft Accident Report 2.3.2.1.2.2.2 Electrical Resistors A resistor limits the amount of current (amperage), and thus power, that can pass through it. According to Boeing, protective resistors in the components connected to 747 CWT FQIS wiring (fuel quantity gauges, the VSO unit, AIDs, and fuel quantity totalizer gauge) limit the amperage from an internal short circuit to about 1 milliamp. Therefore, although each of those components includes a 115-volt circuit, the amount of energy transferred to the CWT FQIS wiring as a result of an internal short circuit would be too small to ignite the fuel/air vapor in the CWT. However, as previously discussed, there are many ways in which a short circuit outside of these components could transfer energy to FQIS wiring. Because resistors are designed to limit current with a known voltage, they are not appropriate devices to prevent short circuits to FQIS wiring from a variety of possible voltage sources. 2.3.2.1.2.2.3 Shielding and Physical Separation of Wires As discussed in the Safety Board’s April 7, 1998, safety recommendation letter to the FAA, shielding and physical separation of FQIS wires from other wires can be an effective means of preventing the transfer of potentially hazardous levels of energy to FQIS wires from higher-voltage wiring. In that letter, the Board issued Safety Recommendation A-98-38, which asked the FAA to Require in Boeing 747 airplanes, and in other airplanes with FQIS wire installations that are corouted with wires that may be powered, the physical separation and electrical shielding of FQIS wires to the maximum extent possible. In response, the FAA initiated two notice of proposed rulemakings (NPRM) that subsequently led to the issuance of airworthiness directives (AD) to require shielding and separation of FQIS wiring on 747 and 737 airplanes.611 Regarding other airplane types, the FAA indicated that advisory material being developed in connection with the fuel tank design reviews proposed in NPRM 99-18612 would include information “describing the use of wire separation and electrical shielding to protect FQIS wiring from short circuits…and other failures and malfunctions that could induce high electrical energy on FQIS wires that enter fuel tanks.” In its February 9, 1999, response, the Safety Board expressed concern about the adequacy of Boeing’s wire separation standard (discussed further below) and stated that, pending receipt of further details regarding this separation standard and planned activities for other airplane models, Safety Recommendation A-98-38 was classified “Open—Acceptable Response.” Although airplane manufacturers generally provide protection for certain critical electrical circuits, there is no FAA regulation that specifies wire separation criteria or identifies which circuits must be protected. In their evaluation of the adequacy of the wire 611 The NPRMs proposed the installation of TSDs as an optional or additional requirement. Although the final ADs did not include TSDs as an alternative, the FAA indicated in correspondence related to Safety Recommendation A-98-39 that it will nonetheless permit TSDs as an alternate means of compliance. 612 For more information about this NPRM, see section 1.18.3.4.3.

Analysis 286 Aircraft Accident Report separation that would be required by the two ADs, Safety Board investigators reviewed the general wire separation standards and practices of several airplane manufacturers and found that these standards are not uniform. For example, Douglas Aircraft Company specified that wiring for certain systems (including FQIS and other fuel system wiring, fire warning system wiring, primary generator feeder cables, and electro-explosive devices) must be separated by at least 3 inches from other electrical wiring. In contrast, Boeing specifications do not require protection for some of the systems specified by Douglas (such as the FQIS), and, for those systems that are designated as protected, the required separation distance is only 1/4 inch in pressurized areas and 1/2 inch in unpressurized areas. The potential for short circuits to damage nearby wiring (more than 1 1/2 inches away) has been documented in Safety Board investigations of numerous accidents and incidents.613 The Safety Board concludes that existing standards for wire separation may not provide adequate protection against damage from short circuits. Therefore, the Safety Board believes that the FAA should review the design specifications for aircraft wiring systems of all U.S.-certified aircraft and (1) identify which systems are critical to safety and (2) require revisions, as necessary, to ensure that adequate separation is provided for the wiring related to those critical systems. 2.3.2.1.2.2.4 Transient Suppression Devices TSDs limit the amount of energy or current that can pass through them to a predetermined amount. In its April 7, 1998, safety recommendation letter to the FAA, the Safety Board indicated that, because of the number of potential latent ignition sources in fuel tanks, the many means by which energy can be introduced into FQIS wires, and the difficulty of achieving complete wire separation and shielding in in-service airplanes, TSDs (referred to in that letter as “surge protection systems”) may be the most effective method of preventing FQIS wiring from becoming an ignition source. The Board noted that if such devices were installed where FQIS wires enter fuel tanks, they could provide added protection against excessive power surges in the FQIS system, regardless of origin. Accordingly, the Board issued Safety Recommendation A-98-39, which asked the FAA to Require, in all applicable transport airplane fuel tanks, surge protection systems to prevent electrical power surges from entering fuel tanks through FQIS wires. In its June 10, 1998, response, the FAA indicated that it had issued NPRMs proposing to require, on 747s and 737s, installation of TSDs and/or installation of wire shielding and separation of the electrical wiring of the FQIS located outside of the fuel tanks. In its February 9, 1999, response, the Safety Board stated that wire shielding and 613 For example, during postincident inspection of a shorted wire bundle after a January 9, 1998, incident aboard a United Airlines 767 en route from Zurich, Switzerland, to Washington Dulles International Airport in which the flight crew made a precautionary landing at London Heathrow International Airport after experiencing multiple display errors and tripped circuit breakers, power was inadvertently reapplied and arcing resumed, but it did not trip any additional circuit breakers. However, this event damaged dozens of wires, some more than 1 1/2 inches away, and also burned printed circuit tracks from cards located in another section of the electronics compartment.

Analysis 287 Aircraft Accident Report separation alone could not protect against the entry of power from sources attached to FQIS wires and noted that FQIS wires share common connections with some higher-voltage circuits. The Board urged the FAA to reconsider its response to this safety recommendation. On the basis of the FAA’s decision not to require TSDs, the Board classified A-98-39 “Open—Unacceptable Response.” In its November 3, 1999, and May 17, 2000, letters, the FAA indicated that on the basis of comments received on the NPRM, it had initially determined that TSD technology was not sufficiently developed for application to in-service airplanes and that wire separation and shielding provided a better design solution for protection of FQIS wiring. The FAA also stated that the requirement for separation and shielding of electrical circuits would apply to all portions of the circuit (including those portions within connectors and components). Regarding the reliability of TSDs, the FAA indicated in its November 3, 1999, letter that it had been particularly concerned about comments that it had received on the NPRM regarding the potential for latent failure modes and the introduction of error in fuel quantity indications. However, the FAA further stated that several manufacturers had subsequently expressed interest in developing TSD technology as a possible alternate means of compliance with the ADs and that approval of TSDs would be considered. The FAA indicated that it had started determining appropriate requirements for such approval. The FAA further indicated that it did not plan to propose a requirement for both circuit separation and shielding and the installation of TSDs and that it believed either design, executed properly, would adequately ensure that high-energy signals are not introduced on wiring inside fuel tanks. In its May 17, 2000, letter to the Safety Board, the FAA stated that the requirements for approval of a TSD design will include demonstrating that the device will limit the transfer of energy and power through the wires that enter a fuel tank to intrinsically safe levels (limited to less than spark energy and filament heating limits that could create an ignition spark or a hot surface ignition source in a fuel tank). According to the FAA,614 in connection with approving TSDs as an alternate means of compliance, it will be assumed that failure of the TSD will result in catastrophic consequences. Therefore, it appears that for a TSD design to receive approval, it would have to be shown that the possibility of any such failure is extremely improbable, as defined in Advisory Circular (AC) 1309-1A. As will be discussed in section 2.4.2, the FAA has initiated rulemaking to require minimizing fuel tank flammability in newly designed airplanes and is evaluating methods to reduce flammability in existing designs. If flammability in existing and future transport- category airplanes were eliminated or reduced (to the maximum extent technologically feasible), the Safety Board would agree with the FAA that either TSDs or separation and shielding, if executed properly, will provide adequate protection against introduction of excess energy to wiring inside fuel tanks.615 Therefore, pending the timely completion of 614 See Issue Paper P-1, “FQIS Transient Suppression Device/Unit for Installation on Boeing Model 747-100, -200, SP and SR Series Airplanes,” dated January 13, 2000.

Analysis 288 Aircraft Accident Report the FAA’s actions to eliminate or reduce (to the maximum extent technologically feasible) flammability, Safety Recommendations A-98-38 and -39 are classified “Open— Acceptable Response.” 2.3.2.1.2.3 Factors Suggesting the Likelihood that a Short-Circuit Event Occurred on TWA Flight 800 Much of the insulation on the wiring recovered from the accident airplane was cracked or otherwise damaged, often exposing the inner conductor. When powered, such damaged wires would be vulnerable to short-circuiting. Although some of the damage to the accident airplane’s wiring insulation probably occurred as a result of the accident or search and recovery operations, the degraded condition of wiring insulation found during inspections of other transport-category airplanes of about the same age as the accident airplane (and representing numerous different operators) suggests that at least some of the damage to the wiring insulation on the accident airplane very likely existed before the accident. Given what was found during the inspections of other airplanes, it is also likely that metal shavings and other contaminants were interspersed with the wiring system on the accident airplane before the accident. Evidence of arcing was found on generator cables routed with wires in the leading edge of the right wing, near the wing root. Although this arcing damage might have been caused by the breaking of the forward wing spar and subsequent fuel fire, it is possible that it could also have been caused before the explosion. Because this wire bundle included wires leading to the right main wing tank (No. 4) fuel flow gauge and right wing FQIS wiring that would have been routed to a connection in the CWT at terminal strip T347, a short circuit in this bundle could have carried excessive energy into the CWT FQIS. In addition, two non-FQIS wires at body station (STA) 955, which would have been corouted in the same raceway as CWT FQIS wiring, were found with possible arcing damage.616 (Although the FQIS wiring recovered from this area did not contain evidence of arcing, it should be noted that some of the FQIS wiring from this area was not recovered.) These wires were located near structural repairs from a burst potable water tank and numerous other floor repairs. These repairs could have disturbed nearby wires, cracking or otherwise damaging the wire insulation, and could also have generated metal shavings. In fact, metal drill shavings were found adhered to fragments of a floor beam from STA 920, within 2 inches of where the CWT FQIS wiring would have been routed. This area was also near galley C, which was the site of numerous reported leaks in the 2 weeks preceding the accident. Leakage from this area could have dripped onto electrical 615 The Safety Board recognizes that some FQIS technologies currently in development do not rely on wiring inside fuel tanks. Instead, the sensors for such systems utilize fiber-optics, sonics, and other underlying mechanisms. No additional protection (TSDs or separation and shielding of wires) would be required to prevent energy from entering fuel tanks so equipped. 616 Copper strands on these two wires had melted and rehardened with molten/resolidified ends. Although it is possible that this damage could have been caused by the postexplosion fire, investigators considered it unlikely that only two wires from this raceway would have sustained such damage if the entire area had been exposed to fire.

Analysis 289 Aircraft Accident Report wiring located immediately beneath the galley floor and caused a short circuit that affected the CWT FQIS wiring. Repairs to the area around the upper deck flight attendant lighting panel could also have created conditions conducive to short-circuiting. A lighting wire and pin in that panel had been repaired on June 20, 1996, about a month before the accident. Although no evidence of arcing was found on the repaired wire, during the repair other wires bundled with it might well have been moved. The repaired wire was part of a bundle that branched off from a larger bundle that contained CWT and left wing FQIS617 wires that led to the upper deck AIDS unit and also contained high-voltage wiring for lighting; thus, manipulation of wires during the repair could have resulted in movement and cracking of these wires. In addition, there was evidence of extensive structural repairs in this area, and the cabin interior had been altered, both of which could have disturbed these wires and introduced metal shavings, possibly damaging the wire insulation. Further, condensation, which is common in transport-category airplanes,618 could have provided a mechanism for short-circuiting of such damaged wires when powered. Finally, in addition to being bundled with FQIS wires, the lighting wires were also bundled with CVR wires and No. 4 fuel flow wires along some portions of their path. Therefore, a short circuit involving these lighting wires could also explain the electrical anomalies indicated on the CVR recording and the No. 4 fuel flow indicator. Although no evidence of arcing was found in any of the components connected to the CWT FQIS (the fuel quantity indicator, totalizer gauge, AIDS, VSO unit, and left wing refueling station), investigators considered the possibility that a short circuit in one of those components could have been a source of excess voltage transferred to the CWT FQIS wiring. The interior of each of these components contained numerous complex wiring and circuit assemblies that could have obscured evidence of a short circuit. Further, it is also possible that a short circuit at lower power or through moisture could occur without leaving evidence of arcing.619 Therefore, there were several possible locations at which a short circuit of higher-voltage wiring could have affected the CWT FQIS wires in the accident airplane. Further, as noted previously, there are several indications that possible anomalous electrical events occurred in the airplane just before the explosion. First, the captain’s CVR channel recording has two “dropouts” of background power harmonics, indicating some type of electrical anomaly, less than a second before the CVR lost power.620 Second, captain’s comments about a “crazy” No. 4 (right outboard engine) fuel flow indicator were 617 As previously noted, FQIS wiring from wing tanks is not electrically isolated from the CWT FQIS wires and, therefore, energy resulting from a short circuit to any of those FQIS wires could potentially reach the CWT. 618 The 747 design includes drip shields between the upper deck and cockpit to protect critical elements (including the cockpit wiring) from condensation. 619 For more information about arcing, see section 1.16.6.2. 620 The continuation of the 400- and 800-Hz signals through these two periods indicate that the CVR was functioning and that the dropouts were not the result of damage to the recording. Safety Board testing found that power interruptions on adjacent circuits could result in acoustical indications on the CVR.

Analysis 290 Aircraft Accident Report recorded on the CVR about 2 1/2 minutes before it lost power, which also suggests that some type of electrical anomaly occurred that affected that wiring. And third, the recovered CWT fuel quantity gauge from the cockpit displayed a reading of 640 pounds, which does not agree with the quantity recorded by the ground refueler (300 pounds).621 Safety Board testing showed that applying power to a wire leading to the fuel quantity gauge can cause the digital display to change by several hundred pounds in less time than is required to trip the circuit breaker. This suggests that an electrical anomaly might have affected the reading of the cockpit gauge (accounting for the discrepancy). These electrical anomalies were not necessarily related to the same event. However, it is possible that one or more of these anomalies were a manifestation of an electrical event that resulted in excess voltage being transferred to the CWT FQIS wiring. On the basis of this and the other evidence previously discussed, the Safety Board concludes that a short circuit producing excess voltage that was transferred to the CWT FQIS wiring is the most likely source of ignition energy for the TWA flight 800 CWT explosion. 2.3.2.2 Release of Ignition Energy Inside the Center Wing Fuel Tank 2.3.2.2.1 Arcing Exposed conductors on FQIS wiring (caused by either mechanical damage or cold-flow)622 within a fuel tank could provide a mechanism that would lead to arcing inside the tank, which in turn could ignite the flammable fuel/air vapor.623 (This was one of the suspected ignition mechanisms for the 1990 Philippine Airlines 737 CWT explosion and the 1972 Navy C-130 fuel tank explosion.) Very little (about 4 feet) of the CWT FQIS wiring from the accident airplane was recovered, and, therefore, the degree to which the wiring in the tank might have been damaged before the accident could not be assessed. However, investigators found preaccident damage, including exposed conductors,624 on some of the recovered FQIS wiring from inside TWA flight 800’s wing tanks, and damaged FQIS wiring was found inside the CWTs of several of the other 747 airplanes examined by the Safety Board.625 In addition, the presence of a conductive material, such as metal drill shavings or safety wire (both of which were found in the fuel 621 There is evidence that the cockpit gauge indicated 300 pounds while the airplane was on the ground; the figure recorded by the ground refueler (300 pounds) would have been taken from a “repeater” gauge at the refueling station, which registers the same quantity as the cockpit gauge. The difference between this and the 640-pound indication at the time of the accident exceeded the accuracy tolerance allowed by the manufacturer and the error recorded during certification tests. Further, the 640-pound indication was found in both the electrical and mechanical gauge mechanisms, which also suggests that the indication may not have been attributable to an error in the gauge. 622 Cold-flow refers to migration or displacement of wire insulation. 623 Investigators also theorized that arcing might occur if a loosely connected FQIS probe intermittently contacted structure inside the fuel tank. However, no loose fuel probes were found during FAA-required postaccident inspections of 747s for loose fuel probes, and there was no evidence in the recovered wreckage from the accident airplane to support this theory. 624 Some of the exposed core conductors resulted from cold-flow of the polytetrafluoroethylene insulation material, and others apparently resulted from improper maintenance. Sulfide deposits were found on some exposed conductors, indicating that the damage existed before the accident.

Analysis 291 Aircraft Accident Report tanks of other airplanes), could have provided a mechanism that would lead to arcing of FQIS components. Although no clear evidence of arcing was found inside TWA flight 800’s CWT, fire damage along the route of the FQIS wiring was severe enough that it likely would have obscured any such evidence. 2.3.2.2.2 Resistance Heating Another potential source of ignition energy is resistance heating, which could have resulted from a thin filament626 being heated through contact with a wire, probe, or compensator exposed to excess voltage.627 Although no clear evidence of a filament ignition was found inside TWA flight 800’s CWT, such evidence could also have been physically lost or obscured by fire damage. 2.3.2.2.3 Silver-Sulfide Deposits on Fuel Quantity Indication System Wiring and Components Research and testing conducted during this investigation found that silver-coated copper parts inside fuel tanks, such as those used in the FQIS, can develop silver-sulfide deposits628 that are semiconductive and, therefore, can reduce the resistance between electrical connections and permit arcing. Such deposits can become a potential ignition mechanism inside a fuel tank.629 Silver-sulfide deposits were found on FQIS probes, compensators, and wiring from the accident airplane. Similar deposits have been discovered on FQIS parts from other airplanes, both military and civilian (including other 747s). Research by the Safety Board, the FAA, and the AFRL has found that deposits accumulate over time as a result of the part’s exposure to jet fuel and fuel vapors, which contain sulfur. (It should be noted that the FQIS design for the 747 classic includes exposed conductors at terminal blocks.) In addition, laboratory research by the University of Dayton Research Institute conducted as a result of this investigation found that increased temperatures enhanced the formation of silver-sulfide deposits and that fuel washing could slow the accumulation of these deposits. This finding is significant with regard to CWTs because they are less frequently 625 This damage was discussed in the Safety Board’s April 7, 1998, safety recommendation letter to the FAA. 626 A filament is a slender wire, such as that found inside an electric light bulb. 627 For example, testing by Boeing indicated that steel wool can be ignited by as little as 32 milliamps from a 25-volt 400-cycle alternating current source. (The Boeing data did not include variables required to calculate energy [J] from the voltage value that was provided.) 628 These deposits are sometimes also referred to as “copper-sulfide deposits,” “sulfides,” or “sulfidation.” 629 Ignition of vapors in an AFRL trainer fuel probe in 1990 during electrical bench tests (when test voltages higher than normal fuel system voltages were applied) was attributed by the AFRL to sulfide deposits. Subsequent AFRL testing for the Safety Board indicated that the deposits could break down and result in arcing when exposed to a 170-volt pulse. Also, during the investigation of the TWA flight 800 accident, the Board became aware that in 1988, Boeing found evidence of silver-sulfide deposits at the location of arcing in 18 fuel pump motors. In addition, during FAA-sponsored testing at Arizona State University in connection with this investigation, application of direct current voltage to silver-sulfide deposits created in a laboratory ignited Jet A fuel vapors.

Analysis 292 Aircraft Accident Report filled with fuel to the top than wing tanks, and, therefore, the terminal block at the top of the CWT fuel probes is less often covered by fuel (which would subject it to fuel washing) than would be the case in a wing tank.630 The AFRL concluded that the accumulation of silver-sulfide deposits “is most likely the result of a long-term degradation or corrosion process…[and that] as the probes age, more probe failures [calibration errors] can be expected.” However, the problem is not solely limited to older airplanes; silver-sulfide deposits that were significant enough to cause FQIS anomalies631 were found in a 757 airplane with only 750 hours.632 The existence of silver-sulfide deposits on FQIS components from both the accident airplane and numerous other airplanes raises the possibility that sulfide deposits could have provided an energy release mechanism at the point of ignition in the CWT. The accident airplane’s recent maintenance history, which indicates FQIS anomalies, is consistent with silver-sulfide deposits interfering with FQIS operation. Accordingly, sulfide deposits were considered as a possible ignition mechanism for the TWA flight 800 CWT explosion. 2.3.2.2.3.1 Elimination of Silver-Sulfide Deposits Inside Fuel Tanks In response to AFRL’s findings from the 1990 vapor ignition incident, BFGoodrich eliminated the use of silver-plated components in the FQIS and began using nickel-plated wire, gold-plated ring connectors, and sealant. Those improved components have been used in military airplanes since about 1993. According to BFGoodrich, since that time, there has been a large reduction in the FQIS anomalies that had been associated with silver-sulfide deposits (such as FQIS inaccuracies). Although a Boeing 1991 engineering report indicated that silver should never contact sulfur-containing liquids because of the susceptibility to sulfidation, and Boeing uses nickel-plated (instead of silver-plated) wiring in its newly manufactured 777 and 737-NG airplanes, Boeing indicated in a December 7, 1999, letter to the Safety Board that it does not recommend replacing silver-plated FQIS components in existing airplanes. In an April 7, 1998, letter to the FAA, the Safety Board expressed concern that sulfide deposits on FQIS wires could become an ignition source in fuel tanks and issued Safety Recommendation A-98-37, which asked the FAA to Require research into copper-sulfide deposits on FQIS parts in fuel tanks to determine the levels of deposits that may be hazardous, how to inspect and clean the deposits, and when to replace the components. 630 Only two of the many FQIS components from other airplanes examined during this investigation that contained silver-sulfide deposits had been removed from the airplane because of FQIS anomalies; both were terminal strips from the top of 747 CWTs. 631 Research by BFGoodrich, an FQIS manufacturer, conducted after the AFRL vapor ignition incident in 1990 found that silver-sulfide deposits could permit leakage of electrical currents and, therefore, cause FQIS anomalies. 632 For more information about sulfide deposit tests, see section 1.16.6.9.

Analysis 293 Aircraft Accident Report In response to this recommendation, the FAA convened a team of specialists from Government, academia, and industry to conduct research. According to the FAA’s May 17, 2000, response to the Safety Board, the team has studied the properties of sulfide deposits created in a laboratory environment but has not found indications of significant levels of deposits occurring in in-service airplanes for comparison. The FAA indicated that the research program had been extended from its original 12-month timeframe so that the team could complete its evaluation. The FAA indicated in NPRM 99-18 that it anticipates that the proposed fuel tank safety review will identify critical areas of the fuel tank system that will require maintenance actions to account for the effects of aging, wear, corrosion, and possible contamination of the fuel system. Specifically, the FAA noted that it might be necessary to provide maintenance instructions to identify and eliminate silver-sulfide deposits.633 The Safety Board concludes that silver-sulfide deposits on FQIS components inside fuel tanks pose a risk for ignition of flammable fuel/air vapor. Although precluding operations with flammable fuel/air vapor (as recommended in Safety Recommendation A-96-174) would eliminate this risk, flammable fuel/air vapors will not likely be eliminated in all fuel tanks or during all phases of flight. Therefore, although the Board is pleased that the FAA is continuing to support research into sulfide deposits, the Safety Board believes that the FAA should require the development and implementation of corrective actions to eliminate the ignition risk posed by silver-sulfide deposits on FQIS components inside fuel tanks. The Safety Board classifies Safety Recommendation A-98-37 “Closed—Acceptable Action—Superseded.” 2.3.2.2.4 Ignition Location Inside the Center Wing Fuel Tank The Safety Board contracted with two research laboratories, Sandia National Laboratory and Christian Michelsen Research, to develop computer modeling in an attempt to determine potential ignition locations. However, because of considerable uncertainties in some aspects of the methodology, the results of that modeling could not be used to determine the most likely ignition location.634 Nonetheless, investigators examined all of the recovered CWT FQIS components, which included portions of all seven fuel probes, one complete terminal block and one partial terminal block, and the compensator.635 None of the recovered probes or terminal blocks exhibited any noteworthy signs of damage. However, several plastic parts inside the compensator’s innermost tube were found burned, with an apparent upward-flowing burn pattern, which investigators hypothesized could indicate that a fire initiated inside the 633 In NPRM 98-NM-163-AD, the FAA proposed that silver-plated copper FQIS wiring in 747 CWTs be replaced with nickel-plated copper FQIS wiring within 20 years of the airplane’s manufacture. Although the FAA acknowledged that there was little technical basis for this time limit, and the proposed replacement requirement was not included in the final rule (AD 98-08-02), the Safety Board is concerned that this proposal indicates a belief on the part of the FAA that silver-sulfide deposits do not pose a significant risk for airplanes less than 20 years old. As discussed in section 2.3.2.2.3, potentially hazardous deposits can accumulate in younger airplanes as well as on older airplanes, and such deposits can pose a significant risk. 634 For more information about the computer modeling, see section 1.16.5.5.

Analysis 294 Aircraft Accident Report compensator. Similar burn patterns636 were observed on the compensator believed by the FAA to be the ignition source for the surge tank fire in the 747 that experienced a fuel tank explosion in May 1976 near Madrid, Spain.637 (Although the Safety Board discounted the compensator as an ignition source in its October 1978 report of the Madrid accident, a different conclusion might have been warranted638 given what is now known about sulfides and other ignition-related phenomenon.) However, there was insufficient evidence to conclude that the damage to the CWT compensator occurred before the explosion, and, therefore, no determination could be reached regarding the likelihood that the compensator was the ignition location. 2.3.2.3 Possible Ignition Scenario for TWA Flight 800 Explosion Therefore, the Safety Board concludes that the ignition energy for the CWT explosion most likely entered the CWT through the FQIS wiring, and, although it is possible that the release of ignition energy inside the CWT was facilitated by the existence of silver-sulfide deposits on an FQIS component, neither the energy release mechanism nor the location of the ignition inside the CWT could be determined from the available evidence. 2.4 Fuel Tank Design and Certification Standards 2.4.1 Preclusion of Ignition Sources in Fuel Tanks As previously discussed, a fuel tank explosion requires both a flammable fuel/air mixture and an ignition source. For purposes of certification, the FAA and transport-category airplane manufacturers have historically assumed that a flammable fuel/air mixture exists in fuel tanks at all times and have attempted to preclude fuel tank explosions by eliminating ignition sources in fuel tanks.639 This philosophy is reflected in NPRM 99-18, which proposes to require (1) substantiation that no ignition sources will exist in fuel tanks and (2) development of maintenance and inspection criteria to ensure 635 Although the burned compensator did not have any marks identifying it as being from the CWT, it was identified as such by process of elimination. Only one fuel tank other than the CWT (reserve tank No. 4) showed any evidence of fire in the vicinity of a compensator; the compensator from this tank was positively identified by unique characteristics. Therefore, the burned compensator apparently came from the CWT. 636 For more information about these burn patterns, see section 1.18.1. 637 Although the ignition energy for that explosion is believed to have come from a lightning strike, the energy would still have had to find a release mechanism inside the tank. 638 The Safety Board explained its determination that “fuel did not ignite” at the compensator by noting that “[t]ests showed that it took more voltage to spark the probe than would conceivably be induced in its wiring [and that] microscopic examination found no evidence of sparking.” However, as was pointed out in an undated FAA memo commenting on the Board report, the report also recognized that “energy levels required to produce a spark will not necessarily damage metal or leave marks” and that “a spark [of] …sufficient energy to ignite the fuel…will not necessarily leave physical evidence.” 639 As stated in the FAA’s January 12, 2000, Draft AC 25.981-1X, “Fuel Tank Ignition Source Prevention Guidelines,” “[d]ue to the difficulty in predicting fuel tank flammability, the FAA has always assumed that a flammable fuel air mixture exists in airplane fuel tanks and has required that no ignition sources be present.”

Analysis 295 Aircraft Accident Report that the level of safety originally designed into the fuel tank system is maintained.640 The proposed rules would require affected type certificate and supplemental type certificate holders to create a failure modes and effects analysis (FMEA) for all components in the fuel tank system and use the resulting data to develop a quantitative fault tree analysis to determine whether combinations of failures expected to occur in the life of the fleet could cause an ignition source to exist in a fuel system. In the NPRM, the FAA indicated that these analyses should conform to the structured requirements of 14 CFR Sections 25.901(c) and 25.1309, which the FAA acknowledged “have not been consistently applied and documented when showing that ignition sources are precluded from transport category airplane fuel tanks.”641 The Safety Board recognizes that FMEAs and fault tree analyses provide a structured and systematic method for identifying and evaluating the potential risk that might be posed by failure modes and, therefore, that they can be a useful part of the certification process. However, the Board is concerned that undue reliance is being placed on such analyses as proof that ignition sources have been precluded. As further discussed below, there are several reasons why such analyses may be unreliable. Unrealistic or otherwise flawed data can be used to develop fault tree analyses. This problem was demonstrated during this investigation by a CWT ignition fault tree analysis that was developed by Boeing at the Safety Board’s request (but that was not required to be and was not submitted as part of the FAA certification process). The exposure times and failure rates appeared to be too low for some events, resulting in overly optimistic probability data. Failure analysis specialists at NASA, who reviewed the fault tree analysis at the Board’s request, stated the following in a November 25, 1998, letter: Many of the probabilities, failure rates, and/or exposure times were much lower than would reasonably be expected. The probability of occurrence should be higher and/or exposure times should be longer on many of the basic events....Based on our evaluation of the tree and the information provided by the [Safety Board], the subject fault tree analysis quantification cannot stand up to peer review and should not be viewed as realistic. It should be noted that the logic of the tree could not be fully evaluated since we did not have access to the engineering drawings and schematics of the system. However, based on previous systems experience, we would expect the tree to be constructed differently. Further, Safety Board staff noted that the two formats in which the data were presented (graphical and tabular) indicated different levels of risk for an ignition source (which was identified as the top-level failure mode); one form indicated that the risk of a CWT explosion was within acceptable limits (that is, it was extremely improbable, as 640 The NPRM also addresses flammability reduction in newly designed airplanes; however, it does not address flammability in current designs. 641 These regulations require the applicant to show (using a quantitative evaluation) that no failure or probable combination of failures will prevent continued safe flight and landing. For more details about these requirements, see section 1.16.6.5.

Analysis 296 Aircraft Accident Report defined in AC 1309-1A), and the other indicated that the risk of a CWT explosion was not within acceptable limits.642 In its submission, Boeing indicated that, because the fault tree analysis was developed only to support the accident investigation, it did not go through the “iterative review process with the FAA normally associated with certification of a system, nor were the underlying FMEAs developed that normally would be the source of data to build the [fault tree analysis].” The Safety Board recognizes that the data submitted by Boeing to the Board in connection with this investigation might not have been submitted to, or accepted by, the FAA during the certification process. However, it is unclear whether the problems identified by the Board and NASA would have been avoided or corrected during that process, since Boeing was aware that the information it was supplying to the Board would be used as part of the TWA flight 800 investigation. In any event, the questionable data used by Boeing in its CWT ignition fault tree analysis raises concerns that similarly questionable data may have been used to develop other fault tree analyses that have been submitted to and accepted by the FAA in connection with aircraft certifications. The adequacy of fault tree analyses submitted in connection with aircraft certification was not examined as part of the TWA flight 800 accident investigation. However, this issue will be addressed in the Board’s upcoming safety study on aircraft certification. Contributing to the possibility that FMEAs and fault tree analyses will be based on inaccurate data and, therefore, will not accurately depict all possible failure modes and their probability of occurrence is the fact that no single source exists for reliable and comprehensive data on component failures or malfunctions. Because the calculations in an FMEA are based (in part) on failure rates, incomplete or inappropriate failure data can significantly skew the results of an examination. The Safety Board is aware that service history data maintained by manufacturers do not include data from all operators. Further, the Board has found that the amount of data provided by the manufacturers of replacement component parts sometimes greatly exceeds the data provided by the aircraft manufacturers (possibly because replacement part suppliers can sell parts directly to operators and repair facilities). Although the FAA collects a significant amount of data about mechanical failures through its Service Difficulty Report (SDR) program, even these data are incomplete.643 Other sources of potentially relevant data are the service histories maintained by the military of its variants of commercial airliners and the Board’s accident and incident investigation database; however, neither of these sources provides complete data either. Even a well-constructed FMEA or fault tree analysis that incorporates the most complete and accurate data available will be unreliable to some extent because it is not possible to predict all failure modes or to accurately determine their probability of occurrence. As demonstrated by the series of accidents and incidents involving uncommanded rudder movements on 737s and the recent horizontal stabilizer trim system failure on a McDonald Douglas MD-83, unanticipated failure modes in aircraft systems 642 For more information about Boeing’s CWT ignition fault tree analysis, see section 1.16.6.5. 643 For more information about concerns regarding and actions taken to address problems with the SDR program, see section 1.18.2.1.

Analysis 297 Aircraft Accident Report can and do occur. The FAA has acknowledged that “ignition sources have developed in airplane fuel tanks due to unforeseen failure modes or factors that were not considered at the time of original certification of the airplane.”644 Similarly, the engineering and test evaluation board that was convened in 1999, which was in response to a Safety Board recommendation, to evaluate the 737 rudder system identified catastrophic failure modes that had not been identified through the FMEA and fault tree analyses submitted in 1997 in connection with certification of the 737-NG airplanes. As evidenced by the Space Shuttle disaster, even systems that have undergone the rigorous and highly respected NASA failure analysis reviews can experience unexpected failure modes. Similarly, the March 28, 1979, nuclear power accident at the Three Mile Island nuclear power plant near Harrisburg, Pennsylvania, was attributed to a series of failures that were not anticipated by the Nuclear Regulatory Commission and, therefore, not considered during development.645 In addition, FMEAs are sometimes intentionally constructed to exclude certain failure modes. The FAA acknowledged in draft AC 25-981-1X that the fuel tank ignition FMEAs proposed in NPRM 99-18 are not intended to consider all potential ignition sources. Ignition sources that are outside the purview of the proposed FMEAs include uncontained engine failure debris; terrorist actions, such as bombs; and the effects of postcrash or other fires outside the tank (including the propagation of fire through the airplane vent system). Finally, to the extent that the prevention of failure modes are dependent on adequate maintenance and inspection of systems and components, the premise that maintenance and inspection programs will prevent failures is also inherently flawed. Many potentially hazardous conditions in aircraft electrical wiring and related fuel system components (such as worn wiring or exposed conductors obscured by clamps or other wires, debris inside fuel pumps, and hidden silver-sulfide deposits) are not easily detected by visual inspection, which is currently the primary method for inspecting such components. Other potentially hazardous conditions (such as metal shavings or other debris) may be perceived by maintenance personnel as commonplace and, therefore, insignificant. Consequently, necessary maintenance and/or replacement of some components—upon which a favorable risk assessment may have been based—may not occur. Therefore, although FMEAs and fault tree analyses focused on eliminating ignition sources are important and necessary parts of the design and certification process, the Safety Board concludes that they should not be relied upon as the sole means of demonstrating that an airplane’s fuel tank system is not likely to experience a catastrophic failure. The Safety Board further concludes that a fuel tank design and certification philosophy that relies solely on the elimination of all ignition sources, while accepting the 644 FAA Draft AC 25.981-1X, “Fuel Tank Ignition Source Prevention Guidelines,” dated January 12,

1. Similarly, the FAA acknowledged in NPRM 99-18 that the TWA flight 800 accident investigation has

led to the discovery of numerous previously unforeseen failure modes that could result in fuel tank ignition and that were not considered in connection with the 747 original certification. 645 For more information about the Three Mile Island accident, see section 1.16.6.5.1.

Analysis 298 Aircraft Accident Report existence of fuel tank flammability, is fundamentally flawed because experience has demonstrated that all possible ignition sources cannot be predicted and reliably eliminated. The design and certification of the 737 rudder system and the MD-80 stabilizer trim system may have been similarly flawed because both of these systems have experienced unanticipated catastrophic failures646 as a result of failure modes that appear to have been unforeseen. The flawed 737 rudder system design and the potentially flawed MD-80 horizontal stabilizer design would have been precluded by a certification approach that required a reliable independent means for overcoming or counteracting the catastrophic effects of a failure, even if the probability of the catastrophic failure mode is calculated to be extremely improbable. (This issue will be further addressed in the Safety Board’s upcoming safety study on aircraft certification.) In the case of fuel tank safety, such redundant protection could be achieved by requiring, in addition to the preclusion of ignition sources, the preclusion of a flammable fuel/air mixture. The Safety Board concludes that operating transport-category airplanes with flammable fuel/air mixtures in fuel tanks presents an avoidable risk of an explosion.647 2.4.2 Preclusion of Flammable Fuel/Air Vapor in Fuel Tanks A major reason for the flammability of the fuel/air vapor in the CWT on the 747 (and similarly designed airplanes)648 is the large amount of heat generated by the air conditioning packs located directly below the tank, which significantly elevates the temperatures in the pack bay. Heat from the pack bay can transfer to the CWT through the bottom of the tank and cause temperatures to rise above the lower flammability limit.649 Therefore, the 747 (and other similarly designed airplanes) may operate a significant portion of the time with a flammable fuel/air mixture.650 Under these circumstances, a single ignition source could cause an explosion and destroy the airplane. 646 In the case of the 737, the catastrophic failures were uncommanded rudder movements; in the case of the MD-80, they were uncommanded horizontal stabilizer movements. 647 The FAA and the aviation industry have also recognized that there is a safety benefit in reducing the degree of fuel tank flammability. For example, after several fuel tank explosions in the 1970s, the use of JP-4 fuel in civil transport-category aircraft was discontinued in favor of Jet A fuel, which is less flammable. Further, in NPRM 99-18, the FAA proposed regulatory changes aimed at minimizing the development of flammable fuel/air mixtures in newly designed airplanes. However, as further discussed in section 2.4.1.2, no regulatory action has yet been taken to address the flammability of fuel tanks in the existing fleet and in current designs. 648 The air conditioning packs are also located under the CWT in several Boeing and Airbus airplanes; however, in some Airbus, airplanes the pack bays are ventilated. In contrast, in the DC-10, MD-11, and L 1011, the packs are located in the nose; in the MD-80, packs are located in the tail. 649 Further, as shown in the Safety Board’s July 1997 flight tests at JFK, ullage temperatures are highest at the bottom and center of the CWT (nearest the heat source) and become cooler in the regions around the side and top of the CWT (where the heat leaves the tank).

Analysis 299 Aircraft Accident Report In its December 13, 1996, letter to the FAA, the Safety Board stated that the existence of a flammable fuel/air mixture in transport-category airplane fuel tanks was inconsistent with the basic tenet of transport-aircraft design that no single-point failure should prevent continued safe flight and landing. Because of its concerns, the Board issued Safety Recommendations A-96-174 and -175, which asked the FAA to Require the development and implementation of design or operational changes that will preclude the operation of transport-category airplanes with explosive fuel/air mixtures in the fuel tanks: (a) Significant consideration should be given to the development of airplane design modifications, such as nitrogen-inerting systems and the addition of insulation between heat-generating equipment and fuel tanks. Appropriate modifications should apply to newly certificated airplanes and, where feasible, to existing airplanes. (A-96-174) (b) Pending implementation of design modifications, require modifications in operational procedures to reduce the potential for explosive fuel/air mixtures in the fuel tanks of transport-category aircraft. In the 747, consideration should be given to refueling the CWT before flight whenever possible from cooler ground fuel tanks, proper monitoring and management of the CWT fuel temperature, and maintaining an appropriate minimum fuel quantity in the CWT. (A-96-175) Initially, the FAA did not agree with the Safety Board that such changes were necessary to address fuel tank flammability, and in its early responses relating to Safety Recommendations A-96-174 and -175 (dated February 18, 1997, and June 28, 1997), it indicated that it was focusing its efforts on eliminating ignition sources. However, in October 1999, the FAA stated in NPRM 99-18 that it was undertaking a “parallel effort to address the threat of fuel tank explosions by eliminating or significantly reducing the presence of explosive fuel/air mixtures within the fuel tanks in new type designs, in production, and the existing fleet of transport airplanes.” The FAA further acknowledged in the NPRM that the placement of air conditioning packs under fuel tanks “without provisions to reduce transfer of heat from the packs to the tank” is the primary reason for elevated temperatures in those fuel tanks and indicated that one purpose of the proposed rule changes (to “minimize” the flammability of fuel tanks in newly designed aircraft) is “to preclude the future use of such design practices.” In the NPRM, the FAA also recognized that airplanes without heat sources adjacent to fuel tanks have significantly reduced levels of flammability exposure (5 percent of the fleet operational time) when 650 It should be noted that the potential for 747 CWT overheating and methods for mitigating against it were studied by Boeing and documented in a 1980 Fuel Tank Heating Study prepared for the USAF in connection with the E-4B, a military variant of the 747. According to Boeing, its personnel associated with the TWA flight 800 investigation did not become aware of the report until late in the investigation. The Safety Board recognizes that the military variant of the 747 is not directly comparable to the civilian 747 and that the focus of that study was fuel pump functionality, not flammability. Nonetheless, it is unfortunate that potentially relevant information about 747 CWT overheating and corrective measures was not provided to the FAA or to 747 operators earlier. According to Boeing, all of its company reports and resources are now electronically accessible through key-word searches, and its accident investigation processes have been revised and now include the ability to electronically search the company’s technical documents.

Analysis 300 Aircraft Accident Report compared with airplanes that have heat sources adjacent to fuel tanks (30 percent of the fleet operational time).651 The Safety Board is pleased that the FAA agrees that the heat generated by the packs located under the CWT significantly increases the flammability exposure in the CWT. Further, the Safety Board concludes that the placement of heat-generating equipment under a fuel tank containing Jet A fuel can unnecessarily increase the amount of time that the airplane is operating with a flammable fuel/air mixture unless measures are in place to either (1) prevent the heat from entering the CWT or (2) eliminate the flammable vapors inside the CWT. Although the Safety Board supports the FAA’s efforts to address fuel tank flammability in new designs, the Board is concerned about the FAA’s apparent premise that minimizing, rather than eliminating, fuel tank flammability is an acceptable goal. The ARAC working group (the FTHWG) established to advise the FAA in its rulemaking efforts concluded that the safety record of fuel tanks located in the wings (which the FTHWG calculated were flammable about 7 percent of the fleet operational time) was adequate and that if the same level of safety could be achieved in CWTs, the overall safety objective could be achieved. Thus, the FTHWG proposed limiting the exposure to flammable conditions in all fuel tanks to less than 7 percent of the expected fleet operational time. FAA staff indicated during meetings with Safety Board staff on February 29, 2000, that the FAA did not intend to endorse the FTHWG’s proposed 7 percent exposure criteria. However, the FAA’s draft guidance652 concerning compliance with the proposed new requirement to minimize fuel tank flammability reflects exposure criteria that are tied to the exposure of wing tanks; these criteria are reiterated in the FAA’s May 17, 2000, letter to the Board describing its actions in response to several safety recommendations, including A-96-174 and -175. The draft guidance states that “the intent of the regulation is to require that the exposure to formation or presence of flammable vapors is equivalent to that of an unheated wing tank in the transport airplane being evaluated,” which, as previously mentioned, the FTHWG calculated to be about 7 percent of the fleet operational time. The Safety Board registered two concerns about such exposure criteria in its comments on NPRM 99-18. First, the Board stated that because the exposure criteria is based on a fleetwide average, it does not account for increased risks that may exist at specific locations, during certain time periods, or for certain flights.653 Second, the Board 651 The FAA amended this estimate (of how much of the fleet operational time CWTs are flammable) to 35 percent in its May 17, 2000, letter to the Safety Board, based on its analysis of recent flammability research. 652 FAA Draft AC 25.981-2X, “Fuel Tank Flammability Minimization,” dated January 12, 2000. 653 The Safety Board notes that of the 16 fuel tank explosions documented by the FTHWG, 11 occurred in the months of May, June, and July, and only 2 occurred outside of warm climates or summer months. Further, short flights in warm climates can have a dramatically higher exposure time than the fleetwide average. For these flights, attempting to reduce the fleetwide flammability of CWTs to the level of wing tanks would be of little benefit.

Analysis 301 Aircraft Accident Report questioned the premise that transport-category airplane wing fuel tanks have an acceptable safety record, noting that wing fuel tanks have exploded. The Board also stated that the goal should be to completely eliminate the development of flammable vapors in fuel tanks to the greatest extent technically feasible (such as would result from the use of inerting systems). In addition, the Safety Board is even more concerned that NPRM 99-18 did not propose any regulatory changes that address fuel tank flammability in current designs and in the existing fleet. This is especially disturbing because some operational measures that can reduce current levels of flammable vapors (such as limiting the on-ground operating time of air conditioning packs and instead using a ground-based cool air supply and cooling or ventilating the pack bay) could be accomplished immediately. The FAA indicated in its May 17, 2000, letter to the Safety Board that it is evaluating methods for reducing flammability in both future and existing designs, including directed ventilation and on-board or ground-based fuel tank nitrogen inerting systems. However, according to the FAA, fuel tank temperature data provided (to date) by airplane manufacturers in response to its request indicate that directed ventilation systems would not reduce the temperature of heated CWTs as much as predicted by the FTHWG. The FAA indicated that it would not reach a final decision regarding the benefits of this design change until it had received and evaluated all of the requested fuel tank temperature data. With regard to fuel tank inerting, the FAA letter stated that its research on ground-based inerting indicated that the costs associated with the needed ground equipment are significantly less than what was estimated by the FTHWG and, further, that analysis indicated that ground-based inerting would reduce the fleetwide average flammability exposure for affected CWTs to about 2 percent. The FAA indicated that it planned to conduct ground and flight tests to determine how long ground-based inerting would remain effective during flight and whether vent system modifications would be required to ensure its effectiveness. The FAA stated that it is also establishing an ARAC working group to gather additional data on the practicality of both ground-based and on-board inerting methods. In addition, the FAA indicated that it is evaluating the use of ground sources for conditioned air (instead of using the air conditioning packs) as an additional measure to reduce the flammability of CWTs in existing designs and the current fleet. According to the FAA, use of ground sources on days when the temperature exceeds 60° F would reduce the fleetwide flammability of CWTs from about 35 percent to about 25 percent. The FAA stated that a Boeing service letter (SL) recommends that operators use ground sources for conditioned air when available and practical and that it intends to encourage operators to follow this recommendation. The Safety Board is pleased by the significant reduction in flammability that can be achieved by using ground sources for conditioned air and notes that a requirement that such sources be used seems to be a logical step toward satisfying the intent of Safety Recommendation A-96-175.

Analysis 302 Aircraft Accident Report Although the use of ground sources for conditioned air can provide meaningful short-term benefits, fuel tank inerting appears to be a more promising, near-term method that could even more dramatically reduce fuel tank flammability in the existing fleet.654 Thus, the Safety Board is pleased that the FAA has recently begun to aggressively study this method. However, given that 3 1/2 years have passed since the Board recommended that the FAA give significant consideration to the issue of fuel tank inerting as a means of precluding the operation of transport-category airplanes with flammable vapors in the fuel tanks, and given the nature of the results that have been achieved by prior ARACs (particularly the FTHWG)655 the Board is concerned that the FAA has chosen to address this issue by forming another ARAC working group to review and advise the FAA regarding the practicality of fuel tank inerting methods. The Board strongly encourages the FAA to consider a broader range of inerting technologies656 and expedite the pace of its research and rulemaking initiatives with regard to fuel tank inerting. However, based on the FAA’s recent input to the Board, and pending additional expedited action with regard to fuel tank inerting, Safety Recommendations A-96-174 and -175 are classified “Open—Acceptable Response.” 2.5 Maintenance and Aging Issues As previously discussed, no evidence was found that preexisting airplane fatigue or corrosion contributed to the accident.657 Although small fatigue cracks were found in the lower chord of the front spar and in shear ties for the floor beams and stiffeners at the front spar, they would not have degraded the capability of the front spar to react to wing bending loads as a part of the WCS, nor would they have affected the pattern or severity of the airplane’s structural breakup. These fatigue cracks appear to have been exposed by fractures generated by the forces associated with the overpressure event within the CWT and by the continued breakup of the airplane. No fatigue cracking was associated with the initial failure of the CWT at the upper end of SWB3. However, several potentially unsafe conditions were found in and near the electrical wiring from the accident airplane, including cracked wire insulation, metal 654 The Safety Board recognizes that fuel tank flammability can be counteracted in a number of different ways. However, inerting appears to be the most direct and effective method because it does not require monitoring or predicting temperatures inside the fuel tank. 655 The FTHWG was tasked with recommending regulatory changes that would “eliminate or significantly reduce the hazards associated with explosive vapors in transport category airplane fuel tanks [of]…new type designs, in-production airplanes and the existing fleet.” 63 Federal Register 3614 (January 23, 1998). However, its final report recommended regulatory changes only with regard to flammability reduction in new aircraft designs and also recommended further study of methods for flammability reduction in the existing fleet and current designs. Further, as previously discussed, the Safety Board disagreed with the FTHWG conclusion that the safety record of wing fuel tanks was adequate and that the FAA should strive for a similar safety record for fuel tanks adjacent to heat sources. 656 For example, the FAA should research the effectiveness of inerting gases other than nitrogen and various methods of gas storage, delivery, and availability. 657 For more information about preexisting fatigue and corrosion in the accident airplane, see section 2.2.1.1.

Analysis 303 Aircraft Accident Report shavings adhered to a floor beam along which FQIS wires would have been routed,658 other debris, and sulfide deposits. In addition, as previously mentioned, evidence of several repairs that did not comply with the guidelines in Boeing’s SWPM were found on the accident airplane. Noncompliant repairs included the use of an oversized strain relief clamp on the terminal block of the No. 1 fuel tank compensator, which did not adequately secure the wires; numerous open-ended (rather than sealed) wire splices, which exposed conductors to possible water contamination; several wire bundles containing numerous wire splices on adjacent wires at the same location; and excessive solder on the connector pins inside the fuel totalizer gauge, which had connected the pins/wires from the right wing main fuel tank and the CWT FQIS. Although some of these conditions may suggest the need for improved maintenance, the Safety Board found that deterioration, damage, and contamination of aircraft wiring and related components, and noncompliant repairs, such as those found on the accident airplane, were common in the airline transport-category airplanes of numerous operators (especially in the older airplanes) inspected in connection with this accident investigation.659 Therefore, the Safety Board concludes that the condition of the wiring system in the accident airplane was not atypical for an airplane of its age and that the airplane was maintained in accordance with prevailing industry practices. Nonetheless, the Safety Board was concerned about the damage and contamination found on electrical wiring and components during its examinations of transport-category airplanes, including the accident airplane. These conditions were especially disturbing because it was apparent from those examinations that a large portion of aircraft wiring is difficult, if not impossible, to inspect and/or test because of its inaccessibility (as a result of being confined in wire bundles or blocked by other obstructions). Moreover, the general nature of current visual wiring inspection criteria is such that wire damage or other potentially unsafe conditions may not be detected even on visible and accessible portions of aircraft wiring. The Safety Board concludes that, until recently, insufficient attention has been paid to the condition of aircraft electrical wiring, resulting in potential safety hazards. However, this accident investigation has resulted in a heightened awareness of the importance of maintaining the integrity of aircraft wiring, and the FAA has now recognized that current maintenance practices may not adequately or proactively address aging nonstructural systems. In its July 1998 Aging Transport Non-Structural Systems Plan (which was developed after the FAA received the recommendation of the White House Commission on Aviation Safety and Security and had participated in Safety Board airplane inspections), the FAA described the results of its evaluation of five 658 The presence of metal shavings is consistent with maintenance records that described compressed air being used to blow metal shavings off avionics units. (For more information about the accident airplane’s maintenance records, see section 1.6.3.2.) 659 The widespread existence of such conditions was also corroborated by Boeing’s SL 747-SL-20-048 (January 25, 1995), which detailed similar conditions found in numerous 747s. In that SL, Boeing also stated that it “believe[d] that the wiring on high time 747 airplanes is holding up exceptionally well” and noted that “[w]iring damage is hard to predict but some areas of wiring experience degradation more frequently.”

Analysis 304 Aircraft Accident Report transport-category airplanes deemed representative of the “aging” fleet of transport-category airplanes. The FAA found conditions similar to those found by the Board during airplane inspections in connection with this investigation, including deterioration of wiring and related components; stiff and easily cracked wire; contamination of wire bundles with metal shavings, dust, and fluids; cracked insulation; corrosion on connector pins; and improper wire installation and repairs. The FAA also found, as had Board investigators, that wires contained in wire bundles could be difficult to inspect. The FAA concluded that current maintenance practices do not adequately address wiring components, wire inspection criteria are too general, unacceptable conditions are not described in sufficient detail, repair instructions and data are difficult to extract from SWPMs, wire replacement criteria may not be adequate, and current incident/maintenance reporting procedures do not allow for easy identification of failures. The Safety Board concurs with these conclusions. The FAA’s plan also detailed several tasks and associated subtasks aimed at correcting these problems, including improving wiring inspection criteria and providing more detailed descriptions of undesirable conditions; improving inspector training to ensure that it adequately addresses the recognition and repair of aging wiring components; and developing methods for nondestructive testing of wiring.660 To assist in addressing these problems, the FAA established the Aging Transport Systems Rulemaking Advisory Committee (ATSRAC), the activities of which the Safety Board has been following with great interest. The Board is encouraged that other Government agencies, including the U.S.Navy and USAF, have increased their research into aging aircraft systems and shared the resulting information and reports with the FAA and that the White House has formed a Wire Safety Research interagency working group. Although the FAA’s research is scheduled to continue into future fiscal years, the ATSRAC charter will expire in January 2001, unless it is extended. In light of the short time remaining for the completion of the ATSRAC’s work, the Board is concerned that the ATSRAC’s final report and recommendations may not fully and adequately address all of the issues identified in the Aging Transport Non-Structural Systems Plan. The Safety Board supports the FAA’s ongoing efforts to address the maintenance/aging issues identified by the Aging Transport Non-Structural Systems Plan and will continue to follow the activities of the ATSRAC and other Government and industry initiatives related to aircraft maintenance and aging problems. The Safety Board concludes that the issues defined in the FAA’s Aging Transport Non-Structural Systems Plan are important safety issues that must be fully addressed through appropriate changes, including rulemaking. Therefore, the Safety Board believes that the FAA should, regardless of the scope of the ATSRAC’s eventual recommendations, address (through rulemaking or other means) all of the issues identified in the Aging Transport Non-Structural Systems Plan, including the need for improved training of maintenance 660 The Safety Board has participated in demonstration tests of automated test equipment in which faults were detected that could not be visually seen. Lectromec documented similar results during inspections of five U.S. Navy P-3 airplanes, finding that visual inspections revealed only 25 to 39 percent of the defects found by electrical inspections. For more information about these inspections, see section 1.18.2.5.

Analysis 305 Aircraft Accident Report personnel to ensure adequate recognition and repair of potentially unsafe wiring conditions; the need for improved documentation and reporting of potentially unsafe electrical wiring conditions; and the need to incorporate the use of new technology, such as AFCBs and automated wire test equipment. To determine whether adequate progress is being made in these areas, the Safety Board believes that, within 90 days, the FAA should brief the Safety Board on the status of its efforts to address all of the issues identified in the Aging Transport Non-Structural Systems Plan.

306 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The flight crew was properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. 2. The airplane was certificated, equipped, and dispatched in accordance with Federal regulations and approved TWA procedures. 3. At the time of the accident, there were light winds and scattered clouds in the area, but there were no significant meteorological conditions that might have disrupted the flight. 4. The in-flight breakup of TWA flight 800 was not initiated by a preexisting condition resulting in a structural failure and decompression. 5. The in-flight breakup of TWA flight 800 was not initiated by a bomb or a missile strike. 6. The fuel/air vapor in the ullage of TWA flight 800’s center wing fuel tank was flammable at the time of the accident. 7. A fuel/air explosion in the center wing fuel tank of TWA flight 800 would have been capable of generating sufficient internal pressure to break apart the tank. 8. The witness observations of a streak of light were not related to a missile, and the streak of light reported by most of these witnesses was burning fuel from the accident airplane in crippled flight during some portion of the postexplosion preimpact breakup sequence. The witnesses’ observations of one or more fireballs were of the airplane’s burning wreckage falling toward the ocean. 9. The TWA flight 800 in-flight breakup was initiated by a fuel/air explosion in the center wing fuel tank.

1. Boeing’s design practice that permits parts less than 3 inches long in any direction to

be electrically unbonded may not provide adequate protection against potential ignition hazards created by static electricity generated by lightning or other high-energy discharges.

Conclusions 307 Aircraft Accident Report

1. It is very unlikely that the flammable fuel/air vapor in the center wing fuel tank

(CWT) on TWA flight 800 was ignited by a lightning or meteor strike; a missile fragment; a small explosive charge placed on the CWT; auto ignition or hot surface ignition, resulting from elevated temperatures produced by sources external to the CWT; a fire migrating to the CWT from another fuel tank via the vent (stringer) system; an uncontained engine failure or a turbine burst in the air conditioning packs beneath the CWT; a malfunctioning CWT jettison/override pump; a malfunctioning CWT scavenge pump; or static electricity.

1. Electromagnetic interference from radio frequency sources external to TWA

flight 800 did not produce enough energy to ignite the fuel/air vapor in the center wing fuel tank.

1. Electromagnetic interference from personal electronic devices played no role in

igniting the fuel/air vapor in TWA flight 800’s center wing fuel tank.

1. It is unlikely that electromagnetic interference from aircraft system wiring played a

role in igniting the fuel/air vapor in TWA flight 800’s center wing fuel tank.

1. Existing standards for wire separation may not provide adequate protection against

damage from short circuits.

1. A short circuit producing excess voltage that was transferred to the center wing tank

(CWT) fuel quantity indication system wiring is the most likely source of ignition energy for the TWA flight 800 CWT explosion.

1. Silver-sulfide deposits on fuel quantity indication system components inside fuel

tanks pose a risk for ignition of flammable fuel/air vapor.

1. The ignition energy for the center wing fuel tank (CWT) explosion most likely

entered the CWT through the fuel quantity indication system (FQIS) wiring, and, although it is possible that the release of ignition energy inside the CWT was facilitated by the existence of silver-sulfide deposits on an FQIS component, neither the energy release mechanism nor the location of the ignition inside the CWT could be determined from the available evidence.

1. Failure modes and effects analyses and fault tree analyses should not be relied upon

as the sole means of demonstrating that an airplane’s fuel tank system is not likely to experience a catastrophic failure.

1. A fuel tank design and certification philosophy that relies solely on the elimination of

all ignition sources, while accepting the existence of fuel tank flammability, is fundamentally flawed because experience has demonstrated that all possible ignition sources cannot be predicted and reliably eliminated.

1. Operating transport-category airplanes with flammable fuel/air mixtures in fuel tanks

presents an avoidable risk of an explosion.

Conclusions 308 Aircraft Accident Report

1. The placement of heat-generating equipment under a fuel tank containing Jet A fuel

can unnecessarily increase the amount of time that the airplane is operating with a flammable fuel/air mixture unless measures are in place to either (1) prevent the heat from entering the center wing fuel tank (CWT) or (2) eliminate the flammable vapor inside the CWT.

1. The condition of the wiring system in the accident airplane was not atypical for an

airplane of its age, and the airplane was maintained in accordance with prevailing accepted industry practices.

1. Until recently, insufficient attention has been paid to the condition of aircraft

electrical wiring, resulting in potential safety hazards.

1. The issues defined in the Federal Aviation Administration’s Aging Transport

Non-Structural Systems Plan are important safety issues that must be fully addressed through appropriate changes, including rulemaking. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the TWA flight 800 accident was an explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. The source of ignition energy for the explosion could not be determined with certainty, but, of the sources evaluated by the investigation, the most likely was a short circuit outside of the CWT that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system. Contributing factors to the accident were the design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources and the design and certification of the Boeing 747 with heat sources located beneath the CWT with no means to reduce the heat transferred into the CWT or to render the fuel vapor in the tank nonflammable.

309 Aircraft Accident Report 4. Recommendations 4.1 New Recommendations As a result of the investigation of the TWA flight 800 accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration (FAA): Examine manufacturers’ design practices with regard to bonding of components inside fuel tanks and require changes in those practices, as necessary, to eliminate potential ignition hazards. (A-00-105) Review the design specifications for aircraft wiring systems of all U.S.-certified aircraft and (1) identify which systems are critical to safety and (2) require revisions, as necessary, to ensure that adequate separation is provided for the wiring related to those critical systems. (A-00-106) Require the development and implementation of corrective actions to eliminate the ignition risk posed by silver-sulfide deposits on fuel quantity indication system components inside fuel tanks. (A-00-107) Regardless of the scope of the Aging Transport Systems Rulemaking Advisory Committee’s eventual recommendations, address (through rulemaking or other means) all of the issues identified in the Aging Transport Non-Structural Systems Plan, including • the need for improved training of maintenance personnel to ensure adequate recognition and repair of potentially unsafe wiring conditions; • the need for improved documentation and reporting of potentially unsafe electrical wiring conditions; and • the need to incorporate the use of new technology, such as arc-fault circuit breakers and automated wire test equipment. To determine whether adequate progress is being made in these areas, the Safety Board believes that, within 90 days, the Federal Aviation Administration should brief the Safety Board on the status of its efforts to address all of the issues identified in the Aging Transport Non-Structural Systems Plan. (A-00-108)

Recommendations 310 Aircraft Accident Report 4.2 Previously Issued Recommendations Resulting From This Accident Investigation As a result of the TWA flight 800 accident investigation, the Safety Board issued the following safety recommendations to the FAA on December 13, 1996: Require the development and implementation of design or operational changes that will preclude the operation of transport-category airplanes with explosive fuel/air mixtures in the fuel tanks: (a) Significant consideration should be given to the development of airplane design modifications, such as nitrogen-inerting systems and the addition of insulation between heat-generating equipment and fuel tanks. Appropriate modifications should apply to newly certificated airplanes and, where feasible, to existing airplanes. (A-96-174) (b) Pending implementation of design modifications, require modifications in operational procedures to reduce the potential for explosive fuel/air mixtures in the fuel tanks of transport-category aircraft. In the 747, consideration should be given to refueling the center wing fuel tank (CWT) before flight whenever possible from cooler ground fuel tanks, proper monitoring and management of the CWT fuel temperature, and maintaining an appropriate minimum fuel quantity in the CWT. (A-96-175) Require that the 747 Flight Handbooks of TWA and other operators of 747s and other aircraft in which fuel tank temperature cannot be determined by flight crews be immediately revised to reflect the increases in center wing fuel tank (CWT) fuel temperatures found by flight tests, including operational procedures to reduce the potential for exceeding CWT temperature limits. (A-96-176) Require modification of the center wing fuel tank of 747 airplanes and the fuel tanks of other airplanes that are located near heat sources to incorporate temperature probes and cockpit fuel tank temperature displays to permit determination of fuel tank temperatures. (A-96-177) As a result this accident investigation, the Safety Board also issued the following recommendation to the FAA on February 18, 1997: Develop and implement procedures, including a checklist of safety-related items, for the handling and placement of explosive training aids by K-9 explosives detection teams to prevent contamination of aircraft and airport facilities and to ensure an effective K-9 explosives detection program. (A-97-11)

Recommendations 311 Aircraft Accident Report As a result of this accident investigation, the Safety Board also issued the following recommendations to the FAA on April 7, 1998: Issue, as soon as possible, an airworthiness directive to require a detailed inspection of fuel quantity indication system wiring in Boeing 747-100, -200, and -300 series airplane fuel tanks for damage, and the replacement or the repair of any wires found to be damaged. Wires on Honeywell Series 1-3 probes and compensators should be removed for examination. (A-98-34) Issue an airworthiness directive to require the earliest possible replacement of the Honeywell Corporation Series 1-3 terminal blocks used on Boeing 747 fuel probes with terminal blocks that do not have knurled surfaces or sharp edges that may damage fuel quantity indication system wiring. (A-98-35) Conduct a survey of fuel quantity indication systems probes and wires in Boeing 747s equipped with systems other than Honeywell Series 1-3 probes and compensators and in other model airplanes that are used in Title 14 Code of Federal Regulations Part 121 service to determine whether potential fuel tank ignition sources exist that are similar to those found in the 747. The survey should include removing wires from fuel probes and examining the wires for damage. Repair or replacement procedures for any damaged wires that are found should be developed. (A-98-36) Require research into copper-sulfide deposits on fuel quantity indication system parts in fuel tanks to determine the levels of deposits that may be hazardous, how to inspect and clean the deposits, and when to replace the components. (A-98-37) Require in Boeing 747 airplanes, and in other airplanes with fuel quantity indication system (FQIS) wire installations that are corouted with wires that may be powered, the physical separation and electrical shielding of FQIS wires to the maximum extent possible. (A-98-38) Require, in all applicable transport airplane fuel tanks, surge protection systems to prevent electrical power surges from entering fuel tanks through fuel quantity indication system wires. (A-98-39) For additional information about these recommendations, see section 1.18.3 of this report.

Recommendations 312 Aircraft Accident Report 4.3 Previously Issued Recommendations Classified in This Report The following previously issued recommendations are classified in this report:661 • Safety Recommendation A-96-174 (previously classified “Open— Unacceptable Response”) is classified “Open—Acceptable Response” in section 2.4.2 of this report. • Safety Recommendation A-96-175 (previously classified “Open— Unacceptable Response”) is classified “Open—Acceptable Response” in section 2.4.2 of this report. • Safety Recommendation A-98-37 (previously classified “Open—Acceptable Response”) is classified “Closed—Acceptable Action—Superseded” in section 2.3.2.2.3.1 of this report. • Safety Recommendation A-98-38 (previously classified “Open—Acceptable Response”) is again classified “Open—Acceptable Response” in section 2.3.2.1.2.2.3 of this report. • Safety Recommendation A-98-39 (previously classified “Open—Unacceptable Response”) is classified “Open—Acceptable Response” in section 2.3.2.1.2.2.4 of this report. 661 For the text of these recommendations, see section 4.2. BY THE NATIONAL TRANSPORTATION SAFETY BOARD James E. Hall Chairman John A. Hammerschmidt Member John J. Goglia Member George W. Black, Jr. Member Carol J. Carmody Member Adopted August 23, 2000

Appendixes on pages 313-416 are contained in a separate document for download from http://www.ntsb.gov/investigations/summary/AAR0003.html

this page intentionally left blank

417 Aircraft Accident Report Glossary of Terms Air conditioning pack: An assembly of air conditioning system components that reduces the temperature and pressure of hot bleed air that is then routed to pressurized areas of the cockpit, cabin, and cargo compartments to provide environmental control (pressurization, ventilation, and temperature). The bleed air source can be any one or a combination of the following: engines, auxiliary power unit (APU), or ground air connections. Air cycle machine (ACM): An assembly in the air conditioning system that includes components such as a fan and compressor. When partially cooled air from the heat exchangers requires additional cooling, the air is routed through the ACM expansion turbine for maximum cooling. Alternating current (a.c.): An electric current that periodically changes in direction and constantly changes in magnitude. Ampere (amp): The basic unit of measurement of electric current flow. Arcing: Arcing is defined by Underwriters Laboratories, Inc., as a luminous discharge of electricity across an insulating medium. The electrical discharge of an arc can involve temperatures of several thousand degrees Celsius. Auto ignition: Spontaneous ignition of a fuel/air vapor when it is sufficiently elevated in temperature for ignition to occur without direct contact with an ignition source, such as a spark, arc, or hot surface or filament. Auto ignition is highly dependent upon many factors, including the size of the heated volume and container and other environmental conditions that affect fuel vapor. Existing research indicates that the auto ignition temperature for Jet A fuel/air vapor at sea level is about 460º Fahrenheit (F). Auto ignition temperature increases as the altitude increases. Ballistic coefficient: The weight of an object divided by the product of its drag coefficient multiplied by its area, used to determine the motion of an object in an atmospheric environment. Bleed air: The hot pressurized air ducted from an airplane’s engines, APU, or a ground source for use by other airplane systems (such as pressurization and air conditioning). Body station (STA): A longitudinal point along an airplane’s fuselage, identified numerically by its distance in inches from a reference point. In a classic 747, this point is 90 inches forward of the airplane’s nose. Bomb: (as used in this report) An explosive device designed to release destructive material at high velocity upon detonation, as distinguished from a small explosive charge.

Glossary of Terms 418 Aircraft Accident Report Bonding: Connecting components to maintain them at a common electric potential. Boost pump: (as used in this report) A pump mounted in the wing fuel tanks designed to move fuel from certain wing tanks to the engines. Capacitance: The property of conductors separated by a dielectric material (for example, air or fuel) that permits the storage of electricity when potential differences exist between conductors. Center wing fuel tank (CWT): A fuel tank that, in the 747-100 series, is located in the wing center section (WCS), between the rear spar and spanwise beam (SWB) 3 and that has a Jet A fuel capacity of 86,363 pounds (12,890 gallons). (See wing center section.) Conductivity: A measure of the extent to which a material is capable of conducting an electric current. (See ohm.) Connector: (as used in this report) A device that makes an in-line connection(s) between one or more wires for a continuous electrical path(s) at a location where the wires are subject to being disconnected and reconnected without mismatching circuits. Typical military-specification multicontact electrical connectors are assembled from two subassemblies, the plug and receptacle, which mate to connect wires with pin and socket contacts. Contact: (as used in this report) A device within an electrical connector used to provide the electrical path joining two individual wires. Coupling: Transferring energy between elements or circuits of an electrical system. Current: The movement of electricity (the flow of electrons) through a conductor. Measured in amps. Dielectric: A nonconductor of electricity. Direct current: An electric current that flows continuously in one direction. Dry bay: A compartment in the WCS that is not intended to contain fuel. In the 747-100, a dry bay is located between SWB3 and the forward spar. Electromagnetic environment (EME): The total of all electromagnetic fields and the associated frequencies, power levels, and polarizations in a given or defined region. The EME consists of natural and manufactured sources of electromagnetic energy. Electromagnetic interference: (as used in this report) Electromagnetic energy from a source either internal or external to an aircraft that imposes greater-than-intended voltage on an electrical system.

Glossary of Terms 419 Aircraft Accident Report Energy: The capacity for doing work. It may exist in potential, kinetic, thermal, electrical, chemical, nuclear, or other forms and be transformed from one form to another. Electromagnetic energy is expressed in units of work, such as joules (J) or kilowatt-hours. Explosion: (as used in this report) The sudden and rapid escape of gases from a confined space, accompanied by high temperatures, violent shock, and loud noise. Extremely improbable failure condition: As defined in Federal Aviation Administration Advisory Circular (AC) 25.1309-1A, a condition so unlikely that it is not anticipated to occur during the entire operational life of all airplanes of one type and that has a probability of occurrence on the order of 1 x 10-9 or less each flight hour, based on a flight of mean duration for the airplane type. Failure modes and effects analysis: A structured and systematic analytical method for identifying potential failure modes of a component or system and for evaluating the potential risk(s) that might be posed by various failure modes. Fault tree analysis: An analysis designed to examine an end event through consideration of assumed precipitating events. Each of these precipitating events is in turn broken down until a level is attained in which no additional precipitating events will occur. The total of all of the events and the way in which they are tied together creates the fault tree analysis. Fireball: (as defined by the TWA flight 800 investigation’s Witness Group) One or more downward-moving ball(s) of fire in the sky. According to the Witness Group’s definition, it could be characterized (by witnesses) as either stationary or descending; however, to meet the group’s definition of a fireball, it must not have been reported to have appeared in the sky after the termination of a streak of light (if such a streak were reported). It could not have been an ascending object or an object that met the group’s definition of a streak of light. Flash point: The minimum temperature at sea level at which a liquid fuel vaporizes sufficiently to form an ignitable mixture with air (when exposed to an open flame), as determined by a standardized test procedure. Flashing: (as used in this report) A category of electrical activity observed during short-circuit tests conducted by Lectromechemical Design Company (Lectromec) as a part of the TWA flight 800 accident investigation, characterized by an arcing discharge seen as a single flash of light with an accompanying popping sound. Fuel mass loading: A measure of the amount of fuel relative to the entire volume of its container. Fuel quantity indication system (FQIS): In the 747-100, a system that measures changes in the capacitance of tubular probes located in each fuel tank for the display of fuel quantity on cockpit gauges and on repeater gauges located at the fueling station in the left wing. The system is also connected to systems that require fuel quantity information,

Glossary of Terms 420 Aircraft Accident Report including the gross weight/total fuel weight indicator, airborne integrated data acquisition, and the volumetric shutoff ([VSO] ground refueling) systems. Fuel quantity compensator: A component used in the FQIS or VSO system to compensate for variations in the dielectric constant of fuel, which varies from one type of fuel to another (and even within the same type of fuel, depending on the “batch” and age of the fuel) to ensure consistent fuel quantity indications. There is at least one compensator in each fuel tank. Fuel quantity probe: A component of the FQIS, a set of which is positioned in each of an airplane’s fuel tanks, used to measure the quantity of fuel in each tank through a range of levels within the tank. The 747-100 may have 65 or more fuel quantity probes positioned within the 7 fuel tanks. Fuel washing: Motion of fuel over a part, which can lead to electrostatic charge accumulation or removal of contaminants (such as sulfides). Green zone: One of three debris fields, labeled during the TWA flight 800 accident investigation, from which the accident airplane’s wreckage was recovered. This zone was located farthest east (farthest from John F. Kennedy International Airport [JFK]) in the wreckage distribution. This zone contained pieces of wreckage from both wings and most of the aft portions of the fuselage, including the following: both wings; all four engines; pieces of SWB1, SWB2, mid spar, and rear spar; the aft portion of the keel beam; the main landing gear; and the tail section. Grounding: Connecting electrical circuits to a large common conductor considered to be at zero electrical potential such as the earth or, in the case of an airplane, the skin of the airplane, which is at a fixed electrical potential. Heat exchangers: (as used in this report) Devices in the 747-100 used to initially cool the heated bleed air coming from the engines located within the air conditioning pack bay under the CWT. High-intensity radiated fields: High-power electromagnetic fields that exist in a defined environment, particularly in the vicinity of high-power radar sites, broadcast antennas, and other high-power radio frequency sources. Hot surface ignition: A phenomenon in which a very high temperature surface comes into contact with fuel or fuel vapor that results in ignition. Hot surface ignition is highly dependent upon many factors, including the geometric aspects of the hot surface and other environmental conditions that affect fuel and fuel vapor. Existing research indicates that hot surface ignition temperatures at sea level for fuels similar to Jet A range from 900° to 1,300° F. The hot surface ignition temperature increases as the altitude increases.

Glossary of Terms 421 Aircraft Accident Report Ignition energy: The quantity of heat or electrical energy that must be absorbed by a fuel/air vapor mixture in a finite volume to generate a propagating flame. Commonly measured as the energy provided by a small (millimeter size) spark. Impeller: A blade on a rotating part in an air compressor or fuel pump. Improbable failure condition: As defined in AC 25.1309-1A, a condition not anticipated to occur during the entire operational life of a single random airplane; however, it may occur occasionally during the entire operational life of all airplanes of one type. It has the probability of occurrence on the order of 1 x 10-5 or less, but greater than on the order of 1 x 10-9 each flight hour, based on a flight of mean duration for the airplane type. Jet A fuel: A kerosene fuel used in civilian turbine engine airplanes. Jet A fuel is composed of a mixture of more than 100 distinct types of hydrocarbon molecules; the precise composition often varies between refinery and by season. Jet A fuel is specified to have a minimum flash point of 100° F. Jet A-1 is a similar fuel, but has a slightly lower freezing point. Although Jet A fuel is available in some other countries, it is used primarily in the United States. Jettison/override pump: In the 747, a fuel pump that has two uses, one of which is to jettison fuel overboard when this function is selected at the flight engineering station. The pump is also designed to provide fuel to the engine manifolds at a higher pressure than the boost pumps, which are located in the wing fuel tanks. Two CWT jettison/override pumps are mounted on the rear spar of the CWT, and pressure from these pumps closes the main tank check valves, resulting in the use of fuel from the CWT before that of fuel from the wing tanks. Joule (J): A unit of measurement of electrical work or energy; 1 J is the amount of work done by 1 watt of power in 1 second. Keel beam: A box-shaped, load-bearing structure located along the airplane’s centerline that extends from the aft wall of the forward cargo compartment below the WCS and through the main and body landing gear compartments to the forward wall of the aft cargo compartment. The CWT is located above the keel beam. Kilojoule (kJ): A unit of measurement equaling 1,000 J. Lower flammability limit: The lowest temperature that will provide a sufficient concentration of fuel vapor to propagate a flame. Millijoule (mJ): A unit of measurement equaling one-thousandth of a J. Minimum ignition energy (MIE): The minimum quantity of heat or electrical energy that must be absorbed by an optimal fuel/air vapor mixture in a finite volume to generate a propagating flame. The MIE for Jet A fuel is generally accepted to be about 0.25 mJ.

Glossary of Terms 422 Aircraft Accident Report Ohm: The unit of resistance of an electrical conductor, at which the fall of potential is 1 volt when the current is 1 amp. (See resistance.) Overpressure event: (as used in this report) An event in which the pressure in the CWT is increased in a relatively short time to a level at which the structural integrity of the CWT is compromised. Power: The time rate of energy transfer; the practical unit of measurement is 1 watt. (See watt.) Primary radar target: A radar target produced when a radar signal reflects off of an object’s surface and returns to a ground-based radar antenna/site for processing and display. Quenching: The extinguishment of a combustion flamefront; often as a result of decreased temperature or propagation through a passageway, such as an orifice or a vent. Raceway: A term used to refer to areas within the 747 where wire bundles are grouped into a common route. Red zone: One of three debris fields, labeled during the TWA flight 800 accident investigation, from which the accident airplane’s wreckage was recovered. This zone was located farthest west (closest to JFK) in the wreckage distribution. A relatively small amount of widely dispersed debris was recovered from the red zone, including the following: pieces from the WCS front spar and SWB3, the manufacturing access door from SWB2, pieces of the fuselage from STA 840 and STA 1000, main cabin floor beams and flooring material from above and in front of the WCS area, and the two forward air conditioning packs. (See figure 3a.) Resistance: The property of a conductor that tends to restrict the flow of an electric current. (See ohm.) Ring chord: An angle member that attaches the bottom of the forward fuselage section to the front side of the lower pressure bulkhead and the front spar. Scavenge pump: (as used in this report) A small fuel pump designed to remove the last amounts of accessible fuel from the lowest point of a 747 CWT and discharge the fuel into the left inboard fuel tank. Although the scavenge pump removes fuel not accessible by the jettison/override pumps, a small amount of residual fuel will remain in the fuel tank that the scavenge pump is not able to remove. Scintillation: (as used in this report) A category of electrical activity observed during short-circuit tests conducted by Lectromec as a part of the TWA flight 800 accident investigation, characterized by a high frequency micro-discharge that usually results in the formation of char or soot on a wire (and adjacent wires) over time.

Glossary of Terms 423 Aircraft Accident Report Secondary radar target: A radar target produced when a radar signal is detected by an airplane’s transponder, which transmits a coded message in response to interrogation by a ground-based transmitter. Shielding: (as used in this report) Metal covers placed around electric wires and electronic devices to prevent the intrusion of external electrostatic and electromagnetic fields. Short circuit: An unintended current path between conductors. Short circuits can occur either directly, if the protective insulation covering between internal conductors in each wire is compromised and there is direct contact between the conductors, or through a “bridge” created by contaminants, such as metal shavings or fluid. Sleeve (wire): A woven or flexible jacket that protects electrical wiring. Small explosive charge: A minimal amount of a highly explosive material (such as a plastic explosive) detonated by a fusing device. Spanwise beam 1: One of the lateral beams in the CWT that divides it into compartments and supports the structure of the WCS. SWB1 is located between the mid and rear spars. Spanwise beam 2: One of the lateral beams in the CWT that divides it into compartments and supports the structure of the WCS. SWB2 is located between the mid spar and SWB3. Spanwise beam 3: One of the lateral beams in the CWT that divides it into compartments and supports the structure of the WCS. SWB3 is located between SWB2 and the front spar. Spar: A beam that extends laterally through the WCS into the outboard wing structure. The 747-100 has front, mid, and rear spars. Splice (wire): (as used in this report) A fixed connection of two electrical wires. Splices can be made by various methods, such as soldering wires together or with crimped metal barrels, and are typically covered by insulating material. Streak of light: (as defined by the TWA flight 800 investigation’s Witness Group) An object moving in the sky that could be variously described in witness documents as a point of light, fireworks, a flare, a shooting star, or something similar, which was usually described as ascending, but could also be described as arcing over and/or descending. Streak-of-light witness: (as defined by the TWA flight 800 investigation’s Witness Group) Any witness who reported seeing an airplane in the general vicinity of a streak of light at the same time that the streak of light was visible (around the time and vicinity of the TWA flight 800 accident). (See witness.)

Glossary of Terms 424 Aircraft Accident Report Stringer: A stiffening member found in the 747-100’s fuselage and wings that helps to support and reinforce the structure. Strong arcing: (as used in this report) A category of electrical activity observed during short-circuit tests conducted by Lectromec as a part of the TWA flight 800 accident investigation, characterized by an arcing discharge that could continue for hundreds of cycles, typically involving 5 kJ of electrical energy. Surge tank protection system: A system to detect and extinguish fire that consists of a series of optical photocells that trigger the discharge of Halon (a fire extinguishing agent) into the surge tank when a flame or bright light source is sensed in the surge tank. Discharge of the extinguishing agent is designed to occur about 1 millisecond after the photocell senses a flame. Transient suppression device: An electrical device that limits the amount of energy or current that can pass through it to a predetermined amount. Transient voltage: A temporary voltage surge or excursion; for example, that which occurs when first turning an electrical system on. Transponder: The airborne receiver/transmitter portion of a radar system that responds to interrogation signals received from ground-based equipment. Ullage: The space in a fuel containing tank not occupied by liquid fuel. Upper flammability limit: The maximum temperature at which a concentration of fuel vapor will propagate a flame. Volt: The basic unit of measurement of electromotive force (the force that causes electrons to flow through a conductor). One volt is the electromotive force required to cause current to flow at the rate of 1 amp through a resistance of 1 ohm. One volt equals 1 amp times 1 ohm. Watt: The basic unit of measurement of power. In electrical application, 1 watt equals 1 volt times 1 amp. (See power.) Weathering: The change in a liquid fuel chemical composition as a result of exposure to environmental conditions. An example involves heating and pressure changes to a vented aircraft fuel tank, where preferential evaporation of the lower molecular weight components of the jet fuel occurs, resulting in a redistribution of the chemical composition of the remaining liquid fuel. Wing center section: A large structural box located aft of the forward cargo compartment and forward of the main landing gear bay in the lower fuselage between the wings, which comprises the CWT and a dry bay directly forward of the CWT. (See center wing fuel tank.)

Glossary of Terms 425 Aircraft Accident Report Witness: (as defined by the TWA flight 800 investigation’s Witness Group) Anyone who reported hearing a sound and/or seeing an event or object or objects (including smoke or fire) in the sky around the time and vicinity of the TWA flight 800 accident. According to the Witness Group’s definition, it must have been likely that the sound or object observed was related to the crash, and the report must not have been a secondhand account. Yellow zone: One of three debris fields, labeled during the TWA flight 800 accident investigation, from which the accident airplane’s wreckage was recovered. This zone was the smallest of the three zones and was contained within the red zone on its northeastern side and located in a small concentrated area. This zone contained wreckage from the forward portion of the fuselage, from STA 90 (the nose of the airplane) to STA 840, including the cockpit, section 41, and the forward portions of section 42. (See figure 3a.) This wreckage was found relatively intact.

FD07224 ｜ 2000_美国_HAR0001.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB00-916201 NTSB/HAR-00/01 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HIGHWAY ACCIDENT REPORT GREYHOUND MOTORCOACH RUN-OFF-THE-ROAD ACCIDENT BURNT CABINS, PENNSYLVANIA JUNE 20, 1998 7216

National Transportation Safety Board. 2000. Greyhound Motorcoach Run-off-the-Road Accident, Burnt Cabins, Pennsylvania, June 20, 1998. Highway Accident Report NTSB/HAR-00/01. Washington, DC. Abstract: On June 20, 1998, about 4:05 a.m., on the Pennsylvania Turnpike near Burnt Cabins, Pennsylvania, a Greyhound Lines, Inc., motorcoach traveled off the right side of the roadway into an emergency parking area. It struck the back of a parked tractor-semitrailer, which was pushed forward and struck the left side of another parked tractor-semitrailer. Of the 23 people on board the bus, the driver and 6 passengers were killed; the other 16 passengers were injured. The two occupants of the first tractor- semitrailer were injured, and the occupant of the second tractor-semitrailer was uninjured. The major safety issues discussed in this report are the busdriver’s performance, the adequacy of carrier oversight, the adequacy of the design and the appropriateness of the use of pull-off areas, the lack of motorcoach emergency interior lighting and retroreflective signage, and the organization of the disaster preparedness and emergency response management. As a result of its investigation, the Safety Board issued recommendations to the National Highway Traffic Safety Administration; the Pennsylvania Turnpike Commission; Greyhound Lines, Inc.; the United Motorcoach Association; and the American Bus Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety at http://www.ntsb.gov. Other information about available publications may also be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, East, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB00-916201 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

Highway Accident Report Greyhound Motorcoach Run-off-the-Road Accident Burnt Cabins, Pennsylvania June 20, 1998 NTSB/HAR-00/01 PB00-916201 National Transportation Safety Board Notation 7216 490 L’Enfant Plaza, S.W. Adopted: January 5, 2000 Washington, D.C. 20594

this page intentionally left blank

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Vehicle Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Engine Electronic Control Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Transmission Electronic Control Unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Busdriver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Medical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Driving Record . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Complaints About the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Motor Carrier Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Motor Carrier Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Schedules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Speeding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Pre- and Posttrip Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Accident Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Voice Response Unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Mystery Rider Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1-800-SAFEBUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Federal Motor Carrier Safety Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1997 Greyhound Compliance Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1996 Greyhound Compliance Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1995 Greyhound Compliance Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Accident History at Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Pennsylvania Turnpike Pull-Off Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Truck Parking Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Pathological and Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Emergency Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Hustontown (Fulton County) Volunteer Fire and Rescue Company . . . . . . . . . . . . . . 35 Metal Township (Franklin County) Fire and Rescue Company . . . . . . . . . . . . . . . . . . 36 Cumberland Valley (Cumberland County) Hose Company . . . . . . . . . . . . . . . . . . . . . 37 West End (Cumberland County) Fire and Rescue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Turnpike Incident Management Program and Command System . . . . . . . . . . . . . . . . . . . . 38 Incident Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Contents iv Highway Accident Report Communications Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Emergency Response Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Pennsylvania State Police Troop T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Incident Command System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Postaccident Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Busdriver Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Carrier Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Highway Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 B: Other Vehicles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 C: Injury Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 D: Federal Motor Carrier Safety Ratings Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . 72

v Highway Accident Report Acronyms and Abbreviations AASHTO American Association of State Highway and Transportation Officials ABA American Bus Association AFIP Armed Forces Institute of Pathology ATA American Trucking Associations, Inc. CAD computer-aided dispatch CDL commercial drivers’ license CFR Code of Federal Regulations Commission Pennsylvania Turnpike Commission communications center Operations Control Center DDEC Detroit Diesel Electronic Controls Detroit Diesel Detroit Diesel Corporation DOT U.S. Department of Transportation DPS Department of Public Safety ECM electronic control module ECU electronic control unit EKG electrocardiogram EMA Emergency Management Agency EMS emergency medical services EMT emergency medical technician FAA Federal Aviation Administration FHWA Federal Highway Administration FMCSR Federal Motor Carrier Safety Regulations FMVSS Federal Motor Vehicle Safety Standards FSP full-service plaza Greyhound Greyhound Lines, Inc. IC incident commander ICS Incident Command System MP milepost MUTCD Manual on Uniform Traffic Control Devices NHTSA National Highway Traffic Safety Administration NMN National Motorcoach Network Oliver Oliver Trucking Incorporated OMCHS Office of Motor Carriers and Highway Safety

Acronyms and Abbreviations vi Highway Accident Report PSP Pennsylvania State Police TEA 21 Transportation Equity Act for the 21st Century Trailways Trailways Incorporated TransAm TransAm Trucking Incorporated TRI Trucking Research Institute UMA United Motorcoach Association VRU voice response unit

vii Highway Accident Report Executive Summary About 4:05 a.m. on June 20, 1998, a 1997 Motor Coach Industries 47-passenger motorcoach, operated by Greyhound Lines, Inc., was on a scheduled trip from New York City to Pittsburgh, Pennsylvania, traveling westbound on the Pennsylvania Turnpike near Burnt Cabins, Huntingdon County, Pennsylvania. As the bus approached milepost (MP) 184.9, it traveled off the right side of the roadway into an “emergency parking area,”1 where it struck the back of a parked tractor-semitrailer, which was pushed forward and struck the left side of another parked tractor-semitrailer. Of the 23 people on board the bus, the driver and 6 passengers were killed; the other 16 passengers were injured. The two occupants of the first tractor-semitrailer were injured, and the occupant of the second tractor-semitrailer was uninjured. The National Transportation Safety Board determines that the probable cause of this accident was the busdriver’s reduced alertness resulting from ingesting a sedating antihistamine and from his fatigued condition resulting from Greyhound Lines, Inc., scheduling irregular work-rest periods. Contributing to the severity of the accident was the Pennsylvania Turnpike Commission’s practice of routinely permitting nonemergency parking in pull-off areas within the highway clear zone. The major safety issues identified in this accident are the busdriver’s performance, the adequacy of carrier oversight, the adequacy of the design and the appropriateness of the use of pull-off areas, the lack of motorcoach emergency interior lighting and retroreflective signage, and the organization of the disaster preparedness and emergency response management. As a result of this accident investigation, the Safety Board makes recommendations to the National Highway Traffic Safety Administration; the Pennsylvania Turnpike Commission; Greyhound Lines, Inc.; the United Motorcoach Association; and the American Bus Association. 1 The 28-foot-wide 1,000-foot-long area off the roadway was used for vehicular parking.

this page intentionally left blank

1 Highway Accident Report Factual Information Accident Narrative Introduction About 4:05 a.m. on June 20, 1998, a 1997 Motor Coach Industries 47-passenger motorcoach, operated by Greyhound Lines, Inc. (Greyhound), was on a scheduled trip from New York City to Pittsburgh, Pennsylvania, westbound on the Pennsylvania Turnpike near Burnt Cabins, Huntingdon County, Pennsylvania. (See figure 1.) The bus was carrying the driver and 22 passengers. As the bus approached MP 184.9, it traveled off the right side of the roadway, at a departure angle of between 3 and 4 degrees, into an “emergency parking area” and struck the back of a TransAm Trucking Incorporated (TransAm) parked tractor-semitrailer, which was pushed forward and struck the left side of an Oliver Trucking Incorporated (Oliver) tractor-semitrailer, parked in front of the TransAm vehicle. (See appendix B for information on the TransAm and Oliver vehicles.) According to the TransAm truckdriver, he and his codriver were sleeping in their truck’s sleeper berth at the time of the accident. About 1:30 a.m., he had stopped his vehicle, leaving its parking lights on, in the parking area, about 9 to 10 feet from the edge Figure 1. Map of accident area.

Factual Information 2 Highway Accident Report of the travel lane, because it was raining heavily at that time.1 They were awakened and injured by the severity of the impact. The Oliver truckdriver was also sleeping in his truck’s sleeper berth at the time of the collision. The TransAm truckdriver said that the area2 was a common place for truckdrivers to stop and rest and that he noticed about four other trucks parked there. (See figure 2.) (See appendix B for information on the occupants of the TransAm and Oliver trucks.) About 5 minutes after the accident occurred, another Greyhound bus was on the turnpike en route to Breezewood, Pennsylvania, when the driver saw the accident bus, which appeared to be parked with its lights off, on the shoulder area.3 The busdriver said that he observed that the bus had crashed into the rear of a tractor-semitrailer and he pulled off the road to help. He pounded on the door of a tractor-semitrailer behind the accident bus and asked the occupant to call 911 on her cellular phone; he then used her phone to call the Greyhound maintenance response division in Dallas, Texas. Of the 23 people on board the bus, the driver and 6 passengers were killed; the other 16 passengers sustained serious to minor injuries. The two occupants of the TransAm tractor-semitrailer received serious and minor injuries, and the occupant of the Oliver tractor-semitrailer was uninjured. 1 Accu-Weather Forecasts for the Pennsylvania Turnpike stated that a cluster of showers and thunderstorms, moving slowly southward, had affected districts 1, 2, and 3 (the accident occurred in district 2) earlier on June 19 and 20, 1998. During the course of the night and morning hours, thunderstorms developed rapidly and moved across parts of the turnpike. Torrential downpours and cloud-to-ground lightning were associated with these storms. The storms had produced local flooding and wind gusts of up to 40 mph. 2 A full-service plaza (FSP) was about 13 miles away at MP 172.3. Figure 2. View of accident. 3 According to Greyhound policy, a driver is not supposed to pass a Greyhound bus that is pulled over without lights without checking to see whether the driver of the parked bus needs assistance.

Factual Information 3 Highway Accident Report Events Preceding the Accident Table 1 reflects pertinent events leading up to the accident. The table was compiled using information from hotel registries, the driver’s logbook entries, the accident bus’ voice response unit (VRU),4 and its engine’s electronic control module (ECM).5 According to Greyhound officials, the busdriver’s wife and grandchild boarded the bus in Philadelphia to ride with him on the his last trip before retirement. The Safety Board interviewed two other Greyhound drivers who had spoken to the accident driver at his next stop in Harrisburg. One of the interviewed drivers said that the accident driver appeared to be content with retiring, seemed normal, and did not seem tired or anything out of the ordinary. An off-duty Pennsylvania State Police (PSP) trooper in a private vehicle reported that a few minutes before the accident on June 20, 1998, he was en route to Pittsburgh on the turnpike near the Tuscarora Tunnel. He recalled that when he entered the tunnel (MP 187.03) he noticed a Greyhound bus ahead of him in the right lane and that he was a short distance behind the bus when it exited the tunnel (MP 186.04). The State trooper stated that when both vehicles were about 500 to 1,000 feet beyond the tunnel, he started to pass the bus and saw it drift to the right, across the edge line, about half the width of the bus. He observed the bus correct back into the right lane and then drift left toward the center line. He said that when he was even with the driver’s side window, he looked at the driver and saw a white male. The State trooper stated that the bus was traveling between 60 and 65 mph at that time. He said that he did not observe anything else unusual and continued on to Pittsburgh. Emergency Response The initial 911 cellular call from the occupant of a truck at the scene to the Hustontown (Fulton County) fire and rescue “dispatch”6 was received about 4:11 a.m. by an emergency medical technician (EMT) at a local ambulance service.7 According to the EMT, he obtained all the pertinent information from the 911 caller in about 3 minutes. He immediately contacted the turnpike dispatch center in Highspire, Pennsylvania,8 which then dispatched emergency medical services, fire companies, and the PSP at 4:16 a.m. 4 A computerized communication system used by Greyhound and its drivers. (See Greyhound Oversight section in this report for more information.) 5 A semiconductor unit for controlling ignition timing and other parameters in an engine management system. (See Engine Electronic Control Module section for more information.) 6 Fulton County does not have a 24-hour 911 emergency dispatch communications center; therefore, 911 calls for Fulton County fire and rescue assistance are transferred to a local number (used as the “emergency number” for the county). Calls to this local number are simultaneously channeled to four different locations: the Hustontown Volunteer Fire Department, a local ambulance service (which is where the EMT received the initial call), a local garage, and the Fulton County Medical Center. 7 Approximate time based on receiver’s attempt to recall time he looked at his watch. 8 The standard procedure when an accident occurs on the turnpike.

Factual Information 4 Highway Accident Report Table 1. Events preceding the accident. Shift Number Date Location Events Preceding the Accident Source Comments June 16 Pittsburgh Checked into hotel 2:45 p.m. Hotel registry Day 1 of 4-day shift June 17 Checked out of hotel 1:07 a.m. Hotel registry On-duty-not-driving* 1:00 a.m. to 2:00 a.m. Busdriver log On-duty driving** 2:00 a.m. to 6:00 a.m. Busdriver log Harrisburg On-duty-not-driving 6:00 a.m. to 6:30 a.m. Busdriver log On-duty driving 6:30 a.m. to 8:30 a.m. Busdriver log Philadelphia On-duty-not-driving 8:30 a.m. to 9:30 a.m. Busdriver log On-duty driving 9:30 a.m. to 12:00 p.m. Busdriver log New York City On-duty-not-driving 12:00 p.m. to 12:30 p.m. Busdriver log Driver logs indicated 8.5 hours driving, 3 hours on-duty-not-driving, and 12.5 hours off duty Off-duty*** 12:30 p.m. to 1:30 a.m. Day 2 of 4-day shift June 18 On-duty-not-driving 1:30 a.m. to 2:30 a.m. Busdriver log On-duty driving 2:30 a.m. to 5:00 a.m. Busdriver log Philadelphia On-duty-not-driving 5:00 a.m. to 5:30 a.m. Busdriver log On-duty driving 5:30 a.m. to 12:00 p.m. Busdriver log Pittsburgh On-duty-not-driving 12:00 p.m. to 12:30 p.m. Busdriver log Driver logs indicated 9 hours driving, 1.5 hours on-duty-not-driving, and 11.5 hours off-duty. This is the last driver log entry found. The driver made a VRU entry at 1:04 p.m. Checked into hotel 1:30 p.m. Hotel registry Day 3 of 4-day shift Checked out of hotel 10:05 p.m. Hotel registry Departed Pittsburgh 11:33 p.m. VRU The VRU was used to reconstruct events in the absence of driver logs, but it could not be used to identify on- and off-duty times. June 19 Philadelphia Arrived Philadelphia 5:35 a.m. VRU Not driving 5:35 a.m. to 6:07 a.m. VRU New York City Arrived New York City 8:56 a.m. VRU Checked into hotel 11:30 a.m. Hotel registry Day 4 of 4-day shift Checked out of hotel 8:30 p.m. Hotel registry Departed New York City 9:08 p.m. VRU Philadelphia Arrived Philadelphia 11:58 p.m. VRU Not driving 11:58 p.m. to 12:35 a.m. VRU The ECM indicated that the bus was idling from 12:00 a.m. to 12:45 a.m. June 20 Harrisburg Arrived Harrisburg 2:40 a.m. VRU The ECM indicated that the bus was driven from 12:45 a.m. to 2:30 a.m. Not driving 2:40 a.m. to 2:57 a.m. VRU The ECM indicated that the bus was idling from 2:30 a.m. to 3:00 a.m. Departed Harrisburg 2:57 a.m. VRU Burnt Cabins Accident at 4:05 a.m. VRU The ECM indicated that the bus was driven from 3:00 a.m. to about 4:00 a.m.

• Title 49 Code of Federal Regulations (CFR) Part 395.2 defines on-duty-not-driving as all time from beginning work or being in readiness for

work and until being relieved from work or responsibilities. ** Title 49 CFR Part 395.2 defines driving as all time spent at the driving controls of a commercial motor vehicle in operation. *** Title 49 CFR Part 395.8(h)(1) defines off-duty as time not performing any work activity for the carrier or other compensated work.

Factual Information 5 Highway Accident Report After notifying the turnpike dispatch center, he contacted the Hustontown Volunteer Fire Department and was informed that the accident had occurred in the Metal Township (Franklin County) Fire and Rescue Company call box area.9 Metal Township is the closest fire and rescue facility to the accident site. (The Hustontown Fire Department then “stood down” as primary responding department.) The EMT next reached the Franklin County dispatch center and was instructed to dispatch the Hustontown Fire Department, which arrived first on scene at 4:22 a.m. The Metal Township firefighters arrived on scene shortly thereafter. The Metal Township fire chief, as the first senior ranking fire officer in the jurisdiction to arrive, assumed the role of incident commander (IC) for fire and rescue operations at the accident site. The first responding senior ranking PSP trooper was the IC for the turnpike and was responsible for the highway, highway safety, and accident investigation. In addition to the above agencies, responders to the accident included Chambersburg Hospital (Franklin County) ambulances, the Cumberland Valley (Cumberland County) Hose Company, the Fannet-Metal Township (Franklin County) Fire Company, Huntingdon County, the Maryland State Police medivac helicopter, the Mercersburg (Fulton County) Fire Department, the Pleasant Hall (Fulton County) Fire Company, Waynesboro Hospital (Franklin County) advance life support ambulances, and the West End (Cumberland County) Fire and Rescue. (See figure 3 for the locations of emergency response departments.) 9 A box card assignment set up exists for turnpike accidents. This assignment is a special area covered on the turnpike (Metal Township has the 2176 box) in which a prearranged number of units are to go to a specific accident. Figure 3. Locations of emergency response departments.

Factual Information 6 Highway Accident Report Injuries A total of 19 injured people were transported to three hospitals. One of the injured bus passengers expired upon arrival at the hospital. One bus passenger sustained serious injuries, including brain contusions; skull, pelvic, and torso fractures; and multiple lacerations; 15 bus passengers received minor injuries involving multiple contusions, lacerations, and abrasions. The two occupants of the TransAm truck sustained serious and minor injuries. Table 2 is based on injury criteria10 of the International Civil Aviation Organization, which the Safety Board uses in accident reports for all transportation modes. (See appendix C for an injury table based on the Abbreviated Injury Scale of the Association for the Advancement of Automotive Medicine.) Vehicle Information Motor Coach Industries Corporation of Pembina, North Dakota, manufactured the 47-passenger coach in September 1997. It was equipped with a Detroit Diesel Series 50, 8.5 liter, electronically controlled diesel engine, which was outfitted with a Detroit Diesel Electronic Controls (DDEC) model III ECM, which limited the maximum engine speed to 70 mph. The engine had a Jacobs engine brake.11 The coach was outfitted with an Allison B500, 6-speed, electronically controlled, double overdrive, automatic transmission, which was programmed through its electronic control unit (ECU) to limit gear usage to gears one through five. The bus was equipped with a Rockwell/Meritor dual wheel drive axle (gross weight rating of 22,000 pounds) with an air spring design suspension that utilized air springs, shock absorbers, radius rods, and an antisway bar. 10 Title 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “Any injury which results in death within 30 days of the accident.” It defines serious injury as an injury that “(1) Requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second or third degree burns, or any burn affecting more than 5 percent of the body surface.” Table 2. Injuries. Injuries Drivers Bus Passengers Truck Occupants Total Fatal 1 6 0 7 Serious 0 1 1 2 Minor 0 15 1 16 None 0 0 1 1 Total 1 22 3 26 11 A vehicle retarder system that modifies the engine valve timing to enable the engine to provide compression braking to augment the vehicle foundation brake system.

Factual Information 7 Highway Accident Report The coach was equipped with an S-cam air-actuated mechanical brake system. Greyhound maintenance records indicated that the brakes were last inspected on June 17, 1998. A visual inspection of the brake drums and system revealed no signs of cracking, contamination, defects, or deficiencies. Inspection brake applications were made using 95 pounds of air pressure per square inch supplied from an outside air source, and the brakes functioned as designed. Engine Electronic Control Module Safety Board investigators removed the ECM, and Detroit Diesel Corporation (Detroit Diesel) technicians extracted the data contained in the ECM. A printed “Engine Usage Profile” report of the data was provided to the Safety Board. The Detroit Diesel technicians enabled the optional “data pages” recording capability of the ECM, which had not previously been activated. According to Detroit Diesel, the data pages option on the DDEC III models, such as this one, requires a one-time activation fee; on the newer DDEC IV ECMs, this option is standard. In the inactive condition, the data pages information was still being captured but could be accessed only by the manufacturer. At the time of the data extraction, the ECM’s time clock was in error and read “10/22/85 14:08:10” when power to the ECM was disconnected. The date in the data file was adjusted to June 20, 1998, and the time was adjusted according to the point of power loss and approximate time of the accident. The information retrieved by Detroit Diesel from the equipment was used by the Safety Board to reconstruct the Greyhound driver’s driving activity. The information accessed from the ECM data pages indicated that, on the day of the accident, the coach was idling motionless from 12:00 to 12:45 a.m.12 The bus was driven from 12:45 until 2:30 a.m. and idled motionless until about 3:00 a.m. It was driven again from 3:00 a.m. until the ECM stopped recording at approximately 4:00 a.m. The ECM data also indicated that the bus had been operated at speeds as high as 76 mph on the day of the accident13 and as high as 90 mph during the previous 90 days. Safety Board investigators were unable to determine the exact dates and operators of the occurrences due to the characteristics of the data pages printout. Fifteen instances were recorded in which the coach’s speed ranged between 80 and 90 mph, and 34 instances were recorded in which the coach’s speed ranged between 71 and 80 mph.14 Hard brake15 data for the day of the accident indicated that between 12:00 p.m. on June 19 and about 12 All times are approximations based on the ECM Engine Usage Profile Report. 13 The speed limit for the turnpike is 65 mph. 14 The DDEC III ECM sampling rate of 10 times per second and resolution of ± 0.5 mph are dictated by the Society of Automotive Engineers J1587 standards. The speed given by the ECM can be higher than actual values due to tread wear. The accident coach had relatively new tires on the drive axle (approximately 0.1875-inch reduction in tire radius). As a result, actual speeds would be approximately 0.6 mph and 0.8 mph higher than the corresponding ECM speeds of 76 mph and 89.7 mph. A study of a DDEC III ECM on a similarly equipped bus was performed by Safety Board staff to evaluate its accuracy. Both speed and hard braking were found to be recorded within the accuracy expected. 15 Defined by Detroit Diesel as a deceleration greater than 7 mph per second.

Factual Information 8 Highway Accident Report 4:00 a.m. on June 20, the coach experienced two hard brake applications. The coach was driven on 13 of the 15 days immediately before the accident. The average high speed recorded for the 13 days was 78 mph, with a total of 14 hard brake applications. According to Greyhound’s senior vice president of operations, in June 1998, Greyhound was operating about 2,000 coaches, of which approximately 370 were equipped with either a DDEC III or IV ECM unit. ECM information was extracted during routine preventative maintenance strictly to ensure that the governed speed of the buses had not been tampered with and to monitor fuel consumption. He stated that, other than this use, Greyhound did not recognize a need for using the data pages recording options that were available because as of January 1998, Greyhound was operating only about 300 coaches with DDEC units. In August 1999, Greyhound was operating about 2,200 coaches of which approximately 900 were equipped with the units. Greyhound projects that around April 2000, the company may be operating about 1,300 coaches with DDEC III and IV ECM units. Greyhound has tentative plans to have older engines remanufactured by Detroit Diesel and equipped with DDEC III ECM units. As of November 1999, Greyhound had not instituted a program to use the available ECM information in the oversight of driver operating habits. Transmission Electronic Control Unit The ECU was removed from the bus, and the Allison Transmission Corporation assisted the Board in its analysis. The ECU was not equipped to save vehicle speed, engine or transmission revolutions per minute, gear position, or torque or load percentages; therefore, these data could not be obtained. Damage The coach sustained substantial front-end damage and intrusion. (See figure 4.) Maximum right frontal intrusion was measured about 8 1/3 feet in the area of the floor line. The right front wheel assembly had been displaced rearward approximately 1 1/2 feet. The front bumper had been separated from the vehicle. The lower right front of the vehicle was displaced rearward about 1 3/4 feet and skewed upward approximately 1 foot. The roof along the right side had been displaced rearward 2 3/4 feet and was skewed downward. Maximum left frontal intrusion had occurred in the area of the windows; rearward displacement was about 9 feet. The left front leading edge of the roof was displaced rearward 2 feet and was skewed down and inward. The area of the front bumper mounts was displaced rearward 2 feet. Cutting tool-type damage was observed on the left side near the third and fourth windows with the cut section of the body panel pulled downward. The left front wheel assembly had been displaced rearward approximately 1 inch. The coach’s windshield was destroyed. The wiper arms were in the off position, as were the left and right windshield wiper control knobs. The steering wheel had been displaced rearward approximately 5.75 feet. The driver seat was not in place due to crush deformation rearward to the second row of passenger seats. (See figure 5.)

Factual Information 9 Highway Accident Report Figure 4. Exterior of damaged accident bus. Figure 5. Interior left-side (driver) crush damage.

Factual Information 10 Highway Accident Report The coach was equipped with seven top-hinged emergency exit side windows on each side, excluding the driver’s side windows. The passenger windows were 54 inches wide by 30 inches high. At the time of inspection, the first through third windows (front to rear) on the left side were missing; the fourth through seventh windows were intact and operational as emergency exits. On the right side, the first window was missing, the second was shattered, and the remaining windows were intact. The third window did not operate as an exit due to damage; the fourth window sustained structural damage and did not close, and its exit handle was blocked by a seat back. The remaining windows were operational as exits. The coach had 11 rows of passenger seats, including the three-seat bench in the rear, which was intact. On the left side of the bus, the row-two seats were severely deformed, and the seats from rows three through five were found in the luggage compartment under the bus body. The row-six aisle seatback sustained inward deformation, while the row-seven aisle seat was rotated clockwise 10 degrees. The row- eight seatback cushions showed no evidence of impact marks, and the row-nine window seatback cushion was broken. At row 10, impact marks were on the aisle seatback cushions. On the right side of the bus, the passenger loading door was missing due to crush damage, which extended rearward to row two (see figure 6), and was found in the lower luggage compartment. Row three was crushed rearward into row four. From row 4 rearward through row 11, the seat frames were intact with some deflection of the seatback cushions. The window seats in rows four through eight were pushed forward and outward, with deformation to the rear of the seat below the level of seatback. Rows 9 through 10 were found relatively intact, without rear seatback deformation. Busdriver Information The 61-year-old busdriver held a valid Class B Pennsylvania commercial drivers’ license (CDL) with passenger endorsement. The license was renewed on October 16, 1996, and had an expiration date of December 31, 2000. The busdriver had been employed by Trailways Incorporated (Trailways) from April 1973 to August 1987, at which time Trailways merged with Greyhound. He had reported 32 years of busdriver experience on his Greyhound employment application. The busdriver listed his assignments with Trailways as dispatcher, busdriver, maintenance supervisor, and terminal manager. No records were available from the busdriver’s employment with Trailways. Since the merger, the busdriver had been employed as a full- time driver with Greyhound. Before his current assignment to the Pittsburgh terminal, he had been assigned to the Philadelphia terminal from September 1996 to April 1997 and to the Pittsburgh terminal from June to September 1996. Other Greyhound duty stations listed were Camden, New Jersey; New York City; and Washington, D.C. The busdriver had been assigned to the Pittsburgh Greyhound terminal since April

1. He had bid and been selected in February 1998 for his present scheduled route, which

he had driven weekly up to the time of the accident. The busdriver worked a 4-days-on

Factual Information 11 Highway Accident Report with 2-days-off cycle. His roundtrip schedule included driving from the Pittsburgh terminal to the New York City Port Authority (trip no. 1350) and from New York City to Pittsburgh (trip no. 1369). The busdriver was in the 4th day of the cycle and on trip no. 1369 when the accident occurred. The busdriver’s routine was to drive about 300 miles to Pittsburgh from Boothwyn, Pennsylvania, just south of Philadelphia. Greyhound files had the driver’s recorded home address as Boothwyn. He usually checked into a hotel in Pittsburgh in the afternoon and checked out about 10 hours later. He then reported to the terminal, from which he departed on his scheduled trip. Medical Greyhound records revealed that during a March 1993 physical examination, the busdriver was diagnosed with hypertension and prescribed medication to control it. Records from his most recent physical examination, conducted on October 10, 1996, indicated that his blood pressure was normal. (No evidence was found to indicate that he was taking medication for hypertension at the time of the accident.) The busdriver’s current medical examiner’s certificate was also issued on October 10, 1996, and would have expired on October 9, 1998. Figure 6. Interior right-side loading door and seat damage.

Factual Information 12 Highway Accident Report The busdriver received his last eye examination on November 1, 1996; at that time, his optometrist reported that his corrected vision was 20/25 in both eyes. The busdriver’s medical certificate required him to wear corrective lenses while operating a vehicle. However, the busdriver had a valid Pennsylvania driver’s license that permitted him to operate vehicles without corrective lenses. The State requires an eye examination only at the time the license is issued. Safety Board investigators were unable to determine whether the busdriver was wearing corrective lenses when the accident occurred. On November 10, 1997, the busdriver visited his family physician complaining of nonradiating left-sided chest pain when at rest, short-term memory loss, and irritability. He also complained, as noted on the summary sheet from the visit, that he was limited to 10 hours driving per day but sometimes drove as much as 18 hours,16 had trouble sleeping, and woke after only 3 to 4 hours of sleep. His physician ordered complete blood work, an electrocardiogram (EKG), and a Thallium stress test17 for him. No abnormalities were found during the examination except for slightly elevated cholesterol levels. According to the busdriver’s sons, their father had a sinus condition for which he had surgery in the 1970s. They said that he took an over-the-counter decongestant medication daily. Training According to Greyhound, since 1992 all driver candidates have had to attend a 7-week structured initial training course, which includes classroom studies and behind-the-wheel instruction. Greyhound restructured its training program in response to Safety Board recommendations issued in 1992.18 Because the accident driver began his employment with Greyhound before the implementation of this training requirement, he did not receive the training. In addition, according to Greyhound, all drivers are required to attend an 8- to 10-hour in-service training program every 2 years. This program addresses several driving topics, including, but not limited to, fatigue, inclement driving conditions, and seasonal driving techniques. The driver refresher program has been in place since November 1997; according to the Greyhound director of training, as of November 1999, all drivers have received the driver refresher training. Greyhound stated that some type of refresher training has always been administered in the past, as well as an annual program about driving in inclement weather. The accident driver’s personnel file did not contain any documentation of in-service training. 16 Safety Board investigators were unable to verify whether he was referring to bus driving time only or was including driving his personal vehicle. 17 A test performed, using a treadmill, to evaluate changes in EKG and blood distribution in the heart brought on by exercise. 18 National Transportation Safety Board. 1992. Greyhound Run-off-the-Road Accidents, Donegal, Pennsylvania, June 26, 1991, and Caroline, New York, August 3, 1991. Highway Accident Report NTSB/HAR-92-01. Washington, DC.

Factual Information 13 Highway Accident Report Drivers returning to work after an extended leave of 30 days or more are required, according to Greyhound, to attend a 1-day driver refresher course, which may include a road test. The company stated that the purpose of the course is to reiterate safe driving techniques, driving skills, and Greyhound’s service policies and to highlight the topics presented in the initial training course. Safety Board investigators did not discover, nor did Greyhound provide to investigators, any manual, course syllabus, or support documentation for refresher training. In December 1992, after an absence of more than 30 days, the accident driver satisfactorily completed refresher training with a road test. The remarks section of the documentation noted that he “could use a refresher in about 3 to 6 months”;19 however, no documentation was found to indicate that such follow-up training was administered during that period. After returning to work from sick leave, the accident driver did again satisfactorily complete refresher training with a road test in January 1995. No documentation was located that described either the content or the duration of the training. According to Greyhound, a driver refresher course may also be administered to drivers who have been involved in an accident or have received driving complaints. Although referred to as a refresher course, the curriculum and length differ from the above-described refresher course; the course is specifically designed to address the actions that caused the accident or the complaint. The accident driver’s personnel file contained two forms for a “notice of personnel record entry” indicating his involvement in two preventable accidents20 on November 19, 1995, and December 26, 1996. The 1995 accident involved another vehicle. The 1996 accident involved a “fixed object where he struck a parked car,” and the personnel entry form stated that “due to the seriousness of the above accident, you are hereby required to take a 2-day refresher course.” No other documents were found in the file indicating whether the accident driver had attended or successfully completed any refresher courses for these occurrences. All training that each employee receives, according to Greyhound policy,21 is documented in the individual driver’s personnel file. A random review of 40 personnel and driver qualification files by Safety Board investigators revealed that 13 files did not contain the company-required documentation, that one driver with 20 years of service had only one entry for manual transmission training, and that another driver with 18 years of service had no training entries. Driving Record A review of the busdriver’s personnel record revealed three speeding violations, one each in November 1989, February 1992, and August 1994. Records indicate that the 19 Safety Board investigators and Greyhound officials were unable to determine the source of this comment. 20 Defined by the Federal Highway Administration as an accident that (1) involves a commercial motor vehicle; (2) includes a fatality, injury, or damage requiring a vehicle be towed; and (3) could have been averted but for an act, or failure to act, by the motor carrier or driver. 21 Policy 68: “It is the policy of this company to document all formal training attended by or provided to employees, contractors, and others.”

Factual Information 14 Highway Accident Report 1992 and 1994 speeding violations occurred while he was operating a bus. The 1992 ticket was issued for traveling 77 mph in a 55-mph zone, for which Greyhound suspended him for 5 days. The busdriver received a written warning from Greyhound for the 1989 speeding violation. The busdriver’s personnel records also revealed that including the two accidents mentioned above, he was involved in two accidents in 1990; one in 1991; one in 1993; three in 1995, one of which resulted in an unsafe-lane-change violation; and two in 1996. All of these accidents occurred while he was operating a bus. Although present in the driver’s personnel files, these accidents do not appear in the Pennsylvania motor vehicle records for the driver. Additionally, the busdriver’s personnel records disclosed that he had received 5-day suspensions in 1989 and 1990 for “refusing an assignment” and for “operating a bus without authorization,” respectively. Two warnings were noted in the record for “failing to show up for work” on July 23, 1990, and December 24, 1993. He also received a 2-day suspension for “failing to fill out a passenger list after an accident” and a 1-day suspension for “log violations” in 1995. Greyhound has a safe driver award recognition program; the awards are presented annually. To qualify for a safety award, a driver must complete 6 consecutive months of driving without a preventable accident. A driver may obtain subsequent safety awards by completing 12 consecutive months of driving without a preventable accident. Traffic violations do not preclude awards. According to Greyhound, the accident busdriver had received a 6-month safe driving award in 1988 and 1-year awards in 1990 through 1993.22 Complaints About the Driver A passenger who said she frequently traveled on Greyhound between Philadelphia and Pittsburgh contacted Safety Board investigators after the accident. She reported that, in December 1997 and January 1998, she rode a Greyhound bus that was driven by the accident driver. She said that, during these trips, she saw the busdriver “nod off” as he drove the bus. During the December trip, she then observed the bus drift to the right onto the grooved pavement of the right shoulder. She said that the sound of the tires on the grooves awakened the driver and that he steered to the left back onto the roadway. The passenger reported that the busdriver repeated the same behavior several more times during the trip. She believed that he must have fallen asleep at least once every hour. The passenger reported that, on one occasion, she informed two Greyhound supervisors at the Pittsburgh terminal of her observations. The passenger said that the supervisors displayed an “unconcerned attitude” and that one supervisor said of the driver falling asleep, “don’t they all.” 22 The records of other interstate carriers’ busdrivers are not stored in a central repository. Individual companies retain their drivers’ records, making it difficult to obtain information to compare the accident driver’s record with other interstate carrier busdrivers. However, according to the Greyhound safety director, the accident busdriver’s record was a little below average when compared with the other Greyhound busdrivers’ records.

Factual Information 15 Highway Accident Report On a third occasion in January 1998, this passenger again boarded a bus with the accident driver. She said that she asked him whether he was going to fall asleep during the trip and that he became angry, ejected her from the bus, and escorted her to a supervisor. The passenger reported that the busdriver told the supervisor that she had a “smart mouth” and that he would not permit her to ride on his bus. She noted that another passenger left the bus at the same time. After she filed a written report with the supervisor about her observations on the other trips, the supervisor placed her and the other passenger on another bus. After the Burnt Cabins accident, the passenger recognized the busdriver from a photograph on a news report. She stated that she then attempted to notify Greyhound but was disconnected. She said that on a second attempt, she talked to a reservationist with Greyhound who referred her to another number, which she did not call. According to Greyhound’s vice president of driver operations, when a complaint about a driver is received, whether oral or written, it is forwarded to the driver’s immediate supervisor for a follow-up investigation. In the case of an oral complaint, the supervisor will request that it be provided in writing. The supervisor will investigate and document in the driver’s personnel file whether the complaint is founded or unfounded. The supervisor may discuss the findings of the investigation with the driver or take other action, following the guidelines of progressive discipline, which can range from an oral warning to suspension without pay or termination. Figure 7. Chart of busdriver’s driving record.

Factual Information 16 Highway Accident Report Although the vice president of driver operations advised the Safety Board about the above procedures, Greyhound has no written policy for documenting and processing driver complaints. Greyhound had no record of the complaints about the accident busdriver, nor did the employees involved in the situation recall the incidents. Greyhound’s 1-800-SAFEBUS program23 does include a written policy for processing complaints against drivers. Motor Carrier Information Greyhound operates 24 hours a day, 7 days a week, as an interstate carrier of passengers providing scheduled bus service within the continental United States, and it has limited operations in Canada and Mexico. Greyhound conducts special destination,24 charter, and package services throughout its scheduled areas. Greyhound is registered with the Federal Highway Administration (FHWA) as an interstate carrier. All scheduled Greyhound operations are monitored from a central location in Dallas, Texas. Greyhound has 11 driver operation and customer service districts that encompass 88 terminals to which drivers are assigned and report for work; driver supervisors are assigned to 61 of these terminals. In addition, passengers can be picked up or discharged at 1,530 bus stop locations. Greyhound travels approximately 254.6 million miles annually in scheduled passenger service. At the time of the accident, Greyhound had a fleet of 2,155 motorcoaches; it owned 873 and leased 1,282 buses. The average age of the fleet was 6.11 years. Greyhound employed 4,121 drivers (4,013 full time and 108 part time). The average driver age and experience were 47 and 11 years, respectively. Motor Carrier Oversight To reduce accidents and ensure compliance with Federal regulations, according to Greyhound, it has in place a multifaceted oversight program that includes driver training, driver refresher training (every 2 years), a safety manual, driver supervision by field safety managers, safety managers riding with drivers, customer service feedback from passengers, and safety bulletins (at least one per month). Greyhound policy 37 states, “The company is committed to the safety of its passengers and employees.” A full-time safety director reports directly to the chief operating officer. A staff of 18 employees under the safety director is responsible for overseeing the drivers’ 24-hour period of records of duty status (logs) and qualification 23 See 1-800-SAFEBUS program section in this report for more details. 24 Casinos, shows, and special events.

Factual Information 17 Highway Accident Report files and the alcohol and drug testing program and for preparing safety bulletins and coordinating safety meetings. Greyhound reported that it generates an average of 4,200 driver logs per day. The log books are submitted monthly to an outside vendor, CommData, in Carrolton, Texas, for review, computer analysis for hours-of-service, and storage. The vendor provides Greyhound with log book hours-of-service discrepancies it discovers. Any hours-of- service discrepancies found by the vendor are forwarded to the safety director, who notifies the driver’s supervisor for appropriate action. In November 1998, the vendor notified Greyhound that of the 106,679 logs reviewed, 152 logs were found to have exceeded the 10-hour rule, 76 logs exceeded the 15-hour rule, and 115 logs exceeded the 70-hour rule.25 According to Greyhound, its drivers routinely have daily contact with company safety supervisors at the terminals and receive a monthly newsletter, which covers various safety topics. According to Greyhound and the drivers, management, drivers, and operational personnel participate in quarterly safety meetings. Each terminal has a bulletin board on which safety memos and posters provided by the safety department are to be displayed. Safety Board investigators examined posters and safety messages that, according to Greyhound, were previously displayed in terminals and are now retained in the safety department files. Schedules Greyhound reported that its schedules comply with Federal regulations and take into account such factors as the number of drivers located in specific cities, the location of maintenance facilities, the seniority of drivers, and the availability of dormitories or hotels when overnight stays are built into the runs. Greyhound and union representatives review the schedules or runs at least four times a year to ensure that they meet Federal and company standards. A regular driver, also known as a scheduled run driver, is one who drives a scheduled run (tour) with specified stops. The schedules specify a departure and an arrival time at each terminal. The drivers are required to sign in (on-duty-not-driving), usually 30 minutes before their first departure time and to sign off (off-duty), usually 30 minutes after their last arrival time. Some schedules require a driver to pick up or drop off a bus at a garage away from the terminal, requiring an additional 15 to 30 minutes of on-duty time. A contractual agreement between Greyhound and the Amalgamated Transit Union establishes the Greyhound drivers’ compensation rate. Greyhound predetermines the compensation rate for each tour based on the tour scheduled driving time. Drivers are contractually obligated, without further compensation, to perform pre- and posttrip bus 25 Title 49 CFR Part 395.3 prohibits motor carriers who operate 7 days a week from permitting or requiring any driver to drive more than 10 hours following 8 consecutive hours off-duty, or for any period after having been on-duty 15 hours following 8 consecutive hours off-duty, or for any period after accumulating 70 hours on-duty in any period of 8 consecutive days.

Factual Information 18 Highway Accident Report inspections, load baggage, fuel buses, and take tickets; for scheduled rest stops of 30 minutes or longer; and for delays of up to 45 minutes upon completion of the trip. Drivers receive additional compensation if the schedule requires them to transport the bus to a garage that is separate from the terminal and if they are more than 45 minutes late (compensation begins after the first 45 minutes).26 Policy 37 in the Greyhound safety manual states, “A regular driver’s commute time plus the on-duty not driving/driving time of the run must be 15 hours or less. If a regular driver’s commute time plus the on-duty not driving/driving time is greater than 15 hours he will not be permitted to bid the run.” The commute time, according to the Greyhound safety director, is considered only when the driver is reporting to drive the run and not when the driver is returning home after driving the run. The accident driver’s tour required him to sign on-duty 30 minutes before the scheduled departure time and sign off-duty 35 minutes after arrival time. The scheduled time for the tour was 11 hours 30 minutes. Safety Board investigators drove at the posted speed limits from Boothwyn (the accident driver’s address) to Pittsburgh (the driver’s home terminal), and the trip took 5 hours 30 minutes. According to the vice president of driver operations, Greyhound permits drivers to bid on runs by seniority and has no limit on the commute distance that scheduled run drivers can live from the terminal when they bid on a run. However, scheduled run drivers have to have a local address near the terminal or board location within 2 weeks of bid acceptance and are permitted to use dormitory facilities at the terminal for up to 30 days until they find living quarters. Living arrangements can be either permanent or temporary. Extra board drivers27 are required to reside within 2 hours travel time of the terminal to which they report. Greyhound has no written policies for establishing and maintaining a domicile address and does not require that records of a driver’s domicile address be maintained. The accident driver’s personnel and driver qualification file listed a Boothwyn address; no documents were found that listed his domicile address in the Pittsburgh area. Safety Board investigators found that, like the accident driver, other drivers in the Greyhound system are assigned to a terminal and use other facilities, such as hotels, that are away from their permanent residence. Speeding According to Greyhound, each bus in its fleet is equipped with an ECM that governs or restricts the bus operation to a maximum speed of between 68 and 70 mph. However, the ECM data downloaded from the accident bus indicated that the bus had 26 In December 1998, a Safety Board investigator questioned the president of the Amalgamated Transit Union about scheduling and compensation for required safety inspections. According to the investigator, the union president responded that he did not know anything about this and terminated the telephone call by hanging up. 27 Extra board drivers are drivers who are not assigned a regular scheduled trip but are available on-call, as needed for extra runs, charters, or in the absence of a regular driver.

Factual Information 19 Highway Accident Report traveled at speeds as high as 76 mph on the day of the accident and as high as 90 mph during the 90 days preceding the accident. Safety Board investigators, while driving the accident driver’s route between New York City and Pittsburgh, observed Greyhound buses speeding as high as 86 mph and on occasion following other vehicles closely. They found that the buses did not travel faster than the governed speed on an upgrade or level road surface but did exceed the governed speed on a downgrade. As a result of their observations, Safety Board investigators monitored Greyhound buses with radar, pacing them with a global positioning system mapping computer program. The monitoring was conducted throughout the United States from the terminals in Harrisburg; Pittsburgh; Denver, Colorado; Cincinnati, Ohio; Atlanta, Georgia; Nashville and Chattanooga, Tennessee; Seattle, Washington; Dallas; Milwaukee, Wisconsin; and Baltimore, Maryland. Safety Board investigators identified the number of each bus on 40 different trips and observed that all 40 drivers were speeding, 6 were following too closely, 5 made improper lane changes, and 10 disregarded red traffic signals. Five drivers exceeded 80 mph, one driver operated at 86 mph, and another driver traveled at 73 mph in a 40-mph construction zone. Greyhound was advised of the above findings and identified 35 of the 40 drivers.28 The Safety Board reviewed the logs of the 35 drivers and calculated average daily speeds from the log entries by dividing the miles driven by the duty hours driving. The findings varied and included three drivers who averaged 20 to 25 mph on a run, one driver who averaged 120 mph, and another driver who averaged 247 mph. According to the Greyhound safety director, after the Safety Board observed the 40 buses speeding, Greyhound observed an additional 140 buses and found that 140 drivers exceeded the posted speed limit. The company, according to the Greyhound safety director, has begun a radar monitoring program of buses by safety managers. As of November 1999, Greyhound had five radar units and planned to acquire a sixth within another month. Company policy, according to Greyhound, is, “if you are late, stay late,” and its purpose is to reduce the drivers’ need to speed. The drivers’ performance evaluation does not address on-time arrival. Safety Board investigators interviewed 2 Greyhound drivers and received correspondence from 11 others on the issue of speeding. These drivers stated they often try to make up for lost time by speeding. The drivers indicated that ensuring passengers made connections with other buses was a reason for speeding. They said that the driver is normally the one who hears complaints about missed connections from passengers. The drivers also stated that when they depart late, they report that they arrive late, even if they arrive on time. They believe that if they are able to drive the trip in a shorter time, Greyhound will reduce the schedule time, thus reduce their pay. Safety Board investigators reviewed several Greyhound trip schedules and found that they could be met without exceeding the speed limit. 28 Five drivers were not identified because of discrepancies in schedules and bus numbers.

Factual Information 20 Highway Accident Report Pre- and Posttrip Inspections The Federal Motor Carrier Safety Regulations (FMCSR) list the vehicle parts that must be inspected by a driver before operating a bus. The driver of a commercial motor vehicle is to “be satisfied that the motor vehicle is in safe operating condition” and is prohibited from operating the vehicle if found in unsafe condition. The driver is also required to conduct a posttrip inspection of the vehicle daily and is directed to make a written report of the inspection and submit it to the carrier. Any defects found “that would likely affect the safety operation of the vehicle” must be corrected before the vehicle can be driven on a public roadway. The accident bus was operated on two runs on June 19, one of which included the accident trip. The accident driver completed the Greyhound pre- and posttrip inspection reports for the accident bus for June 19, even though the accident occurred before the run was completed. Accident Register Title 49 Code of Federal Regulations (CFR) 390.15(b) requires that all carriers maintain an accident register for 1 year that records all reportable accidents involving the carriers’ vehicles. A reportable accident is defined as one that involves (1) a fatality, (2) bodily injury requiring immediate medical treatment, or (3) one or more vehicles damaged to such an extent that towing is required. The accident register must contain the accident date, location, driver name, injuries, and fatalities and state whether hazardous materials, other than vehicle fuel, were involved and released. A review of its accident register for January 1998 through October 1998 revealed that Greyhound had recorded 150 reportable accidents, which involved a total of 4 fatalities, 57 injuries, and 89 towed vehicles. Two errors were noted on the accident register. A traffic collision near Flagstaff, Arizona, on July 13, 1998, resulted in a fatality; the register recorded it as an injury accident. Then, a traffic accident at Mount Pocono, Pennsylvania, resulted in 10 injuries; the register listed it as a noninjury accident.29 Safety Board investigators reported these errors to the Greyhound director of safety, who has informed the Safety Board that the accident register has been corrected. Voice Response Unit Since 1992, Greyhound has utilized the VRU, a computerized communication system, for busdrivers to transmit information to Greyhound management. The system employs between 100 and 120 lines to accommodate calls. According to Greyhound, 75 percent of the calls to the dispatch center are through the VRU system. Greyhound operation requires drivers to enter their current terminal location through the VRU telephone keypad. Greyhound officials stated that as much as a 15-minute delay can occur from the time a driver arrives at a terminal and the time he 29 Safety Board investigators determined the errors after reviewing the State police reports for the two accidents.

Factual Information 21 Highway Accident Report actually enters information into the VRU system. They said that the drivers’ duties vary from terminal to terminal, which could delay the VRU transmission. Greyhound officials also reported that a through driver (one who is continuing his trip to another terminal to load or unload passengers) can do both the inbound and outbound call at the same time. In addition, management uses the VRU system to call drivers to work, to notify drivers of run bid changes, to gather passenger counts for planning purposes, and to broadcast safety messages. The drivers can also use it to monitor the assignment board and to receive personal mailbox messages. Mystery Rider Program Under Greyhound’s Mystery Rider Program, a compensated volunteer, usually a former Greyhound manager, randomly observes the company facilities, equipment, service, and schedule times and the driver skills and practices. On-board mystery riders30 monitor busdrivers who have complaints lodged against them concerning their driving habits or customer service skills. Information obtained by a mystery rider is filed with management and placed in a driver’s personnel file. 1-800-SAFEBUS The 1-800-SAFEBUS program is described in the Greyhound safety manual as one of its driver safety check programs. The purpose of the program is to allow the public to report to the company, using a toll free telephone number, on driver performance, service, and driving behavior. According to Greyhound, a 1-800-SAFEBUS decal is displayed on the rear exterior of most Greyhound buses in the upper left-hand corner. Greyhound currently contracts with an outside vendor, Fleetsafe, in Atlanta to service the program. At the time of the accident, the vendor was Safetynet, which was purchased by Fleetsafe in November 1998. The contract costs are based on the number of vehicles in the fleet so, according to Greyhound, it is important that each bus be identified with a 1-800-SAFEBUS decal. When Fleetsafe receives a 1-800-SAFEBUS call, a telephone operator there has a script displayed on a computer screen to ensure that the proper information is obtained. According to Greyhound, when the vendor receives either a positive report or a complaint from an identified caller leaving a telephone number, it notifies the Greyhound safety department. If a complaint is received from an anonymous caller, the vendor will neither process the complaint nor notify Greyhound, and no further action is taken. Greyhound specifies this procedure because of prank anonymous complaints received in the past. At the time of the accident, the 1-800-SAFEBUS program operated by Safetynet provided similar service. 30 According to the Greyhound safety director, the company had 10 mystery riders in 1999. Greyhound has no set schedule for the use of mystery riders, and their use varies from year to year. The director of safety was unable to determine how many times the mystery riders were used in 1999.

Factual Information 22 Highway Accident Report Greyhound policy requires its safety department to contact the caller and solicit further details. In the case of either a negative or positive report, a fax is forwarded to the driver’s supervisor. All 1-800-SAFEBUS complaints are filed at the driver’s home terminal and do not become part of the driver’s personnel or qualification files. The supervisor may discuss the incident with the driver, institute a check ride with a supervisor or mystery rider, or do nothing. According to Greyhound, no discipline can directly result from a 1-800-SAFEBUS complaint; however, the complaint can lead to further Greyhound inquiry that may result in driver discipline. In addition, according to Greyhound, its safety department receives monthly 1-800-SAFEBUS reports containing the type and location of driver complaints. The safety department follows up with supervisors concerning disciplinary action to be taken for drivers who are repeatedly listed on the monthly reports. Through the 1-800-SAFEBUS program, Fleetsafe also provides an emergency notification service to Greyhound. If a 1-800-SAFEBUS call is received indicating that a Greyhound bus is involved in an accident or needs assistance, the operators at Fleetsafe contact emergency services in that area and notify essential Greyhound management and safety personnel. On July 15, 1998, a Safety Board investigator called 1-800-SAFEBUS and identified a bus traveling from Harrisburg that was speeding and following too closely and had disregarded a red light. The operator stated that it was unnecessary to provide a name or telephone number and that the information would be given to a Greyhound supervisor. Because of the operator’s statement, the investigator did not leave a name or number. When Safety Board investigators conducted a review of company records in October 1998, no record of this call was found. According to Greyhound management, the operator should have solicited a name so that the call could have been processed further. Greyhound did advise the 1-800-SAFEBUS vendor, which was Safetynet at that time, of its phone operator’s comments, but no additional information was obtained. On August 6, 1998, a Safety Board investigator again called 1-800-SAFEBUS and identified a bus traveling from Cincinnati that was speeding, following too closely, and making sudden lane changes. The Safety Board investigator identified himself and provided his name and number to the operator. The 1-800-SAFEBUS incident report on file at Greyhound did not reflect the speeding complaint, no follow-up call was made to the Safety Board investigator, and no action was taken by Greyhound. In October 1998, Safety Board investigators reviewed incidents reported to 1-800-SAFEBUS for April through September 1998. The term selected encompasses the time period before and after the accident. In April, May, June, July, August, and September, respectively, 2, 38, 343, 385, 354, and 213 incidents were reported. The low number of incidents reported in April, according to Greyhound, was the result of its own management and internal program changes.

Factual Information 23 Highway Accident Report During the investigation of this accident, Safety Board investigators and Greyhound managers randomly selected for review 3 of 1,186 driver incidents that had been reported to 1-800-SAFEBUS. The nature of the complaints and Greyhound’s findings were:

1. rude and discourteous service. Call back made to complainant, and complaint

referred to driver’s supervisor. No further action indicated.

1. changing lanes and cutting off another motorist. Call back made to

complainant, and incident report forwarded to driver’s supervisor. Follow-up interview included explanation by driver and supervisor’s comments to the driver. Documented with supervisor’s recommendation for driver refresher if subsequent infractions occur. Form signed by supervisor, but not by driver.

1. unsafe lane change and improper passing. Call back made to complainant, and

incident referred to supervisor. Follow-up included driver check ride, report of which indicated driver courteous and operating bus in safe manner. No further action taken. Federal Motor Carrier Safety Ratings Greyhound has been subject to several Office of Motor Carriers and Highway Safety (OMCHS) compliance reviews,31 which have been conducted by the OMCHS or Texas. (See appendix D for information on Federal motor carrier ratings procedures.) The most recent review of Greyhound before this accident was done by the Texas Department of Public Safety (DPS) on July 16, 1997. The other safety compliance reviews were performed by the OMCHS in 1996, 1995, 1993 (twice), 1991, and 1989. All reviews resulted in satisfactory ratings. However, the FHWA made recommendations to Greyhound for improved safety in some of those reviews, as follows. 1997 Greyhound Compliance Review After reviewing the data from the Texas DPS review (see table 3), the FHWA recommended to Greyhound that it conduct periodic internal reviews of its driver qualification files, hours-of-service controls, vehicle maintenance practices, accident analysis and reporting procedures, training, and other safety systems to ensure continued compliance with the FMCSRs. 31 Title 49 CFR Part 385.3 defines “compliance review” as an on-site examination of motor carrier operations, such as drivers’ hours of service, maintenance and inspection, driver qualification, CDL requirements, financial responsibility, accidents, hazardous materials, and other safety and transportation records, to determine whether a motor carrier meets the safety fitness standard.

Factual Information 24 Highway Accident Report 1996 Greyhound Compliance Review In 1996 the OMCHS discovered 12 violations, 11 of which were logbook-related. It made the following recommendations:

1. Do not permit a person to drive after testing positive for controlled substances

unless that person has been evaluated by a substance abuse professional.

1. Establish a system of control for driver hours-of-service to prevent hours-of-

service violations and falsification of logbooks.

1. Do not dispatch drivers who do not have adequate hours-of-service available to

complete the trip.

1. Verify hours-of-service records with supporting documents.

1995 Greyhound Compliance Review In 1995, the safety compliance review identified 144 violations of the FMCSRs; 120 were drivers failing to forward logbook pages to the company within the required Table 3. Greyhound 1997 compliance review. Factors Points Violations 1 - General 0 None 2 - Driver 0 10 ---- section 382.413, failure to obtain drug/alcohol information from previous employer 02 ---- section 391.11(b)(8), no indication of road test 03 ---- section 391.23(a), no preemployment background check 01 ---- section 391.25, failure to review driver qualification file annually A total of 156 driver records were checked. Because no violation was weighted as acute or critical, no points were assessed. 3 - Operational 0 04 ---- section 395.3, hours-of-service A total of 868 records were checked. This section is weighted as critical. A pattern of noncompliance equals 10 percent, or more, violations in records checked. Since the number of violations did not exceed 10 percent of the records checked, no points were assessed. 4 - Vehicle 0 None A total of 572 roadside vehicle inspections were reviewed. An out-of-service rate of 5.6 percent was determined. The 34-percent limit was not met; therefore, no points were assessed. 5 - Hazardous Materials Not Applicable 6 - Accidents 0 None Greyhound recorded 61 reportable accidents in the 12 months before the review. (Greyhound vehicles, nationally, accumulated over 254.6 million miles in that time.) The accident rate was 0.24, which fell below the 0.3 criteria; therefore, no points were assessed.

Factual Information 25 Highway Accident Report 13-day time limit, and 12 involved hours-of-service breaches. The FHWA made the following recommendations:

1. Ensure that all drivers are qualified and that complete driver employment files

are maintained.

1. Ensure drivers receive a medical examination every 24 months.
2. Ensure that all drivers participate in preemployment, biennial, random,

reasonable cause, and postaccident drug and alcohol screenings.

1. Maintain all required controlled substance testing records.
2. Do not permit employees who have tested positive for controlled substances to

drive.

1. Require all drivers to prepare and submit accurate logbook entries within

13 days.

1. Implement a system of hours-of-service control and do not permit drivers to

violate the 10-, 15-, and 70-hours-of-service rules.

1. Ensure that all vehicles are systematically repaired and maintained.

Highway Information The multi-vehicle accident occurred in a marked emergency parking pull-off area adjacent to the straight and slightly uphill westbound lanes of the Pennsylvania Turnpike32 at MP 184.9 in Huntingdon County, between the Fort Littleton interchange (13) at MP 179.5 and the Willow Hill interchange (14) at MP 188.6. This segment of the turnpike was constructed in 1940 and designated as Interstate 76 in 1956. (See figure 1.) The posted speed limit was 65 mph. According to turnpike traffic flow records, the average daily traffic between interchanges 13 and 14 was 19,033 vehicles (34 percent commercial) in 1997 and 20,278 vehicles (34 percent commercial) in 1998. The turnpike consists of 506 miles of roadway, of which 360 miles are private, with 46 interchanges and 5 tunnels. The turnpike has 22 full-service plazas (FSPs).33 The distance between these plazas is between 31 and 35 miles, depending on the direction of travel and the turnpike segment. Also, emergency call boxes line both sides of the turnpike at 1-mile intervals, providing motorists in need of assistance with an instant link to the turnpike’s communications center in Highspire. A call box is located at MP 185.05 at the beginning of the emergency parking area. 32 The Pennsylvania Turnpike Commission was created in May 1937 to construct, operate, and maintain a limited-access toll road. 33 According to the Pennsylvania Turnpike Commission, Federal grants comprised l.33 percent of its total revenues and receipts from June 1, 1998, through May 31, 1999. Federal funds are allocated to purchase equipment, such as variable message signs and other advanced electronic equipment, and are not used for highway construction or maintenance.

Factual Information 26 Highway Accident Report At the accident area, the roadway was straight with a 3-percent grade. The roadway had an asphaltic concrete surface with asphalt shoulders that were reportedly wet at the time the accident.34 The cross section of the westbound roadway consisted of a 4.5-foot-wide left shoulder, two 12-foot-wide lanes with a 1.2-percent side slope, and an approximately 28-foot-wide right shoulder (emergency pull-off area) with a 4.2-percent side slope and a 45-degree embankment. The east and westbound traffic lanes were separated by 45-inch-high Jersey barriers. The lane markings were 15-foot-long painted white stripes at 25-foot intervals. The lane markings and the standard 4-inch solid yellow and white edge lines were all visible. At the accident site, the highway shoulder had rumble strips that were approximately 4 inches from the travel lane. Tire marks, approximately 28 feet long, at the accident site had a departure angle from the roadway between 3 and 4 degrees. The tire marks started about 170 feet west of MP 185 (see figure 8). Approximately 39 feet of gouges and scrub marks were observed on the shoulder pavement, as well as an impact mark on the earthen embankment. In addition, 61-foot-long tire marks from the TransAm tractor-semitrailer’s precollision parked position to its postcollision position were identified. The PSP surveyed the accident scene and the final rest positions of the accident vehicles. Accident History at Site Using Pennsylvania Turnpike Commission (Commission) accident reports, the Safety Board compiled a 5-year (January 1993 to December 1997) accident history of the area 1.5 miles in both directions from the accident site. During this period, 23 accidents occurred, of which 8 included injuries and 15 had property damage. No fatal accidents were reported. Five of these accidents occurred at night; 18 occurred during daylight. One of the 18 daylight accidents occurred in the accident site emergency parking area. It involved a single vehicle and occurred during snowfall. Of the five night accidents, two involved more than one vehicle. One of these two involved a truck tractor that was rear-ended by a car in the roadway. According to the Commission’s records, the same 5-year period average fatal accident rate for the entire turnpike was 0.44 and the injury rate was 26.5 per 100-million vehicle miles. For the same period, the number of vehicles using the turnpike was approximately 118.97 million, and the miles driven were about 4.5 billion. Between 1993 and 1997, per 100-million vehicle miles, the fatal accident rate for the Nation’s interstates and for rural interstates in Pennsylvania was 0.75 and 0.57, respectively. 34 The off-duty State trooper who traveled through the scene moments before the accident and the investigating PSP reported no problems with visibility at the time of the accident. They said that, although it had been raining heavily earlier, the rain had stopped. Patches of damp areas remained on the roadway, but no standing water was present. All reported low-level fog, or what they interpreted as steam, rising about 2 or 3 feet from the road surface.

Factual Information 27 Highway Accident Report Figure 8. Accident scene diagram.

Factual Information 28 Highway Accident Report Pennsylvania Turnpike Pull-Off Areas The turnpike has several different types and sizes of pull-off areas, both unmarked and marked emergency parking and picnic areas. The accident occurred at a marked emergency parking pull-off area about 13 miles from the next FSP (MP 172.3). The TransAm tractor semitrailer was parked 9 to 10 feet from the edge of the travel lane. According to the Commission, the unmarked pull-off areas have evolved over time as a result of construction or maintenance equipment pulling off the travel lanes and shoulders onto these areas during roadway rehabilitation or snow removal procedures. The Commission advised that these areas were never intended to be used as emergency parking or picnic pull-off areas by the motoring public. The Commission has published guidelines35 for the marked emergency parking and picnic areas that include having a minimum length of 200 and 300 feet, respectively; being on a level or downhill grade; and being on the inside of a horizontal curve with adequate sight distance. Picnic tables can be placed outside the clear zone and have to meet current Americans with Disabilities Act requirements. The guidelines do not allow the placement of emergency parking signs at pull-off areas with picnic tables. The signs used at the picnic areas and FSPs are in accordance with the Manual on Uniform Traffic Control Devices (MUTCD),36 Section 2D-42, “Rest Area Signs.” Unlike the picnic and emergency parking pull-off areas, the FSPs have deceleration and acceleration ramps. The Commission uses emergency parking signs that are similar to those prescribed in the MUTCD, Section 2B-34, “Emergency Parking Signs.” The MUTCD states that these signs are to be horizontal rectangles with a black legend on a white background and recommends that the size of signs on freeways be 4 by 3 feet. During nighttime testing by the Safety Board, these signs were clearly visible to approaching traffic. The Commission does not define what constitutes an emergency for vehicles parked in the emergency parking or any pull-off area, nor does it regulate traffic using the pull-off areas that are not marked. The Commission contends that, if a driver is fatigued or if a commercial driver needs to stop to avoid hours-of-service violations, the emergency parking and other pull-off areas provide a zone where a stopped vehicle can be off and away from the travel lanes of the turnpike. The Commission discourages the use of shoulders other than during a mechanical break down and encourages the removal of a vehicle as quickly as possible. The Commission believes a vehicle on the shoulder poses a greater risk to other vehicles because of its proximity to the roadway. 35 Guidelines for Signing Pull-Off Areas as Emergency Parking Areas and Guidelines for Placement of Picnic Tables in Pull-Off Areas. 36 U.S. Department of Transportation Federal Highway Administration, Manual on Uniform Traffic Control Devices, For Streets and Highways, 1988 edition.

Factual Information 29 Highway Accident Report Truck Parking Facilities A few days after the accident, during its on-scene investigation, the Safety Board surveyed the pull-off areas, east and westbound, between the accident site (MP 184.9) and interchange 12 (MP 161.4), and observed their use for truck parking. (See table 4.) Table 5 provides information on the signage of pull-off areas throughout the turnpike, as observed by Safety Board investigators. Commercial Vehicle Parking Space. The U.S. Department of Transportation (DOT) contracted with the Trucking Research Institute (TRI)37 in 1992 to study the adequacy of truck parking at public rest areas along the interstate system. The results of the study,38 published by the American Trucking Associations, Inc., (ATA) in 1996, found a shortfall of 28,400 truck parking spaces in rest areas nationwide. It stated: Table 4. Pull-off area utilization. Direction Milepost A.M. Vehicles Notes Westbound *185.0 2:57 4 Combinations 3 Illuminated with marker lights *183.3 2:59 None *181.1 3:01 None 178.8 3:04 None 178.4 3:07 None 3 White/orange stripe vertical barriers 177.8 3:11 None Left-hand curve 176.7 3:14 None Eastbound 173.8 4:07 9 Combinations 4 Illuminated with marker lights 174.5 4:09 1 Combination No lights on 175.2 4:11 None 176.4 4:12 None Closed and barricaded 176.7 4:14 1 Combination No lights on 3 reflective triangles *179.2 4:19 3 Combinations 3 Illuminated with marker lights *183.8 4:24 **3 Combinations 1 Passenger car 2 Illuminated with marker lights no lights on car *184.7 4:26 7 Combinations 6 Illuminated with marker lights

• Designated as emergency parking area.

** One combination receiving assistance from mobile repair truck. 37 TRI is the research component of the American Trucking Associations Foundation, Inc., an affiliate of the ATA. 38 Commercial Driver Rest Area Requirements: No Room at the Inn, American Trucking Association Foundation, Inc., 1996, ATA Product Code: C0887.

Factual Information 30 Highway Accident Report The average current national truck parking space shortfall per rest area is 21. On a rest area basis, this shortfall is the highest in Connecticut, New Jersey, South Carolina, and Tennessee. . . . States where the current shortfall estimates are greatest include California, Pennsylvania, New York, Texas, and Virginia. The TRI study found a total of 63 rest areas in Pennsylvania. (The turnpike’s 22 FSPs comprised 35 percent of that total.) In the 63 rest areas, approximately 1,175 truck parking spaces were available, and the study indicated a need for about 3,157 spaces, implying a shortfall of about 1,982 truck parking spaces. Based on the model used in this study, Pennsylvania had the highest truck parking space shortfall. The TRI study proposed that additional truck parking spaces be based on the relationship between accident rates and parking shortfall estimates and suggested that a shortfall in truck parking spaces may contribute to accidents. In addition, the TRI study determined that truck pull-off areas may be appropriate in rural areas with great distances between rest areas and as a short-term solution to solve the nationwide shortfall of truck parking spaces. It stated that truck pull-off areas offer benefits of supplying additional parking for trucks without the cost of a full-service rest area and satisfies the needs of truck drivers to have quiet, accessible, and convenient stopping places for short-term rest along the interstates. The Pennsylvania Turnpike makes the most successful use of truck pull-off areas which are adjacent to and visible from the interstate. Between August 31 and September 2, 1999, the Safety Board held a public hearing in Nashville on Advanced Safety Technology Applications for Commercial Vehicles at which the president of the ATA further stressed the need for additional rest areas for Table 5. Pennsylvania Turnpike pull-off areas. Turnpike Area Signed Emergency Parking Unmarked Signed No Parking Eastbound From Pittsburgh (exit 6) To New Jersey border 35 156 9 Westbound From New Jersey border To Pittsburgh (exit 6) 38 *130 4 North/Southbound Northeast Extension 8 64 **9 Westbound From Pittsburgh (exit 6) To Ohio border 18 74 2 Eastbound From Ohio border To Pittsburgh (exit 6) 5 31 0

• Several of the unmarked pull-off areas displayed picnic area signs.

** No parking signs were located near emergency call boxes.

Factual Information 31 Highway Accident Report commercial vehicles. He reminded the Safety Board that the shortfalls stated in the TRI study were based on 1992 data. He added that the study had a projected shortfall for 1997 of 35,000 spaces along the interstate, based on a model that used a conservative growth rate of about 1 percent for truck demand. According to the ATA president, actual trucking demands for spaces have far exceeded the growth projections of the TRI study and are expected to grow more than 30 percent between 1997 and 2007. Transportation Equity Act for the 21st Century. The TEA 21, enacted on June 9, 1998, requires that the U.S. Secretary of Transportation determine the location and quantity of parking facilities at commercial truck stops, travel plazas, and public rest areas that can be used by motor carriers to comply with Federal hours-of-service rules. Section 4027 of TEA 21 calls for (1) a nationwide inventory of rest areas and other parking facilities along the national highway system; (2) an analysis of shortages, real and projected; and (3) the development of a plan to reduce the shortages. These initiatives are to be delivered to the U.S. Congress by June 2001. Section 4027 further stipulates that this research is to be conducted in cooperation with research organizations that represent the motor carrier industry, the travel plaza industry, and commercial motor vehicle drivers. On June 29 and 30, 1999, the OMCHS hosted a rest area forum for State enforcement and department of transportation officials, motor carriers, private truck stop operators, commercial drivers, safety advocates, and other interested parties. The OMCHS intends to use the results of the forum to help formulate the research proposal to fulfill the requirements of section 4027. Pathological and Toxicological Information On June 21, 1998, three full and four limited postmortem examinations were performed on the accident fatalities (the busdriver and six passengers). According to the pathology findings, the injuries sustained by all seven were the result of multiple blunt trauma. The Civil Aeromedical Institute in Oklahoma City, Oklahoma, conducted toxicological testing of the busdriver’s blood and bodily fluids obtained during the postmortem examination. The report was negative for the presence of alcohol and specified illegal drugs.39 It noted that diphenhydramine (an antihistamine, commonly known by the trade name Benadryl);40 pseudoephedrine (a decongestant, commonly known by the trade name Sudafed); phenylpropanolamine (a decongestant and metabolite of pseudoephedrine); and acetaminophen (commonly known by the trade name Tylenol) were detected. The concentration of these substances was found to be as follows: 39 Marijuana, cocaine, phencylidine (PCP), opiates, and amphetamines. 40 The over-the-counter medication includes a warning label about using caution when driving a motor vehicle or operating machinery.

Factual Information 32 Highway Accident Report diphenhydramine – 0.073 ug/ml in blood and 0.257 ug/ml in liver fluid. pseudoephedrine – detected in blood and liver fluid but no concentration given. phenylpropanolamine – detected in blood and liver fluid but no concentration given. acetaminophen – 12 ug/ml in blood. Greyhound policy requires employees to notify the company about their use of prescription drugs and over-the-counter medication that could adversely affect their ability to safely perform their job. This policy states that employees who perform work that could endanger Greyhound personnel or the public are obligated to advise Greyhound of their use of this type of medication and to refrain from performing such work. No Federal regulation governs the use of nonprescription medication by commercial drivers. Title 49 CFR 382.213 states: No driver shall report for duty or remain on duty requiring the performance of safety sensitive functions when the driver uses any controlled substance, except when the use is pursuant to the instructions of a licensed medical practitioner, as defined in Sec. 382.107 of this part, who has advised the driver that the substance will not adversely affect the driver’s ability to safely operate a commercial motor vehicle. Greyhound contracted with a forensic pathologist and then with a clinical pathologist to review microscopic slides of cardiac material prepared during the busdriver’s autopsy. In a May 6, 1999, letter to an attorney representing Greyhound, the forensic pathologist stated that the lacerated aorta and the tear in the right ventricular wall . . . are . . . of traumatic origin and occurred at the time of the impact. . . . Another section depicts a focal area of intermural hemorrhage, that is bleeding within the vessel wall of the coronary artery, which is not geographically located where trauma occurred to the heart. . . . A hemorrhage of this type reducing the available blood flow can be expected to produce anginal pain and eventually myocardial infarction. In a July 15, 1999, letter to the same attorney, the clinical pathologist, after reviewing the forensic pathologist’s report, noted that the busdriver clearly . . . died from massive trauma sustained in the accident. . . . the microscopic examination of the coronary arteries . . . . shows clear evidence of hemorrhagic dissection. . . . It is highly unlikely that the hemorrhage reflected trauma. . . . The most likely scenario in this case was 1) hemorrhage into a coronary plaque, 2) acute myocardial infarction, 3) sudden cardiac arrhythmia and 4) failure of the circulation and loss of consciousness. An independent review of all retained cardiac material from the autopsy by forensic pathologists at the Armed Forces Institute of Pathology (AFIP) in October 1999 confirmed the presence of bleeding in the coronary artery wall but concluded that “in the absence of documented signs or symptoms of myocardial ischemia41 just prior to the

Factual Information 33 Highway Accident Report collision, this autopsy finding cannot be used to determine the role of the coronary artery disease in the mishap [footnote added].” Survival Aspects One passenger, who is a physician, stated that she was sitting alone on the right side of the bus in the fifth or sixth row from the front. She was resting her head between the window and the seatback, attempting to sleep. She said that, when the accident occurred, she was thrown “very forcefully” into the seat in front of her, hit her head on the seat and window, and fell to the left onto the floor. She then was pinned between the aisle floor and aisle seat because another passenger had fallen on top of her. This passenger stated that visibility inside the bus was very poor because of the dust from the accident and the lack of lights. She said that, after the accident, the bus was “pitch black” and very quiet. She called out for everyone who was able to move to evacuate the bus because she could smell gasoline fumes. She stated that, at one point when they were attempting to evacuate the bus, another passenger ignited a cigarette lighter to provide lighting and she instructed him to quickly extinguish it because of the gasoline fumes and her fear of a fire. She was not familiar with the emergency exits before the accident, and another passenger opened an emergency window on the left side of the bus through which she exited. She stated that she encountered difficulties escaping the bus because it was a “very long jump, and [she] could use only one arm to evacuate.” She scraped the front of her body against the side of the bus and injured herself further while escaping. This passenger stated that the emergency personnel arrived after “probably about 30 to 40 minutes.” She recalled having difficulty in awaking the truckdrivers parked near the accident to ask them to call for help. The first emergency responders she observed were paramedics and then firefighters, who were triaging and assisting passengers. A second passenger on board the accident bus recalled that he was asleep on the left side bench seat across from the restroom when the accident occurred and did not remember the collision. He said that he was thrown about two or three seats forward by the impact. He then opened the left side emergency exit window near where he landed and let other passengers out. He stated that he knew how to open the window because during the journey he had read the instructions posted on the emergency exit handle. A third passenger reported that, when evacuating the bus, everyone used the same emergency exit window to escape. He stated that he did not understand why the other windows did not automatically open when the accident occurred; he did not know about the emergency roof hatches. He said that the passengers could not see the emergency exits 41 Ischemia refers to localized reduction in blood supply due to obstruction of inflow of arterial blood (as by the narrowing of arteries by spasm or disease).

Factual Information 34 Highway Accident Report because of the darkness. He also said that he had been riding Greyhound buses for many years, yet was not aware of the emergency signage indicating the exit locations and instructions on how to use them in an emergency. Another passenger told Safety Board investigators that he was seated alone on the right side of the bus in row eight or nine next to the window. He was sleeping fully reclined in his seat with his head toward the window before the accident and recalled falling to the left and forward, striking his head on the aisle seat handle during the accident sequence, and being pulled out of his seat by an emergency responder. He was the last passenger to exit the bus and was helped by emergency responders to go out a window and down a ladder. He stated that he was able to see inside the bus because by the time he exited the bus, the emergency responders were inside cutting the seats of trapped passengers. When the emergency responders arrived, they set up a step ladder (see figure 9), which the other Greyhound busdriver who had stopped at the accident scene used to climb into the bus and open the emergency windows. He then showed the responders how to use the extrication tools to remove the windows to gain access to the bus to reach the injured. He stated that he had trouble with visibility inside the bus because “it was pitch black and you couldn’t see.” The IC said that had the other Greyhound busdriver not been present to point out where the exits were, the lack of markings on the outside of the bus to indicate the exits would have been a hindrance. Figure 9. Outside left side of accident bus with emergency responders.

Factual Information 35 Highway Accident Report Another firefighter reported that he did not remember whether he observed any lights on the bus because the firefighters immediately set up the truck generator to provide additional lighting at the scene. He added that, had the generator not been available for lighting, the responders had flashlights for use inside the bus. Emergency Management Hustontown (Fulton County) Volunteer Fire and Rescue Company After the EMT who received the initial 911 call had dispatched Hustontown, he responded to the accident scene in an ambulance. He stated that he had no communication with the IC, but contacted the rescue captain when he arrived on scene to inquire where his services were needed. According to the EMT, he had had previous experience that involved a charter bus accident several years earlier; he expressed a concern about a need for more training in operations to improve the turnpike emergency response. After the accident, a Safety Board investigator interviewed two other Hustontown technicians, identified as EMT-2 and EMT-3. They recalled that they were notified at their residence about 4:30 a.m. and left together for the accident scene in their personal vehicle. They arrived on scene between 4:40 and 4:45 a.m. The Hustontown assistant chief was already on scene and had called them while they were en route to report what was happening at the accident site. They said that, after arriving on scene, they did not call in at any time through the dispatch radio because they had no dispatcher. They employed the 4606 radio frequency. They said that, after they arrived, they started triage on the 10 to 15 “walking wounded” from the bus because it appeared enough responders were inside the bus. As more responders arrived and assisted with triage, EMT-2 started coordinating which ambulances would take which patients and in which order. He stated that he found no one was handling this activity and he took charge. He had one patient experiencing chest pains transported first. He also had ambulances stand by for the injured remaining on the bus and placed specific patients into the ambulances. EMT-2 said that he was contacting the hospitals to alert them of the patients that would be arriving. According to EMT-2, he had never been involved in a response to an accident such as this one. He had experience in a response to a two-car accident in May 1998 involving eight injuries, but no fatalities. He said that his fire company carries out training drills and, “once in a while,” two companies coordinate joint training. EMT-2 was an Emergency Management Agency (EMA) coordinate for Hustontown. He stated that the township had a county disaster emergency management plan, which was very vague. He recalled that at first, while on scene, he did not even think about the EMA until after more responders had arrived and enough manpower was present. Neither EMT-2 nor EMT-3 had participated in a local mass casualty drill for at least 12 years; both had been with the Hustontown company for the last 2 years.

Factual Information 36 Highway Accident Report Metal Township (Franklin County) Fire and Rescue Company Metal Township initially dispatched one ambulance and one fire truck with six firefighters. Of the six firefighters, three were EMTs. The ambulance was a basic life support ambulance, and the first arriving triage officer was an EMT from the ambulance. The Hustontown assistant chief, who was already on scene, was assigned triage responsibilities for the passengers who had evacuated the bus. The victims inside the bus were separately triaged. According to the Metal Township fire chief (the IC for the accident), when Metal Township responds to an accident on the turnpike, the incident is essentially under the turnpike’s emergency management system. The first arriving unit to respond is responsible for assessing the scene and the number and type of injuries and for requesting as many units and as much equipment as needed. He said that, after arriving on scene, he assessed the situation and then requested the resources and equipment he needed, including additional ambulances and helicopters. The IC stated that he directed communications to move the fire and rescue operations to channel 2 (Franklin County’s second fire ground channel) to keep the continuous fire and rescue communications off the main dispatch channel. He added that communications were a problem because in Franklin County the medical and fire ground channels were different. The medical channel was on a high band frequency, which the ambulances used; the fire ground channel was on a low band frequency, which was in his vehicle and used on scene. Furthermore, the other counties had a different frequency. So, he observed, responders needed three or four different radios to communicate. He stated that he did not have those radios available and a communication lapse occurred, preventing him from communicating with everyone on scene. In addition, because information was being sent on the medical channel and the IC had a low band channel for the fire company activities, he said that he was not aware that the Fulton County Medical Center could not receive any more patients and patients had to be sent to the Chambersburg Hospital. He recalled asking the Metal Township EMT captain to track the ambulances’ destinations and the class of patient being transported. The IC also expressed several concerns about the emergency response. He remarked that it “wasn’t an organized thing. It was a pretty seat-of-the-pants type deal. We’d never dealt with anything like this before.” When asked whether the situation was chaotic, the IC replied, “yes.” Most emergency response call needs in the past, according to the IC, were not of the magnitude of this accident; multiple-car accidents occur but usually not with this number of fatalities. He said that under the box card assignment set up for turnpike accidents, a prearranged number of units are dispatched to a specific accident, a prearranged number for every situation. The box card assignment set up for this accident provided for a dispatch of four ambulances and one rescue vehicle. He believed that sufficient emergency response resources should be available at dispatch for this type of accident; when he arrived on scene and assessed the situation, he found that he did not have the resources present initially to cope with such an accident.

Factual Information 37 Highway Accident Report The IC stated that he had no bus rescue training before the accident and that the emergency responders would benefit from training on commercial buses. He said that Franklin County does perform countywide disaster drills42 and had one a few months before the accident, although Metal Township did not attend because the drill was held on the other side of the county. The IC also noted that turnpike safety personnel hold a group meeting with the responders once a year, but he thought that no one is obliged to attend. Cumberland Valley (Cumberland County) Hose Company Safety Board investigators interviewed a Cumberland Valley paramedic/EMT, who arrived on scene about 4:30 a.m. His first task was to determine whether several of the passengers in the bus were deceased. He found that six people were dead and one was still alive and then left the bus to allow the rescue units to cut out the seats that were entrapping the bodies. According to the paramedic, throughout the incident, he did not know the identity of the IC and did not learn his identity until the accident debriefing, which occurred several days later. He stated that he had asked who was the IC and reported that “no one really knew.” He recalled, “it was total, pretty much chaos” and noted that responders generally did what they wanted to and that no one was directing the ambulances to the hospitals. He advised that an emergency medical services (EMS) commander, a rescue commander, and a fire commander should have been present, as well as someone staging all the arriving units. He said that when he tried to radio the command post to obtain orders, no one answered when he called, “command post, command post.” West End (Cumberland County) Fire and Rescue The West End Fire and Rescue Department in Shippensburg, Pennsylvania, was called to respond in the second dispatch at 4:43 a.m. The department is about 25 to 30 miles and about 32 minutes from the accident scene and has between 40 and 50 volunteer firefighters. According to department officials, West End was the appropriate heavy rescue fire department to have been called with the vehicles involved in this accident. The West End chief and deputy chief told Safety Board investigators that, while en route to the accident scene, the communications dispatcher identified the IC and advised them to switch to radio channel 2 for all fire and rescue activities. At this time, radio channel Franklin 1 was the dispatcher; channel 2 was the fire and rescue operations channel; and medic 10 was the medical channel. After arriving on scene, they had contact with the IC several times. The IC assigned their team to extricate the trapped passengers remaining in the bus because the initial responders were tiring. The chief and deputy chief expressed some concerns about the response. When notification was initially received that the accident involved a bus and a tractor- semitrailer, West End, as the heavy duty response unit, should have immediately been 42 Franklin County has an emergency management coordinator who maintains the records of the disaster drills held.

Factual Information 38 Highway Accident Report dispatched, especially since it has the same dispatcher. According to the chief and deputy chief, an immediate dispatch would have saved about 15 minutes, which can be important to a response. Instead, dispatch occurred after the IC arrived on scene and called for mutual aid, and the equipment was 32 minutes from the scene. In the county where West End normally operates, its box card assignment for mass casualties always includes at least two heavy duty squads, two full engine companies, four basic life support ambulances, and perhaps one or two medic units, with a helicopter on standby. They explained that, based on the dispatch description of this accident, additional units should have been requested immediately and then sent to a staging area away from the accident scene. These resources could then have been requested and received without delay had a need existed, resulting in less chaos and confusion. West End had participated in mass casualty drills within the county, but not in any turnpike drills. The chief and deputy chief said that they had trained on school buses but had never had a drill with a motorcoach. The last drill that they had participated in took place 6 months before the accident and involved an explosion at a dormitory. The Franklin County companies and EMS and the Cumberland County EMS had also participated. Turnpike Incident Management Program and Command System The Commission has published an Incident Management Program Book and Incident Command System Manual. These publications, from which the following information was obtained, describe the functions of the incident management program and command system. Incident Management In September 1988, the Commission formed its incident management team, which is composed of PSP and turnpike operations personnel. The team of about 30 members meets regularly and reviews incidents that have occurred on the turnpike. After the team review, the Commission then implements measures to improve incident management. Committees are formed to develop and implement initiatives and report findings to the team for disposition. The Contracted Services Committee is responsible for fire services, and the Joint Panel for Ambulance Services manages the EMS companies. The Commission’s various subcommittees for emergency services are responsible for holding annual informational meetings, which are conducted across the State for volunteer emergency service groups and county dispatch centers. According to the Commission, State police and turnpike personnel are available at the meetings to discuss accident and safety procedures and any operational or protocol problems. In addition to the meetings, the Commission has committee member contacts available for the emergency services at all times to notify them of problems, concerns, or suggestions.

Factual Information 39 Highway Accident Report Communications Center The Commission maintains its Operations Control Center (communications center) in Highspire, operating 24 hours a day 365 days a year. Incidents are reported to the communications center through different sources, including call boxes, CB radios, turnpike personnel, *11 cellular calls, and State police maintenance. The center receives an average of 1,300 call box calls every month and 400 calls and 1,400 radio transmissions daily. It is equipped with a CAD (computer-aided dispatch) system, which is designed to provide the radio operators with instantaneous access to the closest emergency services and State police for any incident at any location on the turnpike. The communications center controls the radio communications for turnpike personnel, customers, State police, authorized services, and emergency fire and ambulance services. It dispatches the appropriate personnel, such as State police, fire and ambulance services, emergency spill response, medical helicopters, and specialized equipment. Emergency Response Services According to the Commission, it is the only highway agency in the State that contracts with fire and medical service providers for emergency service on the roadway. The contracts, according to the Commission, are established to provide a means of compensation for the volunteer fire and emergency medical services in Pennsylvania and to improve the quality of emergency service available. The Commission contracts 82 fire companies and 65 EMS providers and assigns each to a specific coverage area. The Commission provides radios to the contracted fire services and EMS providers that do not have radios compatible with the turnpike’s communication system. When an incident occurs, according to the Commission, all responding State police, turnpike units, and emergency services are capable of communicating with each other during their response. To improve communications at the scene, hand-held portable radios with repeaters are used in State police and turnpike units. A dual dispatch system, under which emergency units are dispatched in both directions, is employed on the turnpike for emergency, fire, rescue, and EMS providers responding in selected areas: where traffic is heavy, where the distance is unusually long between interchanges or crossovers, and where the exact location or direction of an incident has not been confirmed. The first directional company to locate the incident deals with it, and the other units return to their station. According to the Commission, dual dispatch has successfully improved response times to incidents. In addition, to enhance the response efforts of the contracted emergency services, emergency access gates are located throughout the turnpike system; many of the access locations were recommended by the emergency services themselves as a measure to improve their response efforts. Pennsylvania State Police Troop T The Commission-funded Troop T of the PSP is assigned to control traffic and enforce all State laws on the turnpike. Troop T officers have the ultimate authority at all

Factual Information 40 Highway Accident Report incidents on the turnpike and oversee all responding agencies. Troop T is assisted by the turnpike’s 20-facility maintenance department, which is equipped with first responder vehicles. One location also provides ambulance service. Emergency response workers are scheduled 24 hours a day and are all trained in CPR, advanced first aid, and hazardous materials recognition and identification; some of the emergency response workers are certified EMTs. They are responsible for attending injured patients until outside medical assistance arrives. The standard first responder vans are equipped with cellular phones, CB radios, turnpike repeaters, and portable radios for communications. The vans carry emergency medical supplies, incident command kits, and spill containment materials. Five customized emergency response vehicles are also available, especially for use in hazardous materials spills and as command posts. The PSP indicated that, when an incident occurs within the turnpike system, the maintenance department sets up a mobile command post that is used to coordinate organization and communication. In any incident on the turnpike, the highest ranking PSP officer at the scene is in charge and acts as the turnpike IC. The PSP and the maintenance department are responsible for clearing accident scenes according to the following priorities: life safety, incident stabilization, and traffic flow restoration. The on-scene maintenance supervisor, in cooperation with the PSP, has the authority to take any action reasonably necessary to ensure customer safety and to promptly clear the roadway. Incident Command System The Commission has adopted the Incident Command System (ICS) as its structure to manage all incidents that occur within the turnpike system. Goals of the ICS include achieving better communication and coordination at the scene among fire and rescue, ambulance, authorized service, PSP, turnpike maintenance personnel, and other agencies; improving overall safety at the scene by providing immediate medical care, when needed; managing traffic efficiently; clearing accident scenes expeditiously; and shortening periods of road closures. Turnpike representatives and the PSP assigned to the turnpike have jointly attended a 16-hour ICS training program. The Commission provides key operational ICS personnel (the State police and maintenance, fire, rescue, and EMS command staff) with incident command field kits, which include command staff vests, as well as blank check-in sheets and structure organizational forms to assist in documentation. The ICS eliminates the 10-code radio system and uses clear text, or plain English, for all radio transmissions to reduce the likelihood of miscommunications at accident scenes. The Incident Command System Manual is sectioned into five modules: the introduction and overview, the ICS command and command staff, the general staff functions and applications, the incident management policies and procedures, and several accident scenarios that would require establishment of the ICS. Included in the scenarios is one in which a Greyhound bus has run off the road and down an embankment with a fatality and minor and serious injuries. The accident depicted in the scenario occurred in

Factual Information 41 Highway Accident Report Donegal, Pennsylvania, on June 26, 1991, and was investigated by the Safety Board.43 The scenario indicates potential problems that may be encountered and lists emergency response units and apparatus that may be required. According to the Commission, the manual is provided to the contracted fire and medical departments. Postaccident Tests The motorcoach’s power steering hydraulic pump was removed by Safety Board investigators for examination and functional testing, which was performed at the manufacturer’s facility. Test results showed the pump to be operating within the manufacturer’s production specifications for new pumps and performing as well as a new unit at the time of the accident. The Safety Board’s Materials Laboratory conducted a forensic examination of the speedometer assembly and 22 lamp assemblies and bulbs for the presence of “needle slap”44 and “hot stretch,”45 respectively. The examination revealed no evidence of needle slap; the headlight assembly and several of the submitted bulbs exhibited evidence of stretching. (See appendix B for TransAm tractor-semitrailer test information.) Additionally, the Safety Board conducted deceleration tests, using a bus similar to the accident bus, on the paved shoulder near the accident site with the surface both dry and wet. A VeriCom-2000 accelerometer/decelerometer was mounted on the aisle of the bus approximately 6 feet behind the steps to measure the deceleration rates. See table 6 for the data collected. 43 National Transportation Safety Board. 1992. Greyhound Run-off-the-Road Accidents, Donegal, Pennsylvania, June 26, 1991, and Caroline, New York, August 3, 1991. Highway Accident Report NTSB/HAR-92/01. Washington, DC. 44 A condition in which the speedometer needle comes in contact with the face of the speedometer when subjected to impact. 45 A condition that results when a filament is illuminated and subjected to impact. Table 6. Deceleration testing data. Surface Condition Speed mph Time Seconds Distance Feet Peak Deceleration Average Deceleration Dry 31.1

2.63

1. 2 ft/sec
2. 1 ft/sec

Wet 32.5 2.87 68 19.0 ft/sec 16.4 ft/sec

42 Highway Accident Report Analysis Exclusions The east and westbound traffic lanes were separated by 45-inch-tall Jersey barriers. The pull-off area began beyond the uphill grade and was designated with signs approaching it. Pavement markings were visible and in good condition. According to witnesses, it was not raining. Postaccident mechanical inspections of the bus, including the coach’s brake actuators, foundation brakes, and steering components, revealed no defects or deficiencies. Based on the statement by the State trooper who observed the bus immediately before the accident, speeding was not involved. The busdriver’s postaccident toxicological tests were negative for alcohol and illicit drugs. The Safety Board therefore concludes that neither the existing highway pavement conditions, the mechanical condition of the bus, nor the weather contributed to the accident. The busdriver did not appear to be speeding, nor was he impaired by alcohol or illicit drugs. The remainder of this analysis will address the safety issues that were raised by this accident, including the busdriver’s performance, the adequacy of carrier oversight, the adequacy of the design and the appropriateness of the use of pull-off areas, the lack of motorcoach emergency interior lighting and retroreflective signage, and the organization of the disaster preparedness and emergency response management. The Accident Busdriver Performance The Safety Board’s investigation found several factors that support the position that the busdriver had trouble staying awake around the time of the accident. These factors include the busdriver’s irregular driving schedule, eyewitness’ accounts, and postaccident evidence. The Safety Board also examined the possibility that a medical condition impaired the busdriver and that his use of an over-the-counter antihistamine contributed to his drowsiness. Medical. Although the Greyhound medical records46 indicated that the accident busdriver used medication for high blood pressure from 1993 to 1995, his personal medical records indicated normal blood pressure and no prescribed medications between 46 Medical records are retained by Greyhound for only 5 years.

Analysis 43 Highway Accident Report 1996 and 1998. In November 1997, during a visit to his family physician, the busdriver noted that he sometimes drove 18 hours per day, and he complained of short-term memory loss, irritability, insomnia, and a nonradiating left-sided chest pain when at rest. A subsequent examination that included an electrocardiogram, blood work, and a Thallium stress test found only slightly elevated cholesterol levels. The stress test was interpreted as unremarkable, with “no evidence of stress-induced ischemia.” The busdriver's autopsy report concluded that his death was caused by the multiple injuries he sustained from the accident; the toxicology evaluation did not reveal the presence of any heart or blood pressure medications. The forensic pathologist and the clinical pathologist, contracted by Greyhound to review slides of cardiac material prepared during the autopsy, noted a single slide with an area of bleeding that the forensic pathologist attributed to a nontraumatic event preceding the accident, a judgement with which the clinical pathologist agreed. On the basis of this finding, one of the pathologists concluded that the driver was distracted by chest pain, and the other concluded that the driver suffered loss-of-consciousness immediately before the accident. The independent review of cardiac material by forensic pathologists at the AFIP confirmed the presence of bleeding in the coronary artery wall but concluded that “in the absence of documented signs or symptoms of myocardial ischemia just prior to the collision, this autopsy finding cannot be used to determine the role of the coronary artery disease in the mishap.” The Safety Board concludes that the evidence cannot establish that the busdriver was impaired or incapacitated by a cardiac condition prior to the accident. The postaccident toxicological blood tests performed on the Greyhound driver found the presence of the decongestants pseudoephedrine, commonly known by the trade name Sudafed™, and phenylpropanolamine, a metabolite of pseudoephedrine. Pseudoephedrine is often used in combination with an antihistamine in over-the-counter and prescription preparations for multisymptom cold and allergy relief. It may act as a mild stimulant and is not likely to have any significant detrimental effect on performance. Also present in the driver’s blood was acetaminophen, the over-the-counter painkiller and fever-reducer found in Tylenol™, which is frequently used in multisymptom cold and allergy preparations in combination with an antihistamine or a decongestant or both. The level detected is therapeutic and suggests relatively recent ingestion of a normal dose of the medication, which is not likely to have any significant detrimental effect on performance. The toxicological tests also revealed the presence of diphenhydramine, a sedating antihistamine commonly known by the trade name Benadryl™, in the accident driver's blood. Diphenhydramine is used in cold and allergy preparations and in sleep aids. In therapeutic doses, the medication commonly results in drowsiness and has measurable effects on complex cognitive and motor tasks, such as driving a vehicle. The levels of antihistamine detected in his blood were therapeutic and consistent with at least a normal, single dose ingested within the previous few hours. Therefore, the Safety Board concludes that the busdriver ingested an over-the-counter multisymptom cold and allergy medication at some time either shortly before or during his scheduled route. The sedating

Analysis 44 Highway Accident Report antihistamine in this medication contributed to making the busdriver sleepy and reducing his alertness. Note: The Safety Board is currently investigating the issue of over-the-counter medication and its effect on transportation safety across all modes. Driver’s Work Schedule. The schedule selected by the busdriver resulted in an irregular work-rest cycle. The busdriver’s on-duty time commenced anywhere between 9:00 p.m. and 1:30 a.m., and his off-duty time began anywhere between 9:00 a.m. and 12:30 p.m. (See figure 10.) The Safety Board has previously addressed the issue of operator fatigue involving irregular work-rest schedules in its 1995 safety study on heavy truck accidents.47 In the subset of these accidents for which sleep data were available, the Safety Board found about 67 percent of the drivers (43 of 64) with irregular schedules were involved in fatigue-related accidents, compared with about 38 percent of drivers (9 of 24) with regular schedules. The Safety Board found that irregular schedules could result in more hours awake than normal and, without careful planning, prevent drivers from obtaining adequate sleep. The busdriver was in the 4th day of a 4-day schedule, during which he slept in the daylight hours and drove in the nighttime hours, contrary to his usual off-day routine. Research has shown that nightshift work schedules are generally more tiring for workers than dayshift work schedules, with nightshift workers usually getting less uninterrupted 47 A driver’s work-rest hours are classified as irregular if the start times of two consecutive duty periods and the start times of two consecutive sleep periods both vary by 2 or more hours at least twice during a 96-hour period. See National Transportation Safety Board. 1995. Factors that Affect Fatigue in Heavy Truck Accidents. Safety Study Report NTSB/SS-95/01. Washington, DC. Figure 10. Chart of shift schedule.

Analysis 45 Highway Accident Report sleep per day.48 In addition, the accident occurred at approximately 4:05 a.m., the time of day when a driver would be most likely to experience sleepiness and a loss of alertness due to the body’s circadian rhythm.49 The busdriver had previously been observed to have difficulty staying awake during nighttime driving. Six months before the accident, a passenger witnessed episodes of drowsiness on the part of the driver during which he repeatedly drifted off the roadway, was alerted by contact with rumble strips, and then steered back onto the roadway. In addition, shortly before the accident occurred, an off-duty State trooper observed a Greyhound bus drifting onto the right shoulder and returning to the roadway about 0.5 mile from the accident site, suggesting that this bus was the one driven by the driver in this accident. The motorcoach departed the roadway at an angle of approximately 3 degrees. The shallowness of the angle suggests that the vehicle drifted from the roadway as the driver was falling asleep.50 The 28-foot tire marks discovered at the scene of the accident by Safety Board investigators, matching the departure angle of the bus, were included in a computer simulation of the accident. The results of this simulation supported the judgement that the marks originated from the accident bus. These marks suggest that the driver did not react quickly enough to apply the brakes until it was too late to avoid the collision. A forensic examination of the taillights of the TransAm semitrailer indicated that they were illuminated at the time of impact, which, in conjunction with the red and white retroreflective conspicuity sheeting (see appendix B), suggests that the rear of the parked TransAm truck should have been clearly visible at night to approaching westbound drivers. An FHWA study51 conducted in the late 1970s determined that fatigued drivers would follow the markings and lights of trucks parked on a roadway shoulder, referred to as the “moth to the light effect.” The TransAm truck was parked about 9 feet from the travel lane, and its lights may have acted as a potential beacon to the accident busdriver. However, it should be noted that although the moth to the light effect is frequently an explanation for accidents of this type among many in the regulatory and law enforcement community, there is currently little evidence supporting this phenomenon.52 Furthermore, the busdriver had complained to his physician in November 1997 about difficulty sleeping, stating that he was able to sleep only 3 to 4 hours before waking. 48 McDonald, N., Fatigue, Safety and the Truck Driver. Long: Taylor and Francis. 1984. 49 Circadian rhythm describes the regular recurrence, in cycles of about 24 hours, of biological processes or activities, such as sensitivity to drugs and stimuli, hormone secretion, sleeping, and feeding. This rhythm seems to set by a “biological clock” that appears to be set by recurring daylight and darkness. Also see Rosekind, M.R., Fatigue in Transportation: Physiological, Performance, and Safety Issues. Prepared for the National Transportation Safety Board. Washington, DC. April 1999. 50 Knipling, R.R., and Wang, J.S., “Crashes and Fatalities Related to Driver Drowsiness/Fatigue.” Research Note. November 1994. National Highway Traffic Safety Administration. Washington, DC. 51 Commercial Vehicles in Collisions Involving Vehicles Parked or Stopped on Highway Shoulders, U.S. Department of Transportation, Federal Highway Administration, and Bureau of Motor Carrier Safety, June 16, 1977.

Analysis 46 Highway Accident Report This suggests that the driver might have accumulated a substantial sleep debt by the 4th day of his shift, resulting in a highly fatigued state.53 Insomnia may have contributed to his fatigue; research shows that “the more sleep is disturbed or reduced for whatever reason, the more likely an individual will inadvertently slip into sleep.”54 Losing as little as 2 hours of sleep can negatively affect alertness and performance, leading to degraded judgment, decisionmaking, and memory; slowed reaction time; lack of concentration; fixation; and irritability.55 The Safety Board concludes that because of the scheduled irregular work-rest cycle and possible sleeping difficulties, the busdriver may have developed a sleep debt over the 4 days of his shift, which was exacerbated by a reduced alertness corresponding to his body’s circadian rhythm. The combined result of these factors may have contributed to the busdriver’s sleepiness and reduced alertness, causing him to drift off the roadway and collide with the tractor-semitrailer parked in the adjacent emergency parking area. Therefore, the Safety Board believes that Greyhound should revise driver scheduling practices to reduce scheduling variability that results in irregular work-rest cycles. In addition, the Safety Board believes that the United Motorcoach Association (UMA) and the American Bus Association (ABA) should advise their members of the facts and circumstances of this accident and encourage them, if they do not already do so, to revise their driver scheduling practices to reduce scheduling variability that results in irregular work-rest cycles. The Safety Board has addressed the issue of operator fatigue and the need to provide employees with fatigue awareness training in other sectors of transportation. In 1995, the Safety Board issued Safety Recommendation H-95-5, which asked the FHWA and trucking organizations to: 56 Develop and disseminate, in consultation with the U.S. Department of Transportation Human Factors Coordinating Committee, a training and education module to inform truckdrivers of the hazards of driving while fatigued. The module should include information about the need for an adequate amount of quality sleep, strategies for avoiding sleep loss, consideration of the behavioral 52 Agent, K.R. and Pigman, J.G. “Accidents Involving Vehicles Parked on Shoulders of Limited Access Highways,” Transportation Research Record 1270. 1990; Charles, M.T., Crank, J., and Falcone, D.N. A Search for Evidence of the Fascination Phenomenon in Road Side Accidents. AAA Foundation for Traffic Safety, 1990; Davis, C.C. Accidents Involving Stopped Vehicles on Freeway Shoulders (Moth Effect Phenomenon). Automobile Club of Southern California, 1982; and Wells, J.D. Patrol Car Crashes: Rear End Collision Study. Florida Highway Patrol, 1999. 53 Safety Study Report NTSB/SS-95/01. 54 Mitler, M., Carskadon, M., Czeisler, C. et al., “Catastrophes, Sleep, and Public Policy: Consensus Report,” Sleep 11, 1988. 55 Fatigue Resource Directory. Website: http://olias.arc.nasa.gov/zteam/fredi/home-page.html. Compiled in conjunction with the NASA/NTSB Symposium Managing Fatigue in Transportation: Promoting Safety and Productivity and managed by the DOT. Also, Online Medical Dictionary. Website: http://www.graylab.ac.uk/omd/contents/F.html. 56 Safety Study Report NTSB/SS-95/01.

Analysis 47 Highway Accident Report and physiological consequences of sleepiness, and an awareness that sleep can occur suddenly and without warning to all drivers regardless of their age or experience. The FHWA subsequently worked with several different organizations to educate truckdrivers about the dangers of driving while drowsy, which resulted in the Safety Board classifying Safety Recommendation H-95-5 “Closed—Acceptable Action” in July 1998. The FHWA developed brochures and videotapes, such as “Awake at the Wheel,” “Alert Driver,” and “Fatigue and the Truck Driver.” Although the FHWA developed its fatigue awareness brochures and videotapes with the trucking industry in mind, the information provided in them applies to the motorcoach industry as well. According to FHWA officials, the agency has a stated goal of educating all seven million CDL holders about recognizing fatigue and about the importance of adequate rest and healthy work and lifestyle choices. In June 1999, the FHWA began a two-phase project to specifically address busdriver fatigue. The first phase, which was scheduled to be completed in December 1999, is a study of the differences between motorcoach operations and truck operations as they relate to operator fatigue. The second phase is the development of a fatigue awareness and countermeasure video for motorcoach drivers, which was scheduled to be completed and distributed in February 2000. The Safety Board is encouraged that the FHWA recognizes that fatigue is a major safety concern and applauds its efforts to educate both truckdrivers and busdrivers. Carrier Oversight Interstate carriers such as Greyhound, according to statistics, have consistently been a safe mode of transportation. From 1989 to 1998, a total of 54 motorcoach occupant fatalities occurred.57 This comprised only 0.01 percent of the 419,171 highway fatalities that occurred during that time span. In 1997, motorcoaches averaged 0.04 crashes per million miles traveled, compared with 1.9 crashes for passenger cars and 2.5 crashes for large trucks.58 Greyhound was given a satisfactory rating at its last compliance review in July 1997; its accident rate was 0.24 per 100 million miles traveled.59 As of October 1997, the out-of-service rate for Greyhound buses was 6 percent, compared with the national average for commercial vehicles of 25.4 percent. During the investigation of this accident, the Safety Board examined several aspects of the Greyhound safety operations, including safety incentives, training, speeding, scheduling, pre- and posttrip inspections, records and logs, and the 1-800-SAFEBUS program. Several concerns developed about the shortcomings in the oversight of the driver safety program that allow unsafe driving practices to persist or go unchecked. 57 National Safety Council. Accident Facts. (1989-1998). Washington, DC. 58 National Highway Traffic Safety Administration. 1998. Traffic Safety Facts 1997. U.S. Department of Transportation. Washington, DC. 59 A commercial vehicle accident rate from 0.00 to 0.299 is satisfactory, 0.30 to 1.00 is conditional, and anything greater than 1.00 is unsatisfactory.

Analysis 48 Highway Accident Report Training. According to Greyhound policy, all training provided to or attended by its employees is to be documented. The Safety Board noted several instances in which Greyhound failed to document either the content, duration, or administration of training. In 1992, the accident driver completed a required 1-day refresher course after an absence of more than 30 days. The trainer noted that the driver “could use” another refresher course in 3 to 6 months. Greyhound could not provide the Safety Board with the training manual used in a 1-day refresher course. In addition, no documentation was found that showed that the follow-up refresher course was ever administered. In 1996, a personnel entry form stated that the driver was required to take a 2-day refresher course after he had struck a parked car. As was the case previously, no documentation was found in the driver’s file indicating that he had attended or successfully completed the 2-day refresher course. A random review by the Safety Board of 40 personnel and driver qualification files revealed further lack of company-required documentation. The Safety Board concludes that Greyhound’s lax procedures in compiling course material and documenting personnel training makes its safety oversight program less effective. Safety Assessments. The Safety Board’s examination of the busdriver’s driving record indicated that he had three speeding violations, one each in 1989, 1992, and 1994. The 1992 and 1994 violations occurred while he was operating a bus. In addition, between 1990 and 1996, he had been involved in nine motor vehicle accidents, varying in severity, while operating a bus. In one of these accidents in 1995, he was ticketed for an unsafe lane change. However, the busdriver’s records also disclosed that between April 1988 and January 1994, he had received five Greyhound safe driving awards. These awards were issued during a period in which the driver, while operating a bus, had been involved in four accidents and had received a speeding ticket. Currently, Greyhound’s safe driver program awards drivers solely for completing 6 or 12 consecutive months of driving without a preventable accident; the program does not consider traffic violations in the award process. The Safety Board concludes that the effectiveness of the Greyhound safety oversight program is lessened by not considering traffic violations in driver safety assessments. The Safety Board believes that the UMA and the ABA should encourage their members, if they do not already do so, to include all traffic violations in their drivers’ records and consider these violations during driver safety assessments. The Safety Board’s safety recommendation regarding Greyhound consideration of traffic violations is discussed later in this report. Systemwide Busdriver Speeding. Although speeding was not a factor in this accident, the Safety Board found during its investigation that busdriver speeding was prevalent throughout the Greyhound system. Safety Board investigators observed Greyhound operations at 10 terminals in different locations throughout the United States and determined that excessive speeding on the part of drivers was systemwide and not restricted to a specific operational area or geographical region. On the 40 trips that

Analysis 49 Highway Accident Report investigators observed, all 40 drivers were speeding at some time during their trips. Greyhound safety officials observed an additional 140 buses, all of which exceeded the posted speed limits. In all, 100 percent of the 180 buses observed by Safety Board investigators and Greyhound safety officials were involved in speeding. Although Greyhound buses were equipped with speed-limiting devices for the engines, the buses could exceed the governed speed on downhill grades. The Greyhound safety oversight system relies on log book audits of hours-of- service, limited observations of drivers, and the 1-800-SAFEBUS program. But Greyhound’s analysis of driver logs does not appear to be successful in detecting abnormal or excessive speed. The calculations based on the logs of 35 of the 40 drivers that the Safety Board observed speeding revealed varying and highly unlikely average speeds, such as three drivers who averaged 20 to 25 mph on a run, one driver who averaged 120 mph, and another driver who averaged 247 mph. While busdrivers’ speeding was found to be prevalent throughout the Greyhound system, the company has not employed all available means, such as monitoring drivers’ violations and analyzing drivers’ logs, to identify speeding and other unsafe driving practices. Therefore, the Safety Board concludes that Greyhound’s current operational oversight program is inadequate to detect and correct the widespread speeding of its busdrivers. Consequently, the Safety Board believes that Greyhound should include in its drivers’ assessment programs all driver traffic and logbook violations. Use of Electronic Control Module Data. At the time of the accident, Greyhound had chosen not to activate the data pages option of the DDEC III ECM units. In the inactive condition, the data pages information was still being captured but could be accessed only by the manufacturer. According to the Greyhound senior vice president of operations, Greyhound did not perceive a need for using the data pages recording option. The ECM data collected during routine preventative maintenance periods were extracted not to obtain driver practices information and speed history but strictly to determine that the governed speed of the buses had not been tampered with and to monitor fuel consumption. Safety Board examination of the accident coach’s ECM data, which Detroit Diesel had extracted, prompted concern about the speeds at which the accident coach had been operated over the last several months. The ECM data downloaded from the accident bus indicated that it had traveled at speeds as high as 76 mph on the day of the accident. For the previous 90 days, the data also revealed 15 instances in which the coach’s speed ranged between 80 and 90 mph and 34 instances in which the speed ranged between 71 and 80 mph. This same information was readily available to Greyhound to assist the company in its driver oversight program. According to the Greyhound vice president of operations, Greyhound plans to have older engines remanufactured and equipped with DDEC III ECM units. By spring 2000, the company expects to be operating between 1,500 and 1,700 coaches with DDEC III and IV ECM units. In November 1999, Greyhound’s safety director informed

Analysis 50 Highway Accident Report the Safety Board that because of privacy issues, Greyhound has no plans to use the data pages option of the ECM units for driver oversight. The ECM data were a powerful investigative tool for the Safety Board during this investigation. The ECM information not only supported the TransAm driver’s statements, but assisted in reconstructing the TransAm and Greyhound drivers’ record-of-duty status (logs) and supplied critical vehicle operational data. While a useful tool for accident investigation, its best use would be for accident prevention. Present day technology, as well as related emerging technologies, provides the Safety Board and corporate safety officials with very important fact-gathering tools. However, unless these systems are in place and their use mandated, the data will be overlooked or unavailable. The Safety Board concludes that, by not establishing a policy to activate and use the data pages option of the ECM units, Greyhound is severely degrading its ability to oversee driver and vehicle operations safety. The Safety Board believes that Greyhound should use all current and future data monitoring and storage capabilities of ECMs, ECUs, and similar technologies to enhance vehicle and driver oversight programs by engaging the specific capabilities of each individual unit’s programmed or programmable functions to collect and monitor data including, but not limited to, vehicle speed, revolutions per minute, hard-brake or sudden decelerations, and other parameters of vehicle and engine operations. “Require devices that will automatically record specified information” is listed as one of the Safety Board’s “Most Wanted” Transportation Safety Improvements.60 The Safety Board considers adequate on-board recording devices necessary in all modes of transportation because information from them can be used to identify safety issues, develop corrective actions, and conduct more thorough, efficient accident investigations. In the past, the Safety Board has recommended that the FHWA require on-board recorders to monitor commercial drivers’ hours-of-service or duty status. More recently, the Safety Board has addressed the accident investigation benefits of recording devices in recommendations urging that vehicle crash pulse data be collected. 61 The Safety Board addressed the desirability of having crash pulse data for vehicle crashes during its 1997 Air Bag Forum.62 On July 1, 1997, the Safety Board issued the following safety recommendation to the National Highway Traffic Safety Administration (NHTSA): H-97-18 Develop and implement, in conjunction with the domestic and international automobile manufacturers, a plan to gather better information on crash pulses and 60 Safety Recommendation H-98-26. 61 National Transportation Safety Board. Airbag Forum NTSB/RP-97/01; 1998. Multiple Vehicle Crossover Accident, Slinger, Wisconsin, February 12, 1997. Highway Accident Report NTSB/HAR-98/01. Washington, D.C.; May 1999 International Symposium on Transportation Recorders; and August 1999 Hearing on Advanced Safety Technology Applications for Commercial Vehicles. 62 NTSB/RP-97/01.

Analysis 51 Highway Accident Report other crash parameters in actual crashes, utilizing current or augmented crash sensing and recording devices. NHTSA responded on March 30, 1999, and indicated that it was working on this issue through its Event Data Recorder Working Group, which is composed of government and industry officials. NHTSA noted a number of activities being carried out: define event data recorder functional and performance requirements, understand present technology, develop a set of data definitions, discuss various uses of the data, and resolve legal and privacy issues. The Safety Board responded on June 17, 1999, noting the NHTSA efforts to make progress on this issue and changing the classification of Safety Recommendation H-97-18 from “Open—Unacceptable Response” to “Open—Acceptable Response.” Cockpit voice recorders and flight data recorders have been on commercial airliners for years. Since 1993, event recorders have been required on trains. Additionally, the Safety Board has for more than 20 years recommended the use of voyage event recorders for marine accident reconstruction. The Safety Board has also made recommendations regarding recorders for highway trucking transport. In 1990,63 the Safety Board issued the following recommendation to the FHWA: H-90-28 Require automated/tamper-proof on-board recording devices, such as tachographs or computerized logs, to identify commercial truckdrivers who exceed hours-of- service regulations. The Safety Board reiterated Safety Recommendation H-90-28 in its 1995 study on truckdriver fatigue,64 explaining that the intent of the recommendation was to provide a tamper-proof mechanism that could be used to enforce the hours-of-service regulations, rather than relying on drivers’ handwritten logs. In a February 1997 response, the FHWA acknowledged that on-board recording devices will eventually be an important tool for monitoring the hours-of-service of commercial motor vehicle drivers. However, the FHWA stated that its “position is that the benefits and practicality of on-board recorders must be firmly established before rulemaking ensues.” In a July 1998 letter, the Safety Board responded that it was disappointed with the lack of positive action by the FHWA on this recommendation. While the deliberately paced research and symposium approach may yield useful information, there is no indication of aggressive research and prompt action to develop and require advanced technical solutions to address the intent of Safety Recommendation H-90-28. As a result, the recommendation was classified “Closed—Unacceptable Action.” 63 National Transportation Safety Board. 1990. Fatigue, Alcohol, Other Drugs, and Medical Factors in Fatal-to-the-Driver Heavy Truck Crashes. Safety Study NTSB/SS-90/01. Washington, D.C. 64 NTSB/SS-95/01.

Analysis 52 Highway Accident Report On November 3, 1998, the FHWA again acknowledged that on-board recording devices may eventually be an important tool in monitoring commercial motor vehicle driver’s hours-of-service. However, its position remains that the benefits and practicality of on-board recorders must be firmly established before rulemaking ensues. With the current state of technology, on-board recorders cannot record the duty status of the driver when the driver is not in the driving mode. The FHWA believes that it would be premature to require technology since the technology is not currently capable of all inclusive monitoring of driver fatigue. On February 25, 1999, the Safety Board noted the “lack of positive action by the FHWA on this recommendation.” Should the FHWA decide to require automated tamper-proof on-board recording devices on commercial motor vehicles, the Safety Board will reevaluate the status of this recommendation. In the meantime, Safety Recommendation H-90-28 remains “Closed—Unacceptable Action.” In the Slinger, Wisconsin, accident report,65 because the FHWA had not yet effectively acted on Safety Recommendation H-90-28, the Safety Board issued Safety Recommendation H-98-23 to the ATA, the International Brotherhood of Teamsters, and the Motor Freight Carrier Association and Safety Recommendation H-98-26 to the Independent Truckers and Drivers Association, the National Private Truck Council, and the Owner-Operators Independent Drivers Association, Inc. These recommendations are as follows: H-98-23 Advise your members to equip their commercial vehicle fleets with automated and tamper-proof on-board recording devices, such as tachographs or computerized recorders, to identify information concerning both driver and vehicle operating characteristics. H-98-26 Advise your members to equip their commercial vehicle fleets with automated and tamper-proof on-board recording devices, such as tachometers or computerized recorders, to identify information concerning both driver and vehicle operating characteristics. The International Brotherhood of Teamsters, the Motor Freight Carrier Association, and the Owner-Operators Independent Drivers Association, Inc., have failed to respond to the recommendations. The Independent Truckers and Drivers Association and the National Private Truck Council responded on August 31, 1998, and September 1, 1998, respectively, stating that they disagreed with the recommended action and would not recommend to their members that they put recording devices on their vehicles. On December 9 and 10, 1998, the Board classified Safety Recommendation H-98-26 to these addressees “Closed—Unacceptable Action.” 65 NTSB/HAR-98/01.

Analysis 53 Highway Accident Report The ATA responded on September 9, 1998, that it had undertaken several steps toward implementing the recommended action and had begun the design of a simulator validation study and the development of an annual simulator. After reviewing the ATA response, the Safety Board classified Safety Recommendation H-98-23 “Open—Unacceptable Response” on January 3, 2000. The Safety Board is convinced that in heavy commercial vehicles, significant safety benefits can be realized from tamper-proof on-board recorders that 1) continuously monitor the vehicle’s operational parameters; 2) capture vehicle usage information as well as vehicle operational data, such as speed, braking, lighting, and steering; 3) are able to recognize an accident or catastrophic system failure; and 4) recapture and store predetermined time frame data before and after incident recognition. On-board recorders should have a power back-up provision or internal battery, and the unit should be placed in a crashworthy position on the vehicle. Having this operational data immediately available would enhance the accuracy of commercial vehicle accident investigations, document driver operational factors, and improve company oversight. 1-800-SAFEBUS Program. In its safety manual, Greyhound describes the 1-800-SAFEBUS program as one of its driver safety check programs. The purpose of the program is to allow the public to notify the company, using a toll-free telephone number, about driver performance, service, and driving behavior. The program is intended to make Greyhound aware of a driver’s unsafe driving practices and allow the company to initiate a follow-up investigation or review of the complaints received. Although a number of problems identified by the Safety Board, such as not recording calls and not including all complaint information in a file report, were rectified, according to Greyhound, when Fleetsafe purchased Safetynet, the Safety Board is concerned that Greyhound is not using the complaints received through the 1-800-SAFEBUS program to their full potential as a driver assessment tool. According to Greyhound, complaints are filed at a driver’s home terminal but not included in that driver’s personnel or qualification files, and the driver’s supervisor is not required to act on a complaint. The Greyhound safety department may initiate disciplinary action for a driver who is repeatedly listed on 1-800-SAFEBUS monthly reports, presenting the possibility that a driver problem may continue for several months before action is taken. In addition, the omission of 1-800-SAFEBUS complaints from personnel files makes it more difficult for Greyhound to take a proactive stance on preventing unsafe driver practices. When a 1-800-SAFEBUS complaint is received from an identified caller who leaves a telephone number, the Greyhound safety department is notified. However, if a complaint is received from an anonymous caller, the complaint is not processed, and the safety department is not notified; therefore, no further action is taken. Not recording all complaints increases the likelihood that unsafe driving practices will continue unchecked. Therefore, the Safety Board concludes that Greyhound’s policy of disregarding anonymous calls to 1-800-SAFEBUS prevents the company from identifying patterns of unsafe driving practices by particular drivers or on particular runs and diminishes the potential safety oversight benefits of this program. Including all complaints in driver

Analysis 54 Highway Accident Report personnel files would enable Greyhound to better detect an operator problem and act to eliminate it before an accident occurs. Receiving and following up on all calls received through the 1-800-SAFEBUS program would allow more encompassing safety oversight. Consequently, the Safety Board believes Greyhound should revise its 1-800-SAFEBUS program to ensure that all complaints are included in drivers’ files and used in drivers’ assessments. Highway Factors The Safety Board’s investigation focused on the design of the emergency pull-off area and the consequences of commercial vehicles being parked in the pull-off area. A discussion of these factors, as well as of the adequacy of commercial vehicle parking spaces nationally, follows. Use of Pull-Off Areas. Emergency pull-off areas exist along the turnpike to allow vehicles to park away from the travel lanes during an emergency. The Safety Board found, in addition to marked emergency pull-off areas, unmarked pull-off areas and picnic areas along the turnpike. This multiple-vehicle accident occurred in a marked 28-foot-wide emergency pull-off area adjacent to the westbound lanes of the turnpike. The TransAm truck struck by the Greyhound motorcoach was parked about 9 to 10 feet from the edge of the travel lane. The Pennsylvania Turnpike guidelines follow the American Association of State Highway and Transportation Officials (AASHTO) recommendations for highway design. AASHTO recommends that roadways have a clear zone, which it defines as the total roadside border area, starting at the edge of the traveled way, available for safe use by errant vehicles. This area may consist of a shoulder, a recoverable slope, a nonrecoverable slope, and/or a clear run-out area. The desired width is dependent upon the traffic volumes and speeds and on the roadside geometry.66 Given that the speed limit on the accident section of the turnpike is 65 mph, the average daily traffic volume in 1998 was approximately 20,000 vehicles, and the slope of shoulder adjacent to the pull-off area is 4.2 percent (1:20), the AASHTO recommended minimum clear zone would be a width of 30 feet. Therefore, the trucks that were parked there at the time of the accident were within the clear zone. Because the accident site pull-off area has a width of 28 feet, it is too small to accommodate both a 30-foot clear zone and parking for commercial or private vehicles. The turnpike has other emergency, unmarked, and picnic pull-off areas that are also unable to accommodate both a clear zone and parking for vehicles. The 28-foot tire mark probably made by the accident motorcoach suggests that the driver had been in the process of braking shortly before impact. The Safety Board examined what might have happened had the trucks not been in the clear zone. At the calculated minimum speed of 50 mph, the stopping distance (skid distance) would have been between 167 and 208 feet. Based on this skid-to-stop distance and the available space of 230 feet to the embankment, the Safety Board determined that the motorcoach would 66 Roadside Design Guide. American Association of State Highway and Transportation Officials. 1996.

Analysis 55 Highway Accident Report not have collided with the embankment. However, given the same set of circumstances at a speed of 65 mph, the required skid-to-stop distance would have been between 282 and 352 feet, and the motorcoach would have collided with the embankment between 38 and 28 mph. At 70 mph, the required skid-to-stop distance would have been between 327 and 408 feet, and the motorcoach would have collided with the embankment between 46 and 38 mph. The Safety Board has determined that the busdriver drifted off the roadway and then collided with the TransAm tractor-semitrailer parked within the 28-foot clear zone in the emergency parking pull-off area. Evidence suggests that the motorcoach probably would have struck the embankment had no vehicles been in the pull-off area; however, the impact speed would have been lower and the consequences less severe. Therefore, the Safety Board concludes that had a clear zone been available to the Greyhound driver, he may have had the opportunity to recover. The Safety Board understands that the Commission is examining and evaluating pull-off areas and closing those that pose a risk to the motoring public. However, a postaccident survey of the turnpike by the Safety Board suggested that it was not uncommon for trucks to park close to the travel lanes. The Safety Board therefore believes that the Commission should prohibit nonemergency parking in pull-off areas within the highway clear zone. In addition, the Safety Board believes that the Commission should provide adequate rest areas for nonemergency parking to accommodate vehicles that may be displaced by the prohibition of parking in emergency pull-off areas within the highway clear zone. Rest Areas. The drivers of the TransAm and the Oliver trucks originally parked in the emergency pull-off area because of the heavy rain. However, at the time the accident occurred, the emergency conditions that forced the drivers to pull off the roadway had passed, and both were using the pull-off as a rest area. As a result, the Safety Board explored whether the drivers’ decisions may have been influenced by the insufficiency of parking at designated rest areas on the turnpike. The lack of data on the number of rest area spaces available on the turnpike inhibited investigators from determining whether a shortfall of parking spaces existed. However, the 1996 ATA report found a shortfall of more than 28,000 truck parking spaces nationwide and of almost 2,000 commercial vehicle parking spaces in Pennsylvania. This lack of commercial vehicle parking is a national concern because it creates situations that may force fatigued drivers to stay on the road. In the 1990 Safety Board study67 of 182 heavy truck accidents that were fatal to the driver, fatigue was a factor in 31 percent of the accidents. The lack of adequate rest area parking spaces can also lead to overflow situations in which drivers are being compelled to park on the shoulder of rest area exit and entrance ramps. This situation is unacceptable for several reasons. First, it limits the acceleration rate of the drivers who are parked on the exit ramp shoulder, creating the possibility that 67 NTSB/SS-90/01 and NTSB/SS-90/02.

Analysis 56 Highway Accident Report their trucks’ speed may be significantly lower than that of the traffic on the main roadway. Second, it creates a dangerous dilemma between high-speed vehicles decelerating into or accelerating out of the rest area and slow-moving vehicles pulling out from parking on the shoulders. Finally, the shoulders are not protected from errant vehicles. While truckdrivers may consider that this is a protected site due to the gore68 areas that separate the ramps from the mainline, the following accident (depicted in figure 11) illustrates differently. On June 3, 1999, a westbound truck tractor-semitrailer approaching a public rest area on I-40 near Jackson, Tennessee, left the roadway, traveled 360 feet across a 63-foot-wide gore area, and struck three combination vehicles. These trucks were parked in an unauthorized area along the outside shoulder of the acceleration lane leading from the rest area onto I-40. The collision resulted in five fatalities.69 The rest area issue has been addressed in Section 4027 of TEA 21. Section 4027 requires the DOT to perform a nationwide inventory of rest areas and other parking facilities along the national highway system and an analysis of shortages, real and projected, and to develop a plan to reduce the shortages. It stipulates that this research is to be conducted in cooperation with research organizations that represent the motor carrier industry, the travel plaza industry, and commercial motor vehicle drivers. In June 1999, OMCHS representatives met with State transportation officials to commence the process to accomplish the directive in Section 4027. The Safety Board is encouraged that a national effort has finally been initiated to alleviate the commercial vehicle parking problem and awaits the conclusions and agreements generated from the OMCHS efforts. 68 The term “gore” refers to the area between a through roadway and an exit ramp and the area between a through roadway and a converging entrance ramp. Figure 11. Diagram of truck tractor-semitrailer collision near Jackson, Tennessee. 69 National Transportation Safety Board. Docket No. Highway 99-FH-019.

Analysis 57 Highway Accident Report Survival Aspects Interior Lighting. One passenger said that the bus was “pitch black” after the accident. She stated that because no lights were on, the passengers had difficulty finding the emergency exits, thus slowing the evacuation. At one point, a passenger ignited a cigarette lighter to provide interior illumination, even with the smell of fuel fumes present. When the emergency responders arrived on scene, wounded passengers were trapped within the vehicle, and the interior of the bus was completely dark. Fortuitously, the first arriving emergency response vehicle had a generator to provide lighting; otherwise, the emergency responders would have had only flashlights to light the rescue operations before the arrival of a heavy-duty rescue mutual aid department. Interior emergency lighting would have helped not only the passengers in their attempt to evacuate the bus, but also the immediate emergency responders in their effort to find and treat trapped and incapacitated passengers. Other modes of transportation, such as aviation, rail, and marine, have requirements for provision of emergency lighting during crash rescue operations. For example, in the aviation industry, carriers are required to install, and to ensure that passengers are aware of, interior emergency floor lighting, which in the event of an emergency illuminates a pathway to emergency exits. In all modes of transportation, the provision of emergency lighting decreases the likelihood of injury or death from either panic or the inability to find an available exit that may have been obvious during daylight. The Safety Board has long believed that the capability to evacuate intercity-type buses70 rapidly in emergencies is essential. In September 1986, as a result of its investigation of an October 1984 truck-bus head-on collision near Laredo, Texas,71 the Safety Board asked the FHWA, in conjunction with NHTSA, to adopt standards to require emergency interior lighting for intercity-type buses that is of sufficient intensity and duration to aid occupants in identifying available exit routes and to aid rescuers in assisting injured occupants (Safety Recommendation H-86-63). After the FHWA responded on November 20, 1986, that it did not find sufficient justification to issue standards for emergency interior lighting for intercity buses, this recommendation was classified “Closed—Unacceptable Action” on March 5, 1987. Currently, no Federal standards for motorcoaches include provision of an alternate light source in the event of an accident in which the main light source has been damaged and no longer provides interior lighting. The Safety Board concludes that the lack of Federal standards requiring motorcoaches to be equipped with reliable emergency lighting fixtures with a self- contained independent power source puts passengers in jeopardy and can hamper emergency response. Therefore, the Safety Board believes that NHTSA should revise the Federal Motor Vehicle Safety Standards (FMVSS) to require that all motorcoaches be 70 Defined as for-hire buses that have a gross-vehicle-weight rating of more than 10,000 pounds and that transport more than 20 passengers. 71 National Transportation Safety Board. 1985. 1982 Eagle Charter Coach Head-on Collision with 1983 Ford Pickup Truck, near Laredo, Texas, October 20, 1984. Highway Field Report NTSB/HFR-85/02. Fort Worth, Texas.

Analysis 58 Highway Accident Report equipped with emergency lighting fixtures that are outfitted with a self-contained independent power source. Emergency Exit Signage. One of the passengers said that when evacuating the bus, everyone used the same emergency exit window to escape. He stated that he did not understand why the other windows did not automatically open when the accident occurred. He added that at first it appeared impossible to escape since, because of the darkness, no way out was apparent. Although he had years of experience riding Greyhound buses, he said he never noticed the emergency signage indicating the exit locations and the instructions on how to use them. Another passenger stated that she evacuated the bus through an exit already opened by another passenger and was the second to exit the bus because she had observed the window being opened. Therefore, the Safety Board concludes that the emergency egress of the passengers was impeded because the motorcoach lacked easily identifiable interior emergency instruction signage. The first emergency responders who arrived on scene stated that they were unsure of how to enter the accident bus and saw no signage for entry locations or emergency exits. According to the emergency responders, without the assistance of the Greyhound busdriver who had stopped after the accident, they would not have been able to immediately gain access to the interior of the vehicle to assist the injured. When they arrived on scene they had to first set up a step ladder, which the Greyhound driver used to climb into the bus. Then he showed them how to take off the windows to gain access to the bus. When passersby and emergency responders arrive on scene to rescue trapped passengers and provide medical assistance, any impediment to rapid entry into the accident vehicle can be detrimental to timely treatment of injuries and, possibly, to passenger survival. The Safety Board concludes that, had it not been for the other Greyhound driver, who pointed out the location and demonstrated the operation of the emergency windows, the fire and rescue personnel would have lost valuable time in trying to access the bus and would not have been able to quickly provide medical assistance to the trapped passengers. Currently, the FMVSS provide guidance only on the location of emergency signage and on what the signage should state. Furthermore, the FMVSS have no requirement that, in the event of an emergency in which normal lighting conditions do not exist, the emergency exits must be visible to the passengers. Title 49 CFR 571.217.S5.5.2 states that in buses, other than school buses, each marking shall be legible when the only source of light is the normal nighttime illumination of the bus interior. However, this requirement does not consider whether the signage is visible without the normal nighttime illumination of the interior when the vehicle has been in an accident and the main power source is no longer available. The Safety Board concludes that the current FMVSS are not comprehensive enough because the standards fail to recognize the need for interior luminescent and exterior retroreflective emergency signage in the event that interior lighting is not present during an accident or other emergency. Therefore, the Safety Board believes that NHTSA should revise the FMVSS to require the use of interior luminescent or exterior retroreflective material or both to mark all emergency exits in all motorcoaches.

Analysis 59 Highway Accident Report Passenger Safety Briefings. In its special investigation report72 of selected motorcoach issues, the Safety Board discussed making safety briefings available to bus passengers. Carriers have a variety of opportunities to provide passengers with emergency evacuation information. Depending on the size of the carrier or the scope of its operation, safety materials could include all or any number of the following: videos, briefings, pamphlets, or cards that are attached to seatbacks. Safety Board investigators discussed the availability of safety briefing videos with representatives from the two major trade associations, the ABA and the UMA, and a marketing and tour brokering organization, the National Motorcoach Network (NMN). The NMN representatives said that many carriers, with the exception of Greyhound and some companies serving senior citizen groups, have motorcoaches that are equipped with television monitors that can show videotapes. The UMA, ABA, and NMN representatives said that passenger safety videos similar to those shown on aircraft are available, but are not widely used throughout the motorcoach industry. The Safety Board has stressed the importance of passenger safety education in all modes of transportation. Federal Aviation Administration (FAA) regulations at 14 CFR Parts 121 and 135 provide minimum requirements for conveying safety information to passengers. FAA advisory circulars and air carrier operations bulletins provide general guidance to air carriers and to FAA inspectors for developing flight attendant oral safety presentations and safety cards. The guidance generally is about what information should be presented, but not how it should be presented.73 Although the Federal Railroad Administration does not specifically include information requirements in its passenger safety regulations, Amtrak uses signs and placards, as well as briefings, to inform passengers about safety features on its trains. U.S. Coast Guard regulations require safety drills on all cruise ships embarking passengers from U.S. ports. The Safety Board determined that emergency instructions can be crucial to a safe and expedient evacuation in the event of an accident or emergency. On February 26, 1999, the Safety Board urged the ABA and the UMA in Safety Recommendations H-99-13 and -17, respectively, to encourage their members to provide pretrip passenger safety briefings. After Safety Recommendation H-99-13 was issued, the Safety Board contacted the ABA, and no response has been received. Safety Recommendation H-99-13 is classified “Open—Await Response.” Safety Recommendation H-99-17 was classified “Closed—Acceptable Action” on November 16, 1999, based on the UMA’s action to make both video and script passenger briefing materials available to member companies for their use. 72 National Transportation Safety Board. 1999. Selective Motorcoach Issues. Highway Special Investigation Report NTSB/SIR-99/01. Washington, DC. 73 See Safety Study—Airline Passenger Safety Education: A Review of Methods Used to Present Safety Information (NTSB/SS-85/09).

Analysis 60 Highway Accident Report Emergency Response The Commission acknowledged that, without a proficient ICS, as well as procedures for control, coordination, and communication with and throughout all responding resources, the effectiveness of emergency response is reduced. One of the turnpike ICS goals is to achieve better communication and coordination at the scene among fire and rescue, ambulance service, PSP, turnpike maintenance personnel, and other agencies. The ICS for this accident included numerous mutual aid agencies contracted by the Commission. Although the emergency response was adequate, the Safety Board identified several areas, such as communications equipment, initial dispatch of appropriate rescue equipment, and disaster response and management, that need improvement. Communications Equipment. According to the turnpike Incident Management Program Manual, when an incident occurs on the turnpike, the maintenance department is responsible for setting up a mobile command post, which is used to coordinate organization and communications. Additionally, standard first responder vans are to be equipped with cellular phones, CB radios, turnpike repeaters, and portable radios; the customized emergency response vehicles are to provide enhanced communication at the scene. The Commission was to provide radios to contracted fire services and EMS responders that did not have radios compatible with the turnpike’s communication system to ensure that when an incident occurred, all responding State police, turnpike units, and emergency services would be capable of communicating with each other during their response. The Metal Township fire chief, who acted as the fire and rescue IC, stated that one problem he encountered on scene was that the medical channel and fire radio channels used different frequencies and the other responding counties also had a different radio frequency; as a result, three or four different radios were needed to communicate. The IC said that he did not have the necessary radios available and that a communication lapse occurred that left him unable to communicate with everyone who was on scene. One problem due to the lack of communication occurred when, during triage, the Fulton County Medical Center could not handle any more patients, and the medics had to send the patients to Chambersburg Hospital. The IC said that he was unaware of this situation because the information was broadcast only on the medical channel and he had a low band channel for the fire company activities; therefore, the IC was dispatching conflicting instructions to emergency responders. He recalled that the medical response became chaotic and disorganized for a period of time, although overall, it did not have a negative effect on the medical assistance provided to the injured. The turnpike’s Incident Management Manual goal in using the ICS -- to achieve better communication and coordination at the scene among all responders -- was not achieved during the emergency response to the Burnt Cabins accident. Because the IC for fire and rescue did not have the appropriate radios, he could not communicate with all the responding agencies at the scene; as a result, the emergency response was disorganized and, at times, chaotic. The Safety Board, therefore, concludes that, during emergency

Analysis 61 Highway Accident Report response activities for the Burnt Cabins accident, the communications were not adequate to appropriately handle a mass casualty event and resulted in less than optimal emergency response. Initial Dispatch of Appropriate Emergency Equipment. Under the box card assignment set up for turnpike accidents, a prearranged number of units are dispatched to a specific accident, a prearranged number for each situation. In this accident, the box card assignment provided for a dispatch of only four ambulances and one rescue engine. When the IC arrived on scene and assessed the situation, he found that he did not have the resources needed to deal with the accident. He then requested additional resources and equipment, including multiple ambulances and helicopters. The fire chief and deputy fire chief of West End Fire and Rescue concurred with the IC about the dispatching of emergency equipment to the accident. They stated that, when the call was received, the situation was initially relayed as involving a bus and tractor-semitrailer. The West End department, being the closest heavy-duty response unit, should have been immediately dispatched, especially since it has the same dispatcher as Metal Township, the initial responding department. According to the West End fire chief and deputy fire chief, being dispatched initially would have saved approximately 15 minutes in arrival time, which can be vital in emergency response to an accident. Instead, their department was dispatched only after the IC arrived on scene and called for their aid. In Franklin County where West End normally operates, its box card assignments for mass casualties always include at least two heavy-duty squads, two full engine companies, and four basic life support ambulances, as well as one or two medic units and a helicopter on standby. The fire chief and deputy fire chief said that based on the dispatch description of the accident, additional mutual aid units should have been called immediately and sent to a staging area away from the accident scene. Depending on what was happening on scene, the resources could have been dispatched without delay upon request. The Safety Board concludes that, although not detrimental to the emergency response efforts for the accident victims, the lack of an initial dispatch of appropriate emergency rescue equipment resulted in a less expedient and more disorganized response. Disaster Preparedness and Emergency Response Management. The turnpike Incident Command System Manual, available to the PSP Troop T and the contracted fire and EMS responders, featured an accident scenario in which a Greyhound bus ran off the road and down an embankment, resulting in fatal, serious, and minor injuries. The manual discussed potential problems that might be encountered and listed emergency response units and apparatus that might be required. However, the Commission did not hold any mutual aid disaster drills to provide hands-on training on any of the scenarios presented in the manual. According to the Commission, its subcommittees for emergency services are responsible for conducting annual informational meetings with the contracted service

Analysis 62 Highway Accident Report departments. These meetings are designed so that the PSP and turnpike personnel can discuss accident and safety procedures and any operational or protocol problems with the emergency service groups. According to the Incident Management Program Book, these meetings have proven invaluable as a source for improving overall communications and on-scene management and have enhanced the response to turnpike incidents. However, the Metal Township fire chief, who acted as the fire and rescue IC for the accident, told Safety Board investigators that these annual group meetings were not obligatory and, therefore, he had never attended. He also said that Franklin County had, however, performed countywide disaster drills and held one a few months before this accident occurred. In addition, the IC remarked that he had concerns about how the emergency response was conducted and believed that it could have been improved, especially in the area of emergency medical services. He recalled that even though the Metal Township EMT captain was tracking the ambulances and the patients being transported, the IC was not aware that one medical center could not receive any more of the injured and that they had to be transported to another hospital. He said that the situation was “chaotic” because Metal Township had never before dealt with an accident of this magnitude. Other emergency responders agreed; one paramedic recalled that the accident scene was “pretty much chaos” and everyone mostly did what they wanted. The IC also stated that he had not had bus rescue training before the accident occurred and that emergency responders should have training on commercial buses. Other emergency responders interviewed by the Safety Board after the accident stated that they believed having operational drills would be beneficial in the event of another mass casualty. The Safety Board has long been a proponent of emergency response plans that specifically highlight multicasualty accidents involving numerous mutual aid agencies from varying jurisdictions. The disaster plan procedures should address, at a minimum, key emergency response departments, equipment, management personnel, and communication. Although the turnpike’s manual included such information, turnpike officials had not tested the adequacy of the disaster plans or the ability of contracted emergency responders to work together to carry out their assigned functions. The Safety Board concludes that because the Commission did not provide disaster drills for its contracted emergency response personnel, the Burnt Cabins emergency response was marked by communication equipment problems, delays in dispatching the appropriate heavy rescue equipment, and a lack of coordination in providing emergency medical services. Therefore, the Safety Board believes the Commission should periodically conduct disaster drills in mass casualty transportation accidents, such as the bus accident near Burnt Cabins, with contracted emergency response departments on the turnpike to assess its emergency management plan, to reinforce and evaluate emergency training, and to test communication among the responding agencies.

63 Highway Accident Report Conclusions Findings

1. Neither the existing highway pavement conditions, the mechanical condition of the

bus, nor the weather contributed to the accident. The busdriver did not appear to be speeding, nor was he impaired by alcohol or illicit drugs.

1. The evidence cannot establish that the busdriver was impaired or incapacitated by a

cardiac condition prior to the accident.

1. The busdriver ingested an over-the-counter multisymptom cold and allergy

medication at some time either shortly before or during his scheduled route. The sedating antihistamine in this medication contributed to making the busdriver sleepy and reducing his alertness.

1. Because of the scheduled irregular work-rest cycle and possible sleeping difficulties,

the busdriver may have developed a sleep debt over the 4 days of his shift, which was exacerbated by a reduced alertness corresponding to his body’s circadian rhythm. The combined result of these factors may have contributed to the busdriver’s sleepiness and reduced alertness, causing him to drift off the roadway and collide with the tractor-semitrailer parked in the adjacent emergency parking area.

1. Greyhound’s lax procedures in compiling course material and documenting

personnel training makes its safety oversight program less effective.

1. The effectiveness of the Greyhound safety oversight program is lessened by not

considering traffic violations in driver safety assessments.

1. Greyhound’s current operational oversight program is inadequate to detect and

correct the widespread speeding of its busdrivers.

1. By not establishing a policy to activate and use the data pages option of the electronic

control module units, Greyhound is severely degrading its ability to oversee driver and vehicle operations safety.

1. Greyhound’s policy of disregarding anonymous calls to 1-800-SAFEBUS prevents

the company from identifying patterns of unsafe driving practices by particular drivers or on particular runs and diminishes the potential safety oversight benefits of this program. Including all complaints in driver personnel files would enable Greyhound to better detect an operator problem and act to eliminate it before an accident occurs.

Conclusions 64 Highway Accident Report

1. Had a clear zone been available to the Greyhound driver, he may have had the

opportunity to recover.

1. The lack of Federal standards requiring motorcoaches to be equipped with reliable

emergency lighting fixtures with a self-contained independent power source puts passengers in jeopardy and can hamper emergency response.

1. The emergency egress of the passengers was impeded because the motorcoach lacked

easily identifiable interior emergency instruction signage.

1. Had it not been for the other Greyhound driver, who pointed out the location and

demonstrated the operation of the emergency windows, the fire and rescue personnel would have lost valuable time in trying to access the bus and would not have been able to quickly provide medical assistance to the trapped passengers.

1. The current Federal Motor Vehicle Safety Standards are not comprehensive enough

because the standards fail to recognize the need for interior luminescent and exterior retroreflective emergency signage in the event that interior lighting is not present during an accident or other emergency.

1. During emergency response activities for the Burnt Cabins accident, the

communications were not adequate to appropriately handle a mass casualty event and resulted in less than optimal emergency response.

1. Although not detrimental to the emergency response efforts for the accident victims,

the lack of an initial dispatch of appropriate emergency rescue equipment resulted in a less expedient and more disorganized response.

1. Because the Pennsylvania Turnpike Commission did not provide disaster drills for its

contracted emergency response personnel, the Burnt Cabins emergency response was marked by communication equipment problems, delays in dispatching the appropriate heavy rescue equipment, and a lack of coordination in providing emergency medical services. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the busdriver’s reduced alertness resulting from ingesting a sedating antihistamine and from his fatigued condition resulting from Greyhound Lines, Inc., scheduling irregular work-rest periods. Contributing to the severity of the accident was the Pennsylvania Turnpike Commission’s practice of routinely permitting nonemergency parking in pull-off areas within the highway clear zone.

65 Highway Accident Report Recommendations As a result of its investigation, the National Transportation Safety Board makes the following recommendations: To the National Highway Traffic Safety Administration: Revise the Federal Motor Vehicle Safety Standards to require that all motorcoaches be equipped with emergency lighting fixtures that are outfitted with a self-contained independent power source. (H-00-01) Revise the Federal Motor Vehicle Safety Standards to require the use of interior luminescent or exterior retroreflective material or both to mark all emergency exits in all motorcoaches. (H-00-02) To the Pennsylvania Turnpike Commission: Prohibit nonemergency parking in pull-off areas within the highway clear zone. (H-00-03) Provide adequate rest areas for nonemergency parking to accommodate vehicles that may be displaced by the prohibition of parking in emergency pull-off areas within the highway clear zone. (H-00-04) Periodically conduct disaster drills in mass casualty transportation accidents, such as the bus accident near Burnt Cabins, with contracted emergency response departments on the Pennsylvania Turnpike to assess its emergency management plan, to reinforce and evaluate emergency training, and to test communication among the responding agencies. (H-00-05) To Greyhound Lines, Inc.: Revise your driver scheduling practices to reduce scheduling variability that results in irregular work-rest cycles. (H-00-06) Include in your drivers’ assessment programs all driver traffic and logbook violations. (H-00-07)

Recommendations 66 Highway Accident Report Use all current and future data monitoring and storage capabilities of electronic control modules, electronic control units, and similar technologies to enhance vehicle and driver oversight programs by engaging the specific capabilities of each individual unit’s programmed or programmable functions to collect and monitor data including, but not limited to, vehicle speed, revolutions-per-minute, hard-brake or sudden decelerations, and other parameters of vehicle and engine operations. (H-00-08) Revise your 1-800-SAFEBUS program to ensure that all complaints are included in drivers’ files and used in drivers’ assessments. (H-00-09) To the United Motorcoach Association: Advise your members of the facts and circumstances of this accident and encourage them, if they do not already do so, to 1) revise their driver scheduling practices to reduce scheduling variability that results in irregular work-rest cycles and to 2) include all traffic violations in their drivers’ records and consider these violations during driver safety assessments. (H-00-10) To the American Bus Association: Advise your members of the facts and circumstances of this accident and encourage them, if they do not already do so, to 1) revise their driver scheduling practices to reduce scheduling variability that results in irregular work-rest cycles and to 2) include all traffic violations in their drivers’ records and consider these violations during driver safety assessments. (H-00-11) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: January 5, 2000

67 Highway Accident Report Appendix A Investigation The National Transportation Safety Board was notified of the Burnt Cabins, Pennsylvania, accident about 10:30 a.m. on June 20, 1998. An investigative team was dispatched with members from the Washington, D.C.; Atlanta, Georgia; and Parsippany, New Jersey, offices. Groups were established to investigate the human performance aspects; the highway, vehicle, and survival factors; and the motor carrier operations. Participating in the investigation were representatives of the Federal Highway Administration; the Pennsylvania Turnpike Commission; the Pennsylvania State Police; Greyhound Lines, Inc.; TransAm Trucking Incorporated; and motor coach associations. No public hearing was held; no depositions were taken.

68 Highway Accident Report Appendix B Other Vehicles TransAm Trucking Incorporated Vehicle And Occupants TransAm Incorporated TransAm Trucking Incorporated owned and operated the tractor-semitrailer combination. The company, with offices in Olathe, Kansas, and Kansas City, Missouri, has 515 power units and employs 600 drivers. It is registered with the Federal Highway Administration (FHWA) as an interstate common carrier of general freight, meat, foods, beverages, and hazardous materials and has been assigned U.S. Department of Transportation (DOT) identification number 315503. TransAm Tractor-Semitrailer The combination vehicle three-axle 1998 Freightliner tractor, of conventional design with a sleeper berth, and the 1991 53-foot utility semitrailer refrigerated cargo van with its cargo weighed 52,300 pounds. The tractor was equipped with a Detroit Diesel Series 60, 12.7 liter, electronically controlled diesel engine, which was outfitted with a Detroit Diesel electronic controls model III electronic controls module (ECM),1 governed at 72 mph. At the time of inspection, the optional data pages recording capability of the ECM was enabled. After National Transportation Safety Board investigators removed the ECM, Detroit Diesel technicians extracted the data from the ECM, which they provided to the Safety Board. According to that information, the TransAm tractor had been motionless and idling on the day of the accident from about 12:30 to 4:00 a.m.,2 at which time the ECM data indicated the engine was no longer idling. TransAm Tractor-Semitrailer Damage Damage was observed in the area of the sleeper compartment of the cab. The rear bulkhead of the tractor cab was deformed outward about 8 inches. No additional damage was noted to the tractor. Both of the trailer rear doors had been removed from the trailer before inspection. The doors had been equipped with diamond grade, prismatic red and white adhesive, retroreflective conspicuity sheeting. 1 A semiconductor unit for controlling ignition timing and other parameters in an engine management system. 2 Times are approximations based on the ECM engine usage profile report.

Appendix B 69 Highway Accident Report The trailer sustained intrusion damage to and upward deformation of its rear section. The trailer frame rails had been bilaterally displaced upward. Frame rail damage was measured in 1-foot increments starting from the rear axle locking pin in the 25th aligning hole from the rear of the trailer. The last measurement represented the maximum observed deformation. The left side of the trailer exhibited 1.75 feet of outward bowing, measured at the outermost point. Maximum outward deformation along the right side of the trailer at the rear measured about 2 feet. The rear-end cap framing of the trailer was deformed outward approximately 1 foot on the left side and 0.75 foot on the right side; the bottom was deformed upward about 1 foot. The lower right and left rears of the trailer were displaced rearward approximately 2 and 6 feet, respectively. The interior flooring was displaced upward. TransAm Tractor-Semitrailer Tests The Safety Board’s materials laboratory conducted a forensic examination of four taillight and two side marker light assemblies that were removed from the trailer. These assemblies were examined for the presence of hot stretch, and the examination revealed that the filaments in several of the bulbs did exhibit evidence of stretching. TransAm Truck Occupants Both occupants of the TransAm truck were in the sleeper berth at the time of the accident. The passenger sustained serious injuries involving multiple rib fractures, pulmonary contusion, and head abrasions. She said that she was thrown forward from the sleeper and landed in the cab and the truckdriver landed on top of her. The truckdriver received minor injuries involving multiple contusions, lacerations, abrasions, and sprains. He stated that he was thrown from the sleeper onto the floor of the cab. A pretreatment blood screen was conducted on one of them at the hospital emergency room; the report was negative for drugs or alcohol. A postaccident drug test was conducted on the other occupant; these test results were also negative for alcohol and drugs. (Because the vehicle was parked at the time of the accident, the drug testing of the occupants was not required by Federal regulations.) Oliver Trucking Incorporated Vehicle And Occupant Oliver Trucking Incorporated Oliver Trucking Incorporated, located in Indianapolis, Indiana, has 223 power units and employs 383 drivers. It is registered with the FHWA as a common carrier of general freight and has been assigned DOT identification number 164074.

Appendix B 70 Highway Accident Report Oliver Tractor-Semitrailer The 1995 Kenworth model T-600 tractor, of conventional design with a sleeper berth, was leased from Penske Truck Leasing, Incorporated; the 1988 Trailmobile, semitrailer was owned and operated by Oliver Trucking Incorporated. Oliver Tractor-Semitrailer Damage The trailer sustained contact damage to its left side where two horizontal creases were observed. The first crease was approximately 33 inches from the bottom of the trailer and traveled from the rear about 207 inches; the second was approximately 50 inches from the bottom of the trailer and traveled from the rear about 199 inches. A 24-inch longitudinal tear to the outer skin of the semitrailer, which began approximately 125 inches from the rear, was observed along the second crease. Oliver Truck Occupant The occupant of the Oliver truck, who was in the sleeper berth of his cab at the time of the accident, was uninjured. No postaccident drug test was conducted on the occupant nor was it required.

71 Highway Accident Report Appendix C Injury Table Injury table based on the Abbreviated Injury Scale1 of the Association for the Advancement of Automotive Medicine. INJURIES DRIVER BUS PASSENGERS OTHERa a. TransAm truckdriver and codriver. TOTAL AIS 9 : UNKNOWN 0 0 0 0 AIS 6 : UNSURVIVABLE 1 1 0 2 AIS 5 : CRITICAL 0 1 0 1 AIS 4 : SEVERE 0 3 0 3 AIS 3 : SERIOUS 0 2 1 3 AIS 2 : MODERATE 0 1 0 1 AIS 1 : MINOR 0 14 1 15 AIS 0 : NONE 0 0 0 0 TOTALb b. The Oliver truckdriver was uninjured, not transported to a hospital, and, therefore, not included in the count. 1 22 2 25 1 Abbreviated Injury Scale refers to the abbreviated injury scale (revised 1990) of the American Association for the Advancement of Automotive Medicine.

72 Highway Accident Report Appendix D Federal Motor Carrier Safety Ratings Procedures The Motor Carrier Safety Act of 1984 directed the U.S. Secretary of Transportation to establish a procedure to determine the safety fitness of owners and operators of commercial motor vehicles operating in interstate or foreign commerce. Subsequently, the FHWA promulgated a set of safety fitness standards and established a methodology for determining whether a carrier has adequate safety management controls to ensure acceptable compliance with the safety requirements. The original methodology was modified as a result of the Motor Carrier Safety Act of 1990 and a 1997 rulemaking. Six factors (see table 1) form the basis for a carrier’s safety rating, that is, the degree to which a carrier is in compliance with the Federal Motor Carrier Safety Regulations (FMCSR) and therefore meets the safety fitness standard. Each factor is rated satisfactory, conditional, or unsatisfactory. A satisfactory factor rating means the carrier has not violated any acute or critical regulations. A conditional factor rating means the carrier has violated one acute regulation or has a pattern of noncompliance with critical regulations. An unsatisfactory factor rating means the carrier has violated two or more acute regulations or has patterns of noncompliance with two or more critical regulations. The accident factor is based on the carrier’s size and number of accidents. Acute violations are FMCSR or Hazardous Materials Regulation violations demanding immediate corrective action regardless of the overall safety posture of the motor carrier. For example, requiring or permitting the operation of a vehicle declared out of service before repairs are made (49 CFR 396.9[c][2]) is an acute violation. Table 1. Motor carrier safety rating factors. Factor* Applicable FMCSR Factor 1 - General Parts 387 and 390 Factor 2 - Driver Parts 382, 383, and 391 Factor 3 - Operational Parts 392 and 395 Factor 4 - Vehicle Parts 393 and 396 Factor 5 - Hazardous Materials Parts 397, 171, 177, and 180 Factor 6 - Accident Factor Recordable Preventable Rate *All factors are given equal weight.

Appendix D 73 Highway Accident Report Critical violations are regulatory violations that indicate breakdowns in a carrier’s management controls. For instance, requiring or permitting a driver to drive after having been on duty for 15 hours (49 CFR 395.3[a][2]) is a critical violation. The ratings for the first five factors and the accident rate for the 12 months before the review are then entered into a rating table, which is used to establish the motor carrier’s safety rating (see table 2). Each of the six factors is given equal weight. Table 2. Motor carrier safety rating table. Factor Ratings Safety Rating Number of Unsatisfactory Ratings Number of Conditional Ratings Resultant Safety Rating 0 2 or fewer Satisfactory 0 more than 2 Conditional 1 2 or fewer Conditional 1 more than 2 Unsatisfactory 2 or more 0 Unsatisfactory

FD07225 ｜ 2000_美国_NTSB_MAR0102_Fire_On_Board_the_US_Passenger_Ferry_Columbia.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 MARINE ACCIDENT REPORT PB2001-916403 NTSB/MAR-01/02 FIRE ON BOARD THE U.S. PASSENGER FERRY COLUMBIA CHATHAM STRAIT NEAR JUNEAU, ALASKA JUNE 6, 2000 7292A

this page intentionally left blank

Marine Accident Report Fire On Board the U.S. Passenger Ferry Columbia Chatham Strait Near Juneau, Alaska June 6, 2000 NTSB/MAR-01/02 PB2001-916403 National Transportation Safety Board Notation 7292A 490 L’Enfant Plaza, S.W. Adopted September 18, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Fire on Board the U.S. Passenger Ferry Columbia, Chatham Strait, Near Juneau, Alaska, June 6, 2000. Marine Accident Report NTSB/MAR-01/02. Washington, DC. Abstract: This report discusses the June 6, 2000, fire that occurred on the Alaska Marine Highway System ferry Columbia, while it was underway in Chatham Strait, near Juneau, Alaska. None of 498 people on board the vessel was killed or sustained serious injury; however, three passengers were transported to a shoreside hospital for medical conditions that preexisted the fire. Damages related to the accident exceeded $2 million. From its investigation of this accident, the National Transporattion Safety Board identified safety issues in the following areas: the adequacy of inspection and maintenance procedures for electrical systems; the adequacy of management safety oversight of maintenance procedures; and the adequacy of firefighting procedures. Based on its findings, the Safety Board made recommendations to the Alaska Marine Highway System. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916403 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms And Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Activities on Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Fire and Rescue Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Crew Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Coast Guard Firefighting Requirements for Vessel Crews . . . . . . . . . . . . . . . . . . . . . . 10 Emergency Training and Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 AMHS Maintenance Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Prior Shipyard Work on Main Switchboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Meteorology Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Medical And Pathological . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Medical Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Toxicological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Units 9 and 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Unit 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Unit 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Muster/Evacuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Passenger Questionnaires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Lifesaving Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Firefighting Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Firefighting Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Emergency Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Coast Guard Firefighting Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Passenger and Crew Accountability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Tests And Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Johns Hopkins University-Applied Physics Laboratory Report . . . . . . . . . . . . . . . . . . 25 Safety Board Materials Laboratory Testing Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Infrared Thermographic Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Emergency Team Muster Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Public Address System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Survey of Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Contents iv Marine Accident Report Equipment Repair and Upgrading of Columbia Systems . . . . . . . . . . . . . . . . . . . . . . . . 28 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Cause and Origin of Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 System Load Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Failure of Main Switchboard Breakers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Abnormal Condition in Electrical Generation System . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Electrical Connection in Switchboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Conductive Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Inspection and Maintenance Procedures For Electrical Systems . . . . . . . . . . . . . . . . . . . . . 33 Preventive Maintenance Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Quality Assurance Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Firefighting Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Actions of the Columbia’s Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Coast Guard Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Firefighters’ Staging Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Means of Communication in Engineroom . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Passenger and Crew Muster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Passenger and Crew Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

v Marine Accident Report Acronyms And Abbreviations AB able seaman ABS American Bureau of Shipping AMHS Alaska Marine Highway System CFR Code of Federal Regulations MSO Marine Safety Office SCBA self-contained breathing apparatus SAR Search and Rescue SOLAS International Convention for the Safety of Life at Sea STCW International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers

vi Marine Accident Report Executive Summary About 1207, Alaskan daylight time,1 June 6, 2000, a fire broke out in the main switchboard in the engine control room of the Alaska Marine Highway System (AMHS) ferry Columbia. The ferry, with 434 passengers, 1 stowaway,2 and 63 crewmembers on board, was underway in Chatham Strait, about 30 nautical miles southwest of Juneau, Alaska, on a regularly scheduled voyage from Juneau to Sitka, Alaska. As a result of the fire, the vessel lost main propulsion and electrical power and began to drift. The crewmembers on board the Columbia responded to the fire first. Soon thereafter, the U.S. Coast Guard (Coast Guard) cutter Anacapa, on patrol nearby, sent a firefighting team to the Columbia. About 1425, the fire was extinguished with no resulting injuries or deaths. However, the Columbia remained adrift. Three passengers were evacuated by Coast Guard helicopter because of medical conditions that preexisted the fire. The remaining passengers were safely transferred to another AMHS ferry, the Taku, which had rendezvoused with the drifting Columbia. About 2030, the Taku arrived at Auke Bay Ferry Terminal in Juneau, where the passengers disembarked. The Columbia was towed to the same terminal, arriving at 0845, on June 7. According to the AMHS, the cost of repairs to the ship was about $2 million. The National Transportation Safety Board determines that the probable cause of the fire on the Columbia was the absence of an effective maintenance and inspection program for the electrical switchboards, resulting in a switchboard fire by arcing, most likely due to a faulty connection or a conductive object. The major safety issues discussed in the report are as follows: • Adequacy of inspection and maintenance procedures for electrical systems; • Adequacy of management safety oversight of maintenance procedures; and • Adequacy of firefighting procedures. As a result of this investigation, the National Transportation Safety Board makes safety recommendations to the AMHS, the operator of the Columbia.

1 All times in this report are Alaskan Daylight Time. 2 See “Passenger and Crew Accountability” for information concerning the stowaway.

1 Marine Accident Report Factual Information Accident Synopsis On June 6, 2000 at 0915, the 418-foot ferry Columbia (see figure 1) departed the AMHS’s Auke Bay Terminal north of Juneau, Alaska, en route to the AMHS terminal in Sitka for a scheduled voyage of about 8 1/2 hours. (See figure 2.) On board were 434 passengers, 1 stowaway, and 63 crewmembers. About 1207, fire broke out in the main electrical switchboard1 in the engine control room, knocking out power to the ship’s electrical systems and causing the emergency generator to come on line. The ship also lost its main propulsion. Personnel on board the Columbia responded to the fire first. Soon thereafter, the Coast Guard Cutter Anacapa, on patrol nearby, sent a firefighting team to the Columbia. Additional resources from Coast Guard Station Juneau and the State of Alaska also responded to the emergency. About 1425, the fire was extinguished. No one was injured or killed. However, the Columbia remained dead in the water. Another AMHS ferry, the Taku, rendezvoused with the drifting Columbia and took on board the Columbia’s passengers without incident or injury. About 2030, the Taku arrived at Auke Bay Ferry Terminal in Juneau, where the passengers disembarked. The Columbia was towed to the same terminal, arriving at 0845 on June 7. Although no injuries resulted from the fire, three individuals were taken to a Juneau hospital for medical reasons. 1 A switchboard supports and houses meters, circuit breakers, switches, indicator lights, rheostats, resistors, and fuse holders. It also contains the electrical conductors interconnecting these components. Figure 1. The Columbia.

Factual Information 2 Marine Accident Report Figure 2. Columbia’s route to the point of the accident (circled).

Factual Information 3 Marine Accident Report Accident Narrative Preaccident Events According to shipboard personnel, from the time that the Columbia departed Juneau, at 0915, until 1130, events were routine in the engineroom. (See figure 3.) The vessel was underway at 19.4 knots with both main engines operating. Two of the ship’s three auxiliary generators were operating in parallel; the third generator was shut down. About 1130, the engineroom watch changed. The new watch included a watch engineer, an unlicensed junior engineer, and an oiler. The junior engineer and the oiler made inspection rounds and returned to the control room. They did not note any problems during their rounds. While the watch engineer went on his rounds, the junior engineer and the oiler talked near the log desk, which was on the port side of the control room. The Accident The junior engineer stated that, shortly after 1200, he and the oiler heard a “disruptive sound, [a] kind of a poof” and saw a bright electrical arc2 and sparks emerge Figure 3. Schematic of engineroom. 2 An electric arc is a sustained luminous discharge of electricity across a gap between two conductors at different voltage levels. Port Door C o n t r o l R o o m Escape Scuttle F.O. Service Tank Starboard Door Electrical Workshop DN AC Refrigeration Machinery Room Up Workshop Workshop

Factual Information 4 Marine Accident Report from the upper portion of the main switchboard section, at its starboard end (unit 12).3 Almost immediately, unit 10 began sparking and arcing, and the noise increased. The control room quickly filled with thick black smoke. The junior engineer and the oiler escaped through a nearby door into the engineroom, whereupon the junior engineer told the oiler to call the bridge and report the fire. The junior engineer then looked for the watch engineer to inform him of the problem. According to the engineroom alarm log printout, at 1207:48, the “Port Main Engine overspeed [alarm] tripped,” signaling a loss of voltage to the overspeed protection device.4 Within 1 minute of the first alarm, the monitoring system computer recorded about 30 fault alarms on various systems, and all engineering systems lost electrical power. Meanwhile, the watch engineer was making an inspection round when he noticed the ship’s No. 2 auxiliary generator surging and moving erratically on its foundation. (See figure 4.) He stated that the generator “would go from a slower speed to a higher speed, and it was shaking and rattling.” He went to the control room to see if he could determine the cause of the erratic operation. On the way, he noticed that the lights were flickering. Upon opening the door to the control room, he “saw fire coming out of the first panel [unit] closest to the starboard door…heard a large [sic] popping sound”; he also saw what appeared to be the panels coming off the side of the breaker board. He closed the fire screen door to the control room and went to the auxiliary engineroom, where he shut down the ship’s No. 2 auxiliary generator and began to stage firefighting equipment at the starboard fire screen door of the control room. The off duty engineers were having lunch in the officers’ mess when the lights began to flicker shortly after 1200. The chief engineer stated that he heard the ventilation fan motors slowing down and the diesel emergency generator start. While the other engineers headed for the engineroom to investigate the reason for the flickering lights, the first assistant engineer went to the emergency generator room, which was on the same deck as the officers’ mess, to make sure that the emergency generator was running. Assured that it was, the first assistant engineer went to the engineroom to join the others. When the day third assistant engineer5 arrived in the engineroom, the oiler told him about the fire in the control room. The engineroom had no manual fire alarm or pull station; the only telephone in the area that could be used to call the bridge was in the control room and was inaccessible because of the fire. As a result, the day third engineer 3 The switchboard manufacturer refers to the sections of the switchboard as units. During Safety Board interviews, the crew referred to the units as panels. Also, the crew used a different numbering system than the manufacturer. For example, unit 12, as indicated on the manufacturer’s drawings, was called panel 1 by the crew. This report uses the manufacturer’s designations. 4 The engineroom automation system controls and monitors various engineering systems. When an abnormal condition occurs within a monitored system, an audible and visual alarm activates, and the time, channel identification, and alarm point condition are printed on a paper alarm log and stored in the computer’s memory. 5 The day third assistant engineer worked in the daytime only, performing maintenance work throughout the ship, and did not stand an engineering watch. For the remainder of this report, he will be referred to as the day third engineer.

Factual Information 5 Marine Accident Report had to climb up one deck to leave the engineroom and walk about 100 feet to call the bridge from a telephone located in the vehicle stowage area on the main deck. When the chief engineer arrived in the engineroom, he met the watch engineer, who had already staged several CO2 fire extinguishers near the starboard fire screen door of the control room and was stretching out the discharge hose for the semi-portable CO2 fire extinguisher in the auxiliary machinery room. The chief engineer noticed that the ship’s No. 1 auxiliary generator was operating erratically and sounded as if it were being overloaded. After feeling the fire screen door on the starboard side of the control room for heat, he opened the door and saw heavy black smoke, but no fire. He immediately closed the fire screen door and directed his and his crew’s attention to checking the engineroom, starting the fire pump, and securing the fuel oil and lube oil centrifuges and the fuel oil isolation valves. Activities on Bridge The chief mate and the master were in the chief mate’s office, working on the computer, when they saw the lights dim. They immediately ran to the bridge. Arriving in the wheelhouse at 1207, the master assumed command from the pilot on duty. Multiple alarms were sounding on the bridge. The ship had lost propulsion and regular lighting and was beginning to drift. Shortly after arriving in the wheelhouse, the chief mate got a call from the day third engineer, informing him of the fire and requesting that the fire team respond to the scene. After the chief mate relayed this information to the master, around 1208, the master ordered the chief mate to sound the general alarm and to announce an emergency to the passengers and crew. Between 1208 and 1212, the chief mate sounded the alarm and made announcements informing the passengers and crew of the fire. He instructed the passengers to muster on the upper decks and ordered the emergency squad6

Figure 4. One of the three auxiliary diesel generators. 6 The squad consisted of 15 members of the deck department and 2 members of the engineering department, all of which were under the command of the chief mate.

Factual Information 6 Marine Accident Report to muster in its designated staging area,7 which was on the starboard side of the main deck near the main access door to the engineroom. Immediately after these announcements were made, the public address system became inoperative. Around 1212, the chief mate, who was responsible for supervising shipboard firefighting activities, went to muster with the emergency squad. At 1216, the master requested assistance from another AMHS ferry, the Taku, on VHF channel 11. The master had seen the Taku earlier in the day and knew that it was in the area. Meanwhile, the emergency diesel generator started, providing emergency lighting and giving the bridge steering control of the ship. When the master realized that the starboard propeller was indicating astern pitch and that both engines were slowing, he ordered the engines stopped and the rudder midships. Fire and Rescue Response Shipboard effort. Shortly after the fire began, the ship’s emergency squad members donned personal protective equipment and brought fire extinguishers to the designated staging area. Because a car was parked in the squad’s muster area, the squad was forced to assemble around the car. Shortly after his arrival at the muster location, the chief mate sent an able seaman (AB) to the engineroom to assess the situation. The first assistant engineer stated that he did not want the emergency squad to enter the control room to fight the fire; he believed that the engineers were better able to do so because of their familiarity with the control room. As a result, the first assistant engineer asked the AB to leave the engineroom. Recognizing that the engineers were more familiar with the control room, the chief mate decided to let them fight the fire. The engineers did not don any protective clothing but they did obtain self-contained breathing apparatuses (SCBAs)8 from the emergency squad. The emergency squad remained in the staging area and provided support as needed by changing SCBA air bottles as they became expended. The chief engineer became concerned that the diesel emergency generator was continuing to feed electrical power to the main switchboard via the emergency switchboard; so he sent the day third engineer into the control room to open the bus tie circuit breaker between the main switchboard and the emergency switchboard. Entering the control room, the day third engineer stayed as low as possible to avoid the smoke that was accumulating near the overhead. After he had advanced about 15 feet into the room, he found that the room was so dark that he could not see the light of his own flashlight even when he aimed it at his facemask. He did not see any flames. He became concerned about his safety, withdrew from the control room, and requested that a lifeline be attached to him. 7 The staging area was in the vehicle stowage area and was an area on the deck that was outlined in yellow. 8 SCBAs are protective breathing equipment that protects the face and lungs from toxic gases and high temperatures. The air supply in an open-circuit SCBA is compressed air.

Factual Information 7 Marine Accident Report At this time, the first assistant engineer donned an SCBA and joined the efforts of the day third engineer to enter the control room. Before the men entered the room, the chief engineer expressed a new concern that the ship’s No. 1 auxiliary generator might still be powering the main switchboard. The chief engineer directed the two engineers to enter the control room and open the bus tie circuit breaker from the emergency switchboard as well as the circuit breakers connected to the ship’s auxiliary generators. The two engineers entered the space through the starboard fire screen door on their hands and knees. The watch engineer stated that when he reached out to open the bus tie circuit breaker, a blue electric arc knocked his hand back. The first assistant engineer then reached over the day third engineer and opened the breaker by hitting it with a flashlight. The first engineer successfully opened another breaker with the flashlight, but, according to his own account, when he attempted to open a third breaker, there was a “really big spark.” At that point, the two engineers backed out of the room. They discussed the situation with the chief engineer, who then manually shut down the ship’s No. 1 auxiliary generator. The engineers attacked the fire with hand-held portable CO2 fire extinguishers. They also unreeled a hose from a semiportable 100-pound CO2 extinguisher in the adjacent auxiliary generator room and stretched the hose to the control room. During this time, the chief mate kept the bridge informed of the firefighting activities. The master stated that the chief mate had difficulty getting frequent and accurate updates because when the engineers “surfaced for air, they were gasping and sweating and couldn’t get time to get a report before they slapped on another bottle and ran back down there.” Around 1220, the engineers informed the chief mate that the fire was out. He passed the information on to the master. At 1225, the chief mate received permission from the master to ventilate the ship. At 1227, as a result of the fire being declared extinguished, the chief engineer, the day third engineer, and the first assistant engineer left the engineroom. Between 1225 and 1231, the chief mate opened the vehicle stowage area doors to allow natural ventilation to clear the smoke from the vessel. Around 1240, the chief engineer reported a reflash of the fire in the main switchboard. The master ordered the crew to close all ventilation dampers and all fire screen doors. He also ordered the closing of all watertight doors, with the exception of door No. 3, which was kept open to permit the passage of the hose from the semiportable CO2 extinguisher in the auxiliary engineroom. The master shut off all fuel to the main and auxiliary engines by remote control. Because most of the SCBA air bottles on the ship had been used during the initial firefighting operations, the Columbia obtained additional air bottles and SCBA units from the Taku. Because a Coast Guard firefighting team from the cutter Anacapa, which had been operating nearby and had come to the assistance of the Columbia, was expected to board the Columbia at any time, the chief engineer instructed the ship’s personnel to pull out of the engineroom and prepare to reenter with the Coast Guard team when it arrived.

Factual Information 8 Marine Accident Report Coast Guard. At 1216, the Coast Guard cutter Anacapa overheard the Columbia’s master requesting assistance from the Taku on VHF channel 11. The Anacapa notified the search and rescue (SAR) controller at the Coast Guard District 17 Rescue Coordination Center in Juneau, who had also overheard the conversation. At this time, the Anacapa was about 4 miles from the Columbia. On orders from the SAR controller, the Anacapa proceeded toward the Columbia and arrived on scene at 1230, whereupon a four- man firefighting team was dispatched in a small boat to board the Columbia. At 1257, the Coast Guard team boarded the Columbia and met with the Columbia’s chief mate. He showed the Coast Guard personnel the location of fire extinguishers and went with the Coast Guard firefighters to the control room. On orders from the Anacapa’s commanding officer, the senior Coast Guard firefighter evaluated the situation to determine whether it was safe to enter the control room. He asked the chief mate whether the Columbia’s firefighting team would assist, and the chief mate responded that the team would remain in the vehicle stowage area to help as needed. The senior Coast Guard firefighter stated that he assessed the space, opened the control room’s escape hatch to vent the smoke, and stood by the control room door to oversee operations while two Coast Guard firefighters entered the control room with CO2 extinguishers. The Coast Guard firefighters donned oxygen breathing apparatuses before entering the control room.9 A Coast Guard firefighter asked the chief mate whether all electrical power had been shut off to the control room. The chief mate did not know whether all of the power had been shut off, but one of the Columbia engineers said that it had. Upon entering the control room, around 1323, the Coast Guard firefighters noticed that some of the control console lights were lit, indicating that the space had not been completely electrically isolated. To remove all possible sources of voltage from control room equipment other than the main switchboard (power to the main switchboard had already been isolated), the chief engineer ordered the emergency generator secured about 1358. Two Coast Guard firefighters then reentered the control room and, with the assistance of the engineers, removed the switchboard panels while the other two Coast Guard firefighters stood near the door, providing backup. The Coast Guard firefighters continued to fight the fire until it was extinguished about 1425. Because the Columbia’s engineers were not wearing proper protective gear, the Coast Guard firefighters asked them to stay out of the control room until the fire was extinguished. The engineers complied, except for briefly entering the area to help the Coast Guard firefighters remove the switchboard panels. The senior Coast Guard firefighter said that he could have used more help and would have asked the engineers to assist if they had been wearing personal protective equipment. The assistance provided by the Anacapa was only a part of the Coast Guard’s response to the fire. Shortly after dispatching the Anacapa, the SAR controller notified the 9 Oxygen breathing apparatuses are closed-circuit devices that use a chemical canister to purify recirculated air.

Factual Information 9 Marine Accident Report Coast Guard Marine Safety Office (MSO) in Juneau of the situation. Over the next 4 hours, a Coast Guard helicopter made repeated trips to the scene, dropping off two firefighters from Sitka to provide medical assistance and a response team consisting of an MSO investigator, an MSO inspector, a State of Alaska fire training specialist, and an AMHS engineer. The helicopter also transported three passengers to Bartlett Memorial Hospital. (For more detailed information, see “Medical Findings.”) Taku and Tugs. Shortly after the fire began, the Columbia’s master radioed a ferry that he had seen earlier, the Taku, to stand by for assistance. About 1400, the Taku’s master positioned his vessel alongside the Columbia’s port side in preparation to take on the passengers of the disabled ferry. The crews of the two vessels rigged a makeshift gangway of aluminum staging and 4-foot by 8-foot plywood sheets between the ferries, about 8 feet above the water. The lifejacket-clad passengers then walked over the gangway from the Columbia to the Taku while the Taku’s chief mate stood by in a rescue boat in case a passenger fell into the water. Six crewmembers from the Columbia also transferred to the Taku to assist with the Columbia’s passengers. After completing the passenger transfer at 1523, the Taku towed the Columbia away from Admiralty Island so that the ferry would not be in danger of drifting aground. About 1630, the tugs Banner and Ardie arrived on scene and took the Columbia in tow. Shortly thereafter, the Banner began towing the Columbia to Auke Bay Terminal, escorted by the tug Ardie and the Anacapa. At 1640, the Taku departed the scene with its own passengers and crew, as well as 434 passengers, 1 stowaway, and 6 crewmembers from the Columbia, and 2 Coast Guard medical corpsmen from the Anacapa. Early the next morning, the tug Chahoenta relieved the Ardie and assisted in docking the Columbia. AMHS Command Center. An emergency response team was established at the command center of the Alaskan Department of Transportation building in Juneau. The AMHS emergency response team consisted of the general manager, a safety officer, and the vessel operations manager, as well as the port captain, the assistant port captain, and the senior port engineer. The team conferred with the master throughout the emergency and participated in decision making, such as determining how to transfer passengers. Injuries Table 1 is based on the International Civil Aviation Organization’s injury criteria, which the Safety Board uses in accident reports for all transportation modes. Additional information about the injuries sustained by passengers appears under “Medical and Pathological.”

Factual Information 10 Marine Accident Report Table 1. Injuries Sustained in the Columbia Accident Damages According to the AMHS, the cost of repairing the ship was about $2 million. Crew Information The Columbia’s crew consisted of 63 individuals, each of whom was properly licensed or certificated by the Coast Guard to serve in his/her position. All of the officers had completed the International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers 95 (STCW) basic safety training, which included instruction on personal survival techniques, fire prevention, firefighting, first aid, personal safety, and social responsibility. Coast Guard Firefighting Requirements for Vessel Crews Since 1986, most applicants for an original license10 or for a raise in grade of an existing U.S. license have been required to complete a firefighting course that has been approved by the Commandant of the Coast Guard.11 The training must be completed on a one-time-only basis; no recurrent training is required for the original or upgraded license. Type of Injurya a. 49 Code of Federal Regulations 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was receive; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second or third degree burns, or any burn affecting more than 5 percent of the body surface.” Passengers Crew Total Fatal 0 0 0 Serious 1b b. The passenger had chest pains associated with a preexisting condition. His condition might have been aggravated by the events surrounding the fire emergency. 0 1 Minor 0 0 0 None 434 63 497 Total 435c c. A stowaway onboard was added to the total number of paid passengers. Two of the passengers received medication for preexisting illnesses and were released from the hospital. 63 498 10 Master’s license for service on vessels of 200 gross tons or less in ocean service, all master or mate’s licenses for over 200 gross tons; all licenses for master or mate (pilot), except apprentice mate (steersman), for towing vessels on oceans; all licenses on mobile offshore drilling units; and all engineers’ licenses. 11 This course must meet both the basic and advanced sections of International Maritime Organization Resolution A.437(XI) Training of Crews in Fire Fighting.

Factual Information 11 Marine Accident Report Emergency Training and Drills The engineers and other licensed officers had taken formal firefighting training. According to the AMHS, weekly firefighting drills were held for all crewmembers who had firefighting responsibilities. These drills simulated fires in various locations of the ship. According to the AMHS, a fire drill in the engineroom had not been held within the last 2 years before the fire. The AMHS also required that crewmembers read the handbook “Fire Safety—There’s No Second Chance” and take a 20-question quiz on its contents. Because the Columbia was in domestic service, it was not required to comply with the basic safety standards, including firefighting, contained in the STCW. Even though the Columbia did not have to comply with these standards, the AMHS decided to apply them to all of its vessels because it had to apply them to its five vessels that were operated in international waters. Although the AMHS decided, before the fire, to require STCW basic safety training for all of its vessels, by the time of the fire, the agency had implemented basic safety training only for licensed crewmembers; it had not had the opportunity to implement it for its unlicensed crewmembers. Vessel Information The Columbia was one of nine passenger/car ferries owned by the State of Alaska Department of Transportation and Public Facilities and operated by the AMHS. The ferry was built in 1974 at Lockheed Shipbuilding, Seattle, Washington, at a cost of $22 million. The vessel was allowed to carry up to 931 passengers and 134 vehicles during the summer season (May 15 through October 15). The Columbia usually did not operate during the rest of the year, when tourism decreased. When the ferry operated during the off-season, it was limited to 527 passengers. The vessel had 91 staterooms. The Columbia’s principal characteristics follow: Length 418.0 feet Beam 85.1 feet Depth 24.0 feet Draft 17.4 feet (summer) Gross tons 3,946 Displacement tons 7,745 Horsepower 12,340 The Columbia was built of all-welded-steel construction, in accordance with the rules of the American Bureau of Shipping (ABS), a classification society. The ABS had

Factual Information 12 Marine Accident Report given the Columbia the highest rating for hull and machinery. The vessel had been maintained in class ever since it was built. The Columbia also met Federal regulations (46 CFR Parts 70-89) for domestic passenger vessels. The Coast Guard completed an annual inspection of the Columbia in May 2000. The inspection included an examination of the hull, machinery, and safety and lifesaving equipment. The inspection did not include an examination of the main switchboard, therefore the problems incidental to this accident would not have been detected. A Coast Guard Certificate of Inspection was issued to the Columbia on May 22, 2000, upon departing the Alaska Ship and Drydock, Ketchikan, Alaska. The certificate of inspection was issued with no major deficiencies and was valid for 1 year after the date of issuance. The Columbia’s Coast Guard Certificate of Inspection stated that the “route permitted and condition of operation” is lakes, bays, and sounds—the sheltered waters of the west coast of North America as defined in 46 CFR 42.03-35, not international waters. Its operating route included Bellingham, Washington, to Ketchikan, Wrangell, Petersburg, Juneau, Sitka, Haines, and Skagway, Alaska. As the Columbia was certified for the domestic coastwise trade, the vessel was exempt from the International Convention for Safety Of Life At Sea (SOLAS) 1974 and its protocol, the STCW. The Columbia had seven decks, four of which were passenger decks containing cabins, lounges, a children’s play area, and exercise facilities. Two enclosed decks were used for roll-on/roll-off vehicular stowage. The bridge, with an enclosed pilothouse, was at the forward end of the vessel on the uppermost deck. The Columbia had two 16-cylinder diesel main engines, one for each shaft, driving a variable pitch propeller. The ship’s three auxiliary generators supplied all electrical power for the vessel. An emergency generator, located on the cabin deck, supplied backup electric power for vital loads. The main switchboard, located in the control room, consisted of 12 units. (See figure 5.) The starboard-most unit was identified as unit 12 and consisted of three rows of circuit breakers. Each row had four circuit breaker locations. Of the 12 locations, only 10 had circuit breakers. Units 8 and 10 of the main switchboard each had two rows of circuit breaker locations. Units 8 and 10 had 8 circuit breakers installed. Units 9 and 11 were ventilation spaces and had no circuit breakers. The three main generator circuit breakers were in units 2, 3, and 4. The vessel had two 450-volt alternating current dead front12 switchboards—a main switchboard and an emergency switchboard. The main switchboard was in the control room, and the emergency switchboard was in the emergency diesel generator room on the cabin deck. The location of the equipment on the switchboard was such that all components requiring monitoring, adjusting, or manual setting could be operated from the 12 A type of electrical construction, usually a switchboard or panel board, where energized parts are not exposed to a person on the operating side of the equipment.

Factual Information 13 Marine Accident Report front of the switchboard without opening the hinged panels. All other components were mounted within the switchboard. The main switchboard contained the devices for the control and protection of the ship’s three auxiliary generators. The main switchboard and the emergency switchboard were interconnected with an automatic bus tie circuit breaker. During normal operation, the emergency switchboard was supplied with electrical power from the main switchboard through the automatic bus tie circuit breaker, and the emergency diesel generator was in standby. Upon loss of voltage at the main switchboard, the automatic bus tie circuit breaker opened, the emergency diesel generator started, and the emergency diesel generator circuit breaker closed, thus supplying electrical power to the emergency switchboard. The Federal Pacific Electric Company of New Jersey had manufactured the main and emergency switchboards, including the breakers installed on the switchboards. The company is no longer in business. The fire alarm system consisted of 20 manual pull stations distributed throughout the vessel and one smoke detector in the paint locker. Each station and detector activated audible and visual alarms on the supervisory panel in the wheelhouse. Heat detectors were distributed throughout the ship, covering public spaces, galleys, lockers and storerooms. The phone system consisted of four independent sound-powered systems;13 the phone stations were installed in the main operating and crew spaces. The four systems were designated as 1JV (six stations for vessel maneuvering, including one in the control room and one on the bridge), 2JV (six stations for senior engineering officers’ quarters and engineering spaces), 3JV (15 stations for senior officers’ quarters and other spaces), and 4JV (nine stations for the chief steward’s quarters and for public spaces), for a total of 36 stations. Figure 5. Outline view of main switchboard showing arrangement of units 3 through 12. 13 A sound-powered telephone system is one in which the operating power is derived from the speech input only. The four systems on the Columbia were independent in the sense that the stations in one circuit could not communicate with the stations in another circuit. For example, the stations in the 1JV circuit could not talk with the stations in the 3JV circuit. Generator Breaker Generator Breaker Generator Breaker Generator 1 Generator 1 Generator 1 P442 P456 P412 Ventilation Fans Ventilation Fans Spare Breakers Breakers Breakers Breakers Breakers JHU/APL HBL, III 8/26/00 3 4 5 6 7 8 9 10 11 12

Factual Information 14 Marine Accident Report AMHS Maintenance Policy According to the AMHS’s ship operations manual, the engineering department on each vessel in its fleet was required to develop a maintenance program for its equipment and to retain maintenance records. While a vessel’s maintenance program was often discussed with the port engineer and modified according to the engineer’s recommendations, each vessel’s engineering department was responsible for determining the nature and timing of its maintenance activities, including those that focused on the main and emergency switchboards. Maintenance tasks were coordinated with the ABS and the Coast Guard through periodic inspections and tests of the equipment and systems. The manufacturer’s technical manual for the Columbia’s main switchboard recommends that operators “physically check the tightness of all electrical connections and parts” and “ascertain that no tools or extraneous materials are adrift” and that operators do so either annually or during shipyard overhaul, whichever occurred first. According to the chief engineer, the Columbia’s crew had not done any maintenance or repair work within the main switchboard or the ship’s auxiliary generators before the accident. The AMHS management had reduced the size of the vessel crew during the lay- up period, leaving the chief engineer with limited crew resources to perform such work. The chief engineer did not know when the main switchboard had last been inspected or cleaned, but he thought it was in 1995 (there were no machinery history records). He was also unsure of when the switchboard had last been checked for loose connections. He added that immediately before the accident, the Columbia had not had any operational difficulties with the switchboard. The chief engineer stated that the vessel’s maintenance program included an infrared thermographic inspection to identify existing or potential problems in electrical circuitry, such as poor physical contact, overload, or load imbalances. Once a year, a contractor boarded the vessel and inspected the distribution panels and motor controllers. A review of the last inspection report showed that the inspection did not cover the main switchboard or its bus bars.14 On this point, the chief engineer said: No, they typically don’t do the main switchboard, due to the fact that, when they do their survey, we’re usually underway and it’s too hard.…we open up the panels down there that are on hinges and that he can get to and can look at, but that’s mainly just the gauges and stuff; it’s not the main switchboard itself. The main switchboard was mounted against the forward bulkhead of the control room and, consequently, did not have access covers on its rear side. Therefore, infrared thermographic imaging of the rear side of the bus bars was not possible. Neither Coast Guard regulations nor ABS rules require that switchboards be accessible from the rear if they are fully serviceable from the front side. 14 A bus bar is a solid aluminum or copper alloy bar that carries current to the branch or feeder devices in a power panel board or switchboard. There is at least one bus bar for each phase of the incoming electrical service.

Factual Information 15 Marine Accident Report Prior Shipyard Work on Main Switchboard Before the accident, Alaska Ship and Drydock electrical workers had worked on the main switchboard during the winter lay-up period. The installation of rescue boats required modifying the main switchboard so it could supply electrical power to the electric motors and controls on the boat winches. The Coast Guard approved the modifications to the ship’s electrical drawings,15 and a Coast Guard inspector visually examined the completed work to ensure the modifications complied with the drawings and found the work satisfactory. Shipyard electricians entered the main switchboard enclosure16 on three separate occasions to complete the work. A shipyard electrical foreman supervised the work done in the switchboard. After the first time that shipyard electricians worked on the switchboard, the AMHS port engineer overseeing the project looked into the energized switchboard to verify whether the connections to the new breaker had been properly made. Following the subsequent two times that electricians worked on the switchboard, no representatives of the AMHS or crewmembers of the Columbia inspected the work while it was in progress or when it was completed. Waterway Information The Columbia’s usual route to Sitka began at the AMHS terminal at Auke Bay, northwest of Juneau, and proceeded through Stephen’s Passage, Saginaw Channel, and then south following Chatham Strait to Peril Strait, then through Neva Strait, Olga Strait and Sitka Sound to the AMHS Sitka terminal. The trip typically took 8 1/2 hours. The accident occurred less than 3 hours into the trip, when the ship was abeam of North Passage Point in Chatham Strait. The width of the strait is about 8 nautical miles. Meteorology Information At the time of the accident, the weather was as follows: winds–light airs; seas–1 foot; visibility–0.5 nautical miles in fog and light rain. At 1200 on June 6, the height of the tide was approximately 0 feet and the tidal current was approximately 1 knot in an east- southeast direction at North Passage Point at the entrance to Freshwater Bay. At 1245, when the Taku arrived on scene, the observed weather was wind from the southeast at less than 5 knots, calm seas, cloudy skies, and visibility about 10 miles. 15 Coast Guard letter dated March 13, 2000, Serial: E2-0000682. 16 A constructed case to protect personnel against contact with the enclosed equipment and to protect the enclosed equipment against environmental conditions.

Factual Information 16 Marine Accident Report Medical And Pathological Medical Findings The Coast Guard transported three passengers to shore in Juneau, where they were taken to Bartlett Memorial Hospital. One passenger, an 80-year old man, had chest pains associated with a preexisting illness, was admitted to the hospital on June 6, and released on June 9. The other two passengers, a 73-year-old woman and a 45-year-old woman, had left medications on the Columbia that needed to be replaced; the women, however, did not suffer any injuries as a result of the fire. Toxicological Testing On June 6, while the Columbia was being towed to Juneau, 13 Columbia crewmembers who were identified as essential personnel were tested for drugs and alcohol between 1800 and 2000, or within 6 hours of the fire. Table 2 shows the results of the tests performed on the members of the on-watch control room and the bridge watch. Table 2. Postaccident Drug and Alcohol Testing Results of Columbia Crewmembers. POSITION LOCATION/DUTY ALCOHOL TESTED (BREATH) DRUG TESTED (URINE) RESULTS (All Tests) Master Bridge X X Negative Chief Mate Fire Team Lead X X Negative Third Mate Bridge Watch X Negative Pilot Bridge Watch X X Negative AB Fire Response X Negative AB Helm X Negative Chief Purser Pass. Evacuation X Negative Chief Engineer Fire Response X X Negative l/A Engineer Fire Response X X Negative 3/A Engineer Fire Response X Negative 3/A Engineer Engine Watch X Negative Junior Engineer Engine Control Room - Watch X X Negative Oiler Engine Control Room - Watch X X Negative

Factual Information 17 Marine Accident Report Wreckage Damage to the Columbia was limited to the control room. A thin film of soot covered nearly all the surfaces within the room, and a video monitor used for surveillance was partially melted, as was a plastic light diffuser on one of the fluorescent light fixtures above unit 10 of the main switchboard. The main switchboard itself suffered the most serious and extensive damage. Most of the damage occurred in units 9, 10, 11, and 12 (all closest to the starboard end of the switchboard). (See figure 6.) Units 1 through 8 did not exhibit any evidence of electrical arcing and had minimal fire damage other than the sooting mentioned above. Units 9 and 11 Each unit was separated by a void. Each void was designated by a number. The space between unit 10 and unit 12 was void and was designated unit 11. Similarly, the space between unit 10 and unit 8 was void and was designated unit 9. The surface of the framing for unit 11 was heavily damaged. Its paint was blistered to a powdery consistency in places, and paint around the vent in the unit’s cover was burned away. The remaining paint on the cover of unit 11 was discolored and powdery in consistency. Unit 9 exhibited less damage, with some burned and soot-covered paint on the framing and the cover, and limited paint blistering around the vent in the unit’s cover. Figure 6. Units 8, 9, 10, 11, and 12 of the main switchboard. The Safety Board investigator is examining unit 12.

Factual Information 18 Marine Accident Report Unit 12 The interior side of the unit was covered with soot, heavy at the top and moderate toward the bottom. (See figure 7.) The top two-thirds of the interior had burned and blistered paint on the framing and the sides. In addition, there was a 9-inch-high by 4-inch-wide spot of localized heating, where the paint was missing. (See figure 8.) On the exterior right side of the unit, a spot of localized heating measured 6 inches by 6 inches, and the paint was white and powdery. The feed and load wires for the entire unit were intact, with only heat damage to the insulation. The insulation on the wires that went to the lower row of breakers was sooted and showed no evidence of heat damage. The unit’s cover was burned and paint was missing in places on the interior. The exterior of the cover had no significant damage. At the top of the unit was an indicator board with 39 lights. Each of the lights was serviced by 110-volt wires. All of the light bulbs were melted out of the panel. The insulation on the wires was melted and charred, but the wires were otherwise intact. The wires showed no evidence of arcing. Unit 12 was made up of three rows of breakers. The top row had three breakers and one blank. The left and center breakers were tripped but otherwise intact. The right breaker was pulled down during the firefighting effort but was otherwise intact. The bus bars and bus bar supports in the top row were also intact. Figure 7. Unit 12. Photograph courtesy of the AMHS.

Factual Information 19 Marine Accident Report The middle row had four breakers. The bus bar connectors were melted except for the bottom left stab-loc connector for the far left breaker. The wire insulation for the relay of that breaker was melted, but the wires were intact and not damaged. The insulated bus bar supports toward the front of the panel were delaminated, but the ones in the back were intact. The support was fractured on the right side. The bottom row had a blank in the far left breaker position. The breakers, bus bars, and supports were intact. Investigators found a 3/8-inch diameter by 1 1/4-inch long steel bolt with an oversized flat washer and a lock washer lying on an angle support bracket on the lower portion of the unit. Arcing, melting, or spatter marks were present on the bolt and on both washers, and the bolt and washers appeared to have melted together. The deck below unit 12 was swept and then vacuumed to collect small pieces of debris. Among the items found were two pieces of plastic wiring banding material. None of the collected material exhibited evidence of heat or fire damage. The investigators did not find any discernable foreign objects in the debris. Figure 8. Closeup of heat damage to unit 12. Photograph courtesy of the U.S. Coast Guard.

Factual Information 20 Marine Accident Report Unit 10 The top two-thirds of the unit framing was burned and heavily sooted; the paint was missing. (See figure 9.) The lower third was sooted but otherwise undamaged. The compartment above the unit was warped. At the top of the unit was a light indicator board with 40 lights, each of which was serviced by 110-volt wires. All of the light bulbs were melted out of the panel. The insulation on the wires was melted, but the wires were intact. There was no evidence of arcing on the wires. There was a 34-inch long by 3.5-inch wide hole in the 1/8-inch steel plate that separated this area from the breaker area of the unit. (See figure 10.) The edges were smooth. Investigators found no evidence of material drip-down on the components below. The steel was discolored from tan to gray in some areas and to black in others. The unit was made up of two rows of breakers. The top row had four breakers. Four tulip-clip connectors were intact—three on the left and one fourth from the right. The rest of the bus bars were melted; both bus bar supports were delaminated in the front, and the breakers were not intact. (See figure 11.) The wires servicing this row were intact, but heat had heavily damaged the insulation.17 Figure 9. Unit 10. Photograph courtesy of the U.S. Coast Guard. 17 The bus bar ended in a male tulip connector. It was through these connectors that the circuit breakers were attached. There were six tulip connectors for every circuit breaker.

Factual Information 21 Marine Accident Report

Figure 10. Closeup of hole in steel plate in unit 10. Photograph courtesy of the U.S. Coast Guard. Figure 11. Damage to bus bars in unit 10.

Factual Information 22 Marine Accident Report The bottom row had four breakers. The three bus bar connectors on the top were all melted except for one. All the bottom connectors were intact. The top edge of the bus bar was melted down to half its width in places. Insulated bus bar supports were delaminated toward the front of the panel but were intact in the back. The wires servicing this row had damaged insulation but were otherwise intact. The deck underneath unit 10 was swept and then vacuumed to collect small pieces of debris. Several pieces of wiring banding material were found. The investigators did not find any discernable foreign objects in the debris. Survival Factors Muster/Evacuation The chief purser was in charge of mustering passengers. The Columbia had three muster stations—the forward lounge, the snack bar, and the dining room, all located on the boat deck. The emergency squad was directed to muster at the emergency locker in the vehicle stowage area, one level above the engineroom, to obtain firefighting equipment. The chief steward directed the stewards to search passenger staterooms and put towels on the doorknobs or at the bottom of the doors to indicate that the staterooms had been searched. The chief steward then briefed the chief purser on the status of the search. According to the master, after 1210, he tried to use the public address system on the bridge; but, to his surprise, it did not work. Because he could not use either the main or the emergency public address system, he relied on hand-held VHF radio units to communicate directly with his crew. He used one VHF channel to communicate with the chief mate who was in charge of fire operations. He used another channel to coordinate the evacuation efforts, directing the pilot to relay information to and from the chief purser, the chief steward, and the second steward, all of whom were managing the muster and evacuation of the passengers. The master stated that using separate channels for radio communication was a new procedure, and it worked well. Through the use of the VHF units, the master was also able to send messages through his staff to the passengers. To help ensure that passengers were kept informed, various crewmembers walked around relaying instructions in loud voices; no loud hailer or similar equipment was available. The chief steward said that some passengers complained about not being able to hear and some passengers were confused about what to do. Other passengers were calm. The muster was completed at 1222, after which the crew distributed lifejackets to the passengers. The Columbia’s master coordinated the transfer of passengers and crew with the Taku’s master, the Anacapa’s captain, the Coast Guard SAR controller, and the AMHS’s general manager. The master of the Columbia obtained permission on his cellular telephone from the AMHS’s general manger to bring the Taku alongside his vessel for the transfer. The master allowed the passengers to go to their staterooms and vehicles to obtain personal belongings and then instructed them to don their lifejackets and proceed to the transfer point via the forward stairwell. The passenger transfer began at 1419 and was

Factual Information 23 Marine Accident Report completed by 1523. Crewmembers were positioned along the stairwell and on the Taku to assist the passengers. Passenger Questionnaires The Safety Board mailed 327 questionnaires to passengers who, according to company records, were on board the Columbia at the time of the accident. Eighty-one passengers responded. Overall, passengers said that the evacuation and transfer to the Taku went well. Fifty-three passengers stated that they heard the announcement describing what to do in an emergency. Twenty-four stated that they did not hear the safety announcement; some commented that they boarded late and did not recall whether such an announcement was made. The majority of the respondents noticed the placards posted throughout the vessel providing safety information. Fifty-two passengers stated that the vessel’s crewmembers gave directions during the emergency and were well trained, helpful, professional, easily identified, and responsive to questions. Forty-two smelled an odor in the dining room and on different decks that seemed to be electrical in nature (like burning rubber or wires). Passengers obtained lifejackets from their staterooms, the crewmembers, or the storage bins. Forty- three passengers stated that they had difficulty hearing announcements once the public address system became inoperable, despite the crew’s efforts to provide information verbally as they walked through the ship. Lifesaving Equipment The Columbia had enough lifeboats and inflatable rafts to accommodate all of the people on board, 1,054 adult-size lifejackets, 98 child-size lifejackets, 12 ring buoys, and an emergency position indicating radio beacon. Firefighting Equipment The Columbia had fire hoses, fire axes, fire pumps, and a wide range of firefighting apparatus, including fixed extinguishing systems in the main engineroom, the auxiliary engineroom, the emergency generator room, the paint locker, the cafeteria, the vehicle stowage area, and the dining salon. More than 60 portable and semiportable fire extinguishers were located throughout the ferry. According to an AMHS general manager, at the time of the fire, the vessel carried seven firemen’s outfits, each consisting of pants, a coat, boots, gloves, a helmet, and an SCBA. Firefighting Procedures According to the Columbia’s muster list, which indicated the assignments for crewmembers during emergencies, the emergency squad was designated to fight fires on board the vessel. Shipboard references contained no procedures for fighting an electrical fire in the control room or how the emergency squad and the engineers should coordinate their firefighting efforts.

Factual Information 24 Marine Accident Report Emergency Procedures According to the Columbia’s muster list, the master had overall command of the evacuation. The chief purser was in charge of the upper deck evacuation, the chief steward was in charge of the boat deck evacuation, and the second steward was in charge of the cabin deck evacuation. All three of these individuals were responsible for coordinating the muster and evacuation of passengers and crew and reporting to the master. Placards that provided safety information on emergency signals and lifejacket locations were posted throughout the ship and in each stateroom. Signs with arrows posted throughout the passenger decks identified the most direct routes to the liferafts. After passengers boarded the Columbia, they were told over the public address system what to do in an emergency. The briefing covered locating and donning lifejackets, the safety announcements that would be provided over the public address system, and the emergency signal for mustering passengers and crew. Coast Guard Firefighting Policy The Coast Guard’s Marine Safety Manual18 stipulates the actions of the agency in preventing marine casualties and incidents. Volume VI, Chapter 8, “Coast Guard Fire Fighting Activities,” states the following, under Policy: Although the Coast Guard clearly has an interest in fires involving vessels or waterfront facilities, local authorities are principally responsible for maintaining the necessary fire fighting capabilities within U.S. ports and harbors. Additionally, a vessel/facility’s owner and/or operator is ultimately responsible for the overall safety of vessels/facilities under their control, including ensuring adequate fire fighting protection. Chapter 8, under Restrictions, states: Generally, Coast Guard personnel shall not directly engage in fire fighting activities on other than Coast Guard units except when necessary to save a life or when possible to avert a significant threat with minimal risk to Coast Guard personnel. In fighting fires on vessels other than its own, the Coast Guard usually limits itself activities to certain activities, including the following: conducting preliminary assessments of the incident, evaluating the magnitude of the threat, developing a response plan, monitoring response actions, contacting the owner, providing assistance as available, and giving any necessary first aid. Passenger and Crew Accountability Based on the advanced reservations made by passengers and the number of tickets purchased before the departure from Juneau, the total number of paid passengers on board the Columbia at the time of the fire was known. To verify that all of the passengers were 18 Commandant Instruction M16000.11.

Factual Information 25 Marine Accident Report accounted for, an Alaska State trooper who happened to be on board worked with the chief purser and second mate to account for passengers during the transfer to the Taku. The State trooper took the names of the passengers as they left the Columbia, and the second mate had a counter to help confirm the numbers. The number of passengers listed on the manifest did not match the number of passengers counted during the transfer. The manifest listed 434 passengers, but the actual count was 435. It was at this point that it became known that the vessel had a stowaway. The master provided an accurate count of the transfer to the Coast Guard, 435 passengers and 6 crewmembers. Tests And Research Johns Hopkins University-Applied Physics Laboratory Report The Safety Board contracted an expert on arcing faults19 in marine switchboards to assist in the investigation. The contractor was an employee of the Johns Hopkins University-Applied Physics Laboratory and had been contracted to investigate a number of U.S. Navy switchboard fires while under contract to the U.S. Navy. The contractor, with the assistance of party representatives, thoroughly examined the switchboard and all of its components. During the investigation a steel bolt was found in unit 12 that was fused to two washers (mentioned earlier in the section on fire damage). (See figure 12.) In his report, dated July 27, 2000, the contractor concluded that the most likely origin of the fire was in the vicinity of the port steering gear breaker in switchboard unit

1. The report also concluded that the most likely cause of the fire was either a faulty

connection of the switchboard bus bars or the loose bolt found during the examination of the switchboard. Because of the bolt’s location, its appearance and other factors, the contractor concluded that that the bolt was probably the initiator of the arcing fault that spread through the two sections of the switchboard. 19 A high impedance connection, such as an arc through air or across insulation, between two conductors.

Factual Information 26 Marine Accident Report Safety Board Materials Laboratory Testing Report The Safety Board’s Office of Research and Engineering Materials Laboratory tested the bolt found within the switchboard to determine the nature of the deposits on the bolt and the manner in which the two washers had bonded to the bolt. In addition, technicians tested two other bolts as controls. The first control bolt had been removed from the bus connection to a main switchboard breaker. This bolt was nearly intact and identical in size and washer arrangement to the loose bolt found in the switchboard. The second control bolt was similar in design to the bolts from the switchboard. Before testing the second control bolt, technicians intentionally arced it by placing it across two copper bus bar conductors and subjecting it to 240 volts direct current. During metallurgical tests, the three bolts and their washers were sectioned longitudinally and polished. The cross-sections were examined using optical microscopy

Figure 12. Bolt found on front (aft side) framework of switchboard.

Factual Information 27 Marine Accident Report and scanning electron microscopy. The cross-sections of the subject bolt and washers were also examined using energy dispersive x-ray spectroscopy. Technicians determined that the material creating the bond between the subject bolt and the washer was copper. The profiles of the bolt and washers at the points of contact were not deformed by melting. In contrast, the intentionally arced bolt was fused to the washer at the junction between them, and no copper material was found within the fused area. Other Information Infrared Thermographic Inspection Infrared thermographic inspection of electrical equipment can be used to detect electrical overloads and poor electrical connections. It has gained increasing acceptance as a valuable tool in the preventive maintenance of electrical equipment and is used by a number of vessel owners as part of the condition-based preventive maintenance program. The Coast Guard has used infrared thermography as part of its Reliability Centered Maintenance program aboard its newest ice-breaking cutter, the Healy. The use of infrared thermograpy was discussed in a paper published in the Society of Naval Architects and Marine Engineers journal Marine Technology.20 In a 1999 Merchant Note Guidance, the United Kingdom’s Coast Guard advised ship owners, masters, and ships officers: In order to identify potential overheating situations in electrical equipment, owners are advised to consider the use of thermal-imaging techniques as a means of verifying the security of electrical connections and pinpoint problem areas at an early stage.21 Emergency Team Muster Location The emergency squad muster location was a deck space painted yellow in the vehicle stowage area; however, during the fire, a car was parked in the space, and the fire team had to assemble around the car. Since the accident, the space has been designated a fire lane, and cars are no longer allowed to park there. Similar areas on other AMHS vessels have also been designated as fire lanes. Public Address System As a result of the accident, the AMHS purchased portable battery-powered public address systems for all of its vessels as backups for the installed public address systems. 20 US Coast Guard, C Healy (WAGB 20), “A Case Study for Implementing Reliability Centered Maintenance.” Marine Technology, Vol. 37, No. 1, January 2000, pp. 50-56. 21 Maritime and Coast Guard Agency Merchant Guidance Note 132 (M+F), December 1999.

Factual Information 28 Marine Accident Report Survey of Equipment At the Safety Board’s request, the Columbia’s engineering staff made a survey of all motor controllers and voltage transformers. The crewmembers found no problems that could be related to the switchboard fire. Equipment Repair and Upgrading of Columbia Systems The damage to the main switchboard was such that the vessel could not be operated without extensive and lengthy repairs. The owner removed the vessel from service. During the lay-up period, repairs to the switchboard and modifications to other systems were made by a shipyard facility in Ketchikan. The vessel returned to service in July 2001. Work performed during the shipyard repair period included the following: • Replacing the switchboard, including repairing or replacing load cables within the switchboard; • Installing a new dial phone system (existing sound-powered system is to remain on board); • Replacing the public address system (According to an AMHS letter, as part of the already scheduled $l0 million+ Federally funded modernization project, the ship is getting an entirely new state-of-the-art, SOLAS-conforming public address and telephone system); and • Inspecting the electrical system. In June 2000, the AMHS issued Engineering Policy 034, which reads, in part: Due to the recent switchboard fire onboard the Columbia, all vessels are directed to include switchboard maintenance in their maintenance planning systems….As a fleet policy, cleaning and tightening fastenings of main and emergency switchboard should be done during the overhaul period at least every other year. On alternate years, all the electrical distribution boards should be maintained by cleaning and tightening fastenings. This maintenance work will normally be done by the crew. In an April 5, 2001, letter to the Safety Board, the AMHS stated that it is installing a computer maintenance planning system, which will present the maintenance planning tasks in a uniform method throughout the fleet. With this program, the AMHS will have the ability to monitor the maintenance efforts of the engineering department on board all ships. As of the date of this report, the system has not been implemented and the AMHS could not provide an accurate timetable for implementation.

29 Marine Accident Report Analysis General This analysis first identifies factors that can be readily eliminated as causal or contributory to the fire and determines how the fire started. The report then discusses the following major safety issues, which were identified during the investigation: • Adequacy of inspection and maintenance procedures for electrical systems; • Adequacy of management safety oversight of maintenance procedures; and • Adequacy of firefighting procedures. Exclusions The weather was mild and the seas were calm throughout the fire emergency and did not affect the emergency response. The officers and crew were properly licensed and certified by the Coast Guard and were fully qualified to serve in their respective positions. Postaccident drug and alcohol screening was done in a timely manner, given the circumstances, and the results were uniformly negative. Consequently, the Safety Board concludes that the conditions of the weather and the sea, the qualifications of the officers and crewmembers, and the use of drugs or alcohol were not factors in this accident. Cause and Origin of Fire In its investigation of the accident, the Safety Board considered whether a fault in one of the three areas of the electrical system (the load section, the distribution section, and the generation section) could have caused the fire. Because the damage to the switchboard was extensive, it is possible that important evidence might have been consumed or altered as a result of the fire or the firefighting efforts. Nevertheless, the Safety Board’s investigation of the electrical system provided important information that the Board used to assess the probable cause of the fire. The investigation considered five scenarios that focused on the main switchboard and its protective devices, the auxiliary generators and their controls, and the electrical system equipment powered by the main switchboard. The hypothetical situations or conditions presented in the first three scenarios probably did not cause the fire; these situations are, therefore, discounted. The conditions in the last two scenarios are the most likely causes of the fire.

Analysis 30 Marine Accident Report System Load Components According to the first scenario, a malfunction occurred in one of the system load components. Such electrical system components include voltage transformers, motors or their controllers, and interconnecting wiring. A malfunction, such as a short circuit, in a connected component might have caused an increase in current flow that, in turn, might have resulted in temperatures high enough to damage the copper conductors or their insulation. An arc fault could have then developed and spread throughout the two switchboard units that were damaged in the fire. The physical evidence does not support this scenario. After the accident, an examination of all motor controllers and transformers did not find any abnormal conditions that were related to the fire. Had there been a fault, evidence of its occurrence would have been visible. Such evidence could include visibly burned or melted insulation on wires, burned contacts in motor controllers, or damaged windings in electric motors. In addition, an excessively high current in any of the load cables connected to the output side of the breakers in the main switchboard would have discolored the copper conductors in the affected cable. An inspection of those cables revealed no discoloration. The Safety Board concludes that the fire was probably not caused by a fault in an electrical system component that was powered by the main switchboard. Failure of Main Switchboard Breakers According to the second scenario, a failure occurred in one of the main switchboard’s breakers. For example, a breakdown in the electrical insulation between the electrical phases of the breaker might have initiated an arcing fault that could have spread to other areas of the switchboard bus bars. The physical evidence collected does not support this scenario. According to the vessel’s chief engineer, most of the breakers had been installed at the time of the vessel’s construction (1974) and had been largely trouble free. He stated that the breakers had been inspected periodically; however, the vessel operator did not maintain complete records of the work performed on the main switchboard breakers. The Safety Board, therefore, has no way of verifying the accuracy of the chief engineer’s statement. Furthermore, because the manufacturer of the switchboard and the breakers is no longer in business, the Safety Board could not obtain the manufacturer’s information on product reliability. Nevertheless, an inspection of the exterior and interior of all of the breakers in the main switchboard did not reveal any evidence of electrical arcing. The Safety Board concludes that the fire was probably not caused by a breaker fault. Abnormal Condition in Electrical Generation System According to the third scenario, an abnormal condition in the electrical system on the main switchboard’s input side resulted in extremely high voltage or current. This could be caused, for example, by a malfunction of a generator or one of its control devices—the governor (speed controller), a load sharing device, or the voltage regulator. At the time of the accident, two generators were operating in parallel. If the voltage regulator on one of the generators malfunctioned, the generator might have become unstable or have reached an abnormal level of excitation, possibly resulting in an abnormally high voltage output

Analysis 31 Marine Accident Report from the generator or, if the compensation circuit was inoperative, an abnormal reactive current flow (cross currents) between the two generators. The development of high cross currents, however, would have required the simultaneous failure of at least two control devices (the voltage regulator or the governor and the compensation circuit), which is unlikely. In addition, because one of the generators became unstable first and the second generator became unstable only after the first was shutdown, an abnormal condition in the voltage regulators or governors probably was not responsible. If the voltage regulator or the governor controlling one of the generators had failed, the corresponding control device on the other generator would have acted in the opposite direction to maintain system voltage or frequency at a set point. Moreover, because a fuse protected the voltage regulator’s current output to the exciter, only a limited level of excitation could occur. Consequently, the generator probably could not have developed the extremely high voltage needed to cause a current to arc through the air between adjacent phases (a spark jumping the gap).22 Even without a fuse, a transient voltage spike of sufficient magnitude to create an arc that could jump the gap probably could not have been created. The generator’s maximum output level was only slightly above 450 volts, and an output level in excess of 10,000 volts would be required to create an arc that could jump the gap. Finally, if a high voltage condition had developed in the electrical system on the input side of the switchboard, electrical equipment breakdowns would have occurred in vessel areas away from the main switchboard. However, a postfire examination of the Columbia’s electrical equipment found no such breakdowns. The damage was limited to the main switchboard. The Safety Board concludes that the fire was probably not caused by an abnormal condition on the input side of the electrical system. Electrical Connection in Switchboard According to the fourth scenario, a faulty electrical connection within the main switchboard initiated an arc fault that grew and spread throughout two units of the main switchboard. Such a faulty connection could have resulted from a loose or corroded joint within the bus bars or circuit breaker tulip clips. A faulty electrical connection might have generated a high level of resistance that would have impeded current flow, causing the temperature to rise to the conductor’s melting point. As the conductor melts, physical separation occurs within the conductor of one phase. At the moment of separation, an arc will develop, in a manner similar to the arc that occurs when a switch is opened while current is flowing in a circuit. If current flow is high enough, a plasma cloud23 that develops as a result of the arc can expand to create a conductive path to an adjacent conductor of a different phase. The arc then becomes a phase-to-phase high impedance short circuit because the conductive path between the two phases is the plasma cloud, which has significant resistance. As the plasma cloud expands further, it can envelop other adjacent conductors, which can then become involved in the event. 22 This voltage level, known as the dielectric breakdown strength of air, is empirically known and can be theoretically calculated using Paschen’s Law. 23 A plasma cloud is a collection of ionized atoms exhibiting some properties of a gas but differing from a gas in being a good conductor of electricity and in being affected by a magnetic field. A plasma cloud is the conductive medium through which an arc’s electron flow occurs.

Analysis 32 Marine Accident Report During postaccident examination, Safety Board investigators did not find any loose or faulty connections within the switchboard. However, an electrical arc, such as the type described above, probably would have destroyed the conductors in a faulty connection. The examination revealed that the connections in the Columbia’s switchboard were badly melted, precluding Safety Board investigators from identifying whether faulty connections existed before the fire. Despite the lack of conclusive evidence, the Safety Board is of the opinion that a faulty connection or connections likely caused the fire for several reasons. That mechanical vibrations and thermal cycling gradually loosen electrical connections is well known. However, investigators found no evidence that the integrity of the switchboard’s electrical connections had been inspected during the last 5 years, despite the switchboard manufacturer’s recommendation that an inspection be done, at a minimum, every year or during vessel overhauls. In addition, although vessel crewmembers had used an infrared thermographic inspection program to detect faulty electrical connections, they had never used the program to inspect the switchboard’s internal electrical connections. Therefore, a faulty connection within the switchboard could have developed and remained undetected for a considerable period of time. Before the accident, during a shipyard overhaul, the Columbia’s main switchboard was modified to support the installation of new rescue boats. The work required that shipyard workers open the switchboard to add electrical connections and, in the process, disturb the connections that were already in place. The AMHS representative did not supervise this work or inspect it upon its completion. In addition, the ship’s crew did not check the integrity of the electrical connections, either manually or thermographically. The modification work, therefore, could have created a faulty connection that would not have been detected by the owner’s representative or the vessel’s crew. The Safety Board, therefore, concludes that the fire might have been caused by a faulty connection within the main switchboard that initiated an arc fault, which spread within the two switchboard units and damaged them. Conductive Object According to the fifth scenario, a conducting object caused a short circuit connection between two phases in the distribution section of the electrical system. Any conductive object, such as a metal tool or a bolt, as well as a conductive liquid, such as seawater, could have created a conductive path. The arc would have grown and spread in the same way as the arc described in the fourth scenario. The Safety Board materials laboratory performed metallurgical testing on the bolt found in unit 12 to evaluate whether it might have caused the arcing fault that swept through the switchboard. Of particular interest was how the washers were bonded to the bolt. If electrical current had passed through the bolt and washers, the high temperature would have fused them, much like welding, resulting in a layer of porous, molten steel between the component pieces. However, the metallurgical examination revealed that a layer of copper bonded the bolt and washers. The molten copper probably was deposited on the junction between the bolt and washer after the arc fault began and could have

Analysis 33 Marine Accident Report dripped down onto the bolt and washers from a unit that was higher in the switchboard. Safety Board technicians compared a bolt that they had intentionally arced to the bolt found in the switchboard. Although some external features of the two bolts appeared similar, the cross sections of the bolts differed. For the bolt found in the switchboard, the copper that accumulated in the threads and between the washers and the bolt had little porosity and appeared to be consistent with molten flow. The edges of the washer and the threads were intact where the copper had accumulated. In contrast, the beaded areas in the intentionally arced bolt were porous and composed of molten steel. Also, the edges of the washer and the bolt’s thread peaks were missing in locations where the molton material had accumulated, and there was an area of contact between the washer and the bolt. Because the damage to the subject bolt and washers was consistent with exposure to molten material, primarily copper, and did not appear consistent with arc damage, the Safety Board concludes that the bolt found in the switchboard was probably not the cause of the fire. Whether or not this particular bolt caused the fire does not eliminate the possibility that the fire might have been caused by a conductive object falling on the bus bars. Electricians possibly inadvertently left a metallic object inside the switchboard during the last shipyard overhaul. Such a mistake would not have been detected because the owner’s representative did not inspect the electricians’ work. It is also possible that a conductive object had been left in the switchboard during some previous work period and remained undetected. Despite the fact that the investigation did not discover any conductive objects in the switchboard that could be definitely identified as causing a short circuit, this scenario cannot be ruled out because the conductive object might have been destroyed or altered beyond recognition as a result of the arcing and/or fire. The Safety Board, therefore, concludes that the fire might have been caused by a conductive object falling onto the switchboard bus bars. Inspection and Maintenance Procedures For Electrical Systems Preventive Maintenance Plan Several preventive measures can be taken to discover or prevent faulty connections before they result in a fire. For example, faulty electrical connections in a switchboard often can be located and tightened during periodic maintenance inspections. A valuable addition to these inspections is the use of infrared thermographic imaging equipment that can uncover faulty connections that might not be visible to the naked eye. The Columbia’s main switchboard had not been inspected either manually or thermographically during the past 5 years. The chief engineer recognized the importance of inspecting and maintaining the switchboard, and placed the tasks on his annual winter lay-up worklist. Such tasks, however, were not given high priority and, therefore, were not completed. According to the chief engineer’s best recollection, the last switchboard inspection had been performed in 1995, but he was not certain whether it was done even then.

Analysis 34 Marine Accident Report Infrared thermographic inspection of electrical equipment is recognized as an important tool in locating improper connections and preventing switchboard fires. Infrared imaging of the Columbia’s switchboard could not be readily performed because its design arrangement prevented a full view of the electrical connections in the switchboard. Full views of the internal connections possibly could be obtained by installing access panels on the rear side of the switchboard. The Safety Board concludes that the use of suitably located access panels on the Columbia’s switchboards would facilitate infrared thermographic inspections and, therefore, help detect faulty electrical connections. After the accident, the AMHS issued an engineering policy letter directing the crews of all vessels in its fleet to clean and tighten the electrical connections in the main and emergency switchboards not less than every other year. The switchboard manufacturer had recommended that such cleaning and tightening be performed, at a minimum, every year or during vessel overhauls. The Safety Board recognizes that the manufacturer’s recommended inspection interval might be based on operating time and that the Columbia typically operates about 6 months a year. This means that it would take the ferry 2 calendar years to attain 1 year of operating time. During half of the year, however, the Columbia is taken out of service, which affords the AMHS ample time and opportunity to perform switchboard maintenance. The Safety Board, therefore, considers an annual examination consistent not only with the manufacturer’s recommended inspection interval but also the ferry’s operation. In spite of the manufacturer’s recommending an annual inspection, the AMHS had not cleaned or tightened the switchboard connections during the 5 years before this accident. Had the switchboard had faulty connections, they would have remained undetected until they became apparent through an equipment malfunction or fire. Thus, it is apparent that thorough and timely inspection of electrical switchboards is necessary for continued safe operations. The Safety Board concludes that had the main switchboard been subjected to thorough and timely inspections as part of an effective preventive maintenance program, any faulty connections or conductive objects would have likely been identified and corrected, and the fire might have been avoided. Therefore, the Safety Board believes that the AMHS should develop an annual switchboard inspection program that includes a thorough infrared thermographic inspection and physical examination of components. In addition, the AMHS is in the process of implementing a computer-based maintenance program that could address the problem of loose connections in the switchboards. In the Safety Board’s opinion, the maintenance of switchboards should be included in this computer-based program. The Safety Board, therefore, believes that the AMHS should include an annual switchboard inspection program in its computer-based maintenance planning system. Quality Assurance Program Quality assurance is the planned and systematic pattern of actions, including inspections, performed by the vessel owner to determine whether a contractor has fulfilled contract obligations pertaining to the quality and quantity of work.24 The AMHS included general quality assurance requirements in its agreements with contractors; the agency

Analysis 35 Marine Accident Report clarified the nature of the general requirements through individual specifications associated with each work item. Because the main switchboard is the central point for receiving and distributing all electrical power throughout a vessel, it is critical to the vessel’s operation. Therefore, any contract work on the switchboard should be subjected to quality assurance inspections. However, for unknown reasons, the AMHS did not include switchboard inspections in its contract with the shipyard. The AMHS had not required the shipyard to present the switchboard for inspection or required the vessel’s crew or the agency’s port engineering staff to inspect the work before the switchboard was returned to service. The shipyard’s electrical foreman stated that he inspected his subordinates’ work upon completion; however, he did not do so at the direction of the AMHS. The Safety Board concludes that a thorough inspection of the interior of the switchboard by the AMHS and the port engineering staff before it was returned to service might have detected the presence of faulty connections and/or foreign objects and led to their correction and/or removal. Consequently, the Safety Board believes that the AMHS should revise its procedures for accepting completed shipboard maintenance and repair performed by outside contractors to verify that the work has been done properly. Firefighting Procedures Actions of the Columbia’s Crew Upon discovering the fire, the on-scene engineers rapidly accounted for crewmembers in the engineroom and notified the master. They also obtained, staged, and used the CO2 extinguishers, secured the ventilation, and isolated the smoke and fire by closing the control room’s fire screen door. The Safety Board concludes that the initial response to the fire by the shipboard engineers was appropriate. However appropriate the engineers’ initial actions were in this accident, the Safety Board is concerned that the crew’s subsequent actions were somewhat haphazard and improvised as they went along. The crew’s actions did not reflect the type of performance that would be expected from properly planning, training, and drilling for a fire in the control room. The emergency response organizational structure for the Columbia was provided in the crew muster list, which showed each crewmember by position and identified his/her station and duty assignment during a fire or other emergency. Generally speaking, a muster list summarizes a crewmember’s duties and responsibilities in one line of text and is designed to provide officers and other crewmembers with a quick guide to the emergency duty assignments. A muster list does not go into any depth on individual roles and responsibilities or give details about policies, procedures, and plans for responding to shipboard fires. A prefire plan, on the other hand, provides such vital information; however, prefire plans are not required by regulation, and not all vessels have developed such plans. The Columbia had a prefire plan, but it was not comprehensive. The Columbia’s fire plan merely provided a brief description of the vessel’s firefighting resources and listed the locations of access doors and fire stations. The plan did not 24 Adapted from the quality assurance definition at 48 CFR 46.101, “Federal Acquisition Regulations.”

Analysis 36 Marine Accident Report describe the vessel’s firefighting organization or specify the crewmembers’ firefighting roles and responsibilities. Moreover, the plan did not describe in detail how to fight fires in specific parts of the vessel. A properly developed comprehensive prefire plan describes various fire scenarios in different spaces on the ship and how to fight the fire in each situation. The plan fully describes the roles and responsibilities of the emergency responders and establishes the chain of command for firefighting operations. Responsibility for strategic and tactical command is made clear and unambiguous for all foreseeable situations, including fires on the decks and in the engineroom. If necessary, separate and distinct organizations are created to respond to fires on deck and fires in the engineroom. In addition, the prefire plan contains checklists for emergency actions, procedures for shutting down the electrical power and closing the ventilation to the various ship areas, as well as instructions for establishing fire boundaries and for maintaining watertight integrity. With a prefire plan, predetermined actions for responding to a fire in a given space or compartment are developed in a nonurgent atmosphere, where one is more likely to exercise good judgment. Then, if a fire develops, the officers in charge can refer to the plan and take appropriate action. However, as noted by one authority,25 “The most comprehensive and well-designed prefire plans are of little value if they are not used for training and they are even less valuable if they are not used when a fire actually occurs.” The Columbia’s muster list designated the master as the person in charge from the bridge and the chief mate as the person in charge of the emergency squad on scene, but the list did not elaborate on their respective duties and responsibilities. The list indicated that the emergency squad consisted of unlicensed deck crewmembers on two hose teams and other unlicensed personnel providing backup and support. The list did not indicate that a separate emergency squad was to respond to engineroom fires or that engineroom personnel were assigned to hose teams. Further, the Columbia had not held a training drill featuring a response to an engineroom fire during the 2 years before the fire. The muster list designated the chief engineer to be “in charge” of the engineroom and to supervise the release of the CO2 system protecting the engineroom should such release be necessary. However, his role in responding to an engineroom fire was not spelled out in any detail. The other engineering officers were variously designated to tend bilge and fire pumps, operate sprinkler systems, and shut down ventilation systems, but were not listed as having any specific firefighting responsibility. The off-watch third assistant engineer and the off-watch junior engineer were the only engineering officers detailed to work with the emergency squad, and their roles were limited to bringing tools to the emergency locker. According to the muster list, the emergency squad, under the command of the chief mate, should have fought the Columbia’s fire. However, the emergency squad was made up mainly of deck department personnel who were unfamiliar with the engineroom and who had never participated in a fire training drill in the control room. The lack of lighting 25 Marine Fire Fighting, First Edition, International Fire Service Training Association, Copyright 2000 by the Board of Regents, Oklahoma State University, pp 261.

Analysis 37 Marine Accident Report and the presence of large quantities of black smoke, which reduced visibility in the control room to nearly zero, complicated their firefighting efforts. The engineers, on the other hand, were very familiar with the layout of the control room. They, logically, should have assumed the lead in fighting this fire. However, the lack of a comprehensive prefire plan detailing firefighting roles and responsibilities, coupled with the lack of a squad trained to fight engineroom fires, reduced the crew’s capability to fight the fire effectively. In response to the fire, the chief engineer sent the day third engineer without a lifeline into the control room to open the bus tie circuit breaker between the main switchboard and the emergency switchboard. Upon encountering difficult conditions, the day third engineer backed out in order to get a lifeline. He and the first assistant engineer then entered the control room to open the circuit breaker between the main and emergency switchboards and the circuit breakers between the ship’s auxiliary generators and the main switchboard. Both men wore SCBAs borrowed from the emergency squad, but neither wore protective clothing. In the Safety Board’s opinion, sending crewmembers who were not properly clothed in protective gear into an active fire scene needlessly exposed them to serious injury and demonstrated poor decisionmaking on the part of the chief engineer. The first assistant engineer opened two circuit breakers by hitting them with his flashlight, which was an imprudent action. Considering the electrical arcing activity and the fire in the switchboard, the poor visibility within the control room, and his choice of tool for the job, only happenstance prevented his being seriously injured. In the Safety Board’s opinion, the actions of the first assistant engineer indicated a lack of proper training in fighting a switchboard fire. After the first assistant opened a third circuit breaker, he and the day third engineer backed out of the control room, and the chief engineer decided to manually shut down the No. 1 auxiliary generator, which was still powering the switchboard. In the Safety Board’s view, manually shutting down the generator to remove electrical input to the switchboard was the course of action that should have been taken in the first place. Manually shutting down the generator is much safer than sending a person into a dark, smoke-filled room to open a bus tie circuit breaker. Once the engineers had notified the bridge of the fire and the general alarm had been sounded, a firefighting team that was trained in the techniques of combating an electrical fire should have led the response to the fire in the control room. Such a team probably would have extinguished the fire more quickly and with minimum risk. This accident demonstrates that, because engineers have the specialized knowledge and expertise needed to effectively fight engineroom fires, they should be an integral part of a vessel’s firefighting team. In the Safety Board’s opinion, if the Columbia had had a comprehensive prefire plan that included procedures for fighting a control room fire and if the crewmembers had been properly trained and drilled in the execution of the plan, they would have known exactly what to do from the outset. If the firefighting roles and responsibilities of the various crewmembers had been predetermined and drilled, the main switchboard would have been electrically isolated quickly and completely, and the engineers would not have

Analysis 38 Marine Accident Report been sent into the control room without proper gear. The danger to firefighters would, thereby, have been diminished; and the fire might well have been extinguished sooner. The Safety Board concludes that the ability of the Columbia’s crew to respond to the fire was less than adequate for the following reasons: the AMHS had not developed a comprehensive prefire plan that included procedures for fighting engineroom fires, and the AMHS, during the past 2 years, had not required that crewmembers train and drill for an engineroom fire. Therefore, the Safety Board believes that the AMHS should develop comprehensive prefire plans for the vessels in its fleet that include procedures for fighting an engineroom fire and require the ships’ crews to be thoroughly drilled in using the plans. Coast Guard Actions One of the primary reasons why the Columbia’s crewmembers were required to complete firefighting training and drills was so that they could control and extinguish an onboard fire in the absence of outside help. This ability is critical to all passenger ship crews because, when underway, such vessels might be too far from shore or other vessels to receive outside firefighting assistance. The Coast Guard cutter Anacapa just happened to be in the area and its crew not only rendered assistance, but also extinguished the reflash of the fire. The Coast Guard firefighters were well organized and well prepared. They were properly equipped with protective clothing and oxygen breathing apparatuses. Furthermore, they assessed the fire before entering the control room, planned how they would approach the fire, rotated fire teams to reduce each individual’s exposure and fatigue, and maintained two firefighters at the control room door to monitor the safety of those inside. Because the engineers were not properly outfitted with protective clothing and gear, the Coast Guard firefighters did not allow them to remain in the control room. The Safety Board concludes that the Coast Guard’s actions in responding to the fire were timely and effective. Firefighters’ Staging Area When firefighters assembled on the car deck, one deck above the engineroom, a car was parked in their staging area. Before this accident, the AMHS had not designated the space as a fire lane and had no policy precluding cars from parking in the space. After the accident, the AMHS designated the area as a fire lane and established a policy prohibiting cars from parking in the space. According to an AMHS representative, the problem of allowing cars to park in the emergency squad staging area existed on other AMHS vessels, but has since been rectified in the same manner. The Safety Board concludes that the actions taken by the AMHS after the fire to ensure that emergency squad muster areas were kept clear for use in an emergency were appropriate. Means of Communication in Engineroom When fire and smoke forced the oiler and junior engineer to evacuate the control room, they were unable to alert the bridge immediately because the only telephone in the engineroom was in the control room and no manual fire alarms were in the engineroom.

Analysis 39 Marine Accident Report Fortunately, the oiler and the junior engineer were able to escape from the engineroom. Subsequently, the day third engineer was able to call the bridge from the car deck. In the Safety Board’s opinion, having a single telephone with which to communicate from the engineroom to the bridge is inadequate to ensure communications during an emergency. Even though the telephone system on board the Columbia has since been upgraded, the main engineroom still has no means of communication outside of the control room. The Safety Board concludes that the means of contacting the bridge from the engineroom was less than adequate once the telephone in the control room became inaccessible. The Safety Board believes that the AMHS should install a means of alerting the bridge of an emergency from the Columbia’s engineroom in case the telephone in the control room is inaccessible. Passenger and Crew Muster Because the passengers were given a safety briefing after boarding the Columbia, they knew how to locate and don their lifejackets and how to report to their muster stations if the general alarm was sounded. Passengers were also provided with safety information on placards posted throughout the ship. The muster of passengers and crewmembers was performed in accordance with emergency procedures. Because the passengers were well briefed on the procedures, muster leaders were able to assemble the passengers in an orderly fashion. The master was in command of mustering operations, and the chief purser accounted for passengers and crewmembers in accordance with her responsibilities as indicated on the muster list. The chief steward carried out his duties by ensuring that the cabin stewards searched cabins. Because a separate radio frequency was used to muster the passengers and the crew, the master was able to relay information through the pilot to the chief purser and chief steward without interfering with firefighting operations. The Safety Board concludes that the passenger and crew muster was well coordinated. Passenger and Crew Communication The public address system became inoperable after the Columbia lost power, forcing crewmembers to provide information to the passengers by walking through the muster stations and speaking loudly. The crewmembers did not use any portable equipment to amplify their voices. In postaccident surveys, 43 passengers stated that they had had difficulty hearing the crewmembers’ announcements. Following this accident, the AMHS supplied all its vessels with portable battery-powered public address systems as backup for the main address system. Before the Columbia’s fire, the AMHS had scheduled the replacement of the older public address systems in its fleet as part of its SOLAS 2000 upgrade. After the accident, the older public address system on the Columbia was removed and replaced with a new system. The Safety Board is satisfied that this action will probably eliminate future public address problems during shipboard emergencies.

Analysis 40 Marine Accident Report Emergency Response An emergency response team led by the AMHS general manager assisted the Columbia’s master, the Taku’s master, and the Coast Guard’s SAR controller in developing a method of safely conducting and coordinating the transfer of passengers and crew from the Columbia to the Taku. The Columbia’s crewmembers constructed a ramp between the ships. Both sides of the ramp had safety lines, and passengers and crewmembers were required to don lifejackets before walking over the ramp. Crewmembers assisted passengers during the transfer. As an added safety precaution, the Taku’s chief mate stationed himself in a small boat beneath the ramp to be in a position to help if anyone fell into the water. The procedures worked well, as evidenced by the fact that all passengers and crewmembers were transferred quickly and without injury. The Safety Board concludes that the transfer of passengers between the Columbia and the Taku was executed in a timely and effective manner and was well coordinated with shoreside management.

41 Marine Accident Report Conclusions Findings

1. The conditions of the weather and the sea, the qualifications of the officers and

the crewmembers, and the use of drugs or alcohol were not factors in this accident.

1. The fire was probably not caused by a fault in an electrical system component

that was powered by the main switchboard.

1. The fire was probably not caused by a breaker fault.
2. The fire was probably not caused by an abnormal condition on the input side of

the electrical system.

1. The fire might have been caused by a faulty connection within the main

switchboard that initiated an arc fault, which spread within the two switchboard units and damaged them.

1. The bolt found in the switchboard was probably not the cause of the fire.
2. The fire might have been caused by a conductive object falling onto the

switchboard bus bars.

1. The use of suitably located access panels on the Columbia’s switchboards

would facilitate infrared thermographic inspections and, therefore, help detect faulty electrical connections.

1. Had the main switchboard been subjected to thorough and timely inspections

as part of an effective preventive maintenance program, any faulty connections or conductive objects would have likely been identified and corrected, and the fire might have been avoided.

1. A thorough inspection by the Alaska Marine Highway System and the port

engineering staff of the interior of the switchboard before it was returned to service might have detected the presence of faulty connections and/or foreign objects and led to their correction and/or removal.

1. The initial response to the fire by the shipboard engineers was appropriate.
2. The ability of the Columbia’s crew to respond to the fire was less than

adequate for the following reasons: the Alaska Marine Highway System (AMHS) had not developed a comprehensive prefire plan that included procedures for fighting engineroom fires, and the AMHS, during the past 2 years, had not required that crewmembers train and drill for an engineroom fire.

1. The Coast Guard’s actions in responding to the fire were timely and effective.

Conclusions 42 Marine Accident Report

1. The actions taken by the Alaska Marine Highway System after the fire to

ensure that emergency squad muster areas were kept clear for use in an emergency were appropriate.

1. The means of contacting the bridge from the engineroom was less than

adequate once the telephone in the control room became inaccessible.

1. The passenger and crew muster was well coordinated.
2. The transfer of passengers between the Columbia and the Taku was executed in

a timely and effective manner and was well coordinated with shoreside management. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on the Columbia was the absence of an effective maintenance and inspection program for the electrical switchboards, resulting in a switchboard fire by arcing, most likely due to a faulty connection or a conductive object.

43 Marine Accident Report Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following recommendations: To the Alaska Marine Highway System: Develop an annual switchboard inspection program that includes a thorough infrared thermographic inspection and physical examination of components. (M-01-19) Include an annual switchboard inspection program in your computer-based maintenance planning system. (M-01-20) Revise your procedures for accepting completed shipboard maintenance and repair work performed by outside contractors to verify that work has been done properly. (M-01-21) Develop comprehensive prefire plans for the vessels in your fleet that include procedures for fighting an engineroom fire and require the ships’ crews to be thoroughly drilled in using the plans. (M-01-22) Install a means of alerting the bridge of an emergency from the Columbia’s engineroom in case the telephone in the control room is inaccessible. (M-01-23) BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: September 18, 2001

45 Marine Accident Report Appendix A Investigation The National Transportation Safety Board was notified of this accident at 1245 on June 7, 2000, and launched a 9-person team that arrived in Juneau, Alaska, at 0700 on June 8. The investigative team consisted of an investigator-in-charge, an operational specialist, a marine engineer, a fire science specialist, a human performance specialist, a survival factors specialist, and a family affairs specialist. Also present were a public affairs specialist and an observer from the Office of General Counsel. The on-scene investigation was conducted between June 8 and 20, 2000. No Board Member participated in the on-scene phase of the investigation. Assisting the Board with the investigation were an investigator from the Anchorage Office of the Bureau of Alcohol, Tobacco and Firearms, a fire marshall from the Alaska Department of Public Safety, and a research engineer from Johns Hopkins University Applied Physics Laboratory who was under contract to the Board. The Safety Board investigated the accident under the authority of the Independent Safety Board Act of 1997 and according to Safety Board rules. The designated parties to the Safety Board’s on-scene investigation were the Coast Guard, the Alaska Department of Transportation and Facilities, the Alaska Department of Public Safety (Division of Fire Prevention), and the Alaska Ship and Drydock Company. The team viewed the damage on the Columbia and conducted over 30 interviews in Juneau and Ketchikan, Alaska. The witnesses included the management of the AMHS and the Alaska Ship and Drydock Company and the officers and crew of the Columbia, Taku, and Anacapa.

FD07226 ｜ 2000_美国_NTSB_MAR0202_Fire_on_Board_the_Small_Passenger_Vessel_Port_Imperial_Manha.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River New York City, New York November 17, 2000 NTSB/MAR-02/02 PB2002-916402 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

Marine Accident Report

Aircraft Accident Report NTSB/MAR-02/02 (PB2002-916402)

Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River, New York City, New York, November 17, 2000

• The title page has been corrected to indicate 7472 as the proper report notation number (16 Nov 2002)

• Pages 43 and 44 have been amended to include the recommendation numbers (16 Nov 2002)

THE CORRECTIONS BELOW ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT

Marine Accident Report Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River New York City, New York November 17, 2000 NTSB/MAR-02/02 PB2002-916402 National Transportation Safety Board Notation 7472 490 L’Enfant Plaza, S.W. Adopted June 11, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River, New York City, New York, November 17, 2000. Marine Accident Report NTSB/MAR-02/02. Washington, DC. Abstract: This report discusses the November 17, 2000, fire that occurred on the small passenger vessel Port Imperial Manhattan while it was underway in the Hudson River from Manhattan to Weehawken, New Jersey. None of 11 people on board the vessel was killed or sustained serious injury; however, a crewman and two passengers were transported to a shoreside hospital for medical evaluation. Damages related to the accident exceeded $1.2 million. From its investigation of this accident, the National Transportation Safety Board identified safety issues in the following areas: vessel maintenance, fire detection and suppression systems, crew response to the emergency, lifejacket stowage, safety information provided to passengers, and vessel communications. Based on its findings, the Safety Board made recommendations to the U.S. Coast Guard, the Federal Communications Commission, NY Waterway, and the Passenger Vessel Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Regulatory Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Deckhand No. 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Deckhand No. 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Basic Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Engineroom . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Electrical System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Lifesaving and Firefighting Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Radiotelephones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Vessel Certification and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 General Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Electrical Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Toxicology Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Emergency Actions of the Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Safety Placards and Briefings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Emergency Plans, Drills, and Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Federal Regulations Pertaining to Vessel Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . 21 Postaccident Actions by NY Waterway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Passenger Vessel Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Cause and Origin of the Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Vessel Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Contents iv Marine Accident Report Fire Detection and Suppression Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Fire Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Fire Suppression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Crew Response to the Emergency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Crew’s Firefighting Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Safety of Passengers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Lifejacket Stowage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Safety Information Provided to Passengers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Vessel Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 B: Navigation and Vessel Inspection Circular No. 1-91 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 C: History of Regulations for Small Passenger Vessels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

v Marine Accident Report Acronyms and Abbreviations AWG American wire gauge CFR Code of Federal Regulations COI Certificate of Inspection FCC Federal Communications Commission FDNY New York City Fire Department IMO International Maritime Organization NFPA National Fire Protection Association NVIC Navigation and Vessel Inspection Circular PVA Passenger Vessel Association OCMI Officer in Charge, Marine Inspection RBA rigid buoyant apparatus SIU Seafarers International Union STCW Standards of Training, Certification, and Watchkeeping for Seafarers

vi Marine Accident Report Executive Summary On the evening of November 17, 2000, the U.S. small passenger vessel Port Imperial Manhattan, with three crewmembers and eight passengers on board, was en route to Weehawken, New Jersey, from the borough of Manhattan in New York City, New York, when a fire broke out in the engine room. Crewmembers attempted to extinguish the fire with portable extinguishers, with no success. The fire burned out of control, causing the vessel to lose power and forcing the crew and passengers to abandon the interior spaces. The crew and passengers were rescued by another NY Waterway passenger vessel, and the burning vessel was towed to Manhattan, where the New York City Fire Department extinguished the fire. One passenger was treated for smoke inhalation. No deaths resulted from this accident. The estimated cost to repair the vessel was $1.2 million. The National Transportation Safety Board determines that the probable cause of the fire aboard the Port Imperial Manhattan was NY Waterway’s inadequate inspection and maintenance of the vessel’s electrical system. Contributing to the extent of the damage were the lack of a fixed fire detection and suppression system and the crewmembers’ lack of knowledge of proper marine firefighting techniques. Based on its investigation, the Safety Board identified safety issues in the following areas: • Vessel maintenance; • Fire detection and suppression systems; • Crew response to the emergency; • Lifejacket stowage; • Safety information provided to passengers; and • Vessel communications. As a result of its investigation of this accident, the Safety Board makes recommendations to the U.S. Coast Guard, the Federal Communications Commission, NY Waterway, and the Passenger Vessel Association.

1 Marine Accident Report Factual Information Accident Narrative About 14201 on November 17, 2000, a night shift crew comprising a master and two deckhands,2 relieved the day shift crew of the small passenger vessel Port Imperial Manhattan (figure 1), which was owned by NY Waterway, a company that operates a daily commuter service between the borough of Manhattan in New York City, New York, and Weehawken, New Jersey. The day shift master stated that he experienced no problems with the vessel during his shift.3 During their evening shift, the three crewmembers alternated making hourly visual inspections of the engine space to check the temperature of the engines and to determine the condition of the space. Deckhand No. 2 said that he performed the last inspection of the engine space about 1 hour before the Port Imperial Manhattan’s departure from the 38th Street Ferry Terminal, which was at 1855. In addition to the crew, eight passengers were on board the ferry. 1 All times in this report are eastern standard time and based on a 24-hour clock. 2 This report refers to the senior deckhand as deckhand No. 1 and the second deckhand as deckhand No. 2. 3 The Port Imperial Manhattan operated daily from 0700 to 2300. Each crew worked an 8-hour shift. Figure 1. The Port Imperial Manhattan, a commuter service vessel, was certificated by the U.S. Coast Guard (Coast Guard) pursuant to 46 Code of Federal Regulations (CFR) Subchapter T “Small Passenger Vessels (Under 100 Gross Tons).” Additional information about its construction appears later in this report, under “Vessel Information.”

Factual Information 2 Marine Accident Report After leaving the dock, the master decided to have dinner and turned over the conn to deckhand No. 1. The master remained in the pilothouse to eat and was facing aft when he observed smoke coming from the port ventilator to the engine space. (See figure 2a.) About the same time, deckhand No. 1 told the master that the throttle felt as if it was not responding. The master sent the deckhand to the engine space to investigate and radioed another NY Waterway ferry to stand by until the cause of the smoke could be identified. Immediately following this radio transmission, the Port Imperial Manhattan lost propulsive power and steering control, and the vessel’s VHF radio lost power. The deckhands proceeded to the engineroom entry door located aft in the main passenger cabin. (See figure 2b.) The deckhands stated that they opened the aluminum door without first using their hands to feel for heat inside the space.4 Both deckhands stated that they received an electrical shock while holding the door open and were unable to enter the space because heavy smoke filled the engine compartment. They observed flames between the rungs of the ladder leading down into the engineroom. The deckhands said that they did not immediately inform the master about the fire. Rather, they decided to try and extinguish the fire. They propped open the access door with two lifejackets. Deckhand No. 1 said that he retrieved a CO2 fire extinguisher that was stowed on the stern and discharged its contents into the engineroom compartment. Deckhand No. 2 said that when he recognized the severity of the fire, he went to the pilothouse and told the master about the engineroom fire and that the deckhands had tried to control it, with no success. Deckhand No. 2 then offered to shut off the fuel supply valve in the main passenger cabin. The master agreed that the fuel supply should be shut off and dispatched the deckhand to do so. After shutting the fuel valve, deckhand No. 2 returned to the engineroom door to assist deckhand No. 1. Meanwhile, after he had completely discharged the CO2 extinguisher into the engineroom, deckhand No. 1 ordered the passengers to evacuate the main cabin, which was becoming increasingly filled with smoke, and to proceed to the foredeck. He did not distribute lifejackets to the passengers. During postaccident interviews, passengers stated that they did not consider the fire to be life threatening at the time. Deckhand No. 1 then went to the pilothouse to inform the master of the situation while deckhand No. 2 went to the main cabin to get another fire extinguisher. In the pilothouse, the master instructed deckhand No. 1 to use a cellular telephone to call the company’s managers to notify them of the fire on board the vessel. The shoreside managers, in turn, called 911 to report the fire. The company’s operations manager also diverted the company vessel George Washington to assist at the scene. Meanwhile, the 911 operator had transferred the emergency call to the FDNY, which dispatched a fireboat to the location. 4 According to standard firefighting protocols, firefighters should not enter a suspected fire area that is hidden behind a bulkhead or compartment door without first feeling the bulkhead or door with their hands to check for heat that would indicate the presence of a fire. See, for example, International Fire Service Training Association, Marine Fire Fighting (Stillwater, Oklahoma: Fire Protection Publications, Oklahoma State University, 2000) p. 242.

Factual Information 3 Marine Accident Report Figure 2. The master was looking aft from the pilothouse when he saw smoke issuing from the engineroom ventilator on the port side of the vessel. Figure 2b. At the master’s direction, the deckhands went to check the engineroom, which was accessed through a door in the after area of the main passenger cabin. Rigid Bouyant Apparatuses Figure 2a.

Factual Information 4 Marine Accident Report The master then went to the main cabin and saw that it was filled with heavy smoke. He returned to the pilothouse and sounded the vessel’s horn repeatedly to signal other vessels in the area that the Port Imperial Manhattan was in distress. He returned aft to the engineroom entry door, where he saw deckhand No. 2 discharging a fire extinguisher into the space. The master grabbed several lifejackets from the stowage locker and took them to the passengers on the foredeck. Deckhand No. 2 then lashed opened the stern door to let the smoke out of the main cabin. The master then returned to the engineroom door and told the deckhand to go to the bow. The stern door and the engineroom door were left open. While the crew was trying to put out the fire, the passengers had gathered on the open foredeck. They discussed the severity of the fire and what actions they should take, including whether they needed lifejackets. Some passengers used their cellular telephones to call 911. One passenger later testified that he thought that the passengers and crew might have to abandon the vessel and jump into the Hudson River. He, therefore, returned to the main cabin to retrieve lifejackets because he did not want to be in the river without one. When he returned to the foredeck, he handed out lifejackets to the other passengers, who later testified that they had also had fears about having to abandon ship. Shortly thereafter, the lights in the main cabin went out. When the master and deckhand No. 2 reached the foredeck, the latter observed that some passengers had donned lifejackets. He noticed that two passengers were having difficulty donning their lifejackets. One passenger had been given a child-size lifejacket, so deckhand No. 2 gave the passenger his work vest. Deckhand No. 2 said that, by this time, the fire had spread to the main cabin and crewmembers could not return to the main cabin to retrieve additional lifejackets. The master told the deckhands to prepare to launch the rigid buoyant apparatuses (RBAs), 5 which were stowed on top of the pilothouse. A passenger helped the deckhands lower two of the seven RBAs down to the foredeck, and the deckhands prepared the abandon ship ladder so that it would be ready for use if needed. About this time, an explosion occurred, and the main passenger cabin became engulfed in flames. According to witnesses, a passenger had to be restrained from jumping into the river. About this time, the FDNY fireboat arrived to offload passengers from the Port Imperial Manhattan. When the fireboat master observed that the deck of the fireboat was significantly higher than the deck of the Port Imperial Manhattan and realized that the passengers could not easily board, he backed his vessel away. The NY Waterway ferry George Washington, which was similar in size to the Port Imperial Manhattan, then approached the vessel and maneuvered so that it was bow to bow with the Port Imperial Manhattan. The passengers and crewmembers from the Port Imperial Manhattan were then able to step directly onto the George Washington. The flames then engulfed the foredeck where they had been standing. 5 An RBA is a flotation device with a peripheral line that survivors in the water can hold onto. A photograph of an RBA appears later in this report, under “Firefighting and Lifesaving Equipment.”

Factual Information 5 Marine Accident Report According to the master, the fire spread throughout the entire vessel within 15 minutes of his noticing the smoke issuing from the port ventilator. The passengers later told Safety Board investigators that the fire engulfed the foredeck of the Port Imperial Manhattan within 30 seconds of their stepping onto the George Washington. The fireboat pushed the Port Imperial Manhattan alongside pier 42, where FDNY assets extinguished the fire. After Coast Guard inspectors verified the structural integrity of the Port Imperial Manhattan, a NY Waterway ferry towed it to the Weehawken terminal, where it was safely moored. The George Washington took the Port Imperial Manhattan’s passengers and crewmembers to the Port Imperial terminal in New Jersey, where emergency responders and two ambulances were waiting. Six passengers declined medical treatment. The Port Imperial Manhattan’s three crewmembers and two of the passengers were taken to Palisades General Hospital in Weehawken, New Jersey, where one crewmember and two passengers were examined for injuries and released. The hospital then obtained samples from the three crewmembers for toxicological testing. Table 1 summarizes the timeline of events in this accident. Table 1. Timeline in the Port Imperial Manhattan accident. Time Event 0700–1420 Day shift crew conducts commuter runs every 15 minutes during rush hour and tours thereafter. The Port Imperial Manhattan operates normally during day shift. 1420 Night shift crew (master and two deckhands) relieves day shift crew. 1455–1755 (approximate) Crewmembers alternate making hourly visual inspections of the engine space. 1855 The Port Imperial Manhattan departs the 38th Street Ferry Terminal with 8 passengers. +/- 3 min. Master observes smoke issuing from port ventilator to the engineroom. 1900 Crew notifies NY Waterway’s shoreside office of fire. 1906 Passenger calls 911. 1907 FDNY dispatches rescue boat Marine 1 to the scene. 1914 Passengers are safely evacuated to the George Washington. +/- 30 seconds The Port Imperial Manhattan is engulfed by flames. 1945 Marine 1 pushes the Port Imperial Manhattan to pier 42, where FDNY firefighters extinguish the fire.

Factual Information 6 Marine Accident Report Injuries Safety Board reports of marine accidents use the injury criteria contained in 49 CFR 830.2. None of the people on board the Port Imperial Manhattan sustained an injury meeting the criteria for fatal or serious injuries. At Palisades General Hospital, one deckhand was treated for muscle pain and released. Hospital personnel evaluated the two passengers, treated one person for smoke inhalation, and then released both. Damages The vessel suffered fire damage in the engineroom and in the main cabin. The estimated repair cost was $1.2 million. Additional information about the damage appears in the “Wreckage” section of this report. Personnel Information Regulatory Requirements Small passenger vessels6 carrying more than 6 passengers for hire may not be operated without a valid Coast Guard Certificate of Inspection (COI), which is issued by the Coast Guard Officer in Charge, Marine Inspection (OCMI) for the zone. The COI stipulates a number of operating requirements, including minimum staffing needs. When determining the number and competencies of the crewmembers, the OCMI considers, among other things, the size of the vessel, its route, the type and horsepower of the vessel’s propulsion machinery, the number of passengers the vessel will carry, the type and location of lifesaving equipment installed on the vessel, and the hazards peculiar to the route and service. According to its COI, the Port Imperial Manhattan was required to carry the following crew complement based upon the number of passengers as indicated in table 2. 6 For the purpose of this report, small passenger vessels refer to vessels under 100 gross tons regardless of whether they operate under 46 CFR Subchapter T or 46 CFR Subchapter K. Table 2. Required Crew Complement for the Port Imperial Manhattan Number of Passengers Required Crew* 1–149 One master, two deckhands 150–299 One master, one licensed mate, one deckhand 300–350 One master, one licensed mate, two deckhands *The licensed mate can be substituted with a senior deckhand, designated in writing by the master and qualified in accordance with policy contained in Coast Guard Navigation and Vessel Inspection Circular (NVIC) 1-91, “Recommended Qualifications for Small Passenger Vessel Deckhands.”

Factual Information 7 Marine Accident Report Master The master, age 30, had been in the marine industry since 1994. In June 1999, he had received a Coast Guard license as “Master Near Coastal Steam Or Motor Vessels Of Not More Than 100 Gross Tons.” He had worked for NY Waterway since January 2000, first as a deckhand and then, beginning in May 2000, as master on various vessels and routes. From June 30, 2000, until the night of the accident, he had served as master on the Port Imperial Manhattan. The master stated that on the two evenings before the accident, he had gone to bed between 11 and 12 p.m. and had obtained about 8 hours of sleep each night. He said that, on the day of the accident, he had arisen at 9 a.m. and was well rested. Deckhand No. 1 Deckhand No. 1, age 20, had worked for NY Waterway about 19 months, since graduating from high school. He did not hold and was not required to hold any Coast Guard documents. (See discussion under “Training.”) He had worked various shifts on company boats and had worked on the Port Imperial Manhattan on previous occasions. He had switched to the night shift on the Port Imperial Manhattan during the week of the accident. Deckhand No. 2 Deckhand No. 2, age 27, had worked for NY Waterway about 18 months. He did not hold and was not required to hold, any Coast Guard documents. All of his marine experience had been on NY Waterway vessels. He had served on the Port Imperial Manhattan for 1 week before the accident. The routine duties performed by a deckhand on a small passenger vessel include general housekeeping, basic vessel maintenance, handling mooring lines, collecting tickets, and directing passengers on and off the vessel. When permitted by the OCMI, deckhands can also serve as concessionaires or waitpersons. Training Regulatory Requirements. To be certified as a master of a small passenger vessel, individuals must serve for at least 1 year on the type of vessel for which they are seeking licensure and must take a license examination. The topics for license examinations are available from the Coast Guard and are published in trade books. To pass a licensing test, individuals must demonstrate that they are conversant in a number of topics, including, but not limited to, piloting, shiphandling, watchkeeping, first aid, fire prevention and firefighting appliances, and emergency procedures. After passing the test, masters are not required to take recurrent training or to be tested on knowledge of the subject matter except as participants in drills conducted by the Coast Guard as part of its annual inspections. For information about Coast Guard inspections, see “Vessel Certification and Inspection.”

Factual Information 8 Marine Accident Report The CFR does not require deckhands on small passenger vessels to hold Coast Guard licenses or documents or to possess formal qualifications for their positions. Regarding emergency duties such as firefighting, abandoning ship, and rescuing people in the water, CFR 185.420 stipulates the following, in part: The owner, charterer, master or managing operator shall instruct each crewmember, upon first being employed and prior to getting underway for the first time on a particular vessel and at least once every 3 months, as to the duties that the crewmember is expected to perform in an emergency including, but not limited to, the emergency instructions listed on the emergency instruction placard required by 185.5107 of this part…. In addition, the person in charge of the vessel is required to conduct emergency drills, as stipulated by 46 CFR 185.520, which states: The master shall conduct sufficient drills and give sufficient instructions to make sure that all crewmembers are familiar with their duties during emergencies that necessitate abandoning ship or the recovery of persons who have fallen overboard. Title 46 CFR 185.520(f) and 46 CFR 185.524(d) require that abandon ship/man overboard drills and fire drills be logged or otherwise documented for review by the Coast Guard upon request. The records must include the date of the drill and a general description of the drill scenario and training topics discussed. NVIC No. 1-91. In February 1991, citing new ship designs that permitted “significantly increased passenger capacity” on small passenger vessels, the Coast Guard issued NVIC No. 1-91 recommending qualifications and training for deckhands on such vessels. (See appendix B.) The NVIC states, in part, The Coast Guard and the industry recognize that a Small Passenger Vessel’s licensed officer(s) would be unable to navigate the vessel and effectively respond to emergencies such as fire, engineering casualties, collision, flooding, medical emergencies, man overboard, etc., without the assistance of trained and qualified deckhands. The NVIC further states, “The employment and training of qualified deckhands is the responsibility of the marine employer (46 CFR 15.103)” and “The Coast Guard is responsible for determining that Small Passenger Vessels are manned with competent crews.” The stated intention of the NVIC is to provide guidance for marine employers and masters of small passenger vessels to use when structuring training programs for deckhands. The circular is further intended as guidance for Coast Guard OCMIs during inspections for certification and reinspections, when evaluating training programs, and during drills conducted to ensure crew competency. 7 46 CFR 185.510 requires that posted emergency instructions contain the actions to be taken in the event of fire, heavy weather, or man-overboard conditions.

Factual Information 9 Marine Accident Report Regarding firefighting, the NVIC recommends that every deckhand “should be familiar with” the following matters: • Fire detection and alarm systems; • Classes of fires and the appropriate firefighting technique; • Location and operation of firefighting equipment; • Location and operation of power, ventilation, and fuel shut-offs; • Location and operation of watertight doors, hatches, fire-screen doors, and escapes; • Procedures for mustering passengers; and • Station bill assignment and duties. Company Training. The master and the deckhands on the Port Imperial Manhattan were not required to complete formal firefighting training and, according to company officials, had not completed such training before the fire. Until shortly before the Port Imperial Manhattan fire, NY Waterway had provided basic familiarization instruction to its new employees by means of on-the-job training. During this training, new masters spent time in the wheelhouse under the tutelage of more senior masters until they became comfortable with the vessel operation. New deckhands, in turn, received instruction on their routine duties from the master. The deckhands received instructions from the master on emergency procedures and equipment during man-overboard drills and fire drills that were conducted monthly on the passenger vessels. NY Waterway records do not indicate that the Port Imperial Manhattan crew had ever practiced a fire drill in the engineroom. According to the senior director of marine operations for NY Waterway, shortly before the fire on the Port Imperial Manhattan, the company entered into a contract with the Seafarers International Union (SIU) to hire new deckhands. Under the agreement with the SIU, the union developed a training program at its Piney Point, Maryland, training center for newly hired deckhands. The training, conducted over a 5-day period, covers such topics as first aid, CPR, general deck fundamentals, marlinspike seamanship, and diesel fundamentals. One day of the training is devoted to on-board safety and 1 day to firefighting. Once the trainees complete the Piney Point course, they return to the NY Waterway facility in New Jersey, where they undergo another 5-day program on the company’s ferry operations. The trainees learn how to maintain the vessels, how and when to make on-board safety checks, how to tie up the vessels, and other routine operational duties. Thus, the new training program provides deckhands with 2 weeks of formal training before they are assigned to work on a vessel. At the time of the fire, the company had sent the first contingent of new deckhands to the 2-week training program. However, the deckhands on the Port Imperial Manhattan had not yet had an opportunity to complete the new training.

Factual Information 10 Marine Accident Report Vessel Information Background Gulf Craft, Inc., based in Patterson, Louisiana, built the Port Imperial Manhattan, an aluminum passenger vessel, for NY Waterway in 1987. The vessel was certificated pursuant to the 1986 edition of 46 CFR Subchapter T, which states the following at CFR 175.05-1(b): Any vessel carrying more than 150 passengers shall comply with the provisions of this subchapter and shall be subject to certain additional requirements as determined by the Officer in Charge, Marine Inspection. The zone OCMI for the Port Imperial Manhattan when it began operations permitted the vessel to carry up to 350 passengers and to operate on lakes, bays, and sounds not more than 1 mile from shore. At the time of the Port Imperial Manhattan’s construction, the Coast Guard was in the process of revising the CFR because the agency had safety concerns about the increased number of vessel designs that were tailored to take advantage of admeasurement exemptions.8 In some designs, small passenger vessels measuring less than 100 gross tons could accommodate more than 1,000 passengers. In 1996, the Coast Guard published 46 CFR Subchapters T and K, which stipulate additional construction and safety equipment requirements for all “new” small passenger vessels, that is, those built after March 10, 1996.9 Those vessels built on or before March 10, 1996, including the Port Imperial Manhattan, were grandfathered in both of the new subchapters and, thus, not required to install the additional safety features. Basic Construction The main characteristics of the Port Imperial Manhattan were as follows: Length: 87.2 feet Breadth: 24.4 feet Depth: 8.0 feet Gross Tons: 94.0 Net Tons: 64.0 Propulsion: Two 750-horsepower Caterpillar diesel engines. 8 A history of the small passenger vessel regulations appears in appendix C. 9 Subchapter T applies to small passenger vessels that carry 150 or fewer passengers; Subchapter K applies to small passenger vessels that carry more than 150 passengers.

Factual Information 11 Marine Accident Report The Port Imperial Manhattan had one main continuous deck with an enclosed main cabin that could accommodate 156 seated and 88 standing passengers. The upper deck had an enclosed pilothouse on the forward end of the vessel and an open space that could accommodate 161 seated and 72 standing passengers. The pilothouse was equipped with a magnetic compass, radar, depth gauge, and two VHF radiotelephones. Engineroom The amount of fire damage on the Port Imperial Manhattan precluded Safety Board investigators from reconstructing the preaccident condition of the engineroom and electrical system. Investigators, therefore, examined a similarly designed NY Waterway vessel, the Port Imperial New Jersey, whose electrical system had been modified in the same way as the Port Imperial Manhattan’s system. The access ladder to the engineroom, located near the aft end of the main passenger cabin, stepped down in an athwartships, or side-to-side, direction. (See figure 3.) A hydraulic oil tank that provided fluid for the steering system was next to the hull, on the port side of the ladder. The port and starboard engines were near the forward engineroom bulkhead, and the generator was next to the forward bulkhead. Air was supplied to the engineroom through two vents located on the open upper deck. Each vent had a hinged damper. Figure 3. In 1992, the electrical system was modified and the battery backup was relocated from the forward bulkhead to beneath the access ladder. New wiring extending from the batteries was joined to the previous wiring in a plastic junction box on the port bulkhead. During postaccident examination, investigators observed a hole in the overhead, above the junction box. Ladder from deck above Battery Bank Generator Generator Forward Bulkhead Port Engine Starboard Engine Knife Switches Original 12 volt cables 12 volt cable added during modification Fuse Box Hot Water Heater Hydraulic Oil Tank Hole in overhead above junction box Plastic Junction Box

Factual Information 12 Marine Accident Report Electrical System Requirements Pertaining to Modifications. Federal regulations at 46 CFR 176.700 stipulate that other than in-kind repairs or equipment alterations that affect the safety of a vessel must not be made without the approval of the Coast Guard. A vessel owner must submit drawings or written specifications describing the proposed alteration to the OCMI for review before work can be started. Moreover, the OCMI can require an inspection and testing of the repair or alteration after it is made. 1992 Modification. The Port Imperial Manhattan originally had been equipped with a 32-volt DC main engine starting system, and the batteries for the system had been located at the forward bulkhead. In 1992, NY Waterway converted the main engine electric starting system to one using compressed air, and two 12-volt batteries were installed to supply the remaining direct current electrical loads. The 12-volt batteries were installed beneath the access ladder, at the aft end of the engineroom compartment, which was beyond the reach of the existing wiring for the starting system. To bridge the gap between the existing wiring and the batteries, a new copper feed wire and a new junction box were installed. No. 2 American wire gauge (AWG) copper wires connected the two 12-volt batteries to knife switches.10 In the event one battery died, a third knife switch could provide crossover capabilities. According to design guidance for electrical systems below 50 volts, No. 2 wire can safely carry about 100 amps of current.11 Additional design requirements for wire sizing require that the wire be of sufficient size as to limit the voltage drop to the load to not more than 10 percent.12 In the wheelhouse, the supply load from each 12-volt battery passed through a forward distribution panel, which had a total load of 55.8 amps, and an aft distribution panel, which had a total load of 42 amps. The distance from the batteries to the distribution panels was about 100 feet. According to design guidance for limiting circuit voltage drop, the size of wire needed to supply a 56-amp load to the forward distribution panel on the bridge is AWG No. 0.13 Output from the knife switches fed to individual fuses, each of which was rated at 100 amps, according to information provided by the company. Fuses are current-sensitive devices designed to act as a weak link in an electrical circuit. They are intended to protect circuit components, such as power sources, loads, and the wires that connect sources to loads, from overheating as a result of excessive current. Title 46 CFR 05-50(c)(1991 10 A knife switch is a switch in which contact is made by sliding a blade between two contacts to close the electrical circuit. 11 46 CFR 183.05-45 (1991 edition) provides guidance on wire sizes for lighting and power wiring of less than 50 volts. Depending on insulation temperature rating, the Coast Guard allows No. 2 AWG wire to carry either 95 or 115 amps. 12 46 CFR 183.05.45(c) (1991 edition) 13 The formula specified in 46 CFR 183.05.45(c) (1991 edition) is used to calculate the required wire area in circular-mils, which is then converted to the corresponding AWG wire size using standard tables.

Factual Information 13 Marine Accident Report edition) required that conductors be protected from overcurrent in accordance with their current carrying capacities. Federal regulations allowed for the use of splices and joints, provided they were installed in junction boxes. In addition, regulations did not prohibit the use of junction boxes constructed of plastic.14 According to the NY Waterway port engineer, the electrical cables had run from the fuse box into a plastic junction box, which had been installed above a reservoir tank for hydraulic oil. During postaccident examination, Safety Board investigators found no junction box among the debris. Investigators, therefore, examined the junction box on the Port Imperial New Jersey. At the junction box, lug bolts to the 12- volt DC wires connected the original to the modified section of the system. The wires from the junction box ran through the forward bulkhead to the two 12-volt independent distribution power panels in the pilothouse. Following its investigation of the Port Imperial Manhattan fire, the Coast Guard issued a casualty report that states, in part, the following: The existing cables were not long enough to reach the new battery location so a junction box was installed to extend the cable. Coast Guard approval was not sought for modification, and no electrical plans were submitted. The cause of the fire appears to be attributed to an incorrect electrical connection within the junction box.... The electrical modifications should have been subject to a review by the Coast Guard. By failing to provide notice of the intended changes NY Waterway precluded the Coast Guard from identifying any deficiencies…. Lifesaving and Firefighting Equipment The Port Imperial Manhattan’s COI stipulated the lifesaving and firefighting equipment required by Subchapter T regulations at Parts 180 and 181, respectively. Lifesaving Equipment. The required lifesaving equipment carried by the Port Imperial Manhattan included 2 ring buoys with lights, 1 ring buoy with lights and a 60- foot line, 1 man-overboard ladder, and 354 lifejackets. Investigators determined that most of the lifejackets on the vessel had been tightly wrapped, fastened with clips, and stowed in two lockers at the aft end (figure 2). Adult- and child-size lifejackets had been stowed together.15 The Port Imperial Manhattan was not required by 46 CFR 180.207(d) to carry any RBAs, but voluntarily carried seven of the devices. (See figure 4.) Firefighting Equipment. The Port Imperial Manhattan had a fire main, which could be supplied with water from two fire pumps, both of which were located in the engineroom and neither of which was remotely operated. The main fire pump was driven 14 46 CFR .05-50(b) (1991 edition) 15 Title 46 CFR 180.78, “Stowage of Life Jackets,” states that each child-size lifejacket must be stowed in a location that is appropriately marked and separated from adult lifejackets.

Factual Information 14 Marine Accident Report by the vessel’s main engine. To engage the pump, a crewmember had to enter the engineroom. The secondary pump was an electrically driven pump that, in normal operations, functioned as a bilge pump for the vessel. To use the bilge pump for firefighting operations, crewmembers had to enter the engineroom and realign the valves to the pump so that it would draw from the sea chest16 and pump water into the fire main. The vessel had two 1 1/2-inch fire hose stations in the main cabin, one hose on the upper deck, and six portable fire extinguishers installed as indicated below: Figure 4. Postaccident view of two RBAs retrieved by crewmembers on board the Port Imperial Manhattan. An RBA lacks a platform to carry survivors. The ring-shaped flota- tion device is surrounded by a line that survivors in the water can grasp until they are rescued. On the night of the Port Imperial Manhattan fire, the lines of the vessel’s RBAs became tangled, and crewmembers cut some of them to free the devices. 16 The sea chest is a water intake space on either side of the ship, under the waterline, near the engineroom, which feeds water into the engines to cool them. Pilothouse One 2 1/2-pound (lb) and one 10-lb dry chemical extinguisher Forward main deck One 15-lb CO2 extinguisher Engineroom Two 15-lb CO2 extinguishers Stern One 15-lb CO2 extinguisher

Factual Information 15 Marine Accident Report The Port Imperial Manhattan did not have either a fixed fire detection system or a fixed fire suppression system in its engineroom; the vessel was not required to have such systems. Federal regulations at 46 CFR 181.155 stipulate that a vessel constructed, converted, or issued an initial COI on or before March 10, 1996, is exempt from the requirement for fire detection systems unless the vessel’s hull or machinery space boundary bulkhead or deck is composed of wood or fiber-reinforced plastic or is sheathed on the interior with fiber-reinforced plastic. According to NY Waterway’s senior director of marine operations, the Port Imperial Manhattan was the only vessel in the company’s fleet that did not have a fixed firefighting system protecting the engineroom. He said that the older vessels in the fleet had halon systems and the new vessels had CO2 systems. As part of this investigation, the Safety Board attempted to determine how many vessels certificated under 46 CFR Subchapter T operated in commuter service. Coast Guard records do not break down the total number of certificated vessels according to use. Coast Guard data does indicate that, as of April 2, 2001, the number of vessels under 100 gross tons totaled 5,613, of which 4,835 were built before March 11, 1996 and, thus, were not required to have fire protection equipment. Of these 4,835 vessels, 951 were certificated to carry more than 100 passengers. Radiotelephones The VHF radiotelephones on the Port Imperial Manhattan were not outfitted with an emergency source of power that enabled them to operate in the event of a power failure. Federal Communications Commission (FCC) requirements at 47 CFR 80.917, “Compulsory Radiotelephone Installation for Small Passenger Boats,” stipulate the following under Reserve Power Supply: (a) A vessel of more than 100 gross tons the keel of which was laid after March 1, 1957, must have a reserve power supply located on the same deck as the main wheel house or at least one deck above the vessel’s main deck, unless the main power supply is so situated. Vessel Certification and Inspections The Port Imperial Manhattan was last certificated on July 7, 1999, and the vessel’s COI had an expiration date of July 7, 2002. Coast Guard regulations at 46 CFR 176.500 require that a vessel be reinspected within 60 days of the anniversary of the COI issuance date. The Port Imperial Manhattan had last been reinspected on June 7, 2000. During the reinspection, the Coast Guard inspector witnessed a simulated fire in the main cabin and a man-overboard drill. The inspector identified several minor deficiencies, none of which were related to the 12-volt electrical system. Waterway Information According to the National Ocean Service’s publication U.S. Coastal Pilot, the Hudson River area between 38th Street in Manhattan and Lincoln Harbor in New Jersey is

Factual Information 16 Marine Accident Report about 3/4 mile wide and has an average depth of about 45 feet. Freshets,17 winds, and droughts influence the river currents. The currents usually set fair with the channels except near bends and wharves. The velocities of the currents average 1.3 to 1.6 knots. Meteorological Information According to area weather reports, the skies were partly cloudy and the visibility was good at the time of the accident. The wind was northeasterly at 10 to 16 knots. The air temperature was 45o F at 1900. The water temperature of the Hudson River, measured near Hastings-on-Hudson, 20 miles north of 38th Street, was 51o F. Operations General NY Waterway began operations in 1986 as Port Imperial Ferry, providing passenger service across the Hudson River between New York and New Jersey. Before the Port Imperial Manhattan accident, the company had gone through a sustained period of growth, and, by 2000, had 23 existing vessels and one boat under construction. At the time of the accident, the company employed 113 masters and deckhands. NY Waterway primarily operated the Port Imperial Manhattan as a commuter ferry that provided regularly scheduled passenger service across the Hudson River between 38th Street in Manhattan and Lincoln Harbor in Weehawken. In addition to 10 ferry routes, the company also operated sightseeing and dinner cruises and seasonal service to Yankee and Shea Stadiums. For most runs, in particular when providing commuter service between Manhattan and Weehawken, the company operated its vessels according to Coast Guard requirements contained in 46 CFR Subchapter T. When providing excursion service for a passenger complement that exceeded 150 people, the company operated the vessels according to Coast Guard requirements contained in 46 CFR Subchapter K. Local Coast Guard officials stated that NY Waterway operates the largest fleet of small passenger vessels within the New York marine inspection zone. Agency officials stated that, according to Federal regulations, a NY Waterway vessel is not considered a “ferry” because it can be operated in different types of commuter service and is not limited to one strictly defined route.18 According to NY Waterway officials, at the time of the Port Imperial Manhattan fire, its vessels carried about 7 million passengers per year, mainly in 17 A freshet is a sudden overflow from a heavy rain or thaw into a body of water. 18 46 CFR 2.10-25 defines ferry as a vessel that: (1) Operates in other than ocean or coastwise service; (2) Has provisions only for deck passengers or vehicles, or both; (3) Operates on a short run on a frequent schedule between two points over the most direct water route; and (4) Offers a public service of a type normally attributed to a bridge or tunnel.

Factual Information 17 Marine Accident Report commuter service. The company also used the vessels to conduct tours during noncommuting hours. As a result of the damage to the Port Authority Trans-Hudson19 (PATH) commuter rail line and the New York City subway caused by the attack on the World Trade Center on September 11, 2001, the number of riders on NY Waterway vessels has greatly increased. Before the terrorist attack, NY Waterway typically carried 20,000 to 30,000 passengers each day. The company now averages 34,000 to 60,000 people per day. On the day of the attack, NY Waterway vessels evacuated more than 150,000 people from lower Manhattan, including 2,000 injured.20 General Oversight According to the company’s senior director of marine operations, at the time of the Port Imperial Manhattan fire, he had three marine managers who provided general oversight for the vessels in the NY Waterway’s fleet. Each of the managers had been a senior vessel master for the company. NY Waterway requires that a manager be on duty at all times between 0545 and 2100. Each marine manager is responsible for 8 vessels. The managers are required to ride on and to conduct an operational check of each of their vessels weekly. They are responsible for ensuring that the vessel masters submit deficiency reports, known as “Captain’s Reports,” on time, as required. The managers are also supposed to observe the performance of the vessel master and to provide mentoring, as necessary. The last operational check of the Port Imperial Manhattan before the accident was on October 17, 2000. Electrical Maintenance Industry Practices. According to recognized technical authorities, three fundamental rules for maintaining electrical equipment are: keep the equipment clean and dry, keep the electrical connections and mechanical fastenings tight, and inspect and test the equipment at sufficiently short intervals to ensure that it is in good operating condition.21 All electrical connections (particularly terminals and terminal board connections) should be inspected at frequent intervals to ensure they are tight.22 Loose connections result in increased contact resistance and increased heating, which may result in breakdown or a fire. Loose electrical connections or mechanical fastenings have caused numerous derangements of electrical equipment. Loose connections can be readily tightened, but a thorough inspection is necessary to detect them. A regular schedule of 19 Port Authority Trans-Hudson is a subsidiary of the Port Authority of New York and New Jersey. Trains operate between midtown Manhattan at 33rd Street to Newark, New Jersey. 20 Source: MarineLog, January 2002-Vol.107 No.1. Information on the World Trade Center response is from the MarineLog Website, 21 Naval Ships’ Technical Manual, Chapter 300, Electric Plant–General S9086-KC-STM-010/CH- 300R4. 22 National Fire Protection Association’s publication 70B, “Recommended Practice for Electrical Equipment Maintenance.”

Factual Information 18 Marine Accident Report cleaning and inspection can ensure trouble-free operation and detection of incipient faults before they develop into a major source of difficulty. If the equipment manufacturer does not specify definite times for cleaning and inspection, a practical schedule for periodic cleaning and inspection at intervals sufficiently short to keep the equipment in good shape should be established. In setting up such a schedule, recognize that older equipment requires more frequent cleaning and inspection than similar equipment that has seen less service.23 Company Procedures. NY Waterway provided maintenance and repair records for July 31 through November 14, 2000. The records indicate that NY Waterway had completed regular and breakdown maintenance for various engineering components, as well as minor preventive maintenance, such as changing oil filters. No documents indicated that the company had established a formal preventive maintenance program for the vessel’s hull or its mechanical and electrical systems. According to the port engineer, NY Waterway hired an electrical contractor to conduct maintenance and repair of the electrical systems on its vessels. The company’s director of marine operations stated that a circuit test of the 12-volt circuit had been conducted before the accident but could not confirm the date of the last prefire check. A review of the maintenance records showed that on September 4, 2000, an electrical contractor made repairs after finding a knife switch disconnected and fuses blown on the 12-volt circuit. Otherwise, the company had no record of any electrical maintenance performed on the Port Imperial Manhattan before the fire and after July 31, 2000. Following the fire, NY Waterway developed a maintenance checklist for personnel to use when performing maintenance of all vessel systems, including electrical. Toxicology Testing NY Waterway arranged for all three Port Imperial Manhattan crewmembers to receive postaccident drug and alcohol testing about 2115 at Palisades General Hospital. All samples tested negative for the presence of alcohol and drugs. Wreckage On November 18, Safety Board investigators examined the damage on the Port Imperial Manhattan. The pilothouse suffered smoke damage, and the main passenger cabin was destroyed. The engineroom sustained extensive damage in the aft port corner. Investigators observed that the aluminum deck above the hydraulic oil tank had melted away. Hull frames on the port side aft suffered fire damage. 23 Naval Ships’ Technical Manual, Chapter 320, Electric Power Distribution Systems, S9086-KY-STM- 010/CH-320R2.

Factual Information 19 Marine Accident Report Within the engineroom, investigators observed a “V” soot pattern on the interior skin of the ferry. The pattern pointed to the area where the plastic junction box had been installed. The junction box, however, was never located. Copper wires to the 12-volt system showed beading.244 At the point where the junction box should have been located, the wire had completely burned through. The connections at the two lug nuts that connected the cables were loose. Investigators found severed wires that matched up to other wires of the 12-volt system and observed that the ends of the wires had beading. Survival Factors Emergency Actions of the Crew The Safety Board interviewed 6 of the 8 passengers on board the Port Imperial Manhattan to gather information about the emergency response and the evacuation process. All of those interviewed said that the crewmembers gave their best effort during the fire but did not appear to be trained to handle the emergency. Safety Placards and Briefings Under 46 CFR 185.506, vessels under 100 gross tons must make a public announcement, referred to as a safety briefing, to passengers to familiarize them with lifesaving devices on board the vessel, including where to find and how to don lifejackets. In the case of the Port Imperial Manhattan, the Coast Guard had granted a waiver from the safety brief requirement because the voyage was less than 15 minutes in duration and because the vessel had posted placards containing information about the lifejackets. As a result, the passengers did not receive a safety briefing before departing the 38th Street terminal. One passenger stated that he knew where the lifejackets were stowed based on the placards. Emergency Response At 1906, the 911 emergency operator relayed a call from a passenger on board the Port Imperial Manhattan to the FDNY dispatcher. The passenger remained on the phone with the FDNY until all passengers and crew had been rescued. At 1907, the FDNY dispatcher notified the FDNY marine division of the fire, and a rescue boat, Marine 1, was sent to the scene. About 1914, Marine 1 reported to the FDNY dispatcher that the passengers were about to be taken off the boat. FDNY responders reported that they initially had some problems establishing the Port Imperial Manhattan’s location because they received conflicting reports of the vessel’s position. The FDNY dispatcher received the first 911 call reporting the boat fire 24 Beading of conductors are spherical formations of melted and resolidified copper that indicate excessive heat.

Factual Information 20 Marine Accident Report soon after the Port Imperial Manhattan had departed from the 38th Street terminal, and the Marine 1 proceeded toward the terminal. Within 15 minutes of losing power, however, the burning Port Imperial Manhattan drifted almost 3/4 mile south. During this time, the FDNY dispatcher received additional calls reporting the vessel fire from several shoreside locations, including Hoboken and piers in Manhattan. According to the crew of the George Washington, they initially tried to approach the Port Imperial Manhattan to offload the passengers and crew but were directed by Marine 1 to back off. The fireboat then attempted to come alongside the Port Imperial Manhattan. When the Marine 1 master realized that the fireboat’s deck was higher than the Port Imperial Manhattan’s deck and that the passengers would not be able to easily climb aboard the rescue boat, the fireboat instructed the George Washington to go alongside the Port Imperial Manhattan. The George Washington successfully evacuated the passengers from the Port Imperial Manhattan. Emergency Plans, Drills, and Exercises NY Waterway provided the Safety Board with its Marine Operations Manual, which contains the following instructions to the crew for actions to take in the event of a fire:

1. Cut off the [fire’s] air supply;
2. If a fire is in a machinery space, shut off fuel supply and ventilation;
3. Move passengers away from the fire and have them don lifejackets; and
4. If necessary, prepare to abandon ship.

The company provided an emergency checksheet for fires, which directed the crew to do the following:

1. For a fire at sea, cut off air supply to fire; close hatches, ports, doors, and

ventilators.

1. For fire in the engine room, manually shut off fuel supply and ventilation in the

burning space. Move passengers away from the fire and have passengers don lifejackets.

1. If necessary, prepare to abandon ship.

The company provided a record of fire drills conducted by all vessel masters from June 29 to November 6, 2000. The record does not indicate the names of the vessels on which drills were conducted or show any entry for an abandon ship drill. The company provided copies of NY Waterway’s drills and training records for the two most recent drills that the Port Imperial Manhattan’s master had performed. The master’s comments did not describe the scenarios used in the drills. The company provided a station bill. According to the bill, one of the duties of the master was to direct the efforts of the crew.

Factual Information 21 Marine Accident Report Other Information Federal Regulations Pertaining to Vessel Maintenance Title 46 CFR Subchapter T contains no section devoted to vessel maintenance. Regarding machinery on small passenger vessels, 46 CFR 182.100, states the following: This part contains requirements for the design, construction, installation, and operation of propulsion and auxiliary machinery, piping and pressure systems, steering apparatus, and associated safety systems. Machinery and equipment installed on each vessel must be suitable for the vessel and its operation for the purpose intended. All machinery and equipment must be installed and maintained in such a manner as to afford adequate protection from causing fire, explosion, machinery failure, and personnel injury. Postaccident Actions by NY Waterway According to the New York Waterway senior director of marine operations, the Port Imperial Manhattan is being rebuilt under 46 CFR Subchapter K with Coast Guard approval. The rebuilt vessel will be outfitted with a fire detection and suppression system in the engineroom. In February 2001, NY Waterway began requiring its masters and deckhands to complete the Standards of Training, Certification, and Watchkeeping for Seafarers (STCW) 5-day basic safety training course at the SIU Piney Point training facility. The course has the following elements:

1. Personal survival, 12 hours (STWC A-VI/1-1);
2. Fire prevention and firefighting, 16 hours (STCW VI/1-2);
3. First aid/CPR, 8 hours (STCW VI/1-3); and
4. Social responsibility and personal safety, 4 hours (STCW A-VI/1-4).

As of the same date, the company requires its vessel masters to complete a radar observer course. NY Waterway instituted a program to qualify deckhands as senior deckhands in accordance with NVIC 1-91. In coordination with the Coast Guard, NY Waterway reviewed the electrical systems on the vessels in its fleet to determine whether any alterations not approved by the Coast Guard had been made. One such alteration was found and corrected to comply with Coast Guard specifications. According to the company’s port engineer, as of January 2002, all vessels in the NY Waterway fleet except the Port Imperial New Jersey had been modified so that lifejackets were stowed beneath the seats. The Port Imperial New Jersey is being modified so that lifejackets will be available throughout the vessel. According to the company’s senior director of operations, all company vessels have been outfitted with emergency backup power for the VHF radiotelephone in the event of a primary power failure.

Factual Information 22 Marine Accident Report Passenger Vessel Association The Passenger Vessel Association (PVA) serves the interests and concerns of more than 350 vessel owners and operators in the domestic passenger vessel industry, which represents about 65 percent of the industry nationwide. Association members operate more than 1,100 passenger vessels in the United States carrying up to 200 million passengers annually. PVA members offer services including dinner cruises, tour and excursion services, car and passenger ferries, private charters, whale watching trips, overnight cruises, and riverboat gaming. The PVA has a safety and loss control committee responsible for reviewing, developing, and implementing programs to encourage enhanced training and safety capability among its members. These programs are designed to improve the loss record for the industry. The PVA has published risk management and training manuals to assist its member companies improve the safety of their passenger vessel operations. The risk management manual includes a safety audit guide containing inspection checklists for identifying hazardous conditions that could lead to slips, trips, falls, and other injuries to passengers and crewmembers. The manual mentions that engineroom safety and deck equipment inspection logs are useful for conducting proper maintenance. The training manual provides information for training deckhands in several areas, including safety precautions for engineroom operations. The manual contains a primer on small passenger vessel machinery operations and systems.

23 Marine Accident Report Analysis This analysis first identifies factors that can be readily eliminated as causal or contributory to the fire and determines where and how the fire started and how it spread. The report then discusses the following major safety issues: • Vessel maintenance; • Fire detection and suppression systems; • Crew response to the emergency; • Lifejacket stowage; • Safety information provided to passengers; and • Vessel communications. Exclusions The weather conditions at the time of the fire were not severe and did not hamper detection of the fire or interfere with the firefighting efforts. The three crewmembers underwent toxicological testing about 2 1/4 hours after the fire was discovered and tested negative for the use of drugs and alcohol. Although the toxicological testing was not done within 2 hours of the accident, it was accomplished timely enough to be meaningful. The master stated that, during the 72-hour period before the accident, he received his normal amount of rest, which typically was 8 hours each night. This amount of rest usually is adequate to prevent fatigue. The Safety Board, therefore, found no evidence that he had been impaired due to lack of sleep. Consequently, the Safety Board concludes that none of the following were factors in this accident: weather, operator fatigue, drugs, or alcohol. Accident Analysis Shortly after the small passenger vessel Port Imperial Manhattan departed the 38th Street Terminal Pier with a complement of 3 crewmembers and 8 commuters, a fire started in the vessel’s engineroom, which was beneath the main passenger cabin. The vessel was not equipped with a fire detection system; therefore, the crew received no early notice of the fire. Crewmembers attempted to fight the fire using portable extinguishers; however, the fire was beyond their capability to bring it under control with the available equipment. The vessel lost propulsive power and steering and began to drift. The fire spread throughout the main passenger cabin, forcing the crew and passengers to evacuate the interior spaces and gather on the foredeck. Another company ferry rescued the crew and passengers, and an FDNY vessel towed the burning ferry to Manhattan, where shoreside

24 Marine Accident Report firefighters extinguished the fire. No deaths resulted from this accident; one passenger was treated for smoke inhalation. Cause and Origin of the Fire Safety Board investigators and party representatives inspected the engineroom and found the most significant damage in the port aft corner. In this area, the aluminum deck above the hydraulic oil tank had melted completely from the intense heat. The interior skin of the ferry had a “V” soot pattern. The base of the V in a soot pattern can be an indication of where the fire originated. In this case, the base of the V pointed toward the area of the hydraulic oil tank in the port aft corner of the engineroom. In postaccident interviews, the deckhands reported seeing flames between the treads of the ladder leading into the engineroom space. From interviews with company personnel, investigators determined that, during a 1992 modification of the electrical system, a 32-volt DC main engine starting system had been removed from its original position at the forward bulkhead of the engineroom and had been replaced with two 12-volt batteries that were installed at the aft end of the engineroom, beneath the access ladder. As installed, the 12-volt batteries had been beyond the reach of the existing wiring for the starting system. To bridge the gap between the existing wiring and the batteries, No. 2 AWG copper wires had been run from the old battery bank location to the new position. Two lug bolts had connected the new and old wires, and the connections had been enclosed in a plastic junction box, which had been installed over the hydraulic oil tank in the port aft corner of the engineroom. The Coast Guard report of findings in this accident found that the No. 2 AWG wire was undersized, that the protecting fuse was oversized, and that these conditions contributed to the cause of the fire. In the Safety Board’s opinion, these conditions probably were not causal or contributory to the fire. The No. 2 AWG wire installed in the system could safely handle up to about 100 amps current, and the full load to the forward distribution panel was only 55 amps. The conductors were undersized only in the sense that a voltage drop would have exceeded the recommended maximum of 10 percent and not because the conductors could not safely carry the current of connected load. Even though the 100 amp fuses exceeded 125 percent of the connected load, they would have adequately protected the No.2 AWG wire from overheating caused by high currents. Investigators could not locate the plastic junction box, which was probably destroyed in the fire. They did find the lug nut connection holding the old and new wires; however, the wires on either side of the lug nuts had burned through. Much of the wire’s insulation had been burned off, with most of the damage closest to the point where the old and new wires were connected. The lug nuts connecting the wires were loose. The 12-volt DC cables matching other sections of the electrical system had sustained heavy damage. The cables showed evidence of beading, which indicates a high temperature condition. Analysis

Analysis 25 Marine Accident Report After finding the loose connections at the lug nuts on the Port Imperial Manhattan, investigators checked the junction box on the Port Imperial New Jersey and found similar loose connections. The Port Imperial New Jersey’s wires also showed evidence of beading, indicating a high temperature condition associated with arcing activity. In high current electrical wiring connections, excessive temperatures can develop at the junction due to excessive voltage drop caused by high resistance from corroded or loose connections. Wiring problems stem from using inadequate gauge wire for the load carried or from running the wire too great a distance for its design. After the conversion, NY Waterway had an electrical contractor periodically perform circuitry tests of the Port Imperial Manhattan’s electrical system. Records reveal that the system had not indicated an overload condition during the tests. Moreover, during the 8 years from the time that the direct current electrical systems of the Port Imperial Manhattan and the Port Imperial New Jersey had been modified, neither vessel had experienced any incidents or had reported problems related to the systems. If the wiring had not been adequately sized to handle the connected load, electrical problems probably would have occurred earlier, given the constant use of the vessels. For 16 hours each day, the Port Imperial Manhattan made commuter runs every 15 minutes during rush hour periods and sightseeing tours, dinner cruises, and other runs during off-peak periods. High resistance connections can be caused by a poor splice, loose or intermittent connections, or by corroded connections. After the fire, investigators found loose wire connectors on the wire ends where the old and new wires were joined during the 1992 system modifications. The probability is high that, if the connections were left unchecked over an 8-year period, vibration and thermal cycling caused them to loosen. A loose connection would increase electrical resistance in the circuit, causing the wire at the connection to overheat, which, in turn, could result in the insulation igniting. The hydraulic oil on board the Port Imperial Manhattan was Mobil Hydraulic Oil AW 32, which according to the “Material Safety Data Bulletin,” has a flash point of 374o F. At normal temperatures, a spark will not easily ignite this hydraulic oil because it doesn’t produce sufficient flammable vapors. However, an established fire will ignite a pool of oil by providing enough heat to raise the liquid to its flashpoint. In this case, the fire from the burning wire insulation and surrounding materials would provide enough heat to raise the oil to its flashpoint. The temperature rise would have caused the oil to produce sufficient vapors to be ignited. The burning debris would have dropped into the bilges and ignited any other combustible debris or accumulated standing hydraulic oil. Finally, the hydraulic oil tank would have ignited, providing fuel for the fire. The Safety Board concludes that the fire on the Port Imperial Manhattan started in the junction box as a result of a loose connection and spread throughout the after portion of the engineroom. The open access door then allowed the fire to spread to other areas of the vessel.

Analysis 26 Marine Accident Report Coast Guard inspectors had not detected the electrical system modification during their annual examinations of the Port Imperial Manhattan. A review of Coast Guard inspection records showed that these routine inspections included visual examinations of the vessel’s hull and of lifesaving and firefighting equipment. In addition, the inspectors conducted operational tests of the fire pumps and other systems, such as main propulsion and steering. These inspections appeared to have been reasonably thorough and complete. During routine Coast Guard examinations, the inspectors do not perform an in- depth review with plans. Unless inspectors note an obvious defect or improper installation, they would not trace individual electrical circuits or check individual electrical connections. In the case of the Port Imperial Manhattan arrangement, the modification to the 12-volt electrical system consisted of running standard No. 2 AWG cable to a junction box. Because cable runs with junction boxes are common on board vessels, the arrangement would have appeared to be in accordance with standard marine practice. An inspector would have had no reason to suspect that the Coast Guard had not previously approved the wiring installation. When inspecting batteries, inspectors typically focus on proper installation, proper ventilation to dissipate gas generated during charging, and proper terminal connections. The Safety Board therefore, concludes that a routine Coast Guard inspection of the vessel probably would not have detected the loose electrical connection that led to the fire on the Port Imperial Manhattan. Vessel Maintenance NY Waterway did not have a preventive maintenance program for the hulls, the mechanical systems, and the electrical systems of the vessels in its fleet. Documentation provided by the company indicated that engineroom inspections had been made, but omitted details indicating the scope of the maintenance performed and the intervals between the maintenance. Company officials stated that a circuit check on the 12-volt system had been conducted, but could not say when it had been performed. Preventive maintenance of the electrical system would have included testing the circuits and tightening the bolts in the junction box, which loosened over time and caused the fire. Several methods are commonly used to detect faulty connections, including resistance testing of the electrical system with a micro-ohmmeter to detect high resistance that results in high temperatures and excessive voltage drops. Infrared thermographic imaging of electrical system components operating under full load can also detect high temperature conditions resulting from high resistance connections. Infrared thermographic imaging is widely used in many industries as means of locating electrical system components operating at higher temperatures than adjacent components, and is able to detect temperature differences of as little as 2o F. A junction box containing a hot connection would have been easily detectable by a modern infrared imaging device well before the problem became serious enough to cause a fire. The Safety Board concludes that had NY Waterway had an effective preventive maintenance program, the loose

Analysis 27 Marine Accident Report electrical connection could have been detected before it caused the fire on the Port Imperial Manhattan. After the fire, the company introduced additional checksheets to improve the monthly maintenance of its vessels. However, this alone is not equivalent to implementing a comprehensive preventive maintenance program, which is much broader in scope. While this accident resulted from inadequate maintenance of the electrical system, passenger safety cannot be ensured by maintenance of electrical systems alone. Several small passenger vessel accidents investigated by the Safety Board show that inadequate preventive maintenance of hull and machinery systems played an equally significant role in causing accidents. Shipboard mechanical systems consist of numerous moving parts that require planned inspections and maintenance to avoid unexpected breakdowns and unsafe conditions for passengers and crew. It is therefore necessary for companies to develop a preventive maintenance program for all systems affecting the safety of passenger vessels. A company’s preventive maintenance program for its vessel fleet should include, as a minimum, established procedures for reporting maintenance and repair needs, for ensuring good interaction between vessel-operating personnel and shoreside maintenance staff, for conducting vessel inspections and repairs, for verifying and/or testing repairs, for retaining and reviewing maintenance and repair records, and for overseeing the maintenance and repair process. The Safety Board therefore believes that, for the vessels in its fleet, NY Waterway should develop and implement a preventive maintenance program for systems affecting safe operation, including the hull and the mechanical and electrical systems. The Coast Guard does not have specific regulations requiring a preventive maintenance program for small passenger vessels. The Federal regulators of other transportation modes recognize the importance of preventive maintenance to the safety of operations and require that operators have a systematic program for performing inspections and maintenance. The Federal Aviation Administration has promulgated for all airplane operators comprehensive maintenance requirements, which include provisions for inspections, repairs, and preventive maintenance.25 The Federal Motor Carrier Safety Administration requires that every motor carrier systematically inspect, repair, and maintain, or cause to be systematically inspected, repaired, and maintained, all motor vehicles subject to its control.26 In addition, the Federal Railroad Administration has extensive inspection and maintenance requirements for locomotives, train cars, crossing signals, and tracks.27 Because no authority other than the Coast Guard exercises oversight over domestic small passenger vessels, the Safety Board believes that the Coast Guard should require that companies operating domestic passenger vessels develop and implement a preventive 25 These requirements are contained in 14 CFR Part 43, and Part 91, subpart E. 26 Maintenance requirements are specified at 49 CFR 393.3. 27 Inspection and maintenance requirements are specified at 49 CFR parts 213, 215, 229, and 231.

Analysis 28 Marine Accident Report maintenance program for all systems affecting the safe operation of their vessels, including the hull and the mechanical and electrical systems. More than 350 small passenger vessels owners and operators, or about 65 percent of the owners and operators nationwide, belong to the PVA. The Safety Board is aware that an objective of the PVA is to assist its member companies improve the safety of their passenger vessel operations, and the association has published risk management and training manuals for that purpose. The risk management manual includes a safety audit guide containing checklists for inspecting vessels for hazardous conditions that could lead to slips, trips, falls, and injuries to passengers and crewmembers. The manual briefly mentions that engineroom, deck equipment, and safety inspection logs are useful for conducting proper maintenance. The training manual provides information for instructing deckhands in several areas, including safety precautions for engineroom operations. The training manual also contains a primer on small passenger vessel machinery operations and systems. While the PVA’s voluntary guidelines cover several areas of passenger and vessel safety, they do not provide adequate guidance to companies for establishing preventive maintenance programs for the hull and the machinery and electrical systems. In addition to operational checks, PVA guidelines should stress the importance of vessel maintenance and list machinery, electrical, and hull items that require periodic inspection and maintenance by a company’s maintenance staff. The guidelines for preventive maintenance should describe, for example, procedures for reporting maintenance and repair needs, for ensuring good interaction between vessel-operating personnel and shoreside maintenance staff, for conducting vessel inspections and repairs, for verifying and testing repair work, for retaining and reviewing maintenance and repair records, and overseeing the maintenance and repair process for its fleet. Given the large number of passengers that are carried on small passenger vessels and ferries today and the commensurate safety risks, preventive maintenance should be performed on a regular basis. Although the PVA does not include the entire domestic small passenger vessel fleet, its members represent a large enough portion of the industry to incrementally improve the level of small passenger vessel safety. Recognizing that Coast Guard rulemaking requiring preventive maintenance programs is likely to be a time-consuming process, the Safety Board believes that, in the interim, the PVA should provide its members with guidelines for developing a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and the mechanical and electrical systems.

Analysis 29 Marine Accident Report Fire Detection and Suppression Systems Fire Detection In this accident, the fire on the Port Imperial Manhattan was probably in its incipient stage28 for some time before entering the free-burning phase. Unfortunately, the crewmembers were unaware of the fire until it was fully involved in the engineroom. A fire detection system in the engineroom would have probably detected the fire while it was in the incipient phase and would have alerted the crewmembers to the presence of a fire while it was still small enough for them to be able to extinguish it. However, the Port Imperial Manhattan did not have a fire detection system for its engineroom. Once the fire reached the free-burning stage, the crewmembers were faced with a much more serious and life threatening blaze. According to Federal regulation, a vessel constructed, converted, or issued an initial COI on or before March 10, 1996, is exempt from the requirement for fire detection systems unless the vessel’s hull or machinery space boundary bulkhead or deck is composed of wood or fiber-reinforced plastic or its interior is sheathed with fiber- reinforced plastic. Because the Port Imperial Manhattan was built of aluminum in 1987, it was not required to have a fire detection system. The Safety Board does not consider the date of build, conversion, or certification to be an appropriate factor for determining whether a vessel should or should not be required to have an installed fire detection system. The sole reason for requiring the installation of such a system should be the risk factors involved. As is the case with most small passenger vessels, the engineroom on the Port Imperial Manhattan was unmanned; no one was in the space to continuously monitor the fire-safe condition. Because the engineroom is the location of most ignition sources for fires, including hot surfaces, fuel and lubricating oils, and electrical equipment, this space is where the greatest fire risk exists on a vessel. Moreover, as the service life of a vessel increases, the potential for failure or breakdown in system components increases. As they age, engine hoses deteriorate, electrical parts fail, and the overall condition of an engineroom declines. Because new small passenger vessels are required to have fire detection systems to protect their enginerooms and older existing vessels in the same service are not, two standards of safety exist. More importantly, the vessels with the higher risk are permitted to adhere to the lower standard. The Safety Board concludes that the lack of fire detection systems for enginerooms on existing small passenger vessels in commuter and ferry service presents an unacceptable risk to passengers and crewmembers. Consequently, the Safety Board believes that the Coast Guard should require that all small passenger vessels 28 The first stage of a fire, known as the incipient stage, begins at the moment of ignition. During this stage, the flames are localized, and the fire is fuel-regulated, meaning the fire is regulated by the configuration, mass, and geometry of the fuel. In the incipient stage, the oxygen content is within normal range, and normal ambient temperatures still exist. Source: NFPA, Fire Ignition & Development, Catalog No. VC-54 (Quincy, Massachusetts: NFPA: 1998)

Analysis 30 Marine Accident Report in commuter and ferry service, regardless of their date of build, be fitted with a fire detection system in the enginerooms. Fire Suppression From the time that crewmembers discovered the Port Imperial Manhattan’s fire, it was beyond their capability to extinguish it with portable fire extinguishers. The vessel’s fire main system was charged by a primary fire pump, which, in turn, was driven by the main diesel engine. The deckhands would have had to enter the engineroom in order to start the pump; however, they could not do so because the engineroom was on fire. The auxiliary fire pump served as a bilge pump during normal operations. However, to align the valves and activate the pump so that it would provide water to the fire main, the deckhands would have had to enter the engineroom, which was not possible. Title 46 CFR 181.300(e) require that “new” small passenger vessels, that is, those built, converted, or issued an initial COI on or after March 11, 1996, have a fire pump that is capable of both remote operation from the operating station and local operation at the pump. Because the Port Imperial Manhattan was built before this cut-off date, it was not required to have remotely operated fire pumps. Had the fire pumps on the Port Imperial Manhattan been capable of remote operation, the deckhands might have been able to charge a fire hose and to use it to fight the fire. However, it would have been extremely dangerous for anyone who was not properly trained and equipped to enter an enclosed space to fight a fire. Nevertheless, the deckhands on the Port Imperial Manhattan, operating from the main passenger cabin, could have directed a stream of water into the engineroom through the open access trunk, which might have knocked down the fire, or they could have used the charged fire hose to cool the fire boundaries and possibly limit the spread of the fire. Consequently, the Safety Board concludes that the lack of remotely operated fire pumps on the Port Imperial Manhattan compromised the ability of the crew to control the fire and that the lack of a remotely operated fire pumps on other small passenger vessels in commuter and ferry service built before March 11, 1996, similarly impairs the ability of their crews to control engineroom fires. The Safety Board, therefore, believes that the Coast Guard should require that all small passenger vessels in commuter and ferry service, regardless of their date of build, be fitted with remotely operated fire pumps. In the Safety Board’s opinion, the most effective method that the crewmembers could have used to extinguish this fire would have been to seal the engineroom by closing all vent openings and doors and then activate a fixed fire suppression system. Unfortunately, the Port Imperial Manhattan was not equipped and was not required to be equipped with a fixed fire suppression system to protect its engineroom. If the Port Imperial Manhattan had been equipped with a fixed fire suppression system, it could have extinguished the fire before it spread to other parts of the vessel, thus limiting the damage to the vessel and the threat to the people on board. Further, it would have freed the deckhands of active firefighting duties and allowed them to concentrate their efforts on taking care of the passengers during the fire emergency.

Analysis 31 Marine Accident Report The value of a fixed fire suppression system was graphically demonstrated in a more recent fire on board another small passenger vessel in commuter service. On September 28, 2001, a fire broke out in the engineroom of the small passenger vessel, the Seastreak New York,29 which was in commuter service between Highlands, New Jersey, and Manhattan. Because the engineroom on the Seastreak New York was fitted with a CO2 fire suppression system, when crewmembers discovered the fire, they were able to activate the suppression system without having to enter the engineroom and extinguish the fire before it caused extensive damage to the vessel. Thus, the vessel firefighters were in less danger, and the fire was extinguished in a quick and effective manner. The Port Imperial Manhattan and the Seastreak New York were both in commuter passenger service; both vessels had enclosed, unmanned enginerooms; both vessels were certificated to carry hundreds of passengers at one time; both vessels were similarly manned, and both vessels suffered an engineroom fire. However, while its fire virtually destroyed the Port Imperial Manhattan, the fire on the Seastreak New York caused only minor damage. The difference between the outcomes of these two fires was that the Seasteak New York was outfitted with a fixed fire suppression system to protect its engineroom and the Port Imperial Manhattan was not. Had the Port Imperial Manhattan been equipped with a fire suppression system to protect its engineroom, the outcome of the fire could have been markedly different. The Safety Board, therefore, concludes that, if the Port Imperial Manhattan had been equipped with a fixed suppression system, properly trained crewmembers could have extinguished the fire and kept it within the confines of the engineroom. At the time of the fire, the Port Imperial Manhattan was the only vessel in NY Waterway’s fleet that did not have a fire detection and suppression system protecting its engineroom. As a result of this fire, NY Waterway plans to rebuild the Port Imperial Manhattan with a detection and suppression system for its engineroom. Because all other vessels owned or chartered by NY Waterway already have the detection and suppression systems, further action by NY Waterway is not warranted on these issues. The small passenger vessel industry continues to grow, and other owners and operators presently have many existing vessels in service. While the Safety Board could not determine how many vessels certificated pursuant to Subchapter T were operating in commuter service, Coast Guard records indicate that of 4,835 small passenger vessels built before March 11, 1996, 951 were permitted to carry in excess of 100 passengers. Further, PVA records indicate that its member companies, which have about 65 percent of the small passenger vessels in service nationwide, carry up to 200 million passengers annually. Because existing vessels are not required to have fire suppression systems in their enginerooms, the passengers on board these vessels are at increased risk. The Safety Board concludes that the safety of existing small passenger vessels in commuter and ferry service would be enhanced by the installation of fire suppression systems in their enginerooms. Consequently, the Safety Board believes that the Coast Guard should 29 The Seastreak New York fire will be the subject of a separate Safety Board report.

Analysis 32 Marine Accident Report require that all small passenger vessels in commuter and ferry service, regardless of their date of build, be fitted with a fixed fire suppression system in their enginerooms. Crew Response to the Emergency In response to the fire on board the Port Imperial Manhattan, the crewmembers’ first actions were directed at locating and fighting the fire and then at securing the safety of the passengers. This section will first examine the crewmembers’ firefighting response and then their efforts in providing for passenger safety. Crew’s Firefighting Response The first indication of fire on board the Port Imperial Manhattan was when the master observed smoke coming from the engineroom vent on the upper deck. He immediately dispatched deckhands to investigate the source of smoke. Given that the vessel lacked a fire detection system, the master’s action was appropriate for he had no other way in which to learn what was causing the smoke. Upon arriving at the access door to the engineroom, the deckhands did not follow accepted firefighting procedures for opening a door into a space suspected of being on fire. They did not move the back of their hands over the outer surface of the door to check for heat before opening it. Rather, they simply opened the engine room door, which not only allowed additional oxygen to enter the area and feed the fire but also put them at risk of injury. Further, a door to an enclosed space suspected to be on fire should not be opened unless firefighters are on hand with a charged fire hose. Once they identified that a fire was in the engineroom, the crewmembers did not immediately notify the master. Rather, they both tried to extinguish the fire, with no success, before one of the men returned to the pilothouse and advised the master about the fire. In their attempt to put out the fire, the deckhands stood at the open doorway to the engineroom and discharged portable CO2 extinguishers at the flames, which was completely ineffective. A portable extinguisher has a limited range and must be directed at the seat of the fire to be effective. Because the crewmembers could not enter the engineroom, they could not get close enough with the portable extinguishers to have any effect on the fire. Their actions demonstrated that they were not properly trained in the use and limitations of the various types of fire extinguishers. If they had been properly trained, they would have known that they could not control or extinguish a fire from a distance with portable devices. Other actions of the deckhands exacerbated the fire and smoke conditions, which again demonstrates that they did not know how to properly respond to the fire. Before leaving the main cabin, one deckhand opened the exterior door to the stern to allow smoke to dissipate from the main cabin. After evacuating the main cabin, crewmembers did not

Analysis 33 Marine Accident Report close the exterior stern door or the engineroom door. By leaving the doors to the engineroom and to the exterior stern open, the crew provided a source of fresh air to the fire and a pathway that allowed the fire and smoke to spread beyond the confines of the engineroom into the main passenger cabin, eventually filling the main cabin with thick black smoke. The crewmembers of the Port Imperial Manhattan did not use proper firefighting techniques; thus, they were ineffective in controlling or extinguishing the fire. They did not take appropriate actions to prevent the heat and smoke of the fire from spreading to other parts of the vessel, which endangered their own safety and the safety of the passengers. In the Safety Board’s opinion, the crewmembers’ inability to appropriately respond to this emergency was the direct result of a lack of adequate training. Federal regulations do not require that the masters and deckhands on small passenger vessels undergo formal firefighting training. Rather, the requirements at 46 CFR 185.420 and 185.520 stipulate, in part, that the owner, charterer, master, or managing operator provide “instruction” to newly hired deckhands as to “the duties that the crewmember is expected to perform in an emergency” and that the master “conduct sufficient fire drills to make sure that each crew member is familiar with his or her duties in case of a fire.” The format and depth of the required instruction for new deckhands is not specified in the regulations but is left to the discretion of the individual company. Likewise, the requirement for masters to hold “sufficient fire drills to make sure that each crewmember is familiar with his or her duties” is subject to discretionary compliance in so far as the depth of “familiarity” with duties is concerned. However, because masters are not required to complete fire training, they are ill-prepared to provide training to others or to evaluate the effectiveness of drills. The required instruction and drills aim at familiarizing crewmembers with duties to be performed during an emergency; the regulations do not require that crewmembers receive in-depth knowledge and training in how to perform those duties. Before the fire, NY Waterway, in accordance with Federal regulations, had provided basic familiarization instruction to its new employees and had required that regular fire drills be held under the direction of the vessel master. The instruction and drills, however, were not adequate to enable the crew to properly respond to the fire on the Port Imperial Manhattan. The Safety Board, therefore, concludes that the crewmembers’ firefighting efforts were ineffective in controlling or extinguishing the Port Imperial Manhattan fire because they lacked adequate firefighting training. The Safety Board has investigated past accidents on small passenger vessels where crew training in emergency procedures was a concern. On December 3, 1994, the small passenger vessel Argo Commodore, with 4 crewmembers and 41 passengers on board, was about 1 hour into a dinner cruise of San Francisco Bay, California, when crewmembers discovered a fire in the engineroom. In analyzing the crew’s handling of the emergency, the Safety Board found their response effort was inadequate, in part, because they had not participated in firefighting or evacuation drills and had been given ineffective on-the-job

Analysis 34 Marine Accident Report training.30 As a result of its findings in the Argo Commodore accident investigation, the Safety Board issued the following safety recommendations to the Coast Guard: M-95-40 Establish mandatory standards for qualifications and training of crewmembers aboard small passenger vessels. M-95-42 Verify crew competence and company preplanning for emergencies either by routinely witnessing emergency drills at every annual inspection or by some other means of regulatory oversight. On January 10, 1996, the Coast Guard revised 46 CFR 185.524 requiring that Coast Guard marine inspectors conduct emergency drills during their annual inspections of vessels and log when such drills were conducted. In its August 6, 1996, letter advising the Safety Board of the regulatory change, the Coast Guard stated that the new requirement for on-board emergency training and drills satisfied the intent of both Safety Recommendations M-95-40 and M-95-42. The Safety Board agreed that the regulatory revision satisfied the intent of Safety Recommendation M-95-42 and classified that recommendation “Closed–Acceptable Alternate Action.” The Safety Board disagreed that the regulatory revision addressed the need for emergency qualification and training standards for crewmembers on small passenger vessels, and, on March 12, 1997, classified Safety Recommendation M-95-40 “Closed–Unacceptable Action.” Effective marine firefighting requires responders to identify the phase and class of the fire and to determine the most efficient way to extinguish it. Firefighters have to understand basic fire chemistry, be aware of the causes of fire phenomena, such as flashover and backdraft, and know the procedures for properly executing both direct and indirect attacks on a fire. Firefighters must also know the proper use and limitations of extinguishing agents and firefighting equipment and the personal safety procedures to follow in conducting firefighting operations. From the actions of the Port Imperial Manhattan’s crewmembers during this emergency, it is clear that, despite participating in regular drills, the crew lacked the basic knowledge of proper firefighting procedures and that their lack of knowledge rendered their efforts ineffective. There is a distinct difference between on-board drilling and formal training. Specifically, drilling reinforces training by applying the techniques learned to specific vessels and crews. As shown in the Argo Commodore and the Port Imperial Manhattan fires, such instruction and drills did not provide adequate training for the crews to respond correctly to the fire emergency. To its credit, NY Waterway has voluntarily instituted a new training program for all its crewmembers, including captains and deckhands, which 30 For more information, see National Transportation Safety Board, Fire Aboard U.S. Small Passenger Vessel Argo Commodore in San Francisco Bay, California, December 3, 1994, Marine Accident Report NTSB/MAR-95-03 (Washington, DC: NTSB, 1995).

Analysis 35 Marine Accident Report includes at least 1 day of training in marine firefighting. Such training probably should make the company’s crews more knowledgeable of proper fire response measures. The Safety Board considers it equally important for other small passenger vessel operators in the commuter trade to provide fire safety training to their deckhands. If a fire breaks out on board a commuter vessel, the deckhands will be required to fight or control it until outside assistance can arrive. For their safety and for the safety of the passengers on board, these deckhands should be trained in the proper procedures to follow and the actions to take for all foreseeable fire scenarios. The Safety Board concludes that the lack of formal emergency training for crewmembers on small passenger vessels leave them unprepared to handle emergencies and, therefore, creates an unsafe environment for the traveling public. The Safety Board, therefore, believes that the Coast Guard should establish firefighting training requirements for crewmembers on board small passenger vessels in commuter and ferry service. The Safety Board recognizes that the regulatory process takes a long time to complete and is convinced that some interim measure to provide improved training for these deckhands is needed to improve fire safety on small passenger vessels. Currently, NVIC No. 1-91 provides the Coast Guard’s only guidance to the small passenger vessel industry concerning fire training and qualifications of deckhands on small passenger vessels. This document, however, contains merely a general outline of subject areas that deckhands should “be familiar with” rather than detailed guidance. Small passenger vessels in commuter and ferry service carry millions of passengers each year and these vessels, as shown by the Port Imperial Manhattan and by the Seastreak New York, continue to be vulnerable to fire. In light of the time needed to promulgate new regulations and of the high number of passengers at risk, the Safety Board believes that, as an interim measure, the Coast Guard should revise NVIC No. 1-91 so that it provides more in-depth guidance in training and drills for firefighting on board small passenger vessels. Safety of Passengers The safety of the passengers was the primary responsibility of the master and crew of the Port Imperial Manhattan. However, based on the postaccident statements from the passengers on the Port Imperial Manhattan, they were left to their own devices and more or less fended for themselves throughout the emergency. When the fire was discovered, several of the eight passengers were in the main cabin and the others were on the upper deck. After one of the deckhands expended a portable fire extinguisher into the engineroom, he instructed the passengers in the main cabin to go to the foredeck. However, he did not inform them of the seriousness of the situation or provide them with lifejackets before they left the passenger cabin. When the passengers arrived at the foredeck, no crewmember was there to instruct them in emergency procedures or to manage their safety. The master, correctly, initially had to remain in or near the pilothouse to sound the ship’s whistle to alert nearby vessels that the Port Imperial Manhattan was in distress because of the loss of electrical power and radio communications capability.

Analysis 36 Marine Accident Report The passengers milled about on the foredeck and began to discuss among themselves what they should do to protect themselves from the fire. One passenger, at her own initiative, used her cellular telephone to contact the 9-1-1 emergency operator to report the fire and to call for assistance. Other passengers considered whether they were going to have to abandon ship. Neither the master nor the deckhands could attend to the passengers during the early stages of the emergency because the crewmembers were trying to extinguish the fire or to alert others to their situation. The inability of the crew to manage the passengers caused some passengers to panic and take actions that potentially placed them in jeopardy. One passenger reentered the smoke-filled passenger cabin to retrieve lifejackets for him and the other passengers. This action placed him in a life-threatening situation in which he could have been overcome by the smoke before he could make it safely back to the foredeck. Another passenger, after hearing an explosion on board the vessel, had to be restrained from jumping into the river. Given the low visibility at night, the swiftness of the current, and the coldness of the water, a passenger jumping over the side without a lifejacket probably would have drowned before being located and rescued by emergency responders. Consequently, the Safety Board concludes that the crew of the Port Imperial Manhattan were unable to properly manage the passengers during the emergency because they were over tasked with fighting the fire and lacked adequate resources and training. During a shipboard emergency, crewmembers need to be able to take appropriate action to deal with the emergency and to protect their own safety as well as the safety of passengers. However, in order for crewmembers to maintain control of the passengers during an emergency, they must be properly trained. Crowd management courses should include, at a minimum, training in the following areas to enable crewmembers to assist passengers during emergencies: • Awareness of emergency plans and instructions and the knowledge of emergency exits and evacuation restrictions; • Ability to assist passengers en route to muster and embarkation stations, including how to give clear reassuring orders, how to control passenger movement, how to keep escape routes clear of obstructions, how to evacuate disabled people and those needing special assistance, and how to search accommodation spaces; and • Knowledge of effective mustering procedures, including the ability to use effective procedures for keeping order and for reducing and avoiding panic and the ability to ensure that the passengers have donned their lifejackets correctly. The instruction and drills provided to the crew of the Port Imperial Manhattan did not prepare them for providing the necessary control of the passengers during the fire emergency. Fortunately, only eight passengers were on board at the time of the fire. However, the vessel was certificated to carry as many as 350 passengers at one time and if more passengers had been on board and if they had panicked or taken actions that placed them in jeopardy, the consequences could have been significantly more serious. The Safety Board, therefore, concludes that, without proper training, the masters and

Analysis 37 Marine Accident Report deckhands on small passenger vessels in commuter and ferry service are ill-prepared to control large numbers of passengers during fires or other shipboard emergencies. Consequently, the Safety Board believes that the Coast Guard should require that owners and operators of small passengers vessels in commuter and ferry service provide crowd control training to their vessel operating crews. The Safety Board furthermore believes that, in the interim, before regulatory requirements become effective, the Coast Guard should revise NVIC No. 1-91 to provide detailed guidance for the small passenger vessel industry concerning proper crowd control management procedures for masters and deckhands to follow during a shipboard fire or other emergency. Lifejacket Stowage On the Port Imperial Manhattan, all of the passenger lifejackets were stowed in lockers at the aft end of the main cabin, next to the engineroom door, rather than distributed throughout the vessel. A passenger and, later, the master entered the smoke- filled cabin, risking serious injury, to retrieve lifejackets for the passengers. Adult- and child-size lifejackets were not segregated in the lockers. Therefore, when the lifejackets were distributed, an adult passenger mistakenly received a child-size one. Lifejackets are essential safety appliances that should be donned by the passengers in the earliest moments of a fire. Passengers may have to retrieve and don lifejackets without assistance because the crewmembers may be devoting all of their attention to the fire. Stowing lifejackets in one area on board a vessel makes them vulnerable to becoming inaccessible during an emergency. For example, if a fire occurs between the vessel’s occupants and the stowage area, retrieving the lifejackets might be impossible. Using a single stowage area can also cause serious problems even when the area is not physically cut off. If a vessel were carrying a large number of passengers and they had to retrieve lifejackets from a central location, the crush of people all heading to the same location could incite panic and cause injury. In addition, stowing child-size lifejackets with adult-size lifejackets increases the chances that passengers will receive the wrong size jacket during an emergency. Further, tightly wrapping and clipping the stowed lifejackets increases the risk of passengers not being able to don the lifejacket in time for the emergency. The Safety Board concludes that if the lifejacket stowage had been more evenly distributed on the Port Imperial Manhattan, the lifejackets would have been more accessible to the passengers. The port engineer for NY Waterway stated that the Port Imperial Manhattan and Port Imperial New Jersey were the only vessels in the company’s fleet that did not have lifejackets stowed beneath the seats. The New Jersey was modified during the January 2002 shipyard period so that its lifejackets were distributed throughout the vessel. Specifications for rebuilding the Port Imperial Manhattan included provisions for the proper distribution of lifejackets.

Analysis 38 Marine Accident Report The problem with lifejacket stowage is not unique to the two NY Waterway vessels. In the Argo Commodore fire, the Safety Board found that the lifejackets were not readily accessible and some passengers had difficulty donning their lifejackets. The lifejackets stowage area was obstructed and some of the lifejackets were so tightly wrapped and clipped that some passengers had difficulty unfastening the clips and, as a result, improperly donned the jackets. Based on its findings, the Safety Board asked Commodore Dining Cruises, Inc., the owner of the Argo Commodore, to correct the problems, which the company did. The Safety Board is concerned that other operators have small passenger vessels on which the stowage of lifejackets is not properly distributed and/or the lifejackets are not segregated by size. Federal regulations stipulate that that lifejackets on small passenger vessels shall be stowed so that adult- and child-size jackets are segregated from each other and that they are “in convenient places distributed throughout accommodation spaces.” Coast Guard inspectors must check the lifejackets and stowage areas during their periodic examinations. However, as a practice, the vessel operators generally remove the jackets from their stowage locations to facilitate the inspector’s review. As a result, inspectors can overlook problems related to the stowage of the lifejackets. Vessel owners are responsible for the lives of the passengers on their vessels. In the case of NY Waterway and Commodore Dining Cruises, Inc., the companies voluntarily made changes to improve stowage and distribution of lifejackets. The Safety Board believes that the Coast Guard should issue a directive to small passenger vessel operators to review the distribution of lifejackets on board their vessels and to ensure that the lifejackets are accessible and segregated. Safety Information Provided to Passengers In this accident, the passengers on the Port Imperial Manhattan did not receive a verbal safety briefing before the onset of the voyage. Several passengers indicated that they didn’t realize the potential seriousness of the situation when they were asked to move to the outer deck. Once on the foredeck, they discussed whether they needed lifejackets and what actions they might have to take. The Safety Board has long been a proponent of safety briefings on small passenger vessels, encouraging owners and/or operators to incorporate prevoyage verbal safety briefings to passengers into their operating procedures and asking the Coast Guard to make safety briefings mandatory. A verbal safety briefing serves multiple purposes. It informs the passengers about emergency procedures and refreshes the crewmembers’ understanding of those procedures. A safety briefing also gives passengers the opportunity to ask questions if they do not understand the procedures.

Analysis 39 Marine Accident Report In its investigation of the 1994 Argo Commodore accident, the Safety Board found that the safety placard on the small passenger vessel did not fulfill its intended purpose. At that time, Federal regulations gave the owner the option of using either a safety placard or a safety briefing. Based on its findings in the Argo Commodore fire, the Safety Board issued the following safety recommendation to the Coast Guard: M-95-41 Require that the operators of small passenger vessels conduct a passenger safety briefing prior to departure to include: the location of lifesaving equipment; the use of such equipment; and proper procedures to follow during the course of an emergency evacuation or other on-board emergency. As a result of this recommendation, the Coast Guard revised CFR 185.506 to require that the masters of small passenger vessels ensure that suitable public announcements are made informing all passengers of, among other safety information, the location of lifejackets, emergency exits, survival craft embarkation areas, and instructional placards for lifejackets and other lifesaving devices. The regulations also require that the crewmembers advise all passengers that they may be required to don lifejackets when hazardous conditions exist and that passengers receive a demonstration either collectively or individually on how to don a lifejacket. The regulations, however, allow an exception to the requirement for a verbal safety brief. The regulation states, in part, “Ferries operating on short runs of less than 15 minutes may substitute bulkhead placards or signs for the announcement if the OCMI determines that the announcements are not practical due to the vessel’s unique operation.” The Coast Guard had granted NY Waterway an exception from the verbal safety briefing to passengers at the onset of voyages because the trips of the company’s vessels lasted less than 15 minutes. The exception did not eliminate the requirement for safety placards, and the Port Imperial Manhattan did have placards posted in the main cabin. The Safety Board maintains that basic safety information needs to be announced to passengers on any vessel before the onset of waterborne operations, regardless of the length and duration of a voyage. An emergency can arise at any moment while the vessel is underway and, given the limited number of crewmembers per passenger, people need to be able to take basic initial actions for their own safety. Essential actions that adult passengers should be able to take include obtaining and donning lifejackets for themselves and their children and going to the proper assembly area. Vessel operators should not rely on passive notification such as posted placards to provide essential safety information to passengers. Passengers may not read placards before an emergency. On the other hand, a short verbal safety announcement can focus the attention of passengers on the basic safety information that they need to know in order to respond correctly in an emergency. Given the ready availability of technology that allows for prerecorded safety briefings to be aired over intercoms and loudspeaker systems, commuter vessels and ferries can readily provide verbal safety briefs without crewmembers having to take time away from other vessel operation activities. The Safety

Analysis 40 Marine Accident Report Board concludes that a mandatory safety briefing on emergency procedures on passenger vessels in commuter and ferry service would enhance passenger safety. The Safety Board, therefore, believes that the Coast Guard should eliminate the waiver for verbal safety briefings and require that such briefings be given to passengers on all small passenger vessels. Vessel Communications Shortly after the master saw smoke issuing from the engine vent, he made a VHF radiotelephone call to a nearby NY Waterway vessel and requested that the vessel standby. However, moments later, the Port Imperial Manhattan’s radio became inoperative when the fire burned through the cables to the pilothouse. The VHF radiotelephones on the Port Imperial Manhattan did not have an emergency power backup; none was required for the small passenger vessel because it measured less than 100 gross tons. Fortunately, a deckhand and a few passengers had personal cellular telephones and were able to contact company officials and the emergency 911 operator. A FDNY rescue boat and a NY Waterway ferry responded to the Port Imperial Manhattan and safely evacuated the passengers and crewmembers. According to the passengers, moments after the evacuation, the foredeck of the Port Imperial Manhattan, where they had been standing, was engulfed in flames. After losing power to the VHF radiotelephone, the Port Imperial Manhattan could not communicate with emergency response vessels and other river traffic. If a passenger had jumped or fallen overboard into the water, the Port Imperial Manhattan would not have been able to inform other boats, including the rescue boat, which would have further endangered the person in the water. The Port Imperial Manhattan would not have been able to inform the rescue boat of injuries to passengers or crew to ensure the availability of appropriate transport and medical service. Without a working radio, the Port Imperial Manhattan would not have been able to confirm the number of people on board. In contrast, with radio backup, the Port Imperial Manhattan’s crew could have informed the rescue boats of the seriousness of the situation and could have helped coordinate the rescue operation, perhaps hastening the process. The Safety Board concludes that the loss of VHF radiotelephone communication unnecessarily increased the risk to passengers and crewmembers. Although the Port Imperial Manhattan was less than 100 gross tons and, therefore, not required to have an emergency source of power for its VHF radiotelephone, its operator, NY Waterway, has since taken corrective action so that all its vessels have a battery backup in the wheelhouse for the communications systems. The Safety Board is concerned, however, that other operators of commuter passenger vessels measuring less than 100 gross tons might not voluntarily take such a step. The Safety Board concludes that without a backup source of power to the VHF radiotelephone, the crewmembers and passengers on small commuter vessels will be placed at increased risk in the event of a loss of power. The Safety Board believes that the FCC should require that small passenger vessels have VHF radiotelephone communications systems on board that can operate even when the vessel loses power.

41 Marine Accident Report Conclusions Findings 1. None of the following were factors in the Port Imperial Manhattan accident: weather, operator fatigue, drugs, or alcohol. 2. The fire on the Port Imperial Manhattan started in the junction box as a result of a loose connection and spread throughout the after portion of the engineroom. The open access door then allowed the fire to spread to other areas of the vessel. 3. A routine Coast Guard inspection of the vessel probably would not have detected the loose connection that led to the fire on the Port Imperial Manhattan. 4. Had NY Waterway had an effective preventive maintenance program, the loose electrical connection could have been detected before it caused the fire on the Port Imperial Manhattan. 5. The lack of fire detection systems for enginerooms on existing small passenger vessels in commuter and ferry service presents an unacceptable risk to passengers and crewmembers. 6. The lack of remotely operated fire pumps on the Port Imperial Manhattan compromised the ability of the crew to control the fire and the lack of remotely operated fire pumps on other small passenger vessels in commuter and ferry service built before March 11, 1996, similarly impairs the ability of their crews to control engineroom fires. 7. If the Port Imperial Manhattan had been equipped with a fixed fire suppression system, properly trained crewmembers could have extinguished the fire and kept it within the confines of the engineroom. 8. The safety of existing small passenger vessels in commuter and ferry service would be enhanced by the installation of fire suppression systems in their enginerooms. 9. The crewmembers’ firefighting efforts were ineffective in controlling or extinguishing the Port Imperial Manhattan fire because they lacked adequate firefighting training.

1. The lack of formal emergency training for crewmembers on small passenger vessels

leave them unprepared to handle emergencies and, therefore, creates an unsafe environment for the traveling public.

42 Marine Accident Report

1. The crew of the Port Imperial Manhattan were unable to properly manage the

passengers during the emergency because they were over tasked with fighting the fire and lacked adequate resources and training.

1. Without proper training, the masters and deckhands on small passenger vessels in

commuter and ferry service are ill-prepared to control large numbers of passengers during fires or other shipboard emergencies.

1. If the lifejacket stowage had been more evenly distributed throughout the passenger

cabin of the Port Imperial Manhattan, the lifejackets would have been more accessible to the passengers.

1. A mandatory safety briefing on emergency procedures on passenger vessels in

commuter and ferry service would enhance passenger safety.

1. The loss of VHF radiotelephone communication unnecessarily increased the risk to

passengers and crewmembers.

1. Without a backup source of power to the VHF radiotelephone, the crewmembers and

passengers on small commuter vessels are placed at increased risk in the event of a loss of power. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire aboard the Port Imperial Manhattan was NY Waterway’s inadequate inspection and maintenance of the vessel’s electrical system. Contributing to the extent of the damage were the lack of a fixed fire detection and suppression system and the crewmembers’ lack of knowledge of proper marine firefighting techniques. Conclusions

43 Marine Accident Report Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following recommendations: To the Coast Guard: Require that companies operating domestic passenger vessels develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. (M-02-5) Require that all small passenger vessels in commuter and ferry service, regardless of their date of build, be fitted with a fire detection system in the enginerooms. (M-02-6) Require that all small passenger vessels in commuter and ferry service, regardless of their date of build, be fitted with remotely operated fire pumps. (M-02-7) Require that all small passenger vessels in commuter and ferry service, regardless of their date of build, be fitted with a fixed fire suppression system in their enginerooms. (M-02-8) Establish firefighting training requirements for crewmembers on board small passenger vessels in commuter and ferry service. (M-02-9) Revise Navigation and Vessel Inspection Circular No. 1-91 so that it provides more in-depth guidance in training and drills for firefighting on board small passenger vessels. (M-02-10) Require that owners and operators of small passengers vessels in commuter and ferry service provide crowd control training to their vessel operating crews. (M-02-11) Revise Navigation and Vessel Inspection Circular No. 1-91 to provide detailed guidance for the small passenger vessel industry concerning proper crowd control management procedures for masters and deckhands to follow during a shipboard fire or other emergency. (M-02-12) Issue a directive to small passenger vessel operators to review the distribution of lifejackets on board their vessels and to ensure that the lifejackets are accessible and segregated. (M-02-13)

44 Marine Accident Report Eliminate the waiver for verbal safety briefings and require that such briefings be given to passengers on all small passenger vessels. (M-02-14) To NY Waterway: For the vessels in your fleet, develop and implement a preventive maintenance program for systems affecting safe operation, including the hull and the mechanical and electrical systems. (M-02-15) To the Passenger Vessel Association: Provide your members with guidelines for developing a preventive main- tenance program for all systems affecting the safe operation of their ves- sels, including the hull and the mechanical and electrical systems. (M-02-16) To the Federal Communications Commission: Require that small passenger vessels have VHF radiotelephone communications systems on board that can operate even when the vessel loses power. (M-02-17) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman JOHN A. HAMMERSCHMIDT Member CAROL J. CARMODY Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: June 11, 2002 Recommendations

45 Marine Accident Report Appendix A Investigation The Safety Board was notified of this accident at 2135 on November 17, 2000, by the New York City Office of Emergency Management and dispatched an investigator to the scene. During the on-scene investigation, which concluded on November 22, 2000, the vessel was examined and the vessel’s crew, company officials, passengers, and cognizant U.S. Coast Guard officials were interviewed. The U.S. Coast Guard and New York Waterway were named as parties to the investigation.

46 Marine Accident Report Appendix B Navigation and Vessel Inspection Circular No. 1-91 COMDTPUB B 16700.4 NVIC 1-91 20 Feb 1991 NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 1-91 Subj: Recommended Qualifications for Small Passenger Vessel Deckhands Ref: (a) 46 CFR Part 15 (b) Marine Safety Manual Volume III Chapter 19

1. PURPOSE. The purpose of this circular is to provide the Marine Industry with

guidelines for the recommended qualifications and training topics for deckhands engaged or employed on small passenger vessels to ensure the safe operation of these vessels. This circular also discusses the concept of SENIOR DECKHAND.

1. BACKGROUND.

a. Various statutes in Title 46 United States Code, the implementing regulations in Title 46 Code of Federal Regulations part 15, and the Marine Safety Manual, volume III, chapter 19, provide the requirements for vessel manning. In recent years there has been an increase in the number of innovative vessel designs tailored to take advantage of the admeasurement exemptions that have resulted in Small Passenger Vessels with significantly increased passenger capacity over what was envisioned when the current manning and deckhand qualification scheme was developed. In some cases, vessels over 200 feet long, carrying in excess of 1,000 passengers and on international routes have been admeasured at less than 100 gross tons. This increase in vessel capacity has raised concerns on the part of the Coast Guard, industry and others regarding the level of training and qualifications of the deckhands employed on all Small Passenger Vessels. b. The Coast Guard and the industry recognize that a Small Passenger Vessel’s licensed officer(s) would be unable to navigate the vessel and effectively respond to emergencies such as fire, engineering casualties, collision, flooding, medical emergencies, man overboard, etc. without the assistance of trained and qualified deckhands. Department of Transportation United States Coast Guard

47 Marine Accident Report c. The Coast Guard, in consultation with the industry, has determined that the best approach to improving deckhand training and qualifications is to allow the industry to undertake a voluntary training program which will provide an increased level of knowledge and skill for their crew members. The Coast Guard believes that because of the generally high level of responsibility and concern displayed by the industry that this approach will be both successful and cost effective.

1. DISCUSSION.

a. The employment and training of qualified deckhands is the responsibility of the marine employer (46 CFR 15.103). The Coast Guard is issuing, by means of this NVIC, recommended criteria for assessing the qualifications of an individual deckhand. b. The Marine employer is responsible for ensuring that an individual engaged as a deckhand on a small passenger vessel: (1) Meets the minimum physical requirements; (2) Is familiar with the location of equipment and procedures; and (3) Has demonstrated the ability to respond to emergency situations. c. This NVIC is not intended to be all encompassing nor indicative of the topics of training for every deckhand, but rather it is a general guide that should be adapted to individual vessel operations. d. At the discretion of the Officer in Charge, Marine Inspection, some or all of the deckhands may be permitted to perform duties such as concessionaires, waiters or waitresses provided that they can readily respond to their regularly assigned deckhand duties. However, cooks and foodhandlers should not normally be accepted as deckhands, because of their employment status and good health practices. e. The Coast Guard is responsible for determining that Small Passenger Vessels are manned with competent crews. The method of accomplishing this is left to the discretion of the Officer in Charge of Marine Inspection (OCMI). In general, this is accomplished by relying on the vessel inspection process including the proper performance of emergency drills and the questioning of the crew on duties assigned and/or a review of the company training program. There is no intent that company training programs undergo any formal Coast Guard approval process.

1. ACTION.

a. The guidelines contained in this circular apply to Small Passenger Vessels and are intended for use by Small Passenger Vessel owner/operators and masters of vessels less than 100 gross tons. Enclosure (1) provides guidance for marine employers and masters of Small Passenger Vessels to use when structuring training programs for deckhands. Appendix B

Appendix B 48 Marine Accident Report b. OCMI’S should use this circular as guidance during inspections for certification and reinspections, when evaluating training programs, and during drills conducted to ensure crew competency. c. The criteria proposed should be tailored to specific vessel needs on the basis of: (1) Operating conditions of the vessel on which the deckhand is employed; (2) Overall vessel complexity; (3) Number of passengers carried; and (4) The specific duties the deckhand is expected to perform. End: (1) Recommended Qualifications for Deckhands on Small Passenger Vessels RECOMMENDED QUALIFICATIONS FOR DECKHANDS ON SMALL PASSENGER VESSELS I. Every deckhand on a small passenger vessel should be at least 16 years of age, should be qualified as to sight, hearing, and physical condition to perform the deckhand’s duties and should be physically able to perform all duties associated with the protection and evacuation of passengers during emergency situations. II. Every deckhand should be familiar with the following matters relating to emergency conditions: A. Man Overboard.

1. Location and use of lifesaving equipment.
2. The vessel’s maneuvering characteristics.
3. Emergency communications skills.
4. Proper recovery procedures.
5. Station bill assignment/duties.

B. Fire.

Appendix B 49 Marine Accident Report

1. Fire detection and alarm systems.
2. Classes of fires and the appropriate fire fighting technique.
3. Location and operation of fire fighting equipment.
4. Location and operation of power, ventilation and fuel shut-offs.
5. Location and operation of watertight doors, hatches, fire-screen doors and

escapes.

1. Mustering passengers.
2. Station bill assignment/duties.

C. Abandon Ship.

1. Location, launching, and operation of survival equipment and craft (this

includes, but is not limited to lifeboats, liferafts, buoyant apparatus, lifefloats, survival suits, and personal flotation devices).

1. Proper method of abandoning the vessel, mustering and debarking passengers.
2. Proper emergency communications procedures (i.e., EPIRB, distress signals).
3. Station bill assignment/duties.

D. Foul Weather.

1. Location and operation of watertight and weathertight closures.
2. Means of access to weather information.
3. Location and operation of bilge and emergency pumping systems.
4. Station bill assignment/duties.

E. Medical Emergency.

1. Red Cross certified in first aid and CPR. (Minimum of 50 percent of required

deckhands) F. Collision.

1. Location of watertight doors.
2. Methods of dewatering.
3. Station bill assignment/duties.

Appendix B 50 Marine Accident Report III. Deckhands assigned to seamanship duties, engineering or passenger safety/control duties should be familiar with the appropriate vessel operational matters based on their assigned positions: A. Bridge.

1. All navigational equipment, engine alarms/indicators, controls, gauges, and

communication procedures. B. Engineering.

1. Main and auxiliary machinery, steering systems, alarms, refueling techniques,

and emergency procedures (i.e., fuel, electrical, ventilation, etc.).

1. In instances where a larger vessel with complex engineering systems or other

factors has been required by the OCMI to have unlicensed engineers in the required complement, these individuals will require a greater in-depth knowledge of and training in the subjects noted above. The OCMI may require specific training and qualification requirements for these individuals. C. Safety.

1. Crowd control, rigging, line handling, casualty control, first aid and CPR.

D. Vessel Assistance.

1. Search and rescue techniques, towing, and superior shiphandling skills.

E. Seamanship.

1. Knots, linehandling, docking/undocking procedures, and basic navigation (i.e.,

piloting, deadreckoning). IV. Senior Deckhand. A. In many situations it is important for the vessel’s master to have available a more highly qualified deckhand, for example where the Officer in Charge, Marine Inspection has allowed the deletion of the required mate. In addition to having a more in- depth knowledge of the above subjects, the SENIOR DECKHAND should also have practical experience on the vessel on which he or she is serving. The recommended experience for the SENIOR DECKHAND is:

1. 30 days experience on board the vessel.
2. 30 hours at the helm under supervision of a master or mate.

B. The SENIOR DECKHAND will provide an increased level of experience on vessels where there is only one licensed officer required. The SENIOR DECKHAND will

Appendix B 51 Marine Accident Report be responsible for supervising the other deckhands while the vessel is underway and act as the team leader in response to any emergencies on board. He or she will be able to assist the master in the operation of the vessel, and will be available to operate the vessel in the event the master becomes incapacitated. In order to properly identify this individual, the vessel’s master should designate the SENIORDECKHAND in writing and a copy of this designation should be retained on board the vessel.

52 Marine Accident Report Appendix C History of Regulations for Small Passenger Vessels The term “small passenger vessel” generally includes any vessel of less than 100 gross tons that is certified to carry more than six passengers for hire. The first Federal requirements governing these vessels became effective June 1, 1958, as Subchapter T (46 CFR Parts 175-187). As these regulations became outdated, the Coast Guard initiated a project to revise Subchapter T in 1982 and established a regulatory docket in 1985. On January 30, 1989, the Coast Guard issued a notice of proposed rulemaking (NPRM), titled “Small Passenger Vessel Inspection and Certification,” proposing a complete revision to the regulations. Based on the numerous comments received in response to this NPRM, including those from the Safety Board, the Coast Guard revised the NPRM extensively and published the new proposed regulations in its supplemental notice of proposed rulemaking (SNPRM) on January 13, 1994. The Coast Guard again received numerous comments, based on which the Coast Guard published an Interim Final Rule (IFR) on January 10, 1996, which became effective on March 11, 1996. The Coast Guard stated that an IFR was necessary for publishing an enforceable rule, while allowing public comment. In the Federal Register issue of September 30, 1997, the Coast Guard announced that it was adopting the IFR (with minor changes) as a Final Rule, effective October 30,

1. The new rules were intended to address changes that had occurred in the passenger

vessel industry since the early 1960s, such as increases in vessel size and passenger capacity, increases in services, expansions of vessel routes, and technological advances.

FD07227 ｜ 2000_美国_NTSB_MBR0101_Fire_on_Board_the_NetherlandsRegistered_Passenger_Ship_Nieuw.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 MARINE ACCIDENT BRIEF REPORT PB2001-916402 NTSB/MBR-01/01 FIRE ON BOARD THE NETHERLANDS- REGISTERED PASSENGER SHIP NIEUW AMSTERDAM GLACIER BAY, ALASKA MAY 23, 2000 7377

this page intentionally left blank

Marine Accident Brief Report Fire On Board the Netherlands- Registered Passenger Ship Nieuw Amsterdam Glacier Bay, Alaska May 23, 2000 NTSB/MBR-01/01 PB2001-916402 National Transportation Safety Board Notation 7377 490 L’Enfant Plaza, S.W. Adopted July 24, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Fire On Board the Netherlands-Registered Passenger Ship Nieuw Amsterdam, Glacier Bay, Alaska, May 23, 2000. Marine Accident Brief Report NTSB/MBR-01/01. Washington, DC. Abstract: This report discusses the May 23, 2000, fire that occurred on the Netherlands-registered passenger ship Nieuw Amsterdam, while it was en route to Glacier National Park. None of 1,169 passengers and 542 crewmembers on board the vessel was killed or sustained serious injury; however, one passenger suffered smoke inhalation injuries requiring evacuation to a shoreside hospital for additional medical treatment. Damages related to the accident exceed $360,000. From its investigation of this accident, the National Transportation Safety Board identified safety issues in the following areas: the adequacy of shipboard training and drills in firefighting management for masters and other officers; the adequacy of Holland America’s policies, procedures, training, and drills for limiting and controlling the spread of smoke during a fire; and the adequacy of Holland America’s safety management oversight of shipboard firefighting operations. Based on its findings, the Safety Board made recommendations to the U.S. Coast Guard, Holland America Lines, Inc., American Classic Voyages, Carnival Corporation, Inc., Crystal Cruises, Disney Cruise Line, Norwegian Cruise Line, Orient Lines, P&O Princess Cruises International, Ltd., Radisson Seven Seas Cruises, Regal Cruises, Renaissance Cruises, Inc., Royal Olympic Cruises, Royal Caribbean Cruises, Ltd., and Silversea Cruises, Ltd The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Initial Response to Smoke Detector Alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Firefighting Efforts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Actions on Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Passenger Muster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Safety Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

this page intentionally left blank

1 Marine Accident Brief Report Executive Summary On the morning of May 23, 2000, while the Netherlands-registered passenger ship Nieuw Amsterdam was en route to Glacier National Park with 1,169 passengers and 542 crewmembers on board, a fire broke out in a crew cabin. A premature effort to extinguish the fire by officers lacking proper gear and backup contributed to the spread of fire and smoke. The fire did not spread beyond the deck of origin; however, the untimely closing of fire screen doors allowed the smoke to migrate up eight decks, creating hazardous conditions in crew and passenger accommodations. Properly outfitted and equipped shipboard firefighting teams subsequently extinguished the fire. One passenger sustained smoke inhalation injuries requiring evacuation to a shoreside hospital for additional medical treatment. Property damage to the vessel was estimated at more than $360,000. Accident Description On May 23, 2000, the Netherlands-registered passenger ship Nieuw Amsterdam, operated by Holland America Line Westours, Inc. (Holland America), was carrying 1,169 passengers and 542 crewmembers while en route to Glacier National Park as part of a 7-day cruise between Vancouver, British Columbia, and Seward, Alaska. (See figure 1.) At 0911, when the ship was about 5 miles north of Russell Island, in the Tarr Inlet, an alarm sounded on the bridge’s fire detection system console, indicating that a smoke detector in a crew cabin on D deck had activated. Figure 1. Approximate location of the Nieuw Amsterdam when the fire broke out. Tarr Inlet GLACIER BAY Muir Inlet Russell Island UNITED STATES CANADA

ALASKA GULF OF ALASKA JUNEAU Boxed area is enlarged above

Accident Description 2 Marine Accident Brief Report At the time of the fire alarm, senior officers with emergency command and control responsibilities, as listed in Holland America’s Safety Management System (SMS), were in various areas of the ship. The master, who had responsibility for the safety of the ship, was on the bridge. The chief officer, who had responsibility for directing firefighting command and control operations, was in his cabin, aft of the pilothouse. The safety officer, who had responsibility for the firefighting drills and training and the command of one of the two fire squads, was doing routine maintenance on D deck. The chief engineer, who had responsibility for ensuring the safe operation of the propulsion, steering, and other engineering systems, was in the engine control room. The second engineer, who was the commander of the second fire squad, as well as the operational backup for the chief engineer, was also in the engine room. Initial Response to Smoke Detector Alarm In addition to the master, the on-duty bridge crew included two deck officers, two quartermasters, a lookout, and an Alaska State-licensed pilot.1 The on-duty third officer stated that when the alarm sounded, he followed company procedures and informed the master of a possible fire on D deck and ordered one of the quartermasters to investigate to ensure that it was not a false alarm. He advised the quartermaster to carry a full-face cartridge respirator (smoke mask), as well as a UHF radio so he could report his findings. The quartermaster descended to D deck, eight decks below the navigation deck, and proceeded aft about 250 feet to the area where the smoke detector had activated. (See figure 2.) After passing fire screen door (FSD) D1, he observed smoke overhead and donned his smoke mask. (See figure 3.) Upon arriving at cabin D98, he saw smoke coming through the ventilation louvers in the lower section of the cabin door. He tried the door, but it was locked. He said that he immediately radioed a report of his observations to the third officer on the bridge, who, in turn, informed the master that smoke was coming from cabin D98.2 Based on the third officer’s description of the quartermaster’s account, the master called the chief officer, who was in his cabin on the navigation deck, and directed him to investigate the fire on D deck. The chief officer later stated that he knew that Holland America’s SMS procedures stipulated that, in the event of a fire, he was to command firefighting operations from the bridge. However, at the direction of the master, he went to D deck to investigate the fire. 1 The pilot was a member of the Alaska Coastwise Pilots Association. 2 Because of its date of construction, the Nieuw Amsterdam was not required by the International Convention for the Safety of Life at Sea (SOLAS) to have fire sprinklers in its crew and passenger accommodations areas.

Accident Description 3 Marine Accident Brief Report Meanwhile, the quartermaster on D deck started alerting off-duty crewmembers by yelling “fire” and “smoke” and by pounding on the cabin doors in the affected area.3 He said that he met a crewman who had retrieved a dry chemical extinguisher from an adjacent passageway and a room steward who happened to have a passkey to cabin D98. The quartermaster opened the cabin door, and the crewman discharged the dry chemical extinguisher into the room. The quartermaster said that “a lot of smoke” came out of the cabin, whereupon he immediately closed the door to contain the smoke. At this time, several officers were either on or entering nearby areas of D deck. The safety officer and another deck officer were doing routine maintenance on watertight door (WTD) WD19. An officer who had been recently assigned as a fourth officer4 on the ship was walking through the area to join the other officers. In response to the smoke or to the quartermaster’s shouts of “fire,” the officers ran toward D98. The fourth officer arrived first and directed two crewmen to help her retrieve a fire hose. She said that as they were unrolling the hose, the safety officer arrived and ordered her to call the bridge and report the fire. At the direction of the bridge, the officers and crewmen then left the smoke-filled cabin area and reported to either a marshalling area or an emergency station. Figure 2. When the first alarm sounded on the fire detection system control panel, the third officer ordered a quartermaster who was on duty on the bridge to go to the affected area (indicated by the circle) to determine whether the alarm was false. The dotted line shows the route of the quartermaster from the bridge to cabin D98. 3 The Nieuw Amsterdam did not have locally sounding smoke alarms in the accommodations areas. 4 The fourth officer is a junior deck officer on the ship. Sun Deck

Accident Description 4 Marine Accident Brief Report Upon receiving the officer’s report of the fire and learning that the crewmembers had not been successful in their firefighting efforts, the master, at 0919, ordered the general alarm sounded. The general alarm alerted passengers of the need to proceed to their muster stations and shipboard firefighting teams of the need to marshal at their assigned staging areas. The master did not radio the chief officer to return to his emergency station on the bridge. Instead, the master assumed the command and control of firefighting operations; the duties of this position required him to coordinate the onboard firefighting, control the spread of smoke and fire, handle the internal communications, and coordinate the evacuation of passengers and crewmembers. He was still responsible for performing his regular duties as master, as well as his own emergency command duties, which, in this case, included making announcements to the passengers, identifying and Figure 3. Plan view of a portion of D deck. The fire started in cabin D98. Within 6 minutes of the initial smoke alarm activation at 0911,detectors began to activate near the crew stairwell forward of FSD D1.

Accident Description 5 Marine Accident Brief Report navigating to a safe area to anchor, and handling the external communications with the U.S. Coast Guard (Coast Guard), shoreside emergency response agencies and Holland America’s shoreside offices. As the chief officer was descending from the navigation deck to the area of the fire, he said, he heard the general alarm and smelled smoke on C deck. He did not contact the bridge to confirm whether he should report to his emergency station or to tell the master that smoke had spread beyond D deck. When he reached D deck, he met the quartermaster in the stairwell, standing by FSD D1, which was slightly open. The chief officer grabbed and donned the quartermaster’s smoke mask and instructed him to keep the door closed. The chief officer said that when he entered the main passageway, he observed “a small amount of smoke.” He then walked through the passageway and adjacent corridors, pounding on doors and yelling for people to evacuate. He said that while he walked along the passageway toward cabin D98, he could feel heat radiating from the cabin’s inboard bulkhead. He then saw “thick, white smoke” streaming through the louvers of the D98 door and observed that a layer of smoke about 1 meter thick had filled the upper area of the passageway. He stated that he crouched beneath the layer of smoke and continued his sweep of the area, checking to ensure that no crewmembers were in their cabins. He said that as he approached WD15,5 the WTD at the main vertical zone bulkhead, he found the door partially open and an uncharged fire hose on the deck. The chief engineer was in the engine control room when the first 0911 alarm sounded indicating a smoke detector had activated in D98. When the general alarm sounded at 0919, he checked the operation of the fire pump and mustered engineering personnel. He said that he then left his emergency station to check the area of the activated smoke detector because he had noted on the fire detection system’s repeater in the engine room that the detector was not far from the engine room. Once on D deck, he saw the chief officer near the partially open WD15. The chief engineer said that the chief officer told him to stand by a fire hydrant valve. The chief officer then picked up the uncharged hose and, crouching under the thickening layer of smoke, proceeded forward toward cabin D98. (See figure 4.) Neither of the men had fire protection gear, such as a self-contained breathing apparatus (SCBA), fire suit, gloves, or helmets. The only gear that the chief officer wore was the smoke mask that he had taken from the quartermaster. After positioning himself near the closed door of D98, the chief officer shouted at the chief engineer to pressurize the hose line. The chief officer said that, while he stood in front of cabin D98, he could feel intense heat radiating from it, an indication that the fire was now fully developed. He partially opened the cabin door and could hear the fire, but could not see any flames. He bent down low to the deck and sprayed a straight stream of water into the cabin for about 30-40 seconds. He said that intense heat, white smoke, and steam came rushing out of the cabin door, forcing him back, whereupon he dropped the charged hose and retreated to WD15. He and the chief engineer then exited the area, 5 WD15 also serves as the FSD in this fire boundary.

Accident Description 6 Marine Accident Brief Report

closing the WTD behind them. Although the chief officer could not remember whether he had closed the door to cabin D98, subsequent events showed that he had not. Firefighting Efforts When the general alarm sounded, the ship’s firefighting assets mobilized, which involved donning full fire protection gear at their assigned muster area. Holland America’s emergency procedures for the Nieuw Amsterdam establish two onboard firefighting organizations, Alpha squad and Bravo squad. (See table 1.) Each squad was to be composed of two attack teams. The Alpha squad was responsible for vessel spaces outside engineering, which included the crew accommodations areas, and the Bravo squad was responsible for the engineering spaces. Figure 4. The attempt to extinguish the fire by the chief offier and the chief engineer. D98 D1 WD15 The chief officer and the chief engineer did not don protective fire gear or arrange for backup in their attempt to extinguish the fully developed fire in crew cabin D98. When the chief officer directed a spray of water into the cabin, heat, smoke, and steam rushed out, causing the chief officer to drop the fire hose. He retreated to WD15 without closing the door to D98 Chief Engineer Chief Officer

Accident Description 7 Marine Accident Brief Report The bridge ordered the Alpha squad to position itself forward of WD16 in preparation for the assault on the fire. Only one of the two Alpha attack teams proceeded to the area of the fire. This unit, the Alpha 1 attack team, had three, rather than four, members and consisted of the fourth officer and two crewmen on the hose line. While the Alpha 1 attack unit proceeded to D deck, it was joined by the Alpha squad commander and assistant commander. On C deck, the group encountered smoke and donned SCBAs before continuing. Once the group members reached D deck, they rigged a hose line. The Alpha squad assistant commander then returned to C deck to turn off the electrical power to WD15 and WD16 so that the fire teams could open them. The Alpha squad commander and assistant commander both had UHF radios with which they could communicate with the bridge and with the Bravo squad. Table 1. Nieuw Amsterdam’s Firefighting Assetsa a. Personnel records indicate that all Nieuw Amsterdam personnel designated as having a command or support role in a fire emergency had attended firefighting training, as required by the International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers. All unlicensed personnel and deck officers had attended the basic firefighting course. In addition; all officers had attended the advanced firefighting course, which discusses principles of command and control. Typically, the recommended practice is for deck and engineering officers to direct the actions of the fire teams and not take a lead position in firefighting activities such as handling the fire hoses. The ship’s log indicates that the Nieuw Amsterdam conducted periodic emergency fire drills, as required by International Convention for the Safety of Life at Sea (SOLAS). Alpha Squad Bravo Squad Commander Senior Second Officer (Safety Officer) Second Engineer Asst. Cmdr. Third Officer Third Engineer Responsibility All vessel spaces outside engineering Engineering spaces Squad Composition Two attack teams • Alpha 1 • Alpha 2 Hose preparation team Staging area team Two attack teams • Bravo 1 • Bravo 2 Hose preparation team Staging area team Attack team composition Four members Deck officer Three unlicensed crewmembers • Two attend the hose line • One serves as backup, assisting as needed with donning and hoses Four members Engineering officer Three unlicensed crewmembers • Two attend the hose line • One serves as backup Fire gear Team members who are for entry and attack are fully suited in fire turnout gear and SCBA. The squad commanders and the attack team commanders carry UHF radios.

Accident Description 8 Marine Accident Brief Report In the meantime, the master ordered the Bravo squad to position an attack unit at WD15 and to backup the Alpha 1 team. The Bravo squad commander (the second engineer) chose to have the Bravo 1 attack team consist of himself, the assistant squad commander (the third engineer), and a day engineer. The third engineer had a UHF radio with which to communicate with the master and with the Alpha squad. The Bravo 1 attack team rigged a fire hose to extend from the boiler room toward WD15. While the team members were proceeding down from C deck, they met the chief officer and the chief engineer. The chief officer told the second engineer where the fire was and that a charged hose line was unrolled on the deck, forward of WD15. The chief engineer returned to his emergency station in the engine control room and the chief officer returned to the bridge to assume the command of the firefighting efforts from the master. The chief officer said that while he was en route to the navigation deck, he observed smoke on both C and B decks. About 0929, the Alpha 1 attack team and the Bravo 1 attack team both radioed the master that they were in position, forward of WD16 and aft of WD15, respectively. The master ordered the Alpha 1 team to attack the fire. The Alpha squad commander said that he opened WD16 and a lot of black smoke rushed out, reducing visibility to almost zero. The hose team advanced through FSD D1 into the passageway, giving shorts blasts of water to the overhead and bulkhead panels. (See figure 5.) The team leader (the fourth officer) followed the hose team. The squad commander indicated that because the team leader was new to the ship, he followed her to monitor her actions. When the attack team Figure 5. The Alpha 1 attack team’s effort to fight the fire was abandoned when the team’s leader, the fourth officer, collapsed. D98 D1 WD15 When the Alpha 1 attack team entered the smoke-filled area through FSD D1, the fourth officer collapsed. The Alpha squad commander picked her up, carried her back through WD16 (not shown), and took her above deck. The other Alpha 1 team members also withdrew through WD16. Fourth Officer

Accident Description 9 Marine Accident Brief Report members were a few feet into the passageway, the team leader collapsed,6 and the squad commander picked her up and carried her back through WD16. The rest of the Alpha team followed, and they closed WD16 behind them. The squad commander then directed the squad assistant commander to take command of the hose team and stand by while he took the team leader to B deck. When the team leader appeared to be all right, the Alpha squad commander later returned to D deck. At 0930, upon overhearing radio communications between the Alpha squad and the bridge, the Bravo 1 attack team radioed the bridge that it was entering the area through WD15. The second engineer said that he took the fire hose nozzle and led the attack. He had the day engineer serve as backup on the hose and the third engineer follow with a flashlight and a UHF radio. (See figure 6.) The Bravo 1 attack team members entered the passageway on their knees. The second engineer said that the main passageway was filled with thick black smoke but had a light draft of air moving through it. He said that when he sprayed the overhead, he saw burned paint hanging down but no flames. He did not see any flames in the passageway; 6 The fourth officer later stated that she believed that she must have panicked and passed out. Figure 6. Upon hearing that the Alpha 1 attack team had withdrawn, the backup unit, in this case the Bravo 1 attack team, entered the area to fight the fire. D1 WD15 The Bravo 1 attack team, comprised of the second engineer, the third engineer, and a day engineer entered through WD 15. The second engineer, on the hose nozzle, did not immediately see flames in the passageway. As he approached D98, however, he realized that the fire had spread beyond its compartment of origin. D98

Accident Description 10 Marine Accident Brief Report however, he heard a noise in the area of the overhead, which he thought was the bubbling sound of paint burning. As the Bravo 1 attack team approached cabin D98, the second engineer realized that the fire had progressed outside the cabin of origin. He said that he felt an increase in temperature and could see flames on the deck in the main passageway and in a portside corridor. He found the door to D98 open and saw flames inside the cabin. He said that, while approaching cabin D98, he was spraying water in the main and other passageways when he discovered that the hose line from the boiler room would reach no farther. He retrieved the charged hose line that the chief officer had abandoned and resumed spraying the decks and overheads. He then attacked the fire inside cabin D98. He said that after he sprayed water into the cabin for several minutes, the flames were no longer visible. While the Bravo 1 attack team was fighting the cabin fire, the Bravo 2 attack team, carrying a second hose line from the boiler room, arrived at WD15 and began working its way forward toward FSD D1, spraying water on the fires in the passageways. A member of the Bravo 2 team relieved the day engineer, who then returned to the engine room to start the ventilation fans. When the low-pressure alarm sounded on the second engineer’s air bottle, the third engineer relieved him. The hose teams continued spraying water until all flames were extinguished on D deck. Shortly before 1000, all ventilation was restored to evacuate the smoke and improve visibility, and the Alpha squad commander reported to the bridge that the fire was under control. The teams continued with overhaul operations and stood by for re-flash until about 1022, when the fire was declared out. (See figure 7.) Figure 7. The gray area in this illustration shows the fire and smoke damage on D deck. D D1 WD15 At 1022, a little more than an hour after the first smoke alarm activated on the bridge, the fire was declared out. In this accident, smoke migrated up eight decks from D deck within 15 minutes of the first detector activation. 98

Accident Description 11 Marine Accident Brief Report Actions on Bridge On the bridge, about the time when the quartermaster made his first report, the fire control panel began indicating that multiple smoke alarms had activated. Between 0911, when the first smoke detector activated, and 0919, when the master ordered the general alarm sounded, 15 smoke detectors activated on D deck. Of these, two detectors were in the crew staircase by FSD D1. Upon receiving the report of a fire from the officer on D deck, the master made the following announcements7 to the passengers and the crew, at 0920 and 0921, respectively: Ladies and gentlemen, may I have your attention. This is your captain with an important announcement for all guests and crew. We just received a fire alarm on the D deck. We just received a fire alarm on D deck. Our fire squads are currently checking out the situation. Please cooperate closely with the officers and crew in following their instructions. There is no cause for alarm. We will keep you closely informed. This is an announcement for crew. There has been a fire reported on the D deck aft; please evacuate the D deck; please evacuate the D deck. Fire squads report to your fire stations, medical teams report to the infirmary, lowering squads report to the bridge wings, passenger-assist team report to housekeeping office, traffic directors report to dining room forward. At 0923, a smoke detector activated in a crew stairwell on C deck. About 0925, the master secured ventilation throughout the ship, closed the FSDs on D deck, and closed WD15 and WD16. He next ordered all elevators secured, the engine room placed on stand-by, and the emergency fire pump started. At 0928, a smoke detector activated in a crew stairwell on B deck. Shortly after 0930, the master began receiving reports from crewmembers that smoke was spreading upward to decks C, B, and A. He conferred briefly with the Alaska State pilot on an appropriate location to anchor the vessel in the event that the fire adversely affected propulsion or steering. During this discussion, the pilot offered to call the Coast Guard while en route to the anchorage, and the master accepted his offer. The pilot, however, had problems contacting the Coast Guard because high mountains in the area interfered with the VHF radio transmissions. A staff officer offered to help the pilot and attempted to send a message via the ship’s satellite communication system; however, the staff officer was not familiar with the equipment because operating it was not one of his duties. He inadvertently sent a message with a distress priority without the master’s knowledge or approval.8 Another Holland America vessel in the area received the message and radioed both the company’s shoreside office and the Coast Guard with news of the fire. At 1015, the Coast Guard radioed the Nieuw Amsterdam to determine the status of the fire. 7 Taken from transcripts of recordings provided by Holland America 8 As a result of this incident, Holland America now requires that certain staff officers become qualified in operating the ship’s satellite communication system.

Accident Description 12 Marine Accident Brief Report At 0932, the fire detection panel indicated that a smoke alarm had activated in a crew staircase on the main deck. At this time, about 20 minutes after the first smoke alarm, the master began broadcasting announcements to clear some of the affected areas. After ordering the low-location lighting turned on, he announced that all passengers on C deck should move to a higher deck and that passenger-assist teams should check that all cabins on C deck had been evacuated. The master then instructed the cruise director to assume responsibility for making the evacuation announcements. By this time, the fire detection panel indicated that a smoke detector had activated at 0936 in a crew stairwell on the promenade deck. Shortly thereafter, about 25 minutes after the first smoke alarm, the chief officer returned to the bridge and assumed the command of firefighting operations from the master. At 0941, or a half hour after the first alarm, the cruise director announced that all passengers and crewmembers should move from C deck, B deck, A deck, and the main deck to a higher-level deck. He then ordered the ship’s rescue squad to ensure that decks B and A had been evacuated. Shortly after 0947, at the master’s instructions, the cruise director announced that all passengers should move from inside the vessel to an outside deck. He also directed passenger-assist teams and evacuation teams to check and, if necessary, move anyone from the interior areas of the decks to an outside deck.9 Passenger Muster According to shipboard personnel, when the general alarm sounded at 0919, most passengers were either on the promenade deck (deck No. 7) or the sun deck (deck No. 10), where they were observing the glaciers and listening to a commentary being given by a ranger from the National Park Service. Some passengers were in their cabins, and “a small number of passengers” were eating breakfast in the restaurant on the lido deck. Shipboard personnel said that, at the sounding of the general alarm, most passengers listening to the commentary on the upper decks proceeded to their muster stations, as directed in the practice drill held when the ship departed Vancouver.10 Also, most passengers who were in their cabins retrieved their lifejackets and proceeded directly to their stations. Some passengers returned to their cabins to retrieve their lifejackets. One couple in the lido deck restaurant first finished their breakfast and then went to their cabin, which was on B deck, to retrieve their lifejackets, medicine, and valuables. They said that they also wanted to obtain warm clothing for the outside air. The couple said that when they reached B deck, they observed the passageway was “a little smoky.” They estimated that they stayed in their cabin about 6-7 minutes. 9 In postaccident interviews, the master stated that his primary concern during the emergency was to move passengers outside and away from any smoke. 10 The Nieuw Amsterdam had conducted an emergency drill, which is required by SOLAS, shortly after the ship left Vancouver. According to Holland America officials, during the drill, passengers had been told that, if they heard the general alarm, they should retrieve their lifejackets and proceed to their muster stations. They also had been told that, if they were not in their cabins, they should proceed immediately to their muster areas and that lifejackets would be provided to them.

Accident Description 13 Marine Accident Brief Report Meanwhile, at the muster stations, crewmembers took roll of the assembled passengers, as required by Holland America’s SMS, and informed the master that passengers from a cabin on B deck and a cabin on main deck could not be accounted for. The master then ordered evacuation teams with SCBAs to check the two cabins and decks for the missing people. About this time, the two passengers who had returned to their cabin on B deck exited their room and encountered thick smoke that severely reduced visibility. The woman put her jacket over her face and moved aft along the passageway. She said that her husband told her to get down near the deck. He followed her and shouted for help. She said that as she neared a doorway and stairs, a crewmember grabbed her and led her to the crew mess hall and then to the promenade deck. She then advised the crewmembers that her husband was still on B deck. According to the husband, when he crouched to move along the deck, he became disoriented. He thought that he might have passed some exit doors (FSDs that were closed) and that he might have blacked out at one point. He said that a crewmember grabbed him and helped him up the stairs first to the crew mess hall and then to the promenade deck to rejoin his wife. A shipboard medical team examined the couple to determine the scope of their injuries. They were later evacuated by medical helicopter to a hospital in Juneau, where the husband was admitted for treatment of injuries.11 About 1100, after the fire had been declared out, the passengers were moved inside to the lounges and public spaces, which had been ventilated and cleared of smoke. About an hour later, after all cabins on the lower decks had been checked, the passengers were allowed to return to their rooms. The Nieuw Amsterdam weighed anchor and continued with the cruise. However, when the bridge requested medical evacuation for the injured couple who had been stranded on B deck, the Coast Guard asked the Nieuw Amsterdam to proceed south. The ship subsequently received a Coast Guard Captain of the Port (COTP) order to anchor in Bartlett Cove for a Coast Guard inspection. After officials from the Alaska State Fire Marshal’s Office and the Coast Guard inspected the ship, Marine Safety Office-Juneau issued a COTP order granting permission for the ship to resume its voyage. On May 25, when the Nieuw Amsterdam arrived in Seward, investigators from the Safety Board and the U.S. Treasury Department’s Bureau of Alcohol, Tobacco, and Firearms (ATF) boarded the vessel. Investigators interviewed the four crewmembers who had occupied cabin D98. One crewmember stated that he had returned to his cabin to have a cup of tea and had plugged in a coffee maker to heat the water when he was called back to work. He said that he had switched off the coffee maker but had not unplugged it. He recalled that all other electrical appliances were turned off. 11 As a result of the investigations of the Nieuw Amsterdam fire and two prior fires on passenger ships, the Safety Board issued recommendations regarding the installation of locally sounding smoke alarms to 18 cruise ship lines in July 2000. The text of the safety recommendation letters is on the Web at http://www.ntsb.gov.

Accident Description 14 Marine Accident Brief Report The ATF conducted a systematic examination of cabin D98 to determine the origin and cause of the fire.12 Investigators observed burn patterns on the cabin bulkheads and furnishings, indicating that the greatest heat and flame damage came from a point near a small round table in the middle of the room, near the starboard bulkhead. (See figure 8.) In examining the debris in this area, investigators found the remains of a coffeemaker and a hot water kettle (electric). The ATF’s examination of the coffeemaker showed damage indicative of heating and melting from the exterior to the interior of the appliance. The coffeemaker’s internal heating element and associated electrical components were undamaged. The remnants of the hot water kettle heating element showed metal distortion indicative of internal heat damage that extended from the inside to the outside of the appliance. Investigators eliminated other possible sources of ignition, including any other electrical source and smoking materials, in this cabin area and concluded that the hot water kettle was the source of the fire. 12 For further information, read: Department of the Treasury, Bureau of Alcohol, Tobacco and Firearms Report of Investigation on the Nieuw Amsterdam Ship Fire, Case No. 787010-00-0070 (Washington, DC: ATF 2000). Figure 8. Plan view of crew cabin D98. Area of Coffee Maker and Hot Kettle VT Area of Electrical Outlets Forward Aft Table Double Bunk Double Bunk Locker Locker Locker Sink Locker

15 Marine Accident Brief Report According to the ship’s safety officer, Holland America has had a long-standing policy prohibiting cooking and water heating appliances in crew berthing areas. As a result of the Nieuw Amsterdam fire and a fire on another Holland America ship, the company issued a fleet advisory stating that any crewmember found to be cooking or in possession of a cooking appliance in a crew cabin would be immediately terminated. The advisory also stipulated that the masters of all vessels were required to have weekly inspections, as well as unannounced, periodic random searches, of crew cabins to check for cooking appliances. Safety Issues In its analysis of the Nieuw Amsterdam accident, the Safety Board identified the following safety issues: the adequacy of shipboard training and drills in firefighting management for masters and other officers; the adequacy of Holland America’s policies, procedures, training, and drills for limiting and controlling the spread of smoke during a fire; and the adequacy of Holland America’s safety management oversight of shipboard firefighting operations. Company files indicate that all Nieuw Amsterdam officers and crewmembers having a command or support role in a fire emergency, including the principals in this accident, had attended firefighting training, as required by the International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers. The unlicensed crewmembers had taken basic firefighting training, and the officers had taken basic and advanced firefighting training. Holland America’s SMS, together with the Nieuw Amsterdam’s station bill, established the shipboard organization and specified the responsibilities of personnel during a fire emergency. Further, the vessel had conducted the periodic crew fire drills required by SOLAS 74, as amended. Despite having received proper training and having performed frequent drills, several key individuals, in particular, officers with command responsibilities during a fire, did not follow accepted marine firefighting protocol and company shipboard procedures during the actual emergency. When the fire on board the Nieuw Amsterdam was detected, the fire was contained within cabin D98. Had several officers handled the emergency differently, the fire might never have escaped from the confines of the cabin. Additionally, the spread of smoke might have been curtailed, which would have reduced the risk of injuries to passengers and crewmembers. Some crewmembers followed Holland America’s procedures during the emergency. When the smoke alarm activated, the third officer in the pilothouse immediately notified the master and dispatched one of the duty quartermasters to investigate whether the alarm was false. The third officer advised the quartermaster to carry a UHF radio and a smoke mask. The third officer’s actions were both timely and appropriate for the circumstances and indicated that he knew how to respond to the situation. The communication and personal protective equipment that the quartermaster carried was adequate to reconnoiter the general area of the fire. The bridge officers,

Safety Issues 16 Marine Accident Brief Report however, did not provide the quartermaster with a passkey that would have enabled him to gain access to the cabin. When the quartermaster arrived on D deck and entered the passageway leading toward cabin D98, he observed a light amount of smoke. He donned his smoke mask, a prudent response to the conditions. At the door of cabin D98, he saw smoke issuing from the ventilation louvers. He tried the door but found it locked, whereupon he immediately radioed a report of his observations to the third officer on the bridge. The quartermaster’s actions, therefore, provided the timely notification that should have enabled officers having command responsibilities during fire emergencies to marshal shipboard firefighters and systematically deal with the fire and smoke. The quartermaster then correctly attempted to clear personnel from the affected area by shouting “fire” and pounding on the cabin doors to alert crewmembers of the need to exit D deck. Only happenstance enabled the quartermaster to determine the scope of the fire. His shouts alerted a cabin steward who happened to have a passkey and unlocked the door of cabin D98. The quartermaster teamed with another crewman who had retrieved a dry chemical extinguisher. After the men determined that it was safe to open the door, they did so and discharged the extinguisher into the room. When a large volume of smoke began to escape through the open doorway, they promptly closed the door. The quartermaster radioed the bridge to report that he had not been able to extinguish the fire. The actions of the quartermaster and the crewman were appropriate. Upon encountering conditions that were not imminently dangerous, they tried to extinguish the fire; however, upon finding the fire beyond their ability to extinguish, they immediately closed the door, which contained the fire and most of the smoke. The breakdown in the systematic handling of the emergency began with the master’s initial response on the bridge. When the third officer told the master of the quartermaster’s account of the smoke, the master’s first action was to violate his own shipboard fire plan. He ordered the chief officer to go to the fire scene to investigate the report instead of having him immediately report to the bridge, his assigned duty station in the event of a fire. As the person in charge of the command and control of shipboard firefighting operations, the chief officer belonged on the bridge, where he had access to communications equipment, vessel plans, fire detection and suppression systems, and remote controls for the ventilation systems, FSDs, and WTDs. From this central location, he could receive reports from the fire squads on scene, assess the situation, and plan the proper course of action. The master assumed the chief officer’s responsibilities, as well as his own, which included the safe navigation of the ship, the internal and external communications, and the overall management of the shipboard emergency to ensure the safety of the passengers and crewmembers. Holland America’s shipboard emergency procedures were based on the assumption that the existence of a fire would be verified before the ship’s firefighting assets were mobilized. In this case, the quartermaster had been appropriately tasked with this responsibility. However, despite the quartermaster’s providing an early confirmation of the fire and follow-up calls advising the bridge on the status of the fire, the master did not immediately react. He did not sound the general alarm signaling the fire teams to

Safety Issues 17 Marine Accident Brief Report marshal or broadcast a message alerting crewmembers on D deck to evacuate their accommodations until he received a call several minutes later from an officer who happened to be on D deck. While the master was trying to juggle his own responsibilities and those of first officer, additional crucial actions were not executed in a timely manner. The master lost some degree of control over external communications and did not ensure that the Coast Guard was contacted in a timely manner. Indeed, about an hour elapsed after the first smoke alarm sounded before the Coast Guard received a relayed distress message from another Holland American vessel and responded to the Nieuw Amsterdam emergency. If the fire on the ship had been beyond the capabilities of the shipboard firefighters, the delay in contacting the Coast Guard and arranging for additional resources could have had tragic consequences. Inefficient management contributed to the spread of smoke beyond the area of the fire and increased the risk of injury to passengers and crewmembers. Following the quartermaster’s report of the fire, the master continually received alarms indicating worsening smoke conditions, yet he did not immediately order the progressive clearing of the decks by the crew, the closing of FSDs as the smoke migrated to other decks, and the ventilation secured in any area of the ship. Any of these actions could have dramatically curtailed the spread of smoke throughout the Nieuw Amsterdam. The master’s orders to secure certain areas were interspersed among his alerts to passengers, communications with the fire squads, and other tasks, the result being that decks were secured after, rather than before, they filled with smoke. For example, between the time that the master alerted passengers to the fire (0920) and the time that he began fielding communications from the fire attack squads (0929), smoke detectors had activated in the crew staircase near FSD D1 on C deck and B deck, at 0923 and 0928, respectively. Yet, the master did not order passenger-assist teams to begin evacuating decks and securing the areas until after the smoke had reached the main deck, at 0932, more than 20 minutes after the initial alarm, at 0911. If the chief officer had been on the bridge performing his command and control duties, he or the master could have reviewed the printout from the fire detection panel and determined that the crew staircase by FSD D1 was acting like a chimney, funneling smoke to the upper decks. The printout, however, was not used to document and plan deck closings. In addition, passenger-assist teams were not ordered into position at the fire doors in a timely manner nor were they used as monitors to report on the effectiveness of the deck clearing and door closings. The number of concurrent tasks that the master was trying to perform probably adversely affected his ability to control the spread of smoke. If, however, Holland America, and, in this case, the Nieuw Amsterdam, had had a systematic plan or specific procedures for controlling the spread of smoke, the evacuation of the decks and the appropriate management of door closings might have been achieved. Timely door closings could have significantly limited, if not eliminated, the spread of smoke to other decks and the consequent injury of a passenger whose cabin was two decks above the fire. At the

Safety Issues 18 Marine Accident Brief Report very least, established shipboard procedures for controlling smoke would have enabled the officers to monitor and manage smoke control measures. Smoke control problems were not limited to the bridge. Some crewmembers did not recognize the importance of promptly reporting smoke. For example, the chief officer, during his descent to D deck, failed to alert the bridge that he smelled smoke on C deck. Such information might have assisted the master in directing smoke control activities. The Safety Board notes that the ship’s log indicates that the Nieuw Amsterdam conducted periodic fire drills as required by SOLAS and that Coast Guard reports indicate that shipboard personnel had performed satisfactorily during a fire drill that was conducted as part of the Coast Guard’s last quarterly examination.13 The focus during fire drills, however, is typically on firefighting. To maximize safety on a passenger ship, procedures for managing the evacuation of passengers and crew and for managing the control of smoke need to be established. For example, crewmembers need to be trained to immediately report any progression of smoke, to rapidly evacuate any passengers and crew from smoke-threatened areas, and to close FSDs to prevent the migration of smoke any farther. Officers, too, need to be trained to take proactive measures to prevent the migration of smoke and to direct the clearing of decks where passengers and crewmembers might be located. Officers should be able to use the fire control plan so that they can anticipate where smoke might migrate. They should interactively coordinate with crewmembers to clear the decks and close FSDs. They should be able to activate or shut down ventilation as appropriate. Follow-up drills should be devised and practiced to feature different scenarios that test the abilities of the officers and crew to respond to different smoke conditions. The Safety Board, therefore, believes that Holland America should revise shipboard procedures for controlling smoke to incorporate proactive measures that ensure the rapid clearing of passengers and crew from decks and that prevent the migration of smoke. Further, Holland America needs to devise and practice drills that feature different scenarios that test the abilities of officers and crew to respond to varying smoke conditions. During the early stages of the fire, the chief officer and the chief engineer essentially abandoned their command roles, choosing to make a premature attack on the fire without obtaining proper gear and arranging for backup. Their inappropriate actions directly contributed to the spread of fire and smoke. While en route to D deck, the chief officer heard the general alarm, an indication for the fire squads to marshal and don their gear. The Safety Board realizes that the chief officer was directed by the master to investigate the fire. Given the chief officer’s command position and duties in shipboard firefighting, however, he should have been alerted by the general alarm to radio the bridge and verify whether he should return to the bridge or continue to D deck to assess the fire. When the chief officer reached C deck and encountered smoke, he failed to alert the bridge to the worsening conditions and to the need to secure the ventilation and the FSDs in the affected areas. He also did not ensure that WD15 and WD16 were secured to prevent the migration of smoke. 13 The examination was conducted on May 21, 2000.

Safety Issues 19 Marine Accident Brief Report At FSD D1, the chief officer met the quartermaster, donned the latter’s smoke mask, and proceeded toward cabin D98. While he walked toward cabin D98, the chief officer encountered clear indications that the fire in the area was now fully developed. Heat was radiating from the cabin’s inboard bulkhead, and thick, white smoke streaming through the louvers of cabin D98’s door had filled the upper half of the passageway. He then met the chief engineer who had left his emergency station in the engine control room to check out the area where the smoke alarm had sounded. Neither man had protective fire gear. They decided to fight the fire without obtaining proper clothing and equipment or arranging for a backup hose team. When the chief officer sprayed water into the cabin, intense heat, white smoke, and steam came rushing out of the cabin door, driving him back and causing him to drop the hose. He retreated and rejoined the chief engineer, leaving the door to cabin D98 ajar, which allowed the fire and smoke to escape its compartment of origin and spread to the adjoining passageways. The chief officer and the chief engineer then exited the area to return to the bridge and the engineroom, their respective emergency stations. While the chief officer and the chief engineer were making their unsupported and precipitate attack on the fire, some of the ship’s firefighting personnel had marshaled in a timely manner and taken up positions forward and aft of the affected area. In fact, after his abortive attempt to fight the fire, the chief officer met the Bravo 1 attack team members near WD15 as they were descending from C deck. Some firefighting personnel handled the firefighting effectively, albeit not in accordance with the ship’s station bill. The performance of the ship’s Bravo squad members in attacking the fire demonstrated that they were trained and properly equipped to extinguish the fire. They used proper technique in approaching the fire, backed one another up during the evolution of the fire, and maintained effective radio communications with each other and with the bridge. Their efforts resulted in the fire being extinguished in short order, with no injury to any of the firefighters. Had the chief officer and the chief engineer not acted precipitately during the early stages of the fire and left the door to cabin D98 ajar, the regularly constituted and properly outfitted fire teams would probably have extinguished the fire inside the cabin, and it might not have spread to the adjoining passageways. The chief officer and the chief engineer took actions that compromised the effectiveness of the ship’s firefighting capability, needlessly endangered themselves, and risked the safety of the passengers and crew. The Safety Board is concerned that the chief officer, the chief engineer, and the firefighting squad officers elected to serve as firefighters in this accident. The Board recognizes that the chief officer and the chief engineer probably were motivated by the desire to extinguish the fire as quickly as possible; however, their actions were ill advised and actually made the situation worse, rather than better. Had either one of these two officers been injured in their firefighting effort, the ship would have lost the benefit of his knowledge and expertise during the emergency. The same is true for the officers on the Bravo squad. Despite the fact that the Bravo teams performed well and ultimately extinguished the fire quickly, the Safety Board is concerned about the officers’ assuming forward attack positions without having

Safety Issues 20 Marine Accident Brief Report replacements in their command and control positions. The Safety Board recognizes that shipboard managers should have the discretion to organize the fire teams as they see fit. Fire squad and fire team leaders should be able to use their firefighting assets where and how the fire and smoke warrant. In this accident, however, if the officers saw the need to personally attack the blaze, they should have arranged to have command and control replacements, i.e., an acting squad commander and an acting assistant squad commander. In particular, the squad leaders’ alignment in the attack order potentially jeopardized any effort at effective command and control. By virtue of their regular shipboard assignments, junior officers and unlicensed crewmembers lack the authority to order a senior officer out of a potentially dangerous situation. If the second engineer and the third engineer had been seriously injured or overcome by smoke, the handling of the emergency might have been adversely affected. The Safety Board is somewhat reluctant to find fault with the actions of the Bravo squad leaders because their attack teams were not intended to be the primary firefighters in this accident. The Alpha squad, which was responsible for all ship areas other than engineering, was first ordered to attack the fire. The management and the composition of the Alpha unit, however, were not adequate for the emergency. The squad commander, who was also the safety officer for the ship, did not position two attack teams. The attack team that led the initial assault on the fire had an inexperienced leader. When she panicked and fainted, the squad leader did not have the necessary people in position to handle the setback. After he carried her out of the smoke-filled passageway, he chose to take her above deck, thus removing himself from his command and control position. He should have directed another person to attend to her and remained with the Alpha 1 team. Instead, he left the management of the attack team to his second in command (the third officer); however, the Alpha squad assistant commander did not have an officer to lead the attack team or other resources adequate to safely continue the firefighting. The Alpha unit, therefore, had to abandon its role as the primary firefighting unit. The Nieuw Amsterdam held regular fire drills in accordance with regulatory requirements. While the training may have prepared the shipboard personnel to attack a fire, the drills apparently did not adequately prepare some officers to appropriately assess and manage a fire emergency. The Safety Board considers it essential to the safe operation of ships that masters and officers be able to fulfill their proper command and control functions during shipboard fires. The Safety Board, therefore, believes that Holland America should revise shipboard training and drills for its masters and other officers to include emphasis on their management responsibilities during a fire emergency and the principles of command and control of onboard firefighting activities. The International Management Code for the Safe Operation of Ships and for Pollution Prevention14 requires that shipping companies conduct periodic internal and external audits, i.e., management oversight, to ensure the continued adequacy of their safety programs and to identify nonconformities that must be corrected to improve safety. Shoreside management should be aware of whether shipboard activities during an emergency are being conducted in accordance with the company’s written policies,

Safety Issues 21 Marine Accident Brief Report procedures, and other directives, such as station bills. Only days before this accident, the company conducted a fire training drill aboard the Nieuw Amsterdam in which company officials evaluated the shipboard response as being in accordance with their policies, procedures, and directives. During a real-life situation, however, the ship’s officers seriously deviated from procedures. In particular, two senior officers attempted to fight a fire without protective equipment or gear and failed to secure a smoke-filled area, thus permitting smoke to travel upward through multiple decks. Because its most recent oversight review did not reveal deficiencies that could, in another emergency, seriously affect the safety of passengers, crew, and its ship, Holland America needs to reexamine its process for evaluating how its shipboard management team fights fires and controls smoke. The Safety Board, therefore, believes that Holland America should review and revise, as necessary, its safety oversight procedures for assessing the effectiveness of its training and drills for firefighting command and control and the effectiveness of its procedures for controlling the spread of smoke during a shipboard fire. About a month before the Nieuw Amsterdam accident, Holland America had a crew cabin fire on another company vessel. During the postaccident examination of the crew quarters following that fire, company officials found not only that some crewmembers had been using prohibited cooking appliances in their cabins, but also that some individuals had tampered with the cabin’s smoke detectors so that they would not activate. Following the Nieuw Amsterdam fire, on May 25, 2000, the company issued a fleet advisory stating that any crewmember found to be cooking or in possession of a cooking appliance in a crew cabin would be immediately terminated. Further, any crewmember found to have tampered with a smoke detector would be immediately terminated. The advisory also stipulated that the masters of all vessels were required to have weekly inspections as well as unannounced, periodic random searches of crew cabins to check for cooking appliances and disabled smoke detectors. The Safety Board considers the actions taken by Holland America to be appropriate. The events of the Nieuw Amsterdam accident, in particular, the poor handling of the fire and smoke, the breakdown in firefighting command and control, and the inadequate control of the crewmembers’ use of prohibited electrical appliances offer lessons that, in the Safety Board’s opinion, might benefit other passenger ship companies. The Safety Board believes that the cruise line companies, including their subsidiary operating cruise lines, should review the circumstances of the May 23, 2000, fire on board the Netherlands-registered passenger ship Nieuw Amsterdam, in particular, the unauthorized use of electrical appliances by the crew and the company’s smoke control management policies and procedures. Based on their review, the companies should make changes, as appropriate, to improve fire safety on their ships The Safety Board is aware that the International Maritime Organization’s Maritime Safety Committee has established a working group to consider safety on large passenger 14 In 1994, the IMO adopted the ISM Code that, among other requirements, stipulated that ship-operating companies establish an SMS that sets forth procedures for conducting normal shipboard operations, as well as procedures for responding to potential shipboard emergencies, including fires. The ISM Code became effective for passenger ships on July 1, 1998.

22 Marine Accident Brief Report ships. The working group is considering safety on existing and future large passenger ship from a global perspective, that is, from an overall systems-safety approach. In reviewing large passenger ship safety issues, the working group is also considering matters related to the human element, such as operations, management, and training. The Safety Board believes that the Coast Guard should submit the lessons learned from the Nieuw Amsterdam’s accident, in particular the need for proper firefighting management and the need to control the spread of smoke, to the IMO working group for its consideration. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on board the Nieuw Amsterdam was the unauthorized use of an electrical appliance that had been left unattended and plugged into an electrical outlet in a crew cabin. Contributing to the extent of the fire damage and spread of smoke was a breakdown in firefighting command and control by the vessel’s master and senior officers. Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following recommendations: To the U.S. Coast Guard:

1. Submit the lessons learned from the National Transportation Safety Board’s

investigation of the Nieuw Amsterdam accident, in particular, the need for proper firefighting management and the need to control the spread of smoke to the International Maritime Organization’s Working Group on Large Passenger Ship Safety for their consideration. To Holland America Lines, Inc.:

1. Revise shipboard training and drills for your masters and other officers to

include emphasis on their management responsibilities during a fire emergency and the principles of command and control of onboard firefighting activities.

1. Revise shipboard procedures for controlling smoke to incorporate proactive

measures that ensure the rapid clearing of passengers and crew from decks and that prevent the migration of smoke.

1. Devise and practice drills that feature different scenarios that test the abilities

of officers and crew to respond to varying smoke conditions.

Recommendations 23 Marine Accident Brief Report

1. Review and revise, as necessary, your safety oversight procedures for assessing

the effectiveness of your training and drills for firefighting command and control and the effectiveness of your procedures for controlling the spread of smoke during a shipboard fire. To American Classic Voyages, Carnival Corporation, Inc., Crystal Cruises, Disney Cruise Line, Norwegian Cruise Line, Orient Lines, P&O Princess Cruises International, Ltd., Radisson Seven Seas Cruises, Regal Cruises, Renaissance Cruises, Inc., Royal Olympic Cruises, Royal Caribbean Cruises, Ltd., and Silversea Cruises, Ltd.:

1. Review the circumstances of the May 23, 2000, fire on board the Netherlands-

registered passenger ship Nieuw Amsterdam, in particular, the unauthorized use of electrical appliances by the crew and the company’s smoke control management policies and procedures. Based on your review, make changes, as appropriate, to improve fire safety on your ships. BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: July 24, 2001

FD07228 ｜ 2000_美国_NTSB_PAR0201_Rupture_of_Piney_Point_Oil_Pipeline_and_Release_of_Fuel_Oil.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Pipeline Accident Report Rupture of Piney Point Oil Pipeline and Release of Fuel Oil Near Chalk Point, Maryland April 7, 2000 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/PAR-02/01 PB2002-916501

this page intentionally left blank

Pipeline Accident Report Rupture of Piney Point Oil Pipeline and Release of Fuel Oil Near Chalk Point, Maryland April 7, 2000 NTSB/PAR-02/01 PB2002-916501 National Transportation Safety Board Notation 7285A 490 L’Enfant Plaza, S.W. Adopted July 23, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Rupture of Piney Point Oil Pipeline and Release of Fuel Oil Near Chalk Point, Maryland, April 7, 2000. Pipeline Accident Report NTSB/PAR-02/01. Washington, DC. Abstract: On the morning of April 7, 2000, the Piney Point Oil Pipeline system, which was owned by the Potomac Electric Power Company, experienced a pipe failure at the Chalk Point Generating Station in southeastern Prince George’s County, Maryland. The release was not discovered and addressed by the contract operating company, Support Terminal Services, Inc., until the late afternoon. Approximately 140,400 gallons of fuel oil were released into the surrounding wetlands and Swanson Creek and, subsequently, the Patuxent River as a result of the accident. No injuries were caused by the accident, which cost approximately $71 million for environmental response and clean-up operations. The safety issues discussed in this report are the sufficiency of the evaluation procedures for pipe wrinkles; the efficiency of the leak notification procedures; and the effectiveness of the incident command. As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the Research and Special Programs Administration and the Environmental Protection Agency. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916501 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Pipeline Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Actions Taken After Pipeline Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Response to Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Notifying Authorities and Containing Spill . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Response to Escape From Containment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Postaccident Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Piney Point Oil Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Pipeline Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Pipeline Maps and Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Pepco Oil Spill Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Office of Pipeline Safety Postaccident Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Pipeline Safety Actions Since Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Incident Command System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Postaccident Assessments of Chalk Point Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 November 2000 Safety Board Hearing on Pipeline Safety . . . . . . . . . . . . . . . . . . . . . . 35 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Pipeline In-line Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Evaluation of Pipe Wrinkles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Leak Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Leak-related Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Inaccurate National Response Center Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Limited Involvement of Local Response Agencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Incident Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Contents iv Pipeline Accident Report Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 B: Initial Incident Timeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 C: Significant Events From Leak Recognition to Loss of Containment . . . . . . . . . . . . . . 53 D: Significant Environmental Response and Clean-up Events . . . . . . . . . . . . . . . . . . . . . . 54

v Pipeline Accident Report Acronyms and Abbreviations API -- American Petroleum Institute CFR -- Code of Federal Regulations EPA -- Environmental Protection Agency Mirant -- Mirant Piney Point, LLP Pepco -- Potomac Electric Power Company RSPA -- Research and Special Programs Administration SCADA -- supervisory control and data acquisition ST Services -- Support Terminal Services, Inc.

vi Pipeline Accident Report Executive Summary On the morning of April 7, 2000, the Piney Point Oil Pipeline system, which was owned by the Potomac Electric Power Company, experienced a pipe failure at the Chalk Point Generating Station in southeastern Prince George’s County, Maryland. The release was not discovered and addressed by the contract operating company, Support Terminal Services, Inc., until the late afternoon. Approximately 140,400 gallons of fuel oil were released into the surrounding wetlands and Swanson Creek and, subsequently, the Patuxent River as a result of the accident. No injuries were caused by the accident, which cost approximately $71 million for environmental response and clean-up operations. The National Transportation Safety Board determines that the probable cause of the April 7, 2000, Piney Point Oil Pipeline accident at the Potomac Electric Power Company’s Chalk Point, Maryland, generating station was a fracture in a buckle in the pipe that was undiscovered because the data from an in-line inspection tool were interpreted inaccurately as representing a T-piece. Contributing to the magnitude of the fuel oil release were inadequate operating procedures and practices for monitoring the flow of fuel oil through the pipeline to ensure timely leak detection. This report discusses the following major safety issues: • The sufficiency of the evaluation procedures for pipe wrinkles; • The efficiency of the leak notification procedures; and, • The effectiveness of the incident command. In addition to these issues, the Safety Board’s investigation addressed the leak detection procedures used on the Piney Point Oil Pipeline and the analysis of the pipeline in-line inspection results. As a result of its investigation of this accident, the Safety Board makes safety recommendations to the Research and Special Programs Administration and the Environmental Protection Agency.

1 Pipeline Accident Report Factual Information Accident Synopsis On the morning of April 7, 2000, the Piney Point Oil Pipeline system, which was owned by the Potomac Electric Power Company (Pepco), experienced a pipe failure at the Chalk Point Generating Station in southeastern Prince George’s County, Maryland. (See figure 1 for a map showing the location of the Chalk Point Generating Station and the spill site.) The release was not discovered and addressed by the contract operating company, Support Terminal Services, Inc., (ST Services) until the late afternoon. Approximately 140,400 gallons1 of fuel oil were released into the surrounding wetlands and Swanson Creek and, subsequently, the Patuxent River as a result of the accident. No injuries were caused by the accident, which cost approximately $71 million for environmental response and clean-up operations. The Accident At the time of the accident, Pepco was the owner of the Piney Point Oil Pipeline system. ST Services, a limited partnership of the Kaneb Pipe Line Company, operated the pipeline and performed certain maintenance functions according to the terms of its contract with Pepco.2 The pipeline was used to deliver heated No. 6 fuel oil from Piney Point Terminal, in Maryland, through an intermediate station at Ryceville, Maryland, to Pepco’s power generating stations at either Chalk Point or Morgantown, Maryland. (See figure 2.) On April 7, 2000, a pigging operation was being conducted on the pipeline to prepare the Chalk Point Station to Ryceville Station segment of the pipeline for an in-line inspection. The pipeline from the Chalk Point Station to the Ryceville Station was started in the reverse direction of normal flow with flushing oil3 in the system. (See figure 3 for a schematic of the pipeline.) Employees calculated the amount of oil in the Chalk Point flushing oil tank and the Ryceville receiving tank before the operation began. As the operation proceeded, they obtained tank level data that would typically be used to determine how much oil had been pumped from Chalk Point and how much had been received by Ryceville. 1 Pipeline operators typically quantify their product using barrels rather than gallons. There are 42 gallons in a barrel. 2 In December 2000, Pepco sold some of its facilities, including the Piney Point Oil Pipeline and the Chalk Point Generating Station, to Southern Energy, Inc., of Atlanta, Georgia. Southern Energy later became Mirant Mid-Atlantic of Atlanta, Georgia. Currently, Mirant Piney Point, LLP, (Mirant) is the pipeline owner and operator. 3 Flushing oil is a mixture of No. 2 and No. 6 fuel oil. No. 6 fuel oil is a thick, black petroleum liquid that may become solid at cooler temperatures. No. 2 fuel oil is a light, refined petroleum product similar to diesel fuel.

Factual Information 2 Pipeline Accident Report Figure 1. Map of accident site. Rt 301 Benedict Route 231 Patuxent River PEPCO - Chalk Point Generating Station CHARLES COUNTY PRINCE GEORGE'S COUNTY CALVERT COUNTY Swanson Creek ST. MARY'S COUNTY N Major Roads MARYLAND Oil Spill Site

Factual Information 3 Pipeline Accident Report At 0715 eastern daylight time, ST Services employees (see figure 4) at the Chalk Point Station started pumping and launched a cleaning pig. Before this operation began, the estimated tank level that would indicate completion of the pigging process was calculated for Chalk Point. The first pig was initially estimated to arrive at the Ryceville Station 7 hours after it had been launched. Before launching the cleaning pig, the ST Services Chalk Point operator walked through the tank and pipe manifold area and measured the actual level4 of the flushing oil tank. Within 15 to 25 minutes, a sizing pig5 was launched to follow the cleaning pig. The ST Services Chalk Point operator measured the first tank level at 0910. He passed this information on to the crew at Ryceville, who had the tank volume conversion tables that were used to determine the volume in the tank and calculate the oil flow rate. The first tank gauge was read at Ryceville shortly after the crew arrived, about 0837. The Figure 2. Locations of Piney Point Oil Pipeline Stations. 4 An operator obtains precise tank level measurements by climbing to the top of a tank carrying a weighted tape, which is used to determine the liquid level in the tank. 5 The sizing pig was constructed to 90 percent of the pipeline’s internal diameter to verify that the pipeline did not have any internal restrictions that could damage or restrict the passage of an ultrasonic inspection tool. 301 Waldorf La Plata Wicomico River Hughesville 301 301 5 234 231 5 5 235 234 235 5 Potomac River Patuxent River 4 4 Valley Lee 5 Leonardtown Mechanicsville Newburg Morgantown Station Ryceville Station Chalk Point Station Piney Point Station Oil Spill Site PEPCO Piney Point Oil Pipeline

Factual Information 4 Pipeline Accident Report Figure 3. Piney Point Pipeline schematic. Morgantown Chalk Point Wicomico River Swanson Creek 12" Pipeline 12" Pipeline Valve Pit #2 16" Pipeline Valve Pit #1 Leak Site ST Services Terminal Piney Point Water Crossing- nitrogen operated valves Manual isolation Valve Tank Legend PEPCO - Piney Point Oil Pipeline Ryceville Transfer Station Fuel Oil Pump Transfer Station Flushing Oil Tank #6 Oil Tank Flushing Oil Tank Flushing Oil Tank #6 Oil Tank Tank Tank Fuel Oil Pump Transfer Station Piney Point Transfer Station

Factual Information 5 Pipeline Accident Report Figure 4. Selective organizational chart for ST Services. Positions cited in accident narrative are in boldface and all capitals. (Note: This chart was developed by the Safety Board for informational purposes. It is not intended to cover the full range of ST Services positions.) ST Services Senior Vice President, Mid-Atlantic Region Traffic Analyst Operators (10 positions) PINEY POINT SHIFT SUPERVISORS (function as PINEY POINT PIPELINE CONTROLLERS) Plant Mechanics (function as CHALK POINT AND RYCEVILLE OPERATORS) Maintenance Workers- Relief Operators MAINTENANCE FOREMAN ASSISTANT TERMINAL MANAGER Administrative Director of Operations, East Coast Terminal Manager

Factual Information 6 Pipeline Accident Report ST Services Ryceville operator determined that about 1,500 barrels (63,000 gallons) had been transferred into the Ryceville tank since the pumping started. The ST Services Ryceville operator kept some notes during the pumping but did not record the time and tank level information in the station log. Tank levels were taken at Chalk Point to be used to check the flow rate from the facility at about 2-hour intervals for most of the pumping operation. The ST Services Ryceville operator said he read the tank gauge at Ryceville, the receiving station, about every 1 1/2 hours to determine the volume of product in the Ryceville tank. The operating personnel did not provide tank volumes to the ST Services Chalk Point operator, and they did not calculate the line balance6 periodically during the pigging operation. Further, they did not communicate the tank level information to the ST Services Piney Point pipeline controller7 when it was obtained. At 1119, another tank level measurement was made at Chalk Point, and the ST Services Chalk Point operator passed the information on to the ST Services Ryceville operator. A few minutes before 1200, the ST Services Chalk Point operator told Ryceville that the pumping was going well and that the cleaning pig would arrive early, between 1300 and 1330. At the same time, the ST Services Chalk Point operator asked Ryceville what it was getting for volume received, as he had not had any confirmation on the product pumped from his station to Ryceville. Ryceville told him the station was working on it. As a normal check-in, the ST Services Chalk Point operator also called the ST Services Piney Point pipeline controller to inform him that he was at the station and that things were going fine. The next Chalk Point tank level measurement was taken at 1220 and reported to Ryceville and Piney Point. The ST Services Chalk Point operator stood by the Chalk Point pump starting about 1250 and was prepared to shut it down whenever he received a call from Ryceville stating that the cleaning pig had arrived. The tank gauge was checked at Ryceville about 1300, but no information on the volume received was calculated or reported to the ST Services Chalk Point operator or the ST Services Piney Point pipeline controller. The ST Services Ryceville operator went outside to the Ryceville pipe manifold about 1300 to await the cleaning pig’s arrival. About 1412, the ST Services Chalk Point operator decided to double-check the Chalk Point tank level because the pig had not arrived at Ryceville. About 1430, the Chalk Point pump started cavitating8 due to a low-pressure condition at the pump inlet, because the level of product in the tank was not providing sufficient pressure for the pump to run properly. About the same time, the ST Services Ryceville operator noticed that Ryceville’s meter noise suddenly stopped, indicating no 6 Line balance is the difference between the volume of product pumped at the origin and the volume received at the destination. It is used for determining whether the pipeline operation is being conducted within certain limits in order to identify a possible leak. 7 The ST Services Piney Point shift supervisors served as the pipeline controllers. 8 Cavitation is an internal pump condition created by the sudden formation and collapse of bubbles in a liquid, which makes a characteristic sound.

Factual Information 7 Pipeline Accident Report product flow. The ST Services Chalk Point operator kept the pump operating by partially closing the pump outlet valve in an effort to avoid internal damage to the pump. The ST Services Chalk Point operator talked to the ST Services maintenance foreman at Ryceville and was told that the meter noise had stopped and no pig had arrived. The ST Services Chalk Point operator was then directed to close the valve as much as possible to maintain product flow. The ST Services Chalk Point operator had not taken a recent tank level measurement but was now ordered by the ST Services maintenance foreman to determine the Chalk Point tank level. The ST Services Ryceville operator was also directed to measure the Ryceville tank level so that the volume pumped could be compared with the volume received. The ST Services assistant terminal manager was notified about the situation, and he confirmed the need for an immediate tank level measurement of the pumping and receiving tanks. The ST Services Chalk Point operator and the ST Services assistant terminal manager had a phone conversation about 1440 and reviewed the situation. The ST Services assistant terminal manager instructed the ST Services Chalk Point operator to double-check which valves were closed to confirm that the No. 6 fuel system was isolated from the flushing oil system. Tank levels were acquired for Chalk Point and Ryceville. The ST Services Ryceville operator, using the tank volume tables, calculated that enough oil had been pumped for the pigs to have reached the Ryceville Station. He said he thought that something was wrong because Ryceville did not receive all the oil pumped from Chalk Point. The ST Services assistant terminal manager later said that at the time he believed that the tank volume discrepancy had been caused by a valve that was improperly aligned (open to another tank) or leaking (product leaking through a valve to another tank) and that flushing oil was being transferred to the No. 6 fuel oil tank. He then directed ST Services employees to make a number of checks to confirm that the correct valves were open, to obtain a reading of the No. 6 fuel oil meters at Chalk Point, and to measure the tanks at Piney Point. The ST Services assistant terminal manager had the ST Services Piney Point pipeline controller perform the line balance calculations, with the result that 3,088.7 barrels (129,725 gallons) could not be accounted for. By 1534, after receiving the additional information he had requested, the ST Services assistant terminal manager stated that the discrepancies could not be explained by tank inventory data. He had ruled out the possibility of the missing oil being anywhere it should be. During a phone call, the ST Services Chalk Point operator told the ST Services assistant terminal manager that the requested check had confirmed the isolation of the flushing oil system from the No. 6 fuel oil. The ST Services assistant terminal manager told the ST Services Chalk Point operator to shut the Chalk Point pump down. At 1538, the ST Services Chalk Point operator shut down the pump. The ST Services assistant terminal manager stated that he paged his Pepco pipeline contact, the Pepco Chalk Point general supervisor for fuel and ash, three times using a “911 code” to indicate the urgent need for a response. (See figure 5 for an organizational chart of Pepco personnel involved in the accident.)

Factual Information 8 Pipeline Accident Report Figure 5. Selective and simplified organization chart for Pepco Generation Organization, intended only to show the basic organizational relationships between the major positions cited in the accident narrative. Positions cited in the narrative are in boldface and all capitals. (Note: This chart was developed by the Safety Board for informational purposes. It is not intended to cover the full range of Pepco Generation Organization positions.)

ENVIRONMENTAL COORDINATOR (also QUALIFIED INDIVIDUAL) SENIOR ENVIRONMENTAL COORDINATOR Environmental Services Manager Division Manager Generation East- CHALK POINT GENERATING STATION MANAGER Fuels and Business Planning Bulk Power Management Engineering and Maintenance Services Environmental GENERAL SUPERVISOR FOR FUEL AND ASH GENERAL SUPERVISOR FOR OPERATIONS Fuel and Ash Maintenance and Planning Operations Station Engineering ENGINEERING SUPERVISOR PEPCO Generation Organization Vice President CHALK POINT SHIFT SUPERVISOR CHALK POINT CONTROL ROOM OPERATIONS SUPERVISOR

Factual Information 9 Pipeline Accident Report Actions Taken After Pipeline Shutdown The ST Services assistant terminal manager told the ST Services Chalk Point operator that he had pumped about 8,900 barrels (373,800 gallons) and that Ryceville had received about 5,900 barrels (247,800 gallons). The ST Services assistant terminal manager then directed the ST Services Chalk Point operator to check the No. 1 valve pit area at Swanson Creek for a leak and to look across the creek at the No. 2 valve pit for signs of a leak. (Valve pit No. 1 is on the north side of Swanson Creek, between the creek and the Chalk Point Station.) The ST Services Chalk Point operator also obtained the closing tank level for the Chalk Point flushing oil tank. The ST Services Chalk Point operator made the visual checks by 1545 and reported that he saw no sign of an oil leak at the creek. Next, the ST Services Chalk Point operator was directed to check all roads that the pipeline crossed back to Ryceville for an oil leak. He called the Chalk Point Operations Center and stated that he was finished pumping and that the pigs had not been received at Ryceville, indicating there was a problem with the pipeline. He said he told the Chalk Point Operations Center that he was checking road crossings and would contact the center if he noticed a leak or some other problem. At 1550, the ST Services assistant terminal manager called a Pepco Washington, D.C., headquarters oil procurement employee who confirmed the pager number for the Pepco Chalk Point general supervisor for fuel and ash. The contact also provided the Pepco engineering supervisor’s phone number, because the Pepco engineering supervisor might be able to locate other contacts needed by the ST Services assistant terminal manager. The ST Services assistant terminal manager contacted the Pepco engineering supervisor, who advised him that the Pepco Chalk Point general supervisor for fuel and ash was on vacation. The ST Services assistant terminal manager told him the details of the 3,000-barrel line balance discrepancy and was advised to call the Pepco Chalk Point general supervisor for operations. The ST Services assistant terminal manager also stated that ST Services personnel were checking the levels of the flushing oil and No. 6 fuel oil tanks at Chalk Point, Morgantown, and Piney Point to determine the location of a 3,000- barrel line balance discrepancy. The ST Services assistant terminal manager indicated that similar discrepancies had occurred in the past due to valve misalignment or valves not being fully closed, which allowed oil to be inadvertently directed into one of the other oil storage tanks in the system. The Pepco engineering supervisor said that about 1620, he called the Pepco Chalk Point general supervisor for operations and informed him of a 2,000- to 3,000-barrel line balance discrepancy, which the Pepco Chalk Point general supervisor for operations noted in his log as a discrepancy of 2,000 barrels. The Pepco Chalk Point general supervisor for operations also noted in his log that ST Services personnel had initiated a ground inspection and were checking the pipeline at road crossings. At 1643, the Pepco Chalk Point general supervisor for operations ordered a patrol flight of the pipeline right-of-way.

Factual Information 10 Pipeline Accident Report Response to Accident Notifying Authorities and Containing Spill April 7. About 1800 or shortly thereafter, the Pepco Chalk Point general supervisor for operations called the on-duty Pepco environmental coordinator, who was the designated Pepco qualified individual,9 at home to discuss the pipeline line balance shortage. He told the Pepco qualified individual what was being done at the pipeline, including the tank level measurement discrepancy found when oil had been pumped back to Ryceville. The Pepco Chalk Point general supervisor for operations also said that he had ordered a pipeline patrol flight. At 1802, the ST Services assistant terminal manager learned that during the pipeline patrol plane flight, an oil release from the Piney Point Oil Pipeline had been spotted in the Swanson Creek wetlands area. By 1807, the ST Services assistant terminal manager had put the Chalk Point pipeline emergency response plan into effect by contacting the Pepco qualified individual and an oil spill clean-up contractor. This plan listed the criteria for notification of local response agencies as “fire, explosion, personal injury or release or significant threat of release off-site.” Local response agencies were not notified. The ST Services assistant terminal manager called Piney Point to summon ST Services employees to assist at Chalk Point. (See appendix B for a timeline indicating significant developments as the leak occurred and was identified.) The Pepco qualified individual called the Pepco Chalk Point general supervisor for operations back and reported that the pipeline patrol flight had found an oil spill. The Pepco Chalk Point general supervisor for operations then notified the Chalk Point control room of the pipeline release. The Pepco Chalk Point general supervisor for operations sent the Pepco Chalk Point shift supervisor to the pipeline crossing at Swanson Creek to assess the situation. During this period, the Pepco Chalk Point general supervisor for operations reviewed the three Pepco spill response plans for the area to ensure that all emergency response requirements were being met.10 Because each plan had a somewhat different purpose and focus and the general supervisor for operations did not know the exact location of the (underground) spill, he did not know which plan applied to this accident. Consequently, he attempted to notify all response personnel identified in all three plans. 9 As indicated under 49 Code of Federal Regulations (CFR) Part 194, the qualified individual is a company representative available on a 24-hour basis with full authority to: activate personnel and contract with required oil spill removal organization(s); activate personnel and equipment maintained by the operator; act as liaison with the on-scene coordinator; and obligate funds needed to carry out all required or directed oil response activities. 10 The three plans were 1) the Pepco Oil Spill Emergency Response Plan for the Ryceville Pumping Station and Pipeline, 2) the Pepco Oil Spill Emergency Response Plan for the Chalk Point Generating Station, and 3) the Pepco Spill Prevention, Control, and Emergency Response Plan for the Chalk Point Generating Station.

Factual Information 11 Pipeline Accident Report About 1817, the Pepco Chalk Point shift supervisor called the Pepco Chalk Point general supervisor for operations and reported that he would deploy an oil spill boom to contain the oil in Swanson Creek. At 1822, the ST Services assistant terminal manager asked the Pepco Chalk Point control room operations supervisor to notify Federal and State agencies about the release, as required by the oil spill response plan for the Chalk Point Generating Station. About 1827, the Pepco Chalk Point general supervisor for operations called the headquarters Pepco senior environmental coordinator at home and discussed the oil spill, so that the Pepco senior environmental coordinator could notify the National Response Center.11 Between 1830 and 1835, the Pepco qualified individual met the Pepco Chalk Point shift supervisor (who had been to the leak site) at the Chalk Point plant building and asked the shift supervisor how much oil had spilled. When the Pepco Chalk Point shift supervisor responded that he was not sure, the Pepco qualified individual pressed him for some number because, he said, he believed that he would have to report a spill quantity when he called the responsible authorities. The Pepco qualified individual stated that, when pressed, the Pepco Chalk Point shift supervisor said, “1,000 gallons, 2,000 gallons, [expletive] mess; tell them what you want.” They reported together to the office of the Pepco Chalk Point general supervisor for operations about 1835, during his continuing telephone conversation with the Pepco senior environmental coordinator. The Pepco qualified individual told the Pepco Chalk Point general supervisor for operations that the estimated size of the spill was 1,000 to 2,000 gallons. The Pepco senior environmental coordinator later told investigators that during their phone conversation, he and the Pepco Chalk Point general supervisor for operations discussed that the “best guess” estimate of the release was 1,000 to 2,000 gallons. He stated that he and the Pepco Chalk Point general supervisor for operations agreed to report a release of 2,000 gallons to the National Response Center. The Pepco senior environmental coordinator stated that the Pepco Chalk Point general supervisor for operations did not discuss the ST Services tank level readings with him. Shortly thereafter, the Pepco senior environmental coordinator called the Pepco qualified individual for more information about the release. The Pepco qualified individual confirmed the oil spill location and stated that booms were being placed in the wetlands. Based on the information they had, the Pepco senior environmental coordinator and the Pepco qualified individual decided to report the estimated spill volume as 2,000 gallons. They agreed to split the reporting task, with the Pepco senior environmental coordinator reporting to the National Response Center and the Pepco qualified individual reporting to the Maryland Department of the Environment. 11 The National Response Center serves as the communications hub of the National Response System, which is the Federal Government’s mechanism for providing emergency responses to discharges of oil and releases of chemicals. The National Response Center receives reports of all reportable oil and hazardous substance releases anywhere in the United States and its territories. The National Response Center then distributes incident reports to predetermined Government agencies based on National Response Center incident classification guidelines.

Factual Information 12 Pipeline Accident Report Around 1840, the Pepco Chalk Point general supervisor for operations received a call from the ST Services assistant terminal manager, who advised him that the ST Services tank level readings were 3,000 barrels (126,000 gallons) short, that the spill covered 3 to 4 acres in the wetlands at Swanson Creek, and that he had activated an oil spill contractor. He also said that ST Services personnel would be arriving in about 15 minutes to close the pipeline valve between Swanson Creek and the Ryceville Station. The notes made by the Pepco Chalk Point general supervisor for operations at this time recorded the figure of “3,000 barrels” and that a 3- to 4-acre area was affected by the release. At 1845, the Pepco qualified individual called the Maryland Department of the Environment to report the release. At 1850, the Pepco qualified individual called the Pepco Chalk Point general supervisor for operations and told him that he had reported a 2,000-gallon release to the Maryland Department of the Environment. About 1850, the Pepco senior environmental coordinator called the National Response Center and reported a 2,000-gallon No. 2 fuel oil release from a pipeline at the Pepco Chalk Point Generating Station, on the border of the facility property where the pipeline crosses Swanson Creek. The Pepco senior environmental coordinator stated that he understood from people at the plant that most or all of the release was in the creek. The Pepco senior environmental coordinator also reported that the incident was discovered at 1817 on Friday, April 7, and that a clean up and an investigation into the cause of the accident were underway. The Pepco senior environmental coordinator indicated that Pepco had booms in the creek, that materials to absorb oil were being used, and that clean- up contractors had been activated. He reported that he was not aware of any injuries or evacuations. The National Response Center watch officer designated the release notification as Incident Report No. 525411 and, lacking information on the exact source of the leak, inaccurately classified it as a fixed (power plant) facility incident rather than a pipeline-type incident. The National Response Center officer sent notifications to the agencies on the fixed facility distribution list.12 Following the Pepco senior environmental coordinator’s notification of the National Response Center, the Pepco qualified individual notified the U.S. Coast Guard Marine Safety Office in Baltimore, Maryland. By 1850, the Pepco spill response teams had completed the initial deployment of more than 1 mile of floating boom in the wetland area on the north side of Swanson Creek and at the mouth of Swanson Creek on the Patuxent River. About 1911, the National Response Center notified Environmental Protection Agency (EPA) Region III (Philadelphia) of the accident by fax.13 About 1930, the on-call EPA Federal On-Scene Coordinator for Region III contacted the Prince George’s County Fire Department requesting directions to the site and was advised that Prince George’s County had not been notified of the spill. 12 The National Response Center maintains a number of distribution lists. The Office of Pipeline Safety was on the pipeline accident distribution list but not the fixed facility accident distribution list. 13 The EPA responds to spills in the inland areas of the United States, and the Coast Guard responds to spills in U.S. coastal and inland waterways.

Factual Information 13 Pipeline Accident Report The EPA Federal On-Scene Coordinator contacted the Pepco senior environmental coordinator and advised him to call the Prince George’s County Communication Center and provide the spill information. The Pepco senior environmental coordinator contacted the Prince George’s County Communications Center and advised the center that “2,000 gallons of No. 2 fuel oil was released and county fire response was not necessary.” The communications center informed the county’s hazardous materials coordinator about the spill, and the hazardous materials coordinator arrived at the accident site within 15 minutes to assess the situation. About 2015, the Pepco qualified individual stated that when he returned to the Chalk Point command center, he learned from the information blackboard that the estimated spill volume was 3,000 barrels (126,000 gallons), rather than 2,000 gallons. The Pepco qualified individual stated that he advised Maryland Department of the Environment and Coast Guard representatives, following their arrival on the scene about 2030, that the spill was “closer to 3,000 barrels in quantity.” Shortly afterwards, this information was relayed to the Coast Guard Baltimore office and the State emergency response duty officer. At 2035, the responders from the Maryland Department of the Environment called their emergency response duty officer and advised him that the updated release amount was 3,000 barrels. Between 2030 and 2100, outside response personnel (including spill response contractors, key Pepco responders, and State and Federal personnel) began arriving with additional boom and boom deployment boats to augment those that Pepco already had at the site. Around 2050, ST Services and other contractors working under Pepco’s direction began evacuating oil from the pipeline between the closed No. 1 river pit valve and the Chalk Point Pump Station. Shortly after 2100, members of Pepco’s engineering and maintenance services group confirmed a 3,000-barrel release, based on calculations using the tank level readings that ST Services used. The Pepco senior environmental coordinator stated that, when he arrived at the Chalk Point command center about 2130, he learned from the information blackboard that the release volume was estimated to be 3,000 barrels (126,000 gallons). The Pepco senior environmental coordinator stated that even though he had notified several agencies earlier of the 2,000-gallon amount, he did not revise the 2,000-gallon notification because he believed representatives of all the agencies he had notified were on-scene or in contact with each other. Around 2300, Pepco conducted a command post briefing, during which participants reviewed the boom placement and the need to augment the boom Pepco had already deployed to contain the oil. They agreed for the night to place booms to direct the oil to a point accessible to a vacuum truck. The command post briefing also covered plans for deploying additional boom at 0600 on April 8, before the anticipated tide change. During the remainder of the night, Coast Guard Baltimore office representatives and the Maryland Department of the Environment on-scene coordinator worked with Pepco and its spill response contractors to contain the spill and prepare collection efforts.

Factual Information 14 Pipeline Accident Report April 8. Shortly after 0115, a member of the Prince George’s County Hazardous Materials Team contacted the National Response Center watch officer and advised the watch officer to update the Coast Guard Baltimore office about the accident status. He also asked the watch officer whether the Chalk Point event constituted a transportation- related incident requiring notification of the U.S. Department of Transportation’s Office of Pipeline Safety. Subsequently, the National Response Center determined that the accident was a pipeline incident rather than a fixed facility incident and distributed the original incident report, containing the 2,000-gallon spill estimate, to its pipeline notification list, including the Office of Pipeline Safety and the Safety Board. Around 0250, the Coast Guard Federal on-scene representative arrived at the accident site to coordinate Federal, State, and local efforts. The Coast Guard representative provided Pepco with a copy of the Baltimore Area Contingency Plan and discussed with Pepco representatives the possibility of pre-staging booms at environmentally sensitive creeks identified under the area contingency plan. After assessing the spill location, the Coast Guard representative notified the Coast Guard Baltimore office that the spill was located above the Benedict Bridge on Highway 231. According to the Baltimore Area Contingency Plan, Benedict Bridge marks the jurisdictional dividing line between the Coast Guard Baltimore office and the EPA’s Region III. Had the spill passed under Benedict Bridge, it would have been considered within the Coast Guard’s geographic jurisdiction. Around 0330, the Coast Guard Baltimore office notified EPA Region III that the spill was in the EPA’s geographic jurisdiction and that Coast Guard personnel were responding. Several hours later, when the Coast Guard representative on-scene was able to view the wetlands area in daylight, he updated the Coast Guard Baltimore office. Shortly after 0530, the Coast Guard Baltimore office advised the EPA Federal On-Scene Coordinator that although the Coast Guard had personnel on the scene, the EPA should take the lead for the spill, because the spill was contained in the wetlands and it had significantly contaminated the wetlands area, including the local wildlife, with oil. Shortly after 0600, the EPA Federal On-Scene Coordinator deployed from Philadelphia with an EPA technical support contractor. Around 1015, the EPA Federal On- Scene Coordinator arrived at the site and assumed responsibility from the Coast Guard for directing the clean-up activity. Soon afterwards, the EPA Federal On-Scene Coordinator learned for the first time that the quantity of oil released was actually 3,000 barrels, rather than 2,000 gallons, of a mixture of No. 2 and No. 6 fuel oil. About 1100, the EPA Federal On-Scene Coordinator held an organizational meeting with representatives of all the parties, including Pepco, Pepco’s three spill response contractors,14 the Maryland Department of the Environment, the Coast Guard, and the U.S. Fish and Wildlife Service. At the meeting, those attending agreed that: 14 The contractors were A&A Environmental Services, Wood Chuck Enterprise, and Clean Harbors (standby contactor).

Factual Information 15 Pipeline Accident Report • The Unified Command (the EPA, the Maryland Department of the Environment, and Pepco) would direct the management of the response effort.15 • The responders would continue with the existing boom placement. The containment and clean-up efforts appeared to be effective, and there was no apparent threat to public health. • Because of the large amount of free product in the wetlands, the primary emphasis should be on collection of oil in advance of a storm expected by early evening. • With the spill contained in the wetlands, the Unified Command would release the standby contractor, Clean Harbors. The weather forecasts changed throughout the afternoon. Earlier forecasts tended to indicate the approach of a relatively weak storm, but the weather reports became more threatening as the day progressed. Around 1600, and with the expected approach of severe winds and heavy rains, the EPA and the Maryland Department of the Environment surveyed Pepco’s site response activities and revised the storm plan so that additional collection resources were placed at the secondary containment points and outer booms. During the early stages of the response, Pepco deployed about 300 of its own employees and spill response contractors to assist with the oil recovery efforts. (See figure 6.) Pepco response personnel were on rotating 8-hour shifts. The EPA Federal On- Scene Coordinator noted that those coming on shift typically were not briefed before or after arriving at the scene. Little information was shared between shifts of employees. Pepco response officials stated that they often were not included in the meetings conducted by the EPA Federal On-Scene Coordinator. In some cases, they could not attend such meetings because it was physically impossible; the space provided for the meetings was inadequate to accommodate all those wishing to attend. Pepco indicated that because of these problems with the meetings, some of the orders of the Unified Command were not clearly communicated to its personnel.16 At the same time, some meeting attendees were not essential to the response effort. 15 A Unified Command is an element within the Incident Command System that represents the key organizations responding to the incident. Under the National Contingency Plan, the Unified Command typically consists of the Federal On-Scene Coordinator, the State on-scene coordinator, and the incident commander of the responsible party. 16 From a letter, dated August 3, 2000, from Pepco’s incident commander for the Chalk Point response to the EPA Federal On-Scene Coordinator for the response concerning lessons learned from the emergency response to the Chalk Point oil spill.

Factual Information 16 Pipeline Accident Report Because Pepco’s qualified individual changed with every 8-hour shift, the Pepco qualified individual did not provide continuity of response and often had to check with other Pepco officials before providing assistance requested by the EPA Federal On-Scene Coordinator. In her postaccident description of events, the EPA Federal On-Scene Coordinator cited the frequent changing of Pepco’s qualified individual and stated that it led to “episodes of miscommunication and unclear lines of authority during the initial key dates of the response.”17 During the first 24 hours of the spill response, three sets of booms had been deployed, and the oil spill was contained in about 5 acres of wetlands. However, during the evening of April 8, the weather deteriorated, and conditions included winds in excess of 50 mph and strong rain showers. Because of the heavy rains and high wind gusts, the outer booms were breached about 2030, releasing a significant amount of oil into the Patuxent River. (See figure 7 for an aerial photo of two plumes of oil in Swanson Creek, moving toward the Patuxent River.) During the night, Pepco’s spill response contractors attempted to deploy additional personnel and equipment, but the weather made it unsafe for workers to be in the wetlands area or on the river, so they could not be deployed. (See appendix C for a listing of the significant events between the recognition of the leak and the loss of oil containment.) Figure 6. Response personnel working on wooden mats in the marsh. 17 Environmental Protection Agency, After-Action Report for Emergency Response at the Swanson Creek Oil Spill Site, Aquasco, Maryland, Prince George’s, Charles, Calvert, and St. Mary’s Counties 7 April 2000 to 16 May 2000, p. 30.

Factual Information 17 Pipeline Accident Report Response to Escape From Containment After the storm caused the oil to escape containment on the evening of April 8, the Unified Command attempted, primarily using Pepco contractor resources, to reestablish control over the spill. The efforts were unsuccessful until the Unified Command 1) obtained additional personnel to implement an Incident Command System structure on April 11, and 2) obtained additional marine response equipment for oil recovery. Between April 8 and 12, the oil plume spread approximately 17 miles (linear) downstream, affecting approximately 40 miles of shoreline, including several environmentally sensitive and populated creeks in Calvert and St. Mary’s Counties. (See figure 8 for creek boom locations and spread of spill.) The major events that took place during the response to the oil’s escape from containment are provided below. April 9. In the early daylight hours of April 9, an oil plume was observed traveling in a straight line from the mouth of Swanson Creek across the Patuxent River towards Calvert County. At 0745, the EPA Federal On-Scene Coordinator contacted the Baltimore office of the Coast Guard to state that the containment had failed and to ask the Coast Guard to identify potential Federal resources with marine capabilities. The Coast Guard directed the EPA Federal On-Scene Coordinator to several possible sources of assistance (Patuxent Naval Air Base, etc.) in the vicinity. Shortly thereafter, Pepco informed the EPA Federal On-Scene Coordinator that it was having difficulty obtaining the necessary contractor resources with marine capabilities, particularly the waterborne skimmers and skimming vessels needed to respond effectively. Figure 7. Aerial photo of Swanson Creek area taken on April 10, 2000 showing two plumes of oil moving with the creek flow towards the Patuxent River after containment was lost.

Factual Information 18 Pipeline Accident Report As the morning progressed, Pepco’s contractors were deployed in an effort to corral the moving oil plume on the river with booms before it could affect the Calvert County shoreline. The effort was unsuccessful. By mid-afternoon, the EPA Federal On-Scene Coordinator, other EPA officials on the scene, the Maryland Department of the Environment on-scene coordinator, and a U.S. Department of the Interior representative had met and agreed that the spill represented a substantial threat to public health and the environment. As a result, the EPA contracted with the Marine Spill Response Corporation, an environmental spill response contractor, to provide on-water response services and personnel.18 At 2100, another meeting was held, during which the protective booming of the environmentally sensitive Hunting, Indian, and Trent Hall Creeks, all of which fed into the Patuxent River, was given a high priority. As a result, it was decided to continue contractor response efforts through the night. April 10. Around 1200, the EPA Federal On-Scene Coordinator and the Maryland Department of the Environment on-scene coordinator toured the accident site with the Figure 8. Spill site map showing creek boom placements and range of oil spill. 18 The Marine Spill Response Corporation is a not-for-profit organization that is funded by member companies. It allows only the Federal Government or member companies to hire it to respond to spills involving releases greater than 1,200 barrels. Pepco was not a member company. Trent Hall Creek I n di an C ree k Patuxent River Washington Creek Battle Creek Hunting Creek S w an so n Cr ee k CALVERT COUNTY CHARLES COUNTY PRINCE GEORGE’S COUNTY ST. MARY’S COUNTY Spill Site Spill Site 1 mile Barrier Booms Oil Spill 231 2 4 6 5 235 Chalk Point

Factual Information 19 Pipeline Accident Report Pepco qualified individual and expressed concern that 1) Pepco’s spill response contractors had not completed booming the threatened creeks according to plans, 2) the contractors were making ineffective use of the available response resources, and 3) the reports being provided to the Unified Command by Pepco about the progress of the response effort were inaccurate. In recognition of the problems, at 1430, the EPA Federal On-Scene Coordinator asked Coast Guard on-site personnel to develop an Incident Command System structure for the response, under her direction. About the same time, the EPA Federal On-Scene Coordinator strongly advised Pepco that it had to greatly increase its logistical support for and control over the response contractors and that a spill management contractor was needed. At the 2100 staff meeting, the EPA Federal On-Scene Coordinator stressed the need to deploy protective boom around the creeks. She directed Pepco to immediately deploy protective booms at Hunting, Indian, and Trent Hall Creeks. At 2200, the EPA Federal On-Scene Coordinator requested that the Coast Guard provide 25 employees by 0600 on April 11 to staff the Incident Command System structure that was being developed. April 11. By 0300, the booming of the creeks had not been completed. The EPA Federal On-Scene Coordinator again directed Pepco to protectively boom the creeks. At 0715, an overflight of the affected area showed that no boom had been installed to protect the creeks and that Trent Hall and Indian Creeks both showed evidence of significant oil contamination. At the 0900 meeting, Pepco indicated that it was attempting to bring additional contractor resources to the scene. The EPA Federal On-Scene Coordinator, in recognition of the “continued failure of the Pepco contractors to carry out direction from the Unified Command,”19 began preparing to have additional Federal environmental responders participate in the Incident Command System structure. The Coast Guard Captain of the Port of Baltimore arrived on the scene about 1100, with additional personnel to staff the Incident Command System structure that had been developed since the previous day. Organizational functions were split into four sections— operations, planning, logistics, and finance—and Unified Command officials managed each section. All field operations were carried out under the direction of the operations section. The newly arriving Coast Guard personnel were designated to monitor the field operations being conducted by Pepco’s contractors to ensure that work was completed in a timely and efficient fashion. The EPA Federal On-Scene Coordinator again asked Pepco to hire a spill management team to manage its contractors and the spill response. Pepco subsequently stated that a firm had been contracted to provide logistic management support and keep track of the contractor and equipment resources at the site. 19 Environmental Protection Agency, After-Action Report for Emergency Response at the Swanson Creek Oil Spill Site, Aquasco, Maryland, Prince George’s, Charles, Calvert, and St. Mary’s Counties, 7 April 2000 to 16 May 2000. Appendix A, Incident Chronology, p. A-9.

Factual Information 20 Pipeline Accident Report During the remainder of the day, protective booming was provided for Hunting Creek, and protective boom was pre-staged for deployment on April 12 for four more creeks. April 12 and Afterwards. Once the Incident Command System structure was implemented, recovery operations were conducted and monitored around the clock with day and night crews. Protective booms were provided for threatened creeks on April 12 and 13. Eventually, more than 1,000 contract workers were hired to assist with the clean- up operations. Restrictions on boating were imposed, and the Maryland Department of the Environment issued a precautionary advisory on the harvest and consumption of fish and crabs from the contaminated areas on the Patuxent River. A rehabilitation center for wildlife was established for oiled animals. By April 13, Marine Spill Response Corporation skimmers had completed the collection of free oil in the main body of the Patuxent River. Free oil continued to be collected through April 16 in several affected creeks in St. Mary’s County. During the last few days of April 2000, the Unified Command developed a long-term site remediation plan addressing oil removal from the wetlands, soil treatment, site decontamination, and demobilization. On May 16, 2000, the Unified Command declared the emergency response phase over. (See appendix D for a timeline of the significant developments in the environmental response effort.) Damage Total environmental clean-up costs were approximately $71 million. On April 24, 2000, the Maryland Department of the Environment lifted the advisories it had issued earlier against the harvest and consumption of products from the Patuxent River. Based on laboratory analyses of crab, fish, and shellfish samples, the Maryland Department of the Environment determined that eating these river products would not pose a significant potential for adverse human health effects. In addition, the Maryland Department of the Environment stated that it had determined that no permanent damage had been done to fishing resources as a result of the spill. Personnel Information The ST Services Chalk Point operator on the day of the accident was a plant mechanic with over 7 years’ experience on the Piney Point Oil Pipeline. His duties included repairing pumps, valves, and construction equipment and being an equipment and pipeline operator when required. He reported to the ST Services maintenance foreman.

Factual Information 21 Pipeline Accident Report The ST Services Ryceville operator on the day of the accident was a plant mechanic with 7 years’ experience on the Piney Point Oil Pipeline. His duties included repairing pumps, valves, and construction equipment and being an equipment and pipeline operator when required. He reported to the ST Services maintenance foreman. The ST Services maintenance foreman had over 3 years’ experience on the Piney Point Oil Pipeline. His duties included supervising five employees in terminal and pipeline operations and maintenance. He reported to the ST Services assistant terminal manager. The ST Services assistant terminal manager started working at the Piney Point Terminal in 1973 in various positions, which included carrying out pipeline operations and maintenance responsibilities for the previous terminal owner. He had approximately 5 years’ experience with ST Services as an assistant terminal manager with responsibilities for the Piney Point Terminal and the Piney Point Oil Pipeline. He reported to the Piney Point Terminal manager. Postaccident Examination The April 7, 2000, pipeline rupture occurred at the Chalk Point Generating Station in southeastern Prince George’s County. At this location, the pipeline was on Pepco property and passed through wetlands adjacent to Swanson Creek, a tributary to the Patuxent River. The release point was 127 feet north of valve pit No. 1 on Pepco property. The pipe at the failure area was 12 3/4-inch-diameter, 0.203-inch wall thickness, American Petroleum Institute (API) 5L grade X42 electric resistance weld steel pipe, installed with 1-inch polyurethane thermal insulation and a 170-mill polyethylene jacket exterior coating. The pipe was insulated and coated before the field bend at this location was made during the pipeline’s installation. The pipeline was buried about 3 1/2 feet deep at the rupture location. The rupture area was excavated a few days after the failure. When the pipeline was exposed, the profile of a buckle could be seen through the pipe coating. (See figure 9.) When the pipe coating was removed, a crack in the circumferential direction was visible. In a postaccident communication from Pepco to Safety Board staff, Pepco stated it had reviewed the recorded pressure information, the size of the pipeline crack, and the pipeline operating conditions at the time of the accident and determined that, to release the estimated 129,000 gallons of product spilled, the pipe failure had to have occurred at least 5 hours before the Chalk Point pump began cavitating at 1430 on April 7, 2000. A subsequent communication from Mirant (current operator of the pipeline)20 to Safety Board staff noted that the failure had probably occurred during the startup of the Chalk 20 Pepco sold the Piney Point Oil Pipeline and the Chalk Point Generating Station in December 2000. Mirant subsequently became the pipeline owner and operator.

Factual Information 22 Pipeline Accident Report Point pump, about 0715, when pipeline pressure was at its highest. Mirant also indicated that the final estimated release quantity was about 3,343 barrels (140,400 gallons). Tests and Research A 53-inch-long section of pipeline taken from the scene was examined at the Safety Board laboratory. The pipe was bent and contained an outward-protruding buckle on the inside radius of the bend. The angle of the bend in which the buckle was formed was determined to be in the 5- to 6-degree range. The buckle extended around 270 degrees of the pipe circumference, from approximately the 10 o’clock to the 7 o’clock position. (See figure 10.) The pipe was deformed into a slightly elliptical shape. The buckle area contained an open crack at the crown of the buckle, which extended from approximately the 2 o’clock to the 4 o’clock position. The maximum height of the buckle was approximately 1 inch at the 3 o’clock position on the inside of the bend. The crack was 6 1/2-inches long by 3/8-inch wide at its widest portion. (See figure 11.) No external corrosion was noted on the pipe section when it was examined under a microscope. The interior surface of the pipe in the area of the buckle peak contained a number of shallow secondary cracks. All the cracks were circumferentially oriented, confined to the permanently deformed area of the pipe (approximately 1/4 inch from the buckle apex), had blunt tips, and were filled with corrosion products. Some of these cracks exhibited slight branching. The appearance of these cracks was typical of corrosion fatigue cracking in low carbon steels, resulting from exposure to high stress amplitudes. Figure 9. Indication of the buckle (Arrows show buckle location).

Factual Information 23 Pipeline Accident Report Figure 10. Inside view of the buckle in the removed section of pipe. Figure 11. 6 1/2-inch-long, 3/8-inch-wide crack, with coating system shown at the left edge of photo.

Factual Information 24 Pipeline Accident Report A scanning electron microscope examination revealed five well-defined fracture zones. Figure 12 illustrates the fracture surface profile of the failure. Bracket “a” starts at the interior surface of the pipe, showing a fracture from corrosion fatigue. Brackets “b,” “c,” and “d” show the crack propagation planes changing from 45 degrees from the surface of the pipe to roughly perpendicular, showing both tensile overstress and fatigue propagation, and contain no evidence of corrosion. Bracket “e” shows the crack propagation changing to a 45-degree shear plane. The final separation zone adjacent to the exterior surface of the pipe reveals dimpled features typical of ductile overstress fractures. Piney Point Oil Pipeline Pipeline Information The Piney Point Oil Pipeline was constructed for the Steuart Petroleum Company in 1971 and 1972 and put in service in 1973. Pepco purchased the pipeline in 1976. In 1995, ST Services purchased the Piney Point Terminal facility from Steuart Petroleum, and ST Services operated the pipeline for Pepco with former Steuart Petroleum personnel. Fuel oil was delivered to the Piney Point Terminal by marine vessels and then transported from the terminal by the Piney Point Oil Pipeline. The 51.5-mile-long pipeline system was composed of 12-inch and 16-inch-diameter pipeline segments that were used Figure 12. Fracture surface profile of failure.

Factual Information 25 Pipeline Accident Report to transport heated fuel oil from the Piney Point Terminal, via the intermediate Ryceville Station, to generating stations at Chalk Point and Morgantown. The pipeline segment from Ryceville to Chalk Point was approximately 11 miles long. The oil was heated to make it flow more easily, and the system operated up to approximately 160° F. 1995 In-line Inspection. The Ryceville to Chalk Point segment of the Piney Point Oil Pipeline was internally inspected in November 1995 with a geometry tool and an in- line magnetic flux leakage tool. After receiving the inspection reports in January 1996, Pepco exposed the pipeline and examined corrosion anomalies at 29 locations in spring

1. The data from the magnetic flux inspection did not correlate well with field

measurements for either wall loss data or odometer readings. Pepco’s Pipeline Working Group recommended that an additional in-line inspection be conducted in 1997 using ultrasonic inspection tool technology. 1997 Pipetronix In-line Inspection. Pepco contracted with the ultrasonic in-line inspection contractor Pipetronix21 to conduct a pipeline inspection on August 16, 1997. Before conducting its ultrasonic inspection tool survey, Pipetronix subcontracted for an in- line caliper tool22 survey, which was completed on August 11, 1997. Pipetronix had the caliper tool run to confirm that there were no physical obstructions in the pipeline that would prevent passage of the ultrasonic inspection tool. On August 16, 1997, Pipetronix examined the segment of the Piney Point Oil Pipeline from Ryceville to Chalk Point with an ultrasonic inspection tool. Pepco required that Pipetronix prepare a final report for the inspection that would include a complete, written survey report for the pipeline. The report would provide the pipeline operator data, including all types of corrosion, gouging, pipeline fittings (such as T-pieces,23 valves, etc.), girth welds, wall thickness changes, special features (such as externally welded patches, insulating flanges, etc.), and differentiation between internal and external corrosion (for general surface corrosion, pitting, and channeling).24 According to the contract, Pipetronix was to use a multi-step process to identify and interpret each feature in the pipeline, as follows:

1. Field check of the data at random locations immediately after the tool run is

completed,

1. Search of the data by automatic computer programs to detect girth welds, pipe

installations, defects (internal and external), markers, and other features, 21 On November 25, 1999, Pipeline Integrity International Ltd. acquired the Pipetronix Group. The subsidiary PII North America, Inc., now controls those assets that belonged to Pipetronix in the United States. 22 A caliper tool is an in-line inspection device used to determine the geometrical condition of the pipe, including the size and location of abnormalities. 23 A T-piece is normally a tee pipe-fitting welded into a pipeline, although alternatively, a T-piece may be made by welding a pipe stub to a pipeline and drilling a hole into the pipeline. 24 National Association of Corrosion Engineers Standard RP0102-2002, Recommended Practice In- Line Inspection of Pipelines, table 1, lists the types of in-line inspection tools and inspection purposes.

Factual Information 26 Pipeline Accident Report

1. Computer generation, with relevant input from the interpreter, of a features list,
2. Interpretation by the interpreter of each feature found in the search phase.

The completed pipeline features list was to contain all features recorded in the tool run and present the results of the interpretation in condensed form. The report noted that data collected during the tool run were systematically evaluated according to criteria defined in the contract between Pipetronix and Pepco. Pipetronix performed this evaluation in five phases: • Phase 1: Handover of data from the workshop (integration within the management of the department, handover meeting, familiarizing of the project leader); • Phase 2: Preparation of the interpretation; • Phase 3: Main interpretation (automatic interpretation, manual interpretation, feature list editing, quality check); • Phase 4: Summarizing of the results (handover of the features list to the client, discussion of the results for the final report, documenting of the features, completion of the final report, quality check); • Phase 5: Project completion, including forwarding the final report to Pepco. After the August 1997 Pipetronix inspection, the pipeline segment from Ryceville to Chalk Point was excavated and exposed in 12 places in fall 1997. The pipeline was inspected and repaired at locations indicated by the ultrasonic inspection to have the deepest and most severe corrosion. At these locations, Pepco determined that the Pipetronix in-line inspection data correlated relatively well with the field measurements made of the pipe-wall thickness using an ultrasonic testing instrument. However, Pepco found that some locations had more severe corrosion than had been indicated by the ultrasonic inspection. Pipetronix provided the results of the inspection of the Ryceville to Chalk Point segment of pipeline to Pepco in a final report dated January 20, 1998. The final report included general information about the ultrasonic inspection tool used, the ultrasonic measuring method, the design of the tool, the benefits and limitations of the tool, the survey procedures, the procedures for evaluating the collected data, and a detailed table of pipeline features. Pipetronix’s interpretation of the tool data was included in an appendix to the final report entitled “Features List.” The report identified and located by station number various pipeline features, including external metal loss, internal metal loss, laminations, flanges, field bends, weld-o-lets, hot bends, dents, sleeves, markers, girth welds, valves, and T- pieces. Pepco used Pipetronix’s in-line inspection report to establish the baseline conditions of the pipeline and to conduct its excavation and field inspection program.

Factual Information 27 Pipeline Accident Report Excluding various aboveground features at the pig launcher and receiver, the Pipetronix features list identified three T-pieces in the pipeline. Two T-pieces were approximately 1,519 feet apart, one on each side of Swanson Creek, at odometer stations 51887.20 and 53406.10. The third identified T-piece, which was actually the buckle that failed on April 7, 2000, was identified as being located at odometer station 53526.55. After conducting a postaccident review of the inspection log for the August 1997 in-line inspection, Pipetronix determined that its analyst had inaccurately interpreted the log indication at odometer station 53526.55 as a T-piece. At the time of the in-line inspection, Pipetronix’s software reference library did not include a standard image of an outward protruding buckle, such as the one at odometer station 53526.55. Pipetronix acknowledged that, based on its knowledge at the time, the feature should have been interpreted as an “unknown.”25 Before the April 7, 2000, accident, Pepco had authorized another ultrasonic pipeline inspection to be conducted by Pipetronix in April 2000. At the time of the accident, Pepco was cleaning the pipeline to prepare it for this upcoming in-line inspection to take place later in April 2000. Operations The pipeline was operated manually for startup and shutdown.26 The Ryceville Station was normally left unattended after initial system startup when no pump was operating at Ryceville. Pipeline operating data were not periodically transmitted to the Piney Point Terminal. The pipeline monitoring system transmitted pipeline pressure, temperature, and flow rate alarms to Piney Point. The pipeline alarms were displayed on the computer screen at the Piney Point Terminal, and audible alarms alerted the ST Services operator on duty to pipeline operating conditions that were outside predetermined limits. Using his computer terminal, the ST Services shift supervisor’s operating practice while serving as the pipeline controller was to verify the system alarm status, as well as pressure, temperature, and flow rate information, once each 8-hour shift. The alarm data were stored at each station for 30 days and could be printed locally at each station if a data review was desired. The pipeline computer monitoring system provided the operations data it was designed to gather during No. 6 fuel oil transfers. Pepco’s Piney Point Oil Pipeline Manual required that during a No. 6 fuel oil transfer, the ST Services pipeline controller had to conduct a daily recording of meter readings and to communicate daily with Pepco operations personnel to ascertain the delivered quantity, flow rate, available tank capacity, and estimated time of operation completion. The Pepco manual further required that the ST Services pipeline controller 25 A postaccident Office of Pipeline Safety report that evaluated the 1997 Pipetronix survey found that the ultrasonic inspection tool provided good characterization of the pipeline’s physical elements, such as the valves, tees, bends, fittings, and points of deformation. The report also found that the tool recorded an indication of a buckle at the location of odometer station 53526.55, but the Pipetronix analyst mischaracterized the indication as a T-piece. 26 The pipeline was operated on an as-needed basis when a No. 6 fuel oil transfer was required for a generating station.

Factual Information 28 Pipeline Accident Report record the pipeline pressure, temperature, and flow rate at Piney Point at 4-hour intervals during a No. 6 fuel oil transfer. The ST Services pipeline controller did not continuously monitor pipeline operating conditions. The ST Services pipeline controller could receive a call from the system that a pipeline operating parameter was out of allowable tolerance, and he could then access the monitoring system to determine the nature of the alarm. Pipeline flushing was performed at the end of each No. 6 fuel oil transfer.27 Piping alignments for pigging operations were set up similarly to a flushing operation, although there were obvious differences in routing the product through the pig traps. The product did not flow through the meter at the Chalk Point Station during a flushing operation or during the pigging operation on the day of the accident. In addition, the meters and pressure-sensing points at the Chalk Point Station were not in the oil flow path, and the temperature-sensing equipment was not in the direct oil flow path to the Ryceville Station. The pipeline monitoring system was not capable of monitoring pipeline operating conditions because of the meter location and the locations of the sensing points. Pipeline shift supervisors and operators had no predetermined line balance limits to follow to assess pumped and delivered product volumes during flushing or pigging operations. Pepco’s Piney Point Oil Pipeline Manual did not require any pipeline operations personnel to perform periodic line balance calculations during a flushing or pigging operation, nor did they do so. The abnormal operating condition procedures described in section 7.4, paragraph 5.2, of Pepco’s Piney Point Oil Pipeline Manual required the ST Services terminal duty operator or pipeline operator mechanic to report any abnormal fuel oil system operating condition that was indicated by 1) an alarm condition on the pipeline monitoring system, 2) a visual indication of a local pressure or level indication, 3) an abnormal system operating indication from the Pepco generating station senior power plant operator, 4) or the One-Call system. Paragraph 5.3 provides an example of an abnormal system operating condition, which it termed an: Increase, decrease or an alarm differential in the fuel oil system pressure or flow rate outside of normal steady state operating conditions as indicated by a computer monitoring alarm condition or a local pressure instrumentation. Pipeline Maps and Records The original Piney Point Oil Pipeline alignment sheets and as-built drawings were destroyed in a fire before Pepco purchased the pipeline in 1976. Title 49 CFR 195.404 requires operators to have maps and records that include at least the following information: 1) the location and identification of breakout tanks, pump stations, scraper and sphere facilities, pipeline valves, cathodically protected facilities, facilities in an immediate response area not equipped to fail safe, facility rights-of-way, and overpressure safety devices; 2) all crossings of public roads, railroads, rivers, buried utilities, and 27 Flushing is the process of pumping flushing oil in the reverse direction of normal flow in the pipeline to displace the No. 6 fuel oil from the pipeline before it cools to the point that it cannot be pumped.

Factual Information 29 Pipeline Accident Report foreign pipelines; 3) the maximum operating pressure of each pipeline; and 4) the diameter, grade, type, and nominal wall thickness of all pipe. During 1993 and 1994, Pepco had pipeline alignment maps made based on aerial photography and created drawings for aboveground piping of Piney Point Oil Pipeline facilities. Meteorological Information At mid-afternoon, on April 7, 2000, Reagan Washington National Airport (about 40 miles northwest of the accident scene) recorded a maximum wind speed of about 19 mph. The temperature was 77° F, and the sky was overcast. By mid-afternoon on April 8, 2000, wind gusts of about 50 mph were recorded at the airport. Conditions were rainy, and the temperature was approximately 57° F. During the evening of April 8, rains in excess of 1 inch and winds over 50 mph were experienced in the Chalk Point area. Pepco Oil Spill Preparedness Under 49 CFR 194.101, pipeline operators are required to submit a spill response plan to the Research and Special Programs Administration (RSPA) for review and approval. Pepco had provided such a plan to RSPA. According to the regulation, the plan must address a response to a worst-case discharge and the threat from such a discharge. It must also include procedures for conducting drills, including identifying the types of drills to be conducted and their schedules. Appendix A to Part 194 provides recommendations concerning the topics that the response plan must address. Under section 7, concerning drill procedures, it is recommended that drills be conducted on the following topics at the following frequencies: • Quarterly drills on emergency procedures and notifications of qualified individuals for manned pipelines; • Quarterly drills involving emergency actions by assigned operating or maintenance personnel and notifications of qualified individuals for unmanned pipelines; • Annual tabletop exercises involving the shore-based management team; • A drill once every 3 years that exercises the entire response plan for each response zone of the pipeline system. In September 1996, a tabletop exercise was conducted at Chalk Point under the direction of RSPA’s Office of Pipeline Safety, with the participation of the Coast Guard. The response exercise involved a hypothetical spill at the Pepco Morgantown facility of 800 barrels of No. 6 fuel oil into the Wicomico River. This was a coastal inland waterway release scenario, within the Coast Guard’s jurisdiction. (The EPA did not participate in the drill.) The Office of Pipeline Safety sponsored the tabletop exercise to assess Pepco’s pipeline emergency preparedness under the National Preparedness for Response Exercise

Factual Information 30 Pipeline Accident Report Program and the Oil Pollution Act of 1990. Specifically, the objectives of the tabletop exercise were to: Validate the emergency response plans and procedures of Pepco, and to enhance participants’ knowledge of the appropriate plan and procedures (e.g. Facility Response Plan, Area Contingency Plan, State Contingency Plan, etc.)[28] In the review that followed the exercise, Pepco received the following recommendations addressing incident management: The Pepco FRP [Facility Response Plan] should be revised to reflect how Pepco intends to direct response and resolve spill-related issues jointly with local, state, and federal responders. Additional training on the roles and responsibilities involved in these assignments should reinforce the policies of the oil spill contingency plan. The training should include all potential response groups if possible, to assist each group in clarifying its role in response operations and as a part of the unified system. The SMT [Spill Management Team] should ensure that other Pepco personnel potentially involved in response operations are also trained in their roles. New personnel assignment to perform the functions of the Incident Command System, revisions of their roles and responsibilities, and a description of how these will interact with the local, state and federal responders in the unified system should be reflected in the FRP.[29] According to Pepco,30 Revision No. 3 (dated March 13, 1997) of the Oil Spill Emergency Response Plan for the Ryceville Pumping Station and Pipeline incorporated the above comments. On August 26, 1997, Pepco submitted Revision No. 3 of the plan to the Office of Pipeline Safety, which, on October 27, 1997, completed review of the revised plan. The Office of Pipeline Safety stated that the revised plan adequately addressed the response planning recommendations made by the Office of Pipeline Safety based on the drill results. Between January 1999 and April 7, 2000, at least five notification drills were conducted for the Piney Point Oil Pipeline. Equipment deployment drills were conducted in July and November 1999. Postaccident Actions Office of Pipeline Safety Postaccident Requirements An April 12, 2000, Office of Pipeline Safety corrective action order stated that Pepco must not operate the Piney Point Oil Pipeline until the company: 28 Pepco Spill Management Team Tabletop Exercise Report, September 1996, prepared by the Corporate Response Group, Inc., for RSPA’s Office of Pipeline Safety. 29 Pepco Spill Management Team Tabletop Exercise Report. 30 Summary of Changes: Ryceville Facility Response Plan –Revision 3a, dated May 4, 1998.

Factual Information 31 Pipeline Accident Report

1. Develops adequate repair procedures,
2. Reviews and addresses procedures for leak detection,
3. Develops a plan with corrective measures to address leak factors including:

•Review existing instrumentation and improve manual line balance, •Develop and implement a training program for operations personnel, •Provide specific procedures and training for pipeline-system monitoring, •Review qualifications of operations personnel, and •Provide classroom and practical training exercises for the above training items. In an amended corrective action order issued on May 4, 2000, the Office of Pipeline Safety further required Pepco to:

1. [Conduct] Hydrostatic test[s] for integrity of pipe segment from Swanson

Creek to Chalk Point,

1. Review previous internal inspection, make needed repairs, and plan future

inspections,

1. Implement operations procedures for line monitoring during pigging activities,
2. Review and update schematic drawings.

Pipeline Safety Actions Since Accident Since the accident, Pepco began and Mirant continued (after its purchase of the Piney Point Oil Pipeline) to make improvements to comply with, and in some cases exceed, the Office of Pipeline Safety’s corrective action orders. Mirant prepared an integrity study to assess the risks posed by pipe wrinkles,31 to establish acceptance criteria for pipe wrinkles, and to remove all those wrinkles or defects not satisfying the acceptance criteria. Mirant also developed additional pipeline repair procedures. After all inspections and replacements were completed, the entire pipeline system was hydrostatically tested. The transport temperature for No. 6 fuel oil was reduced temporarily from 160° F to 125° F until the influence of heat on pipeline movement could be studied. Mirant installed supervisory control and data acquisition (SCADA) systems32 with software-based leak detection and radar tank gauges with remote reading capability on all Piney Point Oil Pipeline tanks, and the entire set of operations and maintenance procedures was rewritten. In support of this pipeline integrity focus, two different smart 31 A wrinkle is a smooth wave deflection of the pipe wall and may have a single inward or outward deflection or may include a sinusoidal waveform with both inward and outward displacements. 32 Pipeline controllers use SCADA systems to remotely monitor and control movement through pipelines. With a SCADA system, controllers can monitor flow rates and pressures along the lines and control valves and pumps to adjust the flow at pump stations and locations throughout the pipeline system.

Factual Information 32 Pipeline Accident Report pig technologies (ultrasonic and deformation inertial) were employed to inspect the entire pipeline system in May 2001. Mirant indicated that the evaluations were intended to provide a substantial new baseline for maintaining pipeline integrity, in addition to restoring pipeline activities. Mirant has put in place a new diversified pipeline management team that has indicated it intends to continue to use industry-recognized pipeline consultants. This team intends to prepare and manage a long-term integrity plan for the pipeline, consistent with the integrity management rule in Federal pipeline safety regulations. Mirant has employed its own pipeline operating personnel, which, Mirant states, have been trained in the new procedures and equipment. Mirant has implemented an internal audit process that it says will provide further assurance that all current regulatory and industry best practices are maintained. In accordance with the requirements at 49 CFR 194.101, Mirant submitted to RSPA in December 2001 a spill response plan dated May 2001. RSPA approved the plan on April 30, 2002. Mirant developed its facility emergency spill response plans with the assistance of industry experts. During the first 6 months of 2001, three revisions were made to the Oil Spill Emergency Response Plan for the Ryceville Pumping Station and Pipeline. Specifically, these changes addressed ownership and nomenclature adjustments, as well as additional revisions intended to clarify and simplify the plan. On July 27, 2001, Mirant published Response Strategies for Southern Maryland. Based on “operational experience gained during the Swanson Creek oil spill response and studies,” the manual was intended to provide tactical response information for use as a pre-planning document for response managers and crews. The manual identified key control points along and off the pipeline corridor where response actions might be taken should a release occur. One of the main elements in the manual was a site summary sheet for each of the primary control point locations. The summary sheets were prepared with map and chart references with global positioning system location data, location and general access instructions, general release/flow paths, information concerning receiving water bodies and selected sensitive features, and response protocols and tactics. Shortly after the manual was published, Mirant personnel met with the members of the Local Emergency Planning Committee, which represents the local public response agencies of the four surrounding counties, to familiarize them with the implementation of the manual. In 2001, Mirant conducted 11 drills concerning spill response (2 deployment drills, 5 tabletop drills, and 4 qualified individual notification drills). As of June 1, 2002, Mirant had conducted four spill response drills (one deployment, one tabletop, and two qualified individual notification) in 2002.

Factual Information 33 Pipeline Accident Report Other Information Incident Command System The Incident Command System concept was developed as a consequence of fires that destroyed significant environmental assets in 1970 in Southern California. Agencies recognized that they needed a system that allowed them to work together effectively and efficiently when conducting responses to the broadest range of emergencies, including incidents involving threats to lives, property, and the environment. A multi-agency task force subsequently developed the Incident Command System. The system consists of procedures for controlling personnel, facilities, equipment, and communications during an incident response. It is designed to be used from the time an incident occurs until response operations are completed. The Incident Command System structure has five major functional areas—command, operations, planning, logistics, and finance—but the structure is flexible and can be accommodated to the specific needs of each response. Consequently, it can be used for any type or size of incident. It provides a framework under which agencies may communicate and function using uniform terminology and operating procedures. The system is widely used by Federal, State, and local responders. Since the development of the Incident Command System concept, Incident Command System structures have been used at hundreds of incidents with general success. In February 1996, the Coast Guard officially adopted the National Interagency Incident Management System Incident Command System and has developed various training modules for it. In an April 24, 2001, letter to the Safety Board, the EPA Federal On-Scene Coordinator for the Chalk Point accident stated that: EPA currently has no formal policy on the use of Incident Command System/Unified Command. The National Response Team’s Technical Assistance document has been distributed to all EPA on-scene coordinator[s], and EPA headquarters has encouraged the inclusion of the Incident Command System/Unified Command into their Area Contingency Plans (ACP). However, EPA’s Regions have been provided the flexibility, consistent with the National Response Team’s Technical Assistance Document, to adopt response management structures that use an Incident Command System that may be consistent with National Interagency Incident Management System [NIIMS]. The Region III Inland Area Contingency Plan calls for a Unified Incident Command System that is not based on NIIMS. EPA has provided no written guidance to its regions on the use of Incident Command System/Unified Command beyond that provided in the National Response Team Technical Assistance Document Incident Command System/Unified Command— Managing Responses to Oil Discharges and Hazardous Substance Releases under the National Contingency Plan. The National Response Team, with the Regional Response Teams, constitutes the Federal component of the National Response System. The National Response Team and Regional Response Teams are made up of 16 Federal departments and

Factual Information 34 Pipeline Accident Report agencies. The EPA chairs the National Response Team, and the Coast Guard serves as Vice Chair. The EPA’s Office of Emergency and Remedial Response is developing an EPA policy position on the Incident Command System. Postaccident Assessments of Chalk Point Response EPA Federal On-Scene Coordinator. In her postaccident report on the Chalk Point response,33 the EPA Federal On-Scene Coordinator made numerous findings concerning a wide range of areas in which the response could have been improved and made suggestions to improve future responses. She acknowledged that the lack of a National Interagency Incident Management System-based Incident Command System structure hindered the establishment of resource tracking and accountability as the Chalk Point incident progressed. She also stated that because local responders were not included in the immediate response, their capabilities were not effectively used to disseminate information to the community or to coordinate response efforts. Regional Response Team. In its April 5, 2001, report on the Chalk Point accident response,34 the Regional Response Team review committee found that there appeared to have been no effective response management system, especially early in the incident. The committee considered that the task-oriented management structure originally used was not conducive to managing the rapid expansion of a major oil spill. The committee added that, although each incident is different, major oil spills have predictable elements that can be managed more effectively via Incident Command/Unified Command systems. As a result, the Regional Response Team review committee recommended that, in future incidents, the Incident Command/Unified Command system be immediately activated at the spill site to ensure that authority and responsibility are clearly assigned. Further, the Regional Response Team stated that the EPA should develop a guidance document on how to set up and run Incident Command/Unified Command systems, train all Federal On-Scene Coordinators in Incident Command/Unified Command systems, and consider augmenting the Federal On-Scene Coordinator with an Incident Command System/Unified Command management team. Coast Guard. In his August 25, 2001, letter addressing lessons learned from the Chalk Point accident response, the Chief of Marine Safety for the Fifth Coast Guard District indicated that the significant delay in establishing an Incident Command System contributed to a fragmented and ineffective response. He further stated: The Coast Guard has adopted the Incident Command System (ICS) as its emergency response process. We have found ICS to be a very effective spill management tool; particularly as the system is used by most State and Local response entities as well. 33 Environmental Protection Agency, After-Action Report for Emergency Response at the Swanson Creek Oil Spill Site, Aquasco, Maryland, Prince George’s, Charles, Calvert, and St. Mary’s Counties 7 April 2000 to 16 May 2000. 34 Swanson Preparedness and Response Review: Swanson Creek Marsh Oil Spill – April 2000, Final Report, dated April 5, 2001.

Factual Information 35 Pipeline Accident Report He noted that, although it appeared that the oil was well-contained in the wetlands early in the response, other factors were at play (wind, predicted storm, etc.) that might have led experienced response managers to recognize the precarious nature of the situation. He indicated that responders conducting overflights or other assessment activities should have analyzed the gathered information more accurately and realized that the oil was liable to break out of containment and enter the Patuxent River. He further found that the limited involvement of the local response community had a negative effect on the response effort. He indicated that local responders play a major role in site safety, provide local information needed by responders from other areas, and can help to establish the Unified Command and Incident Command System structures as soon as they arrive on the scene. November 2000 Safety Board Hearing on Pipeline Safety On November 15 and 16, 2000, the Safety Board held a pipeline safety hearing that focused on pipeline inspection, integrity verification, and leak detection and response. Participating in the meeting were representatives of Federal agencies, including the Safety Board, RSPA, and the Office of Pipeline Safety; the pipeline industry, including pipeline operators, in-line pipeline inspection services, and integrity assessment consultants; and academia and research institutes.35 In addition to addressing a wide range of other pipeline safety issues, pipeline industry representatives stressed the need for pipeline leak detection systems to have accurate pipeline instrumentation located at sensing sites. During the hearing, the RSPA Administrator stated that, to increase their efficiency, leak detection systems must be less dependent on the human pipeline controller. Hearing testimony also indicated that many leaks could be detected in a matter of minutes with a computational pipeline monitoring system, which would reduce the reliance of pipeline system operating parameters on human input. 35 For additional information on the presentations made during the November 2000 pipeline safety hearing, see the Web link at http://www.ntsb.gov/events/2000/pipeline_hearing/default.htm.

36 Pipeline Accident Report Analysis The Accident About 0715 on April 7, 2000, employees of Pepco’s contractor, ST Services, launched a cleaning pig in flushing oil from Pepco’s Chalk Point Station toward Ryceville Station on the Piney Point Oil Pipeline. For the next several hours, periodic tank levels were taken for the Chalk Point (origin) and the Ryceville (destination) Stations’ flushing oil tanks, but tank volumes were not calculated from the tank level readings and evaluated for line balance as the pumping operation proceeded. Because the pumping was progressing faster than expected, ST Services personnel operating the pipeline expected the cleaning pig to arrive at the Ryceville Station between about 1300 and 1330, but it did not. The ST Services Chalk Point operator became concerned and double-checked the tank level about 1412 because the pig had not arrived at Ryceville, and the Chalk Point pump began cavitating at 1430. About the same time, the flow of oil stopped at the Ryceville Station. By 1440, pipeline personnel had initiated the acquisition of current tank level measurements for line balance calculations at both stations and the checking of the Chalk Point manifold for misaligned valves. By 1534, they had calculated that Ryceville had not received 3,089 barrels (129,738 gallons) of the oil that had been pumped from Chalk Point. At 1538, pipeline operating personnel shut down the pipeline and initiated surface inspections at locations where the pipeline crosses roads and Swanson Creek to look for an oil leak. By 1802, a pipeline aerial patrol, which had been launched earlier at the direction of the Pepco Chalk Point general supervisor for operations, had reported sighting a pipeline leak in the wetlands near Swanson Creek, not far from the Chalk Point Station. Postaccident calculations performed by the Piney Point Oil Pipeline owners, which were based on review of the recorded pipeline pressure information, the operating conditions at the time of the accident, the size of the crack, and the amount of product spilled, indicated that the pipe failure occurred before 0930 on April 7, 2000, probably when the Chalk Point pump was started, about 0715, and the pipeline pressure was at its highest level. The Safety Board reviewed this analysis and found it credible. The pipeline ruptured at a wrinkle in a section of pipe that had been field-bent during initial construction of the pipeline in 1971 and 1972. The deformation, or wrinkle, that failed was a single outward deflection of the pipe wall, commonly described as a buckle. After the pipeline was placed in service, forces imposed on the deformed area of the bend, including the normal operating pressure and thermal cycles in the pipeline, caused repeated straining and eventual cracking until the pipe at the deformed area failed.

Analysis 37 Pipeline Accident Report Pipeline In-line Inspection Although in-line inspections were not mandated, Pepco maintained a program under which it periodically had in-line inspections conducted on the Piney Point Oil Pipeline to help ensure pipeline integrity. Pipetronix, an ultrasonic in-line inspection contractor, had conducted the last inspection of the pipeline before the accident on August 16, 1997. When the April 7, 2000, accident occurred, Pepco was preparing the Piney Point Oil Pipeline for another in-line inspection. In accordance with its contract with Pepco for the August 1997 in-line inspection, Pipetronix examined the segment of the Piney Point Oil Pipeline from Ryceville to Chalk Point to identify corrosion, gouging, pipeline fittings, girth welds, wall thickness changes, special features, and differentiation between internal and external corrosion. Pipetronix interpreted and checked the ultrasonic tool data from the inspection using computer-based systems and manual review by its technicians. The Pipetronix report to Pepco concerning the in-line inspection results and Pipetronix’s interpretation of the results included an appendix that identified and located various pipeline features by station number. Pipetronix’s interpretation of the ultrasonic tool data contained a significant inaccuracy for the feature at odometer station 53526.55. This feature, which was found after the accident to be a buckle but was inaccurately interpreted by the Pipetronix analyst as a T-piece, failed and resulted in the leak on April 7, 2000. Based on interpretation of the data available to Pipetronix at the time of the inspection, the Pipetronix analyst should have interpreted the feature as an “unknown” because it did not match the signal characteristic for a T-piece. Had Pepco been notified that the feature was an unknown, it might have attempted to determine the feature’s true characteristics, through excavation or other means. Therefore, the Safety Board concludes that because Pipetronix incorrectly interpreted the results of its ultrasonic tool data for the pipeline feature at odometer station 53526.55, Pepco was not alerted to the need for additional evaluation of the pipe at the location where it subsequently ruptured. After the accident, Pipetronix updated its reference library and training materials to include the signal characteristics of the outward protruding buckle that failed in this accident. Evaluation of Pipe Wrinkles After the accident, RSPA required Mirant (which became the pipeline’s owner some months after the accident) to prepare an integrity study of the Piney Point Oil Pipeline before it would allow the pipeline to be returned to service. Data from the 1997 in-line inspection of the pipeline were compared to the actual geometry of various wrinkles in pipeline bends, obtained after excavating the most severe wrinkles and determining the geometry by field measurements. After correlation between the in-line inspection data and the field measurements was completed, the 1997 in-line inspection data were used as the basis for the evaluation of wrinkles that had not been excavated and inspected. An analysis was performed to determine if identified wrinkles needed to be removed. As a result of this work, Mirant developed quantitative acceptance criteria for

Analysis 38 Pipeline Accident Report pipe wrinkles remaining in the pipeline. RSPA accepted the analysis that indicated that some wrinkles could remain in the pipeline, and RSPA allowed the pipeline to return to service. Field bends containing wrinkles were installed in pipelines before the hazardous liquid pipeline safety regulations went into effect in 1970. Since then, pipeline regulations have prohibited the installation of pipe containing wrinkle bends during pipeline construction.36 However, pipe wrinkles that were not discovered during the construction inspection process or that formed sometime after construction are still periodically found in pipelines. According to RSPA’s pipeline integrity management rule, when an in-line inspection tool is selected by a pipeline operator to assess the condition of the pipeline, it must be “capable of detecting corrosion and deformation anomalies including dents, gouges, and grooves” in high-consequence areas.37 The regulation states that “an operator must evaluate all anomalies and repair those anomalies that could reduce a pipeline’s integrity.”38 Although the language in this regulation does not specifically designate wrinkles as a category of deformation anomaly, when questioned by Safety Board staff, RSPA officials indicated that the regulation applies to wrinkles. Wrinkles can sometimes be identified through the use of in-line inspection tools. However, operators do not have nationally recognized quantitative criteria with which to assess the effect of a specific wrinkle characteristic on a pipe or to determine whether a pipeline can be safely operated while it contains some wrinkles. Therefore, the Safety Board concludes that because pipeline operators have no nationally recognized criteria with which to evaluate pipe wrinkles, they may not be effectively determining whether pipe containing wrinkles should be allowed to remain in service. The Safety Board believes that RSPA should establish quantitative criteria, based on engineering evaluations, for determining whether a wrinkle may be allowed to remain in a pipeline. Leak Detection After the Chalk Point leak began, sometime before 0930 on April 7, 2000, it was hours before those operating the Piney Point Oil Pipeline recognized that a line balance shortage, which might indicate a leak, was developing. The leak might have been recognized much sooner if more systematic leak detection procedures and practices had been in place and used. During normal deliveries of No. 6 fuel oil to the Chalk Point Generating Station, Pepco’s automated pipeline monitoring system was designed to provide alarms for pressure, temperature, and flow rate to the pipeline controller for operating conditions 36 49 CFR 195.212. 37 49 CFR 195.452(c)(1)(i)(A). 38 49 CFR 195.452(h)(1).

Analysis 39 Pipeline Accident Report outside of predetermined limits. During the pigging operation on the day of the accident, however, the meters and pressure-sensing points at Chalk Point were not in the flushing oil’s flow path, and the temperature-sensing equipment was not in the direct flow path to Ryceville. Thus, Pepco’s automated pipeline monitoring and leak detection system on the Piney Point Oil Pipeline did not alert the ST Services personnel to the developing problem. With respect to manual monitoring of the pipeline, ST Services did not require its personnel to perform line balance calculations while conducting either normal pipeline or pigging operations, nor did the procedures in Pepco’s Piney Point Oil Pipeline Manual include such requirements. Although ST Services personnel took tank level measurements at both the Chalk Point and Ryceville Stations throughout the morning of April 7, they did not use this information to evaluate whether product had been lost from the pipeline. Based on the speed of the pigging operation and his previous experience, the ST Services Chalk Point operator updated the estimated cleaning pig arrival time at the Ryceville Station from about 1415 to between 1300 and 1330. Even when the pig failed to arrive during this period, ST Services personnel still did not evaluate the tank level information to check the line balance. It was not until the Chalk Point pump began cavitating and the flow of oil stopped at the Ryceville Station, about 1430, that ST Services personnel recognized a problem. Between 1440 and 1534, using tank level measurements for line balance calculations, they determined that Ryceville had not received 3,089 barrels of the oil that had been pumped from Chalk Point, and they shut the pipeline down at 1538. On April 7, 2000, therefore, Pepco’s procedures, as provided in the Piney Point Oil Pipeline Manual, were inadequate because they did not require ST Services personnel to conduct line balancing during pigging operations, and ST Services’ practices were inadequate because they did not include effective line balancing during the pigging operation. Although some manual tank levels were obtained throughout the day, they were not evaluated. Had line balance been determined on a timely basis, the line balance discrepancy would likely have been discovered within about an hour of its occurrence. The Safety Board concludes that the absence of effective pipeline monitoring procedures and practices, including periodic line balancing, delayed the discovery of the fuel oil shortage on April 7, 2000, which delayed the pipeline shutdown and allowed more oil to leak from the pipeline. As a result of a pipeline accident in North Blenheim, New York,39 the Safety Board issued Safety Recommendation P-91-1 to RSPA. It read: 39 National Transportation Safety Board, Liquid Propane Pipeline Rupture and Fire, Texas Eastern Products Pipeline Company, North Blenheim, New York, March 13, 1990, Pipeline Accident Report NTSB/PAR-91/01 (Washington, DC: NTSB, 1991).

Analysis 40 Pipeline Accident Report P-91-1 Define the operating parameters that must be monitored by pipeline operators to detect abnormal operations and establish performance standards that must be met by pipeline monitoring systems installed to detect and locate leaks. Safety Recommendation P-91-1 is classified “Open—Unacceptable Response.” RSPA, in its 1991 and 1992 responses to the recommendation, indicated that it intended to conduct a study of SCADA systems. In response to a 1997 follow-up status inquiry from the Safety Board, RSPA indicated that it would soon issue rulemaking concerning leak detection standards. In 1998, RSPA incorporated parts of an industry standard for leak detection, API Standard 1130, Computational Pipeline Monitoring, in its hazardous liquid pipeline safety regulations. In 49 CFR Part 195, computational pipeline monitoring is defined as a “software-based monitoring tool that alerts the pipeline dispatcher of a possible pipeline operating anomaly that may be indicative of a commodity release.” Title 49 CFR 195.134, which is the safety regulation requiring the use of API Standard 1130 for design, applies when operators are replacing a component of an existing computational pipeline monitoring system or installing a new computational pipeline monitoring system on a pipeline; the regulation does not require that such systems be installed. Since the April 2000 accident, Pepco initiated, and Mirant completed, the installation of a new SCADA system that meets API Standard 1130, and a pipeline controller will continuously monitor it. This system includes additional instrumentation, sensors, and controls, as well as a computer model that uses current pipeline operating conditions. The system continuously calculates line balances to enable early detection and warning, and it allows the pipeline controller to initiate remote shutdown. Mirant now operates the pipeline with its own employees, and the pipeline controller is engaged in active analysis and monitoring of pipeline operations. Mirant has revised the operating procedures so that the pipeline controller initiates an immediate shutdown when a flow shortage outside of predetermined limits is indicated by its new SCADA-based leak detection system. At a Safety Board pipeline safety hearing held in November 2000, panelists discussed various types of automated monitoring systems that make leak detection possible within a matter of minutes. In contrast, manual line balancing relies on acquisition of data by pipeline operators. Manual computation and evaluation are then required to develop the pipeline operating data. The manual process requires more time to complete than an automated system, and the input data are more susceptible to human error than data obtained and used by an automated monitoring system. On December 1, 2000, RSPA issued a new regulation at 49 CFR 195.452, requiring hazardous liquid operators with 500 or more miles of pipeline to provide pipeline integrity management. On January 16, 2002, RSPA amended the regulation to include operators that own or operate less than 500 miles of regulated hazardous liquid

Analysis 41 Pipeline Accident Report pipelines. The regulation requires that operators have a “means to detect” leaks on their pipeline systems in high-consequence areas, but it does not specify what constitutes adequate means to detect leaks. RSPA officials met with Safety Board staff on May 16, 2002. In response to Safety Board staff questions about how RSPA will enforce the new leak detection requirements, RSPA officials indicated that they are developing specific criteria for defining adequate leak detection measures and that the criteria will be posted and enforced.40 The Safety Board supports this effort and encourages RSPA to expedite the development of the criteria and, as part of the process, to consider increased system automation to ensure timely leak detection. Leak-related Notifications Once the ST Services pipeline operators confirmed that they had a leak, they began to initiate an emergency response. The emergency response was affected by several communications breakdowns. Pepco did not provide accurate information about the volume of the Chalk Point oil release to public agencies, nor did Pepco ensure that its internal information exchanges were effectively coordinated. The failures left responders with inadequate information with which to evaluate the threat posed by the release. In the case of the Chalk Point accident, the response of deploying booms initially contained the oil spill, despite failures to effectively notify responders about the scope of the accident and to inform local response agencies early in the response effort. However, in future incidents involving pipeline leaks, such notification errors could cause responders to fail to respond with the resources needed to deal with a release, which could have negative consequences. Inaccurate National Response Center Notification Between 1538, when the pipeline was shut down, and 1850, when the National Response Center received notification of the Chalk Point spill, miscommunications and the creation of a release estimate lacking any factual basis took place among the various Pepco officials managing the release. By the time they shut down the pipeline, ST Services personnel were aware that they had a line balance discrepancy of about 3,000 barrels (126,000 gallons). Sometime before 1620, the ST Services assistant terminal manager told the Pepco engineering supervisor that the line balance discrepancy was about 3,000 barrels. The Pepco engineering supervisor informed the Pepco Chalk Point general supervisor for operations about the discrepancy at 1620, stating that it was about 2,000 to 3,000 barrels. At this time, the Pepco Chalk Point general supervisor for operations noted in his log that there was a discrepancy of 2,000 barrels. 40 In addition, RSPA is soliciting research proposals to advance leak detection technologies by improving leak detection timeliness and accuracy and by developing improved means of detecting small pipeline leaks.

Analysis 42 Pipeline Accident Report About 1827, a still more significant error took place concerning the estimation of the size of the spill. The Pepco Chalk Point shift supervisor told the Pepco qualified individual (when pressed to provide an estimate) that the amount of the spill was “1,000 gallons, 2,000 gallons, [expletive] mess, tell them what you want.” This unfounded estimate was reported to the Pepco Chalk Point general supervisor for operations, who, in consultation with the Pepco senior environmental coordinator during a phone conversation, agreed to report a release of 2,000 gallons to the National Response Center and the Maryland Department of the Environment. About 1840, ST Services provided additional confirmation to the Pepco Chalk Point general supervisor that the line balance shortage was approximately 3,000 barrels (126,000 gallons). About 1850, the Pepco senior environmental coordinator called the National Response Center and reported a 2,000-gallon No. 2 fuel oil release from a pipeline at Pepco’s Chalk Point Generating Station, even though the Pepco Chalk Point general supervisor had updated information that the line balance shortage was actually about 3,000 barrels (126,000 gallons). By 2015, the estimated release amount of 3,000 barrels (126,000 gallons) had been posted on the Chalk Point command center information blackboard. Shortly after 2100, the Pepco engineering group confirmed with line balance calculations that the amount of flushing oil involved in the release was 3,089 barrels (129,738 gallons). Pepco officials could have updated the National Response Center when they learned that the information they had initially reported was inaccurate, but they did not. The Pepco senior environmental coordinator learned within 2 hours that the 2,000-gallon release estimate he had given the National Response Center did not approach the true magnitude of the release, but neither he nor any other Pepco manager updated the report. When asked why he never updated the National Response Center, the Pepco senior environmental coordinator said he believed that by 2130 on April 7, representatives of all the notified agencies were on the scene or were in contact with each other. In fact, the EPA Federal On-Scene Coordinator was not advised of the revised spill estimate until she arrived at Chalk Point at 1015 on April 8, about 13 hours after Pepco had confirmation that the likely size of the spill was 3,089 barrels (129,738 gallons). Thus, those oil spill responders who received notification from the National Response Center were not informed of the significant size of the product release and the spill’s potential impact on the environment until they arrived on the scene. During the May 16, 2002, meeting between RSPA officials and Safety Board staff, RSPA officials stated that National Response Center notification reports are intended to provide responders, as quickly as possible, the information they need to activate appropriate resources to control, mitigate, and/or clean up a product spill. Emergency responders, as well as accident investigators, rely on the information provided by the National Response Center when preparing their response efforts. Inaccurate or incomplete information can hamper these activities. For instance, if the initial information reported erroneously indicates that the release is minor, some Government responders needed on the scene to carry out containment or mitigation efforts may decide not to respond to the accident. And if they do respond, they may not bring sufficient resources to manage the spill. For those Government agencies that send personnel to the accident, the National

Analysis 43 Pipeline Accident Report Response Center report may be the only information that the responders have before arriving on the scene. The more complete the information is, the better prepared Government responders will be to react to the particular circumstances of the accident. In addition to the Chalk Point accident, the Safety Board is aware of other cases in which pipeline owners or operators reporting an incident to the National Response Center did not update their initial reports when more comprehensive and accurate information became available.41 The Safety Board concludes that because pipeline owners and operators sometimes do not update their initial reports to the National Response Center, the notifications provided to emergency responders may not always contain the complete and accurate information needed to develop an effective incident response. Therefore, the Safety Board believes that RSPA should require pipeline owners and operators to provide follow-up telephone updates to the National Response Center when they discover that the information they initially reported contains significant errors or when they identify significant new information directly related to the reporting criteria. Limited Involvement of Local Response Agencies Pepco considered that, under the Chalk Point oil spill response plan, the release did not meet the criteria for notification of local response agencies, which were “fire, explosion, personal injury or release or significant threat of release off-site.” Although the accident might not have immediately met these specific criteria, Pepco should have realized that the Chalk Point leak, due to its proximity to Swanson Creek, which fed into the Patuxent River, had the potential for a significant off-site release. However, Pepco did not contact local response agencies, including the Prince George’s County Fire Department. As a result, the resources of the local response agencies were not utilized as soon as possible. In her postaccident review, the EPA Federal On-Scene Coordinator stated that she believed the exclusion of local responders from the initial response (having been notified only once State responders were already on-scene) had a negative impact on the response operations, particularly with respect to the dissemination of information to the community and the ability to coordinate response efforts. In addition, the Chief of Marine Safety for the Fifth Coast Guard District stated, in an August 25, 2000, letter addressing lessons learned from the Chalk Point accident, that the local responders are needed to ensure the safety of the site, share local knowledge with the spill management team, and mobilize essential resources to the scene. Mirant, the current owner of the Piney Point Oil Pipeline, has significantly revised the oil spill response procedures for the pipeline. In April 2002, RSPA approved Mirant’s oil spill response plan. After the Chalk Point accident, the Oil Spill Emergency Response Plan for the Ryceville Pumping Station and Pipeline was revised to improve and clarify it. 41 A March 30, 1998, accident in Sandy Springs, Georgia, that was originally reported to the National Response Center as a release of 150 gallons of gasoline was later found to be a release of over 15,800 gallons. An August 20, 2001, accident in Jackson County, Oklahoma, that was initially reported to the National Response Center as a release of 8,400 gallons of crude oil was later found to be a release of about 126,000 gallons.

Analysis 44 Pipeline Accident Report Further, on July 27, 2001, Mirant published the manual Response Strategies for Southern Maryland, which was based on “operational experience gained during the Swanson Creek oil spill response and studies.”42 The Safety Board notes that Mirant personnel met with the members of the Local Emergency Planning Committee, which represents the local public response agencies of the four surrounding counties, to familiarize the members with the implementation of the manual. In the less than 2 years since Mirant became the owner of the pipeline, it has conducted at least 15 drills concerning elements of effective spill response, and some of the drills have involved local response agencies. The Safety Board notes these Mirant efforts to provide prompt involvement of local response agencies in any future emergencies. Incident Command The Safety Board found that the lack of effective incident command had a negative effect on the emergency response to the Chalk Point release. ST Services, Pepco, and spill recovery contractors on the scene on April 7 and 8, 2000, were initially successful in deploying a boom system that contained the leading edge of the spill. On the night of April 8, however, with the arrival of a severe storm that included heavy rains and 50-mph winds, the boom containment system was overwhelmed. The spill escaped containment and ultimately traveled an estimated 17 miles (linear) downstream and oiled 40 miles of shoreline in Prince George’s, Charles, Calvert, and St. Mary’s Counties. Responders were unable to effectively mitigate the environmental impact of the oil’s entry into the Patuxent River, due in part to incident management and oversight deficiencies. The EPA Federal On-Scene Coordinator arrived on the scene at 1015 on April 8 and began attempting to coordinate the Unified Command without establishing an Incident Command System. Instead, she relied on a project management structure that gave the responsible party, Pepco, primary responsibility for directing and monitoring the activities of response contractors. Throughout April 8, the Unified Command’s efforts were focused on containing the spill within the Swanson Creek wetlands area. Pepco’s contractors conducted the booming operation based on the directions they received from Pepco officials, who received their orders from the Unified Command. Management problems were evident even at this early stage. The Pepco officials working with the contractors were on rotating 8-hour shifts, and those personnel going off-duty sometimes did not fully discuss response developments and necessary tasks with those coming on-duty. This lack of continuity caused problems with task and status communication and coordination. Instances of miscommunication and problems with unclear lines of authority occurred. Important meetings were not attended by all necessary personnel, and Pepco contractors sometimes did not fully understand the tasks they were 42 The manual is intended to provide tactical information for use as a pre-planning document for response managers and crews. It identifies key control points along and off the pipeline corridor where response actions may be taken should a release occur. The manual also includes a summary sheet for each of the primary control point locations.

Analysis 45 Pipeline Accident Report assigned. The EPA Federal On-Scene Coordinator also did not have extensive Federal response resources to draw upon at this time. A storm was predicted for that evening, and the Unified Command and the EPA Federal On-Scene Coordinator ordered, and Pepco’s contractors took, reasonable precautions to maintain the containment they had achieved in the Swanson Creek wetlands area. However, the storm was more severe than had been anticipated, and the outer booms at the Patuxent River were breached about 2030, releasing a significant amount of oil into the river. For the next 2 days (April 9 and 10), the Unified Command, under the direction of the EPA Federal On-Scene Coordinator, attempted to mount an effective response to the oil spill’s escape into the river. Significant resource and organizational problems arose immediately. Pepco had difficulty obtaining contractor resources that could carry out marine operations, and the EPA Federal On-Scene Coordinator encountered similar problems when she attempted to augment the response effort with Federal resources. Even more importantly, the contractors hired by Pepco were not completing urgent assigned tasks, and the delays in the response effort were not being promptly and accurately reported to the Unified Command. The EPA Federal On-Scene Coordinator stated that in the 2 days following the escape of the oil into the river, the Unified Command repeatedly directed Pepco to ensure that several environmentally sensitive creeks leading into the river were protectively boomed. According to the EPA Federal On-scene Coordinator, Pepco repeatedly indicated that appropriate action was being taken and that the booms would be placed as soon as possible. As of April 11, no booms had been deployed to protect the creeks, and two creeks showed evidence of oil contamination. To address the coordination and communication problems and the contractors’ inability to complete assigned tasks, the EPA Federal On-Scene Coordinator decided that an Incident Command System structure had to be implemented. Such a system is designed to provide more direct Federal control over response activities, a quicker response to spill developments, greater access to a wider range of resources, and better responder coordination. Consequently, she requested at 1430 on April 10 that Coast Guard officials assisting on scene develop such a structure. She also urged Pepco to hire a spill management contractor to improve the logistics of its contractors’ efforts. On the morning of April 11, the Coast Guard Captain of the Port of Baltimore arrived with additional personnel to staff the Incident Command System structure that had been developed. The new personnel were deployed to monitor the field operations being conducted by Pepco’s contractors to ensure that work was completed as directed. Almost immediately, with the marshalling of the additional personnel and equipment, the effectiveness of the recovery operations improved. Protective booms were provided for the threatened creeks on April 12 and 13. Within days, marine-specialist responders finished collecting the free oil in the main body of the Patuxent River, and they were able to concentrate their efforts on oil collection from the affected creeks and other environmental mediation projects.

Analysis 46 Pipeline Accident Report In their postaccident assessments of the Chalk Point accident, both the Coast Guard and the Regional Response Team review committee concluded that the response would have benefited from earlier use of an Incident Command System as the incident’s coordination and management structure. In fact, the Regional Response Team review committee recommended that the EPA develop a manual on how to use Incident Command System/Unified Command structures and train all Federal On-Scene Coordinators in Incident Command System/Unified Command principles. In her own assessment of the response, the EPA Federal On-Scene Coordinator acknowledged that the decision not to implement an Incident Command System structure immediately upon her arrival at the accident scene ultimately had a detrimental effect on the response effort. Once the oil escaped from containment in the wetlands and the situation became more complex and difficult to resolve, the short-term project management approach could not achieve results with the speed and efficiency needed to avoid a serious environmental impact. The Incident Command System has proven its effectiveness in incidents covering a wide range of transportation modes, and it has usually improved the management of a complex incident response effort, such as the one that evolved from the Chalk Point oil leak. Once the structure was applied at Chalk Point, response efforts soon became more efficient and successful. The Safety Board concludes that, because it did not initially put a fully implemented Incident Command System in place, the Unified Command was for several days unable to mobilize and control an effective response to the loss of oil containment that took place on the evening of April 8, 2000. The Safety Board has previously recognized the benefits an Incident Command System structure may provide during a pipeline spill response effort. As a result of its investigation of the October 1994 pipeline failures on the San Jacinto River near Houston, Texas,43 the Safety Board determined that implementing the Unified/Incident Command structure and operational principles in the National Response Team’s technical assistance document addressing Incident Command System/Unified Command enhances the overall preparedness for responding to oil spills. Consequently, the Safety Board recommended that the National Response Team: I-96-2 Motivate National Response Team agencies to integrate into their area contingency plans the command and control principles contained in Technical Assistance Document Incident Command System/Unified Command and encourage them to train all personnel assigned management responsibilities in those principles. In a January 17, 2001, response to Safety Recommendation I-96-2, the National Response Team stated that it was working on methods to ensure that all member agencies have integrated into their area contingency plans the principles contained in the Technical 43 National Transportation Safety Board, Evaluation of Pipeline Failures During Flooding and of Spill Response Actions, San Jacinto River Near Houston, Texas, October 1994, Pipeline Special Investigation Report NTSB/SIR-96/04 (Washington, DC: NTSB, 1996).

Analysis 47 Pipeline Accident Report Assistance Document Incident Command System/Unified Command—Managing Responses to Oil Discharges and Hazardous Substance Releases under the National Contingency Plan, as requested. The Safety Board classified Safety Recommendation I- 96-2 “Open–Acceptable Response,” pending notification that the action is complete. The National Response Team is made up of 16 Federal departments and agencies. The EPA is the permanent Chair of the National Response Team. Since the San Jacinto accident, the EPA has distributed the Technical Assistance Document Incident Command System/Unified Command—Managing Responses to Oil Discharges and Hazardous Substance Releases under the National Contingency Plan to all EPA on-scene coordinators, and EPA headquarters has encouraged its regional coordinators to incorporate the guidance from the document in their area contingency plans. Nevertheless, an EPA official stated in an April 24, 2001, postaccident letter to the Safety Board that “EPA currently has no formal policy on the use of Incident Command System/Unified Command.” The EPA has not mandated that all its regions use the Incident Command System. Although the EPA’s Office of Emergency and Remedial Response is developing an EPA policy position on the Incident Command System, the Safety Board is concerned that no final EPA Incident Command System policy, the development of which began in 1996 in response to lessons learned during the 1994 San Jacinto pipeline accident, has been completed. The lack of incident command during the Chalk Point emergency response indicates that the EPA needs to make a greater commitment to incorporating Incident Command System principles in its response procedures and to training its people more effectively about the benefits provided by the use of the system. Therefore, to ensure that the necessity of an effective Incident Command System is understood by EPA responders, the Safety Board believes that the EPA should require all its regions to integrate the principles contained in the National Response Team’s Technical Assistance Document Incident Command System/Unified Command—Managing Responses to Oil Discharges and Hazardous Substance Releases under the National Contingency Plan in their area contingency plans and require the regions to train all personnel who are assigned responsibility to implement the plans according to those principles.

48 Pipeline Accident Report Conclusions Findings 1. Because Pipetronix incorrectly interpreted the results of its ultrasonic tool data for the pipeline feature at odometer station 53526.55, the Potomac Electric Power Company was not alerted to the need for additional evaluation of the pipe at the location where it subsequently ruptured. 2. Because pipeline operators have no nationally recognized criteria with which to evaluate pipe wrinkles, they may not be effectively determining whether pipe containing wrinkles should be allowed to remain in service. 3. The absence of effective pipeline monitoring procedures and practices, including periodic line balancing, delayed the discovery of the fuel oil shortage on April 7, 2000, which delayed the pipeline shutdown and allowed more oil to leak from the pipeline. 4. Because pipeline owners and operators sometimes do not update their initial reports to the National Response Center, the notifications provided to emergency responders may not always contain the complete and accurate information needed to develop an effective incident response. 5. Because it did not initially put a fully implemented Incident Command System in place, the Unified Command was for several days unable to mobilize and control an effective response to the loss of oil containment that took place on the evening of April 8, 2000. Probable Cause The National Transportation Safety Board determines that the probable cause of the April 7, 2000, Piney Point Oil Pipeline accident at the Potomac Electric Power Company’s Chalk Point, Maryland, generating station was a fracture in a buckle in the pipe that was undiscovered because the data from an in-line inspection tool were interpreted inaccurately as representing a T-piece. Contributing to the magnitude of the fuel oil release were inadequate operating procedures and practices for monitoring the flow of fuel oil through the pipeline to ensure timely leak detection.

49 Pipeline Accident Report Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Establish quantitative criteria, based on engineering evaluations, for determining whether a wrinkle may be allowed to remain in a pipeline. (P- 02-01) Require pipeline owners and operators to provide follow-up telephone updates to the National Response Center when they discover that the information they initially reported contains significant errors or when they identify significant new information directly related to the reporting criteria. (P-02-02) To the Environmental Protection Agency: Require all your regions to integrate the principles contained in the National Response Team’s Technical Assistance Document Incident Command System/Unified Command—Managing Responses to Oil Discharges and Hazardous Substance Releases under the National Contingency Plan in their area contingency plans and require the regions to train all personnel who are assigned responsibility to implement the plans according to those principles. (P-02-03) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: July 23, 2002

this page intentionally left blank

51 Pipeline Accident Report Appendix A Investigation The National Transportation Safety Board was informed on April 8, 2000, by the National Response Center of a fuel oil release from a pipeline that had occurred on April 7, 2000, at Pepco’s Chalk Point Generating Station near Aquasco, Maryland. The Safety Board launched an investigative team from Washington, D.C., on April 8, 2000, that comprised operations and emergency response investigators. No public hearing took place on the accident, and no formal depositions were taken. Parties to the investigation were Pepco; Support Terminal Services, Inc.; Mirant Piney Point, LLP; and the Office of Pipeline Safety.

52 Pipeline Accident Report Appendix B Initial Incident Timeline Day Time Events April 7, 2000 0715 Cleaning pig is launched from Chalk Point Station to Ryceville Station. 0830-1400 Tank level gauges are taken (but not used to compute line balance) at Chalk Point and Ryceville. 1430 Chalk Point pump begins cavitating. Meter noise and oil flow stops at Ryceville Station. 1440-1534 Pepco and ST Services personnel determine that, based on tank level gauge calculations, Ryceville did not receive all oil pumped from Chalk Point. Shortfall of 3,089 barrels is estimated. 1538 Chalk Point pump is shut down. 1550 ST Services assistant terminal manager begins trying to report problems to Pepco officials. 1620 Pepco Chalk Point general supervisor for operations is told of line balance discrepancy of 2,000 to 3,000 barrels and notes shortfall quantity as “2,000 barrels.” 1643 Pepco Chalk Point general supervisor for operations orders flight to locate leak site. 1802 Report from pipeline patrol plane indicates leak at Swanson Creek. 1807 Chalk Point emergency plan is put into effect.

53 Pipeline Accident Report Appendix C Significant Events From Leak Recognition to Loss of Containment Day Time Events April 7, 2000 1835 Pepco Chalk Point shift supervisor, when pressed, estimates release size at 1,000 to 2,000 gallons. 1840 ST Services assistant terminal manager confirms in his conversation with Pepco Chalk Point general supervisor for operations that line balance discrepancy is about 3,000 barrels. 1850 Pepco senior environmental coordinator reports 2,000-gallon release to the National Response Center. 1850 Pepco spill response teams deploy floating boom in Swanson Creek wetlands area. 2015 Pepco Chalk Point command center information board indicates spill volume of 3,000 barrels. 2030-2100 State and Coast Guard responders begin arriving at site. 2100 Pepco engineering group confirms 3,000-barrel release figure based on tank level calculations. 2300 Pepco conducts first command post briefing. April 8, 2000 0250 Coast Guard Federal on-scene representative arrives. 0330-0530 Coast Guard notifies EPA that incident is in the EPA’s geographic jurisdiction and that it will relinquish lead for incident response to EPA Federal On-Scene Coordinator. 0600 EPA Federal On-Scene Coordinator leaves Philadelphia. 1015 EPA Federal On-Scene Coordinator arrives at accident site and learns that spill volume is 3,000 barrels. 1600 Unified Command revises storm plan due to worsening weather forecasts. 2030 Outer booms at the Patuxent River are breached.

54 Pipeline Accident Report Appendix D Significant Environmental Response and Clean-up Events Day Time Events April 9, 2000 Before 0700 Oil plume is seen moving from Swanson Creek across the Patuxent River. 0745 EPA Federal On-Scene Coordinator contacts the Coast Guard seeking aid in locating marine response resources. 0800- 2000 Pepco contractors attempt to corral the oil plume in the river; they are unsuccessful. 2100 EPA Federal On-Scene Coordinator orders Pepco to arrange protective booming of threatened creeks. April 10, 2000 1200 EPA Federal On-Scene Coordinator and Maryland Department of the Environment tell Pepco that the response is not adequate; that the contractors are not being used successfully; and that Pepco’s progress reports have not reflected the actual status of the response. 1430 EPA Federal On-Scene Coordinator asks on-scene Coast Guard personnel to develop an Incident Command System. 2100 EPA Federal On-Scene Coordinator again orders Pepco to boom the creeks. April 11, 2000 0300- 0715 EPA Federal On-Scene Coordinator again orders Pepco to boom the creeks. Contamination is seen at two creeks. 1100 Coast Guard representatives arrive on the scene and establish Incident Command System. 1100-on Pepco hires contract firm to manage its response. Incident Command System begins to operate. First creek is boomed; booms are pre-staged at four more creeks.

April 12-13, 2000

All creeks are boomed. Free oil collection from the Patuxent River is completed.

April 16, 2000

Oil collection from creeks is completed.

May 16, 2000

Emergency response phase is declared over.

FD07229 ｜ 2000_美国_NTSB_PAR0301_Natural_Gas_Pipeline_Rupture_and_Fire.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Pipeline Accident Report Natural Gas Pipeline Rupture and Fire Near Carlsbad, New Mexico August 19, 2000 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/PAR-03/01 PB2003-916501

this page intentionally left blank

Pipeline Accident Report Natural Gas Pipeline Rupture and Fire Near Carlsbad, New Mexico August 19, 2000 NTSB/PAR-03/01 PB2003-916501 National Transportation Safety Board Notation 7310B 490 L’Enfant Plaza, S.W. Adopted February 11, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. Natural Gas Pipeline Rupture and Fire Near Carlsbad, New Mexico, August 19, 2000. Pipeline Accident Report NTSB/PAR-03/01. Washington, D.C. Abstract: At 5:26 a.m., mountain daylight time, on Saturday, August 19, 2000, a 30-inch-diameter natural gas transmission pipeline operated by El Paso Natural Gas Company ruptured adjacent to the Pecos River near Carlsbad, New Mexico. The released gas ignited and burned for 55 minutes. Twelve persons who were camping under a concrete-decked steel bridge that supported the pipeline across the river were killed and their three vehicles destroyed. Two nearby steel suspension bridges for gas pipelines crossing the river were extensively damaged. According to El Paso Natural Gas Company, property and other damages or losses totaled $998,296. The major safety issues identified in this investigation are the design and construction of the pipeline, the adequacy of El Paso Natural Gas Company’s internal corrosion control program, the adequacy of Federal safety regulations for natural gas pipelines, and the adequacy of Federal oversight of the pipeline operator. As a result of its investigation of this accident, the National Transportation Safety Board makes safety recommendations to the Research and Special Programs Administration and NACE International. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916501 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Pipeline Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Pipeline Operations After the Rupture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Postaccident On-Site Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Metallurgical Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Corrosion Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Pipeline 1103 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Pipeline Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Gas Suppliers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Pigging Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 EPNG’s Internal Corrosion Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Internal Corrosion Control Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Internal Audit Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Regulatory Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Federal Safety Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Preaccident Federal Inspections of EPNG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Federal Safety Standards and EnforcementæMaps and Records . . . . . . . . . . . . . . . . . 29 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Pipeline Reconstruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Pipeline Integrity Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Federal Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Pipeline Integrity ManagementæFederal Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 NACE Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 ASME Code for Gas Piping (B31.8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Guide for Gas Transmission and Distribution Piping Systems . . . . . . . . . . . . . . . . . . . . . . 36 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Previous EPNG Internal Corrosion Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Emergency Training and Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Internal Corrosion in Steel Gas Pipelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Internal Corrosion in Line 1103 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Physical Features of Line 1103 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 EPNG Internal Corrosion Control Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Contents iv Pipeline Accident Report Federal Safety Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Federal Oversight of the Pipeline Operator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Industry Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 B: Summary of Office of Pipeline Safety Corrective Action Order . . . . . . . . . . . . . . . . . . 54 C: Research and Special Programs Administration Advisory Bulletin . . . . . . . . . . . . . . . . 56

v Pipeline Accident Report Executive Summary At 5:26 a.m., mountain daylight time, on Saturday, August 19, 2000, a 30-inch- diameter natural gas transmission pipeline operated by El Paso Natural Gas Company ruptured adjacent to the Pecos River near Carlsbad, New Mexico. The released gas ignited and burned for 55 minutes. Twelve persons who were camping under a concrete-decked steel bridge that supported the pipeline across the river were killed and their three vehicles destroyed. Two nearby steel suspension bridges for gas pipelines crossing the river were extensively damaged. According to El Paso Natural Gas Company, property and other damages or losses totaled $998,296. The National Transportation Safety Board determines that the probable cause of the August 19, 2000, natural gas pipeline rupture and subsequent fire near Carlsbad, New Mexico, was a significant reduction in pipe wall thickness due to severe internal corrosion. The severe corrosion had occurred because El Paso Natural Gas Company’s corrosion control program failed to prevent, detect, or control internal corrosion within the company’s pipeline. Contributing to the accident were ineffective Federal preaccident inspections of El Paso Natural Gas Company that did not identify deficiencies in the company’s internal corrosion control program. The major safety issues identified in this investigation are as follows: • The design and construction of the pipeline, • The adequacy of El Paso Natural Gas Company’s internal corrosion control program, • The adequacy of Federal safety regulations for natural gas pipelines, and • The adequacy of Federal oversight of the pipeline operator. As a result of its investigation of this accident, the National Transportation Safety Board makes safety recommendations to the Research and Special Programs Administration and NACE International.

this page intentionally left blank

1 Pipeline Accident Report Factual Information Accident Synopsis At 5:26 a.m., mountain daylight time, on Saturday, August 19, 2000, a 30-inch- diameter natural gas transmission pipeline operated by El Paso Natural Gas Company (EPNG) ruptured adjacent to the Pecos River near Carlsbad, New Mexico. The released gas ignited and burned for 55 minutes. Twelve persons who were camping under a concrete-decked steel bridge that supported the pipeline across the river were killed and their three vehicles destroyed. Two nearby steel suspension bridges for gas pipelines crossing the river were extensively damaged. According to EPNG, property and other damages or losses totaled $998,296. Accident Narrative The EPNG pipeline system (figure 1) transported gas west from Texas and New Mexico to Arizona and California. A portion of the pipeline system crossed the Pecos River about 4 1/2 miles north of the Texas-New Mexico State line and 30 miles south of Carlsbad, New Mexico. (See figure 2.) About 1 mile west of the river crossing was the Pecos River compressor station, which received gas from four natural gas transmission pipelines26-inch-diameter line 1100, 30-inch-diameter line 1103, 30-inch-diameter line 1110, and 16-inch-diameter line 3191. Three of these lines (1100, 1103, and 1110) ran parallel to Whitethorn Road (also known as Pipeline Road) from the Pecos River to the Pecos River compressor station. Lines 1103 and 1110 were supported at the river crossing by a one-lane concrete-decked steel service bridge that was not open to the public. (See figure 3.) (This bridge, which had been built by EPNG in 1950, also supported a water pipeline and a gas gathering pipeline. EPNG, which was at the time of the accident a subsidiary of El Paso Energy, owned and operated the water pipeline but not the gas gathering pipeline.) Line 1100 was supported across the river on a pipeline suspension bridge approximately 70 feet northeast of the service bridge. Another EPNG pipeline, 16- inch-diameter line 1000, was supported by a separate suspension bridge in this area, but this line had been removed from service and was filled with nitrogen at the time of the accident. The fourth pipeline, line 3191, ran from EPNG’s South Carlsbad compressor station to the Pecos River compressor station.

Factual Information 2 Pipeline Accident Report Figure 1. El Paso Natural Gas system. Figure 2. Accident area.

Factual Information 3 Pipeline Accident Report At the time of the accident, 12 members of an extended family were camping on the east bank of the Pecos River near the service bridge.1 (See figure 4.) A locked wire rope and a “Private Right of WayNo Trespassing” sign at each entrance to the bridge restricted access to the bridge above the campsite. Two “CautionHigh Pressure Gas Line” signs were posted near the east entrance to the service bridge. Also, a sign reading as follows: Warning - No Trespassing - This road and right of way is private property and is not for public use. This pipeline carries natural gas under high pressure and is dangerous. All persons are warned of the danger to person and property. KEEP OFF had been posted alongside the right-of-way road (near the intersection with the county road) leading past the block valves and pig receivers to the service bridge on the east side of the river.The pipeline system was operated from EPNG’s gas control center in El Paso, Texas, as a north system and a south system. The gas control center was equipped with three supervisory control and data acquisition (SCADA)2 system work consoles, each of which was capable of displaying data for both pipeline systems. On the morning of August 19, 2000, three EPNG employees, a coordinator of pipeline control (who was in charge of the shift) and two gas controllers, were nearing the Figure 3. Accident site. 1 At the time of the accident, a private landowner owned the accident site. After the accident, EPNG purchased this property and installed fencing to restrict access to the area. 2 Pipeline controllers use a computer-based SCADA system to remotely monitor and control movement of gas through pipelines. The system makes it possible to monitor operating parameters critical to pipeline operations, such as flow rates, pressures, equipment status, control valve positions, and alarms indicating abnormal conditions.

Factual Information 4 Pipeline Accident Report end of their 12-hour shifts at the gas control center. One of the controllers was operating the north system and the other the south, while the coordinator assisted the two controllers and performed administrative oversight and served as a backup controller when needed. The two controllers were working at separate SCADA terminals to monitor and control pipeline operations. The employees said they had noted no unusual operating conditions during their shift, and no unusual conditions had been noted during the previous 12-hour shift. The south system controller, at 5:26 a.m.,3 received SCADA rate-of-change4 alarms for the speed of compressor unit No. 3 at the Pecos River compressor station.5 Less than a minute later, compressor unit No. 1 at the station shut down, quickly followed by the automatic closing and opening of station valves, as appropriate, to isolate the compressor station from the pipeline. Emergency lubricating oil pumps were also automatically activated at the station. A few seconds later, additional alarms from the station displayed on the controller’s monitor, including a rate-of-change alarm for falling Figure 4. Aerial view of accident site looking east. 3 Times in this section are based on SCADA event data recorder records, controller logs, and personnel statements and interviews. 4 Rate-of-change alarms indicate that a measured variable, such as compressor speed or compressor suction pressure, is increasing or decreasing at a rate exceeding what would be expected under normal operating conditions. 5 The unattended Pecos River compressor station had three turbine compressors.

Factual Information 5 Pipeline Accident Report suction (inlet) pressure at the station. (Unknown to the controller at the time, pressure on the inlet side of the station dropped because pipeline 1103 had ruptured near the river crossing.) Noting the alarms, the south controller began to request SCADA data for the Pecos River compressor station instead of waiting for the data to appear from the automatic data scans, which occurred at 4-minute intervals.6 At about this time, the transmission of SCADA data between the gas control center and the Pecos River compressor station was briefly interrupted. According to the south controller, he was immediately alerted to the data interruption by the display of inverse video on his SCADA monitor. Inverse video indicated that a proper reply to a request for data from the SCADA system had not been received and that the displayed data were not being updated. Although not recorded in the SCADA system event log, this interruption lasted about 30 seconds. At approximately 5:30 a.m., the controller telephoned the Pecos River district station lead operations specialist7 at home and asked him to send people to the Pecos River compressor station. The south controller later stated: I noted that we did have a low suction pressure, and generally when our plants go down, the suction pressure goes up instead of down. I told [the station lead operations specialist], ‘We need to get somebody out there right away because I think we have a problem.’ The station lead operations specialist called two operations specialists that he supervised and who were on duty and told them to go to the Pecos River compressor station. About the same time the station lead operations specialist was making this call, an EPNG operations specialist from the Carlsbad complex, who was at his home south of the city of Carlsbad, noticed a glow in the sky to the south. (See figure 5.) He said he immediately suspected that an EPNG pipeline may be involved. He called the gas control center and asked if its personnel had noticed any sudden pressure changes at the Pecos River compressor station. He told center personnel of the glow in the sky and said that he suspected a rupture. The north controller informed him that EPNG had lost a compressor at the Pecos River compressor station. The operations specialist then telephoned his supervisor (the pipeline lead operations specialist), and informed him of the glow in the sky and of his call to the gas control center. He then told the pipeline lead operations specialist that he was on his way to the Pecos River compressor station. 6 This SCADA system logged operational data and transferred it to the gas control center via modem. 7 EPNG had two employees in the Pecos River district with the official title “lead operations specialist.” One lead operations specialist supervised operations specialists responsible for operating and maintaining compressor and meter stations. Another lead operations specialist supervised operations specialists responsible for operating and maintaining pipelines. This report refers to the two employees, respectively, as the station lead operations specialist and the pipeline lead operations specialist.

Factual Information 6 Pipeline Accident Report At 5:31 a.m., the gas control center in El Paso again experienced an interruption in SCADA data transmission from the Pecos River compressor station, which prevented the controller’s receiving any additional information from the station. The interruption occurred when the emergency shutdown system at the Pecos River compressor station activated, which caused a loss of power to the local SCADA computer and modem. The station was equipped with an uninterruptible power supply, but the station SCADA computer and modem were not connected to it.8 SCADA communications with the Pecos River compressor station were restored at 9:04 a.m. on August 19. At 5:35 a.m., the south controller again telephoned the station lead operations specialist at home and told him that he suspected a possible line blowout. At this time, the south controller did not know which pipeline was involved. The station lead operations specialist said that after looking out a window of his home in the direction of the Pecos River compressor station, he told the south controller that he could see a fire and that he was on his way to the Pecos River compressor station. Figure 5. Post-rupture fire. At lower left of fireball can be seen the 85-foot-tall support structures for the pipeline suspension bridges. 8 The station was equipped with an uninterruptible power supply to maintain AC power to the station computer and hazardous gas and fire detection equipment. A 24-volt DC backup system maintained power to oil pumps, nozzle cooling water equipment, and other emergency equipment in the event of a station power failure.

Factual Information 7 Pipeline Accident Report At 5:44 a.m., the south controller called the Keystone compressor station9 and asked the operator to take down three compressor units. About a minute later, he called the Eunice plant10 and made the same request. At 5:50 a.m., the south controller called El Paso Field Services to make sure that personnel there would shut down all compressor units at the South Carlsbad compressor station.11 The south controller’s shift ended at 6:00 a.m., but he stayed at the gas control center until 8:00 a.m. to provide assistance as necessary. During this time, he notified the El Paso Energy public relations department in Houston, Texas.12 Emergency Response Within 5 minutes of the rupture, at 5:31 a.m., the local 911 operator received numerous calls from residents reporting a fire and the sound of an explosion. An off-duty EPNG employee who lived near the site also called 911 and reported the fire. The gas control center was called by an off-duty operations specialist when he saw light in the sky from the fire, and he also called the pipeline lead operations specialist for the local section of the pipeline. That pipeline lead operations specialist was the first to arrive at the accident site, at about 5:45 a.m. He said that while he was en route, he had spoken with the gas control center and the EPNG general dispatcher from his truck and had asked the control center to call managers for the Jal and Carlsbad complexes. He recalled that as he neared the Pecos River compressor station, the fire was so bright that he had trouble seeing the road. He then went to the pipeline on the west side of the Pecos River compressor station and began closing valves that were downstream from the fire. As he closed block (shutoff) valve No. 6 3/4 on line 1100, the operations specialist who had telephoned him earlier arrived, and the two men closed block valves No. 6 3/4 on lines 1103 and 1110. They also closed the pig launcher valves on these pipelines.13 The pipeline lead operations specialist and the operations specialist then drove their trucks to the west side of the service bridge and viewed the fire across the river, but 9 The Keystone compressor station, an attended station about 57 miles east and upstream of the Pecos River compressor station, supplied gas to the Pecos River compressor station through lines 1103 and 1110. 10 The Eunice plant, an attended station about 53 miles northeast and upstream of the Pecos River River station, supplied gas to the Pecos River compressor station through line 1100. 11 The South Carlsbad compressor station, an attended station about 25 miles north and upstream of the Pecos station, supplied gas to the Pecos River compressor station through line 3191. 12 Notifying the public relations department, which was responsible for responding to inquiries regarding events involving the company, was part of EPNG’s emergency response procedures. 13 Pig refers to any of a variety of mechanical devices that can be introduced into a pipeline system either to clean the pipeline or, through use of various detection technologies, to identify possible pipeline defects. Pig launchers and pig receivers in lines 1100, 1103, and 1110 at the time of the accident were used only for cleaning pigs.

Factual Information 8 Pipeline Accident Report they could not determine which line had ruptured. The pipeline lead operations specialist said he then told the operations specialist to go around to the other side of the river and attempt to determine which line had failed. The operations specialist said he drove across the river at the low-water crossing and viewed the scene, but because of the proximity of the lines to one another and the fire, he could not determine which line had ruptured. The operations specialist said that as he was returning to where he left the pipeline lead operations specialist, he thought he may have seen vehicles in the fire area just south of the bridge. He continued back across the river to assist the pipeline lead operations specialist and also told him about the possibility of vehicles in the fire area. The pipeline lead operations specialist said he told the operations specialist that they had to get the fire contained and that until that time, there was nothing they could do. Both employees knew community emergency responders were waiting at the entrance of the compressor station. The two men then drove toward the low-water crossing, proceeding down the right-of-way road toward the fire. The pipeline lead operations specialist later recalled that when they arrived at the location where they were going to try to close the block valves upstream of the fire, he carefully opened the door of his truck to confirm that he could tolerate the heat. About 6:05 a.m., the two employees left their vehicles and proceeded to the block valves. The pipeline lead operations specialist closed the No. 5 valve on line 1100, but closing this valve did not reduce the intensity of the fire. Together they closed block valve No. 6 on line 1103, and the operations specialist closed block valve No. 6 on line 1110. The fire’s intensity was noticeably reduced after valve No. 6 on line 1103 was closed, but the fire continued to burn at the lowered intensity. The pipeline lead operations specialist told the operations specialist to check the bypass valve on the pig receiver14 on line 1103 and after it was closed, the fire subsided altogether over a period of several minutes. At about 6:21 a.m., the pipeline lead operations specialist called the gas control center and reported the status of the valves and that the fire was out. The pipeline lead operations specialist then told the operations specialist to go back to the west side of the river and prevent traffic from entering the area. The operations specialist said that as he passed where he thought he may have seen the vehicles during the fire, he now clearly saw burned pickup trucks. He stopped and called the pipeline lead operations specialist to tell him there were casualties. The pipeline lead operations specialist then notified his supervisor and told him to call for more ambulances. The operations specialist took a first-aid kit from his truck and started down on foot to check on survivors. At this time, the station lead operations specialist pulled up behind his truck. He knew where the operations specialist was because he had been monitoring radio traffic. After the two men discussed the situation, the operations specialist went to assist the victims while the station lead operations specialist drove back to where he knew fire and emergency medical personnel were waiting. He then led an ambulance to the fire area. The pipeline lead operations specialist said he drove to the 14 The pig receiver is an arrangement of pipe and valves connected to the pipeline that allows a pig to be removed from the pipeline.

Factual Information 9 Pipeline Accident Report location of the No. 6 3/4 block valves and, with the assistance of two other EPNG employees, closed a valve that double-blocked line 1110 (to prevent gas from entering the station in case one of the block valves on the line was leaking). The station pipeline specialist had been called by the gas control center as soon as the Pecos River compressor station shut down at about 5:30 a.m. to determine if the problem was at the station. When he arrived at the entrance road to the compressor station off Whitethorn Road at about 6:10 a.m., he met the two operations specialists he had telephoned earlier and saw the Loving Fire Department vehicles on Whitethorn Road at the entrance driveway to the compressor station. He turned into the entrance road, entered the compressor station, and went to the control room to inspect the equipment. He said he knew that power was off at the station because no lights were available in the control room. He said that the automatic emergency shutdown system had vented gas from the station, shut off electrical service, and started the battery-powered cool-down pumps on the compressors. He and the two operations specialists then crossed the road to the 3191 block valve for the South Carlsbad line. This valve was just outside the east fence of the compressor station where line 3191 connects to lines 1103 and 1110. They finished closing the block valve at about 6:16 a.m., thereby isolating the South Carlsbad compressor station from the Pecos River station and from lines 1103 and 1110. The station lead operations specialist telephoned the gas control center and informed personnel there that the valve was closed and that the South Carlsbad compressor station should be taken off line. The station lead operations specialist sent the other two employees back to Whitethorn Road to help with crowd control as needed. At about 5:51, the first emergency responders arrived on scene and staged on Whitethorn Road where the driveway into the Pecos River compressor station intersects the road. Additional emergency responders also staged at this location, which is about 3/4 mile from the accident site. The Carlsbad Fire Department’s medic units had responded to the initial call and proceeded as far as the Pecos River compressor station. They remained there until an ambulance was directed to the victims and EPNG employees admitted the smaller fire vehicles.15 When one of the fire engines entered the unpaved road from the west during the fire before the No. 6 block valves were closed, the station lead pipeline operations specialist stopped them from going farther. He told fireman to stand by while he shut more valves. As police cars arrived at that location, he told them to go back to the railroad tracks and let only EPNG vehicles or vehicles with flashing red lights through. Emergency vehicles were admitted as needed to the accident scene after the fire at the ruptured line was out. The victims were camped about 675 feet from the crater, between the crater and the river. Emergency personnel located victims with the assistance of the operations specialist. Six victims were found at the camping area; six others had gone into the river and were either in the river or had been assisted to the banks by the operations specialist. Paramedics and emergency medical technicians worked to treat the injuries. Volunteer 15 The station lead operations specialist was concerned that the larger fire fighting equipment would become stuck on the sandy access road.

Factual Information 10 Pipeline Accident Report firefighters and the crews of Carlsbad medic units then evacuated the six victims to hospital burn centers in Texas. None of the victims survived. The New Mexico State Police responded to the accident and assumed responsibility for emergency management of the incident. Police personnel also provided support to Safety Board personnel during the on-scene investigation. EPNG reported the accident to the National Response Center at 8:27 a.m. Pipeline Operations After the Rupture EPNG gas controllers called gas suppliers to inform them of the problem and to request that gas supplies into the affected part of the EPNG system be reduced or suspended due to the incident and the immediate need to shut in all three lines. While only one pipeline ruptured, two other pipelines (1100 and 1110) near the rupture site were shut down and inspected for damage. All compressors at Keystone compressor station “A” plant, as well as Unit 3 at the Keystone compressor station “B” plant, which had been delivering gas toward the Pecos River, were off by 6:25 a.m. Meanwhile, the gas control center was in the process of rebalancing the south pipeline system to compensate for the isolated Pecos River compressor station. At about 6:10 a.m., the gas control center directed personnel at the Washington Ranch storage facility16 to stop injecting gas into the storage field and to begin withdrawing gas from the field. Withdrawing gas from storage allowed EPNG to continue to send gas west. Postaccident On-Site Inspection The force of the rupture and the violent ignition of the escaping gas created a 51- foot-wide crater about 113 feet along the pipe. A 49-foot section of the pipe was ejected from the crater in three pieces measuring approximately 3 feet, 20 feet, and 26 feet in length. (See figure 6.) The largest piece was found about 287 feet northwest of the crater in the direction of the suspension bridges. Investigators visually examined the pipeline that remained in the crater as well as the three ejected pieces. All three ejected pieces showed evidence of internal corrosion damage, but one of the pieces showed significantly more corrosion damage than the other two. Pits were visible on the inside surface of this piece, and at various locations, the pipe wall evidenced significant thinning. At one location, a through-wall perforation was visible. No significant corrosion damage was visible on the outside surfaces of the three pieces or on the two ends of the pipeline remaining in the crater. Pieces were cut from the ruptured pipeline segments and shipped to the Safety Board’s Materials Laboratory in Washington, D.C., for further evaluation. (That evaluation is discussed in the “Tests and Research” section of this report.) 16 Washington Ranch storage facility, an attended facility about 24 miles west and downstream of the Pecos River compressor station, received and delivered gas through lines 1100, 1103, and 1110.

Factual Information 11 Pipeline Accident Report The drip17 between block valve No. 6 and the rupture site was removed from the pipeline and visually examined. The drip was found to contain a blackish oily- powdery/grainy material. At the area of its heaviest concentration, about 13 feet from the drip opening, this material filled approximately 70 percent of the cross-sectional area of the drip. No significant material was observed in the area just underneath and several inches away from the siphon drain at the closed end of the drip. No significant internal corrosion was observed in the drip. Injuries All 12 persons who were camping on the east bank of the Pecos River were fatally injured in the accident. The causes of death were extensive thermal burns, carbon monoxide poisoning, and smoke inhalation. (See table 1). Figure 6. Looking west at a portion of the crater created by the rupture. The missing section of pipe between the arrows was ejected from the crater. 17 The drip (described in more detail later in this report) was a 40-foot-long stub line that branched off the bottom of the gas pipeline. The drip was designed to collect liquids and solids that may have built up in the pipeline during normal transportation of gas or after pigging operations.

Factual Information 12 Pipeline Accident Report Table 1. Injuries Damages Approximately 49 feet of the underground portion of line 1103 were ejected in three pieces from the crater created by the rupture. Two of the pieces of pipe were thrown 234 and 287 feet, respectively, from the northwest end of the crater toward the river. One of these pieces hit the cables that supported the pipeline suspension bridges across the river. The concrete anchor blocks for the cables, the cables themselves, and the two suspension bridge steel structures on the east side of the river were burned, as were the aboveground portions of the pipelines. The two pipelines that were being supported on the bridges (EPNG’s 26-inch line 1100 and the out-of-service 16-inch line 1000) fell and came to rest on the ground on each side of the river, but neither leaked. The three vehicles and camping equipment on the east side of the river were destroyed, and vegetation along both riverbanks was burned. Based on photographs taken of the fire as it engulfed the suspension bridges, the height of the flame was calculated to be about 496 feet. EPNG, in its incident report to the Research and Special Programs Administration (RSPA), stated the cost of the accident was $998,296. Toxicological Information Specimens for drug testing were collected from the controllers and the coordinator on Sunday, August 20. The EPNG substance testing contractor, Behavioral Training Institute, Inc., performed the collections and forwarded the specimens to Universal Toxicology Laboratories in Midland, Texas. The results were reviewed by a medical review officer at SurgiMed, P.A., in El Paso, Texas. Tests were negative for the tested drugs.18 Injury Type Public Employees Total Fatal 12 0 12 Serious 0 0 0 Minor 0 0 0 Total 12 0 12 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.” 18 Specimens were tested for marijuana, cocaine, opiates, amphetamines, and phencyclidine (PCP).

Factual Information 13 Pipeline Accident Report Tests and Research Metallurgical Examination On-site examination of the three pieces of pipe that were ejected from the crater at the rupture site identified severe internal corrosion along the interior bottom of the pipe. (See figure 7.) From these three segments, eight pieces were excised and transported to the Safety Board’s Materials Laboratory in Washington, D.C., for further examination. The examination of these pieces revealed no evidence of corrosion on the outside of the pipe or the internal surface across the top half of the pipe (between the 9 and 3 o’clock positions looking downstream/west). Severe wall loss due to corrosion was observed on the inside of the pipe at the bottom. The area of corrosion damage extended 21 feet 5 inches. Sections of the girth (circumferential) and seam (longitudinal) welds that were in the bottom half of the pipe exhibited damage from internal corrosion similar to that found on the bottom pipe wall. The extent of corrosion damage (metal loss and number of pits) was most severe along the bottom of the pipe; the most severely corroded area reduced the original pipe wall thickness by 72 percent. (See figure 8.) The wall of many of the corrosion pits contained striations that extended around the pit. (See figure 9.) Within this length of corrosion damage were five circumferential wrinkles19 in the pipe wall on the top of the pipe. Figure 7. Fractured section of line 1103. 19 A wrinkle is a smooth fold in the pipe wall that may have a single inward or single outward displacement or that may include a sinusoidal waveform with both inward and outward displacements. The five wrinkles in this pipe were outward deflections of the pipe wall.

Factual Information 14 Pipeline Accident Report Figure 8. Corrosion pitting on inside of pipe near rupture site. Figure 9. Microscopic view of corrosion pit showing striations

Factual Information 15 Pipeline Accident Report Examination of the fractures showed that a fracture face extended between the internal corrosion areas and the external wall of the pipe. The fracture faces resulted from overstress separation with no evidence of fatigue cracking or corrosion degradation, indicating that corrosion had not penetrated the wall of the pipe at the rupture point. Corrosion Products The Safety Board’s Materials Laboratory performed x-ray dispersive spectroscopy analysis on material removed from corrosion pits and areas containing corrosion damage, both from the inside of the pipe. The analysis found high levels of chlorine and sodium in the material. After the accident, corrosion products, deposits, and liquid samples were collected from various locations in the EPNG transmission system and subjected to chemical and microbial analysis. Sample collection locations included the Pecos River and Keystone compressor station inlet scrubbers, the line 1103 drip, the line 1103 pig receiver at valve No. 6, and the line 1100 pig receiver at valve No. 5. Anaerobic bacteria were present in all deposit/corrosion product samples, and aerobic bacteria were present in 9 of 11 samples; sulfate-reducing bacteria were detected in 18 of 22 individual tests (10 of 11 samples), and acid-producing bacteria were detected in 10 of 22 individual tests (7 of 11 samples). The chemical analysis indicated the presence of chlorides in all samples. Chloride concentrations exceeding 9,000 parts per million (ppm) were detected in three of four samples obtained from Line 1103. One of these three samples, obtained from the line 1103 pig receiver, showed a chloride concentration of 333,000 ppm, or roughly 33 percent of the sample. The fourth sample, collected from the line 1103 drip at a point away from the siphon drain, showed a chloride concentration of less than 50 ppm. Samples taken from corrosion pits detected in line 1103 after the accident at a low point in the pipeline (about 2,080 feet downstream of the rupture site) showed positive reactions for all four types of bacteria (sulfate-reducing, acid-producing, anaerobic, and aerobic). At this location, the pipe contained a circumferential wrinkle across the top half of the pipe and corrosion on the internal surface of the bottom of the pipe. Additional chemical and microbial tests were conducted by EPNG on samples collected from various transmission facilities. These data showed the presence of acid-producing bacteria in all samples obtained from the corrosion pit areas. Concentrations greater than 10,000 cells/ml of acid-producing bacteria were observed in 9 out of 13 samples obtained from various pit areas. Only 1 out of these 13 samples showed microbial concentration less than 10 cells/ml. Chloride levels of less than 100 ppm were observed in 26 of 85 samples. Chloride levels greater than 1,000 ppm were observed in 34 of 85 sludge/deposit samples. The highest observed chloride level was 400,000 ppm. Chemical analyses showed that the pH of the liquid collected at the Pecos River compressor station plant inlet separator scrubber was 6.7 to 6.8. The pH of the liquid collected at the Keystone compressor station inlet scrubber was 8.2. For the material collected at the line 1100 and 1103 pig receivers, the pH level was 6.2 to 6.3. The pH of the inside material collected from a low spot on line 1103 west of the rupture was 6.4.

Factual Information 16 Pipeline Accident Report Analysis of the material collected near the siphon drain area of the line 1103 drip showed a pH of 8.9. Chlorides were observed in all corrosion product/deposit samples. The morphology of corrosion damage located away from the bottom of the ruptured pipe appeared similar to water line corrosion. Pipeline 1103 At the time of the accident, EPNG operated more than 10,000 miles of natural gas transmission pipelines involving 59 compressor stations and plants and more than 300 compressor units. The company operated three of the four in-service gas pipelines at the Pecos River crossing, including line 1103, the pipeline that ruptured in this accident. The section of pipeline 1103 between the Keystone compressor station and the Pecos River compressor station was constructed in 1950 with pipe purchased from Republic Steel that had been manufactured in accordance with American Petroleum Institute standard 5LX, High-Test Line Pipe (first edition, 1948). The pipe was 30-inch outside diameter (OD), grade X52 (specified minimum yield strength of 52,000 psi20) pipe with a nominal wall thickness of 0.335 inch, with sections of heavier wall pipe at locations such as road crossings and block valve assemblies. The longitudinal seam weld in the pipe was a double submerged arc weld. The pipeline was cathodically protected, and the coating was coal-tar wrap. The pipeline was operating at approximately 675 pounds per square inch, gauge (psig), at the time of the accident. The maximum allowable operating pressure from Keystone compressor station to the Pecos River compressor station had been established by EPNG at 837 psig.21 Pipeline Features Valves. Block valves were spaced along line 1103 between the Keystone and Pecos River compressor stations at intervals ranging from 1 mile to 19.2 miles. From the rupture location, block valve No. 6 at the pig receiver was the closest upstream/east valve (0.25 mile), and block valve No. 6 1/2 at the Pecos River compressor station was the closest downstream/west valve (0.85 mile). When pigging facilities, including the pig receiver, were installed in the mid- 1970s, the valve then designated block valve No. 6 (a 30-inch gate valve) became the receiver isolation valve. A new plug valve was installed in the bypass around the pig 20 Although yield strength is expressed in pounds per square inch, this number is an expression of the pipe material strength value, which is not equivalent to a pipe’s internal pressure. 21 Equivalent to a stress level of 72 percent of specified minimum yield strength in the 0.335-inch-wall- thickness pipe.

Factual Information 17 Pipeline Accident Report receiver and was designated block valve No. 6. Block valve No. 6 was 0.25 mile upstream/east of the rupture site. Line 1103 was cross-connected with other lines upstream of the rupture site as follows: • Lines 1103 and 1110 were cross-connected in three places between the Keystone and Pecos River compressor stations upstream/east of the rupture site. • Lines 1103 and 1100 were cross-connected between block valve No. 6 and the line 1103 drip. Crossover to Line 1100. About 720 feet downstream/west of block valve No. 6, a 16-inch OD crossover (branch line with valves) cross-connected lines 1103 and 1100. The crossover was installed during the original construction of the pipeline. Line 1100 was equipped with a drip until 1989, at which time the drip was found to be “completely full of solidified black solids & oil” and was removed. No internal corrosion was observed. Line 1103 Drip Assembly. About 990 feet downstream/west of block valve No. 6 was a drip, a liquid collection leg buried beneath the pipeline that consisted of about 40 feet of 30-inch pipe. (See figure 10.) The leg was buried approximately 7 feet directly below the gas pipeline and sloped downward toward a dead end equipped with a siphon drain. The leg functioned to collect liquids and solids during normal transportation or after pigging operations. Also at this location was a liquid storage tank consisting of a 4,620- gallon aboveground steel tank installed within a concrete dike. The siphon drain in the liquid collection leg of the drip assembly emptied into this tank. (See figure 11.) The tank was fitted with piping and valves for loading the collected liquids into a truck for disposal. The drip assembly was installed during the original construction of the pipeline. Because of the location and design of this drip, cleaning pigs could not be run in the section of pipeline that ruptured. After the removal of the line 1100 drip in 1989, liquids and solids moving down line 1100 toward the Pecos River compressor station during both normal operations and pigging operations in line 1100 could enter line 1103 upstream of the drip. Pecos River Crossing. About 2,025 feet downstream/west of block valve No. 6 was a steel bridge with a single-lane concrete service road spanning approximately 430 feet across the Pecos River. Pipeline 1103 rested on, and was strapped to, horizontal steel support members off the side of the north bridge girders. Gas Suppliers Line 1103. In addition to receiving gas from the Keystone compressor station, line 1103 had been connected to and received gas from other gas suppliers beginning in 1979. Seven receipt points existed between the Keystone and Pecos River compressor stations where gas flowed into the line for periods ranging from 6 months to 21 years, but at the time of the accident, only one active supplier, an interstate transmission pipeline, was connected to line 1103.

Factual Information 18 Pipeline Accident Report Line 1110. In addition to the gas entering line 1110 from its connection with line 1103, two receipt points flowed gas into line 1110 beginning in 1979 for periods of 14 years and 21 years, respectively. At the time of the accident, only one active supplier, the same interstate transmission pipeline connected to line 1103, was connected to line 1110. Line 1100. In addition to the gas entering line 1100 from the EPNG’s Eunice plant, 25 receipt points flowed gas into line 1100 beginning in 1949 for periods ranging from 1 1/2 years to 51 years. At the time of the accident, 11 active suppliers were connected to line 1100. Pigging Operations When pigging facilities were added to line 1103 about 25 years after initial construction, a pig launcher was installed at block valve No. 2 approximately 10.5 miles downstream/west of the Keystone compressor station, and a pig receiver was installed at block valve No. 6. At the time of the accident, the line could be pigged from block valve No. 2 to block valve No. 6. The line was pigged to remove solids and liquids that had collected in the pipeline. According to EPNG, when possible, cleaning pigs were run a minimum of twice per year. Figure 10. Line 1103 drip after excavation.

Factual Information 19 Pipeline Accident Report Figure 11. Diagram of line 1103 drip.

Factual Information 20 Pipeline Accident Report There was no pig launcher at block valve No. 6 and no pig receiver at Pecos River compressor station. For that reason, and because of a reduced port valve22 and other pipeline features, including the drip, in the section of the pipeline between block valve No. 6 and the Pecos River compressor station, that portion of the pipeline (which included the rupture location) could not be pigged. At the time of the accident, the design of the pipeline was such that liquids and solids not caught at the pig receiver at block valve No. 6 would continue downstream past the block valve assembly to the drip downstream/west of the block valve. EPNG officials said gas pressure in the drip was used to blow the material out of the drip after each pigging operation, causing the materials to move to the adjacent, aboveground storage tank for later removal by truck. This tank was also used in conjunction with the drip on line 1110. Officials said that in addition to being emptied after a pigging operation, drips were blown on the 1st and 17th of each month, although the company did not keep records of blowdowns. According to EPNG, material that remained in the pig receiver after a pigging operation was blown into a dirt pit through a 6-inch pipe off the bottom of the pig receiver near the closure. This 6-inch pipe also connected to an identical 6-inch pipe, which was used to blow down the adjacent line 1110 pig receiver into the same disposal pit. After about 1975, the 6-inch blowdown piping to the disposal pit was taken out of service. A concrete basin was installed below the closure at the end of the pig receiver, and pigging residue was removed from the pig receiver via the closure and transferred to portable fiberglass containers for disposal. There were no drain lines or liquid storage legs connected to the pig receiver, as the downstream drip served to collect the pig liquids. In the 3 years before the accident, line 1103 was pigged from near block valve No. 2 to block valve No. 6 four times in 1997, three times in 1998, once in 1999, and once in 2000 before the accident. Records for each pig run noted “no solids/liquids reported,” except for the 1999 cleaning, for which “2100 lbs solid/2 barrels oil” was reported. In 2001, EPNG notified both RSPA and the Safety Board that the 1999 report of “2100 lbs” was more likely “20 lbs.” According to EPNG officials, fluids and sludge recovered after the pigging operations were sent to the EPNG laboratory in El Paso, Texas, and analyzed for hazardous components before disposal. Results of the analysis were provided to the complex manager and to the environmental compliance engineer responsible for the complex. Test results were also provided to the principal coordinator, corrosion services, and retained at the laboratory. The materials were not tested to determine if they were potentially corrosive to the pipeline. The laboratory superintendent for the EPNG chemistry laboratory stated that samples from pigging and other inspections had water concentrations ranging from trace amounts (less than 1 percent) to 10 percent. 22 The opening in a reduced port valve is smaller than the actual valve size, which prevents a pig from passing through the valve. For example, the passage through a 30-inch valve could be a 24-inch-diameter opening.

Factual Information 21 Pipeline Accident Report At the Pecos River compressor station, four inlet scrubbers removed liquids from the gas stream entering the station from lines 1100, 1103, and 1110. The collected liquids were analyzed in the same manner as pig liquids. The materials were not tested to determine if they were potentially corrosive to the pipeline. In July 1997, because of a recent rupture of line 1300 due to internal corrosion, EPNG conducted an in-line inspection (using a “smart pig” internal inspection tool) of a 70-mile section of line 1300. According to EPNG, this inspection found no areas of internal corrosion requiring repair, but a visual inspection of the pipeline in the immediate area of the rupture found an area of internal corrosion, which was repaired. In June and July 1998, 33 miles of line 1103 and 33 miles of line 1100, which included a segment of pipe in which a rupture had recently occurred, were inspected with an in-line inspection tool. The inspected segments of lines 1100 and 1103 were downstream of the Pecos River compressor station. No areas of internal corrosion requiring repair were discovered. In February 2000, EPNG conducted in-line inspections of 33 miles of lines 3133/3137 upstream of Goldsmith Plant in Texas. No areas of internal corrosion requiring repair were discovered. Tests and Inspections The line 1103 right-of-way had most recently (before the accident) been inspected on August 11, 2000, by aerial patrol and on August 18, 2000, by ground patrol. Inspectors looked for evidence of leaks (such as discolored soil or dying vegetation), erosion, and excavation near the pipeline. No leaks were reported. Before the accident, the segment of line 1103 between the Pecos River and Keystone compressor stations had never been internally inspected, nor had it been pressure-tested except for two segments, totaling approximately 0.9 mile located approximately 46 miles upstream of the rupture location, that had been hydrostatically tested.23 EPNG’s Internal Corrosion Program According to EPNG, before the accident, the company monitored and mitigated internal corrosion by controlling the quality of gas entering the pipeline, by visually inspecting the inside of exposed pipe (and, under certain conditions, performing an ultrasound test to determine pipe wall thickness), by running cleaning pigs through the pipeline to remove liquids, and by blowing down the drips to remove the liquids and to verify that the drips were functioning properly. EPNG officials stated that they believed that line 1103 was not transporting corrosive gas because the line was receiving “pipeline 23 Current Federal regulations require that gas pipelines be pressure-tested before being placed in service. These requirements did not exist when line 1103 was constructed, and when the regulations were issued later, the requirements for pressure-testing did not apply to existing pipelines.

Factual Information 22 Pipeline Accident Report quality” gas and that unusual conditions, such as water in the pipeline, were not being observed at the pig receiver or the drip on line 1103. Gas quality standards were contained in EPNG’s contracts with its gas suppliers but were not referenced in the company’s corrosion control procedures. Some interconnect locations had gas quality monitoring, which either closed a valve to stop the flow of gas into the transmission pipeline or alarmed in the gas control center if the limit of any specified contaminant was exceeded. Not all contaminants were monitored at each monitoring location. For line 1103, gas quality monitoring was installed in the discharge of the Keystone compressor station, at the suction to the Pecos River compressor station, and at the receipt point with the interstate transmission pipeline approximately 17 miles downstream/west of the Keystone compressor station. This interconnect location had an automatic closing valve (referred to as a “slam valve”) actuated by high levels of hydrogen sulfide (H2S), and an alarm actuated by high levels of carbon dioxide (CO2). No slam valves or alarms were installed at any of the other receipt locations in line 1103 between the Keystone and Pecos River compressor stations. EPNG was not able to provide water vapor data for line 1103 at the discharge from the Keystone compressor station for 19 months between 1998 and 2000.24 At this same location, records showed that moisture monitoring instrument readings remained unchanged from July 10 to 16, 1992; October 1 to 18, 1994; August 13 to 25 and 27 to 30,

1. The moisture monitoring instrument at the Pecos River compressor station inlet also

showed unchanged readings from July 11 to 17, 1991; June 16 to July 26, 1994; June 28 to July 28 and August 1 to 25, 1996. Similarly, moisture monitoring instruments at the Pecos River compressor station inlet for lines 1100 and 1110 showed periods of unchanged readings. For line 1110, gas quality monitoring was installed in the suction to the Pecos River compressor station and at the receipt point with the interstate transmission pipeline approximately 17 miles downstream/west of the Keystone compressor station. This interconnect location had a slam valve actuated by high levels of H2S and an alarm actuated by high levels of CO2. At the other receipt location on line 1110 between Keystone and Pecos River compressor stations, there was a slam valve actuated by high levels of H2S and an alarm actuated by high levels of CO2. For line 1100 between Eunice plant and the Pecos River compressor station, gas quality monitoring was installed on the suction to the Pecos River compressor station. Two of the 26 receipt locations between Eunice plant and the Pecos River compressor station had slam valves actuated by high levels of H2S and alarms actuated by high levels of CO2. In the event of an alarm, gas control center personnel notified the pipeline location supervisor and a technician would be called out to investigate. The remaining receipt locations were not equipped with slam valves or alarms. 24 EPNG officials advised the Safety Board that they believed that the monitoring instrumentation was working, but that the data were not recorded electronically.

Factual Information 23 Pipeline Accident Report EPNG officials said that at other locations, its personnel periodically (at 1- to 6- month intervals) sampled and analyzed the gas entering the pipeline. There were no written requirements that corrosion technicians follow up on reports of out-of- specification gas being received or identify the effect, if any, of this gas on the pipeline. Corrosion coupons25 or corrosion monitoring devices were not used in this section of line 1103 because, officials said, the gas was not believed to be corrosive. EPNG did not inject any corrosion inhibitors into line 1103. The program did not require that ultrasonic testing be performed on the low points of the non-piggable portions of line 1103, and none was performed before the accident. According to EPNG, visual inspections of line 1103 in the area of the Keystone and Pecos River compressor stations that were exposed during operations or maintenance activities before the accident had not shown evidence of internal corrosion. Internal Corrosion Control Procedures Procedures in Effect Before the Accident. Although at the time of the accident, EPNG was in the process of implementing updated internal corrosion procedures (discussed below), the company’s internal corrosion control program in the period leading up to the rupture was governed by its Operating and Maintenance Procedures manual. Section 201.2, “Corrosion Control,” dated September 20, 1999, prescribed the minimum company requirements for monitoring and protecting metallic structures. The indicated references were 49 Code of Federal Regulations (CFR) 192.451 through 192.491, which include Federal regulations regarding internal corrosion. Most of Section 201.2 related to external corrosion. Requirements for an internal corrosion program were as follows: If corrosive gas is transported or if internal corrosion is found, Corrosion Services will recommend the appropriate corrective action and establish an internal corrosion monitoring program to determine the effectiveness of mitigation programs. Internal corrosion mitigation will continue until monitoring and testing determines that the source of corrosion has been removed or other corrective actions have rendered the gas stream non-corrosive. Internal monitoring will be performed at least twice each calendar year, but with intervals not to exceed 7 1/2 months. Additional monitoring will be performed if necessary. A Remedial Action Form will be completed if internal corrosion is discovered on any portion of the pipeline or ancillary components and vessels containing natural gas. Each time a pipeline or station pipe segment is exposed for any reason, the coating and pipe will be evaluated and documented. Whenever any pipe is removed from a pipeline, it shall be inspected for internal corrosion. If internal corrosion is found, the adjacent pipe must be investigated to determine its extent and appropriate measures taken as detailed in these procedures. 25 A corrosion coupon is a small piece of metal with a specially prepared surface for measuring corrosion rates. Corrosion coupons may be inserted into the pipeline during pipeline operations to help operators assess the potential for internal corrosion or to evaluate the effectiveness of corrosion mitigation efforts.

Factual Information 24 Pipeline Accident Report The procedures did not address the factors that should be considered in determining whether the gas being transported could cause corrosion. The company stated that the company’s gas quality standard, set forth in its contracts, addressed several contaminants, including water, CO2, H2S, and oxygen (O2), but the corrosion control procedures did not reference these contaminants or their acceptable limits. In the event that it was determined that corrosive gas was being transported or internal corrosion was occurring, corrosion-mitigation actions would be taken. But the procedures did not detail how technicians were to carry out semi-annual monitoring to determine if the corrosion mitigation measures were effective. The procedures did not provide guidance regarding how internal corrosion would be detected other than through visual inspection of a pipe segment after it had been removed. Procedures in Effect at the Time of the Accident. EPNG acquired Tenneco Energy in December 1996 and formed El Paso Energy Corporation. In January 2000, El Paso Energy Corporation acquired Sonat, Inc., another natural gas pipeline company.26 El Paso Energy Corporation then assembled teams of representatives from each pipeline company and tasked them with establishing best practices and producing a common operating and maintenance manual. This new manual was issued on May 15, 2000. The new Corrosion Control Manual, which detailed the requirements for internal corrosion control and monitoring, was issued on July 10, 2000. The section of the Corrosion Control Manual applicable to internal corrosion control was Section 700, “Internal Corrosion Control.” The applicable sections of the Operating and Maintenance Procedures manual were Sections 308.1, “Corrosion, General and Records,” and 308.3, “Internal Corrosion Control.” References included in these sections were 49 CFR 192.453, 192.475, and 192.477, which address Federal requirements for internal corrosion control and monitoring. Section 308.3 of the manual required that gas and liquids be tested to determine if they are corrosive and required further steps to minimize the possibility of internal corrosion. Section 700 of the Corrosion Control Manual included a statement that quality standards for gas and liquids entering the pipeline represent the first line of defense against internal corrosion and noted that only by regular monitoring and analysis can it be determined if a pipeline is carrying corrosive gas. Detailed descriptions in section 700 for sampling procedures indicate that sampling and analysis of gas, liquids, and solids removed from the pipeline is required. Section 700 also contained a discussion of corrosive constituents in gas streams; listed the company’s typical gas and liquid quality standards, velocity standards, and corrosion coupon and inhibitor guidelines; schedules for pipeline liquid, gas, and solid sampling; and requirements for preservation of evidence after a leak or failure. Also noted in the documents was that water and other corrosives may enter the pipeline by accident or may gradually accumulate in low spots despite gas quality monitoring that shows 26 After acquiring Coastal Corporation in January 2001, El Paso Energy Corporation became El Paso Corporation. The El Paso Corporation pipeline system now consists of more than 46,000 miles of gas transmission pipelines.

Factual Information 25 Pipeline Accident Report adherence to quality standards. It also included the basic regulatory requirements that corrosive gas may not be transported by pipeline unless the effect of the gas on the pipeline has been investigated and steps have been taken to minimize internal corrosion; that the internal surface of a pipeline be inspected whenever the pipe is exposed and opened; and that coupons or other means be used to determine the effectiveness of the steps taken to minimize internal corrosion. Before July 10, 2000, the EPNG operating and maintenance standards did not address the relationship of flow velocity to liquid accumulation in a pipeline. The Corrosion Control Manual dated July 10, 2000, included a velocity standards subsection that stated the velocity of wet gas (defined as gas containing more water vapor than the amount specified, typically 7 pounds of water per million standard cubic feet of gas) in a pipeline must be limited to avoid solids-erosion or erosion-corrosion. The procedure required that consideration be given to flow patterns in the pipeline when evaluating liquid transported by gas. Flow patterns were described for velocities less than 7.5 feet per second (dormant pools in a dry gas stream occur), 7.5 to 15 feet per second (agitated pools and minor spray occur), 15 to 25 feet per second (continuous stream along the bottom of the pipe, small agitated pools, and spray occur), and greater than 25 feet per second (no liquids, only spray occurs). Gas velocity data provided by EPNG for the period 1991 to 2001 indicates that gas velocities in line 1103 ranged from 2 to 33 feet per second. Typical velocities ranged from a low of 2 to 7 feet per second to a high of 15 to 23 between 1993 and 2000, with velocities as high as 33 feet per second in 1991 and 1992. At the time of the rupture, El Paso Energy was in the process of implementing the July 10, 2000, corrosion procedures in Section 700 of the Corrosion Control Manual and had conducted a training session for corrosion technicians in El Paso during the first week of August 2000. Other personnel assigned corrosion control responsibilities were scheduled for training at a later date. After the accident, EPNG revised the sections of the Operating and Maintenance Procedures and the Corrosion Control Manual that affect internal corrosion control. EPNG’s current manual (Corrosion Control Manual, Section 6, effective December 31, 2001) states “identification of corrosive gas in a pipeline is achieved by analysis of operating conditions, gas impurity content, monitoring data, mitigation schemes, and/or other considerations” and that “an effective internal corrosion-monitoring program includes sampling and analysis of liquid, gas and solid materials.” Internal Audit Program EPNG’s Quality Assurance Auditing Procedures Manual (February 4, 1999, revised March 3, 1999) describes the company’s internal audit program. For internal corrosion, the pipeline and plant/stations sections of the manual have a section entitled “Corrosion Control–Internal Coupons.” Answers to the following questions are required for the audit:

Factual Information 26 Pipeline Accident Report Is corrosive gas being transported? If so, has the effect of the gas on the pipeline been investigated? What steps have been taken to minimize internal corrosion? Corrosion inhibitor? Dehydration? Have internal coupons been installed to monitor the effectiveness of the corrosion-mitigating program? If so, are the coupons checked two times each calendar year at intervals not exceeding 7-1/2 months? Is the mil loss per year acceptable? Preprinted forms were provided in the manual for the auditor to record the results of an internal audit. For pipelines, these forms did not list the internal corrosion items identified in the audit questions or provide a space for the auditor to document the results of the internal corrosion portion of the audit. An EPNG senior safety staff member who conducted internal audits told investigators that auditors relied on the location manager/superintendent to tell them whether or not corrosive gas was being transported through the pipeline. This employee stated that he was aware that gas quality specifications existed, but he did not know what they were or what EPNG would consider to be corrosive gas per these specifications. In September 1996, EPNG’s line 1300 ruptured because of internal corrosion. The senior safety staff member stated that previous internal audits had not found indications that internal corrosion may be occurring in line 1300 or that the use of corrosion coupons or other monitoring methods were needed in the line. In addition, he stated that after the rupture of line 1300, the internal audit program was not revised. Regulatory Oversight Federal Safety Standards RSPA promulgates regulations that establish minimum standards for the transportation of natural gas by pipeline. The regulations for internal corrosion control for gas transmission pipelines in effect at the time of the accident are in 49 CFR Part 192, “Transportation of Natural and Other Gas by Pipeline: Minimum Federal Safety Standards,” as follows: Subpart L, 192.605 Procedural manual for operations, maintenance, and emergencies Each operator shall include the following in its operating and maintenance plan: (a) General. Each operator shall prepare and follow for each pipeline, a manual of written procedures for conducting operations and maintenance activities and for emergency response. For transmission lines, the manual must also include procedures for handling abnormal operations. This manual must be reviewed and updated by the operator at intervals not exceeding 15 months, but at least once each calendar year. This manual must be prepared before operations of a pipeline system commence. Appropriate parts of the manual must be kept at locations where operations and maintenance activities are conducted.

Factual Information 27 Pipeline Accident Report (b) Maintenance and normal operations. The manual required by paragraph (a) of this section must include procedures for the following, if applicable, to provide safety during maintenance and operations. (1) Operating, maintaining, and repairing the pipeline in accordance with each of the requirements of this subpart and Subpart M of this part. (2) Controlling corrosion in accordance with the operations and maintenance requirements of Subpart I of this part. Subpart I, 192.453 General: The corrosion control procedures required by §192.605(b)(2), including those for the design, installation, operation, and maintenance of cathodic protection systems, must be carried out by, or under the direction of, a person qualified in pipeline corrosion control methods. 192.475 Internal corrosion control: General: Corrosive gas may not be transported by pipeline, unless the corrosive effect of the gas on the pipeline has been investigated and steps have been taken to minimize internal corrosion. Whenever any pipe is removed from a pipeline for any reason, the internal surface must be inspected for evidence of corrosion. If internal corrosion is found, (1) The adjacent pipe must be investigated to determine the extent of internal corrosion; (2) Replacement must be made to the extent required by the applicable paragraphs of §§192.485, 192.487 or 192,489; and, (3) Steps must be taken to minimize the internal corrosion. Gas containing more than 0.25 grain of hydrogen sulfide per 100 standard cubic feet (5.8 milligrams/m3) at standard conditions (4 parts per million) may not be stored in pipe-type or bottle-type holders. Subpart I, 192.477 Internal corrosion control: Monitoring: If corrosive gas is being transported, coupons or other suitable means must be used to determine the effectiveness of the steps taken to minimize internal corrosion. Each coupon or other means of monitoring internal corrosion must be checked two times each calendar year, but with intervals not exceeding 7 1/2 months. The Federal pipeline safety regulations do not include design, construction, operating, or maintenance requirements that address the relationship of water and corrosive contaminants to internal corrosion in a gas pipeline.

Factual Information 28 Pipeline Accident Report Preaccident Federal Inspections of EPNG From June 1990 to August 1998, RSPA’s Office of Pipeline Safety (OPS) conducted 18 safety inspections of EPNG. Inspections were conducted using a question- and-answer format. Four of these inspections were performed by personnel from the Arizona State Corporation Commission, as an agent for the OPS for interstate pipelines. For each of these 18 inspections, compliance with the internal corrosion control regulations was noted as “satisfactory” or, for items associated with corrosion coupons, “N/A” (not applicable). These inspections were based on an inspection form that typically had six questions related to internal corrosion: (1) Are corrosion control procedures established? (2) Are these procedures under the responsibility of a qualified person? (3) Have coupons been utilized and checked at least twice annually, not to exceed 7.5 months? (4) Is gas tested to determine corrosive properties? (5) Whenever a pipe segment is removed from a pipeline, is it examined for evidence of internal corrosion? (6) Remedial action (if required) to minimize internal corrosion? In each of the inspections, “satisfactory” was entered in response to question 4 regarding testing the gas for corrosive properties. In December 1998, the OPS launched a 3-year pilot program designated the “system integrity inspection pilot program.” EPNG applied for the program in February 1999, and after reviewing EPNG’s qualifications, the OPS accepted EPNG into the program in April 2000. The system integrity inspection pilot program demonstration period expired at the end of 2001, at which time the program was terminated by the OPS. EPNG remained in the program until that time. The pilot program was an attempt by the OPS to develop a method by which the agency could ensure that a pipeline operator had an effective, compliance-driven internal audit plan and that the plan was effectively implemented. The program was intended to improve communication and information- sharing between operators and Government and to focus resources on the most important risks to pipeline safety. From July 1999 to September 2000, the OPS conducted eight safety inspections of EPNG under the system integrity inspection pilot program. For each of these eight inspections, compliance with the internal corrosion control regulations was noted as “satisfactory” or “N/A.” There were four internal corrosion related questions on the inspection report form used for six inspections, and they all were noted “satisfactory”: (1) Does the company maintain a comprehensive corrosion control program and associated records? (2) Is the company’s corrosion program under the direction of a qualified person, with associated records? (3) Are corrosion control procedures in place and do they follow Part 192/National Association of Corrosion Engineers (NACE)/industry standards, with associated records? (4) How is the gathered information reviewed and analyzed? Associated records? OPS memos summarizing several of these inspections noted that EPNG’s internal audit program was working as designed. One of these eight inspections was a joint team operation and maintenance procedures inspection conducted in April 2000. The form used for this inspection included four questions related to internal corrosion. The first was for the operator’s procedure for internal corrosion control coupon monitoring (rated “Satisfactory”); the second was for

Factual Information 29 Pipeline Accident Report the operator’s procedure for corrosion remedial measures (rated “Satisfactory”); the third was for the records of the coupon monitoring (rated “Not Applicable”); and the fourth was for records of the corrosion control remedial measures (rated “Not Applicable”). There were no questions or subject areas on the inspection record related to transporting corrosive gas, the training of internal corrosion control personnel, or the qualifications of the person directing the internal corrosion control program, as required by 49 CFR 192.453. The OPS summary of this inspection did not identify any deficiencies in internal corrosion monitoring and control or personnel training. Before August 2000, there were no enforcement actions against EPNG for its internal corrosion program. After the accident, the OPS revised the inspection form to include more detailed questions about internal corrosion. The revised form27 has the following written guidance for the inspector: • Proper procedures for transporting corrosive gas? • Is pipe inspected for internal corrosion? If found: is adjacent pipe inspected? Is pipe replaced if required? Are steps taken to minimize internal corrosion? • Internal corrosion control coupon monitoring (2 times per year / 7 1/2 months) • The operator should maintain a comprehensive internal corrosion control program that includes the following (Best Practice): • Sufficient fluid sample locations throughout their system for monitoring for corrosive elements. • Does the operator have established threshold limits for various corrosive compounds in their procedures? • Has the operator identified low points throughout their system where fluids are likely to accumulate and does the operator identify how to remove the fluids from the lines? • Does the operator specify the frequency in how often the fluids are removed? • Does the operator address fluid accumulation in unpiggable lines? (i.e., fluid samples, coupons, etc.) (Note: Refer to Advisory Bulletin ADB-00-02, 8/29/00; Internal Corrosion of Gas Pipelines). Federal Safety Standards and EnforcementMaps and Records The Federal regulations for construction records, maps, and operating history for gas transmission pipelines in effect at the time of the accident are in 49 CFR Part 192, Subpart L, 192.605, Procedural Manual for Operations, Maintenance, and Emergencies, which includes the following: (b) Maintenance and normal operations: The manual required by paragraph (a) of this section must include procedures for the following, if applicable, to provide safety during maintenance and operations: (1) .... 27 OPS Form-1 (192-90), “Evaluation Report of Gas Transmission Pipeline,” (Revised 2/01/02 through amendment 192-90).

Factual Information 30 Pipeline Accident Report (2) …. (3) Making construction records, maps, and operating history available to appropriate operating personnel. For the 26 safety inspections of EPNG (referenced earlier) conducted by the OPS from June 1990 to September 2000, compliance with 192.605(b)(3) was noted as “satisfactory,” “not applicable,” “not checked,” or, in some cases, the inspection form did not include questions specifically related to maps and records. Before August 2000, there were no enforcement actions against EPNG for their program for making construction records, maps, and operating history available to operating personnel. Postaccident Actions Pipeline Reconstruction After the accident, EPNG reconstructed lines 1103 and 1110 in the area of the river crossing. Line 1103 was modified to make it piggable between the Keystone and Pecos River compressor stations. During hydrostatic testing, line 1103 failed about 2,097 feet downstream/west of the accident site between the Pecos River and the Pecos River compressor station. At the failure location, pitting was observed on the internal surface of the bottom of the pipe, and the wall thickness had been reduced by approximately 69 percent. A March 2001 in-line inspection of line 1103, which included the segment in which cleaning pigs had been periodically run (from block valve No. 2 to block valve No. 6) found no areas of internal corrosion that required repair under the internal inspection analysis protocol developed by EPNG and reviewed by the OPS. Line 1110 was modified to make it piggable from its beginning point on line 1103 to the Pecos River compressor station. EPNG investigated nine low points in line 1110 between its beginning point on line 1103 and the Pecos River compressor station. No indications of internal corrosion were found. Some of these low points were in the section of line 1110 upstream of block valve No. 6 in which cleaning pigs had been periodically run. Line 1100 was removed from the suspension bridge, and new 26-inch pipe was constructed across the Pecos River and supported off the service bridge. Line 1000, which previously had been abandoned, was removed. The suspension bridges were removed and not replaced. EPNG modified the power supply to the SCADA computers and modem at Pecos River compressor station so that an emergency shutdown would not cause a loss of power to the local SCADA computer and modem.

Factual Information 31 Pipeline Accident Report Pipeline Integrity Management After the accident, EPNG contracted for the development of a program to train company personnel in internal corrosion. According to EPNG, that program has been completed and implemented. In response to the August 23, 2000, corrective action order (discussed in more detail below), EPNG identified 60 segments of pipeline where the risk of internal corrosion was judged to be the greatest. These segments were inspected by in-line inspection or other non-destructive means with the result that internal corrosion was discovered in eight pipelines. In six of these lines, the company judged the corrosion to be isolated instances. EPNG sent sections of the remaining two pipelines to the company’s metallurgical laboratory for analysis and chemical testing. These tests found a portion of one of these lines, line 1107, in which general internal corrosion and localized pitting had reduced the pipe wall thickness by approximately 42 percent. Corrosion product samples taken from this line were analyzed and found to contain high levels of acid-producing bacteria. Remedial actions were completed before the affected pipelines were returned to service. On December 4, 2002, the pressure restrictions imposed by the OPS corrective action order for lines 1100, 1103, and 1110 were lifted. After the accident, El Paso Corporation implemented an integrity management program applicable to the company’s 46,000 miles of gas pipelines. An executive-level committee was formed to provide program oversight, and a company-wide pipeline integrity committee was created to directly supervise and administer the integrity management program. The internal corrosion portion of this program includes a system- wide evaluation of flow velocities, low spots in pipelines, drips, vessels, gas quality history, and liquid analysis and other operating and maintenance history and specifies follow-up remedial action. Other components of the program include operational audits, the implementation of continuous improvement processes focused on sharing best practices, enhanced communication, and the incorporation of performance metrics. In addition, the program includes in-line inspection, before 2011, of all onshore pipelines 6- inch-diameter and larger (10,551 miles for EPNG and 42,083 miles total for all pipelines operated by El Paso Corporation). Federal Response On August 23, 2000, RSPA issued a corrective action order (appendix B) to El Paso Energy Pipeline Group requiring EPNG to take the necessary corrective actions to protect the public and environment from potential hazards associated with its pipeline operations. The corrective action order listed 25 required corrective action items. On August 29, 2000, RSPA issued Advisory Bulletin ADB-00-02 (appendix C) to all operators of natural gas transmission pipelines. This bulletin advised pipeline operators to review their internal corrosion monitoring programs and operations and provided guidance for doing so. On June 20, 2001, the OPS issued to El Paso Energy Pipeline Group a notice of probable violation, proposed civil penalty, and proposed compliance order. In the notice,

Factual Information 32 Pipeline Accident Report the OPS stated that preliminary findings indicate that internal corrosion likely played a major role in the accident. These findings also indicate that internal corrosion had probably occurred, over a long period, where liquids had accumulated in a low point in the pipeline. The five violations alleged in the OPS notice are summarized as follows:

1. EPNG's corrosion control procedure No. 700 for pipelines 1100, 1103, and

1110 is not carried out by, or under the direction of, a person qualified in pipeline corrosion control methods. This is because EPNG's corrosion personnel have not received the informal or formal training necessary to perform the tasks required to implement the corrosion control procedures.

1. EPNG did not take steps to investigate and to minimize internal corrosion, as

required by 49 CFR 192.475. EPNG failed to follow its procedures when it failed to determine that the gas transported in its pipelines was corrosive. Includes 1– Gas Control failed to recognize when water vapor levels of gas entering the pipeline exceeded Company limits and failed to stop the flow of gas into lines 1110 and 1103, 2 – Operations personnel failed to communicate with Corrosion personnel about excessive water vapor and liquid water in lines 1103 and 1110, 3 – Personnel failed to follow procedures to investigate and take corrective actions when the water vapor limits were exceeded in line 1103 and 1110, and 4 – Personnel failed to follow procedures and sound engineering practice by not performing corrosiveness tests on the liquids and solids that were removed from lines 1103 and 1110 after pigging operations.

1. EPNG did not follow its procedures for continuing surveillance by failing to

consider and take appropriate action on several unusual operating and maintenance conditions on line 1103. EPNG failed to test pigging residue for corrosivity and failed to evaluate line 1103 for low points where liquids could accumulate and where corrosion could occur.

1. EPNG did not follow its Leak and Failure Reporting procedure by not

following up on the Company's recommendations developed after the Roswell failure (caused by internal corrosion) and thus not minimizing the likelihood of a recurrence.

1. EPNG did not have an updated drawing of line 1103 because it did not show

the elevation profile of the pipeline in the area of the accident. Having an accurate profile would have allowed EPNG to determine where low points, and possible liquid accumulation and internal corrosion, were located. The notice proposed a civil penalty of $2.525 million for probable safety violations. On October 12, 2001, EPNG submitted a detailed response to the notice that addressed each alleged violation and requested a hearing as set forth in RSPA regulations. As of January 3, 2003, a hearing date had not been set, and a final order had not been issued.

Factual Information 33 Pipeline Accident Report Pipeline Integrity ManagementFederal Regulations In 1987, as the result of two gas pipeline accidents28 that killed five persons, the Safety Board made the following safety recommendations to RSPA: P-87-4 Require operators of both gas and liquid transmission pipelines to periodically determine the adequacy of their pipelines to operate at established maximum allowable pressures by performing inspections or tests capable of identifying corrosion-caused and other time-dependent damages that may be detrimental to the continued safe operation of these pipelines and require necessary remedial action. P-87-5 Establish criteria for use by operators of pipelines in determining the frequency for performing inspections and tests conducted to determine the appropriateness of established maximum allowable operating pressures. RSPA most recently responded in April 2002, stating that RSPA now requires integrity management programs for hazardous liquid pipelines in high-consequence areas, and that it (1) published a notice in the Federal Register on June 27, 2001, requesting comments on integrity management concepts for gas transmission pipelines, (2) published a proposed definition of high-consequence areas for gas pipelines on January 9, 2002, and (3) would propose a gas pipeline integrity management program later in 2002. On the basis of this information, Safety Recommendations P-87-4 and -5 were classified “OpenAcceptable Response” pending completion of these actions. In 1987, as the result of a gasoline pipeline accident29 in which two persons were killed and one person was seriously burned, the Safety Board made the following safety recommendation to RSPA: P-87-23 Revise 49 CFR parts 192 and 195 to include operational based criteria for determining safe service intervals for pipelines between hydrostatic retests. RSPA most recently responded in an October 11, 2002, letter summarizing the actions the agency has taken regarding pipeline integrity since the recommendation was issued. The agency told the Safety Board that over a number of years it had developed new 28 National Transportation Safety Board, Texas Eastern Gas Pipeline Company Ruptures and Fires at Beaumont, Kentucky, on April 27, 1985, and Lancaster, Kentucky, on February 21, 1986. Pipeline Accident Report NTSB/ PAR-87-01 (Washington, D.C.; NTSB, 1987). 29 National Transportation Safety Board, Williams Pipe Line Company Liquid Pipeline Rupture and Fire, Mounds Views, Minnesota, July 8, 1986. Pipeline Accident Report NTSB/PAR-87/02 (Washington, D.C.; NTSB, 1987).

Factual Information 34 Pipeline Accident Report approaches and had studied a number of developing technologies that are helping industry to better assess the operation of their pipelines. In addition, the letter stated that RSPA had developed a series of rulemakings that will require every natural gas transmission and hazardous liquid pipeline operator to implement an integrity management program to protect high-consequence areas that could be affected by a pipeline failure. Based on this information and information contained in an earlier (July 2002) response to this recommendation, the Safety Board classified Safety Recommendation P-87-23 “OpenAcceptable Response,”30 pending completion of the rulemaking. Effective September 5, 2002, RSPA issued a final rule (“Pipeline Safety: High Consequence Areas for Gas Transmission Pipelines”) in which it defined “high- consequence area” as an area within a certain distance of a gas transmission pipeline that meet one or more specified criteria for the number of persons or types of property that might be affected by an accident involving that pipeline. On December 17, 2002, the President signed Public Law 107-355, the Pipeline Safety Improvement Act of 2002. Section 14 of this act requires that within 12 months of its enactment, RSPA is to issue a final rule prescribing integrity management standards for operators of gas transmission pipelines in high-consequence areas. The act requires that within 24 months of its enactment, gas pipeline operators implement integrity management programs, even if RPSA has not issued a final rule. The act requires these pipeline operators to complete integrity testing of 50 percent of the highest risk pipelines within 5 years and the remainder within 10 years. Reassessment intervals are set at a minimum of once every 7 years. Integrity testing must be done by in-line inspection, pressure-testing, or an alternative method approved by RSPA as providing at least an equal level of safety. Under certain conditions, RSPA may grant waivers. The act requires the integrity programs to have clearly defined criteria for evaluating the results of the testing in addition to a description of actions to be taken by operators to promptly address any integrity issues raised by the evaluation. On January 28, 2003, RSPA published in the Federal Register a notice of proposed rulemaking (NPRM) to require operators of gas transmission pipelines to establish integrity management programs to identify and evaluate the condition of and threats to their pipelines in high-consequence areas and to take steps to protect against pipeline failures. The proposed rule would require these pipeline operators to use periodic in-line inspections, pressure-testing, direct assessment,31 or other means to identify weaknesses in the pipe wall. Further, the rule would require operators to gather and evaluate data on the performance trends resulting from their programs and to make improvements and corrections based on this evaluation. The rule will not apply to gas gathering or to gas distribution lines. The proposed rule would also incorporate the required elements for gas 30 Safety Recommendation P-87-23 had previously been classified “OpenUnacceptable Response.” 31 Direct assessment is an integrity assessment method that uses a process to evaluate the threats to pipeline integrity from external corrosion, internal corrosion, and stress corrosion cracking. The process includes the gathering and integration of risk factor data, indirect examination or analysis to identify areas of suspected corrosion, direct examination of the pipeline in these areas, and post-assessment evaluation.

Factual Information 35 Pipeline Accident Report pipeline integrity management programs that are mandated in the Pipeline Safety Improvement Act. NACE Standards NACE International, an organization concerned with corrosion issues, produces consensus industry standards in the form of test methods, recommended practices, and material requirements. In 1975, the organization issued a standard, RP0175-75, “Control of Internal Corrosion in Steel Pipelines and Piping Systems.” The purpose of this standard was to describe procedures and recommended practices for achieving effective control of internal corrosion in steel pipe and piping systems in crude oil, refined products, and gas service. RP0175-75 addressed methods for detecting and controlling internal corrosion and noted the importance of flow velocity analysis, periodic product sampling, and chemical analysis of corrosive constituents in mitigating corrosion. It also identified the beneficial effects of the use of cleaning pigs. RP0175-75 was intended to serve as a guide for establishing minimum requirements for control of internal corrosion in gas transmission, gas distribution, and other steel piping systems. Because the document had not been reviewed and renewed by NACE when it was due for periodic review, in 1995 the document was withdrawn and is available from NACE only as a historical document. NACE does not consider RP0175-75 to be an official and current NACE document. The Safety Board has been told by NACE representatives that the society is working on another standard similar to, and based on, RP0175-75. ASME Code for Gas Piping (B31.8)32 The American Society of Mechanical Engineers (ASME) code for gas piping addresses the safety aspects of the design, construction, operation, and maintenance of gas pipelines. Specific guidance for an internal corrosion control program for all existing pipelines is included. For pipelines that transport corrosive gas, design and construction considerations for new pipelines and modifications to existing pipelines are included. For design and construction, the considerations include (1) running cleaning pigs (including provisions for effective accumulation and handling of liquids and solids removed from the pipeline by the pigging), (2) installing corrosion monitoring devices (coupons, probes) at locations where the greatest potential for corrosion exists, (3) treating the gas to reduce its corrosivity, (4) selecting corrosion resistant materials for construction of the pipeline, (5) internally coating the pipeline, and (6) injecting corrosion inhibitors into the gas stream. 32 ASME B31.8-1999, Gas Transmission and Distribution Piping Systems, American Society of Mechanical Engineers; Chapter VI, paragraph 863. (Essentially identical wording has been part of ASME B31.8 since 1982.) On January 31, 2002, ASME issued a supplement to the B31.8 code entitled “Managing System Integrity of Gas Pipelines,” which includes guidance for determining whether internal corrosion may be a threat to pipeline integrity and measures to assess the condition of the pipeline at those locations.

Factual Information 36 Pipeline Accident Report For operations and maintenance, the considerations include (1) establishing a program for the detection, prevention, or mitigation of internal corrosion (including reviewing leak and repair records, inspecting the internal surface of the pipe whenever it becomes accessible, analyzing gas from areas of known internal corrosion to determine the types and concentrations of corrosive agents, analyzing liquids and solids removed from the pipeline by pigging, and draining or cleanup to determine the presence of corrosive materials and evidence of corrosion products), (2) controlling corrosion by modifying the pipeline to facilitate the removal of water from low spots, and (3) measuring the wall thickness of buried pipe when it is uncovered and of exposed pipe in areas where internal corrosion is suspected. Guide for Gas Transmission and Distribution Piping Systems33 The Gas Piping Technology Committee’s34 Guide for Gas Transmission and Distribution Piping Systems includes material intended to assist the user in complying with the Federal regulations.35 For internal corrosion, guidelines for design, detection, monitoring, and corrective measures are included. The guide states that in the presence of water, gases containing certain components such as CO2, H2S, and O2 can be corrosive to steel pipelines and that pipeline liquids may contain constituents that may be detrimental to pipeline integrity. The guide also states that if it is anticipated or has been determined that the gas to be transported is corrosive, the following should be considered: selection of special materials of construction, effect of flow velocities, fluid removal (pigging, drips that include access ports for internal inspection, separators), control of water dew point (by dehydration, separation, or temperature control), reduction of corrosive components in the gas, internal coating, and chemical treatments. For the detection of internal corrosion, considerations include sampling and analysis of gas, liquids, and solids; visual inspection of pipe and drips; use of corrosion monitoring devices (coupons, probes); and in-line inspection and other non-destructive inspection to determine wall thickness. Other Information Previous EPNG Internal Corrosion Accident On September 10, 1996, line 1300 ruptured near Roswell, New Mexico. The EPNG investigation determined that the pipe had failed from internal corrosion at a sag bend in the pipe. The accident report stated that: 33 ANSI GPTC Z380.1, Guide for Gas Transmission and Distribution Piping Systems, Gas Piping Technology Committee. 34 The Gas Piping Technology Committee is an independent consensus committee comprising representatives from the pipeline industry, including manufacturers, operators, and consultants, as well as from pipeline regulatory agencies. 35 The current guide is dated June 15, 1998, and includes Addendum No. 1, July 7, 1999; Addendum No. 2, August 23, 2000; and Addendum No. 3, January 29, 2002. The guide material for internal corrosion was most recently revised in Addendum 3.

Factual Information 37 Pipeline Accident Report it is impossible to tell when in time most of the corrosion at the rupture point occurred. However, it is certainly related to the settlement of liquids in a low spot, possibly during the period of low flows in the line for several years prior to its reversal in 1992. The source of liquids was probably one or more of the production facilities that provide (or provided) gas directly to the transmission line. Current analyses do not provide adequate information to determine the presence of potentially corrosive liquids in gas received, so other measures should be taken to prevent the introduction of liquids into the line. The metallurgy report, which was an attachment to EPNG’s final investigation report of the rupture, recommended that the quality of gas being injected into line 1300 near the rupture location and at other locations of concern be monitored to avoid another failure of this type. Also recommended were (1) that pigs be run near the failure location to clean any remaining liquid from the system, (2) that a sample of the pigging residue be analyzed to determine whether undesirable compounds were present, (3) that other areas of possible pipeline deflection be examined, and (4) that previously untested areas in the vicinity of the rupture be hydrostatically tested to ensure their structural integrity. In a Safety Board interview, a member of the EPNG pipeline safety staff stated that the company considered the failure of line 1300 to be an isolated event and that the recommendations in the investigation report were therefore applicable only to line 1300 because of unique operating conditions in the ruptured pipeline. These conditions included a producer that EPNG representatives said had been known to introduce water into the pipeline at a receipt point near the rupture location, as well as periods of low-flow and static conditions in line 1300, which resulted in gas flow rates insufficient to move or dissipate the moisture. Emergency Training and Simulations Annual meetings of emergency responders were conducted in November 1997, October 1998, October 1999, and October 2000 for the Carlsbad area, including Eddy County, emergency response and law enforcement agencies. At these meetings, EPNG personnel reiterated safety precautions at natural gas emergencies and, through written tests, quizzed emergency responders on safety issues. In November 1997, EPNG conducted an emergency response exercise for a leak on line 3191 between South Carlsbad compressor station and Pecos River compressor station. The Eddy County Sheriff’s Office was involved, as well as the Eddy County disaster coordinator. In August 1997, a leak was simulated at the Keystone compressor station to test the readiness of the compressor station personnel.

38 Pipeline Accident Report Analysis EPNG pipeline 1103 was operating at about 80 percent of the maximum allowable operating pressure when the pipeline ruptured. The rupture occurred at a place in the pipeline where internal corrosion had thinned the pipe wall. The fact that the fracture faces resulted from overstress separation with no evidence of fatigue cracking indicates that the rupture occurred as one catastrophic event. The Safety Board therefore concludes that line 1103 ruptured as a result of severe internal corrosion that caused a reduction in pipe wall thickness to the point that the remaining metal could no longer contain the pressure within the pipe. A number of factors were found to have contributed to the fact that the corrosion that led to the rupture had not been detected and mitigated by EPNG before the accident, and those factors are addressed in this analysis. The major safety issues identified during the investigation of this accident are as follows: • The design and construction of the pipeline, • The adequacy of EPNG’s internal corrosion control program, • The adequacy of Federal safety regulations for gas pipelines, and • The adequacy of Federal oversight of the pipeline operator. Exclusions The investigation determined that the operating pressure (675 psig) in the pipeline at the time of the rupture was below the maximum allowable operating pressure (837 psig) established for that section of the pipeline. Operation of the pipeline system was monitored by a SCADA system, and even though the gas controller’s understanding of the rapidly unfolding situation at the Pecos River compressor station immediately after the rupture was hampered by a brief interruption of data from the SCADA system and the subsequent loss of SCADA communications as a result of the power outage at the Pecos River compressor station, the controller accurately evaluated the available information and promptly initiated an appropriate response. There was no evidence of third-party damage to the pipeline at the rupture site, nor was there evidence of external corrosion at the rupture location. The Safety Board therefore concludes that the following were neither causal nor contributory to the accident or its aftermath: overpressure of the pipeline, the interruption in or loss of SCADA communication, external damage to the pipeline through excavation or other activities, and external corrosion of the pipeline.

39 Pipeline Accident Report Emergency Response EPNG employees, who were on the accident scene within 19 minutes of the rupture, worked quickly and effectively to stop the flow of natural gas from the ruptured pipeline and to extinguish the fire. Because they did not know which pipeline had ruptured, they began closing valves upstream and downstream of the fireball in all four EPNG natural gas pipelines. Emergency responders arrived on scene within 25 minutes of the rupture and staged at the Pecos River compressor station. The emergency responders anticipated a routine standby assignment that would terminate when the flow of natural gas was stopped and the fire self-extinguished. Because the accident was in a rural area, emergency responders did not expect to find any persons injured. However, approximately 40 minutes after the rupture and while attempting to reach valves to stop the flow of natural gas, an EPNG employee thought that he saw vehicles in the area of the fire and provided that information to another employee. About 15 minutes later, when the flow of natural gas was stopped and the fire was extinguished, the EPNG employee confirmed that he had seen vehicles in the area where the fire had been burning. This information was then passed on to emergency responders, who immediately initiated rescue efforts. Carlsbad Fire Department’s medic units had responded with the initial call and were staged at the compressor station. Paramedics and emergency medical technicians worked diligently to treat the injuries of victims and to hastily evacuate them to hospital burn centers in Texas. The Safety Board notes that the EPNG employees who initially had information that vehicles may be parked in the vicinity of the fire did not notify emergency responders until the fire was extinguished and the presence of vehicles was confirmed. In order for emergency responders to make informed decisions about rescue efforts, it is important that they be given information, as quickly as it is available, that could indicate the possibility of victims in the vicinity of an accident. In this case, because of the intensity of the fire in the vicinity of the campsite, the radiant heat associated with the fire, and the difficulty that response crews would have faced gaining access to the area while the fire was burning, the Safety Board does not believe the outcome of the accident would have been different if responders had been notified sooner, although the precise effect such notification would have had on responders’ decision-making cannot be determined. Internal Corrosion in Steel Gas Pipelines Corrosion on the internal wall of a natural gas pipeline can occur when the pipe wall is exposed to water and contaminants in the gas, such as O2, H2S, CO2, or chlorides. The nature and extent of the corrosion damage that may occur are functions of the concentration and particular combinations of these various corrosive constituents within the pipe, as well as of the operating conditions of the pipeline. For example, gas velocity and temperature in the pipeline play a significant role in determining if and where corrosion damage may occur. In other words, a particular gas composition may cause corrosion under some operating conditions but not others. Therefore, it would be difficult

Analysis 40 Pipeline Accident Report to develop a precise definition of the term “corrosive gas” that would be universally applicable under all operating conditions. Corrosion may also be caused or facilitated by the activity of microorganisms living on the pipe wall. Referred to as microbiologically influenced corrosion, or MIC, this type of corrosion can occur when microbes and nutrients are available and where water, corrosion products, deposits, etc., present on the pipe wall provide sites favorable for the colonization of microbes. Microbial activity, in turn, may create concentration cells or produce organic acids or acid-producing gases, making the environment aggressive for carbon steel. The microbes can also metabolize sulfur or sulfur compounds to produce products that are corrosive to steel or that otherwise accelerate the attack on steel. Internal corrosion in a gas pipeline may be detected by any of several methods, including visual examination of the inside of a pipeline when it is opened, external measurement of the pipe wall thickness with instruments, evaluation of corrosion coupons or probes placed inside the pipeline, or inspection of the pipe with an in-line inspection tool to identify areas of pitting or metal loss. Internal corrosion may be kept under control by establishing appropriate pipeline operating conditions and by using corrosion-mitigation techniques. One method for reducing the potential for internal corrosion to occur is to control the quality of gas entering the pipeline. Also, by periodically sampling and analyzing the gas, liquids, and solids removed from the pipeline to detect the presence and concentration of any corrosive contaminants, including bacteria, as well as to detect evidence of corrosion products, a pipeline operator can determine if detrimental corrosion may be occurring, identify the cause(s) of the corrosion, and develop corrosion control measures. Internal Corrosion in Line 1103 Interconnecting pits were observed on the inside of the pipe in the ruptured area of line 1103. Typically, these pits showed the striations and undercutting features that are often associated with microbial corrosion. A pit profile showed that chloride concentration in the pits increased steadily from top to bottom. Increased chloride concentration can result from certain types of microbial activity. All four types of microbes (sulfate- reducing, acid-producing, general aerobic, and anaerobic) were observed in samples collected from two pit areas in the piece of line 1103 where internal corrosion was discovered after the accident about 2,080 feet downstream of the rupture site. Though the individual contribution of various microbes in the corrosion process could not be estimated, the damage morphology and the corrosion product analyses data suggest that microbiological activity contributed to the corrosion process. Dissolved O2 in an electrolyte could cause pitting by creating concentration cells. CO2 is soluble in water and will form carbonic acid, which is corrosive to carbon steel.

Analysis 41 Pipeline Accident Report When dissolved in water, H2S forms a weak acid that could corrode carbon steel. In combination with dissolved O2, it could cause pitting. Though generally present in low concentrations, these potentially corrosive constituents were present in the gas that was being transported in line 1103. Also, upset conditions occasionally increased the concentrations of these constituents in the transported gas. Chlorides were observed in all corrosion product/deposit samples. Anions, such as chloride, cause pitting and, typically, chloride concentration in a pit may be much higher than the chloride concentration outside the pit (bulk concentration). Chemical analyses showed that the pH (6.7-6.8) of the liquid collected at the Pecos River compressor station plant inlet separator scrubber was more acidic than the pH (8.2) of the liquid collected at Keystone compressor station inlet scrubber. Also, the material collected at line 1100 and 1103 pig receivers (pH ~ 6.2-6.3) and the inside material collected from a low spot on line 1103 west of the rupture (pH ~ 6.4) were more acidic than the material collected near the siphon drain area of the line 1103 drip (pH ~ 8.9). The observed low pH in the samples could be a result of dissolved CO2, and/or H2S in the water, and/or intrusion of low-pH ground water into the gas supply. Typically, acidic (pH7). Thus, water and contaminants such as chlorides, O2, CO2, and H2S all likely contributed to the observed corrosion damage. The Safety Board therefore concludes that the corrosion that was found in line 1103 at the rupture site was likely caused by a combination within the pipeline of microbes and such contaminants as moisture, chlorides, O2, CO2, and H2S. Physical Features of Line 1103 Examination of the pipe at the rupture location revealed five wrinkles in the pipe wall at the top of the pipeline. Wrinkles in the wall of a pipe occur when a pipe is bent, either to align pieces of pipe during construction or from external forces, such as earth movement, after the pipeline is in service. When pipe is bent and wrinkles form on the top of the pipe, a low point is created at the bottom of the pipe opposite the wrinkles. The observed internal corrosion in the pipeline at the rupture location was at such a low point, where liquids likely accumulated into a pool with a fluctuating liquid level. Because the density of water is greater than that of hydrocarbon liquids present in the pipeline, water in the pipeline would remain at the bottom of the pool with the liquid hydrocarbons on top, creating an ideal environment for the development of internal corrosion. The original construction of line 1103 by EPNG included a block valve and drip approximately 1 mile east of the Pecos River. The block valve, designated No. 6, was on a hill about 62 feet higher than the Pecos River. The valve may have been positioned thus so that it would remain accessible and not be damaged if the river flooded. The underground drip was placed downstream of the block valve and was 31 feet lower in elevation than the pipeline at block valve No. 6. This configuration facilitated the trapping of liquids and

Analysis 42 Pipeline Accident Report solids flowing in line 1103 toward the Pecos River compressor station by the drip, which was upstream of the rupture location. When pigging facilities were added to line 1103 about 25 years after initial construction, a pig launcher was installed at block valve No. 2, and a pig receiver was placed at block valve No. 6. A separate storage leg or tank to collect the pig liquids at block valve No. 6 was not installed. Instead, during pigging operations, the pig and some of the liquids and solids being pushed by the pig would be caught in the pig receiver at block valve No. 6. Any material that passed the pig receiver, either during normal operations or because of a pig run, would flow downstream and downhill to the drip. Postaccident visual examination of the drip revealed that, at one point, about 70 percent of the drip cross-section was filled with the blackish oily-powdery/grainy material that acted as a dam inside the drip, preventing some of the materials entering the drip from continuing to the far end of the barrel to the siphon drain. This blockage also likely contributed to movement of liquids and solids past the drip. Materials flowing past the drip could then collect at low points in the downstream pipeline, such as the low point at the rupture location, where they would remain until gas flow of sufficient velocity was available to sweep the liquids farther downstream toward the inlet scrubbers at the Pecos River compressor station. Velocity data provided by EPNG for the period 1991 to 2000 indicated numerous periods when the gas velocity was substantially below the preferred sweeping velocity of 25 feet per second. The Safety Board concludes that, as a likely result of the partial clogging of the drip upstream of the rupture location, some liquids bypassed the drip, continued through the pipeline, and accumulated and caused corrosion at the eventual rupture site where pipe bending had created a low point in the pipeline. Periodic use of cleaning pigs can remove water and other liquid and solid contaminants from a pipeline. One of the considerations for the design and construction of a cleaning pig system is to make provisions for effective collection and removal of the accumulated materials from the pipeline after pigging. In line 1103, because of the configuration of the piping and valves at block valve No. 6 and the geometry of the drip, cleaning pigs could not be run in the section of pipeline that ruptured. Some of the liquids and solids that accumulated in front of the cleaning pig were returned to the pipeline and moved downstream by the flowing gas toward the drip. In conjunction with the partially clogged drip, and the introduction of additional liquids into line 1103 from the crossover from line 1100 (from which the drip had been removed) upstream of the line 1103 drip, it is likely that there was incomplete removal of accumulated liquids and solids from line 1103. Postaccident in-line inspection of the segment of line 1103 in which cleaning pigs had been periodically run (from block valve No. 2 to block valve No. 6) found no areas of internal corrosion that the company determined required repair. The Safety Board therefore concludes that if the accident section of pipeline 1103 had been able to accommodate cleaning pigs, and if cleaning pigs had been used regularly with the resulting liquids and solids thoroughly removed from the pipeline after each pig run, the

Analysis 43 Pipeline Accident Report internal corrosion that developed in this section of pipe would likely have been less severe. The ASME code for gas piping (ASME B31.8, Gas Transmission and Distribution Piping Systems) and the Guide for Gas Transmission and Distribution Piping Systems include design and construction considerations related to internal corrosion control for new pipelines and modifications to existing pipelines. Although some operators may incorporate these considerations or have their own engineering standards for the design and construction of pipelines to minimize liquid accumulation and to remove liquids from a pipeline, there are no Federal regulatory requirements applicable to all operators. The Safety Board believes that RSPA should revise 49 CFR Part 192 to require that new or replaced pipelines be designed and constructed with features to mitigate internal corrosion. At a minimum, such pipelines should (1) be configured to minimize the accumulation of liquids, (2) be equipped with effective liquid removal features, and (3) be able to accommodate corrosion monitoring devices at locations with the greatest potential for internal corrosion. EPNG Internal Corrosion Control Program At the time of the accident, EPNG was beginning the process of implementing an internal corrosion control program based on the new procedures dated May 15, 2000, and July 10, 2000. However, training of personnel in the new procedures began in August 2000, and the new corrosion control actions specified in these documents had yet to be fully implemented at the time of the accident. As a result, the program actually in place was the one specified in the September 20, 1999, operating and maintenance procedures manual. This written program required (1) that the corrosion services department, after being notified that corrosive gas was being transported or if internal corrosion was found, recommend appropriate corrective actions and establish an internal corrosion monitoring program to determine the effectiveness of the corrective actions, and (2) that a visual inspection he made of the inside of a pipeline when opened. These procedures did not address the specific operating conditions, such as water in the pipeline, corrosive contaminants in the gas and liquid, and velocity of the gas, that should be considered when evaluating a pipeline for possible internal corrosion. The company’s gas quality standard addressed several contaminants, including water, CO2, H2S, and O2, but the corrosion control procedures did not reference these contaminants or their acceptable limits. Although gas quality standards were contained in EPNG’s contracts with gas suppliers, most of the interconnect locations with gas producers on line 1103 (between the Pecos River compressor station and the Keystone compressor station) and line 1100 (between Eunice plant and the Keystone compressor station, from which gas and liquids could enter line 1103 upstream of the drip) did not have alarms (which alarmed in the gas control center if contaminant levels were exceeded), and other locations only had periodic sampling and analysis of the gas entering the EPNG pipeline. Thus, despite the fact that EPNG officials said they relied partially on maintaining the quality of gas to

Analysis 44 Pipeline Accident Report help prevent corrosion, the company did not take the steps necessary to allow it to adequately monitor and control the quality of gas entering the pipeline. The 1999 procedures did not provide guidance regarding how internal corrosion would be detected other than through visual inspection of a pipe segment after it had been opened. Nor did the procedures require that, during normal operations, pigging, or maintenance activities, liquids and solids be removed from the pipeline and tested for the presence of corrosive materials or evidence of corrosion products. The ASME B31.8 code identifies the importance of determining whether gas is corrosive by requiring that “Gas containing free water under the conditions at which it will be transported shall be assumed to be corrosive, unless proven to be non-corrosive by recognized tests or experience.” Very little useful information concerning what was entering the pipeline, where it was entering, and what materials were accumulating in the pipeline was available to corrosion control personnel. As a result, EPNG corrosion control personnel stated that they were not aware that corrosion could be occurring in the company’s pipeline or that corrosion mitigation measures might be necessary. In the event it was determined that corrosive gas was being transported or internal corrosion was occurring, corrosion mitigation actions would be recommended by the corrosion services department. However, there were no written requirements for corrosion technicians to follow up on reports of out-of-specification gas being received or to identify the effect, if any, of this gas on the pipeline, and there were no standards or criteria to be used to determine if out-of-specification gas was potentially corrosive. The procedures did not detail how the semi-annual monitoring to determine the effectiveness of the corrosion mitigation measures would be carried out. Corrosion monitoring devices were not used in line 1103 between the Keystone and Pecos River stations because the gas was not believed to be corrosive. In September 1996, EPNG’s line 1300 ruptured as a result of internal corrosion. The metallurgy report attached to EPNG’s final investigation report of the rupture recommended expanded gas quality monitoring and additional pigging, with collected residue being analyzed for undesirable components. Because the company considered this rupture to be an isolated event, it did not implement the recommendations for its other, similar, gas transmission lines. Further, according to a senior safety staff employee at EPNG, the company’s internal audit program was not revised after the September 1996 rupture of line 1300 from internal corrosion. Revising the company’s audit program to include inquiries regarding operating conditions (gas velocity, gas producers connected to a transmission pipeline, unpigged pipelines whose configuration could lead to accumulation of liquids in low spots) would have helped EPNG to determine if similar conditions existed in other pipelines, but the company did not do so. In the years leading up to the accident, EPNG had access to industry standards and guidelines, such as those contained in the NACE standards, the ASME code, and the Guide for Gas Transmission and Distribution Piping Systems, regarding the detection and control of internal pipeline corrosion. But the company did not incorporate that guidance in its internal corrosion procedures. Nor did the company take the steps necessary to ensure that the limited procedures that it did have in place were effective. For example,

Analysis 45 Pipeline Accident Report while the procedures in place at the time of the accident stated that corrosion control personnel were to be notified if corrosive gas was being transported, the company did not, as noted above, carry out the gas quality monitoring or inspection activities necessary to make an accurate determination of the corrosivity of the gas. Also, the procedures required that corrosion control personnel be notified if corrosion was found, but the company had no systematic program to detect possible internal corrosion. Internal inspection devices or corrosion coupons that could have detected existing or potential corrosion were not regularly employed. In the view of the Safety Board, the preaccident approach of EPNG in regard to internal corrosion indicates that the company did not believe internal corrosion to be a significant issue in the safety of its pipeline operations. As a result, the company was inadequately attentive to the potential for severe internal corrosion to occur, with the result that the corrosion that led to the rupture of line 1103 was not detected and mitigated in time to prevent a serious accident. The Safety Board therefore concludes that, before the accident, EPNG did not have in place an internal corrosion control program that was adequate to identify or mitigate the internal corrosion that was occurring in its pipelines. After the acquisition of Sonat in January 2000, which had been preceded by the acquisition of Tenneco Energy in December 1996, El Paso Energy organized teams of representatives from each pipeline to determine best practices and produce a new operating and maintenance manual. The resulting Operating and Maintenance Procedures manual was issued on May 15, 2000, followed by a Corrosion Control Manual on July 10,

1. These procedures were applicable to El Paso Energy’s gas pipeline companies and

were the approved procedures at the time of the accident in August 2000. For Tenneco Energy, the internal corrosion procedures in use at the time of the December 1996 acquisition by EPNG were in the company’s Operating and Maintenance Manual. The procedure for internal corrosion detection and control was dated December 1, 1993, and included a requirement to test gas and liquids being transported to determine if they are corrosive. A Corrosion Control Manual dated February 1, 1997 supplemented the internal corrosion control procedures in the Operating and Maintenance Manual with additional, detailed internal corrosion control considerations and measures. Even though EPNG had access to Tenneco’s procedures after the acquisition, it took an additional 41 months, from December 1996 to May 2000, for El Paso Energy to develop and issue internal corrosion control procedures applicable to EPNG that included requirements for testing pipeline gas and liquids to determine if they are corrosive. It was an additional 2 months, from May 15 to July 10, 2000, before the supplemental, detailed internal corrosion control procedures were issued describing what to test for, where to test, and how often to test. The program being implemented at the time of the accident was based on EPNG’s Corrosion Control Manual, Section 700, dated July 10, 2000 (subsequently revised January 15, 2001, revised October 1, 2001, and redesignated Section 6 and revised December 19, 2001). The program recognized that gas quality standards alone are insufficient to determine whether a pipeline is transporting corrosive gas. These procedures state that the first line of defense against internal corrosion is gas and liquid

Analysis 46 Pipeline Accident Report quality standards but that whether a pipeline transports corrosive gas cannot be determined from the standards themselves. Also noted in the documents is that industry experience has shown that water and other corrosives may enter the pipeline by accident or by operational upsets or that it may slowly accumulate in low spots despite gas quality monitoring that shows adherence to quality standards. The procedures state that “identification of corrosive gas in a pipeline is achieved by analysis of operating conditions, gas impurity content, monitoring data, mitigation schemes, and/or other considerations” and that “an effective internal corrosion-monitoring program includes sampling and analysis of liquid, gas, and solid materials.” After the accident, the Safety Board’s analysis of the liquids and solids from the pipeline determined that potentially corrosive constituents such as water, chlorides, and bacteria were present in the pipeline. The Safety Board concludes that had EPNG effectively monitored the quality of gas entering the pipeline and the operating conditions in pipeline 1103 and periodically sampled and analyzed the liquids and solids that were removed from the line, it would likely have determined that the potential existed for significant corrosion to occur within the pipeline. Federal Safety Regulations Federal regulations for gas pipelines include two sections that have requirements for an internal corrosion control program and one section that requires that the procedures for the program be included in the operator’s operating and maintenance manual. The regulations do not define “corrosive gas” but do state that such gas may not be transported by pipeline unless its effect on the pipeline has been investigated and steps have been taken to minimize internal corrosion. For internal corrosion to occur, water must typically be present in the pipeline, along with corrosive contaminants such as chlorides, H2S, CO2, O2, or bacteria. The regulations do not specifically address microbiologically influenced corrosion or the way that water and contaminants in the pipeline can combine to contribute to the corrosion process. The regulations also do not specifically address the importance of the following: minimizing liquids and liquid accumulation in the pipeline, removing liquids from the pipeline, maintaining drips, and the role of gas velocity in corrosion control. Because the Federal regulations do not specifically address the above issues, the Safety Board concludes that the current Federal pipeline safety regulations do not provide adequate guidance to pipeline operators or enforcement personnel in mitigating pipeline internal corrosion. The Safety Board therefore believes that RSPA should develop the requirements necessary to ensure that pipeline operators’ internal corrosion control programs address the role of water and other contaminants in the corrosion process. Federal Oversight of the Pipeline Operator On May 15, 2000, EPNG issued revised operating and maintenance procedures for internal corrosion control. For each of the six OPS safety inspections of EPNG conducted

Analysis 47 Pipeline Accident Report between May 15 and September 25, 2000, compliance with the Federal regulations for internal corrosion control was noted by the inspectors as “satisfactory.” After the accident, however, the OPS cited EPNG for a number of probable violations related to its internal corrosion program. For example, in its June 20, 2001, notice of probable violation, the OPS stated that EPNG’s internal corrosion control program was not carried out by, or under the direction of, a person qualified in pipeline corrosion control methods. But in each of the six inspections between May 15 and September 25, 2000, OPS inspectors had noted that the company’s program was “…under the direction of a qualified person, with associated records….” In several cases, the inspector included on the form a brief description of the qualifications of EPNG’s principal coordinator of corrosion services. At no time did the OPS inspection process, even under the system integrity inspection pilot program, indicate a personnel qualification issue with EPNG’s corrosion program. The postaccident notice of probable violation also cited EPNG for not following its own procedures and sound engineering practice by not performing corrosiveness tests on the liquids and solids that were removed from lines 1103 and 1110 after pigging operations. But at no time during the inspections conducted before September 2000 did the OPS indicate that such testing of liquids and solids was required or that it was sound engineering practice. In addition, the notice of probable violation stated that EPNG’s elevation profile drawings for its pipelines in the area of the Pecos River were incomplete. Specifically, the notice stated that the drawings did not show any elevation profile for line 1103 between block valve No. 6 and the Pecos River compressor station. Therefore, according to the OPS, EPNG did not know the location of low points in the pipeline where liquids could accumulate and thus could not take certain corrosion control steps that could possibly have prevented the accident. However, during none of the six inspections between May and September 2000 did the OPS indicate that profile drawings of pipelines were required or that there were any other compliance or safety issues with the pipeline maps. Further, in April 2000, the OPS conducted a team review of EPNG’s operating and maintenance procedures as part of the system integrity inspection pilot program. No deficiencies in the procedures were identified in this inspection, and the OPS did not require any follow-up actions by EPNG to correct compliance and safety problems. But only four questions related to an internal corrosion control program (coupon monitoring and records and corrosion remedial measures and records) were included on the inspection form. The inspection form did not inquire into the four components of an effective internal corrosion control program identified in the regulations (determining whether corrosive gas is being transported, inspection of pipe removed from a pipeline, qualification of internal corrosion control personnel, and qualification of the person directing the internal corrosion control program). Thus, because its inspections did not seek information from the operator in these four areas, the OPS did not have sufficient basis for evaluating EPNG’s compliance with the Federal regulations for internal corrosion control. Throughout the inspections conducted by the OPS to qualify EPNG for the system integrity inspection pilot program, OPS inspection reports documented that EPNG’s internal audit program was working as designed. However, the procedures and forms used

Analysis 48 Pipeline Accident Report by EPNG for its internal audits only addressed actions to be taken after it had been determined that corrosive gas was being transported. Not addressed in either the EPNG procedures or forms reviewed by the OPS was how to determine if corrosive gas was being transported. Thus, although the program was functioning, the internal audit program was not adequate to uncover potential deficiencies in the company’s internal corrosion control program. Federal inspections of a pipeline operator should provide the operator with accurate feedback and the opportunity for immediate, constructive dialog with the OPS. In addition, the OPS uses data obtained during field inspections to assess the effectiveness of its regulations and identify issues of operator noncompliance. But in this case, the OPS postaccident investigation documented deficiencies in EPNG operations that it had not previously identified. Had the preaccident inspections applied the enforcement criteria in the same manner as they were interpreted after the accident, EPNG may have been prompted to correct deficiencies in its programs. The Safety Board concludes that the OPS did not make accurate preaccident assessments of EPNG’s internal corrosion program and therefore did not identify deficiencies in the program before the accident. The Safety Board therefore believes that RSPA should evaluate the OPS’s pipeline operator inspection program to identify deficiencies that resulted in the failure of inspectors, before the Carlsbad, New Mexico, accident, to identify the inadequacies in EPNG’s internal corrosion control program. The Safety Board further believes that RSPA should implement the changes necessary to ensure adequate assessments of pipeline operator safety programs. Industry Standards As shown by this accident, pipeline failure due to internal corrosion can have serious consequences and, in the view of the Safety Board, industry standards and recommended practices such as NACE RP0175-75, “Control of Internal Corrosion In Steel Pipelines and Piping Systems,” can be of significant benefit to pipeline operators. The Safety Board is concerned that, because RP0175-75 is not considered current and may contain outdated information, pipeline operators may not have easy access to information that could contribute significantly to the establishment of an effective internal corrosion control program. Even though the Safety Board has been told by NACE representatives that the society is working on a new standard to replace RP0175-75, no timetable has been given for the completion of this effort. The Safety Board believes that NACE International should establish an accelerated schedule for completion of an industry standard for the control of internal corrosion in steel pipelines that will replace or update NACE standard RP0175-75.

49 Pipeline Accident Report Conclusions Findings 1. The following were neither causal nor contributory to the accident or its aftermath: overpressure of the pipeline, the interruption in or loss of supervisory control and data acquisition system communication, external damage to the pipeline through excavation or other activities, and external corrosion of the pipeline. 2. Line 1103 ruptured as a result of severe internal corrosion that caused a reduction in pipe wall thickness to the point that the remaining metal could no longer contain the pressure within the pipe. 3. The corrosion that was found in line 1103 at the rupture site was likely caused by a combination within the pipeline of microbes and such contaminants as moisture, chlorides, oxygen, carbon dioxide, and hydrogen sulfide. 4. If the accident section of pipeline 1103 had been able to accommodate cleaning pigs, and if cleaning pigs had been used regularly with the resulting liquids and solids thoroughly removed from the pipeline after each pig run, the internal corrosion that developed in this section of pipe would likely have been less severe. 5. As a likely result of the partial clogging of the “drip” upstream of the rupture location, some liquids bypassed the drip, continued through the pipeline, and accumulated and caused corrosion at the eventual rupture site where pipe bending had created a low point in the pipeline. 6. Had El Paso Natural Gas Company effectively monitored the quality of gas entering the pipeline and the operating conditions in pipeline 1103 and periodically sampled and analyzed the liquids and solids that were removed from the line, it would likely have determined that the potential existed for significant corrosion to occur within the pipeline. 7. Before the accident, El Paso Natural Gas Company did not have in place an internal corrosion control program that was adequate to identify or mitigate the internal corrosion that was occurring in its pipelines. 8. The current Federal pipeline safety regulations do not provide adequate guidance to pipeline operators or enforcement personnel in mitigating pipeline internal corrosion. 9. The Office of Pipeline Safety did not make accurate preaccident assessments of El Paso Natural Gas Company’s internal corrosion control program and therefore did not identify deficiencies in the program before the accident.

Conclusions 50 Pipeline Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the August 19, 2000, natural gas pipeline rupture and subsequent fire near Carlsbad, New Mexico, was a significant reduction in pipe wall thickness due to severe internal corrosion. The severe corrosion had occurred because El Paso Natural Gas Company’s corrosion control program failed to prevent, detect, or control internal corrosion within the company’s pipeline. Contributing to the accident were ineffective Federal preaccident inspections of El Paso Natural Gas Company that did not identify deficiencies in the company’s internal corrosion control program.

51 Pipeline Accident Report Recommendations As a result of its investigation of the August 19, 2000, pipeline rupture and subsequent fire near Carlsbad, New Mexico, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Revise 49 Code of Federal Regulations Part 192 to require that new or replaced pipelines be designed and constructed with features to mitigate internal corrosion. At a minimum, such pipelines should (1) be configured to reduce the opportunity for liquids to accumulate, (2) be equipped with effective liquid removal features, and (3) be able to accommodate corrosion monitoring devices at locations with the greatest potential for internal corrosion. (P-03-1) Develop the requirements necessary to ensure that pipeline operators’ internal corrosion control programs address the role of water and other contaminants in the corrosion process. (P-03-2) Evaluate the Office of Pipeline Safety’s pipeline operator inspection program to identify deficiencies that resulted in the failure of inspectors, before the Carlsbad, New Mexico, accident, to identify the inadequacies in El Paso Natural Gas Company’s internal corrosion control program. Implement the changes necessary to ensure adequate assessments of pipeline operator safety programs. (P-03-3) To NACE International: Establish an accelerated schedule for completion of an industry standard for the control of internal corrosion in steel pipelines that will replace or update NACE standard RP0175-75. (P-03-4) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JOHN A. HAMMERSCHMIDT JOHN J. GOGLIA Acting Chairman Member CAROL J. CARMODY Member Adopted: February 11, 2003

this page intentionally left blank

53 Pipeline Accident Report Appendix A Investigation The National Transportation Safety Board was notified on August 19, 2000, through the National Response Center, of a pipeline explosion and fire south of Carlsbad, New Mexico. The Safety Board dispatched an investigative team from its Washington, D.C., headquarters. The team comprised investigative groups in pipeline operations, corrosion, survival factors, and family assistance. Board Members John Hammerschmidt and Carol Carmody accompanied the investigative team. Then-Chairman Jim Hall was also at the accident site during the on-scene portion of the investigation. No hearings or depositions were held in conjunction with the investigation. Representatives from El Paso Natural Gas Company and the Office of Pipeline Safety participated in the investigation.

54 Pipeline Accident Report Appendix B Summary of Office of Pipeline Safety Corrective Action Order On August 23, 2000, the Office of Pipeline Safety issued a corrective action order requiring EPNG to take the necessary corrective actions to protect the public and environment from potential hazards associated with its pipeline operations. The corrective action order listed 25 required corrective action items, summarized as follows: Line 1110 between block valve No. 6 and the Pecos River compressor station: • Utilizing x-ray and ultrasonic examination techniques, assess the integrity of the pipeline at all locations that may have a no-flow condition or where liquids may accumulate, and implement corrective actions; • Hydrostatically test the pipeline to at least 90 percent SMYS; • Prepare status reports and summary of findings and submit to RSPA; • After return to service plan is approved by RSPA, restrict the operating pressure to 538 psig (80 percent of actual pressure at the time of the failure); maintain pressure restriction until released by OPS. Line 1103 between block valve No. 6 and the Pecos River compressor station: • Remain out of service until additional information about the rupture is reviewed. Line 1100 between station 2482+52 (6.1 miles upstream of block valve No. 6) and the Pecos River compressor station: • Utilizing x-ray and ultrasonic examination techniques, assess the integrity of the pipeline at all locations that may have a no-flow condition or where liquids may accumulate, and implement corrective actions; • Obtain OPS approval for the design of the temporary crossing of the Pecos River; • Hydrostatically test the pipeline to at least 90 percent SMYS; • Prepare status reports and summary of findings and submit to RSPA; • After return to service plan is approved by RSPA, restrict the operating pressure to 538 psig (80 percent of actual pressure at the time of the failure); maintain pressure restriction until released by OPS.

Appendix B 55 Pipeline Accident Report Lines 1103 and 1110 between Keystone Compressor Station and Guadalupe Compressor Station, and Line 1100 between Eunice plant and Gaudalupe Compressor Station: • Restrict operating pressure to 668 psig (80 percent of MAOP) until released by RSPA; • Develop a risk-based plan to inspect for indications of internal corrosion and assess and correct (1) areas in the pipeline that cannot be inspected with an internal inspection tool, (2) areas that may have a no-flow condition, and (3) areas where liquids may accumulate; • Provide RSPA with an analysis of the continued safe operation of lines 1100, 1103, and 1110. All pipelines operated by EPNG: • Obtain OPS approval of corrective action plans, which must describe the criteria for evaluating corroded areas and the criteria used to select the corrective action; • Complete the submission of EPNG’s pipeline system information to the National Pipeline Mapping System; • Obtain OPS approval for design of the permanent crossings of the Pecos River; • Develop a risk-based plan to inspect for indications of internal corrosion and assess and correct (1) areas in the pipeline that cannot be inspected with an internal inspection tool, (2) areas that may have a no-flow condition, and (3) areas where liquids may accumulate.

56 Pipeline Accident Report Appendix C Research and Special Programs Administration Advisory Bulletin On August 29, 2000, the Research and Special Programs Administration issued Advisory Bulletin ADB-00-02 to all operators of natural gas transmission pipelines: DEPARTMENT OF TRANSPORTATION Research and Special Programs Administration

1. Pipeline Safety: Internal Corrosion in Gas Transmission Pipelines

AGENCY: Research and Special Programs Administration (RSPA), DOT ACTION: Notice; issuance of advisory bulletin. SUMMARY: The Office of Pipeline Safety (OPS) is issuing this bulletin to owners and operators of natural gas transmission pipeline systems to advise them to review their internal corrosion programs. Operators should consider factors that influence the formation of internal corrosion, including gas quality and operating parameters. Operators should give special attention to pipeline alignment features that may contribute to internal corrosion by allowing condensates to settle out of the gas stream. This action follows a review of incidents involving internal corrosion, some of which resulted in loss of life, injuries, and significant property damage. OPS’ preliminary investigation of a recent gas transmission pipeline incident found wall thinning on damaged pipe associated with the incident. The wall thinning is consistent with that caused by internal corrosion. SUPPLEMENTARY INFORMATION: I. Background Internal corrosion control in gas transmission pipelines is addressed in the Federal pipeline safety regulations at 49 CFR 192.475 and 192.477. Internal corrosion is most often found in gas transmission pipelines and appurtenances in the vicinity of production and gathering facilities or storage fields. An OPS review of incident reports and inspections indicated that better industry guidance is needed to determine the best practices for monitoring the potential for internal corrosion in gas transmission pipelines. Some methods for monitoring internal corrosion are weight loss coupons, radiography, water chemistry tests, in-line inspection tools, and electrical, galvanic, resistance, and hydrogen probes. Operators should refer to available recommended practices provided by national consensus standards organizations, such as the American Petroleum Institute, the National Association of Corrosion Engineers, and

Appendix C 57 Pipeline Accident Report the Gas Piping Technology Committee (GPTC) for guidance in addressing internal corrosion issues. OPS has worked with GPTC to revise the Guide for Gas Transmission and Distribution Piping Systems (Guide) to better address the control of internal corrosion. GPTC is considering modifying the Guide to address design considerations, corrective measures and detection techniques for internal corrosion. II. Advisory Bulletin August 29, 2000 To: Owners and Operators of Gas Transmission Pipelines. Subject: Internal Corrosion in Gas Transmission Pipelines. Purpose: To advise owners and operators of natural gas transmission pipelines of the need to review their internal corrosion monitoring programs and operations. Advisory: Owners and operators of natural gas transmission pipelines should review their internal corrosion monitoring programs and consider factors that influence the formation of internal corrosion, including gas quality and operating parameters. Operators should give special attention to pipeline alignment features that may contribute to internal corrosion by allowing condensates to settle out of the gas stream. This action follows a review of incidents involving internal corrosion, some of which resulted in loss of life, injuries, and significant property damage. OPS’ preliminary investigation of a recent gas transmission pipeline incident found internal wall thinning on damaged pipe associated with the incident. The wall thinning is consistent with that caused by internal corrosion. Gas transmission owners and operators should thoroughly review their internal corrosion management programs and operations: Review procedures for testing to determine the existence or severity of internal corrosion associated with their pipelines. Some methods for monitoring internal corrosion are weight loss coupons, radiography, water chemistry tests, in-line inspection tools, and electrical, galvanic, resistance and hydrogen probes. Special attention should be given to specific conditions, including flow characteristics, pipeline location (especially drips, deadlegs, and sags, which are on-line segments that are not cleaned by pigging or other methods, fittings and/or “stabbed” connections which could affect gas flow), operating temperature and pressure, water content, carbon dioxide and hydrogen sulfide content, carbon dioxide partial pressure, presence of oxygen and/or bacteria, and sediment deposits. Review conditions in pipeline segments downstream of gas production and storage fields. Review conditions in pipeline segments with low spots, sharp bends, sudden diameter changes, and fittings that restrict flow or velocity. These features can contribute to the formation of internal corrosion by allowing condensates to settle out of the gas stream.

this page intentionally left blank

FD07230 ｜ 2000_美国_RAR0001.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2000 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

F PB2000-916301 NTSB/RAR-00/01 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT DERAILMENT OF BURLINGTON NORTHERN AND SANTA FE RAILWAY COMPANY INTERMODAL FREIGHT TRAIN S-CHILAC1-31, CRISFIELD, KANSAS SEPTEMBER 2, 1998 7271

this page intentionally left blank

Railroad Accident Report Derailment of Burlington Northern and Santa Fe Railway Company Intermodal Freight Train S-CHILAC1-31, Crisfield, Kansas September 2, 1998 NTSB/RAR-00/01 PB2000-916301 National Transportation Safety Board Notation 7271 490 L’Enfant Plaza, S.W. Adopted July 17, 2000 Washington, D.C. 20594 E P L U R IB U S U N U M N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

National Transportation Safety Board. 2000. Derailment of Burlington Northern and Santa Fe Railway Company Intermodal Freight Train S-CHILAC1-31, Crisfield, Kansas, September 2, 1998. Railroad Accident Report NTSB/RAR-00/01. Washington, DC. Abstract: About 6:10 a.m., central daylight time, on September 2, 1998, the 17th through 19th cars and the first two platforms of the five-platform 20th car of westbound Burlington Northern and Santa Fe Railway Company intermodal freight train S-CHILAC1-31 derailed at Crisfield, Kansas. The derailment resulted in a pileup involving four articulated multiplatform cars carrying intermodal shipping containers. Some of the containers were breached, resulting in the release of hazardous materials and fires. About 200 people were evacuated, but no injuries resulted from either the derailment or the hazardous materials releases. Estimated damage was $1.3 million. The safety issues addressed in the report include the adequacy of intermodal container loading and securement standards for the preloading inspection of double-stack cars and the adequacy of railroad industry training and practices with respect to emphasizing the importance of removing foreign objects from the wells of double-stack cars before loading. As a result of its investigation of this accident, the National Transportation Safety Board makes recommendations to the Federal Railroad Administration, to the Class I railroads, and to the Association of American Railroads. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2000-916301 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

iii Railroad Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Derailment and Initial Crew Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Release of Hazardous Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Train Crew Rest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Track and Signal Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 DTTX 72318 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Postaccident Examination of DTTX 72318 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Movement and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Maintenance and Repair History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Event Recorder Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Weld Failures for Thrall 125-Ton Double-Stack Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Floor Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Weld Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Remedial Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Standards and Training for Intermodal Container Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Intermodal Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 AAR Committee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Board and AAR Action on Intermodal Inspection and Securement Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 FRA Oversight of Preloading Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Initial Notifications and Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Hazardous Materials Assessment and Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Hazardous Material Emergency Response Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Harper County Personnel Experience and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 BNSF Training Program for Emergency Responders . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 State Initiatives and Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Contents iv Railroad Accident Report Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Accident Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Industry Response to Thrall Car Weld Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Adequacy of Preloading Inspection Standards and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Modification or Redesign of Container Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Response to Hazardous Materials Release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Harper County Emergency Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 State Oversight for Emergency Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Appendixes A: Key Specifications for DTTX 72318 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

v Railroad Accident Report Acronyms and Abbreviations AAR Association of American Railroads BNSF Burlington Northern and Santa Fe Railway Company CFR Code of Federal Regulations CHEMTREC Chemical Transportation Emergency Center COFC container on flatcar Conrail Consolidated Rail Corporation CTC centralized traffic control system DOT Department of Transportation EMC emergency management coordinator EMS emergency medical service EW-161 Early Warning Letter 161 FRA Federal Railroad Administration HCSD Harper County Sheriff Department IBC interbox connector psi pounds per square inch SOP standard operating procedure Thrall Thrall Car Manufacturing Company TOFC trailer on flatcar TV trailer-van UMLER Universal Machine Language Equipment Register UP Union Pacific Railroad

vi Railroad Accident Report Executive Summary About 6:10 a.m., central daylight time, on September 2, 1998, the 17th through 19th cars and the first two platforms of the five-platform 20th car of westbound Burlington Northern and Santa Fe Railway Company intermodal freight train S-CHILAC1-31 derailed at Crisfield, Kansas. The accident occurred when the 18th car from the locomotive, DTTX 72318, an articulated, five-platform, 125-ton double-stack car, experienced a separation between the floor shear plate and bulkhead bottom angle at the leading end of the car’s B platform. The separation allowed the car to sag below the rails, catch a part of a switch, and derail. The train was traveling 68 mph through the east siding switch at Crisfield, milepost 291.7, on the Panhandle Subdivision of the railroad’s Amarillo Division, when it began to derail. The train then went into emergency braking and stopped after traveling about 1/2 mile. The derailment resulted in a pileup involving four articulated multiplatform cars carrying intermodal shipping containers. Some of the containers were breached, resulting in the release of hazardous materials and fires. About 200 people were evacuated within a 5-mile radius. No injuries resulted from either the derailment or the hazardous materials releases. Estimated damage was $1.3 million. The National Transportation Safety Board determines that the probable cause of this accident was the structural failure of intermodal car DTTX 72318 due to fatigue cracking initiated when a container was misloaded onto a foreign object. The misloading of the container occurred because of the railroad industry’s inadequate preloading inspection procedures for double-stack well cars. Contributing to the accident was the improper and undocumented repair of the car. The safety issues addressed in the report include: • Adequacy of the Association of American Railroads’ and Federal Railroad Administration’s intermodal container loading and securement standards for the preloading inspection of double-stack cars; and • Adequacy of railroad industry training and practices with respect to emphasizing the importance of removing foreign objects from the wells of double-stack cars before loading. The report also discusses the industry’s response to the structural failures experienced by Thrall Car Manufacturing Company’s 125-ton double-stack cars, the Federal Railroad Administration’s oversight of preloading inspections, the improper and undocumented repairs to DTTX 72318, the modification or redesign of double-stack cars, and the adequacy of emergency preparedness in Harper County, Kansas.

Executive Summary vii Railroad Accident Report As a result of its investigation of this accident, the Safety Board makes recommendations to the Federal Railroad Administration, to the Class I railroads, and to the Association of American Railroads.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Narrative Derailment and Initial Crew Actions About 6:10 a.m.1 on September 2, 1998, the 17th through 19th cars and the first two platforms of the five-platform 20th car of westbound Burlington Northern and Santa Fe Railway Company (BNSF) intermodal freight train S-CHILAC1-31 derailed at Crisfield, Kansas. The accident occurred when the 18th car from the locomotive, DTTX 72318, an articulated, five-platform, 125-ton double-stack car, experienced a separation between the floor shear plate and bulkhead bottom angle at the leading end of the car’s leading platform (B platform). The separation allowed the car to sag below the rails, catch a part of a switch, and derail. (See figures 1 through 3.) The train was traveling 68 mph through the east siding switch at Crisfield, milepost 291.7, 2 on the Panhandle Subdivision of the railroad’s Amarillo Division, when it began to derail. The train went into emergency braking because of a broken or disconnected train line3 and stopped after traveling about 1/2 mile. The engineer and conductor saw fire toward the rear of the train. The engineer said he immediately called the BNSF dispatcher in Fort Worth, Texas, to report that the train was in emergency, that there was a fire on the rear of the train, and that hazardous materials were on the train. (See figures 4 and 5.) Despite derailing, the 17th car remained coupled to the rest of the train; there was a gap of about 1/3 mile between it and the 18th car, DTTX 72318. Another gap of about 500 feet existed between that car and the last two cars of the train (19th and 20th), which remained coupled. Containers from the 18th and 19th cars burned in the two separate piles. The weather at the time of the accident was mostly clear; the temperature was near 70° F, with an east wind of 4 mph. Release of Hazardous Materials Of the eight cargo containers carrying hazardous materials involved in the derailment, four, along with their contents, were destroyed by fire. The destroyed hazardous materials included 14,885 pounds of corrosive material (including 14,500 pounds of nitric acid), 2,965 pounds of flammable liquids, 2,280 pounds of solid poisons, 1 Times given in this report are central daylight time. 2 BNSF On-Track Equipment Accident/Incident Report. 3 The train line connects the locomotive’s and cars’ air brake systems via metal pipes and connecting flexible air hoses at the ends of each railroad vehicle.

Factual Information 2 Railroad Accident Report Figure 1. Aerial view of accident site (photograph by The Wichita Eagle)

Factual Information 3 Railroad Accident Report Figure 2. Thrall Car Manufacturing Company 125-ton double-stack car platform (side and overhead views)

Factual Information 4 Railroad Accident Report Figure 3. Separation between the floor shear plate and bulkhead bottom angle on DTTX 72318 (car as viewed lying on side)

Factual Information 5 Railroad Accident Report and 6,880 pounds of aerosols that typically contain flammable compressed gases as propellants. The hazardous materials packaging in three other cargo containers was damaged; the only releases noted were due to leakage from two 4-liter plastic bottles of isopropanol (a flammable liquid) and from a 20-gallon drum of hypophosporous acid (a corrosive material). The BNSF reported4 to the Kansas Department of Health and Environment that all of the chemicals released as a result of the derailment were removed by BNSF environmental and cleanup contractors. Figure 4. Accident region 4 September 7, 1998, letter to the Kansas Department of Health and Environment.

Factual Information 6 Railroad Accident Report Figure 5. Aerial view of DTTX 72318 (photograph by The Wichita Eagle)

Factual Information 7 Railroad Accident Report Personnel Information Engineer The engineer was hired as a switchman-brakeman in 1977 and promoted to locomotive engineer in 1986. He passed his last rules examination on April 19, 1996. The engineer took a hazardous materials refresher class and a hazardous commodities refresher class on February 4, 1997. Conductor The conductor was hired as a track worker in 1952 and promoted to conductor in

1. He passed his last rules examination on February 19, 1998. The conductor took a

hazardous materials refresher class and a hazardous commodities refresher class on January 28, 1997. Train Crew Rest The engineer arrived in Wellington, Kansas, on August 30, 1998, according to BNSF records. The conductor said5 that he and the engineer were called at Wellington, Kansas, at 4:30 a.m. on September 2, 1998, for train S-CHILAC1-31. The conductor further stated that he and the engineer departed from Wellington about 5:10 a.m. and did not stop or meet any other trains before the derailment an hour later, at 6:10 a.m. Both crewmembers testified that they were well rested upon reporting for duty that day. According to BNSF personnel records, the engineer had requested and received the opportunity for 14 or more hours of rest between runs for at least 30 days before the derailment. During this time, the engineer had made seven trips. The Hours-of-Service Act requires a minimum of 12 hours of “rest” between runs, which may include travel time to and from the job. Toxicological Information About 11:00 a.m., the BNSF Wellington trainmaster took the conductor and engineer to the Sumner Regional Medical Center in Wellington for drug tests.6 Test results for both the conductor and engineer were negative. 5 The Safety Board conducted sworn testimony of key railroad and emergency response personnel in October 1998 at the Sumner County Mental Health Clinic, Wellington, Kansas, and in September 1998 at the Safety Board’s West Chicago, Illinois, office. 6 49 Code of Federal Regulations (CFR) Part 219.201 requires that testing be conducted within 8 hours of an accident.

Factual Information 8 Railroad Accident Report Train Information Westbound BNSF freight train S-CHILAC1-31 was a Chicago-to-Los Angeles intermodal container train. After an initial terminal air brake test and equipment inspection with no defects noted, the train departed the BNSF intermodal facility at Chicago, Illinois (Corwith Yard), at 9:45 a.m. on September 1, 1998. The train consisted of three locomotive units pulling 20 articulated cars with three to five platforms per car. The train’s 59 platforms were all loaded (no empty cars) and carried a total of 192 cargo containers (182 loaded and 10 empty). Twelve of the loaded containers contained hazardous materials in various quantities and forms.7 The train trailing tonnage (portion behind locomotive) was 5,806 tons and was 5,379 feet long; the total train length was 5,574 feet. Track and Signal Information The track, which is constructed of continuous welded rail, is tangent (straight) through the derailment area. The track was last inspected on August 31, 1998, and no reportable defects were noted. Safety Board, Federal Railroad Administration (FRA), and BNSF maintenance-of-way officials inspected the track in the accident area as part of the on-scene investigation, which included reviewing related maintenance and inspection records. August 1998 inspection records were reviewed for the area between mileposts 236.2 and 308.2 (72 miles). The majority of defects noted in the records of inspections and repairs involved the replacement of missing switch and rail joint bar bolts and the welding of worn switch parts. According to FRA Track Safety Standards (49 CFR Parts 213.121d and e), at least two bolts are required for continuous welded rail and jointed rail. BNSF records showed that all noted defects were repaired or corrected on the spot. The railroad has colored wayside signals in both directions as part of the centralized traffic control system (CTC).8 After track and signal continuity had been restored from accident derailment damage, Safety Board and FRA investigators tested the signal system. No anomalies were identified during the test. Operations The railroad, which is part of the BNSF Amarillo Division, Panhandle Subdivision, is controlled by a CTC system under the direction of a BNSF dispatcher in Fort Worth, Texas. The CTC system is supplemented by the BNSF Amarillo Division Timetable No. 1, effective April 1, 1998. 7 Eight of the hazardous material containers were involved in the derailment or subsequent fires. At the time of the accident, DTTX 72318 carried 11 containers, 4 of which contained hazardous materials. 8 A remotely controlled system under which train movements are authorized by block signals.

Factual Information 9 Railroad Accident Report The BNSF Amarillo Division is one of three (Kansas, Amarillo, and New Mexico) in the Amarillo Service Unit. The division extends from the eastern boundary of the Wellington, Kansas, yard to Clovis, New Mexico, and includes about 410 miles of track, three minor yards, and one larger yard in Wellington. According to the Amarillo Division Superintendent of Operations, most of the division runs through rural areas. The BNSF’s Director of Hazardous Materials estimated that more than 90 percent of the railroad’s operating territory is in rural areas. He also stated that, in 1999, 7 percent of the railroad’s 8,064,175 total shipments (563,654) consisted of hazardous materials and that roughly half of the hazardous materials shipments (280,352) were intermodal. DTTX 72318 General Well cars, which have multiple platforms, or wells, with low side walls, are a specialized type of flatcar used for transporting freight contained in intermodal shipping containers or semitrailers. Freight transported in this manner can be transferred to or from ships or trucks. (See figures 6 and 7.) Well cars that are capable of carrying containers stacked two high and locked together with interbox connectors (IBCs),9 such as DTTX 72318, are referred to as double-stack cars.10 (See figures 8 and 9.) DTTX 72318 was designed and built by Thrall Car Manufacturing Company (Thrall) of Chicago Heights, Illinois, for TTX Company. Completed on March 8, 1989, it was one of 1,848 125-ton double-stack cars built by Thrall from 1988 through 1997, as shown in table 1. (For a diagram of a Thrall 125-ton double-stack car, see figure 10. For car specifications, see appendix A.) 9 Interbox connectors are devices that connect stacked intermodal shipping containers. IBC storage boxes are provided on intermodal cars and throughout loading (“ramp”) facilities to minimize IBC loss and maximize convenience and availability. 10 Railroad Emergency Response Hazardous Materials Awareness, (handbook for emergency responder training), Burlington Northern and Santa Fe Railway Company, January 1998. Table 1. Thrall 125-ton double-stack cars built from 1988 through 1997 Owner Number of cars Car number American President Lines 75 APLX 4700-4774 BNSF 100 SFLC 254100-254199 TTX Company 1,6731 DTTX 72000-72882 (883 cars) DTTX 720000-720789 (790 cars) Total 1,848 1Of the 1,673 cars built for TTX Company, 20 were later destroyed in derailments and accidents.

Factual Information 10 Railroad Accident Report Figure 6. Five-platform car DTTX 72318 shortly after the Crisfield derailment Figure 7. End platform of DTTX 72318 with a container still in place

Factual Information 11 Railroad Accident Report Postaccident Examination of DTTX 72318 At the time of the accident, DTTX 72318’s five platforms carried a total of 11 containers, 4 of which contained hazardous materials. The car’s B platform, where the floor shear plate failure occurred, was carrying container HDMU 205007, which contained FAK (freight of all kinds) but no hazardous materials. Safety Board investigators visually examined the car and found a lateral fracture at a weld between the floor shear plate and the bulkhead bottom angle, at the leading end of the car’s B platform.11 In this area, the floor and end wall, or bulkhead, of the car meet at a right angle. The bulkhead bottom angle is attached between the floor shear plate and bulkhead face plate, as shown in figure 11. It contains drain holes in the bottom corners between the floor shear plate and sidewalls. Corner post angles are attached between the bulkhead face plates and the left and right sidewalls. All components are attached to each other with fillet welds. As viewed from inside the car, the fracture, for the most part, followed the toe of the weld on the floor-shear-plate side and penetrated completely through the floor shear plate. The sliver-shaped lateral fracture was about 92 inches long and about 4.8 inches at its widest point, longitudinally. (See figure 12.) A detailed examination of the floor shear plate by the Safety Board materials laboratory revealed that the fracture face had originally contained a 20-inch lateral fatigue crack. The fatigue crack emanated from the bottom side of the floor shear plate and propagated upward, terminating at the weld. The center of the fatigue crack corresponded Figure 8. One type of IBC 11 See Safety Board Materials Laboratory Reports 99-35 and -35A, December 21, 1998.

Factual Information 12 Railroad Accident Report Figure 9. Typical double-stack train configuration Figure 10. Thrall 125-ton double-stack car

Factual Information 13 Railroad Accident Report Figure 11. DTTX 72318 design Figure 12. Gap as viewed from above car’s platform

Factual Information 14 Railroad Accident Report to the midpoint between the sidewalls. At some time, an 8-inch-long bolt had been welded between the floor shear plate and bulkhead bottom angle as filler metal to bridge the original 20-inch-long crack in the floor shear plate. (See figures 13 and 14.) The weld on one side of the bolt had been attached directly to the face of the fatigue fracture, and the downward deformed floor was not straightened or made flush with the mating bulkhead bottom angle. This weld repair had left an air gap (vertically about 0.3 inch) between the bottom of the bulkhead bottom angle and the upper surface of the floor shear plate. Furthermore, the thickness of the weld that bridged the gap between the bolt and fractured floor shear plate was about 0.2 inch, which was much less than the thickness of the floor shear plate (0.5 inch). The repaired area on the inside portion of the car had been covered with paint. The fracture faces remained exposed at the bottom side of the car. According to the Thrall Assistant Vice President, Product Engineering,12 such a repair was “not proper” because it did not restore the floor shear plate to its original strength and condition. DTTX 72318 repair records did not state where the repair had been done or who had done it. In addition, DTTX records indicated that TTX Company had not been billed for the repair. A further metallurgical examination disclosed that the lateral fracture contained somewhat symmetrical fracture features on each end of the original 20-inch fatigue crack. In travelling outward from the ends of the fatigue crack, the lateral fracture contained a river pattern13 region (10 inches) and a secondary fatigue region (6 inches), followed by an overstress region (20 inches) that contained several crack arrest marks. These secondary fatigue cracks emanated from the weld on the top surface of the floor shear plate. The secondary fatigue cracks propagated down and through the wall of the floor shear plate. No evidence of impact marks or other types of severe contact was noted on the top surface of the floor shear plate in the area of the down deformation. An additional fatigue crack emanated from the edge of the web portion14 on both sides of the sill. The fatigue crack at each web propagated toward the A end (opposite the lateral fracture) of the car’s B platform and intersected the lateral weld between the floor shear plate and bulkhead bottom angle. Fatigue cracks were also found on the bulkhead face plate on the B end of the car. These fatigue cracks intersected a weld on the top of the left and right corner post angles. 12 The Safety Board conducted sworn testimony of the following party representatives in August and September 1999 at Safety Board headquarters in Washington, D.C.: Thrall Assistant Vice President, Product Engineering, August 25, 1999; TTX Company Assistant Vice President, Engineering and Research, August 25, 1999; Association of American Railroads (AAR) Assistant Vice President, Technical Services, August 19, 1999. In addition, the FRA Staff Director, Motive Power and Equipment Division, participated in the August 19 and 25 meetings. Unless otherwise noted, statements attributed in this report to Thrall, TTX Company, the AAR, and the FRA were made by the individuals and on the dates cited in this footnote. 13 An overstress fracture that contain features similar to nested letters “V,” where the points of the chevrons are traced back to the fracture origin. According to the Safety Board Materials Laboratory report, the lateral fracture in the accident railroad car contained chevrons indicative of a crack that had propagated outward. 14 Where the floor shear plate extends beyond the bulkhead face plate and is welded to the horizontal leg of the bulkhead bottom angle, forming corners between the center sill and bulkhead face plate.

Factual Information 15 Railroad Accident Report Figure 13. Cross-section of the bolt (bound by dashed lines) welded between the floor shear plate and bulkhead bottom angle of DTTX 72318. (Sketch of the surrounding structure was added for orientation purposes and is not to scale. Bolt section photographed at 1.8X magnification.)

Factual Information 16 Railroad Accident Report Movement and Inspections According to TTX Company computer records, DTTX 72318 had been empty pending loading on August 28, 1998, as part of train TV (trailer-van) 263 at the Consolidated Rail Corporation (Conrail) Croxton intermodal facility near Secaucus, New Jersey. As stated in the Conrail Mechanical Department’s daily air brake inspection report, train TV 263 had completed the initial terminal air brake test at 11:48 p.m. and then moved to the loading area. According to the same records, DTTX 72318 was loaded at about 1:00 a.m. Train TV 263 departed Croxton Yard at 1:12 a.m. on August 29 and was routed through Selkirk (Albany), New York; Syracuse, New York; Buffalo, New York; Cleveland, Ohio; and Elkhart, Indiana; it arrived at the Chicago Cargo transfer yard at 5:00 p.m. on August 30, 1998. DTTX 72318 was then transferred to BNSF’s Corwith Yard and switched to become the 18th car on BNSF train S-CHILAC1-31. From Chicago, the train followed the route of the former Atchison Topeka & Santa Fe Railway through Amarillo, Texas, toward Los Angeles, California. Crew (engineer and conductor) changes were made at Fort Madison, Iowa; Kansas City, Kansas; and Wellington, Kansas. After the train crew changed at Wellington, the train departed at 5:11 a.m. on September 2, 1998, for the accident trip. Conrail records indicated no inspection defects or discrepancies for DTTX 72318 on the night of August 28 through 29, 1998. The Conrail carman who inspected DTTX 72318 before its departure from the Croxton trailer-van facility told Safety Board Figure 14. Bolt used to make improper repair to DTTX 72318

Factual Information 17 Railroad Accident Report investigators on September 16, 1998, that although he did not specifically remember inspecting DTTX 72318, he could describe his work routine on the 28th. According to the carman, when a train entered Croxton Yard, he conducted a roll- by inspection15 of the train. Once the train was stopped and secured, both he and the intermodal ramp contractor were allowed to work the train simultaneously. The carman stated that the container cars were not always empty when he inspected the trains and that the contractor personnel, usually a loader operator and a ground guide, loaded and unloaded containers as the carman inspected. The carman further stated that the contractor crew unloaded containers from the inbound train and immediately begin loading the train with other containers for the outbound movement while he was inspecting the cars. The carman said that most of the time he followed the contractor crew while conducting his inspections to avoid injury and to avoid getting in the way of the loaders. The carman said that he inspected the cars at night from a Conrail repair truck with a search light and believed that he was positioned to observe both car condition and container position. According to the carman, in addition to performing the required air brake and equipment inspections, his inspection routine included ensuring that: • Containers are loaded into the correct container wells; • Containers are placed correctly (not set on top of the retention pins); • Container heights are within clearance limits for the route; • IBCs are correctly positioned and locked; • Container doors are locked shut; and • The car’s overall condition is satisfactory, and safety appliances are undamaged from loading and unloading. Two BNSF carmen at BNSF’s Corwith Yard were also interviewed regarding DTTX 72318. One had been involved in conducting the initial terminal air brake test, which required inspecting each car’s air brakes. On September 1, 1998, the carmen conducted an outbound equipment inspection of BNSF train S-CHILAC1-31, positioned on the ground 10 to 15 feet from and on each side of the train as it departed. Neither carman noted defects. The August 31, 1998,16 BNSF Intermodal Securement Safety Audit Form for Cicero Yard, which would have included DTTX 72318, indicated that 53 cars and 123 platforms were inspected, with no defects found on any of the cars. 15 Cursory inspection for obvious safety hazards such as shifted loads, dragging equipment, and stuck brakes. 16 Includes the time at which the accident train would have been inspected.

Factual Information 18 Railroad Accident Report Maintenance and Repair History According to TTX Company, the 125-ton double-stack cars are inspected and sent to TTX shops for preventive maintenance every 300,000 miles.17 TTX Company stated that cars average about 100,000 miles each year. DDTX 72318’s maintenance and inspection history for the year preceding the accident is summarized in table 2. DTTX 72318 received a scheduled 300,000-mile inspection and repair in August

1. In addition, according to TTX Company, DTTX 72318 received a nonroutine

inspection March 20, 1998, about 5 months before the accident, as directed by AAR Early Warning Letter 161 (discussed later in this report). This inspection found no defects. DTTX 72318’s whereabouts, according to information reported in TTX Company, AAR, and BNSF maintenance and car movement records for the 4-week period in which this inspection occurred, are shown in table 3. TTX Company maintains a billing history of additional repairs and maintenance performed on each of its cars. DTTX 72318 received its last billed repairs before the accident on November 7, 1997, for hand-hold or grab-iron repairs.18 According to TTX Company records, the car was last sent for routine servicing to a Norfolk Southern shop in Norfolk, Virginia, on July 17, 1998. No record of the improper repair was discovered during the Safety Board’s postaccident examination of the car’s repair history. 17 Mileage is based on data from the Automatic Equipment Identification system. Each car has an electronic tag that identifies the car when it passes a scanner. Table 2. DTTX 72318 maintenance and repair history Event Date 300,000-mile inspection and repair by TTX Company August 1997 Last billed repairs before accident November 7, 1997 Inspection for floor cracking as directed by Early Warning Letter 161 March 20, 1998 Routine servicing by TTX Company maintenance personnel July 17, 1998 Crisfield derailment September 2, 1998 Table 3. Reported locations for DTTX 72318 TTX Company AAR BNSF 3/9/98 Long Beach, CA — — 3/20/98 — Global I Yard (near Chicago) Oakland, CA 3/25/98 — — Global I Yard 4/4/98 Chicago — — Note: Blank cells indicate no record of the car’s location. 18 Metal rods attached to the sides of equipment that are used by railroad personnel while climbing and mounting the equipment.

Factual Information 19 Railroad Accident Report Event Recorder Information Safety Board investigators recovered the event recorders from each of the three locomotive units and downloaded the data from them. Event recorder data showed that the train’s speed at the time of the derailment, when the air brake system experienced an emergency brake application due to a train line separation, was 68 mph. The maximum authorized speed was 70 mph. Weld Failures for Thrall 125-Ton Double-Stack Cars Floor Design Floor shear plates for Thrall 125-ton double-stack cars vary in width from 3 1/2 feet to 4 1/2 feet, depending upon the well platform’s length. Most designs by other manufacturers19 call for either a smaller end floor plate or no end floor plate. Thrall’s larger-than-average end floor plate at the end of every well platform strengthens the car; it also acts as a shelf that can catch or hold foreign objects between the floor and the container. During sworn testimony conducted by Safety Board staff, Thrall, TTX Company, and the AAR stated that if a foreign object becomes lodged between the floor shear plate and a container, the concentrated weight of the container pressing on the small area of the foreign object creates a high stress point or force that can exceed the design limits of the car. Party representatives also stated that these concentrated loads and the associated high stress points eventually cause cracks in the floor shear plate. According to the AAR Assistant Vice President, Technical Services, a car in which a container (loaded or empty) has been placed on top of a hard foreign object is considered to be misloaded or improperly secured because the container will not rest on the retention cone.20 According to Thrall, the floor shear plate is designed for a static loading of about 13,000 pounds per square inch (psi) in the area attached to the end bulkhead angle. Calculations by Thrall indicate that when a foreign object-concentrated load is placed 8 inches away from the bulkhead, the static load on the floor shear plate increases to about 114,000 psi, or about 8.7 times the designed static load. Thrall further calculated that under loading conditions with the car under movement, the load increases to about 230,000 psi, a 6.7-fold increase over the designed dynamic load of 34,000 psi. Each 1/2-inch-thick floor shear plate has a yield strength of about 50,000 psi minimum. According to Thrall, the floor shear plate’s thickness would have to be increased from 1/2 inch to about 1 1/4 inches to accommodate concentrated loads from foreign objects. 19 Other double-stack car manufacturers are Gunderson, Greenville, American Car and Foundry, and Trinity Industries. Trinity Industries manufactured some intermodal cars with a floor design similar to the Thrall cars. 20 Projection that helps center a container on the platform.

Factual Information 20 Railroad Accident Report Thrall stated that the additional thickness would increase a car’s weight by about 2,500 pounds per platform (2 percent), or over 6 tons per five-platform car, reducing carrying capacity by the same amount. The 4,824 double-stack cars built by Thrall since 198421 have virtually the same floor design as the current cars. Each Thrall 125-ton double-stack car has 10 welds between floor shear plates and the bulkhead bottom angles, one at each end of the five wells that make up the articulated car. Weld Failures Thrall first became aware of the weld failures in its 125-ton double-stack cars in July 1993, about 5 years after they were introduced into service. A Chicago train yard inspection of DTTX 72052 at that time revealed a cracked floor shear plate. (See table 1 for a list of the 125-ton double-stack cars manufactured by Thrall from 1988 through 1997, which includes DTTX 72052 and the other cars discussed in this section.) In 1997, Thrall was informed of two other cars with similar cracks in the floor shear plate.22 According to Thrall and TTX Company, in each case, depressions in the floor plate were caused by a stress point created by a foreign object beneath a loaded container. Until 1997, these cars were the only cases of cracked floor shear plates known to Thrall and TTX Company. Both Thrall and TTX Company said that they considered these occurrences to be isolated incidents. In each case, the cars were repaired and did not experience further problems. In November 1997, Union Pacific Railroad (UP) personnel discovered cracks between the floor shear plate and the bulkhead bottom angle on two Thrall 125-ton double-stack cars: DTTX 720573 on November 22 at Green River, Wyoming, and DTTX 720158 on November 25 at Central City, Nebraska. Both cars were sent to Thrall for further inspection and repair.23 The UP found, which was later confirmed by the AAR, that both cracks were due to the presence of a foreign object. Neither structural failure resulted in a derailment. According to the AAR Assistant Vice President, Technical Services, the inspection of the Green River car revealed the imprint of an IBC manufacturer’s casting in the floor plate depression near the crack. In addition, the Thrall Assistant Vice President, Product Engineering, stated about the cracks in 125-ton double-stack cars, “Everything that we’ve seen that has this crack; there’s been a depression in the floor that was an indication of misloading it.” Immediately after finding the first failures in 1997, the UP began inspecting DTTX 125-ton double-stack cars for cracking, particularly where the floor shear plate meets the 21 These cars include 1,012 five-unit 100-ton cars; 138 four-unit drawbar-connected well cars; 300 three- unit drawbar-connected well cars; 960 stand-alone well cars; 250 all-purpose stand-alone well cars; 116 all- purpose three-unit drawbar-connected well cars; and 2,048 other cars (125-ton) of various design. 22 SFLC 254188, in Kansas City, Kansas, in January, and DTTX 720294, in Portland, Oregon, in July. 23 FRA letter, Floor Failures in Thrall 125-Ton Double-Stack Cars; FRA/NTSB Collaborative Investigation, November 15, 1999.

Factual Information 21 Railroad Accident Report bulkhead bottom angle. Five more cars with such cracks were found during inspections in Chicago; Memphis, Tennessee; Oakland, California; and Chehalis, Washington.24 In every case, the UP found evidence of damage by a foreign object. According to the AAR, the UP Mechanical Department informed the AAR, Thrall, and TTX Company of its inspection results and of its concern that a safety problem existed. (See figure 15 for a representative example of a damaged Thrall car.) The AAR’s Intermodal Car Performance Committee held a teleconference on December 4, 1997, to discuss the cracking. By that time, the UP had inspected 303 DTTX cars and found evidence of a cracking problem. On December 10, 1997, the AAR issued Early Warning Letter 161 (EW-161) to all 1,200 interchange subscribers.25 The letter informed subscribers of the cracks found in Thrall 125-ton double-stack cars manufactured since 198826 and directed their inspection.27 The letter also provided an attachment and a sketch showing the critical areas to be inspected, including the area between the floor shear plate and the bulkhead angle. The letter stated: Figure 15. Damage caused by foreign objects to the platform floor of a Thrall double-stack car (two depressions and a hole). The larger depression (closer to hole) contains the imprint of a loose IBC. 24 DTTX 720806 (Global 2 Yard—Chicago), DTTX 720494 (Global 1 Yard—Chicago), DTTX 720457 (Oakland), DTTX 720757 (Memphis), and DTTX 720294 (Chehalis). 25 Railroads that have agreed to follow AAR regulations so that they may interchange cars with other railroads. 26 Since EW-161 was issued, the number of Thrall 125-ton double-stack cars has increased, from 1,848 to 2,048, because more cars have been built since 1997. 27 The EW-161 letter assigned inspection Severity Code C—Stop Car, Loaded or Empty, INSPECT.

Factual Information 22 Railroad Accident Report If it is possible to perform a thorough inspection of these areas, whether the car is loaded28 or empty, then the following action is to be taken. If no cracks are found, return the car to service and report Inspection Code MR—Car Inspected—Return Car to Service to the car owner or directly to the AAR UMLER [Universal Machine Language Equipment Register] Section. If cracks are found per attached inspection procedure, bad order the car and request home shop disposition from the car owner…The car owner or repairing line should ensure that Inspection Code ME—Car Inspected—Moving to Shop is reported…. If the car is loaded and it is not possible to inspect all critical areas, in particular the floor shear plate to the bulkhead bottom angle welds that are inside and along the bottom end of the wells, allow the car to continue to destination if no cracks are found, but do not report the car to the car owner or AAR UMLER Section. Cars will be removed from the Early Warning list only after all the critical areas have been inspected and determined to be free of cracks or are repaired. Please do not report an Inspection Code MR unless you are able to perform a complete inspection per attached procedure. Of 1,65329 TTX Company cars inspected, 71 were sent to repair facilities for closer inspection, and 27 cars were repaired. Thrall witnesses, in sworn testimony taken by Safety Board investigators, stated that each repaired car displayed evidence of the presence of a foreign object. TTX Company maintenance personnel conducted EW-161 inspections at 34 intermodal loading facilities. By August 19, 1999, all but five Thrall 125-ton double-stack cars had been inspected as directed by EW-161. Remedial Actions Intermodal cars are designed for a 40-year service life and may last longer. According to TTX Company, the Thrall 125-ton double-stack cars had not experienced a pattern of systemic weld problems between the floor shear plate and the bulkhead bottom angle. TTX Company stated that such problems would have been noticed during the scheduled preventive maintenance program or during unscheduled shop repairs. Safety Board investigators reviewed the repair records and histories of the cars having weld cracks or experiencing structural failure and found that a car’s cracks and failures were unrelated to the car’s age, mileage, service pattern, maintenance, or previous repairs. TTX Company also testified that it could not find a correlation between the cracks and a car’s age and service or a manufacturing defect that would have caused the cracks, stating that the problem “…appeared to be more random in this whole group of equipment.” According to TTX Company, repair records also indicated that the 27 cars with cracks showed evidence of the current or past presence of a foreign object. In many instances, the object left an impression in the floor shear plate. Floor shear plates were deformed or dented or, in some cases, holed, where the object had punched through the steel plate. In addition, during the Crisfield investigation, the Safety Board learned that the 28 To meet the letter’s inspection requirements, the well(s) would have to be either empty or contain a single 20-foot container. 29 Total number of cars less 100 SFLC cars and 6 removed from service.

Factual Information 23 Railroad Accident Report FRA, TTX Company, and railroad inspectors found that the presence of a foreign object correlates with cracks between the bulkhead and the floor shear plate. Under Thrall’s guidance, TTX Company (and BNSF shops for SFLC cars) repaired the cars found to have cracks or breaks between the floor shear plate and the bulkhead bottom angle. The repairs were intended to last the life of the car, according to Thrall and TTX Company testimony. Depending upon the nature and severity of the crack, break, or related damage, repairs involved rewelding the area, removing and replacing weld, or replacing the floor shear plate. In some cases, repairs included reinforcing the area joining the floor shear plate and the bulkhead bottom angle with a doubler plate. Doubler Plate Reinforcement. A doubler plate is a T-shaped piece of plate steel about 1 foot 9 inches long by 2 feet wide on each leg that is welded in place outside the well, where the floor shear plate and the bulkhead bottom angle intersect. This 1/2-inch-thick plate reinforces the repair weld and is designed to ensure that the weld area is as strong as originally designed. Thrall stated that, in the case of a car misloaded with a foreign object between a loaded container and the floor shear plate, even reinforcement with a doubler plate would only slow the inevitable creation and propagation of a crack and would not prevent an eventual structural failure. Decals. Starting in 1998, Thrall began adding decals to newly built intermodal cars. These decals, added to the last 200 Thrall 125-ton double-stack cars built, instructed loading ramp personnel to remove foreign objects from the car. The rectangular decals were self-adhesive 11- by 5-inch yellow signs with 3/4-inch red capital letters reading: Thrall placed the decals on the outside of the container cars’ side walls and on the inside of the container cars’ end walls; each five-platform car had 30 decals. DTTX 72318 did not have the decals as they had not been applied before the accident. New Floor Design. Thrall also instituted a new floor design for a prototype double-stack car designed to accommodate 53-foot containers. (See figure 16.) The prototype’s floor shear plates are 1 inch thick and less than 3 feet wide (about 30 inches), compared to the current 4 1/2 feet. In addition, the plate is a truss (bracketed framework) and therefore has triangular “holes” or open spaces. The plate’s smaller overall size and open floor design provide less space on which to trap foreign objects and create a stress point under a loaded container. As of January 2000, the prototype for this design was being tested. In addition, TTX Company has revised its car performance specification to REMOVE ALL DEBRIS FROM THE WELL FLOOR BEFORE LOADING CONTAINERS

Factual Information 24 Railroad Accident Report Figure 16. New floor design for double-stack cars (two views)

Factual Information 25 Railroad Accident Report require that well cars be designed to prevent the collection of foreign objects or debris in the bottom of the well. IBC Redesign and Storage. The AAR intermodal committees have been working with operators on a new automatic or semiautomatic IBC that eliminates the need for loading ramp personnel to climb on top of containers to affix connectors. Several have already been demonstrated. The AAR and operators believe that an automatic IBC would also help reduce the number of loose IBCs and reduce the probability of one becoming trapped under a loaded container.30 Standards and Training for Intermodal Container Loading Intermodal Overview Railroad intermodal traffic has increased an average of about 15 percent per year, from 3 million trailers and containers in 1980 to over 8.7 million in 1997. Intermodal traffic accounts for more than 17 percent of railroad industry revenue, second only to coal, at 22 percent. The largest of the companies that provide intermodal equipment to the Class I railroads, TTX Company,31 was originally chartered in Delaware as a private for-profit company on March 17, 1956, and is owned by the Class I railroads of the United States and Canada. The company functions like a cooperative pool, providing intermodal cars to the railroads when requested at a per diem or rental rate. Thus, the railroads that own TTX Company are also its customers. TTX Company also provides cars to nonowner railroads, private companies, and the Department of Defense when requested and if cars are available. When the railroads charge shippers for moving goods using TTX Company cars, some of the money is used to pay TTX Company for the use of the TTX Company cars. Although TTX Company is a for-profit company, one of the reasons it exists is to provide well-maintained standard-design cars to the railroad industry at an economical rate. Thus, TTX Company reinvests most of its profits in capital investment for new cars and for the modernization and maintenance of cars. TTX Company also makes possible the most efficient use of car assets. Once a TTX Company car is no longer needed by a railroad, the rental is stopped and immediately reassigned to the next nearest customer. This efficiency allows 8 percent of the freight car fleet to account for about 20 percent of the fleet car mileage. Finally, “excess” profits are used to lower car rental rates. Several rate reductions have occurred in recent years. Class I railroads not only own TTX Company, which has the largest pool of intermodal equipment, but also possess their own intermodal equipment, which accounts for a significant portion of the intermodal car population. Consequently, the Class I 30 AAR Intermodal Committee meeting, San Pedro, California, February 7, 2000. 31 Until July 1, 1991, TTX was called Trailer Train Company.

Factual Information 26 Railroad Accident Report railroads own or control all of the intermodal terminals.32 The railroads coordinate control of intermodal traffic, operations, and equipment through the AAR Intermodal Committee. AAR Committee The AAR Intermodal Committee represents the Class I railroads and significant nonrailroad intermodal car owners, such as TTX Company, Pacer Stacktrain, and The Greenbrier Companies. Car manufacturers and intermodal facility owners and operators may also participate in committee activities and decisions but are not formal members. The AAR Intermodal Committee establishes uniform standards and safe practices for intermodal equipment and operations in the North American interchange system.33 This committee is made up of two subcommittees: Intermodal Working and Intermodal Car Performance. The Intermodal Working subcommittee consists of the operators and owners of intermodal facilities where trailers and containers are loaded and unloaded; members include both public and private entities, such as railroads, contractors, shippers, and quasi-governmental authorities. The Intermodal Car Performance subcommittee consists of the operators and owners of railroad intermodal freight cars. One product of these subcommittees was the development of an intermodal securement SOP (standard operating procedure), which is discussed in the next section. Board and AAR Action on Intermodal Inspection and Securement Training On May 16, 1994, an Amtrak train derailed near Selma, North Carolina, after colliding with an intermodal trailer that had fallen off a passing freight train.34 As a result of its investigation of this accident, the Safety Board recommended on March 29, 1995, that the AAR: R-95-22 Advise the National Transportation Safety Board within 90 days of the progress toward the development of the manual, poster, and video for the railroad industry and the incorporation of the recommended practices for the loading, securing, and inspecting of TOFC [trailer on flatcar]/COFC [container on flatcar] equipment in Manual 7 of the Open Top Loading Rules. Also implement these actions by December 31, 1995. In response to the recommendation, the AAR produced a manual, a video, and a poster on trailer and container securement and by December 30, 1995, had distributed 32 Intermodal terminals are defined for this report as being located at marine terminals with container traffic. Intermodal facilities are those locations that are inland and deal with truck trailers and may or may not also handle intermodal containers. 33 For further information, read Association of American Railroads Technical Services Division— Mechanical Section Manual of Standards and Recommended Practices, chapter XII, “Controlled Interchange Equipment,” effective April 30, 1990. 34 For further information, read Railroad Accident Report—Amtrak Train 87 Derailment After Colliding With Intermodal Trailer From CSXT Train 176, Near Selma, North Carolina, May 16, 1994, NTSB/RAR-95/02, Washington, D.C.

Factual Information 27 Railroad Accident Report them throughout the railroad industry and to all intermodal facilities. Since then, the AAR has produced two additional videos and a poster. Based on the AAR’s actions, the Safety Board classified Safety Recommendation R-95-22 “Closed—Acceptable Action” on May 14, 1998. The AAR’s current training materials on trailer and container securement include: • Intermodal Trailer and Container Securement (manual); • Intermodal Trailer Loading and Securement (video); • Intermodal Container Loading and Securement (video); • Trailer and Container Securement (video); • Trailer Hitch Information (poster); and • Container Securement (poster). Also in response to the Safety Board’s 1995 recommendation, the AAR developed Standard Operating Procedures for Intermodal Securement, which became effective on August 1, 1998. The SOP establishes uniform standards for loading, securement, and inspection of intermodal equipment and devices and establishes training requirements for loading personnel. Part 4 of the SOP, Standards, Section (h), “Training Criteria for Securement and Inspection,” requires that all personnel involved with the loading, securement, or inspection of intermodal equipment and devices receive training in loading and securement practices before performing those activities. It also requires that the training cover the application of securement devices and the identification of defective devices and equipment. The SOP contains two forms for use by intermodal facility personnel: Intermodal Securement Safety Audit Form and Internal and Inter-road Securement Failure Report. The Intermodal Securement Safety Audit Form is a checklist for postloading and/or predeparture inspection. The form, which is organized by railroad, location, and date, is intended for use on a facility basis; some facilities have adapted it for use on individual train inspections. The Internal and Inter-road Securement Failure Report is used for reporting improper or failed securement of equipment found during inspection. Neither form contains a requirement or checklist item that a car be free of foreign objects, even though the SOP (Part 4, Standards, Section (b) “Loading Practices Impacting Securement,” paragraph (4)) states, “Debris must be removed from railcar wells or surfaces.” A car with a container loaded onto a foreign object is considered “misloaded” by the AAR. The AAR’s August 1999 video on trailer loading and securement briefly notes that ice, snow, and foreign objects should be removed from the decks and inside the wells of intermodal cars to ensure that containers are seated properly. This 30-second segment of the 17-minute video does not discuss the consequences of loading containers onto foreign objects. In addition, the end floor of a car is not shown as a possible preloading inspection area. The video focuses on postloading and predeparture inspections, including improper IBC and trailer hitch securement and on trailer or container misalignment.

Factual Information 28 Railroad Accident Report FRA Oversight of Preloading Inspections Following the Safety Board’s Selma, North Carolina, accident investigation, the FRA conducted a study35 on intermodal loading and securement problems in the railroad industry. The study found …while their [the railroad industry’s] safety record is good, TOFC/COFC loading practices have not been treated as the critical safety procedures that they are. Industry standards need to be set for minimum training requirements as well as maintenance procedures. In addition, pre-departure inspections of securements must be instituted where they are not already standard practice. As an initial step, the best way to establish these standards is through the cooperation with the railroad industry, rather than through regulatory proceedings. The FRA will initiate a series of partnerships with the industry which, FRA believes, will establish appropriate industry standards effectively and efficiently. Given the importance of these goals, however, FRA will consider initiating regulatory proceedings if partnerships with the industry do not produce the desired results in an acceptable time frame. To date, the FRA has not initiated regulatory action specifically concerning intermodal loading or securement. Indeed, no AAR or FRA requirement exists even to report the loss of unsecured intermodal trailers or containers. From the time the FRA study was completed in September 1994, until November 1997, when the UP began reporting problems with the Thrall double-stack cars, solutions to loading problems have featured postloading securement and predeparture inspection of container cars. For instance, the actions taken as a result of the Selma accident recommendations did not address preloading inspection; they focused upon postloading securement and predeparture inspection. When the Thrall 125-ton double-stack car misloading problems were identified in November 1997, the FRA urged the AAR to issue a warning to inspect car floors for cracking. In addition, the FRA monitored the progress of the resulting inspection and repair program and conducted several meetings with the AAR concerning the double- stack cars. Following the Crisfield accident, the FRA requested that BNSF produce a video addressing the EW-161 inspections. The resulting video has been circulated throughout the railroad industry. The FRA has also taken part in the Safety Board’s investigation of the Crisfield accident and continues to monitor the condition of the Thrall 125-ton double-stack fleet. In October 1999, the FRA initiated an 18-month nationwide intermodal securement safety audit. FRA inspectors have been directed to pay particular attention to the preloading condition of cars, as well to as the securement of trailers and containers. 35 For further information, read Trailer-on-Flat Car Loading Securement and Safety, Federal Railroad Administration, Washington, D.C., September 15, 1994.

Factual Information 29 Railroad Accident Report Emergency Response Initial Notifications and Response Shortly after the derailment, about 6:12 a.m., the Harper County Sheriff Department (HCSD) dispatcher (county dispatcher) received a 911 telephone call from a resident near the accident site reporting the train derailment and a fire close to the tracks. Between 6:14 a.m. and 6:29 a.m., the county dispatcher notified the Attica, Kansas, emergency medical service (EMS) units and fire department and the Harper County Undersheriff (the undersheriff). The undersheriff and one of the responding emergency medical technicians, who was also the emergency management coordinator (EMC) for Harper County, served as joint incident commanders throughout the emergency.36 Between 6:30 a.m. and 6:40 a.m., the responding EMS and fire units from the Attica fire department arrived at the scene. (See figure 17 for nearby localities and figure 4 for larger cities in the region.) In the meantime, having been notified of the derailment by the train crew, the BNSF dispatcher’s office in Fort Worth, Texas, notified the trainmaster in Wellington, Kansas,37 of the accident about 6:25 a.m. and notified the BNSF superintendent of operations for the Amarillo Division38 about 6:32 a.m. The trainmaster and superintendent Figure 17. Accident site and nearby localities 36 The command posts for the undersheriff and EMC were their respective vehicles. Throughout the incident, both individuals changed locations.

Factual Information 30 Railroad Accident Report each departed immediately for the scene. At 6:27 a.m., the county dispatcher also made initial contact with a BNSF official. At 8:45 a.m., the BNSF Director of Hazardous Materials was notified and served as part of a senior management team that monitored events from BNSF corporate headquarters in Fort Worth, Texas. Other BNSF officials and personnel, including an assistant vice president, hazardous materials response teams, and environmental and cleanup crews, were sent to the accident scene from various locations throughout the morning. Hazardous Materials Assessment and Response Immediately following the 6:10 a.m. derailment, while it was still dark, the conductor walked about 2,500 feet toward the back of the train39 before he encountered fumes and returned to the head end of the train. He then walked north of the derailed train to 160th Avenue, where, about 6:52 a.m., he met an HCSD deputy. The conductor informed the deputy that he had the train consist. The deputy drove the conductor to the EMC, arriving about 6:58 a.m. The three discussed the cars involved in the fire. According to the deputy, they knew that hazardous materials were involved but did not know the types and quantities. They decided that the conductor should go to the rear of the train to try to identify which cars and, thereby, which hazardous materials were involved. The deputy and conductor drove to the east end of the derailment site, arriving about 7:10 a.m. The conductor observed that the train had separated into two sections, about 1/3 mile apart. He determined that the derailed portion of the train appeared to be the last three or four articulated cars in the train. The conductor also observed two fires— a large fire to the east, involving the derailed cars at the rear end of the train, and a smaller fire to the west, involving the derailed cars toward the head (locomotive) end of the train. The conductor and the deputy stated they stayed upwind and out of the smoke from the fire. Meanwhile, about 6:53 a.m., the undersheriff had arrived at the staging area of the responding fire departments, about 100 to 150 yards south of the westernmost fire. He observed the two burning sections of the train and two types of smoke—heavy black smoke and yellowish orange smoke. He concluded from the yellowish orange smoke that hazardous materials had been released and were burning. Because this smoke was drifting toward Hazelton in neighboring Barber County, at 6:53 a.m. he directed the county dispatcher to contact Barber County officials about the possible need to evacuate Hazelton.40 37 Wellington, approximately 45 miles from Crisfield, was the closest BNSF terminal to the accident scene. 38 Senior BNSF officer for the operating area including Crisfield. 39 According to the consist, the train was 5,379 feet long, excluding the locomotives. 40 The accident site was about 3 miles east of the boundary between Harper and Barber Counties.

Factual Information 31 Railroad Accident Report About 7:00 a.m., the county dispatcher radioed all responding units that the BNSF had confirmed the presence of hazardous materials on the train and that information about the hazardous materials was being faxed to the dispatcher. Between 7:04 and 7:09 a.m., the EMC, the undersheriff, the Harper County fire chief, and the dispatcher conferred about the corrosive nature of the yellow smoke from the east fire. The EMC concluded that the drifting smoke might be toxic and directed the evacuation of all farms in its direction. He also directed the dispatcher to notify Barber County of these evacuations. About 7:16 a.m., the undersheriff, the Harper County fire chief, and an Attica firefighter walked into the west fire area to observe drums and other containers that had spilled from one or more of the derailed cargo containers. The undersheriff said that he did not look for hazardous materials labels but instead looked for product names on the packages and drums spilled from the cargo containers.41 The undersheriff later advised Safety Board investigators that the three men came within 30 to 40 feet of the burning containers and within 5 feet of spilled barrels from a cargo container. The undersheriff did not observe any release or leakage from these barrels, but noted that product information on the barrels indicated they contained isopropyl palmitate (not regulated as a hazardous material by the Department of Transportation [DOT]). The undersheriff also stated that the county fire chief and Attica firefighter saw containers labeled “sodium hydroxide” and “nitric acid” (both of which are regulated as corrosive materials). At 7:18 a.m., the Harper County fire chief radioed the dispatcher that barrels were out of a cargo container and some were bursting from pressure. The fire chief also advised the dispatcher that they had identified nitric acid in some of the spilled containers and were attempting to identify the contents of others. The undersheriff stated that he, the Harper County fire chief, and the Attica firefighter stayed out of the smoke area and that they were not wearing protective equipment. About 7:22, the county dispatcher called CHEMTREC (Chemical Transportation Emergency Center)42 and requested that a material safety data sheet for isopropyl palmitate be faxed. (CHEMTREC subsequently faxed that information and also copies of material safety data sheets for sodium hydroxide and nitric acid to the dispatcher.) As the undersheriff and the dispatcher were concluding the initial telephone call to CHEMTREC between 7:28 and 7:33 a.m., the deputy and conductor arrived at the command post to meet with the undersheriff and the county fire chief. The conductor told Safety Board investigators that during the meeting with the undersheriff and fire chief, he identified the section of the train that derailed and was on fire. The conductor stated that he also identified “several” of the hazardous materials carried in this section of the train and reviewed with the undersheriff emergency response information for some of the hazardous materials present in larger quantities. The undersheriff acknowledged that he and the fire 41 During depositions with Safety Board investigators, the undersheriff stated that he was “somewhat” familiar with the diamond-shaped DOT hazardous materials labels and placards. When the diamond-shaped placard for corrosive materials was described to him, the undersheriff stated he had never seen one. 42 CHEMTREC® was established in 1971 and is affiliated with the Chemical Manufacturers Association. CHEMTREC maintains an Emergency Call Center that provides around-the-clock emergency response information during hazardous materials accidents. The Emergency Call Center provides technical information and links chemical experts and resources with emergency responders.

Factual Information 32 Railroad Accident Report chief did not discuss the consist with the conductor in detail, spending 5 to 10 minutes at most reviewing it. The undersheriff stated they confirmed only the chemicals or products that they had seen. The conductor and deputy departed the command post about 7:45 a.m. and returned to the head end of the train about 8:00 a.m. The conductor had no further contact with either incident commander before departing the scene about 11:00 a.m. Shortly before 8:00 a.m., the undersheriff and the EMC jointly decided to evacuate residents within 5 miles of the accident. At 8:58 a.m., the EMC joined the undersheriff at the command post, where the undersheriff continued to ensure that evacuations were proceeding. As fire suppression and evacuation efforts continued, the two joint incident commanders and representatives of all fire departments met shortly before 9:30 a.m. and determined that the local departments were not adequately equipped to suppress the fire. The group further determined that water “drops” from a helicopter were needed to extinguish the fires. Arrangements for National Guard helicopters were then initiated through the Kansas Division of Emergency Management. By 9:39 a.m., the undersheriff had advised the dispatcher that helicopters were en route and that the evacuations had been completed. In the meantime, about 8:05 a.m., the BNSF trainmaster from Wellington, Kansas, arrived at the accident scene and encountered a firefighter.43 After identifying herself, the trainmaster asked the firefighter for the person in charge. The firefighter advised the trainmaster that the undersheriff was in charge but that he was unavailable and that she did not know his whereabouts. When the trainmaster asked her whether anyone else was available, the firefighter offered to help. The trainmaster told the firefighter that she had a complete consist with all of the hazardous materials information and asked whether the emergency responders needed this information. According to the trainmaster, the firefighter replied that the information was not needed because it was being faxed from the BNSF offices in Fort Worth. The trainmaster then told the firefighter that if no information was needed, she was going to the train. The trainmaster said she wanted to identify the last derailed car so that she would know exactly which cars were involved in the fires. The EMC later told Safety Board investigators that the firefighter had advised him between 8:05 and 8:15 a.m. that “Trainmaster Betty” (the first name of the Wellington trainmaster) had arrived and was looking for him with “some paperwork.” The EMC gave his location to the firefighter. The firefighter responded that she would relay the information to the trainmaster. The EMC remained at his location for approximately 1 hour but never saw the trainmaster. After speaking with the firefighter, the trainmaster went to the head end of the train, where she located the engineer. By 8:30 a.m., the trainmaster had met with the 43 The firefighter was identified during Safety Board depositions as a volunteer with the Attica fire department.

Factual Information 33 Railroad Accident Report conductor and the deputy about 1/2 mile from the west fire. The trainmaster stated that she could see that the last car remaining with the head portion of the train was the 17th car. The trainmaster further stated that this car was partially derailed and that two of six containers remained on the car’s first platform. Because the last car (the 17th) was leaning precariously, the trainmaster directed the train crew to cut the 15th and 16th cars apart but leave the 16th car coupled to the 17th car so that the remaining 15 cars that had not derailed would not turn over. The trainmaster then directed the train crew to move the remaining 15 cars 1,000 feet west to the first road crossing, 160th Avenue, which was done by 9:00 a.m. About that time, a second BNSF officer, an assistant trainmaster, arrived and met with the Wellington trainmaster. After conferring with the Wellington trainmaster, the assistant trainmaster proceeded to the derailment to map the positions of cars 16 through 20. He rejoined the Wellington trainmaster and the train crew at the head end of the train about 9:40 a.m. and, using a copy of the consist, determined that the 18th and 19th cars and some containers from the 17th car were possibly involved in the fires. Upon the arrival of a relief train crew shortly thereafter, the Wellington trainmaster and the original train crew returned to Wellington in order to conduct drug testing on the original crew. The assistant trainmaster and deputy then proceeded to a staging area near 150th Avenue, where, about 10:10 a.m., they met the undersheriff and the EMC. The assistant trainmaster advised the undersheriff and the EMC that he had the train consist and that any information that they needed from those documents was available. The undersheriff informed the assistant trainmaster that the documents had already been faxed to the emergency responders. About 10:15 a.m., the EMC returned to Anthony for a press conference and to survey the accident site from an airplane. About 11:15 a.m., the undersheriff also departed the scene to meet National Guard personnel at the Anthony airport about conducting the water drops and to survey the accident site by air. In their absence, the Harper County sheriff was the senior county official at the scene. At the accident scene, the assistant trainmaster was relieved as the BNSF officer- in-charge by an assistant vice president about 11:00 a.m.; upon being relieved, the assistant trainmaster gave his copy of the train consist to the assistant vice president. Other BNSF personnel also arrived at the accident site between 11:00 a.m. and 12:45 p.m., including the BNSF hazardous materials response team, railroad police, wreckage clearing and environmental cleanup crews, and the superintendent of operations. About 12:50 p.m., the joint incident commanders had returned to the command post. They convened a meeting with BNSF personnel by 1:00 p.m. During this meeting, the BNSF hazardous materials response team leader, the BNSF assistant vice president, and the superintendent of operations disagreed on whether to proceed with the helicopter water drops before identifying the burning cargo containers and their contents. The EMC agreed to delay dropping water on the fires until the hazardous materials response team had surveyed the fires to determine which containers were burning. The team surveyed the west fire by 2:00 p.m. and the east fire by 3:30 p.m.

Factual Information 34 Railroad Accident Report Railroad officials decided, based on the assessment of the hazardous materials response team, that water drops could be made safely. Although the 10 water drops made from the Kansas National Guard helicopter between 3:30 and 5:00 p.m. did not completely extinguish the fires, they reduced the flames’ intensity. Following the water drops, firefighters and equipment crews were able to enter the derailment area. There they directed water on the burning containers, used heavy equipment to pull the wreckage apart, and extinguished fires on the pulled-out wreckage. By 9:15 p.m., no flames or odors were reported, although white smoke remained. Barber County officials lifted the evacuation of Hazelton about 2:00 p.m. All roads were reopened by 4:15 p.m. Except for the four residents who lived near the derailment site, those evacuated were permitted to return to their homes by 5:00 p.m. At 12:33 a.m. on September 3, the undersheriff released control of the scene to the BNSF. EMS and fire units remained on the scene to provide contingency fire support. Hazardous Material Emergency Response Training Harper County Personnel Experience and Training Harper County is a rural agricultural county in south central Kansas along the Oklahoma border. The county covers 860 square miles and has a population of 8,000. The county has three all-volunteer fire departments, one each in the towns of Attica, Anthony, and Harper, with a total of 75 volunteers (Attica—25, Anthony—30, and Harper—20). Excluding the Kansas Highway Patrol, local law enforcement in the county consists of 1 full-time officer (the police chief) in Attica, 5 in Anthony, 3 in Harper, and 5 with the HCSD, for a total of 14 full-time police officers. The county also has two full-time paramedics, an emergency medical technician, and a secretary. The county does not have a full-time emergency management staff. The EMC stated that the security and emergency services structure in Harper County is standard for Kansas and many other rural areas. The EMC also acknowledged that he, the undersheriff, and other emergency responders were not familiar with the articulated container-type freight cars or the information contained on the train consist and that they were confused by the articulated multiplatform cars being listed as a single freight car. He said that he and the other emergency responders relied upon the BNSF hazardous materials experts for guidance and direction, particularly regarding the safest manner to extinguish the fires and to clear the accident site. EMC training and experience. The EMC was hired by Harper County as an emergency medical technician in 1983 and became a paramedic in 1986. One of two full- time paramedics for Harper County, he was appointed county emergency management coordinator as a collateral duty in April 1998, about 6 months before the accident.

Factual Information 35 Railroad Accident Report The EMC, as the emergency management coordinator, coordinates emergency and disaster planning between the fire departments, law enforcement agencies, emergency medical services, and other agencies within the county. The EMC also helps develop local emergency response plans and works with the local emergency planning committee. The EMC acknowledged that he was still learning about the position. The EMC stated that he had completed a State-provided course on the recognition and identification of hazardous materials in March 1990. He also stated that, in 1993, he had completed two 12-hour courses (Hazard Incident Analysis and Incident Command System) offered through the National Fire Academy. He further stated that he had attended a portion of the BNSF class for emergency responders in April 1998. (See the next section for information on the training provided by the BNSF.) Undersheriff training and experience. The undersheriff served with the Anthony, Kansas, police department as a patrolman from 1975 to 1981 and then as the Chief of Police from 1981 to 1987. After a 10-year hiatus from law enforcement, he had joined the HCSD in March or April 1997, where he was promoted to undersheriff in December 1997. Before the Crisfield derailment, the undersheriff had served as incident commander for one other hazardous materials accident, which occurred when he was the Anthony, Kansas, chief of police. The previous accident involved the release and explosion of propane from a tank truck that ruptured after backing into a building. The undersheriff stated that although he was aware BNSF trains carried hazardous materials, he was not familiar with the types and quantities of hazardous materials transported through Harper County. He also acknowledged that had he known the types and quantities, he probably would not have understood their significance. The undersheriff stated that since his employment with the HCSD, he had attended a 1-day training session on hazardous materials response provided by Phillips Pipeline Company in 1997. The training involved the simulated rupture of a 24-inch-high pressure pipeline. The undersheriff had not taken any of the BNSF’s emergency response training because of schedule conflicts. BNSF Training Program for Emergency Responders The BNSF conducts hazardous materials awareness training for community emergency responders throughout its operating system. The director of hazardous materials estimated that about two-thirds of the training results from direct community requests,44 while the remaining training is scheduled through BNSF initiatives, such as 44 Local emergency response organizations are encouraged to plan and train for hazardous materials accidents and to utilize the training equipment and instructors that are offered through private companies, such as carriers and shippers of hazardous materials, under the Transportation Community Awareness and Emergency Response program. The TRANSCAER® program is a nationwide community outreach program jointly sponsored by the AAR, the Chemical Manufacturers Association, the National Association of Chemical Distributors, the National Tank Truck Carriers, the American Petroleum Institute, the Hazardous Materials Advisory Council, the American Trucking Associations, and the Chlorine Institute.

Factual Information 36 Railroad Accident Report “whistle-stop” tours. In addition, the BNSF, in cooperation with the University of Kansas Law Enforcement Training Center, provides hazardous material awareness training to every graduating class of State law enforcement officers. A typical community training program lasts about 4 to 5 hours and includes about 2 1/2 hours of classroom instruction. The classroom instruction covers the material in a 45-page hazardous materials awareness handbook45 that is given to each participant. The handbook provides basic information about railroad operations, placarding and marking of hazardous materials railcars and containers, hazardous materials shipping papers (waybills and bills of lading), and types of rail cars (tank cars and intermodal container cars). The handbook also gives definitions of chemical properties and contains sample consists and emergency response information for the types of freight trains that can carry hazardous materials. In addition, the training includes a damage assessment module for tank cars and a review of the decisions and options facing an incident commander during an actual derailment. The balance of the training is spent on some or all of the following activities: viewing a training film on tank car explosions, examining an actual tank car, or training on the BNSF training tank car. According to the director of hazardous materials, the BNSF provided this system-wide training for 2,899 community responders in 1996, 2,540 in 1997, and 2,355 during the first 9 months of 1998. Three BNSF instructors conducted hazardous materials awareness training on April 4, 1998, in Harper, Kansas, for county law enforcement, EMS, and fire department personnel. BNSF training records indicate that 35 persons attended. Of the 35, which included the EMC, 2446 were affiliated with the fire departments, EMS, or the 911 dispatcher within Harper County. The Harper County undersheriff did not attend. State Initiatives and Actions In 1997, the Governor of Kansas formed a task force to study the capabilities of State and local public safety agencies for all types of incidents and disasters. The task force’s final report in 1997 cited as the most needed improvement an increase in the resources for stabilizing hazardous materials incidents so that people and the environment are protected and cleanup costs are reduced. The Governor’s staff asked State agencies, such as the Division of Emergency Management, the Highway Patrol, and the Fire Marshal, for proposals on providing the support of trained persons and equipment to local jurisdictions to assist with hazardous materials incidents. During the 1998 legislative session, the Division of Emergency Management and the Highway Patrol introduced proposals to improve hazardous materials response. Representatives from the Fire Marshal’s office and fire service organizations met in early 1998 to discuss options for the establishment of a statewide hazardous materials response 45 BNSF, January 1998. 46 The towns of Attica, Anthony, and Harper have a total of 92 volunteer and professional emergency responders.

Factual Information 37 Railroad Accident Report system. After several months, local and State agencies finalized a proposal that became law during the 1999 legislative session. The hazardous materials response program established under this legislation was authorized to commence on July 1, 1999. The program is administered by the State Fire Marshal and managed by a full-time director. When fully implemented in late 2001, the program will have two components—a response program and a training program.47 The response program will provide trained and equipped hazardous materials response teams to assist local jurisdictions in handling hazardous materials incidents within geographical response regions established by the program. Professionally staffed fire departments or other “host agencies” with established hazardous materials response teams will be selected to provide services and assistance to jurisdictions without teams. In turn, the professional departments/agencies will receive funding and grants from the State to defray the expenses of providing this support. According to the Office of the Kansas State Fire Marshal, complete State coverage is planned by late 2001. Under the program’s training component, a hazardous awareness program will be developed and provided on a continuous basis to all emergency responders statewide. The development of a hazardous materials technician class to be offered two to three times per year will follow. The development of an advanced hazardous materials operations level class is also being considered. The Fire Marshal’s office and the Kansas Division of Emergency Management will jointly oversee the development, delivery, and financing of the training program. The interim director of the overall program indicated that after a training coordinator is hired, the training programs will be implemented. 47 A May 22, 2000, letter from Office of the Kansas State Fire Marshal to the Safety Board revised the implementation dates for the response and training programs from mid- to late 2001.

38 Railroad Accident Report Analysis Exclusions BNSF inspection records revealed no mechanical defects for BNSF train S-CHILAC1-31 on September 1, the day before the accident. Postaccident examinations found no evidence of additional preexisting defects beyond the structural failure of the car. The weather at the time of the accident was clear. In addition, postaccident equipment inspections and crew statements indicated the weather did not impair the performance of the accident train crew or equipment. Postaccident testing and review of BNSF records showed that the signal and train control systems functioned as designed. Postaccident track inspections and a review of maintenance-of-way records revealed no contributory track anomalies. The Safety Board therefore concludes that the train’s braking systems, the train’s signal and control systems, the weather, and the track conditions did not cause or contribute to the accident. Safety Board investigators examined whether train crew fatigue may have been a factor in the accident. The train crew had been operating the train for only about an hour before the derailment. BNSF records indicate that the engineer had been provided ample opportunity for rest before the derailment, and both crewmembers stated that they were well rested upon reporting for duty; no direct evidence suggests that the crewmembers were fatigued. Event recorder data indicated that all throttle and braking actions were normal and in accordance with accepted train-handling practices and that the engineer appeared to be alert. In addition, a postaccident analysis of in-train forces (wheel lift) showed that train handling and speed did not cause or contribute to the derailment. Both crewmembers were qualified to perform their duties according to BNSF procedures, as approved by the FRA, and both crewmembers had passed their most recent rules examinations. Postaccident toxicological tests of the crewmembers were negative for drugs and alcohol. The Safety Board therefore concludes that train handling, train crew qualifications, and train crew fatigue or impairment by drugs and alcohol did not cause or contribute to the accident. The release of hazardous materials in this accident was caused by the derailment forces, which led to breakage and failure of the individual hazardous material packages within the cargo containers on the intermodal cars. The release of certain hazardous materials, particularly the nitric acid, probably caused the ensuing fire.48 No evidence indicated that inferior packaging or inadequate blocking and bracing of the hazardous materials packages within the cargo containers49 caused the release of hazardous material. The Safety Board concludes that although the release and ignition of hazardous materials 48 Nitric acid, when spilled on cardboard, wood, and other commonly used packing materials, can cause them to ignite. 49 Cargo containers OOLU 555493 and HDMU 228010.

Analysis 39 Railroad Accident Report complicated emergency response efforts, their packaging and shipment did not cause or contribute to the accident. Accident Discussion The accident occurred when a platform of articulated car DTTX 72318 separated between the floor shear plate and the bulkhead bottom angle, allowing the car to sag below the rails, catch a part of a switch, and derail. All of the parties to the investigation of this accident, including the manufacturer (Thrall), the car owner (TTX Company), the FRA, the AAR, the BNSF, and the UP, have found that all previous weld failures between the floor shear plate and the bulkhead bottom angle on Thrall 125-ton deep-well double-stack cars resulted from the placement of a loaded container on top of a hard foreign object. All agree and have concluded that these weld failures were the direct result of such misloadings. Investigators found that the cracks discovered in Thrall cars were not related to car age, mileage, service pattern, maintenance, or previous repairs but to stress forces caused by the presence of a foreign object on the floor of these cars. The UP inspections of Thrall cars that ultimately prompted EW-161 provide additional evidence of this phenomenon. Further, inspections of 1,653 cars still in service since EW-161 was issued, in December 1997, have resulted in the repairs of 27 Thrall double-stack container cars, all of which had damage due to foreign objects. No evidence suggests that any of the weld failures found by the FRA or during the EW-161 inspections were the result of any other condition or phenomenon. Therefore, the Safety Board concludes that a direct causal relationship exists between the misloading of a loaded container on top of a hard foreign object and the weld failures at the floor shear plate to bulkhead bottom angle on Thrall 125-ton deep-well double-stack cars. Since the accident car displayed all of the characteristics inherent in a weld failure due to such misloading, the parties to the investigation were convinced that the initial weld failure occurred as a result of the placement of a loaded container on a hard foreign object. No empirical evidence or evidence from the metallurgical examination supports any other conclusion. Therefore, given the nature and location (bulkhead to bottom angle) of the crack and the similar problems caused by foreign objects in the wells of Thrall cars, the Safety Board concludes that DTTX 72318’s original 20-inch lateral fatigue crack was most likely caused by the misloading of a container onto a foreign object. The postaccident examination revealed that an improper and undocumented repair of the original 20-inch floor crack had been attempted. An 8-inch-long bolt had been improperly welded between the floor shear plate and bulkhead bottom angle as filler metal to bridge the original crack. The repaired area had been painted over. However, a portion of the repaired crack at the bottom of the floor shear plate had not been covered with weld. Under the stress of service, this area became a stress raiser, which caused secondary cracking to extend outside the original 20-inch lateral fatigue crack. The repair area separated during service because of this stress raiser and because of the reduced thickness

Analysis 40 Railroad Accident Report of the weld repair (0.2 inch), compared to the wall thickness of the shear plate (0.5 inch). Thus, the repair was strictly cosmetic and merely covered, rather than repaired, the cracking. The 20-inch lateral fatigue crack started at the bottom of the floor shear plate and propagated up through the floor. The upward crack propagation and the down deformation on the floor in the area of the repair are consistent with a downward stress on the floor of the car. Such a downward stress is caused by a localized stress point, typical of a scenario in which a foreign object lodges between the cargo and floor of the car. The separation of the repair weld, in turn, caused secondary fatigue cracking of the web at the floor shear plate and top of the corner post angles. These secondary cracks can most likely be attributed to growth of the lateral gaping crack at the bottom of the railroad car. The metallurgical investigation did not determine whether the secondary fatigue cracks were caused by foreign objects lodged between the floor and cargo or by lateral cracking that extended beyond the weld repair area. Nevertheless, judging by the low striation count on the fracture of each secondary fatigue crack, a significant portion of each secondary fatigue crack appears most likely to have occurred after the weld repair had separated and as the floor of the car had begun to sag. The painting of the repair area, which would suggest a preexisting condition, and the presence of primary and secondary fatigue are indicative of a long-term cracking problem, not derailment damage. Safety Board investigators, TTX Company, Thrall, and the AAR attempted to discover the history of the improper repair to DTTX 72318. The Safety Board reviewed Thrall car repair records and histories of cars experiencing cracking or structural failure to determine why the improper repair may have been made to DTTX 72318. However, the absence of records for this repair and the conflicting records on the car’s location made it impossible to realistically determine who made the repair or when the repair was made. The lack of documentation for the repair made to DTTX 72318 prevents the Safety Board from determining definitively the cause of the original 20-inch lateral fatigue crack. The Safety Board is deeply concerned about these database discrepancies. To improve accountability for railroad equipment and to aid in future accident investigations, the Safety Board believes that the Federal Railroad Administration should audit the Association of American Railroads and individual railroad equipment repair databases to determine whether adequate quality control procedures have been incorporated to ensure that database information is complete, accurate, and secure. In addition, the Safety Board believes that the Federal Railroad Administration should direct the Association of American Railroads and the individual railroads to correct all identified deficiencies. Industry Response to Thrall Car Weld Failures The Safety Board examined the adequacy and timeliness of the railroad industry’s response to the cracks in the Thrall 125-ton double-stack cars, including the adequacy and timeliness of the one-time inspection as outlined by EW-161. Table 4 summarizes the history of these activities.

Analysis 41 Railroad Accident Report In the Safety Board’s opinion, the AAR reacted expeditiously once the UP had gathered sufficient evidence to determine that Thrall 125-ton double-stack cars manufactured since 1988 were experiencing cracking problems. The AAR issued EW-161 on December 10, 1997, less than 3 weeks after UP personnel discovered cracks between the floor shear plate and bulkhead bottom angle on two Thrall cars. This was a timely response to a potentially catastrophic car structural problem. Nonetheless, the Safety Board also examined whether the one-time inspection was adequate. The Thrall cars had been in interchange for 9 years (1988 to 1997), and three cracking problems had been recorded before the UP began its inspections. From December 10, 1997, to August 1999 (21 months), 1,848 Thrall cars were inspected. Of those, 27 required repairs for cracked or broken floor shear plates. These failures were consistent with fractures caused by improper loading of a container onto a foreign object. As noted earlier, Thrall stated it is uncertain how long a misloaded car will operate before structural failure occurs. The Safety Board concludes that the one-time inspection as directed by the AAR’s EW-161 was timely and sufficient to diagnose the extent of the cracking problem and possibly to reduce or prevent accidents in the short term. Table 4. Industry response timeline Event Dates Thrall 125-ton double-stack cars introduced into service. 1988 Cracked floor shear plate found on a Thrall 125-ton double-stack car during a Chicago train yard inspection. July 1993 Thrall informed of cracked floor shear plates on two cars. January 1997 July 1997 UP reports cracked floor shear plates on two more cars. Both sent to Thrall for further inspection and repair. November 1997 UP begins inspecting DTTX 125-ton double-stack cars for cracking, particularly where the floor shear plate meets the bulkhead bottom angle. Damage attributable to a foreign object found in five cars with cracked floor shear plates. UP Mechanical Department informs the AAR, Thrall, and TTX Company of inspection results and of its concern that a safety problem exists. November 1997 AAR Intermodal Car Performance Committee holds teleconference to discuss the floor cracking problem. By that time, the UP had inspected 303 DTTX cars and found evidence of a cracking problem. December 4, 1997 AAR issues EW-161 to 1,200 interchange subscribers informing them of cracks and directing inspection of Thrall 125-ton double-stack cars manufactured since 1988. December 10, 1997 EW-161 inspections conducted of 1,653 TTX Company cars at 34 intermodal loading facilities; 71 cars sent to repair facilities for closer inspection and 27 cars repaired. By August 15, 1999, all but five cars had been inspected. December 1997 through August 1999

Analysis 42 Railroad Accident Report Adequacy of Preloading Inspection Standards and Training Loading a container onto a foreign object, such as a track spike, brake shoe, or IBC, is the only type of “improper securement” noted in AAR container loading and securement standards and inspection forms that is undetectable once the container is loaded. This is particularly true for longer containers, on which it is difficult to see whether one end of the container is higher than the other and possibly resting on a foreign object. If the end of a 40- or 48-foot-long container is raised no more than 6 inches, it may still appear level and pass any overhead clearance restrictions. Thus, the only effective way to ensure that foreign objects have been removed or that the car is “clean” is to inspect the car well when it is empty. However, current methods of loading do not ensure that this occurs. The emphasis placed on postloading and predeparture inspections is illustrated by the earlier descriptions given to the Safety Board investigators of inbound and outbound inspection procedures by the Conrail carman at Croxton Yard and the two BNSF carmen at Corwith Yard and by the AAR’s Standard Operating Procedure for Intermodal Securement, inspection forms, and related training videos. Such an emphasis on postloading and predeparture inspections belies the importance of preloading inspections to ensure that car wells contain no foreign objects. The procedures outlined by the Croxton and Corwith carmen illustrate actual operating conditions for many intermodal ramp operations, under which it is difficult to perform preloading inspections. At Croxton, the carman and the contractor personnel were allowed to work the train simultaneously. The Croxton carman stated that the container cars were not always empty when he inspected them because the contractor crew routinely unloaded containers from the inbound train and immediately loaded the train for the outbound movement. The carman said that most of the time he followed the contractor crew while conducting his inspections to avoid injury and to avoid getting in the way of the loaders. Therefore, the carman could not perform a consistent, comprehensive inspection of the car wells for foreign objects. In addition, the Croxton carman stated that he conducted his night inspections from a repair truck with a search light. He said that although he was positioned to observe both the car’s condition and the container’s position, he would have been unable to completely see the floor of an empty car. Therefore, at each point, the carman’s inspection was focused on ensuring the securement of the loads and the operation of car safety appliances before departure and not on inspecting the car wells for foreign objects. When the car was placed in the accident train, the only opportunity to inspect the cars was the predeparture inspection conducted by the Croxton carman. Since DTTX 72318 was already loaded by the time it had arrived at Chicago, the Corwith carmen could not have determined whether the car was structurally sound (beyond the obvious sagging or structural failure) or have seen whether a container was loaded on top of an object. The Corwith carmen’s inspection was limited to postloading, predeparture securement items

Analysis 43 Railroad Accident Report emphasized in the AAR training and inspection forms. This situation is typical of many intermodal facilities, where postloading securement, not preloading inspection, is emphasized. The Safety Board, therefore, concludes that current preloading inspection procedures are inadequate to ensure that foreign objects are detected on the floors of well cars, particularly Thrall 125-ton double-stack cars. Despite the fact that the AAR SOP requires that foreign objects be removed from rail car wells or surfaces, inspecting the wells of intermodal cars before loading is not included as a safety check on the AAR Intermodal Securement Safety Audit Form, nor is it listed as a securement failure on the Internal and Inter-road Securement Failure Report. Although these forms cover postloading and predeparture securement and inspection comprehensively, the only preloading consideration is to ensure that containers and trailers are structurally sound with closed and locked doors and that trailer hitches, IBCs, and other loading equipment are in safe working order. In short, the primary emphasis is on the importance of load securement and postloading inspection. In the latest AAR video, the removal of foreign objects is briefly mentioned by a narrator, standing next to an intermodal flatcar, who says, “Ice and snow can build up and prevent a container from making proper contact. Brake shoes, IBCs, and rocks can also prevent a container from seating properly, so remember to remove these items before loading a container.” This segment takes about 30 seconds of the 17-minute video and could be easily missed. The topic of removing foreign objects before loading intermodal cars is mentioned in passing without emphasis or example, and the only reason cited for its importance is the need to ensure the container is seated correctly. The FRA has no inspection standards and procedures for intermodal cars. The Safety Board concludes that had the railroad industry or the Federal Railroad Administration placed sufficient emphasis on ensuring a complete preloading inspection of all well cars, the structural failure of DTTX 72318 may not have happened. The Safety Board also concludes that the EW-161 inspections did not address the root cause of the resulting structural failures: loaded containers placed on foreign objects on the floors of double-stack container cars. The Safety Board further concludes that to prevent the structural failure of double-stack container cars, all such cars must be inspected while empty to ensure that foreign objects are eliminated from the wells and platforms. This inspection can best be done at the intermodal facilities as part of a comprehensive program that focuses not only on postloading securement but also on preloading conditions when the car is empty. Since the Class I railroads own or control the intermodal terminals and the majority of intermodal equipment and cars, and since they coordinate intermodal operations and standards through the AAR Intermodal Committee, the Safety Board believes that the Class I railroads should: • Require intermodal loading facilities to inspect double-stack well car floors before loading and remove any foreign objects.

Analysis 44 Railroad Accident Report In addition, the Safety Board believes that because of its oversight responsibility for the Class I railroads, the Federal Railroad Administration should: • Require that double-stack well car floors be inspected and that all foreign objects be removed before loading. In addition, the Safety Board believes that the AAR should: • Revise training and instructional materials to emphasize the necessity of conducting a thorough preloading inspection of container cars while empty, particularly double-stack cars, to ensure the removal of foreign objects before loading. The training should also discuss the consequences of not conducting such inspections. • Revise intermodal container loading and securement standards, including Standard Operating Procedures for Intermodal Securement, to emphasize the necessity of conducting a thorough preloading inspection of intermodal cars while empty, particularly double-stack cars, to ensure the removal of foreign objects before loading. • Revise the Intermodal Securement Safety Audit Form to include, as a safety check item, the removal of all foreign objects from double-stack cars before loading. • Revise the Internal and Inter-road Securement Failure Report to include, as a reportable failure, the misloading of a container onto a foreign object. The Safety Board also examined the FRA’s response to the Thrall car floor shear plate failures. In the short term, because the railroad industry reacted with relative dispatch to this problem, the FRA only monitored subsequent remedial actions by the industry to inspect and repair the affected car fleet. To address long-term solutions to intermodal equipment problems, the FRA is now conducting a nationwide intermodal securement safety audit focusing on topics such as loading practices and the removal of foreign objects from car wells. The 18-month safety audit begun in October 1999 should be completed in April 2001. One result of the FRA audit will be to determine whether new regulations regarding intermodal industry practices are needed. Railroad intermodal traffic has increased an average of about 15 percent per year, from 3 million trailers and containers in 1980 to over 8.7 million in 1997. Intermodal traffic accounts for more than 17 percent of railroad industry revenue, second only to coal, at 22 percent. The BNSF’s Director of Hazardous Materials estimated that, in 1999, roughly half of its hazardous materials were transported intermodally. In addition, according to 1998 AAR statistics, 486,300, or 5.6 percent, of the 8,772,663 total intermodal shipments in the United States consisted of hazardous materials. Such statistics prompt the Safety Board to recommend that more immediate action be taken to develop comprehensive safety inspection standards and procedures for all intermodal cars. Such procedures must include inspections of those areas of cars that have been identified as subject to misloading and catastrophic structural failure. In addition, the procedures

Analysis 45 Railroad Accident Report should address other issues ultimately identified in the FRA’s audit. Therefore, the Safety Board believes that the FRA should revise 49 Code of Federal Regulations Part 215 to include comprehensive safety inspection standards and procedures for all intermodal cars. Modification or Redesign of Container Cars According to Thrall, no one in the industry foresaw the problems that could be caused by the misloading of loaded containers onto foreign objects in the wells of Thrall 125-ton double-stack cars. As was noted earlier in this report, placing a loaded container onto a foreign object in the car well creates stresses that can significantly exceed the car’s floor strength. Although Thrall has developed a new floor plate design that is much more resistant to foreign object retention, the company states that retrofitting existing equipment with the new floor design would be economically prohibitive. To date, cracked floor shear plates have been dealt with using various methods, including replacing the floor shear plates or reinforcing the area joining the floor shear plate and bulkhead bottom angle with doubler plates. Thrall states that the costs of labor and materials to replace floor shear plates for the entire car fleet would be prohibitive, particularly if all cars of similar floor design were modified. In addition, Thrall states that to effectively compensate for the stress forces created by misloaded containers, doubler- plate or other reinforcement methods would have to substantially increase the floor plate’s thickness, in turn, significantly increasing the car’s weight and decreasing its carrying capacity. Thrall, TTX Company, and the AAR testified that retrofitting existing double-stack equipment with a new floor design is economically prohibitive. While the Safety Board recognizes that retrofitting existing equipment with a new floor design may be expensive, the application of doubler plates and the implementation of complete inspection procedures are prudent actions. The Safety Board agrees that doubler plates will not prevent the eventual failure of a misloaded car, but such an application will increase the chance that the car will arrive at a location where it can be inspected before failure. Cars of similar floor design to the accident car may be susceptible to the same structural failure caused by the misloading of a loaded container on a foreign object. Therefore, the Safety Board believes that the Association of American Railroads should conduct a study to determine whether other double-stack cars similar in design to the Thrall 125-ton model are also susceptible to misloading and whether remedial actions would be appropriate.

Analysis 46 Railroad Accident Report Response to Hazardous Materials Release Overview Emergency response efforts by Harper County emergency responders and by the BNSF were successful, given that no injuries resulted from chemical exposure, that the fires involving the cargo containers from the train were safely extinguished, and that the environmental cleanup was promptly undertaken. Local emergency responders, including the county dispatcher’s office, made timely initial notifications, enabling the local fire departments and law enforcement authorities to respond promptly. The EMC and the undersheriff, as the joint incident commanders, appropriately made the safe evacuation of residents at risk from smoke from the chemical fires their first priority. They also recognized that the orange smoke was a good indication that hazardous materials might be involved in the fires. Consequently, they sought out the train crew to get information about the hazardous materials on the train that might be involved. In addition, the county dispatcher correctly contacted BNSF Fort Worth for a copy of the consist and sought assistance from other appropriate agencies and organizations, for example, the Kansas National Guard and CHEMTREC. Immediately following the derailment, the train conductor attempted to determine which cars were involved in the derailment and what hazardous materials were on the train and to provide this information to emergency responders. The Wellington trainmaster and the assistant trainmaster both offered their assistance to emergency responders and also tried to determine which hazardous materials were involved in the derailment and fires. The BNSF dispatched and utilized the appropriate resources, such as hazardous materials response teams, wreckage clearing personnel and equipment, and environmental cleanup crews. During the late morning hours, as hazardous materials response personnel, wreckage clearing personnel, and other resources arrived at the scene, emergency response agencies and the BNSF worked together to evaluate the best method for extinguishing the fires and mitigating the chemical spills. Thus, overall, the emergency response outcome was positive. Harper County Emergency Preparedness Nevertheless, the following actions and conditions indicate a lack of training and expertise among Harper County emergency response personnel in managing a hazardous materials accident or incident: • The undersheriff (one of the incident commanders) and fire personnel entered the west fire area without personal protective equipment to identify drums of unknown material on the ground. • The initial staging area for responding fire departments was established about 100 yards south of the west fire, even though emergency responders did not know at that time what was burning or the types of containers involved.

Analysis 47 Railroad Accident Report • A volunteer firefighter advised the BNSF trainmaster from Wellington that the consist was not needed, that no additional information was required, and that the incident commander was unavailable. Both incident commanders later stated that the firefighter did not have the authority to make those judgments. The firefighter failed to recognize that the trainmaster was the first arriving officer from the railroad and should have been taken to the incident commander. • Local firefighters were ready to make water drops without knowing the contents of the burning containers. • The two joint incident commanders (the undersheriff and the EMC) both left the scene during an overlapping interval of 1 hour during the late morning. Although the county sheriff remained at the scene, there was no indication that he ever assumed the responsibilities of the incident commander. • The two joint incident commanders lacked a working familiarity with the information contained in train consists; for example, they were confused by articulated multiplatform cars being listed as a single freight car. • The joint incident commanders had virtually no experience or training in managing a train derailment or a transportation accident involving the release of hazardous materials. Upon the arrival of senior BNSF officers, hazardous materials response teams, and wreckage clearing teams about noon, the two incident commanders both acknowledged that they then relied upon the expertise of BNSF officials for methods of extinguishing the fires and dealing with hazardous materials that had been released. Further, although approximately one-third of the county’s volunteer firefighters and other responders attended training provided by the BNSF in April 1998, less than 6 months before the accident, neither incident commander had completed the training. In addition, the EMC, a full-time paramedic, had performed the responsibilities of the county’s emergency management coordinator as a collateral duty for less than 6 months before the accident. Fire departments and other emergency response organizations that depend upon volunteers often do not have the equipment or level of training found in professionally staffed departments and agencies. Nonetheless, the problems noted above, such as staging personnel and equipment too close to burning containers, entry into danger zones without knowledge of the materials involved or without personal protective equipment, and the departure of both incident commanders from the scene, demonstrate a lack of a awareness and adherence to fundamental principles that should be followed in any hazardous materials accident. The incident commanders’ lack of experience and training was also indicative of Harper County’s inadequate emergency preparedness. Consequently, the Safety Board concludes that the Harper County emergency response agencies took or created unnecessary risks during the response to the Crisfield derailment because of inadequate emergency preparedness planning and training.

Analysis 48 Railroad Accident Report State Oversight for Emergency Preparedness The deficiencies in Harper County’s emergency preparedness prompted the Safety Board to examine Kansas programs that oversee and evaluate emergency preparedness and to examine planning for hazardous materials incidents at the county and local levels. The Safety Board learned that, in addition to implementing emergency planning requirements mandated under Federal environmental laws, Kansas is implementing and funding a State-initiated hazardous materials response program. The program was developed in response to the Governor’s concerns about the ability of local jurisdictions to respond to and effectively manage hazardous materials incidents. When fully implemented in late 2001, the program will ensure that a professionally staffed and trained hazardous materials response team is available to every local jurisdiction and that local emergency responders receive upgraded and standardized hazardous materials response training. Although the State program was not developed or implemented as the direct result of the Crisfield accident, the Safety Board believes that it will correct the deficiencies that occurred in the Crisfield accident as a result of Harper County’s reliance upon volunteer emergency responders, who often lack the equipment and training to effectively manage a hazardous materials incident. The training provided by the State-initiated plan will, in the Safety Board’s opinion, significantly improve emergency preparedness in Harper County and throughout the State. The Safety Board recognizes Kansas’ initiative in addressing this issue.

49 Railroad Accident Report Findings Conclusions

1. The train’s braking systems, the train’s signal and control systems, the weather, and

the track conditions did not cause or contribute to the accident.

1. Train handling, train crew qualifications, and train crew fatigue or impairment by

drugs and alcohol did not cause or contribute to the accident.

1. Although the release and ignition of hazardous materials complicated emergency

response efforts, their packaging and shipment did not cause or contribute to the accident.

1. A direct causal relationship exists between the misloading of a loaded container on

top of a hard foreign object and the weld failures at the floor shear plate to bulkhead bottom angle on Thrall 125-ton deep-well double-stack cars.

1. Given the nature and location (bulkhead to bottom angle) of the crack and the similar

problems caused by foreign objects in the wells of Thrall cars, DTTX 72318’s original 20-inch lateral fatigue crack was most likely caused by the misloading of a container onto a foreign object.

1. The lack of documentation for the repair made to DTTX 72318 prevents the Safety

Board from determining definitively the cause of the original 20-inch lateral fatigue crack.

1. The one-time inspection as directed by the Association of American Railroads’ Early

Warning Letter 161 was timely and sufficient to diagnose the extent of the cracking problem and possibly to reduce or prevent accidents in the short term.

1. Current preloading inspection procedures are inadequate to ensure that foreign

objects are detected on the floors of well cars, particularly Thrall 125-ton double- stack cars.

1. Had the railroad industry or the Federal Railroad Administration placed sufficient

emphasis on ensuring a complete preloading inspection of all well cars, the structural failure of DTTX 72318 may not have happened.

1. The Early Warning Letter 161 inspections did not address the root cause of the

resulting structural failures: loaded containers placed onto foreign objects on the floors of double-stack container cars.

Findings 50 Railroad Accident Report

1. To prevent the structural failure of double-stack container cars, all such cars must be

inspected while empty to ensure that foreign objects are eliminated from the wells and platforms.

1. Harper County emergency response agencies took or created unnecessary risks during

the response to the Crisfield derailment because of inadequate emergency preparedness planning and training. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the structural failure of intermodal car DTTX 72318 due to fatigue cracking initiated when a container was misloaded onto a foreign object. The misloading of the container occurred because of the railroad industry’s inadequate preloading inspection procedures for double-stack well cars. Contributing to the accident was the improper and undocumented repair of the car.

51 Railroad Accident Report Recommendations To the Federal Railroad Administration: Audit the Association of American Railroads and individual railroad equipment repair databases to determine whether adequate quality control procedures have been incorporated to ensure that database information is complete, accurate, and secure. Direct the Association of American Railroads and the individual railroads to correct all identified deficiencies. (R-00-9) Require that double-stack well car floors be inspected and that all foreign objects be removed before loading. (R-00-10) Revise 49 Code of Federal Regulations Part 215 to include comprehensive safety inspection standards and procedures for all intermodal cars. (R-00-11) To the Class I Railroads: Require intermodal loading facilities to inspect double-stack well car floors before loading and remove any foreign objects. (R-00-12) To the Association of American Railroads: Revise training and instructional materials to emphasize the necessity of conducting a thorough preloading inspection of container cars while empty, particularly double-stack cars, to ensure the removal of foreign objects before loading. The training should also discuss the consequences of not conducting such inspections. (R-00-13) Revise intermodal container loading and securement standards, including Standard Operating Procedures for Intermodal Securement, to emphasize the necessity of conducting a thorough preloading inspection of intermodal cars while empty, particularly double-stack cars, to ensure the removal of foreign objects before loading. (R-00-14) Revise the Intermodal Securement Safety Audit Form to include, as a safety check item, the removal of all foreign objects from double-stack cars before loading. (R-00-15)

Recommendations 52 Railroad Accident Report Revise the Internal and Inter-road Securement Failure Report to include, as a reportable failure, the misloading of a container onto a foreign object. (R-00-16) Conduct a study to determine whether other double-stack cars similar in design to the Thrall 125-ton model are also susceptible to misloading and whether remedial actions would be appropriate. (R-00-17) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member CAROL J. CARMODY Member Adopted: July 17, 2000

53 Railroad Accident Report Appendix A Key Specifications for DTTX 72318 Length (over couplers) 291 feet 5 inches Width 9 feet 11 inches Carrying capacity Nominal 602,000 pounds, or approximately 60 tons (121,500 pounds) per well End trucks (A and B) 33-inch-diameter wheels Intermediate trucks (C, D, E, and F) 38-inch-diameter wheels, empty-load brake valves Hand brakes Mounted at end of each car; only A, B, C, and F trucks braked Type AAR S566: S—stack; 5—40-foot-long (interior dimension) end wells and 48-foot-long (interior dimension) intermediate wells; 6—Five wells; IBC type heavy capacity (125-ton trucks); 6—Combination of containers car designed to carry.* *Each of DTTX 72318’s five platforms, or wells, was designed to carry containers stacked two high: two 20-foot or one 40-foot container(s) in the two end wells and one 40-, 45-, or 48-foot container in the three intermediate wells with one 40-, 45-, or 48-foot container stacked on top of all wells and 53-foot containers stacked only on top of the intermediate wells. For further information, read AAR Operations and Maintenance Department Customer Operations Division UMLER [Universal Machine Language Equipment Register] Data Specification Manual, Section IX, effective July 1, 1997.

FD07231 ｜ 2001_美国_AAR0101.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 AIRCRAFT ACCIDENT REPORT PB2001-910401 NTSB/AAR-01/01 DCA91MA023 Uncontrolled Descent and Collision With Terrain United Airlines Flight 585 Boeing 737-200, N999UA 4 Miles South of Colorado Springs Municipal Airport Colorado Springs, Colorado March 3, 1991 5498C

this page intentionally left blank

Aircraft Accident Report Uncontrolled Descent and Collision With Terrain United Airlines Flight 585 Boeing 737-200, N999UA 4 Miles South of Colorado Springs Municipal Airport Colorado Springs, Colorado March 3, 1991 NTSB/AAR-01/01 PB2001-910401 National Transportation Safety Board Notation 5498C 490 L’Enfant Plaza, S.W. Adopted March 27, 2001 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2001. Uncontrolled Descent and Collision With Terrain, United Airlines Flight 585, Boeing 737-200, N999UA, 4 Miles South of Colorado Springs Municipal Airport, Colorado, Springs, Colorado, March 3, 1991. Aircraft Accident Report NTSB/AAR-01/01. Washington, DC. Abstract: This amended report explains the accident involving United Airlines flight 585, a Boeing 737-200, which entered an uncontrolled descent and impacted terrain 4 miles south of Colorado Springs Municipal Airport, Colorado Springs, Colorado, on March 3, 1991. Safety issues discussed in the report are the potential meterological hazards to airplanes in the area of Colorado Springs; 737 rudder malfunctions, including rudder reversals; and the design of the main rudder power control unit servo valve. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-910401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Introduction to Amended Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.3 Damage to Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.5.3 Flight Crew Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.5.4 Air Traffic Control Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6.2 Maintenance History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.6.3 Boeing 737 Hydraulic System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.6.4 Boeing 737 Flight Control Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.6.4.1 Rudder Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.6.4.1.1 Main Rudder PCU and Servo Valve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.7.1 Observations and Forecasts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.7.2 Topics from Meteorological Meeting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.7.3 Witness Information and Satellite Data on Vortices . . . . . . . . . . . . . . . . . . . . . . . . 34 1.7.4 Previous Accidents/Incidents Attributed to Vortices. . . . . . . . . . . . . . . . . . . . . . . . 35 1.7.5 Review of Information Obtained from A.J. Bedard, Jr., NOAA . . . . . . . . . . . . . . . 36 1.8 Aids To Navigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.9 Communications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.10 Aerodrome Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.10.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.10.2 Weather Related Accidents/Incident Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.12.1 Engine Mount Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.12.2 Examination of Roll and Pitch Flight Controls Components and Other Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.12.2.1 Hydraulic System A and B Pressure Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.12.2.2 Roll Control Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.12.2.3 Pitch Control Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.12.3 Examination of Yaw Control Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.12.3.1 System Main Rudder Power Control Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Contents iv Aircraft Accident Report 1.12.3.2 Standby Rudder Actuator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.13 Medical And Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.16.1 Recorded Radar Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.16.2 Modeling and Simulations of Atmospheric Disturbances and Airplane Flight Dynamics Conducted During the Initial Investigation (1991/1992). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.16.2.1 Modeling of Atmospheric Disturbances (1991/1992): NCAR Weather Study. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.16.2.2 Safety Board Simulations (1991/1992) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.16.2.3 Boeing Simulations (1991/1992). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.16.3 Detail Examination and Tests of Standby Rudder Actuator Input Shaft and Bearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.16.3.1 Additional Standby System Actuator Binding/Jam Tests . . . . . . . . . . . . . . . . . . 66 1.16.4 Other Documented Rudder Control Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.16.5 Additional Examination and Testing of 737 Flight Control Systems/Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.16.5.1 Detailed Examinations of Main Rudder PCU Servo Valves . . . . . . . . . . . . . . . . 72 1.16.5.2 PCU Servo Valve Chip Shear Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 1.16.5.3 PCU Thermal Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 1.16.5.3.1 Baseline Test Condition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.16.5.3.2 Simulated Hydraulic System Failure Condition . . . . . . . . . . . . . . . . . . . . . . 76 1.16.5.3.3 Extreme Temperature Differential Test Condition . . . . . . . . . . . . . . . . . . . . 76 1.16.5.3.4 Additional Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.16.5.4 Rudder Actuator Reversals During Servo Valve Secondary Slide Jams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.16.5.5 Ground Demonstration of Rudder PCU Servo Valve Jam. . . . . . . . . . . . . . . . . . 83 1.16.6 Flight Performance Simulation Studies Conducted During the USAir Flight 427 Investigation (1994-1999) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 1.16.6.1 United Flight 585 Simulation Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1.17.1 United Airlines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1.17.1.1 United Airlines Office of Flight Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1.17.1.2 United Airlines Windshear and Irregular Procedures . . . . . . . . . . . . . . . . . . . . 104 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 1.18.1 Study of Pilots’ (USAir Flight 427 and United Flight 585) Speech, Breathing, and Other CVR-recorded Sounds . . . . . . . . . . . . . . . . . . . . . . . . . . 105 1.18.2 Comparison of Engine Sound Signatures From the United Flight 585 CVR and a CVR From 737-200 Flight Tests . . . . . . . . . . . . . . . . . . . . . . . . 107 1.18.3 Ergonomics—Study of Maximum Pilot Rudder Pedal Force . . . . . . . . . . . . . . . . 108 1.18.3.1 United Flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1.18.4 Conclusions Adopted in the USAir Flight 427 Report . . . . . . . . . . . . . . . . . . . . . 110 1.18.4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.18.4.2 Probable Cause. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 2.2 Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Contents v Aircraft Accident Report 2.3 Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.4 Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.4.1 Hydraulic Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.4.2 Flight Control Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.5 Environmental Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.5.1 General Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.5.2 Characteristics of Horizontal Axis Vortex (Rotor) . . . . . . . . . . . . . . . . . . . . . . . . 125 2.5.3 Flight Simulations with Atmospheric Disturbances . . . . . . . . . . . . . . . . . . . . . . . 128 2.6 United Flight 585 Upset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.6.1 Computer Simulation Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.6.2 Human Performance Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 2.7 Rudder System Jam Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 2.8 Flight Data Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
2. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

A: Investigation and Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 B: Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 C: Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 D: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 E: NCAR Weather Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 F: Review of Literature and Correspondence Related to Severe Weather Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 G: LLWAS Sensors and Plots of Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

vi Aircraft Accident Report Figures

1. Boeing 737-200 hydraulic system panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2. Three axes of motion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3. Boeing 737 flight control surface locations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4. Boeing 737 rudder system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

4a. Detailed view of 737 aft rudder system controls and linkages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1. Boeing 737 main rudder PCU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2. Boeing 737 main rudder PCU schematic and installation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3. Boeing 737 main rudder PCU servo valve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4. Types of airflow over ridges: (a) laminar streaming; (b) standing

eddy streaming; (c) wave streaming; and (d and e) rotor streaming. Dashed line on left indicates vertical profile of horizontal wind speed.. . . . . . . . . . . . . . . . . . . . . . . 30

1. Ground track with selected CVR data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
2. Profile view of flightpath with selected CVR data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3. Standby rudder actuator.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
4. Normal operation of the 737 PCU servo valve with slides in the

neutral position (no jam). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

1. Normal operation of the 737 PCU servo valve with slides in the

extend command position (no jam). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

1. PCU servo valve intended operation with the secondary slide

jammed to the servo valve housing and primary slide opposing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

1. PCU servo valve with the secondary slide jammed to the servo

valve housing and the primary slide in the overtravel condition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

1. Pilot rudder pedal force positions for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

16a. Rudder surface positions for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 16b. Control wheel positions for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 16c. Heading data for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Figures vii Aircraft Accident Report 16d. Normal load factor data for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 16e. Pitch angle data for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 16f. Bank angle data for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 16g. Roll rate for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 16h. Yaw rate for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 16i. Wind direction for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 16j. Horizontal windspeeds for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 16k. Vertical windspeeds for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

1. Rudder surface positions for United flight 585 assuming a

sustained equivalent control wheel input. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 17a. Control wheel surface positions for United flight 585 assuming a sustained equivalent control wheel input. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 17b. Heading data for United flight 585 assuming a sustained equivalent control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 17c. Normal load factor for United flight 585 assuming a sustained equivalent control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 17d. Calibrated airspeed for United flight 585 assuming a sustained equivalent control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 17e. Pitch angle data for United flight 585 assuming a sustained equivalent control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 17f. Bank angle data for United flight 585 assuming a sustained equivalent control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

1. United flight 585 rudder surface positions according to Boeing’s new

rotor model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 18a. Rotational windshear encountered by United flight 585 according to Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 18b. United flight 585 control wheel positions according to Boeing’s new rotor model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 18c. United flight 585 heading data according to Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . . . 101

Figures viii Aircraft Accident Report 18d. United flight 585 bank angle data according to Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . 102 18e. United flight 585 normal load factor data according to Boeing’s new rotor model. . . . . . . . . . . . . 102 18f. United flight 585 pitch angle according to Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . . . . . 103

ix Aircraft Accident Report Introduction to Amended Report On March 3, 1991, about 0944 mountain standard time, United Airlines flight 585, a Boeing 737-291 (737-200), N999UA, crashed while maneuvering to land on runway 35 at Colorado Springs Municipal Airport, Colorado Springs, Colorado. Flight 585 was operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled domestic passenger flight from Denver, Colorado, to Colorado Springs. Numerous witnesses reported that, shortly after completing its turn onto the final approach course, the airplane rolled steadily to the right and pitched nose down until it reached a nearly vertical attitude before hitting the ground. The 2 flight crewmembers, 3 flight attendants, and 20 passengers aboard were killed, and the airplane was destroyed by impact forces and fire. On December 8, 1992, the National Transportation Safety Board adopted a final report on the accident. The Safety Board concluded that it “could not identify conclusive evidence to explain the loss of United Airlines flight 585.”1 In its probable cause statement, the Board indicated that it considered the two most likely explanations for the sudden uncontrollable upset to be a malfunction of the airplane’s directional control system or an encounter with an unusually severe atmospheric disturbance. The Board further indicated in its probable cause statement that, although anomalies had been identified in the accident airplane’s rudder control system, it was unable to identify a condition under which any such anomaly would have produced a rudder movement that the pilots could not have easily countered by the airplane's roll controls. Additionally, the Board concluded that weather conditions in the Colorado Springs area at the time of the accident were conducive to the formation of a horizontal axis vortex (rotor) and that some witness observations supported the existence of a rotor at or near the time and place of the accident. However, the Board determined that too little was known about the characteristics of rotors to conclude whether a rotor was a factor in the accident. Additional rudder- and weather-related information pertinent to the United flight 585 accident was developed after the Safety Board’s adoption of its December 1992 final report. This information was developed in the course of the Board’s investigation of the September 8, 1994, USAir flight 427 accident, which included an investigation of the June 9, 1996, incident involving Eastwind Airlines flight 5172 and a reexamination of certain aspects of the United flight 585 accident. In its final report on the USAir flight 427 1 National Transportation Safety Board. 1992. Uncontrolled Collision With Terrain for Undetermined Reasons, United Airlines Flight 585, Boeing 737-291, N999UA, 4 Miles South of Colorado Springs, Colorado, March 3, 1991. Aircraft Accident Report NTSB/AAR-92/06. Washington, DC. 2 The Eastwind flight 517 incident was a yaw/roll upset that occurred near Richmond, Virginia. The pilots of Eastwind flight 517 were able to regain control of the airplane and land without further incident.

Introduction to Amended Report x Aircraft Accident Report accident,3 the Safety Board adopted several conclusions that supplement and, in some cases, contradict those that the Board adopted in its December 1992 final report on the United flight 585 accident. Accordingly, the Safety Board has determined that the original United flight 585 report should be amended to reflect the information and conclusions contained in the USAir flight 427 report. In this amended report, new or revised text that was added as a result of information developed during the USAir flight 427 accident investigation is shown with a change bar along the outside of the page. Although some additional corrections and revisions have been made, the remainder of the report is substantially the same as the December 1992 report. 3 National Transportation Safety Board. 1999. Uncontrolled Descent and Collision With Terrain, USAir Flight 427, Boeing 737-300, N513AU, Near Aliquippa, Pennsylvania, September 8, 1994. Aircraft Accident Report NTSB/AAR-99/01. Washington, DC.

xi Aircraft Accident Report Abbreviations A/P autopilot ACARS aircraft communications addressing and reporting system AD airworthiness directive AFF Air Force Academy agl above ground level AMA area minimum altitude AMIS aircraft maintenance information system ANR airplane nose right APU auxiliary power unit ARTCC air route traffic control center ATA Air Transport Association ATC air traffic control ATIS automated terminal information service ATP airline transport pilot AWS Air Weather Service BAC British Aerospace Corporation CAT clear air turbulence CFR Code of Federal Regulations Cg center of gravity COS Colorado Springs Municipal Airport CSD constant speed drive CVR cockpit voice recorder CWA center weather advisory

Abbreviations xii Aircraft Accident Report CWSU center weather service unit DEN Denver Stapleton International Airport EDP engine-driven hydraulic pump EPR engine pressure ratio F Fahrenheit FA area forecast FAA Federal Aviation Administration FAR Federal Aviation Regulations FDR flight data recorder FL flight level FT terminal forecast GOES Geostationary Operational Environmental Satellite gpm gallons per minute Hg Mercury HPT high pressure turbine HRC Hardness Rockwell C (scale) Hz Hertz IFR instrument flight rules ILS instrument landing system KCAS knots calibrated airspeed KIAS knots indicated airspeed

Abbreviations xiii Aircraft Accident Report LIDAR Light Distancing and Ranging LLWAS low level windshear alert system LLWS low level wind shear LPT low pressure turbine LVDT linear variable displacement transducer LWD left wing down MAC mean aerodynamic chord McIDAS Man Computer Interactive Data Access System MEL minimum equipment list MPCU main power control unit MSA minimum sector altitude msl mean sea level MST mountain standard time N1 engine fan speed N2 engine compressor speed NASA National Aeronautics and Space Administration NCAR National Center for Atmospheric Research NIDA National Institute of Drug Abuse NOAA National Oceanic and Atmospheric Administration nmi nautical mile NOTAM notice to airmen NPRM notice of proposed rulemaking NTSB National Transportation Safety Board NWS National Weather Service OTS Officer Training School

Abbreviations xiv Aircraft Accident Report P/N part number PAPI precision approach path indicator PCU power control unit PIREP pilot report psi pounds per square inch PST Pacific standard time RRWDS radar remote weather display system RWD right wing down SEM scanning electron microscope SIGMET significant meteorological information TRACON terminal radar approach control UAL United Airlines USAF U.S. Air Force VFR visual flight rules VMC visual meteorological conditions VORTAC very high frequency omnidirectional radio range/ultra high frequency tactical air navigation aid ZDV Denver Center

xv Aircraft Accident Report Executive Summary On March 3, 1991, a United Airlines Boeing 737, registration number N999UA, operating as flight 585, was on a scheduled passenger flight from Denver, Colorado, to Colorado Springs, Colorado. Visual meteorological conditions prevailed at the time, and the flight was on an instrument flight rules flight plan. Numerous witnesses reported that shortly after completing its turn onto the final approach course to runway 35 at Colorado Springs Municipal Airport, about 0944 mountain standard time, the airplane rolled steadily to the right and pitched nose down until it reached a nearly vertical attitude before hitting the ground in an area known as Widefield Park. The airplane was destroyed, and the 2 flight crewmembers, 3 flight attendants, and 20 passengers aboard were fatally injured. The National Transportation Safety Board determines that the probable cause of the United Airlines flight 585 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On March 3, 1991, a United Airlines (UAL) Boeing 737, registration number N999UA, operating as flight 585, was on a scheduled passenger flight from Denver, Colorado, to Colorado Springs, Colorado. Visual meteorological conditions (VMC) prevailed at the time, and the flight was on an instrument flight rules (IFR) flight plan. Numerous witnesses reported that shortly after completing its turn onto the final approach course to runway 35 at Colorado Springs Municipal Airport (COS), about 0944 Mountain Standard Time, the airplane rolled steadily to the right and pitched nose down until it reached a nearly vertical attitude before hitting the ground in an area known as Widefield Park. The airplane was destroyed, and the 2 flight crewmembers, 3 flight attendants, and 20 passengers aboard were fatally injured. Flight 585 originated in Peoria, Illinois, and the intended destination was Colorado Springs, Colorado, at 0946.4 It had intermediate stops in Moline, Illinois, and Denver, Colorado. The flight was conducted under the requirements of 14 Code of Federal Regulations (CFR) Part 121. The airplane departed Peoria on schedule at 0500 and arrived in Moline 6 minutes behind schedule at 0532. It departed Moline on schedule at 0600 and arrived at the Denver Stapleton International Airport (DEN) at 0800, 13 minutes ahead of schedule. The pilots for the Peoria to Moline to Denver segments of the flight reported that there were no open maintenance writeups or deferred minimum equipment list (MEL) items in the airplane's maintenance log. The pilots reported no abnormal situations related to the airplane during the flight to Denver. A scheduled crew change took place in Denver. The cargo manifests for the flight indicated that no hazardous material was on board. The cargo bay areas contained passenger baggage, spindle assemblies, a casket, and printed papers. Loading personnel reported that all of the cargo was properly restrained by the pit cargo net/stanchions installed in the cargo bins. The weather briefing message that the flightcrew received before departing Denver included the 0750 Aviation Surface Weather Observation for Colorado Springs, as follows: Clear, visibility 100 miles, temperature 49 degrees F, dew point 9 degrees F, winds 330 degrees at 23 knots, gusts to 33 knots, altimeter setting 30.03 inches of Hg, cumulus over the mountains northwest. 4 All times are Mountain Standard Time (MST) based on the 24-hour clock, unless otherwise indicated.

Factual Information 2 Aircraft Accident Report The UAL mechanic who was responsible for receipt and dispatch of the flight reported that during his routine exterior inspection of the airplane, he found that the latch on the electronics and equipment (E and E) door was not in its normal flush stowed position. He checked the security of the door and stowed the latch. He stated that, “other than that [stowage of the latch], the aircraft departed normally.” Flight 585 departed Denver at 0923. The captain was flying the airplane and the first officer was making the radio transmissions. The airplane was scheduled to arrive in Colorado Springs at 0946. While en route to Colorado Springs, the flightcrew sent an aircraft communications addressing and reporting system (ACARS) message updating its estimated arrival time to 0942. The cockpit voice recorder (CVR) tape revealed that at 0930:37, the flightcrew received automated terminal information service (ATIS) information, version “Lima,” that was about 40 minutes old. ATIS “Lima” stated, in part: Wind three one zero at one three gust three five; low level wind shear advisories are in effect; local aviation wind warning in effect calling for winds out of the northwest gusts to forty knots and above. According to the CVR and flight data recorder (FDR), the flightcrew added 20 knots to the approach landing reference target airspeed based on the ATIS information. The full CVR transcript is contained in appendix D. At 0932:35, the first officer reported their altitude to Colorado Springs Approach Control as 11,000 feet, saying that they had received ATIS information “Lima.” Approach Control then told the flight to depart the “Springs” VORTAC (very high frequency omnidirectional radio range/ultra high frequency tactical air navigation aid) heading 165 degrees for a vector to runway 35 for a visual approach. Wind information was issued as 320 degrees at 13 knots, gusting to 23 knots. At 0934:06, a descent was issued to 10,000 feet, at the pilot's discretion, and a further descent to 8,500 feet was issued about 3 minutes later. The first officer then reported the airport in sight, and approach control instructed them to maintain “at or above 8,500 until on base, runway 35, cleared visual approach, contact tower 119.9." She repeated the instructions and contacted the tower. At 0937:59, the first officer reported to the tower, “...cleared for a visual to 35." The local controller then cleared the flight to land and issued the wind as 320 degrees at 16 knots with gusts to 29 knots. The first officer then confirmed that they were cleared to land on runway 35, and asked whether there were any reports of a loss or gain of airspeed from other airplanes. The local controller replied that the last report was the one reported by a Boeing 737. The first officer then asked the controller, “could you repeat it please?” At 0938:29, the local controller replied that a Boeing 737 reported a 15-knot loss at 500 feet, at 400 feet “plus 15 knots,” and at 150 feet, “plus 20 knots.” The first officer replied, “sounds adventurous, uh, United five eighty five, thank you.” Airport traffic was issued to the flight by the tower controller at 0940:07, “...eleven o'clock five miles northwest bound straight in for runway three zero.” The first

Factual Information 3 Aircraft Accident Report officer replied that they would look for him and then asked how many miles the traffic was from them. The local controller replied, “eleven to ten o'clock and five miles for United five eighty five.” The first officer replied, “five eighty five, roger.” At 0940:44, the first officer asked the controller the whereabouts of the traffic. The local controller transmitted, “United 585, the Cessna traffic is ten to nine o'clock now as you're in your turn, passing behind you, no factor.” At 0941:23, the local controller directed the flight, “after landing, hold short of runway three zero for departing traffic on runway three zero.” The first officer replied “we'll hold short of three zero United five eighty five.” This transmission was the last one received from flight 585. More than 60 witnesses were interviewed during the initial field phase of the investigation and more than 100 other witnesses came forward during a followup visit to the accident site area about a year later. The majority of the witnesses who observed the flight of the airplane on March 3, 1991, indicated that although the airplane was flying at an altitude that was lower than what they were accustomed to seeing, it appeared to be operating normally until it suddenly rolled to the right and descended into the ground. Many witnesses reported that the airplane rolled wings level momentarily (as it lined up with the runway) and that it rolled to the right until it was inverted with the nose nearly straight down. Some of them saw the nose rise during the initiation of the right roll. One elderly couple, who was reportedly walking through Widefield Park at the time of the accident, stated to another witness that a liquid substance from the airplane fell onto their clothing which “smelled very bad.” Repeated efforts to find and interview this couple have been unsuccessful. These efforts included a door-to-door search of the houses in close proximity to the park, a circulated composite picture of the male, as well as local radio and television news coverage. One witness, who was about 6 miles west of the accident site, reported seeing several rotor clouds5 in the area of the accident, 10 to 15 minutes before the crash. That witness said that the rotor clouds were accompanied by thin wispy condensation. Another person, who passed west of the accident site between 0830 and 0900, reported seeing “torn wispy clouds” in the area of the accident. Some witnesses reported seeing a white mist in the area of the right wing about the time that the airplane began its rapid roll to the right. No other witnesses in the park, or along the flightpath, reported liquid falling from the airplane. In the final minute of the flight, evidence from the recorded radar data, the CVR, and the FDR indicates that the normal acceleration varied between 0.6 and 1.3 G. The airspeed was at about 155 knots with 2 to 10 knot excursions. At 0937:32, the flight had 5 Rotor: A vortex of air generated about a horizontal axis by high winds over irregular terrain. Characteristics are similar to but less severe than a tornado. Rotors are sometimes evident by a cloud that appears in the form of a stationary roll usually on the leeward side of a ridge. When viewed from the air, a rotor cloud looks like a line of cumulus clouds.

Factual Information 4 Aircraft Accident Report been cleared for a visual approach to runway 35 at Colorado Springs and the airplane was approaching the extended runway centerline at 300 degrees, consistent with a 45 degree intercept of the final approach path to the airport. The indicated altitude was 8,000 feet and a descent was just commencing. Ten seconds later, the heading began to change about 0.5 degrees per second until the heading was 320 degrees. The thrust of each engine was reduced from about 6,000 pounds to about 2,000 pounds approximately 40 seconds before the crash. At that time, the airplane began descending at about 2,200 feet per minute, a rate greater than required to remain on a standard approach to the airport. Several seconds later the thrust was increased to about 3,000 pounds per engine. About 20 seconds prior to the crash, the rate of heading change increased, consistent with a 20-degree bank angle and a turn for alignment with the runway. Sixteen seconds prior to the crash, the thrust was increased to about 6,000 pounds per engine. As the thrust was increasing, the first officer made the “1,000 feet” call. Within the next 4 seconds, and about 9 seconds prior to the crash, the heading rate increased to about 5-degrees per second to the right, nearly twice that of a standard rate turn. The first officer said “Oh God,” followed by the captain, in the last 8 seconds, calling for 15 degrees of flaps. This selection of 15-degrees flaps, in combination with increased thrust, is consistent with the initiation of a go-around. The altitude decreased rapidly, the indicated airspeed increased to over 200 knots, and the normal acceleration increased to over 4 G. The airplane impacted relatively flat terrain 3.47 nautical miles south of the south end of runway 35 and .17 nautical miles to the east of the extended centerline of runway 35 at the Colorado Springs Municipal Airport. All of the occupants on board the flight received fatal injuries. The airplane was destroyed by impact forces and postcrash fire. The accident site coordinates were 38 degrees, 44 minutes and 09.4 seconds north latitude, and 104 degrees, 42 minutes and 42.4 seconds west longitude at an elevation of 5,704 feet above sea level. The accident occurred during daylight hours. 1.2 Injuries to Persons Injuries Crew Passengers Others Total Fatal 5 20 0 25 Serious 0 0 0 0 Minor/None 0

0

0 Total 5 20 0 25

Factual Information 5 Aircraft Accident Report 1.3 Damage to Aircraft The airplane was destroyed by ground impact and postcrash fire. The value of the airplane was estimated by UAL to be $14,200,000. 1.4 Other Damage There was no damage to structures on the ground. Trees adjacent to the impact crater were damaged by flying debris and soot, and nearby patches of grass north and northeast of the crater were scorched. The size of the impact crater measured approximately 39 feet by 24 feet and was about 15 feet deep. 1.5 Personnel Information The flightcrew consisted of the captain, first officer, and three flight attendants. (See appendix B). 1.5.1 The Captain The captain, age 52, was hired by United Airlines on May 15, 1969. He possessed a current Airline Transport Pilot (ATP) certificate and a current first class medical certificate. He had accrued a total flight time of 9,902 hours, of which 1,732 hours were in the B-737-200 that included 891 hours as captain. This landing was the captain's first at COS as the pilot-in-command. However, it is likely that the captain had landed many times at COS in the 16 years he had worked for UAL as a flight crewmember. During the accident flight, he commented to the first officer that he had “never driven to Colorado Springs and not gotten sick” (0927:31), signifying that this was probably not his first landing or first experience with turbulence on the segment to COS. He had conducted 14 flights into and out of Denver during the 90 days before the accident. First officers who had flown recently with the captain described his strict adherence to standard operating procedures and his conservative approach to flying. They indicated that the captain briefed all approaches even in visual conditions, always reported equipment malfunctions, and discussed deferred maintenance items with the first officer. The first officers also reported that, if the captain had not previously flown with a first officer, he would observe that first officer perform pilot-flying duties during the first leg of a trip sequence. Further, a first officer who had previously flown with the captain in gusty, turbulent weather reported during a postaccident interview that the captain had advised him to conduct a go-around if windshear was encountered. The first officer stated that the captain had indicated that he had no problem with an early go-around and had encouraged the first officer to conduct a go-around if he thought the approach was unsafe.

Factual Information 6 Aircraft Accident Report 1.5.2 The First Officer The first officer, age 42, was hired by UAL on November 21, 1988, held a current ATP certificate and a current first class medical certificate. She had accrued a total flight time of 3,903 hours, including 1,077 hours as first officer in the B-737. This landing was her second at COS. The captain of United flight 585 had flown a 3-day trip sequence with the United flight 585 first officer a few weeks before the accident and had described her to a friend as “very competent.” 1.5.3 Flight Crew Activities According to UAL records, the captain and the first officer were paired together on a 3-day trip beginning on February 22, 1991 (that ended 6 days before the accident trip). The captain was off duty on February 25 and 26, and then flew a 3-day trip beginning on February 27. The last day of the trip began with a departure from Seattle, Washington, at 0726 Pacific standard time (PST) and ended with an arrival at San Francisco, California, at 1330 PST. This trip was followed by a 2-day trip beginning on March 2 (the accident trip), which was the captain's last scheduled trip before a 2-week vacation. From March 23 through 25, the captain was scheduled to perform his annual proficiency check. The first officer flew a 3-day trip beginning on February 25, and she was off duty on February 28 and March 1. The accident trip was not scheduled, but she volunteered for it the previous night. According to the scheduler, she did not know the identity of the captain when she accepted the trip. The accident trip began with a reporting time of 0545 PST at Oakland, California, on March 2, and a departure at 0735 PST. The first day consisted of landings at Los Angeles, California, and Sacramento, California, and ended at 1828 MST with a landing at Denver. After flying, the crew checked into the hotel at Denver at 1915, according to hotel records. A UAL pilot, who was acquainted with the first officer, said he spoke with both crewmembers when they arrived at the hotel. He said that the first officer invited him to join her and the captain for dinner at a nearby restaurant, but since he had already eaten, he declined the invitation. The next day the crew checked out of the hotel at 0721 and took the 0730 courtesy bus to the airport. The UAL pilot, who was taking a different bus, said he spoke again briefly to the first officer. He said that she appeared alert and that she asked him about what she could expect on a trip to Colorado Springs since it would be her first flight to that airport. The pilot advised her to check the weather ahead since it could be a short flight, and the first officer indicated she was familiar with short flight segments. A member of the UAL training staff said that he greeted the captain around 0815 outside the

Factual Information 7 Aircraft Accident Report Denver Operations/Dispatch area and that the captain seemed fine and “didn't look unrested.” The Denver Customer Service Agent, who handled the departure of the accident flight, said that the captain commented “we'll be back in a few minutes” as the agent was closing the door (referring to the fact that the flight was scheduled to return to Denver after landing at Colorado Springs). He described the captain as a “real confident-type guy” and “very nice fellow” who appeared to be in exceptionally good spirits. He described the first officer as a quiet person who “had her mind on what she needed to get done.” He indicated that both crewmembers appeared rested and seemed to get along well. A check of Federal Aviation Administration (FAA) records showed that neither the captain nor the first officer had any prior accidents, incidents, or violations. 1.5.4 Air Traffic Control Personnel The local air traffic controller who was working the No. 1 position in the Colorado Springs tower at the time of the accident became a full performance level controller at that facility on August 11, 1990. The controller who was working the ground control/flight data position in the tower at the time of the accident became a full performance level controller at Colorado Springs on September 13, 1990. The radar south controller position at the Denver terminal radar approach control (TRACON) at the time of the accident was staffed by a full performance level controller who had been certified on March 20, 1990. 1.6 Airplane Information 1.6.1 General The airplane, a Boeing 737-291 Advanced, serial number 22742, was manufactured in May 1982. (See appendix C). It was powered by two Pratt & Whitney JT8D-17 engines. The airplane was owned and operated by UAL. It had been acquired by UAL from Frontier Airlines on June 6, 1986. By the accident date, the airplane had accumulated 26,050 hours and 19,734 cycles. Its most recent “C” check and Heavy Maintenance Check-4 was accomplished by UAL on May 27, 1990. At that time the airplane had accumulated 24,004 hours and 18,298 cycles. Weight and balance information was computer generated by UAL's load planning function. The computerized model used input from passenger service, fueling, and ramp cargo functions to provide closeout information to the flightcrew through ACARS. Flight 585 departed Denver at a takeoff gross weight of 77,859 pounds. The center of gravity (CG) at the time of takeoff was 25.3 percent of mean aerodynamic chord (MAC). The forward and aft CG limits at the takeoff weight were 5 and 31.4 percent MAC,

Factual Information 8 Aircraft Accident Report respectively. The weight at the time of the accident was 76,059 pounds, and the CG was 25.7 percent. This was based upon an estimated fuel burn of 1,800 pounds which was generated from UAL's historical fuel burn records for the airplane. 1.6.2 Maintenance History All UAL Aircraft Maintenance Information System (AMIS) entries for N999UA from December 15, 1990, to March 2, 1991, were reviewed by the Safety Board, as well as all nonroutine items from the last Heavy Maintenance Check-4 and “C” check. All AMIS entries listed by the Air Transport Association (ATA) Specification 100, chapters 22 (Autopilot), 27 (Flight Controls), and 29 (Hydraulic Systems) for February 1988 through January 1991 were also reviewed. The records review revealed that there had been five writeups from January 30, 1991, to February 6, 1991, stating that the No. 1 engine pressure ratio (EPR) was sluggish and slow to respond. The final corrective action was recorded as: “Replaced transmitters, replaced indicators, checked lines and fittings for leaks, finally flushed manifold and probes.” On February 14, 1991, the flightcrew reported that the CAT II coupled approach was unsatisfactory. They said that the airplane “tried to land to left of [the] runway.” The corrective action was signed off as: “Accomplished full ground CAT II system check, OK. Returned aircraft to CAT II status.” On February 15, 1991, the flightcrew reported: “Last two coupled approaches have been excellent. Autopilot checks good per maintenance manual.” On February 25, 1991, the flightcrew reported: “On departure got an abnormal input to [the] rudder that went away. Pulled yaw damper circuit breaker.” The corrective action was signed off as: “Replaced yaw damper coupler and tested per [the] maintenance manual.” Interviews with the flightcrew of that flight indicated that, at the time of the event, the airplane was between 10,000 feet and 12,000 feet mean sea level (msl) at an indicated airspeed of 280 knots, in smooth air with the landing gear and flaps up. The first officer was flying the airplane with the autopilot off. The flight had just leveled off, and the first officer was in the process of retarding the power levers to the cruise setting when there was an uncommanded yaw. He estimated that the yaw was to the right 5 to 10 degrees. In the time that it took him to close the throttles, everything returned to normal. The first officer did not recall any uncommanded movement of the rudder pedals. The yaw damper was turned off and its circuit breaker was pulled before landing. On February 27, 1991, a writeup by the flightcrew stated “Yaw damper abruptly moves [the] rudder occasionally for no apparent reason on [the] “B” actuators. Problem most likely [is] in [the] yaw damper coupler...unintended rudder input on climbout at FL [flight level] 250. A/P [auto-pilot] not in use, turned yaw damper switch off and pulled [the] circuit breaker. Two inputs, one rather large deflection....” The corrective action was signed off as: “Replaced rudder transfer valve and [the] system checks OK.” Interviews with the flightcrew of the flight revealed that the first officer was flying the airplane and

Factual Information 9 Aircraft Accident Report indicated that he believed that his feet were on the rudder pedals at the time of the event. While climbing through 10,000 feet, he said he experienced several rapid “jerks” that he could not identify. The flight encountered light turbulence at the time. While continuing the climb between 25,000 feet and 28,000 feet, he said he felt a significant right rudder input which lasted between 5 and 10 seconds. The airplane was still in light turbulence and at 280 knots. Although he was not sure if his feet were on the rudder pedals during this later occurrence, he reacted by centering the ball with left rudder input and normal flight was resumed. Both crewmembers looked up at the overhead panel and saw the No. 1 constant speed drive (CSD) low oil pressure light illuminated. The yaw damper was turned off and its circuit breaker was pulled. The CSD light went out, then came back on about 5 minutes later. The CSD was disconnected, and no further anomalies were experienced during the remainder of the flight or subsequent flights. There were no open maintenance items when the airplane departed Denver on March 3, 1991. No other maintenance items were found in the AMIS review that appeared related to the accident circumstances. All applicable Airworthiness Directives (ADs) had been complied with. Required actions that were not yet accomplished were within the time limits specified in the AD. The hydraulic rudder actuator, standby actuator, transfer valve, and yaw damper coupler are “on condition”6 items in the United Airlines maintenance program. Subsequent to the records review, the history of the standby rudder actuator was reviewed in detail because of discrepancies found during the actuator's disassembly (see section 1.12.3.2 of this report.) The actuator was manufactured on October 3, 1981, by Hydraulic Units, Inc.—now Dowty Aerospace. It had been installed on N999UA by Boeing during manufacture of the airplane. It had not been removed from the airplane by either Frontier Airlines or by UAL. It was identified by the manufacturer's part number 1U1150-1 and Boeing part number BAC10-60797-4, serial number 0953. 1.6.3 Boeing 737 Hydraulic System Information Hydraulic power on the 737-200 is provided by three independent hydraulic systems, each of which is capable of operating pressures of about 2,950 pounds per square inch (psi). The systems are designated as hydraulic system A, hydraulic system B, and the standby hydraulic system. Hydraulic systems A and B have independent hydraulic reservoirs and two hydraulic pumps each. Although hydraulic systems A and B normally operate together to provide dual hydraulic power for primary flight controls (ailerons, elevators, and rudder), either system is capable of powering the flight controls alone if the other system fails. Further, if one of the hydraulic pumps in either the A or B systems were to fail, the remaining pump has sufficient capacity to provide full flight control authority for its respective system operation. If needed, the ailerons and elevators can also 6 “On condition” means that maintenance is performed only after a defect is noted during inspection, rather than on a time or cycle basis.

Factual Information 10 Aircraft Accident Report be operated manually, without hydraulic power, and the rudder may be operated with the standby hydraulic system. The 737-200 hydraulic system A is powered by two engine-driven hydraulic pumps (one driven by each engine). The 737 hydraulic system A provides power for flight controls, landing gear, nose gear steering, alternate brakes, inboard flight spoilers, engine thrust reversers, and ground spoilers. The landing gear may be lowered hydraulically with hydraulic system A power or released to a free fall manually. The 737-200 hydraulic system B is powered by two electric motor-driven hydraulic pumps (one driven by each engine). Hydraulic system B provides power for flight controls, normal brakes, trailing edge flaps, leading edge flaps and slats, and outboard flight spoilers. The 737-200 standby hydraulic system is unpressurized during normal operations. This system is powered by an electric pump and can be activated manually by the pilots by arming “ALTERNATE FLAPS” or selecting the hydraulic system A or B flight control switch to “STBY RUD” (standby rudder) on the overhead panel in the cockpit.7 This standby hydraulic system powers the standby rudder system, provides an alternate source of power for both engine thrust reversers, and extends the leading edge flaps and slats in the ALTERNATE FLAPS mode. Two flight control hydraulic modules (one each for hydraulic systems A and B) are installed. Each hydraulic module is a manifold assembly containing a spoiler shutoff valve, flight control shutoff valve, low-pressure warning switch, and compensator cartridge. The compensator cartridge maintains return fluid from the aileron, rudder, and elevator power control units (PCU) after hydraulic system shutdown. This fluid is used to compensate for volume changes in the hydraulic system because of temperature changes or fluid loss. Motor-operated shutoff valves within the module are commanded to their operating positions by the flight control system switches in the cockpit. Figure 1 illustrates the hydraulic system panel. 7 During normal operation, the hydraulic system A and B flight control switches would be in the ON position and the ALTERNATE FLAPS switch would be in the OFF position.

Factual Information 11 Aircraft Accident Report Figure 1. Boeing 737-200 hydraulic system panel. 1.6.4 Boeing 737 Flight Control Systems The flight controls on the 737 are the ailerons, flight spoilers, elevators, horizontal stabilizer, rudder, flaps, and slats. Flight control about the longitudinal (roll) axis of the airplane is provided by an aileron on each wing assisted by two flight spoilers. Flight OVERHEATOVERHEAT LOW PRESSURE LOW PRESSURE LOW PRESSURE LOW PRESSURE YAW DAMPER MACH TRIM FAIL B LOW QUANTITY FEEL DIFF PRESS LOW PRESSURE STANDBY HYD LOW QUANTITY FLT CONTROL SPOILER YAW DAMPER MACH TRIM ALTERNATE FLAPS LOW PRESSURE LOW PRESSURE 1 ENG 2 1 ELEC 2 OFF ON A CLOSE OPEN OFF ON B HYD PUMPS GRD INTERCONNECT A B A B STDBY RUD OFF A ON STDBY RUD OFF B ON OFF ARM OFF ON OFF ON TEST OFF ON UP DOWN OFF

Factual Information 12 Aircraft Accident Report control about the lateral (pitch) axis is provided by the horizontal stabilizer and two elevators. Flight control about the vertical or directional (yaw) axis is provided by the single-panel rudder.8 The ailerons and flight spoilers (roll control) are operated by moving the control wheel clockwise or counter-clockwise,9 the elevator (pitch control) is operated by moving the control column forward or aft, and the rudder (directional/yaw control) is operated by moving either the right or left rudder pedal forward or aft. Figure 2 depicts the three axes of motion, and figure 3 shows the flight control surface locations. Figure 2. Three axes of motion. 8 For more information about the rudder design, see section 1.6.4.1. 9 A clockwise control wheel input commands roll in a right-wing-down (RWD) direction, whereas a counter-clockwise control wheel input commands roll in a left-wing-down (LWD) direction. In this report, clockwise and counter-clockwise control wheel inputs will be described as right and left control wheel inputs, respectively.

Factual Information 13 Aircraft Accident Report Figure 3. Boeing 737 flight control surface locations. Boeing stated that the 737 roll and yaw control systems were designed to be capable of countering the effects of failures (such as loss of power on one engine, flap and/or slat asymmetries, and hydraulic system failure) and achieve the desired crosswind control capability. According to Boeing, the 737 is aerodynamically cross-coupled (as are most airplanes); that is, motions about the roll and the yaw axes constantly interact and affect each other in flight. Thus, any yawing motion (sideslip) would cause the airplane to roll unless countered by the control wheel. 1.6.4.1 Rudder Control System The 737-200 has a single rudder panel actuated by a single hydraulic rudder PCU. A standby rudder actuator is available to move the rudder if hydraulic systems A and/or B fail. According to a Safety Board review of large transport-category airplanes (including Boeing, McDonnell Douglas, Airbus, and Lockheed models), the 737 is the only twin wing-mounted engine, large transport-category airplane designed with a single rudder panel and single rudder actuator. All other large transport-category airplanes with twin wing-mounted engines were designed with a split rudder panel, multiple hydraulic actuators, or a mechanical/manual/trim tab rudder actuation system. Pilot control of the 737-200 rudder is transmitted in a closed-loop system from the pilots’ rudder pedals in the cockpit through a single cable system to the airplane’s tail section and then through linkages to the main rudder PCU and a standby rudder PCU in the aft portion of the vertical stabilizer. The rudder pedals at each pilot position are located on either side of the control column stem, which is protected within a housing (commonly Angle of Airflow Sensors Leading Edge Flaps Leading Edge Slats Flight Spoilers Trailing Edge Flaps Ailerons Stabilizer Balance Tabs Elevator Rudder Ground Spoilers

Factual Information 14 Aircraft Accident Report termed the “doghouse” by 737 flight crews) that is located between each pilots’ lower legs at the pilot positions. Figures 4 and 4a show the 737 rudder system. According to Boeing personnel, because of the engine placements on the wings, the 737 rudder has to be sufficiently powerful to effectively counter the effects of a loss of engine power on one side during a maximum gross weight takeoff at low airspeeds, especially in crosswind conditions. A loss of engine power on one side of the airplane would result in a large yawing moment, in the direction of the inoperative engine, produced by thrust from the operating engine. The loss of engine power can be countered by a rudder input in the opposite direction (for example, left pedal input to counter loss of power on the right engine).10 Figure 4. Boeing 737 rudder system. 10 The rudders on airplanes with fuselage-mounted engines are typically less powerful than the rudders on airplanes with wing-mounted engines. The rudders for fuselage-mounted engine airplanes do not have to be designed to counter as significant an asymmetrical thrust effect in the event of a loss of power on one engine. Because the rudder on airplanes with fuselage-mounted engines is less powerful, the consequences of a rudder hardover are less serious; thus, the Safety Board’s investigation did not consider this type of airplane. Standby Rudder PCU Captain’s Rudder Pedals Switch and Indicator Rudder Control Cables Aft Torque Tube Feel and Centering Unit Left Rudder Motion Electric Rudder Trim Actuator Rudder Hinge Line Aft Rudder Power Control Unit Input Rod Rudder Main PCU

Factual Information 15 Aircraft Accident Report Figure 4a. Detailed view of 737 aft rudder system controls and linkages. When properly installed and rigged, the 737-200 main rudder PCU can command a maximum deflection of 26° to the right and the left of the rudder’s neutral position (under no aerodynamic load conditions); the rudder can travel to those limits at a maximum rate of 66° per second. (The 737 main rudder PCU is capable of producing about 5,900 pounds of output force to move the rudder when both hydraulic systems are operating at their normal operating pressure—2,950 psi each.) The rudder pedals move about 1 inch (from their neutral position) for every 6.5° of rudder surface travel (under no aerodynamic load conditions) until the rudder pedals reach their maximum travel of about 4 inches (backward and forward) from the neutral position. The rudder pedal stops at the pilots’ forward rudder control quadrant are set to provide a mechanical stop at 28° of rudder travel (exceeding the rudder’s travel authority) because compliance in the cable system (cable stretch) may require rudder pedal travel beyond the 4-inch limit to achieve the full travel rudder movement of 26°. With the aerodynamic loads encountered in flight, the available amount of rudder surface travel is reduced. The maximum amount of rudder Upper Crank Standby Power Unit Input Rod Aft Torque Tube Center Crank Lower Crank (Bell Crank) Rudder Power Control Unit Input Rod Aft Rudder Control Quadrant Input Rod Trim and Feel Rod Cable RB Cable RA AFT Quadrant

Factual Information 16 Aircraft Accident Report travel available for an airplane at a given flight condition/configuration is referred to as the rudder’s “blowdown” limit.11 The rudder feel and centering unit is attached to the aft rudder torque tube in the vertical fin, forward of the main rudder PCU (see figure 4). This unit holds the rudder at the neutral (or trimmed) position when no rudder pedal force is applied. It also provides a feedback force to the rudder pedals that increases as the rudder pedals are depressed. The pilot rudder pedal force required for full rudder deflection is about 70 pounds; however, the rudder trim system allows the pilots to maintain a rudder deflection without having to maintain a rudder pedal force. During normal and abnormal operations, the rudder can be moved beyond the movement commanded by the hydraulic actuator through a pilot’s application of force on the rudder pedals. (Normal operation of the rudder refers to the rudder’s motion, or lack thereof, resulting from normal PCU servo valve operation. Abnormal operation refers to the rudder’s motion that results from a PCU servo valve that is functioning abnormally, for example, because of a rudder jam and/or reversal.12 Both types of operation can include rudder movement within the range of the rudder authority on the ground and/or to the rudder’s in-flight blowdown limit.) During normal rudder operation, if a pilot applies a sufficiently rapid rudder pedal input (the rudder pedal must move faster than the PCU’s ability to respond to the input), the PCU input crank would contact the PCU external body stop (manifold stop), transmitting force from the rudder pedal input to the rudder surface through the main rudder PCU and the rudder system's linkages. Also, the additional force applied by the pilot would increase the rudder PCU output force, moving the rudder farther in the intended direction of travel. The rudder feel and centering unit would oppose the rudder pedal force (decrease the force applied by the pilot’s foot)13 with about 9 to 70 pounds of force, depending on how far the rudder is away from its centered position. During normal operation of the rudder in flight, if a pilot applied between 9 and 70 pounds of force to a rudder pedal, the rudder would move in response until it reached its blowdown limit (when the aerodynamic forces acting on the rudder surface equal the hydraulic actuator force). According to Boeing engineers, if the pilot were to then apply additional force to the rudder pedal, the pedal would move about 1 inch farther, with no corresponding movement of the rudder, as the slack in the rudder linkage system is removed and the external input crank contacts the external stop. Any additional pilot application of force to the rudder pedal would result in rudder pedal movement of about 11 Rudder blowdown is the maximum rudder angle resulting from a pilot-commanded full rudder input under the existing flight conditions. It represents a balance between the aerodynamic forces acting on the rudder and the mechanical forces produced by the PCU. The maximum rudder angle can be increased beyond that produced by the hydraulic force if the pilot exerts sufficient force on the rudder pedals. 12 Rudder reversals are discussed in sections 1.16.5.3, 1.16.5.4, and 1.16.5.5. 13 U.S. Air Force (USAF) ergonomic studies indicate that the maximum rudder pedal force pilots can exert on the rudder pedals is about 500 pounds. For additional information regarding pilot rudder pedal force, see section 1.18.3 of this revised report.

Factual Information 17 Aircraft Accident Report 1 inch for each 300 pounds of rudder pedal force, which in turn would move the rudder surface slightly beyond the maximum deflection possible from the hydraulic actuator force. During a servo valve jam/rudder reversal, the rudder pedal force from a pilot resisting the jam would cause the rudder to move in the direction opposite the jam (toward the rudder’s neutral position). The feel and centering unit would add to the rudder pedal force. As a pilot applied force to a rudder pedal in opposition to the jam/reversal, the first inch of movement of the pedal would cause the PCU input crank to move to the PCU manifold body stop. After the PCU input crank contacts the manifold body stop, approximately 300 additional pounds of pilot rudder pedal force would be required to move the rudder pedal each additional 1 inch of travel until the rudder pedal contacts the forward quadrant stops. Pilot rudder pedal force in opposition to a jammed/reversing rudder malfunction would reduce the deflection of the rudder. The 737 rudder trim system allows the pilots to command a steady rudder input without maintaining foot pressure on the rudder pedals. The primary purpose for rudder trim is to compensate for the sustained large yawing moments generated by asymmetric thrust in an engine-out situation. Pilots also sometimes use a small amount of rudder trim during normal flight to compensate for slight yawing moment asymmetries such as those caused by flight control and engine rigging imperfections. To trim the rudder on the 737-100 and -200, the flight crew turns a knob on the flight deck center pedestal that is mechanically connected to the rudder trim actuator at the feel and centering unit. The rudder trim actuator (located near the aft control torque tube in the vertical fin) rotates the feel and centering unit, thus changing the neutral, or zero, position of the rudder. The rudder trim moves within its maximum authority of ± 16°. The 737 yaw damper system improves ride comfort by sensing turbulence- or airplane-generated yaw motion and countering the yaw with rudder surface movement. The system is initially activated by the yaw damper switch on the overhead panel in the cockpit and is continuously engaged during normal operations; all inputs are automatic and require no pilot action. The yaw damper system comprises the yaw damper control switch and a yaw damper coupler, which includes a rate gyro that senses airplane motion about the yaw axis and converts the motion to an electrical signal that is sent to the main rudder PCU. An electrohydraulic servo valve (or transfer valve) converts the electrical signal from the yaw damper coupler to PCU motion by directing hydraulic fluid from hydraulic system B to move the rudder left or right. The yaw damper system also includes a cockpit indicator of yaw damper activity.

Factual Information 18 Aircraft Accident Report In the 737-200 series, the yaw damper can command up to 2° of rudder surface deflection in either direction at a rate of 50° per second (when correctly assembled/rigged).14 Rudder movements that result from yaw damper system inputs do not move the rudder pedals. Figure 5 shows the main rudder PCU. Figure 6 shows the main rudder PCU schematic and installation. Figure 5. Boeing 737 main rudder PCU. 14 The 737-100 and -200 series airplanes’ yaw dampers were designed to command either ± 2 or ± 4° of rudder authority. The 737-300 yaw damper was subsequently designed with ± 3° of rudder authority. Boeing indicated that units permitting ± 2, 3, or 4° of rudder deflection may be used interchangeably on 737-100 and -200 series airplanes, and units permitting ± 2 or ± 3° of rudder deflection may be used interchangeably on 737s in the -300, -400, and -500 series. Servo Control Valve Yaw Damper LVDT Note: LVDT, linear variable displacement transducer

Factual Information 19 Aircraft Accident Report Figure 6. Boeing 737 main rudder PCU schematic and installation. 1.6.4.1.1 Main Rudder PCU and Servo Valve The main rudder PCU is powered by hydraulic systems A and B, each of which provides about 3,000 pounds of output force to move the rudder, for a total output force of about 6,000 pounds. The main rudder PCU operates by converting either a mechanical input from the rudder pedals or an electrical signal from the yaw damper system into motion of the rudder by means of mechanical linkages (summing levers, input cranks, and shafts) and a servo valve that directs hydraulic fluid either to extend or retract the PCU actuator rod that moves the hinged rudder surface. Primary Summing Lever Yaw Damper Actuator Compensator Secondary Summing Lever Compensator Spring Electrical Connector Yaw Damper Position Transmitter Transfer Valve Caging Spring Yaw Damper Shutoff Valve Primary Valve Secondary Valve Input Shaft Internal Input Crank Dual Concentric Servo Valve To Vertical Fin RA PA A System - Off B System - On To Rudder Tander Actuator Bypass Valve Power Unit Torque Tube System A Input Return System B Input Rudder Hinge Line External Summing Lever Input Crank (External) Forward

Factual Information 20 Aircraft Accident Report The body of the main rudder PCU is attached to the airplane vertical fin structure, and the actuating rod is attached to the rudder. The PCU moves the rudder right or left when actuated by rudder pedal or trim input or signals from the yaw damper. Rudder pedal and trim input are transmitted to the PCU’s external input crank through an external summing lever and linkage. The external input crank is also moved by feedback from motion of the rudder, which comes from a mechanical system linkage (see figure 6). The input shaft rotates, actuating the internal summing levers and moving the primary and secondary slides of the servo valve. The 737 main PCU servo valve was designed by Boeing and is manufactured to Boeing specifications by Parker Hannifin Corporation. It is a dual-concentric tandem valve composed of a primary slide that moves within a secondary slide that, in turn, moves within the servo valve housing. The primary and secondary concentric slides are moved by primary and secondary internal summing levers, which translate inputs from the yaw damper15 and/or the external input crank (which moves when a pilot steps on the rudder pedals) into axial movement of the slides. Figure 7 shows an expanded view of the servo valve. Figure 7. Boeing 737 main rudder PCU servo valve. 15 When the yaw damper solenoid control valve is energized, 3,000 psi of hydraulic pressure is applied to the transfer valve, which proportionally converts electrical signals from the yaw damper coupler into hydraulic flow and control pressure. The control pressure moves the yaw damper actuator assembly piston (mod piston), which moves the pivot point of the internal summing levers. The internal summing levers move the primary and secondary slides of the servo valve from neutral, which causes movement of the pistons in the actuator assembly. Movement of the yaw damper actuator piston generates a balancing signal by the linear variable displacement transducer (LVDT), which assists in returning the transfer valve to the neutral position. Feedback, provided through the external summing lever and linkage, returns the slides of the servo valve to near neutral, which maintains hydraulic pressure to hold the actuator position against the air load while not commanding further motion. Primary slide Secondary slide Servo valve housing

Factual Information 21 Aircraft Accident Report When rudder motion is commanded (by the yaw damper, rudder pedal input, and/or rudder trim), the internal input shaft moves the servo valve slides through the internal summing levers to connect hydraulic pressure and return circuits from hydraulic systems A and B so that hydraulic pressure is ported to the appropriate sides of the dual-tandem actuator piston to extend or retract16 the main rudder PCU piston rod. At the same time, fluid is directed from the other side of the piston to the hydraulic return system. As the rudder reaches the commanded deflection, external linkages reposition the servo valve’s internal summing levers to nullify the initial command signal and arrest further motion. During normal operation, the primary summing lever applies force to move the primary slide, and the secondary summing lever applies force to move the secondary slide as needed. The primary slide is normally displaced first, and the secondary slide is displaced only when the primary slide does not provide enough hydraulic flow to keep up with the input commanded by the pilots or the yaw damper (that is, when the movement of only the primary slide is not sufficient to move the rudder at the commanded rate). The normal maximum axial movement from the neutral positions to the extreme travel positions in either the extend or retract directions is about 0.045 inch for both the primary and secondary slides, for a combined distance of about 0.090 inch. Both the primary and secondary slides are designed so that they can move about 0.018 inch axially beyond their normal operating range (overtravel capability). The two slides are designed to provide approximately equal flow. Thus, the primary slide alone can provide a rudder rate of about 33° per second, and the primary and secondary slides together can provide a rudder rate of about 66° per second (under zero aerodynamic load conditions). The outside diameter surfaces of the primary and secondary slides are composed of Nitralloy 135 that, in its prefinished form (slightly larger in diameter than its finished form), is nitrided17 to a depth from 0.005 to 0.008 inch to a surface hardness of 55 to 58 on the Hardness Rockwell C (HRC) scale. The inside surfaces of the secondary slide and the servo valve housing are made of 52100 hardened steel (surface hardness 57 to 62 on the HRC scale). The outside diameter surfaces of the primary slide are very close to the inside diameter surfaces of the secondary slide, and the outside diameter surfaces of the secondary slide are very close to the inside diameter surfaces of the servo valve housing. In a March 18, 1999, letter, Parker advised the Safety Board that two engineering documents from 1966,18 which were produced during prototype testing of the servo valve, revealed that dimensional changes were made to the prototype because of conditions and performance results observed during the initial testing. According to the letter, a 16 When the actuator moves in the extend direction, it commands left rudder; when it moves in the retract direction, it commands right rudder. 17 Nitriding is a process in which the surface of the part is impregnated with nitrogen to increase hardness. 18 These documents were located by Parker in response to requests made in the context of litigation resulting from the USAir flight 427 accident.

Factual Information 22 Aircraft Accident Report March 11, 1966, Parker engineering order modified certain dimensions in the servo valve slightly to “insure accumulated tolerances will not cause reverse flow.” Additionally, the letter stated that a December 9, 1966, Parker engineering order indicated that other modifications were made “to preclude bottoming of [the] secondary slide at the detent at the max[imum] tolerance stackup.” According to the letter, after the dimensional changes were incorporated into the prototype servo valve’s design, it passed the acceptance test procedure, and no further flow problems were noted. Parker personnel stated that no servo valves with the original prototype dimensions were provided to customers. The letter further stated, “as we can best determine, ‘reverse flow’ was used to refer to cross-flow or higher internal leakage in the servo valve than is desirable…but had nothing to do with reversal in the dual concentric servo valve” and indicated that “the reversal phenomenon in the servo valve…was first seen in the 1992 examination of the…United Airlines Boeing 737 rudder power control unit [which resulted from a July 16, 1992, anomaly found during a ground check, as discussed later in this section and in more detail in section 1.16.4]—rudder or servo valve reversal was not an issue recognized at the time of the 1966 Engineering Orders.” Before 1989, the servo valve assembly engineering drawings did not specify diametrical clearances between the primary and secondary slides or between the secondary slide and servo valve housing. However, “shop travelers” (manufacturing documents that include instructions for specific tasks) used before 1989 indicated that the minimum and maximum clearances were 0.00010 and 0.00015 inch, respectively. On March 14, 1989, Parker released an engineering order that amended the servo valve assembly drawings to specify minimum and maximum diametrical clearances of 0.00015 and 0.00020 inch, respectively, between the outside diameter of the secondary slide and the inside diameter of the servo valve housing assembly and between the outside diameter of the primary slide and the inner diameter of the secondary slide assembly. According to Parker, the engineering drawing clearances normally allow the servo valve assembly to pass the functional testing that is part of the acceptance test procedure, and the servo valve components may then be individually polished based on functional test results to obtain the proper ease of movement. Because of the variability in dimensions of individual servo valve primary and secondary slides and the tight clearances required by the design, the servo valve components are assembled, installed, and maintained as matched sets. Before 1992, the acceptance test procedure for the servo valve assembly was based on compliance with performance standards. (According to Parker, each valve was to be “trimmed”19 until the desired functional performance was obtained.) Actual travel (or overtravel) capability of the primary and secondary slides had not been measured. In 1992, as a result of findings from the main rudder PCU anomaly found during a July 1992 United Airlines ground check, Boeing established maximum axial distances between metering edges for both the primary and secondary slides, and Parker instituted a 19 Trimming is the machine grinding of the outside diameter/groove interface that forms the metering edges for the primary and secondary slides. Trimming moves the metering edges to new longitudinal positions to better align the metering edges with the metering ports to meet functional test requirements.

Factual Information 23 Aircraft Accident Report functional test. In addition, the FAA issued AD 94-01-07, effective March 3, 1994, which required operators to test 737 main rudder PCUs at 750-hour intervals for internal hydraulic fluid leakage until they are replaced with new PCUs containing servo valves designed to prevent secondary slide overtravel. In addition to the functional testing performed on each individual main rudder PCU servo valve, one valve was subjected to qualification testing at the time of the 737’s initial certification.20 The purpose of this qualification testing was to ensure that the servo valve would be able to withstand the operational and environmental stresses expected during its life. 1.7 Meteorological Information 1.7.1 Observations and Forecasts The 0850 and 0950 surface weather observations for March 3, 1991, made by certified weather observers of the National Weather Service (NWS) at Colorado Springs were, in part, as follows: 0850: Record, clear, visibility 100 miles, temperature 49 degrees F, dew point 9 degrees F, winds 330 degrees at 23 knots, gusts 33 knots, altimeter setting 30.03 inches of Hg, cumulus over the mountains northwest. 0950: Record special, clear, visibility 100 miles, temperature 53 degrees F, dew point 8 degrees F, winds 320 degrees at 20 knots, gusts 28 knots, altimeter setting 30.02 inches of Hg, altocumulus over mountains northwest. The NWS office is located on the west side of the Colorado Springs airport. The maximum wind speed determined from the NWS Wind Gust Recorder Record from 0930 to 0950 was 29 knots. The minimum wind speed from 0930 to 0950 was 7 knots. The NWS wind sensor is located near the center of the airport about 10 meters above ground level (agl). The Low Level Windshear Alert System (LLWAS) at Colorado Springs was operational on the day of the accident. It consisted of six sensors located around the airport, each approximately 20 feet agl. Based on data from the LLWAS sensors, at 0932:43, the radar south controller in the Denver TRACON issued wind information to the flightcrew as “320 at 13, gusts 23." About 0933:06, the LLWAS readout indicated centerfield winds of 320 degrees, 13 knots, with gusts to 23 knots. These were the last 20 The qualification testing involved functional and environmental testing (including pressure, vibration, and thermal testing) under conditions that replicated assumed operating conditions (based on Boeing’s analyses). The redesigned servo valve being retrofitted on 737-100 through -500 series airplanes and installed on the 737 next-generation (-600 through -900) series airplanes also underwent qualification testing, and those tests included conditions that exceeded the assumed operating conditions (including thermal conditions that simulated an overheated hydraulic system) to evaluate the component’s functional limits.

Factual Information 24 Aircraft Accident Report recorded gusts on the LLWAS readout before the accident. The printout of the data lasted until about 0957. Winds broadcast by the local controllers in the Colorado Springs tower just prior to the accident were as follows: • 0938:07: 320 degrees at 16 knots, gusts 29 knots. • 0942:44: 300 degrees at 20 knots, gusts 30 knots. • 0943:20: 300 degrees at 22 knots, gusts 30 knots. These wind values were not consistent with the recorded LLWAS wind values. Although the direction was consistent with the recorded data, the recorded wind speeds were significantly lower than those broadcast by the controller. In an effort to try to understand these inconsistencies, Safety Board investigators visited the FAA's Aeronautical Center in Oklahoma City, Oklahoma, on April 30, 1991, and the LLWAS data printout of wind values and approximate times were verified. The local controller, in a subsequent interview, stated that the LLWAS was the only instrument in the tower cab that indicated wind direction and speed. He stated that he had referred to the LLWAS indicator for wind information when the airplane was on the local control frequency. The Safety Board was unable to determine the reason for the discrepancy between the recorded and broadcast LLWAS winds. The locations and plots of data from the LLWAS sensors are contained in Appendix G. A locally operated air quality network of meteorological sensors existed in the COS area. Data from these sensors were obtained by the Safety Board. Some of the pertinent data from the Pinello site, 2.7 miles northwest of the accident site, are listed below: Time WDa a. WD: Wind direction in degrees true WSb b. WS: Wind speed in miles per hour Tc c. T: Temperature in degrees C 0920 327.5 21.8 11.9 0930 314.2 20.8 12.1 0940 280.0 10.4 12.6 0950 327.2 6.4 13.4 1000 314.9 8.5 14.3

1010

1020 193.8 11.1 13.1

Factual Information 25 Aircraft Accident Report Wind direction and wind speed are 10-minute averages. The height of the wind sensor is 10 meters agl. A continuous recording of wind direction for the Pinello site showed a wind shift (northwest to southwest) about the time of the accident. The maximum wind speed recorded did not exceed 16 mph during the period of 0940 to 0950. The continuous recording of wind speed was not available because the recording pen ran out of ink. Acoustic Doppler radar data were obtained from the same network for the times from 0930 to 1000 at the Nixon Base located 6.2 miles south of the accident. A plot of the data of the Air Quality Network provided to the Safety Board by a Certified Consulting Meteorologist of Greystone Development Consultants, Inc., showed a wind shift line at 0940 and 0950 in the area of the accident. At 0940, winds north of the wind shift line were from the northwest about 10 miles per hour and south of the line southeast about 6 miles per hour. At 0950, winds north of the line were from the northwest about 6 miles per hour and south of the line from the southeast about 5 miles per hour. The Safety Board's Man Computer Interactive Data Access System (McIDAS)21 was used to examine the wind data from the LLWAS and air quality network. The Safety Board's examination of the data showed significant wind convergence and vertical axis Height (Meters agl) WDa a. WD: Wind direction in degrees true. WSb b. WS: Wind speed in meters per second. 60 165 2.1 90 158 2.3 120 143 2.5 150 144 2.2 180 146 2.4 210 144 2.7 240 142 2.9 270 142 2.9 300 136 3.2 60 165 2.1 21 Interactive Meteorological Analysis and data management computer system. McIDAS is developed and administered by the Space Science and Engineering Center at the University of Wisconsin, Madison, Wisconsin.

Factual Information 26 Aircraft Accident Report vorticity (rotation) in the area just south of the accident site around the time of the accident. The Safety Board calculated altimeter settings from station pressure values obtained from stations in the Colorado Springs Air Quality Network and station pressures obtained from the Air Force Academy (AFF). The Colorado Springs altimeter setting was from the Colorado Springs surface weather observation for 0950. All times for the altimeter settings listed below are for 0950. Upper Air Data Upper air wind data for 0700 for the AFF22 is as follows: Location Altimeter Setting at 0950 (inches of Hg) Distance/Bearing from Accident Site AFF 30.03 14 miles N-NW Chipita Park 30.07 17 miles NW Woodmen Valley 30.06 11 miles N-NW COS 30.02 4 miles N Nixon Base 29.98 6.2 miles S Nixon North 30.08 5.7 miles S Height in feet agl Wind Direction (Degrees True) Speed (Knots) 500 295 9 1,000 290 10 1,500 290 16 2,000 290 21 2,500 295 25 3,000 295 28 4,000 305 35 5,000 310 43 6,000 325 51 22 AFF field elevation is 6,572 feet.

Factual Information 27 Aircraft Accident Report Data from the Chatfield Profiler23 (53 miles north-northwest of the accident site) showed a wind speed of 39 knots from the northwest at 6,600 feet increasing to a wind speed of 142 knots from the northwest at about 14,900 feet. The Profiler data were centered around a time of 0830. The following relevant Pilot Reports (PIREPs) were made the day of the accident: At 0615, a B-747 at FL370, 10 nautical miles south of Denver reported moderate turbulence and a moderate mountain wave.24 • While over Colorado Springs at 0628 during a descent, a B-737 encountered +20-to -30-knots on final approach to runway 35. • At 0732, a B-737 encountered severe turbulence at FL200 approximately 46 nautical miles south southwest of Denver. It lost about 400 feet during the encounter. • At 0755, a B-727, at FL310, encountered a moderate mountain wave of +/ -40 knots approximately 48 nautical miles northwest of Denver. • At 0815, a Beech 36 at FL200, 30 nautical miles southwest of Denver, reported “500 to 1,500 feet (per minute) downdrafts...unable to maintain altitude.” • Over the Colorado Springs, Pueblo area, at 0850, a Cessna 172 reported moderate to extreme turbulence between 7,000 and 8,000 feet. • At 0900, a B-737 at FL350, 55 nautical miles west southwest of Denver, encountered moderate chop in mountain waves. • Over the Colorado Springs, Pueblo area, at 0916, at 9,000 feet, several aircraft reported moderate to severe turbulence at or below 9,000 feet. • At 0920, a B-737 at 500 feet, while on final approach to runway 35 at Colorado Springs, reported low level wind shear of -15 knots at 500 feet, +15 knots at 400 feet, and +20 knots at 150 feet. • The captain of Continental flight 166, a B-737-200, who departed runway 35 at COS, about 4 minutes after the accident, reported gusty winds but no wild gyrations. He said it was a normal Colorado windy day. • The pilot of a Cessna airplane who was located about 4 miles northeast of the accident at the time of the accident, reported slight, occasional, moderate chop at 7,000 feet. Also noted were indicated airspeed fluctuations between 65 and 105 knots with vertical speed indications of approximately 500 feet per minute. • The captain of UAL flight 714, a Boeing 737-300, who departed runway 30, COS, at 0905, reported light chop with one “good sinker.” 23 Vertically pointed radar that is used to measure winds in the atmosphere. 24 A wave in the atmosphere which is caused by and is therefore stationary with respect to the mountain.

Factual Information 28 Aircraft Accident Report The following in-flight weather advisory was pertinent to the time and area of the accident: • SIGMET (significant meteorological information) Juliet 1, valid from 0915 to 1315 local, called for mountains25 (sic) occasional severe turbulence 18,000 feet to 38,000 feet reported by 737 and 727. Information pertinent to the accident contained in the Area Forecast (FA), issued by the National Aviation Weather Advisory Unit in Kansas City, Missouri, at 0445 on March 3, and valid until 1000 on March 3, was as follows: • Flight precautions: Turbulence. • Light occasional moderate turbulence below 20,000 feet with local strong up and downdrafts over and near the mountains. The Terminal Forecast (FT), issued by the NWS Forecast Office in Denver, Colorado, for COS, in effect for the time of the accident is as follows: • COS FT...0728 to 1000...Clear, winds 340 degrees at 20 knots gusts 35 knots. An Aviation High Wind Advisory issued by the NWS at COS, valid from 0800 to 1400, was in effect for COS. It called for northwest winds 25 knots with possible occasional gusts to 40 knots, especially in the foothills. The NWS observer on duty at the time of the accident was certified to make surface weather observations. He had been at COS since May 1990, and worked the 0800 to 1600 shift, which he characterized as routine. He said that from 0900 to 1000 the winds were gusty and the wind direction varied about 20 to 30 degrees. The Denver Air Route Traffic Control Center Weather Service Unit (CWSU) meteorologist who was on duty at the time of accident worked the 0600 to 1400 shift. He had been at the Denver CWSU since November 1990. About 0705, he provided an area briefing (Area 3, which included the COS area) to the area manager in charge. A copy of the briefing was provided to the supervisor. The briefing forecast was for light to moderate turbulence below 40,000 feet with isolated severe turbulence at and below 18,000 feet. He was aware of moderate and severe turbulence reports pertinent to Denver's airspace, including some severe turbulence reports below 20,000 feet. He did not issue a Center Weather Advisory (CWA) for severe turbulence because he believed the requirements for issuance were not met. Requirements for a CWA are to supplement or enhance SIGMETs. He stated that the Radar Remote Weather Display System (RRWDS) was not showing any precipitation echoes in the area of COS at the time of the accident. The RRWDS was set to the Limon, Colorado, NWS weather radar. The forecaster at the National Aviation Weather Advisory Unit in Kansas City, Missouri, stated that he did not issue a SIGMET for low level turbulence for the area of 25 About 1030, “mountains” in Juliet 1 was corrected to “moderate.” The SIGMET and corrected SIGMET were issued by the National Aviation Weather Advisory Unit in Kansas City, Missouri.

Factual Information 29 Aircraft Accident Report COS because most pilot reports were of moderate intensity and were local in nature. In addition, light to moderate turbulence below 20,000 feet was forecast in the FA. The Aviation Forecaster at the NWS Forecast Office at Denver did not append a low level wind shear (LLWS) remark to the COS FT. The forecaster stated that analyses of the continuously available profiler data (wind speed and direction) at Denver indicated that the remark was not necessary. In addition, the forecaster never saw the 0920 pilot report that indicated a 20-knot gain of airspeed by a B-737. NWS forecasters do routinely look at pilot reports; however, the forecaster stated that this might have been an oversight. Weather observations from the AFF indicated that there were rotor clouds to the west between 0700 to 0900. Rotor clouds were not reported on the next observation. According to weather personnel at Peterson Air Force Base, collocated with COS, rotor clouds have been observed previously in the area of the airport in COS but that such an occurrence is uncommon. The weather radar at Peterson did not detect any weather echoes at 0950. Due to strong gusty surface winds, there was an LLWS Advisory in effect. The Safety Board was informed by A. J. Bedard, Jr.,26 National Oceanic and Atmospheric Administration (NOAA), that atmospheric rotors can occur in the area where the accident occurred. He stated that atmospheric rotors can occur some distance downwind from the front range of the mountains and can be quite strong. A sailplane pilot, who flies in the area north of COS, was interviewed by Safety Board investigators and stated that he thought the existence of a mountain wave and atmospheric rotor in the area of the accident was possible. He added, however, that he believed the rotor would be farther south than usual. He said that he had flown in many rotors and that, on occasion, he had nearly lost control of his sailplane. He said that it was possible for a rotor to come close to the ground. He mentioned that he had seen tow planes penetrate rotors, a situation that resulted in bank angles of 90 degrees. Another sailplane pilot, who had 15 years experience in mountain wave flying in the COS area, stated that he was at Meadow Lake (14 miles northeast of the accident) planning to fly on the morning of the accident. After talking to a pilot who terminated his flying because of “turbulent, squirrely conditions,” he decided not to fly. He commented that it is “not uncommon” for rotor clouds to touch the ground at the AFF and the monument area north of COS. He also said that the rotor clouds did occur south of COS, although they were rare. According to the World Meteorological Organization, the base of rotor clouds is generally near or below ridge lines, yet the tops may be considerably higher than ridge lines and may merge with the lenticular clouds [lens-shaped] directly above. Unlike the lenticular clouds, rotor clouds show evidence of strong and occasionally violent turbulence. They are constantly forming on the windward side and dissipating on the leeward side and appear to rotate--the upper portion moves forward while the lower portion moves backward towards the mountain. A succession of rotor clouds may appear 26 Supervisory physicist for the Wave Propagation Laboratory, Boulder, Colorado.

Factual Information 30 Aircraft Accident Report at regular intervals downwind from the mountain ridge. Rotor clouds develop in standing eddies that form in the lower layers under the crests of the mountain wave. Lenticular clouds may be visible above these clouds. However, rotor clouds often provide the only visible evidence of the mountain wave. Clouds may or may not occur with rotors, depending on the moisture profile of the atmosphere. Therefore, rotors may be invisible to the eye. (See figure 8). Figure 8. Types of airflow over ridges: (a) laminar streaming; (b) standing eddy streaming; (c) wave streaming; and (d and e) rotor streaming. Dashed line on left indicates vertical profile of horizontal wind speed. A glider instructor, who had been in the COS area for more than 25 years, was interviewed. He stated that around 1200 on the day of the accident, he observed a rotor hit

Factual Information 31 Aircraft Accident Report the ground with estimated wind speeds of 70 to 80 miles per hour. He was inside a building at a wrecking yard when he heard the roar of the wind. He then went outside and saw a rotor impacting the ground in the yard, which he said was about 1/2 mile east and 5 miles north of the extended centerline of runway 35 at COS. Tree limbs were blown off and car hoods were damaged. He believed that the rotor was part of a line of rotors extending north to south which would most likely have extended to the area where the accident occurred. He stated that the year's weather activity had been highly unusual with many days of strong downslope winds and rotors. He said that he had experienced vertical velocities of 5,000 to 6,000 feet per minute in rotors and that rotors can be as small as a “gymnasium” or many miles long. He added that the force of rotors impacting the ground has severely damaged houses, railroad cars, and trucks. In a subsequent written statement, the instructor told the Safety Board that the wrecking yard was about 12 statute miles north of COS and 1 statute mile east of the extended centerline of its runway 17-35 and that the elevation was 7,300 feet. He stated that on the morning of March 3, 1991, he observed a rotor system on a line parallel to the Front Range, passing over the wrecking yard and other points north and south, especially south because of the angle of Pikes Peak, Mt. Rosa, and Cheyenne Mountain with the northwest prefrontal wind. He said that on the morning of the accident, there was an unusually strong prefrontal weather system and a sky full of rotor clouds. He added that he had flown gliders into vertical velocities of more than 5,000 feet per minute in and around rotor/wave systems and that pitch changes of 60 degrees and roll changes of 180 degrees (inverted) are not uncommon. A Continental Airlines pilot, who had flown in the COS area since 1965, stated that during strong mountain wave conditions, rotors have occurred over the approach to runway 35. He said that he has flown in rotors in the COS area in T-37, T-38, and B-727 airplanes, but that any roll activity was countered by aileron application without difficulty. He has seen airplanes roll to 45 degrees in rotors. On the day and approximate time of the accident, he observed a lenticular cloud over Pikes Peak. He stated that given the right conditions, rotors can exist along the route from Denver to COS. The rotors are accompanied by moderate to severe turbulence. He said that he has heard from many pilots that the area south of COS is extremely rough to fly. He added that during suitable conditions, a primary wave is located over Manitou Springs (16 miles northwest of the accident site), a secondary wave is just north of the AFF, and a “tertiary” wave extends over COS. The Weather Briefing Message, printed March 3, at 0808, for the Denver (DEN) to COS segment, provided to the crew of flight 585 by UAL consisted of map features, origin, destination, and alternate weather, destination area weather; PIREPs, and en route NOTAMs. The map features section was valid from March 3 mountain standard time to March 4 mountain standard time. It was a description of the maximum wind speed and location, the 0200 surface pressure center, frontal position, and VFR conditions predicted for the Rockies. The DEN weather included surface observations for 0551, 0652, and 0750; the DEN NWS FT valid from March 3 to March 4, and the UAL DEN FT and DEN

Factual Information 32 Aircraft Accident Report NOTAMs. The observations indicated clear skies, 70 miles visibility, and northwest winds with gusts to 19 knots. Both the NWS and UAL Terminal Forecasts were similar and called for VFR conditions. The COS weather included the 0551, 0650, and 0750 surface observations, the COS NWS FT Amendment 2, and the COS NOTAMs. The surface observations indicated clear skies, unlimited visibility, and northwest winds gusting 31 to 37 knots. The FT called for VFR conditions with winds 340 degrees at 20 knots, gusting to 35 knots. No weather was included for an alternate airport, nor was any required. UAL meteorologists issue routine forecasts for clear air turbulence (CAT) and mountain waves over the United States. In addition, forecasts for nonconvective LLWS were issued for only major hubs and COS was not covered. At 0825, on March 3, UAL issued a CAT mountain wave forecast covering Montana, Wyoming, and Colorado, for FL200 to 390, valid 0825 to 2000. 1.7.2 Topics from Meteorological Meeting The Safety Board's Meteorology Group convened a meeting in Boulder, Colorado, on March 27, 1991, with scientists from NOAA, the National Center for Atmospheric Research (NCAR) and the University of Wyoming to discuss orographically generated weather phenomena that might be pertinent to the accident. The topics raised were historical in nature and were not present on March 3, 1991, except as noted. The following are points raised during the meeting that the participants agreed upon: • The parameters of a representative atmospheric rotor are as follows: a radius of 500 meters; a linear increase of tangential velocity from the center to 500 meters. Velocity at a radius of 500 meters is 30 meters per second. The change in velocity is 30 meters per second per 500 meters. Outside a radius of 500 meters, the tangential velocity decreases as 1/radius. The rotational rate of the core mass would be 0.06 radians per second or 3.5 degrees per second. This information was obtained from 2 measurements of Doppler Lidar and FM/CW Doppler Radar, conferences with other scientists, and time lapse movies. • Surface pressure drops of as much as 10 millibars can be expected in strong eddies. • Observations were made in the Boulder area of trash cans flying up the streets at high speed and then flying back down the streets at high speed. • A documentary film demonstrated that vertical axis rotation of lenticular clouds can reach speeds of 10 meters per second and heights of 3 to 4 kilometers.

Factual Information 33 Aircraft Accident Report • Important accepted meteorological parameters in obstacle flows are wind speed strength, variation of wind speed with height, variability of wind (gusts/surges), angle relative to obstacle, obstacle shape and height, relative position of obstacles, stability of the atmosphere (temperature variation with height), and humidity. • The numerical modeling of leeward waves is complicated. There is a strong interaction of leeward waves with the surface. • Caution must be used in applying surface data to determine conditions aloft. • There are not many measurements of atmospheric rotors. Rotors can form in lines several hundred kilometers long. The front of the rotor has the most severe turbulence. • In the past, horizontal gusts have existed at high altitude (40,000 feet), 60 to 80 miles per hour over mountainous terrain. Moreover, a 16-G load is estimated to have occurred based on the damage sustained to a sailplane during similar high altitude winds. • Acceleration of the flow of air above 10,000 feet to more than 60 knots occurred over Denver about 0700 on March 3. • From the Chatfield Profiler data, a change of horizontal wind speeds in the vertical of 50 meters per second per kilometer coincided with a period of accelerated winds over the continental divide. • Rotors can descend and interact with the ground and produce strong surface winds. • Airflow over the mountains excites gravity waves, sometimes resulting in a large amount of horizontal vorticity tilting to vertical vorticity downward. • Horizontal vorticity that is parallel to the mountains, when tilted to vertical, results in gusts. • Numerical modeling in January 1989 showed vertical axis vorticity in the COS area. Meteorological conditions were similar to the day of the accident. • The maximum speed that can be generated in vortices is unknown. • Vorticities generated by the numerical model were about 1/10 the vorticity of a tornado. • A University of Wyoming instrumented King Air 200 flew approaches into COS the day after the accident. The general weather condition, such as occurred on March 3 in the COS area, occurs 10 to 15 days a year. When the King Air flew on March 4, the weather conditions were similar to those on March 3. Its data showed a wind shadow east of Pikes Peak below 11,000 feet. During the flight test, the wind shadow extended from about 10 kilometers south of COS to 5 to 10 kilometers north of COS. There were lighter winds and a wind reversal in the shadow. Vortices and turbulence were present at the

Factual Information 34 Aircraft Accident Report interface between strong winds and light winds in the shadow. Above the ground, waves were producing vertical roll; 800 to 1,000 feet per minute vertical velocities were recorded during the King Air flights. • Wave activity over the mountains is a function of atmospheric stability and wind speed. Small differences in these parameters produce large differences in the atmospheric response. • Isolated phenomena (horizontal and vertical axis vortices) caused by Pikes Peak are probably more significant than typical mountain wave phenomena. • On March 3, according to Geostationary Operational Environmental Satellite (GOES) data, there was no evidence of rotors in the COS area at the time of the accident. A weak cap cloud was seen in imagery near Pikes Peak through GOES data. GOES BAND-10 data showed a trough of a mountain wave near the Colorado Rockies front range (area of warm temperatures). 1.7.3 Witness Information and Satellite Data on Vortices The following information supports evidence of a strong horizontal axis vortex at the time and in the area of the accident: • A witness report of a brief 90 mile per hour or stronger (132 feet per second or stronger) gust from the west about 2 miles east (downstream of the accident site) and a witness report of a 50 to 70 knot gust about 1.25 miles east of accident site. Gusts occurred about the time of aircraft impact. Another witness reported a possible strong gust a few blocks west northwest of the accident site about the time of the accident. Most witnesses near the accident site reported light winds. Mean upper flow had a westerly component. • GOES visible satellite imagery examined on McIDAS showed an upper air cloud feature whose southward extended axis is moving across the accident location about the time of the accident. Analysis of satellite imagery showed the feature to be moving southeast about 45 meters per second. This feature may have been an area of upward vertical motion containing vortices. There seems to be support in the witness statements for the feature seen in the satellite imagery. In addition to the two witnesses noted above, a witness at a golf course northwest of the accident site reported a brief strong gust, swirling winds, and downdrafts about 5 to 7 minutes prior to the accident. He estimated wind speeds at 50 to 60 miles per hour. At about 0940, a motorist southeast of that location (about 3 miles northwest of the accident site) reported a brief gust that almost blew his car off the road. A person in a Chevrolet S-10 Blazer reported a brief strong wind about the time of the crash. He was located a few blocks west northwest of the crash site.

Factual Information 35 Aircraft Accident Report Evidence of the existence of vortices in the area of the accident: • King Air flights on the day after the accident measured turbulence and vertical velocities of 800 to 1,000 feet per minute in the area where the accident occurred. Atmospheric conditions were similar to the day of the accident. • The Super King Air pilot ran into “terrible shear” in the area of the crash. At 7,500 feet AGL the airplane lost 20 knots of airspeed, and 100 feet of altitude. He described it as a very hard hit. He departed from Fort Carson at 0800 MST on the day of the accident. • Examination on McIDAS of wind data from the Colorado Springs Air Quality Network and LLWAS at the approximate time of the accident showed a discontinuity in the wind field oriented west to east in the area of the accident. The flow was converging in this area, and along this discontinuity, vortices could form. Observations of horizontal axis vortices (rotors) on the day of the accident: • Rotors were reported southwest of the AFF prior to the accident. • Three distinct rotor clouds at 11,000 feet to 12,000 feet moving east-southeast were observed by an airline captain at about 0845 in the Palmer Lake area (15 miles north-northwest of COS). • A rotor was observed hitting the ground around noon about 12 miles north of COS with estimated wind speeds of 70 plus miles per hour. Calm returned after 30 seconds. One person located about 6 miles west of the accident site observed several rotor clouds near Widefield within 10 to 15 minutes of the accident. He estimated the rotor clouds to be at 7,000 feet but was unsure of their intensity. However, he also observed rotor clouds over his home rotating very fast. He said that the rotors were accompanied by very thin wisps of condensation. 1.7.4 Previous Accidents/Incidents Attributed to Vortices A review of accidents/incidents involving horizontal axis vortices (not including vortices generated by aircraft) for the past 30 years includes the following: • A B-52 lost about 75 percent of its vertical stabilizer and rudder while flying at 350 knots indicated airspeed (KIAS) at a pressure altitude of 14,300 feet msl 5.4 miles east of Spanish Peak in Colorado, on January 10, 1964. The ground elevation was about 8,500 feet. The mountain top level was 13,500 feet. Boeing calculates the angular velocity at .66 radians per second for this event. Maximum gusts exceeded 140 feet per second. • A BOAC 707 experienced structural failure while flying between 320 and 370 KIAS at 4,900 meters msl, 6 kilometers east of the summit of Mr. Fuji, Japan, on March 5, 1966. There was a strong mountain wave system leeward

Factual Information 36 Aircraft Accident Report of Mt. Fuji. The breakdown of waves resulted in small-scale turbulence with an intensity that might have become severe or extreme in a short period of time. The aircraft suddenly encountered abnormally severe gust loads exceeding the design limit and disintegrated in the air in a very short period of time. At the summit of Mt. Fuji (3,776 meters), the wind was north/west at 60 to 70 knots. • A BAC-111 experienced structural failure between 2,000 and 3,000 feet near Falls City, Nebraska, on August 6, 1966. Ground witnesses observed the aircraft fly into or over a roll cloud preceding a thunderstorm and shortly thereafter saw an explosion in the sky followed by a fireball falling out of the cloud. Vortices were associated with the outflow of cold air from an approaching squall line. The forces and accelerations produced by this encounter caused the fin and right tailplane to reach their ultimate loads with near simultaneous failures resulting. • A Fairchild F-27B, flying about 11,500 feet around 220 KIAS, experienced an in-flight structural failure resulting from an encounter with severe to extreme turbulence on December 2, 1968, at Pedro Bay, Alaska. A consultant calculated the existence of an intense low-level mountain wave about 5 miles downwind from the ridge of Knutson Mountain (approximately 6 miles northwest of Pedro Bay). A rotor region of mountain wave would have existed between 2,000 feet and 3,000 feet over the northern tip of Pedro Bay. The gust loads in the rotor were beyond the ultimate design limits of a transport-category airplane. The investigation showed that the right outer wing, the empennage, portions of the left wing, and other components of the aircraft structure had separated from the aircraft in flight. 1.7.5 Review of Information Obtained from A.J. Bedard, Jr., NOAA: • Summary of hazard potential for March 3. There was a moderate potential for a steady-state horizontal roll vortex associated with a lee wave. There was a moderate to high potential for a nonsteady horizontal roll vortex associated with a wind surge and moving downstream. The potential was high for a steady state 3-D twin vortex pattern with sporadic instabilities rolling up into vertical axis vortices. The potential was high for Von Karman vortex shedding. The highest potential was for a strong vertical axis vortex associated with a wind surge. • A significant pressure drop (in some cases over 21 millibars) will occur in the core of a strong horizontal axis vortex that is stationary or is moving with the medium. A pressure drop will also occur along the edge of the core (about 1/2 that of the core pressure drop). If the vortex is moving relative to the medium, the pressure distribution becomes more complicated even though the rotational flow is the same. In a strong vortex moving relative to the medium (translating vortex), the pressure distribution is strongly dependent on a position in the

Factual Information 37 Aircraft Accident Report vortex. A pressure decrease still occurs in the core. However, there are regions above the core where the pressure change is small and pressure increases can occur. In addition, very strong pressure decreases of as much as 50 millibars may occur just below the core of a strong, moving vortex. • Strong rotors would be accompanied by an audible “roaring” sound. The intensity of the sound increases rapidly as the tangential speed increases. Appendix F contains excerpts from relevant literature and correspondence pertaining to rotors and mountain waves and other terrain-induced atmospheric phenomena. 1.8 Aids To Navigation Not applicable. 1.9 Communications There were no radiotelephone transmissions received by any ground station indicating trouble with N999UA. No discrepancies were noted on any communications equipment that potentially could have affected flight 585. 1.10 Aerodrome Information 1.10.1 General The Colorado Springs Municipal Airport is a public-use airport owned and operated by the City of Colorado Springs. It is controlled by an FAA tower that is attended 24 hours a day and has been classified as a Federal Aviation Regulation (FAR) 139 index C airport since May 1973. The elevation of the airport is 6,172 feet. The airport has two runways, runway 12/30 (8,511 feet by 150 feet) and runway 17/35 (11,021 feet by 150 feet). Runway 35 has a 1,000-foot paved stopway, a precision approach path indicator (PAPI), and a full instrument landing system (ILS). The glideslope is 3 degrees. For the 12 months ending September 27, 1990, takeoff and landing operations totaled 176,880 movements, of which 18,912 were air carriers. There are extensive areas of high terrain in the COS area. Minimum sector altitudes (MSAs) of 9,000 feet exist within 25 nmi from the north northwest, clockwise through south of the airport. Higher elevations with area minimum altitudes (AMAs) above 16,000 feet lie to the west within 15 nmi of the airport. COS is not categorized as a special airport by the FAA or UAL. There are some specific airports where the FAA has determined that special qualifications are required for

Factual Information 38 Aircraft Accident Report pilots to land, as provided in FAR section 121.445 and Advisory Circular number 121.445-1D. UAL has similar procedures for certain airports. 1.10.2 Weather Related Accidents/Incident Data The National Transportation Safety Board's accident data files were reviewed for accidents that occurred within the State of Colorado in which windshear or mountain wave activity were cited as causal or contributory to the mishap. The data reviewed covered the period from December 24, 1974 to September 2, 1990. Of the 31 accidents reviewed, only one was listed as having occurred in proximity to Colorado Springs, Colorado. This nonfatal accident, which took place on December 1, 1983, occurred when a sailplane encountered a mountain wave near the Black Forest Glider Port while on approach to land. 1.11 Flight Recorders The Boeing 737 Cockpit Voice Recorder (CVR) and Digital Flight Data Recorder (FDR) are located in the airplane fuselage, aft left side, within the pressurized area of the airplane. Both recorders from flight 585 were recovered from the accident site and sent to the Safety Board's laboratories in Washington, D.C., for readout. The FDR was a Fairchild Model F800, serial number 4016. The recorder has the capability to record many parameters; however, it was installed in N999UA to record only 5 parameters: heading; altitude; airspeed; normal acceleration (G loads)27; and microphone keying. All parameters were sampled and recorded once per second except vertical acceleration, which was sampled 8 times per second. The FDR sustained extensive impact damage to its external dust cover sleeve and internal electronic components. The dust cover sleeve was cut away from the protective casings to remove the internal tape assembly. Once the tape assembly was opened, the tape cover was found broken and the tape medium was partially dislodged and crumpled; however, the tape was not torn or mangled, and the data were extractable. Figure 9 shows the ground track with selected CVR data. Figure 10 is a profile view of the flightpath with selected CVR data. 27 G-load is a unit of acceleration equal to the acceleration of the Earth's gravity, used to measure the force on a body undergoing acceleration, and expressed as a multiple of the Earth's acceleration.

Factual Information 39 Aircraft Accident Report Figure 9. Ground track with selected CVR data Figure 10. Profile view of flightpath with selected CVR data

Factual Information 40 Aircraft Accident Report The CVR was a Sunstrand Model V557, serial number unknown. It sustained some structural damage, but the crash case maintained the overall integrity of the recording tape. Due to the severity of the impact and the nature of the tape cartridge employed in this CVR, the tape had several creases which degraded the audio quality on playback. Also, due to the ejection of the CVR from the airplane into a nearby shallow creek, the CVR sustained minor water contamination that had no apparent contribution to the relatively poor playback quality of the tape. The CVR had no fire or smoke damage. The playback time of the tape was 30 minutes and 14 seconds. An acoustic spectral study was performed on the CVR tape to determine the rotational frequencies of the engines prior to the accident. It was also used to attempt to determine whether the airplane's stabilizer trim actuations during the final stages of the approach were the result of pilot trim switch actuations or autopilot trim inputs. The rotational frequencies of the engines from approximately 2 minutes and 14 seconds prior to impact showed normal operation except that continuous frequencies during the final 10 seconds of tape were not attainable because of strong foreground noises in the cockpit. The study of comparative spectral data of the trim acoustic signatures heard on the CVR tape and that of manual trim switch actuation heard on a reference test tape showed that the trim rates were pilot inputs rather than from the autopilot. Sounds consistent with abnormal events, such as bird strikes, structural failure, or catastrophic engine failures, were not found. 1.12 Wreckage and Impact Information The wreckage site was located about 3.47 nmi south of the south end of runway 35 at COS and .17 nmi to the east of the extended centerline of the runway. The elevation of the crash site was about 5,704 feet above msl. Measurements of the wing tip debris, the engine shafts, and the tree strikes indicated an impact heading of 205 degrees, an 80-degree nose-low attitude, a 4-degree nose-right yaw, and a right rolling motion. The flightpath direction was about 020 degrees magnetic, and the flightpath angle was about 80 degrees down. The wreckage debris found outside the crater were mostly to the northeast, although the airplane heading was aligned to the southwest (nearly vertical, nose down) at ground contact. The normal acceleration just prior to ground contact was about 4 G, requiring a 16-degree angle of attack at 212 knots. Witnesses reported continuous smooth rolling and pitching from normal flight attitudes all the way to ground contact. The airplane flightpath and attitude at ground contact can be described as follows: With the airplane pointed northeast, aligned with the wreckage scatter, roll the airplane inverted, and pitch the airplane down 84 degrees to establish the flightpath. Then continue the pitching of the nose 16 additional degrees (angle of attack) to 100 degrees (10 degrees past vertical) to establish the pitch attitude of the airplane. In this attitude, the airplane is then nose down 80 degrees, upright, and pointed to the southwest while still moving towards the northeast.

Factual Information 41 Aircraft Accident Report Witnesses saw no pieces of the structure fall from the airplane prior to the impact. An aerial search along the flightpath found no debris that had separated from the airplane before ground impact. There was no evidence of fire south of the principal impact crater. The airplane's fuselage had severe accordion-like fore and aft crushing throughout its entire length with overstress breaks. Except for two aft fuselage sections of skin and small debris, the entire fuselage was contained within the impact crater. Wreckage examinations were conducted on site, at a local storage facility, and at the facilities of various manufacturers. Fuselage examination revealed no evidence of any preimpact failures or malfunctions. The windshield was severely cracked from overload consistent with terrain impact at a high vertical speed. The severity of the impact and postcrash fire precluded documentation of the relative positions of the cockpit seats and rudder pedals. No damage was found that could be associated with preimpact strikes with birds or other objects. Parts of the door assemblies were examined. The evidence is consistent with all doors being locked, and no evidence of preimpact failures was found. The left wing was partially in the crater at the crash site. The entire length was broken into pieces, and the portion of the wing in the crater was burned and partially consumed by fire. The leading edge devices, although severely crushed, revealed evidence of having been in an extended position. All of the leading edge devices, spoilers and aileron actuators were in and around the crater. The slat actuator in the number one position was still attached to the wing structure. Wing structures, containing the fuel cells, were concave, ruptured and burned. The left aileron, flaps and slats were found at the wreckage site. The No. 3 slat actuator was found in the mid-position, and the No. 2 leading edge flap actuator was found approximately 1/2 inch from full extension. No control system parts were missing. The right wing was partially in the crater. The entire wing, from the engine attach points outboard, was severely crushed. The outer 35 feet of the wing was located outside the crater and was embedded in the ground with the leading edge down and the chord of the wing perpendicular to the ground. The leading edge devices, although severely crushed, were in an extended position. The outer 6 feet of the wing had broken off and had marks and damage consistent with tree strikes. The wing was near a tree that had marks consistent with wing impact. The wing panels were split open and bowed in a convex manner consistent with hydraulic (fuel tank) overpressure. The inboard portions of both wings from the engine attach points to the fuselage were in numerous pieces. Some portion of the lighter structure had melted. The wing flaps were separated from their tracks and were recovered at the crash site. Measurements of the flap jack screw positions corresponded to symmetrical flaps on the left and right side. According to Boeing technical data, the measurements indicated 10-degree outboard and 12-degree inboard flap positions corresponding to FLAPS 10 position of the flap handle. The right aileron was separated from its wing and recovered about 25 feet north of the wing. The vertical stabilizer and rudder were in the impact crater, damaged severely by impact and fire. Remnants of the vertical stabilizer and rudder were removed from the

Factual Information 42 Aircraft Accident Report crater and examined for preimpact abnormalities. The vertical stabilizer fin cap was damaged but complete. The lower vertical stabilizer front spar structure was in the crater and was severely damaged by impact. The attach fittings and bolts were complete and included portions of rib structure and stabilizer skin. Approximately 4 feet of the lower rear and false vertical stabilizer spar assemblies were found attached to their respective fittings. The rudder attach points were found with the hinges, bolts and a 4-foot section of the rudder still attached. Both rudder control systems were damaged but found connected to the lower portion of the rudder at their respective attach points. The two counterweights were in the crater, detached from their respective attach points. Several sections of burned and damaged rudder were found that included inspection ports and attachment fittings. The horizontal stabilizer was in the crater, in pieces and severely burned. The horizontal stabilizer parts were located at the top of the pile of destroyed airplane debris. The star section (front and rear horizontal spar to fuselage attach structure) was separated into three major pieces. A 5-foot section of the right-hand horizontal stabilizer front spar was attached to the center section of the star section with the spar attachment bolts and fittings intact. A small section of the left-hand horizontal stabilizer front spar was attached to the center section of the star section with the spar attachment bolts and fittings intact. A 5-foot section of the right-hand horizontal stabilizer rear spar was attached to the center section of the star section with all three attachment bolts and fittings intact. A 4-foot section of the left-hand horizontal rear spar was attached to the center section of the star section with all three attachment bolts and fittings intact. Both the left and right horizontal stabilizer hinge fittings and bolts were examined for security and preimpact malfunctions. No abnormalities were noted. The center section jackscrew and jackscrew system were examined, and no abnormalities were noted. The left and right elevators were destroyed during the impact and postcrash fire; however, parts of the elevators from the tips to the center were found and examined. Both the left and right elevator balance hinges (three on each side) were found and examined. All six balance hinges had structural damage indicative of overstress and all had hinge pins and attachment hardware that were complete. Both of the outboard elevator counterweights were in the crater. Both left and right inboard elevator hinge points were intact with portions of the respective elevator balance tab push rods (two on each side). The landing gear assemblies were in the crater in the extended position. There was some fire and extensive impact damage to all three landing gear assemblies. The tires located in the crater were severely burned. The right main gear outboard tire was about 200 feet northeast of the crater. The right main gear outboard rim half was about 175 feet northeast of the crater. All of the landing gear actuating cylinders were in the extended position. Both main landing gear over-center locking arms were in the locked position. No evidence of preimpact malfunction was found with the actuating cylinders. The left engine was buried about 10 feet nose down in the ground under the left wing at about a 75-degree impact angle. The nose cowl and the inlet cases were destroyed. The first and second stage compressor disk modules were about three feet ahead of the outer fan case. The fracture surfaces on these parts revealed characteristics of tensile overload. All first stage fan blades were broken off just above the platform. Most second

Factual Information 43 Aircraft Accident Report stage fan blades were broken off, but those remaining were bent opposite to the direction of rotation of the compressor. The left engine thrust reverser had separated from the engine and was located about 150 feet northeast of the impact crater. It was impact damaged, but its track and actuating mechanism were intact and in the stowed position. The left engine separated in sections during its removal from the impact crater. The inspection of it disclosed no mechanical problems that would have precluded normal operation prior to impact. The forward portion of the right engine was buried about 7 feet in the ground under the right wing at an angle of about 50 degrees. The portion aft of the combustion section of the right engine was separated, and some parts were located about 25 feet north of the impact crater. The combustion chambers were exposed from the aft end and did not exhibit any distress or metalization. The right thrust reverser was located about 140 feet north of the impact crater, in line with other parts that had exited the engine. The thrust reverser was in the stowed position. The high pressure turbine (HPT) rotor from the right engine (minus the shaft) was located 553 feet north of the impact crater. The first and second stage compressor fan disk modules were located about 1 foot forward of the outer fan case. The first stage fan blades were separated from their disk and were in the impact crater. The remaining fan blades were pushed back and bent opposite to the direction of rotation of the low pressure compressor. Most of the second stage fan blades were broken off at their platforms. The remaining blades were bent opposite to the direction of rotation of the compressor. Examination of the right engine during its removal from the ground revealed that it was twisted clockwise, as if the front was stationary and the aft end was rotated clockwise. The turbine disks and blades for the first through the fourth stages of the compressor, the low pressure turbine (LPT) and HPT shafts, and various vane airfoil and shroud fragments were removed and examined at the UAL Maintenance Operation Center at San Francisco, California. The inspection of the right engine and its associated components did not reveal any mechanical problems that would have precluded normal operation prior to impact. Damage to the cockpit area of the airplane precluded meaningful examination of most of the cockpit equipment and indicating systems. The engine indicating instrumentation was recovered in a condition which permitted meaningful examination. Examination of the engine indicating instrumentation indicated that, at impact, the N1 speeds for left and right engines were 86 percent and 84 percent, respectively. EPRs were 1.97 for both engines. N2 speeds were found at 93 percent for the left engine and in the range of 86-88 percent for the right engine. These indications are sufficient to show that both engines were producing nearly symmetric thrust at impact. The pilot's and copilot's glareshield annunciator panels were also recovered and examined. Light bulb filament analysis of the captain's annunciator panel indicated that

Factual Information 44 Aircraft Accident Report the FLT CONT, FUEL, and OVHT DET indicators may have been illuminated at impact or as a result of the accident events. The copilot's annunciator panel indicated the potential for illumination of the HYD, OVERHEAT, AIR COND, and an unused segment of the annunciator panel. A heated filament in the bulbs of the unused segment of the annunciator panel is unexplainable except for the possibility that the press to test circuit was activated during the impact sequence. 1.12.1 Engine Mount Examinations The three engine mount cone bolts from both the left and right engines were located and sent to the Safety Board's Materials Laboratory for examination. All six bolts were found mechanically damaged and separated at the undercut radius between the threaded end and conical portions of the bolts. Examination of the bolts revealed fracture features and deformation consistent with overstress separations. There was no evidence of fatigue cracking or other types of preexisting defects. 1.12.2 Examination of Roll and Pitch Flight Controls Components and Other Systems A total of 46 components were removed from the airplane and functionally tested or examined at the UAL Maintenance Operations Center in San Francisco, California, under the supervision of the Safety Board. Each component was unpackaged, documented in the position found, photographed, cleaned as necessary, and x-rayed when possible. They were then disassembled and tested when possible. Parts were substituted if the testing necessitated a substitution. Certain examinations required the destruction of part or all of some components. A few components required metallurgical examinations. The 46 components examined included engine indicating instruments, yaw damper electronics, primary flight controls, including the rudder, ailerons, and elevator, secondary flight controls and spoilers, leading edge devices, the flap control module, and the trailing edge flap control valve. In addition, the yaw damper coupler and the rudder power control unit transfer valve, both of which had been removed from the airplane before the accident flight, were bench checked. Additional functional testing and/or teardown inspections of components removed from the airplane took place at the Boeing facilities in Seattle, Washington. These components included the “A” and “B” and standby hydraulic system pressure modules, the “A” and “B” system flight control modules, the landing gear maintenance valve, the standby rudder actuator, the rudder main power control unit (MPCU), the elevator feel and centering mechanism, the aileron force limiter, and the autopilot and flight director mode control panels. The elevator feel computer, which had been tested earlier at the UAL Maintenance Operations Center, was further tested.

Factual Information 45 Aircraft Accident Report Of the components tested at UAL and Boeing, 10 were found with anomalies. The condition of these components, along with their respective abnormalities and potential systems effects, where applicable, was as follows: 1.12.2.1 Hydraulic System A and B Pressure Modules “A” Hydraulic System Pressure Module: The hydraulic system pressure modules located downstream of the hydraulic pumps provide a means to simplify fluid handling and reduce the number of fittings in the hydraulic system. The module consists of two pressure filters, two check valves, two pressure switches, and a pressure relief valve. The entire module can be replaced on the airplane. A failure within the module, such as a crack or jam of a moving part or major internal or external leakage, could impair the “A” hydraulic system function. One of two filter elements was darker than the other element. A discolored deposit was found in the pressure port. A metallic particle was in the check valve installed in port 6, causing it to stick to the open position. System effects: To test the effects of the discolored filter on the hydraulic system performance, both filters from the “A” module were flow checked. Both filters passed Boeing's required flow rate for acceptable performance. Therefore, it was determined that the discoloration of the filter had no effect on the operation of the hydraulic or flight control systems. The effect of the metallic particle in the port number 6 check valve of the module was considered. The check valve is installed to prevent flow from the “B” hydraulic system to the “A” system if the ground interconnect valve is open. Operation (opening) of the ground interconnect valve requires 28 VDC power from the battery bus to be available, the parking brake to be set, and the ground interconnect switch to be “OPEN.” It was determined that in the absence of other multiple system failures that were not observed in the components examined, the open check valve in port number 6 would not affect the operation of the airplane's hydraulic or flight control system because the ground interconnect valve was not open and no hydraulic fluid or pressure was available to flow through the check valve. “B” Hydraulic System Pressure Module: Corrosion was observed on the filter bowl area outside of the filter element, on the port 4 and port 5 side. Epoxy particles were also in the filter bowl on the port 1 and port 2 side. Two sheared backup rings were on the pressure switch cavity. A green-colored deposit was found in the check valve cavity. System effects: The anomalies in the “B” hydraulic system pressure module were determined to have no effect on the operation of the hydraulic system or flight control systems. The surface corrosion on the filter bowl area would not effect the system. Chemical and infrared-spectrographic examination of the epoxy particles indicated that they were epoxy of the DGEBA type. This epoxy is used as an adhesive in the manufacture of the filter. The green-colored deposit removed from the check valve cavity

Factual Information 46 Aircraft Accident Report was identified as aluminum phosphate. The source was not identified. Its presence in the cavity had no effect on the operation of the check valve or the systems that were associated with the check valve. The portions of sheared backup rings in the pressure switch cavity on port 1 and port 2 were determined to have been debris from a previous disassembly of the module and were not portions of the backup rings installed with the pressure switch in the module. The examination indicated that all backup rings associated with the cavity and pressure switch were intact. The presence of the portions of the backup rings would not have affected the operation of the hydraulic or flight control systems. Standby Hydraulic System Pressure Module: Examination of the standby hydraulic system module indicated that both motor-operated shutoff valves were in the “OFF” position. Additional testing of the unit confirmed the hydraulic integrity of the unit to a point that it could be determined that the standby unit was off and would have been capable of operation, if needed. The valve cavity on port 2 and port 4 contained a section of a sheared backup ring. The pressure relief valve was in the open position. System effects: The sheared Teflon backup ring in valve cavity port 2 and port 4 was determined to have no effect on the operation of the hydraulics or flight control systems. Port 2 and port 4 are the pressure and return circuits, respectively, for the operation of the airplane's rudder system. The ports are connected internally within the standby hydraulic system pressure module by the hydraulic standby system rudder shutoff valve. With pressure applied to port 1, leakage was observed from port 2, port 3, and port 4. Visual examination of the shutoff valve indicated that it was closed; therefore, none of the ports should have had hydraulic fluid flow. Further testing of the standby module with a new rudder shutoff valve installed indicated that leakage occurred from port 2, port 3 and port 4 when pressure was applied to port 1. Disassembly of the module revealed that a portion of a sheared backup ring from the second land28 of the standby rudder shutoff valve was in the valve cavity. All other backup rings and O-rings were intact. There was no evidence of O-ring extrusion or failure. Further examination of the module indicated that the leakage between ports occurred because of free flow through the pressure relief port on the valve. X-ray examination and subsequent disassembly of the relief valve gave no positive indication of the reason for failure of the valve. During disassembly, a particle too small for identification or collection was observed in the fluid in the valve. After cleaning, the valve's components were reassembled and the valve did not leak. 28 Grooved area on component normally used to contain O-ring assembly.

Factual Information 47 Aircraft Accident Report The function of the relief valve within the module is to provide a means for pressure to be relieved to the return side of the hydraulic system in the event of blockage or obstruction of the downstream side of the module. The valve is a ball and spring-type check valve. Failure of the relief valve would have no effect on the normal operation of the airplane's hydraulic or flight control systems. The valve would not see hydraulic pressure or flow unless the standby hydraulic system was activated. There is no indication that the system was activated in this accident. System “A” and “B” Flight Control Modules: The flight control modules (one each for “A” and “B” flight control systems) contain shutoff valves and a flow compensating device in a modular package. The motor-operated shutoff valves within the module are commanded to their operating positions by the flight control system switches in the cockpit. Examination of the flight control (“A” and “B” systems) modules revealed that all shutoff valves were open (the normal position for flight). All pressure sensing switches were tested and found to be operating normally. During the examination, sheared backup rings and a “nibbled” O-ring were found in the valve cavities. O-rings showed signs of discoloration and/or extrusion. The damage to the O-rings could allow leakage between the pressure and return hydraulic ports of the module. It was determined that excess leakage between the ports could allow flow to the flight control system actuators. It was determined that additional testing was necessary to determine the effects of leakage on the flight control system. On May 21, 1991, under the supervision of the Safety Board, testing was performed at Boeing. A new flight control module was used for the tests. In an attempt to duplicate the worst case condition for the tests, one O-ring and both backup rings were removed from the shutoff valve of the test unit. After these tests, the damaged O-ring from the accident airplane (flight control module, serial number 1870) was installed in the module, and leakage was measured. The O-ring was then repositioned, and leakage readings were retaken. The maximum leakage obtained with the damaged O-ring was 0.06 gallons per minute (gpm). The rate of leakage decreased as pressure was increased from 1,000 psi to 2,000 psi to 3,000 psi. The tests and subsequent evaluation showed that the leakage of 0.06 gpm would have no noticeable effect on the operation of the airplane. 1.12.2.2 Roll Control Components General: The left and right aileron bus cables, which connect the two cockpit control columns, were removed from the aileron bus drum and examined. Metallurgical examination of the cable ends indicated a one-time tensile overload failure of the cables. The aileron bus drum rivets were found sheared which allowed the drum to rotate approximately 90 degrees. This damage occurred as a result of impact and did not exist prior to impact.

Factual Information 48 Aircraft Accident Report X-ray examination of the spoiler mixer and subsequent disassembly indicated that the flight spoiler position at impact was approximately 4 degrees left wing down at impact. The x-ray also indicated that the ground spoilers were down at impact. The aileron spring cartridge (pogo) was found bent upward by external impact forces, and the aileron spring was extended 1.12 inches. Although the cartridge was bent and the spring extended, the length from one end to the other was nearly the same as if the cartridge was properly installed and the spring was not extended. In normal operation, the aileron spring cartridge is not extended or compressed. It would be extended or compressed as a result of control system jamming in the roll axis, or as a result of the noted crash induced deformation. An analysis of the deformation of the aileron spring cartridge indicated that with the extension found, the copilot's control wheel would have been deflected about 79 degrees counterclockwise, which would have resulted in spoilers No. 2 and 3 deflected 24 degrees. This deflection would have required approximately 85 pounds of force by the copilot to deform the aileron spring cartridge. Another correlation of spoiler mixer impact position and aileron spring cartridge deformation indicates that spoilers No. 2 and 3 could have been at approximately 4 degrees at impact and the copilot's control wheel would have been deflected counterclockwise 31 degrees. The aileron MPCUs were consistent with a zero aileron position. Actual impact control wheel positions could not be determined by examining the control wheels for the captain or copilot. The ground spoiler control valve was recovered and examined. Grime present on the exposed portion of the slide indicated that the spoilers were down at impact. The four aluminum alloy shear rivets at the attach point between the spring cartridge and the control quadrant input crank were found sheared. Analysis of the metal smears in the shear faces indicate that the clevis attach arm connected to the aileron spring cartridge was forced in the opposite relative direction of rotation at the time of failure. This would indicate the integrity of the control system inputs from the copilot's column to the spoiler mixer at impact. No. 6 Flight Spoiler Actuator: Metal slivers were in the input side of the filter. System effects: The metal slivers on the input side of the filter were from a source upstream of the actuator. The filter was in good condition. The next component upstream of the actuator (and possible source of the slivers) is the system “A” flight control module. The No. 6 flight spoiler's piston head seals were split and torn. The No. 6 flight spoiler is the closest inboard flight spoiler and, along with spoiler No. 3, did not exhibit metal slivers in the filter. The metal slivers would not have affected the operation of the airplane. No. 7 Flight Spoiler Actuator: Metal slivers were found in the input side of the actuator's filter. A small metal chip was found in the thermal relief valve cavity. System effects: Metal slivers found on the input side of the actuator's filter would have originated upstream from the unit. The piston head seals were also split and torn similar to the No. 6 flight spoiler actuator. The No. 7 actuator is paired hydraulically with

Factual Information 49 Aircraft Accident Report the No. 2 actuator on the left wing. There were no anomalies found with the No. 2 actuator. The metal slivers would not affect the operation of the airplane. 1.12.2.3 Pitch Control Components General: Both elevator tab lock actuators were removed from the airplane wreckage and examined. Evidence to determine the position of the elevator tab lockout piston was inconclusive. Examination of the horizontal stabilizer jackscrew indicated that the horizontal stabilizer was positioned at 0.75 degrees leading edge down at impact. Elevator Feel Computer: A small metal chip was in the “A” system filter element. System effects: The metal chip found in the “A” system side filter unit showed that the filter was performing its intended function of cleaning (filtering) the system's hydraulic fluid and did not indicate a system failure. Other damage noted in the feel computer was attributed to the airplane's impact with the ground. 1.12.3 Examination of Yaw Control Components 1.12.3.1 System Main Rudder Power Control Unit The accident airplane’s main rudder PCU was substantially damaged by external impact, fire, and smoke; thus, operational testing of the complete PCU was not possible. Examination of the PCU servo valve revealed six semicircular discolorations (consistent with exposure to heat) on the lands. The six discolored areas were aligned with the porting holes on the inside bore of the secondary slide, establishing the relative positions of the primary and secondary slides at the time of the fire. The relative position of the secondary slide was near neutral. The hydraulic system A bypass valve, located upstream of the rudder actuator piston, was stuck in the unpressurized bypass condition apparently as a result of heat-deteriorated hydraulic fluid. Residue of overheated hydraulic fluid was located within the actuator, primarily on the hydraulic system A (forward) side. The hydraulic system B side of the main rudder PCU exhibited less evidence of thermal distress than the hydraulic system A side. A small amount of water was located in the hydraulic system B filter cavity. The center portion of the rudder actuator cylinder bore and piston exhibited slight wetness and no evidence of heat-deteriorated hydraulic fluid. The hydraulic system B (aft) side of the actuator piston was relatively clean and dry. The input pushrod that connects a torque tube to the MPCU input crank was broken and the fracture was attributed to exposure to the fire. System effects: The rudder system was evaluated to determine if a local fluid leak could deplete the hydraulic fluid in the rudder system. It was determined that loss of fluid in the rudder MPCU, if it occurred in flight, would also indicate a loss of hydraulic system

Factual Information 50 Aircraft Accident Report fluid in the system reservoir which would result in a loss of system pressure that could be detected by the crew. The evidence in the rudder MPCU indicated that the fluid was released from the MPCU during the impact sequence and not prior to impact. It also is believed that the water entered the system after impact and that the system was open at that time because of impact forces. 1.12.3.2 Standby Rudder Actuator Standby Rudder Actuator: The bypass valve in the standby rudder actuator was examined and found damaged by heat. Melted O-rings and backup rings were found along with burned hydraulic fluid. There was no evidence of preimpact physical damage in the bypass valve. X-rays of the package show that the bypass valve was in the unpressurized “bypass” position and the piston was extended 1/16 inch from the center. Examination of the control valve indicated that there was no preimpact physical damage. Etching (believed to be a result of burnt hydraulic fluid) within the valve indicated that the valve was in the neutral position during the fire. This was determined by lining up etchings with known port positions. The fracture on the input push rod that connects a torque tube to the actuator valve input lever was determined to have occurred prior to the fire and was due to side loads with out significant compression loads. The input lever was about 1/16 inch from neutral when found at the accident site. The lever was in the dead band (null) area. The stops on the actuator housing were not damaged and the input lever was not damaged at the point of contact with the stops. During the initial disassembly of the standby rudder actuator, it was noted that the bearing through which the shaft connecting the input crank to the control valve slide passes was difficult to remove. Subsequent examination revealed evidence of galling on the bearing surface of the input shaft (P/N 1087-23) and mating bearing nut (P/N 1087-22). Normally, the standby actuator is not used and the input lever arm is free to rotate as required to accommodate the relative motion between the rudder and torque tube. The shaft extends through the bearing which is threaded into the body of the standby rudder actuator. The bearing is torqued and safety wired into position. A 6.72-inch input lever is attached to the end of the shaft. According to the manufacturer, the maximum force to move the input lever should not exceed 0.5 pound. The input shaft and bearing are manufactured and installed as a matched pair because of the tight tolerances between the two components and the requirements for ease of operation of the standby rudder actuator. The presence of galling could cause the input shaft to bind. See section 1.16.3 for information regarding more detailed tests and examinations of the standby rudder actuator and input shaft and bearing. 1.13 Medical And Pathological Information The captain held a valid first class airman medical certificate dated December 7,

1. The Safety Board and UAL reviewed the captain's company medical records,

Factual Information 51 Aircraft Accident Report including records of annual physical examinations and medical claims made by the captain to the insurance carrier employed by UAL. There was no record of hospitalization or major medical claims. Family members and coworkers said that the captain exercised regularly and appeared fit, and that he did not smoke or drink alcohol. Based on the medical examination on October 24, 1990, the captain's overall cardiac risk factor was assessed as “below average.” On his FAA medical records of December 7, 1990, the captain's height was listed as 5 feet 7 inches, and his weight was listed as 145 pounds. The first officer held a valid first class airman medical certificate dated August 21,

1. The Safety Board and UAL reviewed the first officer's medical records and medical

claims made by the first officer to the insurance carrier employed by UAL. They indicated that she had no hospitalizations or major medical claims. Family members and coworkers said that the first officer exercised regularly, did not smoke, and was an occasional drinker. Based on the medical examination of August 21, 1990, the first officer's cardiac risk factor was assessed as “low.” Her height was listed as 5 feet 4 inches, and her weight was listed as 130 pounds. According to Boeing, in compliance with Federal regulations, the seat of the B-737 is designed to be adjustable to provide full flight control authority to pilots having a minimum height of 5 feet 2 inches. The actual position of crewmember seat settings could not be determined from the wreckage. However, the captain cautioned the first officer to “watch your feet here comes the rudder” during his control check (0914:20), suggesting that he was positioned to use full rudder authority. Boeing has also indicated that 80 pounds of leg pushing force is necessary to achieve full rudder authority under normal operation. An aeromedical official who reviewed the medical records of the captain and first officer said that either crewmember should have been capable of providing this leg pushing force. The cause of death for the 20 passengers and 5 crewmembers was determined to be blunt force trauma. Toxicological testing on tissue samples obtained posthumously from the captain and first officer was completed by the Coroner's Office of El Paso County, Colorado. The samples tested negative for alcohol, major drugs of abuse, and prescription and over-the-counter medications. A panel of medical authorities reviewed all available autopsy evidence, including x-ray records of the feet and flight boots of both crewmembers, to determine injuries that might have been caused by hand or feet contact with control wheel and pedals. In the case of the captain, the panel noted minimal deformation of the left foot and less deformation of the right foot. In the case of the first officer, the panel noted symmetrically pronounced deformations of both feet. In accordance with its drug testing program, the FAA obtained urine samples from four controllers at the COS tower: the ground controller/CIC; local controller; arrival controller; and supervisor. The samples, obtained between 2200 and 2320 on March 3, 1991, were tested for the five drugs specified in the protocol of the National Institute of

Factual Information 52 Aircraft Accident Report Drug Abuse (NIDA): marijuana, cocaine, amphetamines, PCP, and opiates. No positive results were reported to the Safety Board, as required by Federal statute if positive results are found. The four controllers declined to provide blood and urine samples for testing by the Safety Board. Blood and urine samples were provided voluntarily to the Safety Board by the departure controller at the Denver terminal radar approach control (TRACON) facility. No testing was conducted on these samples because of an absence of evidence that this controller's actions were involved in the accident sequence. 1.14 Fire An intense ground fire melted localized sections of the airplane structure and scorched nearby trees and the ground surrounding the crash site. There was no indication of any fire prior to the impact with the ground. Fire fighting equipment arrived at the accident site within minutes of the crash and proceeded to extinguish the fire. 1.15 Survival Aspects The accident was not survivable. 1.16 Tests and Research 1.16.1 Recorded Radar Data The Safety Board obtained and reviewed recorded radar data from the Denver Air Route Traffic Control Center (ARTCC). The data covered the period from initial contact with flight 585 at 0923 hours during climbout from Denver until the loss of radar contact about 4 miles south of the approach end of runway 35 at COS around 0944 hours. This information showed a normal flight until the airplane turned onto final for runway 35. The last radar data point was recorded about 16 seconds prior to the crash. The radar data show that the airplane was approaching the airport from the southeast at an altitude of about 7,900 feet. The course was consistent with a 45-degree intercept angle to the final approach course with the intercept 4 to 5 miles south of the runway. While the airplane was about 1 nmi east of the final approach course, it started descending at a rate consistent with that required to maintain a flightpath aligned with the 3-degree glideslope. About 20 seconds later, the descent rate increased, resulting in a new 7.5-degree flightpath, or 2,200 feet per minute down, and the airplane descended below the glideslope. The airplane crashed about 37 seconds after the initial departure from the glideslope.

Factual Information 53 Aircraft Accident Report 1.16.2 Modeling and Simulations of Atmospheric Disturbances and Airplane Flight Dynamics Conducted During the Initial Investigation (1991/1992) Three simulations were conducted during the initial investigation:29 1) NCAR used sophisticated atmospheric numerical computer modeling of air movements in the Rocky Mountains near COS to define potential flow fields that might have been present; 2) a specialized computer simulation was used to define possible roll angle and sideslip angle time histories that would produce flightpaths consistent with recorded radar data, FDR data, crash site location, and crash attitudes; and 3) Boeing used its engineering simulator to examine the effects of various atmospheric disturbances and/or flight control malfunctions on the flightpath of a B-737-200 Advanced airplane. 1.16.2.1 Modeling of Atmospheric Disturbances (1991/1992): NCAR Weather Study Personnel from the Mesoscale and Microscale Meteorology Division of NCAR were contacted by the Safety Board. A contract was awarded to NCAR to use known environmental data to simulate a downslope windstorm event similar to the conditions that may have existed at COS on March 3, 1991 in order to determine whether it might have contributed to the crash of the airplane. The accident airplane case was more complex to model than had originally been expected because of current modeling techniques related to wind, temperature, and humidity upstream of the mountains. Current modeling is based on the assumption that the flow approaching the mountain is horizontally uniform and, therefore, a single sounding is used to describe those conditions. The conditions on the day of the accident were complicated by a trough that was over the Rocky Mountains at the time of the accident. The use of a single sounding to describe the basic flow over the Colorado region on that day was therefore not appropriate. Other soundings used in the model for the studies gave different results, and none of the cases studied indicated a severe windstorm event. Due to the extensive horizontal variations over Colorado that day, the study indicated that no single sounding existed that could be used to initialize the model that would be representative of the flow over the front range at the time of the windstorm. Observations indicated that there was a severe windstorm over the front range of the Rockies at the time of the crash. The study indicated that severe windstorms over the Rockies have consistent characteristics because they are caused by low-level stable air flowing over the orography, exciting highly nonlinear breaking gravity waves. Waves result in the generation of severe turbulence, rotors and hydraulic jumps. The jumps are regions where the flow rebounds in the vertical to its original level of equilibrium, after 29 Since the adoption of the original report in December 1992, additional weather- and rudder-related computer simulations and modeling studies have been conducted. These simulations and studies are discussed in section 1.16.6.

Factual Information 54 Aircraft Accident Report passing over the mountain range, and they can produce updrafts exceeding 40 m/second. The NCAR study indicated that the horizontal widths of these jumps are believed to be quite narrow, producing regions of extreme horizontal variations in the updrafts. Hydraulic jumps may be found with mountain wave activity. The study referenced a windstorm that occurred on the front range on January 9, 1989, when conditions were similar to those existing at the time of the accident. NCAR personnel completed a series of simulations of this windstorm that covered a large portion of Colorado and showed a strong concentrated region of upward motion (jump) with upward velocities exceeding 40 m/second traveling up and down the foothills of the Rockies in the Boulder region. In the COS area, the jumps exhibited much more variability than along the Boulder region front range. The orography is highly structured in the COS area and dominated by the presence of Pikes Peak and the Palmer divide. The horizontal shears associated with these jumps were limited by resolution (the shear was forced by the model to be spread out over about 4 kilometers (km)) and were therefore about 10 m/second per km. It could be anticipated that the higher resolution simulations would show much larger shear values because a model selects the narrowest scales it can resolve for its largest gradients, and the peak gradients are usually larger when using higher resolutions. Some idealized two-dimensional simulations were performed on the January 9, 1989, case which showed that at higher resolutions, small-scale eddies were generated within the high-wind regions on the mountain slope. These eddies, which contained very high velocities both in the horizontal and vertical that varied sharply over short distances, traveled down the lee slope and out onto the plains. The orientation of the jumps observed in the January 9, 1989, simulations was typically parallel to the front range. It could be expected, therefore, that the traveling updrafts associated with these jumps would pass over the north-south COS runway with an orientation more or less parallel to the runway. If an airplane were approaching the runway from either north or south, it would experience a rapid increase in upward motion as the jump approached, and the upward motion on the west-facing wing would be higher than that on the east side. The report stated that runway 35 has the worst possible orientation in terms of airplane safety in the presence of downslope windstorm events. The report indicated that it was impossible to determine from modeling whether a traveling jump actually occurred on March 3, 1991, in the COS area. Models, even at high resolution and properly initialized, can only suggest the structure of the storm and cannot indicate precisely where the various features within it were located at a particular time. Only observations of wind and vertical motion near the accident site could determine whether a jump was at that location at the time of the accident. Modeling can only determine whether such an event was possible. Based on the study and the opinions of NCAR personnel, who are familiar with observations in the area, such an event was possible on March 3, 1991.

Factual Information 55 Aircraft Accident Report Two recommendations were generated by the study with respect to airplane safety in severe downslope windstorms in the COS area. First, there should be several surface observing stations in the valleys on either side of Pikes Peak to provide warnings about the development of strong winds associated with mountain windstorms. These stations would be able to detect any extremely strong winds that could exist in these valleys without any winds noticeable in the region of the airport. Such observations could alert the tower that gusts or strong updrafts might begin traveling out over the plains. Further, there is a strong need for an improved and more advanced level of airline transport and commercial pilot training regarding mountain windstorms. Based on FAA commercial pilot exam listings that are categorized by subject, the FAA requirements for commercial pilot understanding of orographically induced strong downslope winds are almost nonexistent; also, the FAA manuals contain minimal information on this topic. As a result of the information developed during the investigation and gained during this study, on July 20, 1992, the Safety Board issued two safety recommendations to the FAA: Develop and implement a meteorological program to observe, document, and analyze potential meteorological aircraft hazards in the area of Colorado Springs, Colorado, with a focus on the approach and departure paths of the Colorado Springs Municipal Airport. This program should be made operational by the winter of 1992. (Class II, Priority Action) (A-92-57) Develop a broader meteorological aircraft hazard program to include other airports in or near mountainous terrain, based on the results obtained in the Colorado Springs, Colorado, area. (Class II, Priority Action) (A-92-58) In response to Safety Recommendation A-92-57, NOAA and NCAR collected weather and wind data in the Colorado Springs area between February and April 1997. The June 1998 NOAA/NCAR interim report30 indicated that numerous mountain-induced weather phenomena were observed, including low-altitude windflow reversals, windshears, and horizontal axis vortices (rotors). The Safety Board’s review of the NOAA/NCAR data revealed that, in several cases, the upper wind directions were similar to, but weaker than, those that existed in the Colorado Springs area when the United flight 585 accident occurred.31 The data from these cases showed that mountain rotors were present. Some of the weaker rotors measured by NOAA/NCAR were located between the surface and about 3,000 feet agl, whereas other (stronger) rotors were observed at altitudes exceeding 4,000 feet agl. The rotors observed during the NOAA/NCAR data gathering program had a maximum rotational rate of 0.05 radians per second, which is less than the rotational rate 30 A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs Area: Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997), NOAA/NCAR, June 1998. As of March 1999, a final report had not been issued. 31 The Safety Board’s review of the data indicated that the upper winds present at the time of the United flight 585 accident were about two to three times stronger than those observed in the NOAA/NCAR data.

Factual Information 56 Aircraft Accident Report of 0.6 radians per second that was demonstrated during the investigation of the United flight 585 accident to be necessary to produce extreme control difficulties in a 737 airplane. According to NOAA scientists, stronger upper windspeeds produce proportionally stronger rotors. Therefore, if the upper windspeeds encountered by United flight 585 were three times stronger than those measured by NOAA/NCAR, the rotor rotational rate could be three times stronger. (For example, a rotor three times stronger than the maximum observed by NOAA/NCAR would have a maximum rotational rate of 0.15 radians per second.) Section 4 contains the status of the FAA action on these recommendations. 1.16.2.2 Safety Board Simulations (1991/1992) The Safety Board used a specialized computer simulation to define possible roll angle and sideslip angle time histories that would produce flightpaths consistent with recorded radar data, FDR data, crash site location, and crash attitudes. Initial conditions that affected the calculated flightpaths were ground track angle, ground speed, starting positions, starting altitudes, flightpath angle, weight, thrust, and aerodynamic coefficients related to lift, drag, and side force. Time-dependent variables that affected the calculated flightpaths were roll angle, sideslip angle, normal acceleration, wind direction and velocity, and airplane configuration. The initial conditions and time-dependent variables were varied to achieve matches between calculated parameters and recorded data. The calculated ground track was compared with the radar data. Calculated airspeeds, altitudes, and headings were compared with FDR data. Calculated impact attitudes were compared with those derived from crash site data. In general, roll angle, sideslip angle, and wind time histories were varied, while the time histories of normal acceleration and airplane configuration remained constant. In addition, the initial ground speed and ground track were modified with wind conditions to achieve a match with initial heading and indicated airspeed data. Modeling was started about 36 seconds prior to the crash and was continued to impact. The starting time was consistent with the third from the last radar data point at 0931:10. Reasonable matches of altitude, airspeed, heading, and impact position were obtained in some cases. The modeling showed that large, rapid rudder inputs initiated near the time of the upset would have resulted in heading angles different from the recorded heading data. The best matches of recorded data and impact conditions were obtained with roll rates of about 11 degrees per second from wings level to 80 degrees and 22 degrees per second from 80 degrees to 180 degrees of roll while the sideslip angle was 0.32 Initial roll rates greater than 20 degrees per second generated calculated values different than the values of recorded data.

Factual Information 57 Aircraft Accident Report 1.16.2.3 Boeing Simulations (1991/1992) The Safety Board and parties to the investigation met on May 10, July 17, and August 1, 1991, and April 28, 1992, at Boeing to examine the effects of various atmospheric disturbances and/or flight control malfunctions on the flightpath of a B-737-200 airplane. Boeing developed simulator models of the atmospheric disturbances and could demonstrate various control malfunctions.33 The simulator was flown by a Boeing pilot and pilots from the investigation team operations group who attempted to maintain control of the airplane while encountering atmospheric disturbances or control malfunctions. The pilots attempted to follow the flightpath of the accident airplane, as determined by radar data. The visual scene showed the rotor, airport, crash site, terrain features, and lead-in poles representing an approximate flightpath of the accident airplane. The rotor portion of the visualization was disabled on selected runs. About 250 simulator runs were completed. Stationary and translating rotors were modeled. They could be modified by varying the core radius, tangential velocity, position and orientation (azimuth and elevation angles). The rotational nature of rotors may produce rapidly changing air flow fields relative to an airplane encountering such a rotor. The changing flow fields produce changes in angle of attack, sideslip angle, and lift distribution across the wing. The resulting lateral or directional imbalances contribute to uncommanded airplane motions. NOAA estimated that a typical rotor on the day of the accident could have a rotational velocity of .06 radians per second (3.4 degrees per second) with a radius of 1,640 feet and a tangential velocity at the core edge of 100 feet per second. Simulations showed that the .06 radian per second rotor had little effect on airplane control except that performance problems could develop if the airplane remained in the down-flow field of the rotor. In a sustained downflow, the airplane would either have to lose altitude or airspeed, similar to the outcome of entering the downflow field of a microburst. Performance calculations have shown that the accident airplane could have been in a downflow field of about 80 feet per second for about 30 seconds, possibly induced by a rotor's downflow field or some other atmospheric disturbance. The airplane 32 The roll rates described in this paragraph represent the solutions examined by the Safety Board using the data and computer simulations that were available during the initial United flight 585 investigation. Since that time, additional 737 flight test data have become available, and more sophisticated computer simulation programs have been developed. During later computer simulation studies (1998/1999), the Board produced good matches with simulations of many accident scenarios, including main rudder PCU servo valve jams (secondary slide to servo valve housing at various locations) resulting in rudder deflections to the blowdown limit and equivalent control wheel inputs. For additional information, see sections 1.16.6 and 2.7 of this revised report. 33 The weather- and rudder-related simulations described in this section represent the simulations conducted by Boeing using the data and computer simulations that were available during the initial United flight 585 investigation. Similar to the Safety Board, Boeing subsequently conducted additional computer simulations examining the United flight 585 accident scenario. This later work (1998/1999) is discussed in sections 1.16.6 and 2.7 of this revised report.

Factual Information 58 Aircraft Accident Report did lose altitude at a higher than normal rate, but the airspeed remained constant at the flaps reference speed plus 20 knots for the approach to landing. In a sequence of simulations, the severity of the rotor was increased until encounters produced extreme control difficulties. The engineering group, with the Boeing pilot, determined that rotors with rotation rates of 0.6 radians per second (34 degrees per second) with a 250 feet core radius (150 feet per second tangential velocity) generated extreme control difficulties. Control problems were especially notable at the edge of the core. The airplane tends to roll into the core when positioned just outside of the core and tends to roll out of the core when positioned just inside the core. Operationally, pilots found that a more moderate rotor with 0.4 radian per second rotation and a 250 feet core radius (100 feet per second tangential velocity) produced significant control problems and even loss of control if recovery procedures were not promptly implemented. A “loss of control,” as defined by the pilot group, did not necessarily result in a crash but in the loss of precise operating control of the airplane, such as inability to maintain a desired heading or roll angle for short periods of time.34 Encounters with strong stationary atmospheric rotors are expected to produce significant errors in the indicated altitude and airspeed recorded on the FDR. Rotors result in low pressure near the core, similar to tornadoes. A low pressure area will result in an increase in indicated altitude while the actual altitude remains constant. Data extracted from the FDR from UAL 585 failed to show the existence of an error in recorded indicated altitude. An anomaly in recorded indicated altitude was identified in the FDR data of an L-1011 that traversed a microburst-induced horizontal axis vortex.35 In addition, data supplied by NASA (Wingrove correspondence to Safety Board investigators, dated April 16, 1992) showed significant increases in indicated altitude when airplanes have encountered vortices at high altitude. A strong flow field passed through the COS area at or near the time of the crash and, according to NOAA and NCAR scientists, the flow field could have produced a large upflow (hydraulic jump) which, in turn, could have produced a series of translating rotors. The rotors could have been small but severe. Rotors with a 0.6 radian per second (34 degrees per second) rotational rate, a 250 foot radius, and a 150 feet per second tangential velocity were possible, according to NOAA and NCAR. Based on a review of visible and infrared satellite imagery on the Safety Board's McIDAS, the air mass was moving about 100 feet per second to the east. According to NOAA, translating rotors are similar to stationary rotors except that they move and create a localized flow field, in addition to the rotational flow field. One unique aspect of a translating rotor compared with a stationary rotor is that a discernible pressure gradient may not be present in certain regions of the translating rotor, although 34 According to Boeing’s later (1998/1999) simulations, a vortex strength of 1.8 radians per second would be required to result in the airplane’s flightpath. See sections 1.16.6 and 2.7 for additional information. 35 Aircraft Accident Report, Delta Air Lines flight 191, Dallas/Fort Worth International Airport, Texas, August 2, 1985 (NTSB/AAR-86/05).

Factual Information 59 Aircraft Accident Report the rotational effect remains the same. Further, when simulating an encounter with a translating rotor, the localized flow field produced by the rotor translation was assumed to be a straight wind, west to east. The wind was vectorially added to the tangential velocities of the rotational flow field. The velocity of the localized flow field was set at 100 feet per second within the core of the rotor and was decreased as the distance from the core increased (by a factor of core radius divided by the distance from the center of the core). For example, at the eastern edge of the core, two velocity components would be present. The tangential velocity associated with a 0.6 radian per second, 250 feet diameter clockwise rotating rotor would be 150 feet per second down. The localized flow field would produce a 100 feet per second velocity to the east. At 500 feet to the east of the center of the core (2 times the radius), the tangential velocity would be 75 feet per second and the west-to-east velocity would be 50 feet per second. In addition, the rotor and localized flow field could be moved in unison and translated at velocities up to 100 feet per second. The rotor could also be moved up or down, tracking the airplane, to ensure that the airplane intercepted the rotor at a predetermined point. Simulator runs were made with 0.3, 0.4, and 0.6 radian per second translating rotors. Many crashes occurred during encounters with a 0.6 radian per second translating rotor. A few crashes occurred during encounters with a 0.4 radian per second translating rotor, and no crashes occurred during encounters with a 0.3 radian per second rotor. The following observations were made: 1) the addition of the translating rotor increases the difficulty in maintaining control; 2) an encounter with a 0.4 radian per second translating rotor was approximately equivalent in severity to an encounter with a stationary 0.6 rotor; 3) an encounter with a 0.4 radian per second translating rotor was very difficult to control, requiring an appropriate, aggressive response using the flight control (some aggressive flight control applications resulted in more severe control problems); 4) an encounter with the 0.4 radian per second translating rotor occasionally resulted in a crash; 5) an encounter with a 0.6 radian per second translating rotor was frequently uncontrollable and often unrecoverable, resulting in a crash; 6) airspeed was a factor, and extra speed increased the airplane's controllability and decreased the effect of atmospheric disturbances; 7) any hesitation in arresting uncommanded rolls resulted in extreme roll attitudes; and 8) in several cases, the airplane rapidly moved east to west through the rotor with little control difficulty. The Safety Board requested that two B-737 crewmember pairs, who were unfamiliar with rotor simulations, attempt to fly the simulator while encountering translating rotors. The visual portion of the rotor was disabled, although the remainder of the visual scene was present, minus the last lead-in pole and the crash site identification pole. Observers noted that the element of surprise subsided after the first encounter and that the crew performances during the encounters with translating rotors were similar to the performances of pilots with prior experience in flying through translating rotors. The possibility was considered that a strong, west-to-east, windshear or gust front may have accounted for the upset. Boeing designed a model to simulate the west wind

Factual Information 60 Aircraft Accident Report increasing from 0 to 200 knots in 4 to 40 seconds while the airplane was moving north. The simulated lateral windshear produced rapidly changing air flow fields with the potential for loss of control. As the airplane penetrated the shear, large side slips developed with predictable airplane responses. Lateral windshears that were severe enough to produce control difficulties also produced flight responses that were clearly different than those recorded from the accident airplane. Lateral windshears produced 1) large changes in heading into the wind; 2) large increases in airspeed; and 3) rapid rolling away from the wind if not controlled by the pilot. As the roll angle increased, the wind-induced side slip angle transitioned into wind-induced angle of attack with marked increases in normal acceleration (G-load). The Safety Board and Boeing conducted separate studies to determine possible local wind conditions. Each study used FDR data and radar data. In addition, Boeing used a National Aeronautics and Space Administration (NASA) program that uses known airplane performance data to calculate vertical wind. The calculations show large reversals of wind at various positions. Strong vertical velocities were derived in the Boeing study, peaking at 40 to 80 feet per second down, depending on whether the radar data was smoothed or unsmoothed, respectively. The wind calculations were used as input data in the airplane simulations. The large wind excursions in the simulation resulted in large airspeed excursions and did not match the airspeed data recovered from the FDR. Thus, the simulations showed that wind excursions alone did not result in the United flight 585 upset and loss of control. The Safety Board requested data from Boeing concerning the effect of rudder hardover failures on the flight dynamics and controllability of B-737-200 airplanes. Boeing responded with a series of letters describing the modeling of rudder hardovers on the B-737-200 flight simulation. In all cases, high rates of rudder deflection resulted in large, rapid heading excursions. Although roll angles could reach large values, prompt wheel and elevator input resulted in regaining roll control rather than contacting the ground. An uncommanded rudder deflection to 7.5 degrees (consistent with one theory of uncommanded rudder deflection) was easily controllable with control wheel (aileron/spoiler) deflection. Delaying recovery for 25 seconds resulted in ground contact. Failure of the B hydraulic system would limit the lateral control response. An immediate response to a rudder hardover (full rudder deflection) would have been required if a B hydraulic system failure occurred simultaneously. Boeing provided data showing that a rudder hardover to the mechanical limits (approximately 26 degrees) could result in large yaw and lateral excursions even if full wheel control was used (approximately 107 degrees).36 Flap position and airspeed are important when determining controllability during a rudder hardover condition. With the 36 During its investigation of the USAir flight 427 accident, the Safety Board became aware that, in the flaps 1 configuration and at certain airspeeds, the 737 roll authority (using spoilers and ailerons) was not sufficient to completely counter the roll effects of a rudder deflected to its blowdown limit. The airspeed at which the maximum roll control (full roll authority provided by control wheel input) could no longer counter the yaw/roll effects of a rudder deflected to its blowdown limit was referred to by the test group participants as the “crossover airspeed.”

Factual Information 61 Aircraft Accident Report rudder at about 25 degrees airplane nose right (ANR), the following conditions would exist at 150 to 160 knots calibrated airspeed (KCAS). Bank angles are noted as left or right wing down (LWD, RWD) and provide constant heading trim solution (no turns), except for the last case. At 10 and 15 degrees of flap setting, heading cannot be maintained with full rudder deflection. If full right rudder is achieved with a 10-degree flap setting, for example, heading control is lost and, according to Boeing, a steady 40-degree right-wing-down trim solution is attained that results in turning flight to the right even with full left wheel deflection. Immediate, full control wheel deflections would be required to prevent a lateral upset in the presence of a rudder hardover. The Safety Board evaluated the flight dynamics associated with other potential system failures. Various mechanical failures were simulated as follows: 1) leading edge slat failed to extend; 2) leading edge Krueger flap failed to extend; 3) yaw damper malfunction (2 degrees); 4) flight spoiler float; 5) a rudder control system malfunction that would cause 8 degrees of rudder deflection; 6) combined spoiler float and B hydraulic system out; 7) asymmetric thrust with 8 degrees of rudder; 8) inadvertent flight spoiler deployment; and 9) rudder hardover while at flaps 30. Simulations showed that the various mechanical failures failed to produce significant control difficulties. Most of the mechanical failures were described as “nonevents” (not a control problem). In the presence of turbulence, the simulations indicated that the leading edge slat and Krueger flap failures would probably go unnoticed. A yaw damper hardover (2-degree rudder deflection) required 20 degrees of wheel, and a floating spoiler required 25 degrees of wheel deflection. Rudder deflections of 10.5 degrees attributed to galling37 were controllable with 40-degree wheel deflections. Asymmetric thrust with 8 degrees of rudder deflection required 30 degrees of wheel deflection. Rudder Angle Flaps Side Slip Angle Wheel Angle Bank Angle 25 ANR 40 14 ANR 35 LWD 18 LWD 25 ANR 30 15 ANR 44 LWD 17 LWD 25 ANR 25 15 ANR 68 LWD 16 LWD 23 ANR* 15 17 ANR 107 LWD 23 LWD 21 ANR* 10 16 ANR 107 LWD 19 LWD 25 ANR** 10 13 ANR 107 LWD 40 RWD

• Less than full rudder allowed to maintain directional control.

** Loss of directional control. 37 A condition whereby contact forces between mating surfaces produce localized welding, transfer of material, and roughening of each surface.

Factual Information 62 Aircraft Accident Report 1.16.3 Detail Examination and Tests of Standby Rudder Actuator Input Shaft and Bearing A review of the design of the B-737 rudder control system revealed that binding of the input shaft to the bearing that is threaded in the actuator body could potentially cause flight control problems even though the standby rudder hydraulic system is not pressurized. In the rudder control system, the pilot pedal movement is applied through a mechanical control system to a lever arm to rotate a torque tube in the empennage. Other lever arms attached to the torque tube transmit linear motion to the ends of the input cranks for both the MPCU and the standby rudder actuator. (See figure 11). Figure 11. Standby rudder actuator. In normal operation, the input cranks to both the MPCU and standby rudder actuator will rotate to provide the servo valve command to the units, and the rudder will be hydraulically moved by the MPCU. The rudder movement is in turn fed back mechanically to both the MPCU and standby actuator systems so that when the rudder surface deflects to the position commanded by the pilot, the input cranks on both of the units will be returned to their null positions. Thus, there is a geometric relationship between the rudder position, the input crank of the MPCU, the torque tube, and the input

Factual Information 63 Aircraft Accident Report crank of the standby rudder actuator that is retained during normal operation. If, however, the input crank on the standby rudder actuator is not free to rotate with respect to the actuator housing because of galling between the shaft and bearing, the actuator housing, input crank, and control rod will act as a rigid link between the rudder and the torque tube. The inability to change the length of this link by rotation of the standby rudder actuator input crank within the actuator housing will affect the feedback mechanism between the rudder position and the MPCU input crank. This condition can result in problems ranging from high pilot control force necessary to move the rudder to uncommanded rudder deflections. The worst case condition would be one in which a pilot applies a rapid rudder pedal movement that is transmitted through the torque tube to move the input crank on the MPCU to its mechanical stops before the rudder begins to catch up to the commanded pedal position. Concurrently, the input crank on the standby rudder actuator would be rotated about 4 degrees from its null position. If the input crank were bound to the actuator housing in this position, the geometric relationship to null the MPCU would not be achieved. Theoretically, the MPCU will continue to move the rudder hydraulically, and the rudder movement will be transmitted through the rigid link created by the bound crank in the standby actuator to produce continued rotation of the torque tube so that the input command to the MPCU is perpetuated until the rudder reaches its full deflection mechanical stop in the direction originally commanded. If this should occur, the continued rotation of the torque tube will move the pilots' pedals and will react against a proportionally greater restoring moment provided by the rudder centering unit. Three factors could ameliorate the effect of a bound input shaft and bearing. The first is the elasticity of the control system linkage that, against a definable load, will permit sufficient deformation of the otherwise rigid link feedback loop to null the MPCU servo valve. The second factor is the application of a load sufficient to break loose the binding between the input shaft and bearing. The third factor is a loss of torque of the bearing in the standby rudder actuator housing to permit the rotation of the bearing and shaft together within the housing to compensate for the bound shaft. Because a rudder control system problem appeared to be a possible explanation for the loss of control, the Safety Board conducted a detailed examination of the input shaft and bearing and required tests to be conducted to determine the maximum rudder deflection that would result from binding between the shaft and bearing. Examination of the shaft and bearing from the standby rudder actuator at the Safety Board's Materials Laboratory revealed that some of the softer bearing material had transferred onto the surface of the harder shaft. A similar type of problem had reportedly caused operational problems in B-737 airplanes on at least three previous occasions, according to an article in Boeing's In Service Activities, Report 86-05, May 8, 1986. The bearing and the shaft are manufactured and installed as a matched pair. On September 3, 1986, as a result of the three previous incidents of galling between the input shaft and bearing, a design change was made by Boeing that increased the clearance between the two parts in the galled area by reducing the diameter of a portion of the shaft.

Factual Information 64 Aircraft Accident Report New and reworked actuators are identified by suffix letter “A” added to the unit serial number. Measurements showed that the diameter of the standby rudder actuator shaft from the accident airplane had not been reworked or manufactured to the dimensions for the increased clearance. Maintenance records of the airplane indicate that the standby rudder actuator had been installed on the airplane since new. During installation, the required installation torque on the bearing is 500 to 600 inch-pounds. The bearing is secured in its installed position with a safety wire and a mechanics seal. One end of the wire is pulled through two holes in the hexagonal head of the bearing, and the other end is connected to the body of the actuator. A safety wire, without the mechanic's seal, was present prior to the examination. Visual inspection of the parts revealed soot accumulations and discolored hydraulic fluid residue on the underside of the bearing flange and on the surface of the housing boss, indicating that these surfaces had not been mated together during the fire. During the examination, the bearing was reassembled into the actuator body so that the fire witness marks on the actuator surface and the bearing flange matched and the bearing was situated as close as possible to the actuator's housing surface. In this position, it was noted that an additional 30-degree rotation was required in order for the bearing flange to mate against the actuator boss. Comparison of the reassembled bearing to an x-ray radiograph made prior to disassembly showed that the bearing, as found after the accident, had been backed off (unscrewed) about 30 degrees of rotation from its fully seated position. However, the galled part of the bearing and shaft could be aligned only when the bearing was fully seated, and the standby rudder actuator input lever was in the neutral position. Boeing specifies that the maximum force required to move the standby rudder actuator input lever positioned at the end of the lever should not exceed 0.5 pound. Testing was performed by Boeing, under the direction of the Safety Board, in order to estimate the force required at the end of the lever arm to produce visible deformation on the hexagonal attachment hole flats. Testing indicated that the minimum force to produce the deformation was 220 pounds. No deformation or damage was noted on the flats of the attachment hole in the lever arm of the unit. Additional calculations and testing showed that when the shaft and bearing are galled and bound together, a force at the end of the lever can untorque the bearing from its seated position. If the bearing tightening torque is within the specified range of 500 to 600 inch-pounds and the shaft is frozen to the bearing, calculations show that the force required at the end of the input lever to untorque the bearing is between 70 and 80 pounds. Tests were conducted at the Boeing facility in Renton, Washington, under Safety Board direction in order to estimate a binding force produced by the galling found on the accident airplane's components. The shaft and bearing were custom manufactured with a known clearance between the parts. In order to produce binding, the clearance between the test parts was much less than that specified for production parts. Four sets of specimens, each comprised of one shaft and one bearing, were tested using simulated

Factual Information 65 Aircraft Accident Report flight cycling profiles. The testing of each pair was discontinued when the lever force reached a target value. After each test, the parts were disassembled, the galling pattern on each specimen part was examined, and the surface area of the gall was measured using a binocular microscope. The binding force versus the estimated galled area in the shaft and the bearing for each test specimen were plotted and compared to the measured area of the gall in the accident shaft and bearing. The binding forces were estimated to equate to 68 and 78 pounds at the end of the input crank, based on the areas of the galling on the shaft and bearing from the accident airplane. During the postaccident disassembly of the unit, the bearing nut was removed from the actuator housing. The torque applied to the bearing during this removal process was not recorded. However, during the process, the torque to rotate the bearing around the shaft was reacted by a ball machined on and protruding from the shaft that was seated into a mating socket in the servo valve slide. Calculations showed that the maximum torque that could be reacted by the shaft ball before fracture equated to about 76 pounds at the end of the lever. The shaft and ball were intact after disassembly. Thus, the effect on rudder control was examined, assuming that a force of about 80 pounds applied at the end of the standby rudder actuator input lever was necessary to rotate the shaft with respect to the actuator housing; the rotation could be effected by untorquing the bearing (in one direction only) or overcoming the galling force. As the rudder moves, the load applied to the torque tube will be reacted by the restoring moment of the centering spring and any added restoring force applied to the pilots' pedals. As this load is applied, the resulting deformation of the control linkages between the point of application at the torque tube to the standby rudder actuator attachment at the rudder--torsional windup of the torque tube, bending of the input lever, and any looseness in linkage connections--will offset the effect on the MPCU direct feedback so that the MPCU input crank will be moved toward the null position. If the standby rudder actuator input lever is bound in an angular position near to null, the pilot may be able to control the rudder position with relatively low pedal force. If the standby rudder actuator input lever is bound with an angular displacement from null greater than about 1.4 degrees, the load necessary to null the MPCU servo valve through deformation equals or exceeds the 80-pound load at the end of the standby rudder actuator crank necessary to overcome the binding or untorque the bearing. According to Boeing, the centering spring restoring moment will reach this load with a rudder deflection of 3 to 5.5 degrees depending upon tolerances. A force applied at the pilot's rudder pedal would be additive to the centering spring load to reduce rudder deflection. A pedal force of 47 pounds or greater could even achieve some opposite direction rudder. A maximum yaw damper deflection of 2 degrees at the rudder would produce a 1.34-degree displacement at the lever, and would require 75 pounds of load at the lever to overcome. Pilot pedal forces of 35 pounds would be sufficient to bend the standby rudder actuator input crank sufficiently to regain control of the rudder. During a routine UAL airplane maintenance inspection, the bearing was found loose (unscrewed), and the safety wire was broken on the standby rudder actuator from

Factual Information 66 Aircraft Accident Report another B-737. The standby rudder actuator was removed and shipped to the Safety Board's Materials Laboratory for examination. Examination of the unit disclosed that the bearing and the shaft were galled. The area of galling on the shaft and bearing from this unit was about the same, or slightly larger than that found on the shaft and bearing from the accident airplane. Three in-service witness marks were observed on the surface of the housing boss. One of the marks appeared to be a dirt mark and coincided with the edge of the bearing flat when the bearing was rotationally tightened in the actuator body using hand force. The other two marks appeared to be rub marks. The rub marks corresponded to the bearing hex nut flat, as if the bearing was backed off 5.5 degrees and 17.8 degrees, from its tightened position. 1.16.3.1 Additional Standby System Actuator Binding/Jam Tests During the investigation of the USAir flight 427 accident, Safety Board investigators conducted additional tests on the rudder system of a 737 to examine the effects of variable input shaft binding forces and input shaft binding at different positions, with and without yaw damper input and various hydraulic system failures. Before testing, the investigators verified that the airplane’s rudder system rigging and main and standby rudder PCU installations met in-service standards; the investigators also cycled the rudder systems to verify instrumentation and operational limits and establish a baseline. The standby rudder actuator was removed from the test airplane and replaced with a standby rudder actuator that was selected for the testing because it exhibited input shaft and bearing galling similar to the unit that was installed on the USAir flight 427 accident airplane. The following rudder commands were input with the main and standby rudder PCUs pressurized:38 full rudder pedal inputs in both directions with the yaw damper disengaged, full rudder pedal inputs in both directions with the yaw damper engaged, and full yaw damper commands in both directions. In all of these tests, the rudder system functioned normally, and higher-than-normal pilot rudder pedal forces were not required.39 After these tests, the standby rudder actuator was replaced with one that had an input shaft that could be adjusted to various levels of binding (intended to simulate galling). The replacement actuator was used to determine the effects of binding of the standby rudder input shaft and bearing and the various levels of force that would be required to overcome such binding. Tests were conducted with the actuator adjusted so that 60 to 70 and 100 pounds of force were required to move the actuator input arm. The tests also measured the effects of left, right, and no yaw damper commands. 38 The standby and main rudder PCU input rods move together regardless of which PCU is pressurized. 39 According to Boeing, normal input force is about 0.5 pounds.

Factual Information 67 Aircraft Accident Report The tests showed that, with 60 to 70 pounds of standby rudder binding force, the rudder could travel 7° to the left with a full left yaw damper command and 8° to the right with a full right yaw damper command. With 100 pounds of standby rudder binding force, the rudder could travel 8° to the left and right with full left and right yaw damper commands, respectively.40 Test conditions that simulated hydraulic system failures, along with binding of the standby actuator, did not significantly affect the rudder system’s operation. Ergonomic research indicates that pilots should have no difficulty applying 80 to 100 pounds of leg-pushing force against the rudder pedal, thus overriding the effect of such standby rudder actuator binding. (For additional information regarding ergonomic research on pilot rudder pedal forces, see section 1.18.3.) Tests were also conducted to determine the effects of a hard jam (not just binding) of the standby rudder actuator input shaft and bearing at the neutral, 3° (simulating left and right yaw damper inputs), and maximum standby rudder actuator positions (limited by the main rudder PCU external manifold stop). The tests showed that, with the standby rudder actuator input shaft jammed at the neutral position, the rudder could travel 6° to the left and 4° to the right with respective full yaw damper commands. A force of 45 pounds on the left rudder pedal or 55 pounds on the right rudder pedal would return the rudder to the neutral position; when the yaw damper command was turned off, the rudder remained at neutral. When the standby rudder actuator input shaft was jammed at the 3° left position, the rudder could travel 10° to the left with a full left yaw damper command and 3° to the right with a full right yaw damper command. With the yaw damper at its full deflection, a force of 95 pounds or 25 pounds on the appropriate rudder pedal, respectively, would return the rudder to the neutral position. When the yaw damper was turned off, the rudder was positioned 2° left of the neutral position. When the standby rudder actuator input shaft was jammed at the 3° right position, the rudder could travel 2° to the left with a full left yaw damper command and 13° to the right with a full right yaw damper command. With the yaw damper at its full deflection, a force of 30 or 110 pounds on the appropriate rudder pedal, respectively, would restore the rudder to the neutral position. When the yaw damper was turned off, the rudder was positioned 4° to the right of the neutral position. With the standby rudder actuator input shaft jammed at a position required for a full maximum rate left rudder input (limited by the main rudder PCU external manifold stop), the rudder traveled 19° to the left of the neutral position. Under this test condition, 65 pounds of force applied to the right rudder pedal returned the rudder to the neutral position. The 65-pound force to the right rudder pedal would create a 140-pound force on the standby PCU input arm. 40 The 737-300 yaw damper still commanded ± 3° of motion. Therefore, if the standby actuator jammed when the rudder was positioned 3° left of its neutral position, the yaw damper could command rudder movement 3° in either direction, resulting in left rudder movement to 6° of left or right deflection back to neutral. If the rudder was at 6° ° left when the standby actuator binding occurred, the yaw damper could command rudder movement that would result in between 3 and 9° of left rudder deflection.

Factual Information 68 Aircraft Accident Report Regardless of whether the standby rudder actuator input shaft was jammed at 3° left or 3° right of the neutral position or at the main rudder PCU body stop in either direction, the rudder moved to an off-neutral position when the hydraulic system was powered. With the standby rudder actuator input shaft and bearing jammed at the neutral position, no initial offset to the rudder occurred. In every case, the rudder could be centered by applying rudder pedal force to oppose the offset. The replacement standby actuator contained an input shaft and bearing that displayed galling similar to the unit that was installed in the United flight 585 airplane. Subsequent testing indicated that a full 3° yaw damper command would result in a 5° rudder movement to the left and a 6° rudder movement to the right. Another galled input shaft and bearing were installed in the standby rudder actuator, and subsequent tests indicated that full 3° yaw damper commands to the left and right resulted in 6° of rudder movement in the respective directions. 1.16.4 Other Documented Rudder Control Incidents Boeing stated that, at the time of the United flight 585 accident, 737-series airplanes had flown about 50 million hours and that there had been five previous incidents involving anomalies in the main rudder PCU.41 • On July 24, 1974, the flight crew of a 737 reported that a rudder moved “full right” upon touchdown. The investigation revealed that the primary and secondary slides were stuck together by a shotpeen ball lodged in the servo valve. • On October 30, 1975, during a main rudder PCU inspection, shotpeen balls were found in a servo valve that had undergone chrome plating. • On August 26, 1977, the flight crew of a 737 reported that, during taxi, the right rudder pedals moved in “half way” and then jammed. This event happened three times and was corrected each time by cycling the rudder with the standby rudder system. Further examination indicated that the main rudder system was contaminated by metal particles. • On August 31, 1982, the flight crew of a 737 reported that the rudder “locked up” on approach and that the flight crew initiated a go-around and activated the standby rudder system. The subsequent landing was uneventful. The examination of the PCU revealed internal contamination and worn seals, which resulted in the PCU having a limited capability to generate enough force to move the rudder. 41 For information about additional anomalies and events potentially involving the 737 rudder system and/or main rudder PCU, see section 1.18 of the final report on the USAir flight 427 accident.

Factual Information 69 Aircraft Accident Report • On November 8, 1990, during an overhaul, a main rudder PCU was found to have internal corrosion. The primary slide was stuck to the secondary slide at the neutral position as a result of the corrosion. No malfunctions were reported before disassembly. In addition, during the initial investigation of the United flight 585 accident, another rudder-related anomaly was reported. On July 16, 1992, during a preflight rudder control ground check at O’Hare International Airport, Chicago, Illinois, the captain of a United Airlines 737-300 noted that the left rudder pedal stopped and jammed near 25-percent pedal travel. The captain reported that he was moving the rudder pedals more rapidly than usual when the jam occurred. He further stated that the rudder pedals returned to their neutral position after he removed foot pressure from the left rudder pedal. The airplane returned to the gate, and the main rudder PCU was removed for further examination. The main rudder PCU was tested and examined at United Airlines’ facility in San Francisco, California, and Parker’s facility in Irvine, California. The testing revealed that the PCU exhibited anomalous behavior, ranging from sluggish movement of the actuator piston to a full reversal in the direction of piston travel opposite to the direction being commanded, when the input crank was fixed against the PCU body stops (to move the primary and secondary slides throughout their full travel) and the yaw damper piston was in the extend position. The testing also revealed high internal fluid leakage. When investigators tapped on the dual servo valve housing or the summing levers or released the force on the input crank, the PCU returned to normal operation. Further examination of the servo valve components showed that the secondary slide could move axially beyond its designed operating position (overtravel), resulting in abnormal porting of hydraulic fluid. When the secondary slide overtraveled to its mechanical stop (internal stop) in the servo valve housing, the abnormal flow could produce full pressure opposite to that intended at the actuator piston. Thus, the rudder would move in a direction opposite to the commanded direction; for example, rudder input intended to command left rudder could result in the rudder moving right. The Safety Board’s examination of this servo valve revealed that overtravel of the secondary slide occurred when the rudder pedals were moved rapidly to command a maximum rate of rudder travel or when the pedal was fully depressed to command full deflection of the rudder. During subsequent tests, the overtravel of the secondary slide was determined to be the result of the failure of the secondary summing lever to maintain contact with its respective external stop. Examination of the summing levers revealed that the secondary summing lever did not meet design specifications in that the chamfer42 on the summing lever was 50°, rather than the specified 45°, at the point where it contacted the external stop. This anomaly allowed the secondary summing lever to move beyond its external stop; thus, the secondary slide and summing lever could continue to move 42 A chamfer is an oblique face located at a corner (a beveled edge).

Factual Information 70 Aircraft Accident Report beyond the normal range of travel until the secondary slide bottomed out at its internal stop in the servo valve housing.43 As a result of its investigation of this incident, the Safety Board became concerned about the potential for rudder reversal in all 737 main rudder PCUs, specifically, that the internal stops of the dual-concentric servo valve could allow sufficient movement to route hydraulic fluid through a flow passage located outside the normal valve operating range, resulting in movement in the direction opposite to the control input. On November 10, 1992, the Board issued Safety Recommendations A-92-120 and -121. Safety Recommendation A-92-120 asked the FAA to Issue an airworthiness directive mandating design changes for main rudder PCU servo valves that would preclude the possibility of rudder reversal attributed to the overtravel of the secondary slide. Safety Recommendation A-92-121 asked the FAA to Conduct a design review of servo valves manufactured by Parker Hannifin that have a design similar to the 737 rudder power control unit servo valve that control essential flight control hydraulic power control units on transport-category airplanes certificated by the Federal Aviation Administration to determine that the design is not susceptible to inducing flight control malfunctions or reversals due to overtravel of the servo slides. Section 4 contains the history and status of these recommendations. Because of the nature of the United flight 585 accident, the PCU servo valve from N999UA, the accident airplane, was also subjected to tests involving abnormal movement of the concentric primary and secondary slides. It was found that the tolerances of this unit were such that maximum travel of the secondary slide, irrespective of the relative position of the primary slide, would not result in a reversal of pressure differential across the actuator pistons. In the worst case, with the secondary slide against its internal stop, an internal leakage was produced with a resultant 66-percent drop in maximum pressure differential across the pistons. This condition would limit the rate of rudder movement and the maximum deflection that could be achieved against aerodynamic loads. In addition, the secondary summing lever was making full contact with its respective stop, which would eliminate one condition that could lead to an overtravel of the secondary slide. 43 The servo valve was designed to prevent abnormal flow if the secondary slide bottomed out at its internal stop; however, during the investigation of this incident, it was discovered that parts built within tolerances could be assembled with a resulting tolerance buildup that would allow the abnormal flow to occur if the secondary slide moved to its internal stop. Thus, in addition to the potential for overtravel because of the incorrect chamfer, it became evident that the secondary slide could also be forced into the overtravel range if it became jammed to the primary slide. Normal movement of the primary slide could produce a rudder reversal if a primary to secondary slide jam existed.

Factual Information 71 Aircraft Accident Report 1.16.5 Additional Examination and Testing of 737 Flight Control Systems/Components During its investigation of the USAir flight 427 accident, the Safety Board conducted numerous additional tests and examinations of the 737 rudder actuator system components. Several of these tests are described next. For more information about these and other tests conducted in connection with the USAir flight 427 accident investigation, see the Board’s final report for that accident. Tests were conducted to determine the effects on the rudder system of the presence of a foreign object or blockage between the main rudder PCU external input crank and one of the PCU external manifold stops. The tests indicated that a blockage between the rudder’s external input crank and one of the external manifold stops could result in a significant rudder movement. However, the main rudder PCU linkage is positioned so that it prevents a foreign object from dropping into the space between the aft stop and the crank arm. The PCU’s orientation also makes it difficult for a foreign object to lodge between the forward stop and input link. The external summing lever effectively covers the gap in the PCU retract direction (left rudder command). The Safety Board conducted a series of tests to examine the effects of dynamic external loads (such as those that the United flight 585 airplane might have experienced during its approach in turbulent weather and the USAir flight 427 airplane might have experienced during the wake turbulence encounter) applied axially to the main rudder PCU actuator rod.44 The tested PCUs responded normally throughout all tests without any abnormal motions. In the tests to determine the effects of silting,45 the flight 427 PCU was rigged to allow silting to occur and then was freed to operate normally. A force of 4 pounds was required to move the external input crank. Normal input crank operation requires about 1.5 pounds of force. To determine the effects that air in the hydraulic fluid would have on the main rudder PCU operation, the Safety Board conducted operational tests of the USAir flight 427 PCU. The PCU responded normally (the output command matched the input command). 44 These tests were conducted on a new-production PCU and the flight 427 PCU; the PCU from United flight 585 was too badly damaged to test. 45 The term “silting” refers to the accumulation of particles of contaminants in hydraulic fluid in a hydraulic component. The particles are smaller than the filter on the inlet side of the component and tend to settle at various edges and corners of valves and stay there unless washed away by higher flow rates. In other words, when the servo valve is in the hydraulically neutral position, the flow of hydraulic fluid is restricted, and the servo valve can function as a filter by catching some of the particles. These particles tend to accumulate at the upstream side of edges and corners of narrow orifices (such as the servo valve ports); however, movement of the servo valve from the hydraulically neutral position results in increased hydraulic fluid flow, which tends to flush any accumulated particles through the servo valve.

Factual Information 72 Aircraft Accident Report Also during its investigation of the USAir flight 427 accident, the Safety Board conducted detailed examinations of main rudder PCU servo valves, PCU servo valve chip shear tests, PCU thermal tests, tests to determine the effects of rudder actuator reversals during servo valve secondary slide jams, and ground demonstrations of rudder PCU servo valve jam/reversal. These tests are discussed in sections 1.16.5.1 through 1.16.5.5, respectively. 1.16.5.1 Detailed Examinations of Main Rudder PCU Servo Valves Several times during the USAir flight 427 investigation, the Safety Board subjected the flight 427 PCU46 to Parker’s postproduction acceptance test procedure (which is a performance-based test only and does not require the measurement of diametrical clearances). The acceptance tests did not reveal any disqualifying anomalies. It was not possible to measure the diametrical clearances that existed within the PCU servo valve from United flight 585 because the valve was damaged by the postaccident fire and attempts to remove the PCU from the wreckage. However, the Safety Board measured the clearances between the primary and secondary slides and between the secondary slide and the servo valve housing on three PCU servo valves—a new-production PCU servo valve and the servo valves from the USAir flight 427 and Eastwind flight 517 airplanes. These measurements indicated that a wide variability existed among servo valves that passed Parker’s acceptance tests. The primary and secondary slides and the servo valve housing of each PCU were measured in three places—at the input lever end, midpoint, and spring end. Table 1 lists the minimum diametrical clearances (in inches) measured for each PCU at each position. Table 1. Diametrical clearance measurements (in inches) for three PCUs. 46 Postaccident tests and examinations were performed on the USAir flight 427 main rudder PCU servo valve and the primary and secondary slides in their condition as recovered. The PCU actuator rod and external input linkage, however, exhibited impact damage that precluded normal operation; thus, these components (and their associated hardware) were replaced to facilitate testing. Measurement position 427 PCU slide to housing 427 PCU slide to slide 517 PCU slide to housing 517 PCU slide to slide New PCU slide to housing New PCU slide to slide Input lever end 0.000130 0.000170 0.000190 0.000200 0.000195 0.000190 Midpoint 0.000140 0.000140 0.000170 0.000180 0.000215 0.000200 Spring end 0.000170 0.000150 0.000180 0.000190 0.000190 0.000210

Factual Information 73 Aircraft Accident Report As part of its USAir flight 427 investigation, the Safety Board conducted further detailed examination and testing of the main rudder PCU servo valves from USAir flight 427, Eastwind flight 517, and United flight 585. The Board also examined a “minimum tolerance” servo valve that was used by Boeing during thermal shock testing (see section 1.16.5.3);47 new-production servo valves; the servo valve from the December 19, 1997, Silk Air flight 185 (737-300) accident in Palembang, Indonesia; and five servo valves supplied by Parker that had been removed from service and had varying hours of operation (referred to as exemplar valves). The Board’s materials laboratory examined the primary and secondary slides and housing from each of these main rudder PCU servo valves48 using a specially designed borescope and video recording system. Each segment of the primary and secondary slides’ outside diameter surfaces, the metering ports,49 and the inside diameters of the secondary slide and the servo valve housing were examined with a 90° borescope at magnifications up to 130 times. The outside diameter surfaces of the primary and secondary slides were also examined with a binocular microscope. A few small chipped areas were noted on the metering edges of the primary slide of each of the units examined; the locations of the chipped areas did not correspond circumferentially to the metering port areas. Examination with a scanning electron microscope (SEM) revealed that the dimensions of the largest chipped area on the USAir flight 427 primary slide was 0.006 inch in circumference by 0.002 inch in length. The other primary slides examined (including the new-production servo valve primary slide) had chipped areas of similar or larger size yet still met specifications. The metering ports for the secondary slide and the servo valve housing inside diameter surfaces were also examined using a 15° borescope so that the metering port edges could be better viewed. No evidence of deformation or distress was noted on any of the metering ports on any of the secondary slides and servo valve housings. In addition, small deposits of material that appeared to have the same composition as the secondary slide were observed on the slide’s outside diameter surface adjacent to the metering edge. To identify the origin of these material smears, the Safety Board reviewed Parker’s manufacturing procedures. This review found that, during manufacture, the servo valve slides are trimmed (or cut) at the metering edges, burr-wiped (or polished), and functionally tested in matched assemblies. The Board obtained from Parker 47 This servo valve was specifically selected from existing stock because it had the tightest tolerances between the primary and secondary slides and the secondary slide and the servo valve housing that would pass the PCU acceptance test friction requirements. According to Boeing, the diametric clearance between the secondary slide and the servo valve housing was 0.000070 inch. (The same clearance in the USAir flight 427 valve was 0.000130 inch.) 48 The main rudder PCU from the Silk Air accident airplane was examined by Safety Board investigators under the supervision of a representative from the Indonesian government. The examination did not reveal any evidence of a preimpact jam or failure. 49 Metering ports are rectangular holes in the servo valve housing and secondary slide through which hydraulic fluid flows to cause actuation of the unit. Metering edges are the sides of grooves that are cut into the outside diameter surface of the primary and secondary slides. Flow of hydraulic fluid is controlled by positioning the metering edges relative to the metering ports.

Factual Information 74 Aircraft Accident Report two primary slides in an intermediate manufacturing condition to microscopically observe the trimmed and trimmed/burr-wiped conditions. SEM examination of the trimmed-only primary slide revealed numerous pieces of folded-over metal curled over the metering edge at the trimmed edge of the slide. SEM examination of the trimmed and burr-wiped primary slide showed areas on the slide’s outside diameter adjacent to the trimmed edge that appeared to be flattened down and smoothed over, similar to that observed on the USAir flight 427 primary slide. 1.16.5.2 PCU Servo Valve Chip Shear Tests The Safety Board conducted two series of tests during the USAir flight 427 investigation to determine if a chip of material could lodge between the PCU servo valve primary and secondary slides or between the secondary slide and the valve housing and result in a jammed servo valve. The first series of tests were conducted at Boeing’s Equipment Quality Analysis Laboratory in January 1995 with chips of various materials that could be found in an airplane system. These materials included rubber, Teflon, steel wire, aluminum alloys, hardened and stainless steels, lockwire, aluminum-nickel-bronze, and chrome plating. The chip sizes were manufactured so they would be large enough to fill as much as possible of the 0.015- by 0.045-inch primary metering ports. Chips were inserted into these metering ports at the interface of the primary and secondary slides of a servo valve slide assembly. The primary slide was then moved to close off the metering port. The tests demonstrated that, when forces of up to 44 pounds were applied50 to move the primary slide to close off the secondary slide metering ports, all but one type of chip sheared. The chip that did not shear was a hardened-steel chip that jammed the primary slide to the secondary slide and did not shear with the maximum force of 44 pounds applied.51 When investigators examined the servo valve after the primary slide jammed on the hardened-steel chip, they noted a physical mark on the surface of the primary slide where the chip was inserted. The physical mark had the approximate size and shape of the hardened-steel chip. A second series of chip shear tests was conducted at Boeing’s facility in Everett, Washington, in February 1997. These chip shear tests were similar to the January 1995 tests except that (1) the February 1997 test chips were inserted in the secondary metering ports at the interface of the secondary slide to the servo valve housing, (2) different sizes of hardened-steel chips were used, and (3) forces of up to 140 pounds were applied. In the February 1997 tests, all of the chips were successfully sheared, and each shearing event created a mark on the secondary slide that was approximately the shape of the chip. The maximum shear force needed was 140 pounds for a 0.042-inch wide by 0.014-inch thick chip. The minimum shear force for the same material was 23 pounds for a 0.011-inch wide by 0.013-inch thick chip. 50 According to Boeing, the PCU design allows a maximum input force of about 50 pounds to the primary slide and 200 pounds to the secondary slide. 51 This chip was 0.032 to 0.058 inch wide by 0.012 to 0.016 inch thick.

Factual Information 75 Aircraft Accident Report 1.16.5.3 PCU Thermal Testing A hydraulic system thermal analysis by Boeing engineers conducted during the USAir flight 427 investigation indicated that the failure of one of the 737 airplane’s engine-driven hydraulic pumps (EDP) could result in the overheating of the fluid in one of the hydraulic systems. Further, in response to recommendations made by an independent technical advisory panel,52 the Safety Board conducted two series of thermal tests (in August and October 1996)53 to identify the effects of thermal variations on the operation of the main rudder PCU. The hydraulic fluid used in the Safety Board’s silting tests was used for both series of thermal tests. During the August 1996 thermal tests, a total of 12 tests were conducted: 4 on a new-production PCU and 8 on the USAir flight 427 PCU. During the October 1996 thermal tests, a total of 19 tests were conducted: 8 on the new-production PCU and 11 on the USAir flight 427 PCU. The tests for both series were conducted first on the new-production PCU (to verify setup and methodology) and then on the USAir flight 427 PCU. Testing under all of the thermal test conditions was accomplished by pushing or pulling the external PCU input crank with a rod (simulating a left or right input command) and using sufficient force to move the secondary slide. (In the absence of jamming or binding, the secondary slide moves when about 12 pounds of force is applied at the input crank.) The results of three thermal test conditions (performed on both PCUs during both the August and October 1996 test series) are discussed in this report section. Two of these test conditions were included in this section because the tests and their results were representative of all other thermal tests that were conducted under conditions believed at the time to approximate those that a 737 airplane might encounter during normal operation (baseline and with a hydraulic system failure). The third test condition, which used hot hydraulic fluid injected directly into a cold PCU to explore the effects of extreme temperature differentials on the main rudder PCU’s operation, was selected for inclusion in this section because the USAir flight 427 PCU exhibited anomalous behavior during this test condition. For these three thermal test conditions, the exterior temperature of the PCU servo valve housing was allowed to reach and stabilize at a temperature believed, at the time the tests were conducted, to be representative of the vertical stabilizer cavity (where the rudder PCU is located) of the accident airplane just before the upset (-27 to -40° F).54 These temperatures were achieved before each test without hydraulic fluid circulating 52 The independent technical advisory panel was created by the Safety Board in January 1996 to review the work of the Board’s Systems Group for the flight 427 investigation. 53 The October 1996 tests used improved temperature control and data recording capabilities. 54 The temperatures used during these tests (-27 to -40° F) were based on the results of Boeing’s thermal analyses. In October and December 1996, Boeing conducted flight tests to measure the operating temperatures of the 737 hydraulic system and main rudder PCU in a normal operating environment. The December 1996 tests indicated that the PCU servo valve housing operating temperature was greater than -27° F, as discussed at the end of this section.

Factual Information 76 Aircraft Accident Report through the PCU. Also, the PCU servo valve housing continued to be cooled by the cold ambient air inside the test chamber and was warmed to varying degrees and at varying rates by the introduction of hydraulic fluid into the servo valve. 1.16.5.3.1 Baseline Test Condition This test condition approximated the system operating temperatures that investigators initially hypothesized for the USAir flight 427 accident airplane if both hydraulic systems A and B were operating normally (PCU temperatures of about 10 to 20° F and hydraulic fluid temperatures of about 70° F at the PCU inlet). Test results for this condition indicated that the difference in the servo valve exterior surface temperature and the hydraulic fluid temperature at the PCU was approximately 50 to 60° F. Both the new-production PCU and the accident airplane’s PCU responded normally during all tests under this condition. 1.16.5.3.2 Simulated Hydraulic System Failure Condition In this test condition, the temperature of the hydraulic fluid entering the PCU was raised to simulate a malfunction of one of the EDPs. Boeing could not provide flight test data for the temperature of the hydraulic fluid at the PCU. Therefore, at the Safety Board’s request, Boeing performed a thermal analysis, which indicated that a failed EDP could raise the temperature of the hydraulic system reservoir associated with the pump failure to 180 to 207° F. (The 737 incorporates a hydraulic fluid temperature sensor near the EDPs that provides a cockpit indication of an overheat condition when the hydraulic fluid reaches or exceeds 220° F. The accident airplane’s CVR recorded no flight crew comment regarding hydraulic system overheating.) Boeing’s thermal analysis also indicated that, if the hydraulic fluid were to overheat to a point just below the threshold of the overheat detector, the hydraulic fluid would cool to about 170° F as it passed from the hydraulic pumps to the end of the pressurized section of the fuselage. The fluid would then pass through about 15 feet of 3/8-inch diameter steel tube before it would reach the hydraulic fluid inlet point on the main rudder PCU. The tests for this condition were conducted with the hydraulic fluid temperature raised to about 170° F at the point that the fluid entered the thermal test chamber. The fluid was then cooled by the ambient conditions in the chamber (temperatures in the chamber were between -27 and -40° F) as the fluid passed through the steel tubing into the main rudder PCU. Testing was conducted with both hydraulic systems A and B overheated and with only system A overheated (system B was at about 60° F). Test results for these conditions indicated that the difference in the servo valve exterior surface temperature and the hydraulic fluid temperature at the PCU inlet was approximately 100° F. Both the new-production PCU and the accident airplane’s PCU responded normally during all tests under this condition. 1.16.5.3.3 Extreme Temperature Differential Test Condition This test condition examined the effects of subjecting the PCU to a relatively extreme differential between the hydraulic fluid temperature at the PCU inlet and the

Factual Information 77 Aircraft Accident Report servo valve exterior surface temperature. The extreme temperature differential produced during this test condition would not be expected during normal flight operations. For this test condition, the PCU was cooled to about –40° F while both hydraulic systems were depressurized (no hydraulic fluid passing through the PCU). At the beginning of these tests, heated hydraulic fluid only from system A (at a temperature of 170° F) was inserted directly into the PCU. The maximum temperature differential between the inlet hydraulic fluid and the servo valve housing of 180° F was attained 25 seconds after insertion of the heated hydraulic fluid. The new-production PCU responded normally under the extreme temperature differential test condition. However, the USAir flight 427 PCU exhibited anomalous behavior during these tests. During the August 1996 extreme temperature differential tests, the accident airplane’s PCU responded normally for the initial three external input crank commands, but the external input crank stuck in the full left rudder position for about 5 seconds at the end of the fourth input command. Afterward, the movement of the external input crank was normal, except for a hesitation in motion as the crank was pushed and pulled on each input command in both the rudder left and rudder right directions. The anomalous operation of the USAir flight 427 PCU was verified by a repeat test. During this repeat test, the PCU responded normally for one input command. However, during the next two input command cycles, the external input crank moved slower than normal for the left rudder command. At the end of the fourth left rudder command cycle, the external input crank stuck in the full left rudder position for about 1 second, after which the movement of the external input crank returned to normal. To further examine the extreme temperature differential test condition, the PCU temperature was once again lowered to about -40° F and stabilized, and the test was repeated again. During this repeat test, the PCU responded normally for the first three input commands. During the next three input commands, however, the external input crank moved slower than normal during the left rudder command. At the end of each of these left rudder command inputs, the force required to return the input crank to neutral increased to about 124 pounds for about 1 second. Afterward, the external input crank returned to its neutral position with the application of less than 5 pounds of force. The October 1996 tests under the extreme temperature differential test condition, which utilized improved temperature control and data collection systems, yielded similar results for the USAir flight 427 PCU. Examination of the hydraulic fluid flow data revealed that momentary, anomalous increases in hydraulic system fluid return flow occurred during the jamming/binding. Further examination of the data indicated that the servo valve secondary slide momentarily jammed to the servo valve housing and that the subsequent overtravel of the primary slide resulted in an increase in system return flow that could cause a rudder actuator reversal (travel in the direction opposite to that commanded). Although reversal of the PCU actuator was not noted by any of the participants or observers during the tests, the periods of anomalous hydraulic system fluid flow observed in the data were consistent with the misporting of the hydraulic fluid from the effects of the jammed secondary slide and overtravel of the primary slide, resulting in a momentary output command opposite to the input command.

Factual Information 78 Aircraft Accident Report 1.16.5.3.4 Additional Testing The USAir flight 427 PCU was disassembled and examined at Parker after both of the August and October 1996 test series were completed. The primary slide, secondary slide, and interior of the servo valve housing showed no evidence of damage or physical marks from jamming or binding during the thermal testing. The PCU also passed the functional acceptance test procedure used by Parker for validating PCU performance. On October 4, 1996, at the Safety Board’s request, Boeing conducted a flight test to measure the operating temperatures of the 737 hydraulic system and main rudder PCU in a normal operating environment. A test airplane was flown for about 2 hours at an altitude of up to 30,000 feet. Measurements included static air temperature outside the airplane (-40° F), temperature on PCU body (20° F), and temperature of the hydraulic fluid exiting the EDP (100° F). Additional temperature data was obtained during a flight test on December 6, 1996, that was conducted by Boeing (at the request of the Safety Board) with additional instrumentation. During this flight test, a test airplane was flown for about 2 hours at an altitude of up to 35,000 feet, and then the airplane descended to 20,000 feet for 1 hour. Data from this flight test indicated the following temperatures at 35,000 feet: static air outside the airplane, -58° F; hydraulic system A fluid at the outlet of the EDP, 58° F; hydraulic system A fluid at the PCU inlet, 22° F; hydraulic system B fluid at the PCU inlet, 34° F; PCU servo valve housing, 35° F; and ambient air around the PCU (inside the vertical stabilizer), -15° F. Data from this flight test indicated the following temperatures at 20,000 feet: static air outside the airplane, -36° F; hydraulic system A fluid at the outlet of the EDP, 65° F; hydraulic system A fluid at the PCU inlet, 35° F; hydraulic system B fluid at the PCU inlet, 35° F; PCU servo valve housing, 38° F; and ambient air around the PCU (inside the vertical stabilizer), 0° F. In February 1997, Boeing independently conducted a third series of thermal tests. These tests were conducted on a main rudder PCU that was specifically selected by Boeing because it had the tightest diametrical clearances (between the primary and secondary slides and between the secondary slide and servo valve housing) that would pass the Parker functional acceptance test procedure frictional requirements.55 Boeing reported that this minimum tolerance PCU servo valve operated normally for each test condition designed to simulate a hydraulic system overheat, with one or both hydraulic systems circulating fluid through the servo valve before insertion of the heated fluid and at Boeing’s estimated normal operating temperatures within the vertical fin (conditions similar to those used in the Safety Board’s simulated hydraulic system failure tests). Boeing conducted additional tests in which hot hydraulic fluid was injected directly 55 As noted in section 1.16.5.1, the diametrical clearance of the minimum tolerance servo valve (secondary slide to servo valve housing) was 0.000070 inch. (The same clearance in the USAir flight 427 main rudder PCU servo valve was 0.000130 inch.)

Factual Information 79 Aircraft Accident Report into the minimum tolerance servo valve. Hydraulic fluid was not circulated through the servo valve before insertion of the heated hydraulic fluid (conditions similar to those used in the Board’s extreme temperature differential tests). In some tests under these two conditions, the minimum tolerance servo valve’s secondary slide jammed to the servo valve housing (and remained jammed as long as the force on the input crank was maintained). The smallest temperature differential between the inlet hydraulic fluid and the servo valve housing at which the minimum tolerance PCU jammed was 145° F. 1.16.5.4 Rudder Actuator Reversals During Servo Valve Secondary Slide Jams After the Safety Board’s October 1996 thermal tests, Boeing engineers began an independent detailed examination of the test data. Their review of the data indicated that the PCU servo valve responded slowly and erratically to the input commands when the secondary slide was jammed to the housing by the thermal shock and an input was applied to the external input arm. Boeing subsequently conducted tests using a new-production PCU that had been modified to simulate a jam of the secondary slide to the servo valve housing at various positions and then to simulate the application of a full rudder input to the PCU. These tests revealed that, when the secondary slide was jammed to the servo valve housing at certain positions, the primary slide could travel beyond its intended stop position because of bending or twisting of the PCU’s internal input linkages (compliance). This deflection allowed the primary slide to move to a position at which the PCU commanded the rudder in the direction opposite of the intended command (reversal). Specifically, the tests revealed that, when the secondary slide was jammed at positions greater than 50 percent off neutral toward the extend or retract position and a full-rate command was applied to the PCU, the rudder would move opposite to the commanded position.56 Figures 12 and 13 show normal operation of the servo valve. Figure 14 shows the servo valve with a secondary slide jam (normal operation). Figure 15 shows the servo valve with a secondary slide jam and primary slide in the overtravel condition. 56 The Safety Board has investigated several fatal aviation accidents that have involved flight control reversals. In some cases, improper maintenance resulted in an airplane’s aileron controls being connected backward so that a pilot control wheel input intended to command a right turn resulted in a left turn. See the following National Transportation Safety Board accident reports: ANC94LA101 (August 3, 1994), FTW92FA218 (August 25, 1992), ATL88LA149 (June 4, 1990), ANC88FA062 (May 20, 1988), LAX85LA104 (January 10, 1985), MIA84FA040 (December 4, 1983), and MKC83FA090 (April 15, 1983). Also, see National Transportation Safety Board Briefs of Accident 1469 (August 20, 1982) and 3-1496 (June 9, 1976).

Factual Information 80 Aircraft Accident Report Figure 12. Normal operation of the 737 PCU servo valve with slides in the neutral position (no jam). Figure 13. Normal operation of the 737 PCU servo valve with slides in the extend command position (no jam). R Left P Right R Primary Slide Primary and Secondary Slides at Neutral Rudder Rate = 0 Neutral Secondary Slide Valve Body Normal Full Rate Command- Primary & Secondary Slides Full Open Rudder Rate TEL R Left P Right R Primary Slide Neutral Secondary Slide Valve Body

Factual Information 81 Aircraft Accident Report Figure 14. PCU servo valve intended operation with the secondary slide jammed to the servo valve housing and primary slide opposing. Figure 15. PCU servo valve with the secondary slide jammed to the servo valve housing and the primary slide in the overtravel condition. After studying the thermal test conditions in which the USAir flight 427 main rudder PCU jammed, the Safety Board attempted to determine the combined effects of PCU servo valve secondary slide jamming and input linkage deflections (compliance) to determine if the USAir flight 427 PCU was more susceptible to reversal than other servo valves. These tests were conducted in November 1996 on three PCUs: a new-production Intended Operation: Secondary Slide Jammed Full Open, Primary Slide Opposing (Full Cross Flow) Rudder Rate = 0 Secondary Slide - Jammed To Valve Body R Left P Right R Primary Slide Neutral Valve Body Secondary Slide - Jammed To Valve Body Newly Discovered Failure Effect: Secondary Slide Jammed Full Open, Primary Slide Over-Stroked In Opposing Direction Rudder Rate TEL R Left P Right R Primary Slide Neutral Valve Body

Factual Information 82 Aircraft Accident Report PCU, the USAir flight 427 PCU, and the Eastwind flight 517 PCU. For this series of tests, a tool was used to mechanically jam the secondary slides of all three PCUs to their respective servo valve housings. Manual inputs were then applied to the PCUs with the yaw damper energized and deenergized (no yaw damper command was applied in both cases). When inputs at a less-than-maximum rate were made to the PCU, all three PCUs operated normally. However, if the external input crank rate exceeded the capability of the PCU to respond at its maximum rate, the input caused deflection of the internal linkages (that is, caused them to bend or twist), resulting in overtravel of the primary slide and a reverse rudder response (that is, a response opposite to that commanded). To identify the threshold for reversal, the Safety Board conducted tests on the three PCUs to determine the distance that the secondary slides had to be placed away from the neutral (“no rudder command”) position to result in rudder actuator reversal when an input force was applied to the PCU. The tests indicated that each of the three PCUs would stall (stop movement) or reverse when the secondary slide was jammed at or beyond the following positions (expressed as a percentage of full secondary slide travel from the neutral position): • New-production PCU: 38 percent in the extend direction, 54 percent in the retract direction. • USAir flight 427 PCU: 12 percent in the extend direction, 41 percent in the retract direction. • Eastwind flight 517 PCU: 17 percent in the extend direction, 30 percent in the retract direction. On August 20, 1997, the Safety Board conducted additional tests on the USAir flight 427 and Eastwind flight 517 PCUs to determine the effects of a jammed secondary slide on the force and rate of rudder movement. For these tests, each PCU was installed in a test fixture at Parker that simulated the airplane installation, and the servo valve secondary slide was jammed with the jamming tool. Table 2 shows the test results, which indicated that the position of the secondary slide jam affected the rudder’s output (force and rate). Table 2. Test results on the effects of a jammed secondary slide on the force and rate of rudder movement. PCU Position (percent off neutral) Force (percent of full PCU output capability)a Rate (degrees per second) USAir 427 0 100 31.7 USAir 427 12 50 3.9b USAir 427 22 76 9.5b USAir 427 50 88 17.8b

Factual Information 83 Aircraft Accident Report 1.16.5.5 Ground Demonstration of Rudder PCU Servo Valve Jam In connection with the investigation of the USAir flight 427 accident, the Safety Board participated in June 1997 in a ground demonstration conducted by Boeing at its facility in Seattle, Washington.57 The demonstration was intended to identify and document the cockpit characteristics of a rudder PCU servo valve secondary slide jam. The demonstration was accomplished in a newly manufactured 737-300 airplane that was fitted with a special tool to simulate a rudder PCU servo valve secondary slide jam at three different positions (about 0 percent, about 25 percent, and about 50 percent of travel from the neutral position). The demonstration was conducted while the airplane was parked on the ground with both engines off and with hydraulic systems powered by an external source of power. Before the demonstration began, the participants sat in the pilot seats of another newly manufactured 737-300 and manipulated the rudder pedals to become familiar with the feel of a normally functioning 737 rudder system on the ground. The participants then moved to the airplane that was fitted with the special jamming tool, and each participant USAir 427 71 93 26.6b USAir 427 100c ~ 100 ~ 33 Eastwind 517 0 100 31.7 Eastwind 517 22 34 4.8b Eastwind 517 50 79 14.3b Eastwind 517 71 89 25.4b Eastwind 517 100c ~ 100 ~ 33 USAir 427 0 100 31.7 a. Full PCU output capability is 5,800 pounds. b. Rudder motion was in the opposite direction from that commanded. c. The 100-percent secondary slide jam position was not tested for either PCU because of test equipment limitations. Force and rate values for both 100-percent positions are estimated by Boeing. 57 Representatives of the interested parties who were members of the Human Performance Group for the flight 427 investigation were notified of the demonstration but declined to participate. However, party members of the Systems Group for the flight 427 investigation and a representative from the expert technical panel were present during the testing and participated informally in the tests. PCU Position (percent off neutral) Force (percent of full PCU output capability)a Rate (degrees per second)

Factual Information 84 Aircraft Accident Report manipulated the rudder pedals under the three simulated rudder jam conditions. One Safety Board participant described the demonstration as follows: All demonstrations were conducted in the cockpit, with Boeing test pilot…sitting in one of the pilot seats to coordinate the procedure…When I was the active participant, I sat in the right seat wearing the seat belt. The first demonstration in the test airplane represented a jam of the secondary slide about 25 percent off [its] neutral position. I pushed the respective rudder pedals slowly to their full down positions as though I were performing a slow rudder system check. The right rudder pedal seemed easier to push down than the left pedal, although the difference seemed subtle. I then performed about 7 tests in which I [applied] hard left rudder. With one or two exceptions, this input triggered a rudder reversal on the pedals. Immediately after my input, the left rudder pedal began moving outwards until it reached the upper stop. The motion was slightly slower than an input I would expect from a human. The motion was steady and continued without pause no matter how hard I pushed to counter it (“unrelenting” was a description that, at the time, seemed to capture my impression)…. [When] I…“stopped fighting” the motion, [the] action of the rudder system ended almost immediately and the rudder pedals returned to the neutral position. On subsequent trials, I “stopped fighting” the rudder motion earlier, before the left pedal had reached the upper stop. Again, the rudder motion stopped almost immediately as soon as I stopped applying pressure, no matter where the pedal was located, and the pedals returned to neutral. The second demonstration represented a jam of the secondary slide about 0 percent off [its] neutral position. I pushed each respective rudder pedal slowly to the lower stop as though performing a rudder system check. The right pedal again seemed easier to push than the left pedal, although the difference was small. I also pushed the rudder pedals aggressively and abruptly, but this did not produce a rudder reversal situation. The third demonstration represented a jam of the secondary slide about 50 percent off [its] neutral position. I performed about 9 trials. When I moved the pedals slowly and steadily [as though performing a rudder system check], I was generally able to move the pedals to their stops without starting a reversal. Sometimes, however, even a slow input initiated a rudder reversal situation (this time with the right pedal moving to the upper stop). Any abrupt motion on the pedals initiated an immediate rudder reversal situation. The rudder reversal motion was faster than was the case with a jam in [the] 25 percent position, perhaps similar to a relaxed or slow input speed by a human operator. Again, it was impossible to stop the motion by physically pushing against the rudder pedal. On several trials, I tried relaxing my input momentarily before the rudder pedal reached the upper stop. I found that the rudder reversal motion continued. This [was not true in the jam at the approximate 25 percent position], when the relaxation of pressure seemed to automatically stop the reversal motion. This motion was faster, easier to initiate, and more difficult to stop.

Factual Information 85 Aircraft Accident Report Other participants reported similar experiences during the demonstrations. They described the rudder back pressure during the reversal as “machine-like,” “startling,” and “relentless.” Another Safety Board employee who participated in the demonstrations stated that he switched the hydraulic system B flight control switch to “standby rudder” during the simulation of a secondary slide jam near the 50-percent position, which eliminated the rudder reversal and allowed the rudder to be centered by rudder pedal inputs in the normal direction. He reported that the centering was slow and required more rudder pedal pressure than in the absence of a jam but that there was no need to release the rudder pedal pressure and reapply it to eliminate the reversal. During subsequent rudder sweeps with the standby rudder system engaged, the rudder did not reverse. This Board employee (who is 5 feet 8 inches tall) further stated that he was able to reach the hydraulic system A and B flight control switches in the overhead panel without difficulty from either the left or right pilot seats. 1.16.6 Flight Performance Simulation Studies Conducted During the USAir Flight 427 Investigation (1994-1999) During the investigation of the USAir flight 427 accident (and the Eastwind flight 517 incident), Boeing applied a “kinematics analysis,” that is, a technique developed from prior flight test activities to derive from available FDR data the position of the flight control surfaces that were not among the parameters recorded by the FDR.58 (Use of the kinematics process was not possible for the United flight 585 event because of the limited number of FDR parameters.) The Safety Board reviewed Boeing’s kinematics process early in the investigation and then developed its own kinematics programs that ran on the Board’s computer workstation. The Safety Board developed the programs to validate the kinematics solutions being developed by Boeing for the USAir flight 427 investigation and now has the technique available for use in future aviation investigations. The Safety Board’s kinematic results for the USAir flight 427 accident were compared with Boeing’s kinematic results for the same inputs. Because the review of the kinematic results indicated that more frequent heading samples were needed to effectively perform the kinematic calculations, the Safety Board and Boeing used interpolation techniques to curve fit the FDR’s magnetic heading data and thereby provide data between the FDR data points. (The accident airplane’s FDR recorded magnetic heading data at a once-per-second rate.) The FDR’s once-per-second magnetic heading data could be matched by different interpolation techniques, each resulting in different rudder surface 58 Boeing’s kinematics process involves fitting curves through available FDR data (such as heading, pitch, and roll), obtaining time histories of rates from these curves, and obtaining accelerations from these rates. Forces, moments, and aerodynamic coefficients are then obtained from these accelerations using Newton’s laws of physics. Boeing uses its aerodynamic models to derive flight control time histories from the aerodynamic coefficients.

Factual Information 86 Aircraft Accident Report time histories. Further, kinematics techniques magnified the noise59 that was inherent in the accident airplane’s FDR data, so smoothing techniques were needed to reduce this noise and minimize the potential for erratic signatures in the extracted control surface time histories. Safety Board investigators used the Board’s workstation-based flight simulation computer program60 for the 737-200 and -300 to perform simulations of the flights of USAir flight 427, United flight 585, and Eastwind flight 517.61 The flight simulation process was used by the Safety Board, rather than the kinematics process, because it eliminated the uncertainties introduced into the kinematics process through the data interpolation and smoothing techniques (required because of the limited number of FDR parameters recorded and the limited sampling of the data). The Safety Board initially used assumed flight control (control wheel [aileron and spoilers], rudder, and control column [elevator]) positions (based on earlier Boeing and Safety Board kinematic solutions and FDR-recorded column position when available) as inputs into its computer simulations and then compared the output of the simulations—such as altitude, airspeed, and heading—with the available FDR data. Safety Board investigators then modified the control input, reran the simulations, and continued this process (known as iteration) until a good match with the FDR data was obtained.62 Various factors affect the extent to which the derived control surface positions reflect the actual control surface positions. For example, the accuracy of the simulations is affected by the fidelity of the aerodynamic modeling of the airplane in the flight conditions at the time of the upsets. The aerodynamic models used in the simulations are validated by flight tests, but this validation process is limited by safety factors, such as the structural load limits for which flight tests can be safely conducted, and the number of flight tests to be conducted. In addition, the computer simulations generally assume calm air conditions. The United flight 585 airplane most likely encountered significant winds and turbulence; thus, the computer simulations were adjusted to account for such winds. However, because the actual turbulence conditions were not known, the respective contributions of the flight control surfaces and winds to the motion of the airplane are uncertain. For example, if a large rolling moment resulting from a wind gust was quickly countered by the flight crew 59 According to page 60 of Boeing’s “Submission to the National Transportation Safety Board for the USAir 427 Investigation,” dated September 30, 1997, “when the heading data is sampled at less than twice a second, the rudder position derived using kinematics becomes contaminated with an overlying ‘noise’ signal that shows up as an oscillation in derived rudder…. Proper interpolation can reduce the ‘noise’ providing more reliable information on rudder movement.” 60 The Safety Board’s flight simulation computer program is a Windows™-based executive program that uses Boeing-developed flight control, aerodynamics, and engine models to derive force and moment time histories of the airplane. Safety Board-developed equations of motion convert these forces and moments into airplane motion. 61 The Safety Board’s workstation-based flight simulations used computer software that describes the physics of the motion of an airplane in flight and various computer subroutines, including those that use data and equations from Boeing, to describe the 737 aerodynamic characteristics and engine thrust. 62 Boeing also performed similar flight simulations on its own computer workstation.

Factual Information 87 Aircraft Accident Report through a large control wheel movement, the resulting roll recorded by the FDR would be relatively small. If the wind gust effect introduced into the simulation was less than the actual wind gust experienced by the flight crew, the control wheel movements derived through the simulations would be less than the movements that actually occurred. Other factors affecting the accuracy of the simulation studies include instrumentation calibration errors and time lags in data recording. In addition, the directional gyroscopes that provided heading information to the FDR in the United flight 585 airplane could have introduced errors in the recording of the heading data when the airplanes were operating in certain flight attitudes. The Safety Board accounted for part of the potential heading gyro gimbal errors by using a computer program especially developed for that purpose.63 Because a pilot exerting considerable force on the rudder pedals could alter the rudder blowdown limit that would result from the hydraulic actuator alone,64 the simulations also had to account for the estimated pilot rudder pedal force time history. This estimation was accomplished for the United flight 585 accident based on the physical characteristics of the flying pilot, available human performance research data, and CVR information. (See section 1.18.3 for further information.) All parties to the USAir flight 427 investigation had the opportunity to submit proposed accident scenarios. However, only Boeing submitted detailed simulations or studies. The Safety Board notes that Boeing may be one of the few entities in the world with the technological ability and knowledge of the 737 airplane to conduct the complex and sophisticated simulations that were used during this investigation to evaluate potential accident scenarios. Accordingly, the Safety Board assumed that the alternative scenarios provided by Boeing were the best alternatives that could be developed. The Safety Board therefore gave serious consideration to the scenarios submitted by Boeing for the USAir flight 427, United flight 585, and Eastwind flight 517 upset events. The results of the Safety Board’s best-match solution65 from the simulation studies for United flight 585 are discussed in section 1.16.6.1. 1.16.6.1 United Flight 585 Simulation Studies United flight 585 was flying in turbulent air while making a right turn to the final approach to Colorado Springs Municipal Airport. Strong winds aloft created complex airflow patterns that moved from west to east across the mountains located west of the airplane’s flightpath; these airflow patterns likely included strong turbulence, eddies, 63 A heading gyro consists of a rotating gyro mounted inside two gimbals, and heading data is subject to gyro gimbal error. Heading is determined by the angle of the outer gimbal to the airplane body. Combinations of pitch, roll, and gyro rotor alignment introduce angle errors into the outer gimbal and produce predictable heading errors that can be quantified and corrected. 64 During normal rudder operation, a considerable pilot force on the rudder pedals can result in the rudder moving beyond its blowdown limit based on hydraulic actuator force alone. However, in a rudder reversal situation, a considerable pilot force on the rudder pedals can reduce the blowdown limit. 65 The Safety Board’s best-match solution is the derived flight control surface position time histories that best match the recorded FDR data, radar data, and human performance information.

Factual Information 88 Aircraft Accident Report rotational flow fields, and crosswind shear. The FDR data showed that, as the airplane was descending through an altitude of about 1,000 feet agl and was about on track to approach the airport from the south (about 0943:32), its heading changed to the right. The airplane impacted the ground about 9 seconds later. The airplane’s orientation and flightpath angle at impact were near vertical. The airplane was aligned approximately 205° magnetic heading, and the ground track (as defined by the debris field) was about 020° magnetic heading.66 The Safety Board’s workstation-based simulator for a 737-200 airplane was used to simulate the event. The simulation process used available FDR data, radar data, and information on the accident location and airplane orientation at impact. Input to the simulation for engine thrust was based on engine sounds recorded on the CVR. The flight control surface position time histories needed for the simulation were not among the parameters recorded by the FDR and thus had to be estimated or derived. The control wheel (aileron and spoilers), rudder surface, and elevator position time histories used in each simulation were derived by iteration. The simulations assumed that the airplane encountered turbulence with a crosswind gust (perhaps associated with a mountain rotor).67 In the Safety Board’s best-match simulation that involved a rudder movement for this event, these winds produced a heading change and yaw rate to which the pilot was assumed to have responded (about 0943:32) with left rudder pedal input.68 This scenario further assumed that this input occurred while the main rudder PCU servo valve secondary slide was jammed to the servo valve housing, resulting in a rudder reversal to the right. The general wind field was derived by comparing the ground track from the radar data with the airspeed and heading data from the FDR. An approximation of a vertical gust profile was developed from the vertical load factor data. Crosswind gust components were also used in this best-match simulation. In this simulation, at 0943:21, when the airplane was nearly aligned with the landing runway, the airplane began to experience a significant heading change to the right. The simulation indicated that a right bank angle of about 30° was required to produce this heading change. The Safety Board determined that the heading change and the rolling moment that occurred after 0943:21 were likely the result of turbulence, and these data became the baseline for the turbulence models used in some of the Board’s simulations. 66 The heading and ground track were about 180° opposed because of the near-vertical flightpath angle. 67 The Safety Board considered several rotor scenarios in its studies, including moving rotors above, below, and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s flightpath; and horizontal rotors that transitioned to vertical rotors along the airplane’s flightpath. 68 The complete data sets for this and other scenarios can be found in the Safety Board’s “United Flight 585 Simulation Study,” dated October 19, 1998, and the Board’s “Addendum to Simulation Study,” dated February 23, 1999.

Factual Information 89 Aircraft Accident Report Rudder position time histories were developed for jams of the secondary slide to the servo valve housing at 100, 71, 50, 40, and 30 percent from the neutral position.69 The rudder position, once reversed, was assumed to remain at the blowdown limit70 corresponding to a servo valve jam at the 100-percent position (blowdown limit is partly dependent on jam position, airspeed, and sideslip angle) for the duration of the reversal. The timing of the rudder inputs was modified by iteration until the simulation produced heading time histories consistent with the FDR data. The heading data that resulted from the simulation with the secondary slide jammed to the housing at 100 percent produced the Safety Board’s best-match with the FDR heading data.71 The pilot rudder pedal force, rudder surface, and control wheel time histories for the 100-percent jam are presented in figures 16 through 16b, respectively.72 The resultant heading, normal load factor, pitch angle, and bank angle data for the Safety Board’s 100-percent jam solution compared with the FDR data are presented in figures 16c through 16f, respectively. Roll and yaw rate, two parameters pertinent to human performance, are presented in figures 16g and 16h, respectively, for the 100-percent rudder secondary jam case. CVR data are presented on figures 16e, 16f, and 16h to correlate verbal responses of the pilots to simulated pitch angle, bank angle, and yaw rate, respectively. Wind direction and horizontal and vertical wind speeds used in the Safety Board’s best-match are presented in figures 16i through 16k. 69 The 100-percent jam scenario does not include the rotational eddy from the turbulence model; the 30-percent jam (which is not presented in this report) does include the eddy. 70 Because of fire damage to the United flight 585 PCU, the Safety Board was unable to perform laboratory tests to determine the rudder deflection rate and the hinge moment capability of the PCU with the secondary slide jammed at various positions from neutral. Therefore, data from the USAir flight 427 PCU servo valve tests in which the secondary slide was jammed at 71, 50, and 22 percent from neutral were used. Data from the Eastwind flight 517 PCU servo valve tests were not used because that servo valve had a leaky bypass valve. 71 Because of the reduced hydraulic pressure ported to the actuator in the overtravel situation, this 100-percent jam would result in the rudder moving at a reduced rate of about 32° per second to the reduced blowdown limit. 72 The Safety Board’s best-match simulation used 300 pounds of force reducing to 200 pounds, based on ergonomic and other research data (see section 1.18.3). The Safety Board was also able to match the United flight 585 FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds).

Factual Information 90 Aircraft Accident Report Figure 16. Pilot rudder pedal force positions for United flight 585. Figure 16a. Rudder surface positions for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -500 -450 -400 -350 -300 -250 -200 -150 -100 -50 0 50 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Input Left Right Pedal Force (lbs) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -30 -25 -20 -15 -10 -5 0 5 10 15 20 25 30 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Input Nose Left Nose Right Equivalent Rudder (deg) Time (hr:min:sec)

Factual Information 91 Aircraft Accident Report Figure 16b. Control wheel positions for United flight 585. Figure 16c. Heading data for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -100 -80 -60 -40 -20 0 20 40 60 80 100 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Input Left Right Equivalent Wheel (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 300 310 320 330 340 350 360 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response FDR points Simulation Heading (deg) Time (hr:min:sec)

Factual Information 92 Aircraft Accident Report Figure 16d. Normal load factor data for United flight 585. Figure 16e. Pitch angle data for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response FDR data Simulation Normal Load Factor (G's) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -90 -80 -70 -60 -50 -40 -30 -20 -10 0 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Pitch Angle (deg) Time (hr:min:sec)

Factual Information 93 Aircraft Accident Report Figure 16f. Bank angle data for United flight 585. Figure 16g. Roll rate for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -180 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 180 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Left Right Bank Angle (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -10 0 10 20 30 40 50 60 UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Body Axis Roll Rate - pb (deg/sec) Time (hr:min:sec)

Factual Information 94 Aircraft Accident Report Figure 16h. Yaw rate for United flight 585. Figure 16i. Wind direction for United flight 585. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -15 -10 -5 0 5 10 15 20 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study 100% Secondary Slide Jam Simulation Response Body Axis Yaw Rate - rb (deg/sec) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 220 230 240 250 260 270 280 290 300 310 320 UAL 585 Simulator Study 100% Secondary Slide Jam Wind Direction (deg) Time (hr:min:sec)

Factual Information 95 Aircraft Accident Report Figure 16j. Horizontal windspeeds for United flight 585. Figure 16k. Vertical windspeeds for United flight 585. One of the Safety Board simulation scenarios that produced a good match with the FDR data and other physical evidence assumed a sustained equivalent control wheel input 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0 10 20 30 40 50 60 70 UAL 585 Simulator Study 100% Secondary Slide Jam Wind Speed (kts) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -15 -10 -5 0 5 10 15 20 UAL 585 Simulator Study 100% Secondary Slide Jam Vertical Wind Speed (kts - positive down) Time (hr:min:sec)

Factual Information 96 Aircraft Accident Report to the right with no rudder input. The equivalent control wheel input could represent a pilot command, a rotational wind, or a combination of the two. Figures 17 through 17f show the resultant data for rudder surface and control wheel postions and heading, normal load factor, calibrated airspeed, pitch angle, and bank angle data, respectively. Figures 17e and 17f also show CVR data. Figure 17. Rudder surface positions for United flight 585 assuming a sustained equivalent control wheel input. Figure 17a. Control wheel surface positions for United flight 585 assuming a sustained equivalent control wheel input. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -25 -20 -15 -10 -5 0 5 10 15 20 25 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Input Nose Left Nose Right Equivalent Rudder (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -100 -80 -60 -40 -20 0 20 40 60 80 100 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Input Left Right Equivalent Wheel (deg) Time (hr:min:sec)

Factual Information 97 Aircraft Accident Report Figure 17b. Heading data for United flight 585 assuming a sustained equivalent control wheel input. Figure 17c. Normal load factor for United flight 585 assuming a sustained equivalent control wheel input. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -20 -15 -10 -5 0 5 10 15 20 UAL 585 Simulator Study 100% Secondary Slide Jam Vertical Wind Speed (kts - positive down) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response FDR data Simulation Normal Load Factor (G's) Time (hr:min:sec)

Factual Information 98 Aircraft Accident Report Figure 17d. Calibrated airspeed for United flight 585 assuming a sustained equivalent control wheel input. Figure 17e. Pitch angle data for United flight 585 assuming a sustained equivalent control wheel input. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 140 160 180 200 220 240 UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response FDR data Simulation Vcas (Kts) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -90 -80 -70 -60 -50 -40 -30 -20 -10 0 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response Pitch Angle (deg) Time (hr:min:sec)

Factual Information 99 Aircraft Accident Report Figure 17f. Bank angle data for United flight 585 assuming a sustained equivalent control wheel input. In a June 23, 1997, letter to the Safety Board, Boeing provided its analysis of the United flight 585 accident.73 Boeing’s analysis concluded that a rudder hardover scenario did not fit the FDR data and that a “new rotor model” did match the data.74 Further, Boeing derived this new rotor model to match the available data and introduced a rotational effect of near zero just before 0943:28, which increased linearly to about 0.4 radians per second just before 0943:29 and then increased linearly to about 1.8 radians per second about the time the airplane impacted the ground (just before 0943:42). Boeing’s simulation using the new rotor model produced the data shown in figures 18 through 18f for rudder surface positions, windshear, control wheel positions, heading, bank angle, normal load factor, and pitch angle, respectively. As shown in figure 18b, Boeing’s simulation assumed a left control wheel input by the flight crew just after 0943:30. 73 Boeing’s analysis was resubmitted to the Safety Board in a September 14, 1998, letter. 74 According to Boeing, “the new rotor model is significantly different from that evaluated during the original [United flight] 585 investigation. The original [rotor] model was a solid rotating core of air with a distinct boundary. This meant that the air at the outside edge of the core was at a very high velocity for large cores with high rotational velocity. [Boeing’s new rotor] model is not a solid rotating body, but has a velocity profile which varies significantly as the distance from the center core increases. The model was developed based on a simulation of the weather conditions that existed in the Colorado Springs area on the day of the accident.” 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 CAM_2-wow CAM-2_We're_at_a_thousan CAM-2_OhGod(flip) CAM-1_fifteen_flaps CAM1- Oh(exclaimed loudl Sound_of_impact UAL 585 Simulator Study Equivalent Wheel Solution Simulation Response Left Right Bank Angle (deg) Time (hr:min:sec)

Factual Information 100 Aircraft Accident Report Figure 18. United flight 585 rudder surface positions according to Boeing’s new rotor model. Figure 18a. Rotational windshear encountered by United flight 585 according to Boeing’s new rotor model. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -25 -20 -15 -10 -5 0 5 10 15 20 25 Boeing Simulation Match UAL585 Rudder (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 Boeing Simulation UAL585 P Shear (rad/sec) Time (hr:min:sec)

Factual Information 101 Aircraft Accident Report Figure 18b. United flight 585 control wheel positions according to Boeing’s new rotor model. Figure 18c. United flight 585 heading data according to Boeing’s new rotor model. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 Boeing Simulation Match UAL585 Wheel (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 300 310 320 330 340 350 360 Boeing Simulation Match UAL585 Simulation FDR Points Heading (deg mag) Time (hr:min:sec)

Factual Information 102 Aircraft Accident Report Figure 18d. United flight 585 bank angle data according to Boeing’s new rotor model. Figure 18e. United flight 585 normal load factor data according to Boeing’s new rotor model. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -180 -160 -140 -120 -100 -80 -60 -40 -20 0 20 40 60 80 100 120 140 160 180 Boeing Simulation Match UAL585 Bank Angle (deg) Time (hr:min:sec) 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 Boeing Simulation Match UAL585 Simulation FDR Data Normal Load Factor (G's) Time (hr:min:sec)

Factual Information 103 Aircraft Accident Report Figure 18f. United flight 585 pitch angle according to Boeing’s new rotor model. 1.17 Organizational and Management Information 1.17.1 United Airlines At the time of the accident, United Airlines employed approximately 75,105 people, including 7,251 pilots, and operated a fleet of 465 airplanes, including 74 Boeing 737-200 airplanes. United maintained major hub operations in Chicago, Illinois; Denver, Colorado; and San Francisco, California. 1.17.1.1 United Airlines Office of Flight Safety United personnel indicated that, at the time of the accident, the airline’s Office of Flight Safety directed the development and implementation of the company’s philosophies, policies, plans, goals, procedures, and standards regarding flight and cabin safety and airplane security. Additionally, personnel from United’s Office of Flight Safety represented the airline to outside agencies and industry associations in safety-related matters, including accident and incident investigations. At the time of the accident, the Director of the Office of Flight Safety reported directly to the Senior Vice President of Flight Operations. 09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00 -90 -80 -70 -60 -50 -40 -30 -20 -10 0 Boeing Simulation Match UAL585 Pitch Angle (deg) Time (hr:min:sec)

Factual Information 104 Aircraft Accident Report 1.17.1.2 United Airlines Windshear and Irregular Procedures According to United personnel, the company advised its 737 flight crews to avoid areas of known windshear75 whenever possible. Pilots were trained to enter a holding pattern until conditions improved if windshear was indicated during an approach; pilots were instructed to initiate a go-around if windshear was encountered unexpectedly during an approach. According to United flight training personnel, flight crews received training on windshear procedures during initial, transition, and annual recurrent training. Further, these personnel indicated that United’s pilots frequently received handouts and videotapes containing additional information regarding windshear. The irregular procedures section of the United 737-200 Flight Handbook that was in effect at the time of the flight 585 accident (revision 12, dated February 13, 1991) contained guidance for irregular flight control and hydraulic system conditions, including asymmetrical or no trailing edge flaps, asymmetrical or no leading edge devices, jammed or runaway stabilizer, loss of hydraulic system A or B quantity or pressure, and jammed flight controls. According to United personnel, irregular procedures are referenced actions accomplished when necessary by the flight crew with the use of a checklist. The guidance for jammed flight controls contained in the handbook was specified for use when a flight crew experienced jammed or restricted movement of roll, pitch, or yaw flight controls. The handbook indicated that the pilots should overpower the jammed system, using maximum force (including the combined force of both pilots) if necessary. The handbook also indicated that the flight crew should use the operative flight controls, trim, and engine thrust, as needed, for airplane control if the faulty system could not be overpowered. 1.18 Additional Information For additional information about the history of Boeing 737 potential rudder system and/or PCU-related anomalies/events, the independent technical advisory panel (created to review the work of the Systems Group during the USAir flight 427 accident investigation), 737 certification requirements and information, the FAA’s critical design review team (created to review the 737 flight control systems), 737 rudder system design improvements, human performance considerations, wake turbulence/upset event information, unusual attitude information and training, procedural information available to 737 flight crews, and the history of safety recommendations resulting from the United 585 and USAir flight 427 accidents and the Eastwind flight 517 incident, see the Safety Board’s final report on the USAir flight 427 accident. For information on a study of pilots’ speech, breathing, and other CVR-recorded sounds; a comparison of engine sound signatures form the United flight 585 CVR and a CVR from 737-200 flight tests; ergonomics; and the conclusions adopted in the USAir flight 427 report, see sections 1.18.1 through 1.18.4, respectively, of this revised report. 75 United’s 737-200 Flight Manual defines windshear as any rapid change in wind direction or velocity.

Factual Information 105 Aircraft Accident Report 1.18.1 Study of Pilots’ (USAir Flight 427 and United Flight 585) Speech, Breathing, and Other CVR-recorded Sounds As part of its investigation of the USAir flight 427 accident, the Safety Board examined the USAir flight 427 and United flight 585 pilots’ speech (voice fundamental frequency, or pitch; amplitude, or loudness; speaking rate; and content) and breathing (inhaling, exhaling, and grunting) patterns recorded by the CVRs during the routine portions of the flights, the initial upsets, and the uncontrolled descents. Investigators extracted several acoustical measures of speech (fundamental frequency, amplitude, and speaking rate) from pilot statements on the CVR recording to understand the actions and emotional states of the pilots during the accident sequence.76 According to scientific literature,77 fundamental frequency, amplitude, and speaking rate tend to increase in response to increased psychological stress. The Safety Board’s review of the USAir flight 427 captain’s speech during the accident flight, as recorded by the CVR, indicated that his speech fundamental frequency and amplitude increased as the emergency situation developed. Review of the first officer’s speech during the accident flight revealed that he did not speak enough during the emergency period to provide a basis for meaningful analysis. The Safety Board conducted a similar laboratory speech analysis examination of the speech and other sounds recorded by the United flight 585 CVR. The only measurable data obtained during this examination was for speech fundamental frequency.78 The captain’s speech fundamental frequency when he spoke the word “flaps” during routine and emergency radio transmissions provided a basis for direct comparison. When the captain said “flaps” during routine flight operations, his speech exhibited an average fundamental frequency of 131 Hz. However, when the captain stated “flaps” at 0943:33.5 during the upset event, the fundamental frequency of his speech had increased 77 percent, to 233 Hz. The laboratory results and CVR tape and transcript were provided to three independent specialists from the Interstate Aviation Committee, Moscow, Russia;79 the U.S. Naval Aerospace Medical Research Laboratory, Pensacola, Florida;80 and NASA’s 76 See “Speech Examination Factual Report, May 5, 1997” from the USAir flight 427 investigation for details on the extraction procedures, which employed computer analysis. 77 See Ruiz, R., Legros, C., and Guell, A. 1990. “Voice analysis to predict the psychological or physical state of a speaker.” Aviation, Space, and Environmental Medicine, 61, 266-71. Also, see Brenner, M., Doherty, E.T., and Shipp, T. 1994. “Speech measures indicating workload demand.” Aviation, Space, and Environmental Medicine, 65, 21-6. 78 Amplitude could not be measured because of the automatic gain control feature on the microphone. Speech rate could not be measured because of the limited amount of speaking by either crewmember during the emergency period. 79 This specialist is the Chief of the Acoustical Laboratory at the Interstate Aviation Committee. He has a medical degree and graduate level training in psychology. He has participated in more than 250 aviation accident investigations and specializes in medical and psychological aspects, especially the psychological analysis of speech.

Factual Information 106 Aircraft Accident Report Ames Research Center, Moffett Field, California.81 Their areas of specialization were general speech analysis (focusing on issues of psychological stress and physical effort), breathing physiology, and communication information, respectively. The specialist from Moscow’s Interstate Aviation Committee observed that both USAir flight 427 pilots showed symptoms of psychological stress (increased amplitude and fundamental frequency of speech, increased frequency of breathing, and reduced information within a statement) beginning almost immediately after the initial upset and that these symptoms increased throughout the accident sequence. However, the specialist believed that the increased psychological stress did not necessarily interfere with the pilots’ ability to respond to the emergency situation. The specialist’s report stated that stress can be viewed as having the following three increasing stages,82 which reflect typical changes in performance: Psychological stress, at low levels, can improve a person’s performance by providing a constructive mobilization of attention and resources (first stage). As the person’s stress increases, the performance often displays hasty or premature actions [such as the omission of words or checklist items]. However, they can still accomplish their task (second stage). It is only at the highest levels of stress (third stage, or “panic”), that the person cannot think or perform clearly. The Safety Board applied the specialist’s guidelines and criteria to the speech and other sounds recorded by the United flight 585 CVR. When the captain spoke the word “flaps” during the accident sequence (at 0943:33.5), his speech fundamental frequency was 77 percent higher than when he spoke the same word during routine flight operations. In addition, the captain’s statement “fifteen flaps” (at 0943:33.5) signified a go-around decision but occurred without the captain first stating “go-around thrust,” as specified in the procedures section of the company flight manual at the time of the accident. According to the specialist’s guidelines, the captain’s responses (high fundamental frequency value and omission of a standard procedure item while communicating and responding appropriately to the situation) indicated that he was likely operating at the second stage of stress at 0943:33.5. He had not reached a panic but was displaying characteristics of a high level of stress within about 1½ seconds of the onset of the emergency period. The Safety Board’s examination of the remaining 8 seconds of CVR 80 This specialist is a Research Physiologist in the Aviation and Operational Medicine Department of the U.S. Naval Aerospace Medical Research Laboratory. He has a doctorate degree in exercise physiology, and his research includes work on the effects of physical fitness on normal load factor tolerance and the development of anthropometric standards for naval aviators. 81 This specialist is a Research Psychologist at the NASA Ames Research Center. She has a doctorate degree in behavioral sciences, and her research addresses aerospace human factors, focusing on crew communication, coordination, and performance issues. 82 As a guideline, the specialist from the Interstate Aviation Committee indicated that stage 1 speech is characterized by an intra-individual increase in fundamental frequency of about 30 percent compared with that individual’s speech in a relaxed condition, stage 2 speech is characterized by an increase in fundamental frequency of 50 to 150 percent, and stage 3 speech is characterized by an increase of 100 to 200 percent. These guidelines are advisory and considered with other speech factors in characterizing the speaker’s level of stress.

Factual Information 107 Aircraft Accident Report information indicated that the pilots likely reached the third stage of stress—panic— before the airplane crashed. 1.18.2 Comparison of Engine Sound Signatures From the United Flight 585 CVR and a CVR From 737-200 Flight Tests Because of the Safety Board’s findings during the USAir flight 427 investigation that certain sideslip and yaw maneuvers in a 737-300 could result in changes in engine sound signatures, investigators attempted to determine whether such maneuvers in a 737-200 would result in similar changes in engine sound signatures and, if so, whether any such changes could be discerned on the United flight 585 CVR. According to Boeing, the overall geometry and proportions of the 737-200 and -300 series fuselages are very similar; however, the airplanes are equipped with significantly different engines. The 737-200’s engines are equipped with inlet vanes or diffusers that intentionally make the inlet airflow turbulent.83 Therefore, investigators recognized the possibility that maneuvers causing the inlet airflow to be slightly more turbulent might not produce significant change in the engine’s noise-producing characteristics. On June 3, 1996, the Safety Board conducted an engine perturbation flight test using a United Airlines 737-200 at the United Airlines Maintenance Operations facility in Indianapolis, Indiana. The flight test consisted of sideslip and yaw conditions similar to those present during 737-300 flight control characteristics testing in September 1995 (as part of the USAir flight 427 investigation). The CVR recordings of the 737-200 flight test revealed engine sound signature changes similar to those heard in the 737-300 flight test CVR recordings for the same conditions. The CVR recording from United flight 585 was compared with the CVR recording from the 737-200 flight test. However, analysis of the engine sounds on the United flight 585 CVR was hampered by two factors: the recording was of poor quality with obscuring background noise, and the pilots of United flight 585 were changing the engine power settings—and therefore varying the revolutions per minute frequency—almost constantly during the approach to land. Investigators attempted to compensate for these factors when possible and then extracted and plotted the resulting engine sounds. Further, investigators plotted the FDR data (heading, altitude, vertical Gs, and indicated airspeed) along with the CVR data. No changes in engine sound volume were detected on the United flight 585 CVR. 83 According to the engine manufacturer, the engines installed on the 737-200 series airplane were designed when controlling/reducing inlet noise was not a critical issue for manufacturers. Because of the differences in engine inlet design, the engines installed on the 737-200 series airplanes produced more noise than the engines installed on the 737-300 series airplanes.

Factual Information 108 Aircraft Accident Report 1.18.3 Ergonomics—Study of Maximum Pilot Rudder Pedal Force As previously discussed, one of the variables in the Safety Board’s computer simulations was pilot rudder pedal force. Because pilot rudder pedal force was not recorded by the FDRs in the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes, the Safety Board conducted a study during its investigation of the USAir flight 427 accident to estimate, using ergonomic research and other data, the rudder pedal forces that the pilots might have applied during the upset events. A researcher at the U.S. Air Force’s (USAF) Armstrong Laboratory studied strength capability for operating aircraft controls in a study often used as a standard for aircraft design.84 The data reported in this study represent the maximum isometric strength demonstrated by USAF subjects operating the aircraft controls of a laboratory simulator. Subjects were healthy volunteers, either from the AFF or Officer’s Training School (OTS), who were instructed to push forward on the rudder pedal with as much force as they could exert and hold that force for 5 seconds. Among 199 of the subjects (male AFF students between 19 and 25 years old), median strength output of the left leg against the left rudder pedal was 624 pounds, and median strength output of the right leg against the right rudder pedal was 623 pounds. Among 249 other subjects (male OTS students between 21 and 34 years old), median strength output of the right and left legs was 510 pounds each. These results were some of the highest leg force outputs obtained in a laboratory setting and cited in the available ergonomic literature,85 even when the results were compared with other studies using USAF subjects.86 The results from the USAF study involving OTS subjects were considered to be more representative of the airline pilot population for two reasons: the OTS subjects (although physically fit) were not subject to the rigorous physical selection and exercise requirements that were applied to the AFF students, and the OTS students, on average, were older than the AFF subjects. Therefore, the Safety Board used the results of the USAF studies involving OTS subjects as a baseline for its ergonomic study; an output of 510 pounds, sustained for a short period of time, was deemed a reasonable estimate for the maximum leg force output of an airline transport pilot. In evaluating the leg force that could have been applied during the three upset events, the Safety Board also considered the effect that seat position and knee angle would have on that force. Ergonomic studies indicate that an individual’s maximum potential leg thrust varies dramatically with knee angle, with an optimal knee angle range of between 84 McDaniel, J.W. 1995. “Strength capability for operating aircraft controls.” SAFE Journal, 25, pp. 28-34. 85 Weimer, J. 1993. Handbook of Ergonomic and Human Factors Tables. Englewood Cliffs, New Jersey: Prentice Hall, pp. 90- 91. 86 Hertzberg, H.T.E., and Burke, F E. 1971. “Foot forces exerted at various aircraft brake-pedal angles.” Human Factors, 13, pp. 445-56.

Factual Information 109 Aircraft Accident Report 140 and 160° (180° corresponds to a straight leg).87 (The knee angles of the subjects in the USAF studies were between 130 and 140° for a neutral pedal position, which provided for adequate leg extension to obtain a full rudder input with the most effective knee angles.) The Safety Board also considered the effect that age might have on a pilot’s ability to exert leg forces approaching those demonstrated in the USAF studies. Research indicates a loss of strength in leg extension forces among subjects older than those in the USAF studies (about a 6-percent reduction in strength per decade in individuals older than 30 years old).88 However, studies also indicate that general muscle loss can be prevented or reversed as a result of regular exercise.89 Further, the Safety Board researched the correlation between physical size (such as height) and leg strength and found that the correlation between the two was low. In other words, the research showed that a shorter person may be extremely strong, whereas a taller person may be comparatively weak. The Safety Board recognizes that a pilot’s leg force output in a real cockpit emergency (such as those that occurred on USAir flight 427, United flight 585, and Eastwind flight 517) may also depend on the motivation and perception of the pilots about their situation. Thus, laboratory results may not necessarily replicate actual flight situations. Therefore, in estimating the maximum rudder pedal force applied by the flying pilots in the USAir flight 427 and the United flight 585 accidents and the Eastwind flight 517 incident, the Safety Board used available ergonomic and other data, including the leg strength results from the USAF OTS subject study, the pilot’s knee angle, age, physical fitness, physical size, motivation, and perception of the situation. 1.18.3.1 United Flight 585 The captain of United flight 585 was 5 feet 7 inches tall, which permitted him to make seat adjustments that could have obtained an optimum knee angle for exerting force on the rudder pedals. The captain was assumed to have selected a seat and rudder pedal adjustment that resulted in the optimal (130 to 140°) knee angle with the rudder pedals in the neutral position and allowed for leg extension to command full rudder. (The CVR 87 Woodson, W.E., Tillman, B., and Tillman, P. 1993. Human Factors Design Handbook. New York: McGraw Hill. Kroemer, K.H.E., Kroemer, H.B., and Kroemer-Elbert, K.E. 1994. Ergonomics: how to design for ease and efficiency. Englewood Cliffs, New Jersey: Prentice Hall, p. 379. 88 Hortob’agyi, T.; Zheng, D.; Weidner, M.; Lambert, N.J.; Westbrook, S.; and Houmard, J.A. 1995. “The influence of aging on muscle strength and muscle fiber characteristics with special reference to eccentric strength.” Journal of Gerontology: Biological Sciences, 50, B399-406. Bemben, M.G.; Massey, B.H.; Bemben, D.A.; Misner, J.E.; and Boileau, R.A. 1996. “Isometric intermittent endurance of four muscle groups in men aged 20-74 yr.” Medicine and Science in Sports and Exercise, 28 (1), pp. 145-54. Borges, O. 1989. “Isometric and isokinetic knee extension and flexion torque in men and women aged 20-70.” Scandinavian Journal of Rehabilitation Medicine, 21 (1), pp. 45-53. Sanders, M.S., and McCormick, E.J. 1993. Human Factors in Engineering and Design. New York: McGraw Hill, p. 251. 89 Yukitoshi, A., and Shephard, R.J. 1992. “Aging and muscle function.” Sports Medicine, 14 (6), pp. 376-96; Sanders and McCormick, p. 251.

Factual Information 110 Aircraft Accident Report transcript indicates that the captain performed a rudder check before takeoff,90 which would have required the captain to adjust his seat position to allow for the full range of motion on the rudder pedals.) Although the captain’s age (52 years) might have resulted in some degradation in maximum leg force,91 postaccident interviews indicated that the captain was in excellent health and followed a rigorous exercise regimen. Because the captain’s personal health characteristics might have countered the normal age-related loss of strength, the Safety Board did not reduce its estimate of the captain’s leg force from the USAF norms based on his age. However, the United flight 585 circumstances indicated that, in a rudder reversal situation, the left rudder pedal could move as much as 3 inches aft (toward the captain) during the rudder’s movement to its blowdown limit (and within about 1 additional second as sideslip allowed the rudder to deflect more). This rudder pedal movement would have forced the captain to use a less effective knee angle than that of the USAF OTS subjects, which would have reduced his rudder pedal input force. Further, because of the suddenness of the United flight 585 upset and the airplane’s rapid departure from controlled flight, it is possible that the captain never reached his personal maximum leg force effort. In the short time available to recover from the upset, the captain may have pushed hard on the left rudder pedal only long enough to realize that there was a serious problem in the flight control and then shifted his focus to attempt a go-around and stop the yaw/roll with control wheel inputs. Therefore, on the basis of the available information, the Safety Board’s simulation studies assumed that the captain applied a force of about 300 pounds during the brief period between pedal input and the go-around decision/control wheel input and that he subsequently reduced his rudder pedal force to about 200 pounds.92 1.18.4 Conclusions Adopted in the USAir Flight 427 Report On March 24, 1999, the Safety Board adopted 34 findings and a probable cause statement for the USAir flight 427 accident. 1.18.4.1 Findings Note: Because the Safety Board’s analysis of the USAir flight 427 accident also included analysis of the United flight 585 accident and the Eastwind flight 517 incident, some of the findings pertain to these two events. 90 The CVR transcript indicates that, at 0914:20, before taxiing for takeoff, the captain warned the first officer to “watch your feet here comes the rudder.” 91 Research indicated that a loss of about 15 percent in pilot rudder pedal force might be expected in an individual the same age as the captain. 92 This model of pilot rudder pedal force was considered the most appropriate, but a second model also provided a good fit of the data. In this second model, the captain was assumed to have initially input a rudder pedal force of about 500 pounds and then reduced this input force to 250 pounds.

Factual Information 111 Aircraft Accident Report 1. The USAir flight 427 flight crew was properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. 2. The USAir flight 427 accident airplane was equipped, maintained, and operated in accordance with applicable Federal regulations. The airplane was dispatched in accordance with Federal Aviation Administration- and industry-approved practices. 3. All of USAir flight 427’s doors were closed and locked at impact. 4. USAir flight 427 did not experience an in-flight fire, bomb, explosion, or structural failure. 5. A midair collision with other air traffic, a bird strike, clear air turbulence, or other atmospheric phenomena were not involved in the USAir flight 427 accident. 6. Asymmetrical engine thrust reverser deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing uncommanded flight control movements, yaw damper malfunctions, and a rudder cable pull or break were not factors in the USAir flight 427 accident. 7. Although USAir flight 427 encountered turbulence from Delta flight 1083’s wake vortices, the wake vortex encounter alone would not have caused the continued heading change that occurred after 1903:00. 8. About 1903:00, USAir flight 427’s rudder deflected rapidly to the left and reached its left aerodynamic blowdown limit shortly thereafter. 9. Analysis of the human performance data shows that it is likely that the first officer made the first pilot control response to the upset event and manipulated the flight controls during the early stages of the accident sequence; although it is likely that both pilots manipulated the flight controls later in the accident sequence, it is unlikely that the pilots simultaneously manipulated the controls (possibly opposing each other) during the critical period in which the airplane yawed and rolled to the left.

1. Analysis of the human performance data (including operational factors) does

not support a scenario in which the flight crew of USAir flight 427 applied and held a full left rudder input until ground impact more than 20 seconds later.

1. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors) from the USAir flight 427 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

Factual Information 112 Aircraft Accident Report

1. The flight crew of USAir flight 427 recognized the initial upset in a timely

manner and took immediate action to attempt a recovery but did not successfully regain control of the airplane.

1. The flight crew of USAir flight 427 could not be expected to have assessed

the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.

1. It is very unlikely that the loss of control in the United flight 585 accident

was the result of an encounter with a mountain rotor.

1. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors) from the United Airlines flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

1. The flight crew of United flight 585 recognized the initial upset in a timely

manner and took immediate action to attempt a recovery but did not successfully regain control of the airplane.

1. The flight crew of United flight 585 could not be expected to have assessed

the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.

1. Training and piloting techniques developed as a result of the USAir flight 427

accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions of the flight envelope; such training was not yet developed and available to the flight crews of USAir flight 427 or United flight 585.

1. During the Eastwind flight 517 incident, the rudder reversed, moving to its

right blowdown limit when the captain commanded left rudder, consistent with a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

1. It is possible that, in the main rudder power control units from the USAir

flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid, or other unknown factors), the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position without leaving any obvious physical evidence and that, combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input.

Factual Information 113 Aircraft Accident Report

1. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517

were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides.

1. When completed, the rudder system design changes to the Boeing 737 should

preclude the rudder reversal failure mode that most likely occurred in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident.

1. Rudder design changes to Boeing 737-next-generation series airplanes and

the changes currently being retrofitted on the remainder of the Boeing 737 fleet do not eliminate the possibility of other potential failure modes and malfunctions in the Boeing 737 rudder system that could lead to a loss of control.

1. The dual-concentric servo valve used in all Boeing 737 main rudder power

control units is not reliably redundant.

1. A reliably redundant rudder actuation system is needed for the Boeing 737,

despite significant improvements made in the system’s design.

1. The results of this investigation have disclosed that the Boeing 737 rudder

system design certificated by the Federal Aviation Administration is not reliably redundant.

1. Transport-category airplanes should be shown to be capable of continued safe

flight and landing after a jammed flight control in any position unless the jam can be shown to be extremely improbable.

1. Pilots would be more likely to recover successfully from an uncommanded

rudder reversal if they were provided the necessary knowledge, procedures, and training to counter such an event.

1. A neutral rudder pedal position is not a valid indicator that a rudder reversal

in the Boeing 737 has been relieved.

1. The training being provided to many Boeing 737 flight crews on the

procedures for recovering from a jammed or restricted rudder (including a rudder reversal) is inadequate.

1. The continued use by air carriers of airspeeds below the existing block

maneuvering speed schedule presents an unacceptable hazard, and the existing block maneuvering speed for the flaps 1 configuration provides an inadequate margin of controllability in the event of a rudder hardover.

Factual Information 114 Aircraft Accident Report

1. The flight data recorder (FDR) upgrade modifications required by the Federal

Aviation Administration for existing airplanes are inadequate because they do not require the FDR to be modified to record yaw damper command voltage; yaw damper and standby rudder on/off discrete indications; pitch trim; thrust reverser position; leading and trailing edge flap positions; and pilot flight control input forces for control wheel, control column, and rudder pedals.

1. On the basis of the rudder-related anomalies discussed in this report, flight

data recorder documentation of yaw damper command voltage; yaw damper and standby rudder on/off discrete indications; and pilot flight control input forces for control wheel, control column, and rudder pedals is especially important in the case of the 737, and these parameters should be sampled on 737 airplanes at frequent intervals to provide optimal documentation.

1. The Federal Aviation Administration’s failure to require timely and

aggressive action regarding enhanced flight data recorder recording capabilities, especially on Boeing 737 airplanes, has significantly hampered investigators in the prompt identification of potentially critical safety-of-flight conditions and in the development of recommendations to prevent future catastrophic accidents. 1.18.4.2 Probable Cause The Safety Board determined that the probable cause of the USAir flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

115 Aircraft Accident Report 2. Analysis 2.1 General The flightcrew of flight 585 were trained and qualified in accordance with applicable Federal regulations and UAL company standards and requirements. Background evidence on both pilots was unremarkable. There was no evidence of relevant human performance issues for either pilot. Injuries to the pilots were consistent with the comments contained on the CVR that the captain was attempting to prevent the accident. Autopsy, CVR, ATC information, and review of medical records revealed no evidence of physical or psychological factors that were causal to the accident. The airplane was certificated, equipped, and operated according to applicable regulations. The UAL operating procedures for the Boeing 737 were in conformance with the established requirements of Boeing and the FAA. The airplane was properly loaded and the cargo and baggage were properly secured. There were no ATC factors found that contributed to the cause of the accident. Analysis of ATC and FDR data showed that the airplane intercepted the extended centerline during its approach to runway 35 about 0942:50 and began to descend on the visual approach. Although CVR evidence showed that the pilots were encountering airspeed fluctuations and turbulence, the first officer’s voice showed no concern when she stated “we’re at a thousand feet” at 0943:28.2. However, CVR and FDR data indicated that, about 0943:33, United flight 585 began an abrupt heading change to the right and a sudden descent. Evidence from the CVR indicated that the pilots were caught by surprise by a rapidly developing event during which control of the airplane was lost. Witness observations confirmed that the airplane was banked right, while turning from the 45-degree intercept to final approach alignment with the runway. As the airplane neared the end of the turn (nearly aligned with the runway), it momentarily rolled wings level and then commenced to roll to the right at a steady rate. The roll continued until the airplane was inverted with the nose nearly straight down. At about the time the airplane was rolling wings level, and started the final rolling maneuver to the right, witnesses reported that the nose was rising. However, the FDR shows that the airplane continued to descend and the accelerometer data does not indicate an increase in the airplane's load factor that would be consistent with the nose rising (increase in the angle of attack) during the initial phase of the upset. The load factor started to increase when the airplane was banked to about 90 degrees and the flightpath had fallen to over 20 degrees below the horizon and reached about 4 G prior to ground contact. Comments on the CVR indicate that the pilots were alert and aggressive throughout the final 9 seconds. The Safety Board assumes that the crew responded rapidly with control wheel rotation to counteract the roll of the airplane. The focus of the

116 Aircraft Accident Report investigation and analysis therefore centers on events that might have produced rolling moments greater than those that can be countered by the B-737's lateral control system. If control countermeasures were applied in a rapid manner, only large sideslip angles, severe atmospheric disturbances, control system anomalies or structural failures could produce rolling moments greater than the restoring capacity of the airplane's lateral control system. In addition, if the crew used rudder control to either reduce a potential sideslip or create a sideslip angle aiding in roll recovery control, then the upsetting event had to be even more severe than that which could be corrected by control wheel alone. The Safety Board attempted to determine an identifiable reason for the loss of control of flight 585 and the inability of the flightcrew to prevent the accident. During the course of the investigation and analysis of the available data, several possible scenarios were considered. These scenarios included loss of directional control (uncommanded rudder deflection); loss of lateral control (failure in the lateral control systems—flaps, slats, spoilers, and ailerons); atmospheric disturbances (windshears or rotors); or a combination of airplane malfunctions, atmospheric disturbances, structural failures, engine failures, or flightcrew performance. 2.2 Engines The Safety Board considered the possibility that one or both of the engines malfunctioned during the final portion of the flight and initiated a loss of control or prevented the flightcrew from maintaining control. This analysis included examination of the evidence from the wreckage, the CVR spectral signatures, and aerodynamic simulation. The postcrash examination of the engines, as well as the indications on the engine pressure ratio (EPR) gauges and transmitters, showed that the engines were developing power at the time of impact. The evidence was conclusive and the indications of power were similar in both engines. Nonetheless, there is some evidence to support a theory that one or both engines had flamed out in flight, caused control difficulties, and then recovered to normal operation before impact. The CVR spectral analyses show two separate signatures consistent with engine characteristic frequencies, just prior to the comment “Oh God.” The frequencies indicate the engines were developing nearly equal thrust at that time. The signatures disappear in the foreground noise at the “Oh God” comment and are not seen for several seconds thereafter. Four or five seconds prior to impact, two signatures were noted that are consistent with two engines accelerating with one engine leading the other by 2 seconds. However, the gaps in the spectral traces preclude firm conclusions that the observed traces were from the engines. Also, some witnesses reported hearing popping or cracking sounds coming from the airplane when it was about 1/2 mile from the crash site. Witnesses also reported observing a “mist” trailing the airplane's right wing. Both the sounds and the mist could

Analysis 117 Aircraft Accident Report have been associated with engine surges (compressor stalls) that could have accompanied an attempted relight and acceleration of engines in the presence of turbulent air. However, engine thrust variations alone, even with a total flameout, cannot explain the loss of lateral control. Simulator tests showed that the asymmetrical thrust differences produced by a failure of one engine or a 5-second split in engine acceleration were easily handled with flight controls assuming all hydraulics systems were operational. The simulator tests showed that thrust differentials consistent with the signatures from the CVR would produce some yawing and rolling moments. However, at the airspeeds recorded on the FDR, the effects of asymmetric thrust would have been minimal and well within the capability of the airplane's lateral and directional control systems. The Safety Board also considered the effects that a failure of one or both engines would have on the airplane's hydraulic systems. In the B-737, the A hydraulic system is powered by engine-driven hydraulic pumps on both engines. Either pump is capable of maintaining the system operating pressure while delivering 22 gallons per minute flow. At engine windmilling speed, the flow capability of the pumps drops to 4 or 5 gallons per minute. However, even with maximum utilization of the flight controls, including a simultaneous flap retraction, the flow requirement would be about 4 gallons per minute. Thus, even with a complete flameout of both engines, there should be adequate hydraulic power available to the A hydraulic system to provide for flight control. Also, as an engine accelerates from windmilling speed, the flow capacity of the engine-driven pump increases immediately. Further evidence of normal hydraulic capability on the A system was provided by the elapsed time for flap retraction. The time from the sound of flap handle movement recorded on the CVR to impact was consistent with the normal flap retraction speed from the 30-degree position to the 10-degree position as found after the crash. The B hydraulic system is powered by two electrical motor-driven hydraulic pumps, each of which is capable of maintaining system pressure while producing 6 gallons per minute flow. It is possible that, at engine windmilling speed, the constant speed drive would not maintain the electrical generator frequency and the associated electrical buss would drop off line. However, if this had occurred, the FDR and CVR, which are powered by the same busses, would have ceased to operate. Since there is no evidence of an interruption of electrical power to either of the recorders, the Safety Board concludes that the electrical busses and the respective electrical motor-driven hydraulic pumps remained powered throughout the flight. With both the A and B hydraulic systems operating, it can be assumed that, absent some other unidentified failure, there was sufficient control capability to cope with any combination of engine thrust variations. Thus, while the Safety Board cannot rule out the possibility of engine surges or a momentary asymmetric thrust condition, the Board concludes that these factors, if they did occur, should not have resulted in the loss of control evident in this accident.

Analysis 118 Aircraft Accident Report 2.3 Structures All of the airplane's flight control structure was found and examined, except for a portion of the rudder and vertical stabilizer. The wreckage was localized, and there was no wreckage found along the flightpath. The portion of rudder and vertical stabilizer not examined consisted of composite material located in the middle of the surfaces. Fragments of charred composite fabric were found with the extremities of the surfaces indicating that they were present at impact and burned during the postcrash fire. Reconstruction of the wing structure indicated that all of the parts were attached until impact. Examination of fractures of the wings indicate that the failure modes were consistent with impact overload failures. Examination of the wing flaps showed that the flaps were attached to the wing structure and there were no mechanical failures prior to impact with the terrain. The positions of all of the flap jack screws indicated that there was not a split flap condition and the flaps were at the 10-degree position at impact. This position was further confirmed by metallurgical analysis of the detent track from the flap handle module. Examination of the ailerons indicated that they were attached to the wings until impact. The continuity of the flight control cables throughout the wings indicated that the aileron cables did not malfunction in the wing areas. The attach points for the spoilers indicated that they were attached to the wing structure until impact. Crushing of the leading edge devices (slats) in the extended position indicated that all of the slats were properly extended at impact. Reconstruction of the empennage revealed that all parts were attached to the structure until impact. The recovery of the rudder top cap and the balance weights at the crash site indicated that the rudder was present and intact at impact. The recovery of the elevator end balance weights and the elevator hinges at the crash site indicated that the elevators were present and intact at impact. Examination of the elevator control mechanisms indicated that there was no elevator malfunction prior to impact. Examination of the horizontal stabilizer indicated that there was no preimpact malfunction or failure of the horizontal stabilizer. Numerous examinations of the wreckage failed to produce evidence of preimpact structural problems. Engine mount separation points showed evidence of impact overload. All doors were closed and latched. The Safety Board considered the possibility that the “mist” trailing the wing observed by witnesses was produced by fuel or hydraulic fluid resulting from a structural failure of some nature. However, the investigation disclosed no evidence of a structural failure that would have allowed fuel or hydraulic fluid to escape. 2.4 Systems From the flightcrew conversations recorded on the CVR and the flightpath described by FDR data, it is evident that the loss of control occurred suddenly and that the

Analysis 119 Aircraft Accident Report crew were not aware of any prior problems with the airplane's systems. However, the lateral upset and the flightpath of the airplane during the final 9 seconds of flight could have resulted from a flight control system malfunction. Thus, the Safety Board's investigation focused on an examination of the wreckage and all recovered components of the airplane's hydraulic and flight control systems in an effort to identify any anomalies that could have produced the loss of control. The onset of the loss of control occurred nearly 30 seconds after the flaps were extended to 30 degrees. The trailing edge flaps and leading edge devices would have began extending immediately and would have reached the command position before the first officer's comment, “we're at a thousand feet,” which was made in a tone of voice that did not express unusual alarm. Thus, the Safety Board concludes that the flap operation was symmetrical and normal. 2.4.1 Hydraulic Power The primary flight controls of the B-737 are powered by the independent A and B hydraulic systems previously discussed in section 2.2. A loss of fluid or pressure from either of these systems would result in a loss or degradation of some flight control functions. However, the Safety Board found no indications that the systems had malfunctioned, except for a stretched bulb filament in the HYD indicating light on the first officer's annunciator panel. Because several other light bulb filaments were stretched, some of which would normally illuminate only in a press-to-test check, the Board does not view this evidence as meaningful. The evidence also shows that the motor-operated shutoff valves in both the system A and System B flight control modules were open and that the motor-operated shutoff valves in the standby hydraulic system module were off or closed. Because impact loads do not usually affect the position of motor-operated valves, it is assumed that the systems were operated in this normal configuration before impact. Had the flightcrew been aware of an A or B hydraulic system problem, it would be expected that they would have talked about it and perhaps selected the standby system. Thus, the Safety Board believes that the A and B systems were pressurized and capable of delivering hydraulic power to the flight controls. The teardown examination of the hydraulic components showed considerable evidence of contamination in the A, B, and standby systems. Most of the contaminants were portions of “O” rings or backup rings that had migrated through the system and were trapped in filter housings. In those cases where contaminants were found to potentially affect the function of relief or check valves, it was determined that there would have been no effect on essential flight control components. While the level of contamination in the hydraulic systems of this airplane seemed excessive, the Safety Board did not determine whether the level was atypical to that which would be found on other airplanes of comparable vintage.

Analysis 120 Aircraft Accident Report 2.4.2 Flight Control Systems From the FDR data, it is apparent that the airplane's departure from controlled flight began with a sudden heading change to the right. A lateral or directional flight control problem could produce such a maneuver whereas a longitudinal control system malfunction would produce a pitching maneuver evident by a sudden change in the airplane's load factor. A pitch change was not evident in the FDR data. There were no anomalies found in the longitudinal flight control components that were available for examination. The elevators were recovered at the accident site and the horizontal stabilizer was trimmed in a normal range. During the attempted recovery from the upset, the airplane's load factor increased to about 4 G--a maneuver that would have required a pilot-commanded elevator deflection. The Safety Board thus concludes that the elevator control system was functional until impact. The lateral control system consists of ailerons and flight spoilers controllable by the captain's and first officer's control wheels. The aileron power control units provided evidence that the ailerons were at or near neutral at impact. There were no anomalies noted in the actuators that could account for an uncommanded movement. Although there was some conflicting evidence regarding flight spoiler position, all of the damage was consistent with impact-applied loads. The aileron spring cartridge, which is installed to permit independent operation of the left or right ailerons in the event that the opposite side of the aileron system becomes jammed, was bent and extended. This damage also was readily explainable by impact loading and is not viewed by the Safety Board as evidence of an in-flight problem. Thus, there was no evidence that a lateral control system malfunction occurred in flight. There is also no evidence that a ground spoiler deployed to cause the lateral upset. The condition of the ground spoiler control valve slide was consistent with a retracted spoiler position. Further, had either the flight or ground spoilers been extended in flight, the airplane would not have been able to achieve a 4-G load factor at 212 KIAS without activating the stall warning stick shaker. The sound of the stick shaker was not heard on the CVR. The simulation conducted during the investigation determined that a 20-degree or greater deflection of the rudder to the right could induce extreme control difficulties and could lead to a rolling moment consistent with that observed by witnesses and determined during flightpath analysis of this accident. The Safety Board was therefore concerned about the previous maintenance discrepancies relating to rudder operation on the accident airplane. Previous discrepancies: The first evidence of a potential rudder control problem on N999UA occurred on February 25, six days before the accident flight, when the flightcrew on that day experienced a transient uncommanded yaw to the right. The crew turned off the yaw damper and no further uncommanded yaws were observed during the flight. Following that flight, UAL maintenance replaced the yaw damper coupler. However, on February 27, another crew experienced an uncommanded yaw to the right,

Analysis 121 Aircraft Accident Report and they, too, turned off the yaw damper to eliminate a recurrence of the problem. The UAL maintenance personnel then replaced the yaw damper transfer valve in the rudder MPCU. No further problems were encountered prior to the accident flight. The Safety Board believes that the UAL maintenance efforts to troubleshoot the system were in accord with normal practices. However, it is doubtful that these actions corrected the problem since subsequent tests of both of the removed components showed that they operated normally. During the examination of the MPCU recovered from the wreckage, it was noted that one of the electrical wires to the solenoid was loose and circuit continuity was intermittent. The Safety Board believes that this intermittent circuit could have been the cause of the uncommanded yaws experienced on the earlier flights. If this were the case, the effect of the discrepancy would be erratic deflections of the rudder when the yaw damper was in use. However, by design, the authority of the yaw damper is limited to 2 degrees of rudder travel. While uncommanded rudder movements of 2 degrees or less could produce noticeable side loads, they would have little or no effect on airplane controllability. Standby rudder actuator input crank shaft galling: The Safety Board believes that the binding of the input shaft to the bearing that is threaded in the standby actuator body could also have produced the two transient uncommanded yaws experienced during previous flights. As discussed in section 1.16.3, a rudder movement initiated by the yaw damper will produce a small angular movement of the standby actuator input crank. If the crank is not free to move relative to the actuator body, the feedback loop to the MPCU servo valve will be affected so that a rudder deflection command signal may be applied to the MPCU through rotation of the torque tube. The rudder could then move beyond normal yaw damper limits until an opposing load sufficient to overcome the binding force between the standby actuator input shaft and bearing applied by the centering spring is reached. At this point, the MPCU servo valve null can be restored. The resultant deflection could be as much as 5.5 degrees. The simulation tests showed that this rudder movement could be easily countered by the airplane's lateral controls. Although the airplane would be in a sideslip with some resultant performance penalties, a loss of control is unlikely. Moreover, the Safety Board believes that the finding that the bearing nut was rotationally backed off about 30 degrees from the standby actuator body when the unit was examined following the accident is significant to this analysis. It was evident from the soot pattern on the actuator body that the bearing was in this position, rather than the position that would correspond to a properly torqued nut, before the unit was exposed to the postcrash fire. The Safety Board does not believe that the loss of torque and rotation can be attributed to impact loads. The postaccident examination also showed that, after cleaning the threads, the bearing nut rotated freely in the body. Given this condition, the potential binding between the input crank shaft and the bearing nut would have no longer provided the rigid link between the rudder attachment and the torque tube that is necessary to produce uncommanded rudder deflections. The Safety Board considered the possibility that the bearing nut was backed off from the housing during flight by a ratcheting motion wherein the binding caused by

Analysis 122 Aircraft Accident Report galling was dependent upon the direction of rotation of the shaft within the bearing. However, in order for the input shaft to move relative to the bearing nut, the bearing nut must be held in position relative to the actuator or housing. A 4-degree misalignment is the maximum that can occur with a properly connected system and without the bearing nut moving. Once the bearing nut moves within the housing, the torque is broken and further movement between the input shaft and bearing nut is unlikely unless a resistance to bearing nut motion is reestablished. A series of at least eight such excursions would have to take place before the nut could be moved 30 degrees. The Safety Board discounts this theory as extremely unlikely. The Safety Board believes it more likely that the nut was backed off during maintenance in which the MPCU was removed from the airplane. With the MPCU removed from the control system, movement of the rudder surface from side to side would be resisted only by the standby actuator and torque tube. The centering spring would resist torque tube rotation so that the rudder movement would normally result in a rotation of the standby actuator input crank within the bearing. The standby actuator input crank could have been moved to its mechanical stops with the input shaft rotating in the bearing nut against the galling resistance. When the system was reconnected, the rudder would have been repositioned and the lever returned to its normally neutral position while backing off the bearing nut rather than repositioning the shaft in the nut. The final position of the lever would be neutral, and the bearing nut would be backed off, up to 30 degrees. Such rotation of the nut would probably break the safety wire, which might not be noticed if the standby actuator is not the focus of the maintenance. Boeing tests have shown that a bearing nut that has backed off 30 degrees and is frozen to the input shaft is free to rotate about the nut threads without interfering with the rudder system operation. The Safety Board concludes that the bearing nut was backed off prior to the accident and that the galling was not contributory to rudder control problems at the time of the accident. Although the FAA has not required such inspections, UAL inspected other B-737s to determine whether other examples of standby actuator input shaft to bearing galling existed. One B-737-200 airplane was found to have a galled bearing nut and input shaft. The safety wire to the bearing nut was missing, with only a small fragment in the hole on the bearing nut. The nut was backed off about 20 degrees. This airplane had received maintenance writeups for rudder problems several years ago. Several components were changed, and no additional complaints had been received. Safety Board metallurgists characterized the galling as worse than that found on the accident airplane. The airplane that the galled actuator was removed from had apparently been operating for some time with the galled actuator. There were no indications that the galled actuator had ever been detected by flight or maintenance crews within the preceding several years. It is believed that galling occurs shortly after the unit begins operation because the condition that causes galling is the lack of clearance between parts. After the bearing nut backs off, galling ceases to be a problem.

Analysis 123 Aircraft Accident Report As a result of its concern about galled standby rudder actuator bearings on other B-737s and B-727s, the Safety Board issued Safety Recommendation A-91-77 to the FAA on August 20, 1991 (See section 4). MPCU secondary slide overtravel: After the July 16, 1992, incident in which an abnormal rudder operation was observed by a pilot during a preflight controls check, it was discovered that the tolerances in the MPCU servo valve input lever mechanism, valve housing, and slides could result in a degradation of MPCU force capability or piston travel opposite to the commanded direction. The extensive tests and analyses that were conducted disclosed that several concurrent conditions must exist to produce this aberrant operation of the MPCU. First, the dimensional buildup of the secondary slide relative to the valve body has to permit hydraulic fluid flow outside the normal passage in the event that the secondary slide moves beyond its normal range of motions and attains an overtravel condition. Hydraulic flow outside the normal passage would have to be severe enough to produce hydraulic pressure drops or pressure reversals resulting in the loss of hinge moment capacity or, in extreme cases, a rudder motion in the direction opposite the input command. Second, a mechanism must exist to produce the overtravel, for example, the secondary slide sticking to the primary slide. Motion of the primary slide could then push the secondary slide into the overtravel condition. Third, input commands through the pedals have to induce large rudder MPCU input crank deflections, normally to the valve body stops of the input crank. When the MPCU servo valve module from N999UA was examined, it was found that the tolerances were such that maximum travel of the secondary slide irrespective of the relative position of the primary slide would not result in a reversal of pressure differential across the actuator pistons. In the worst case, an internal leakage was produced with a 66-percent drop in maximum pressure differential. This condition would limit the rate of rudder movement and the maximum deflection that could be achieved against aerodynamic loads. Nonetheless, the Safety Board is concerned that this condition could cause significant flight control difficulties under certain circumstances—for example, if sudden, large rudder pedal inputs are needed in response to an engine failure during takeoff or initial climb. Thus, the Safety Board believes that the positive measures that were communicated to the FAA on November 10, 1992, in Safety Recommendations A-92-118 through A-92-121 are warranted. (See section 4). The Safety Board is also concerned that the potential for this aberrant operation of the B-737 rudder MPCU was not found during the unit's initial design acceptance tests or during the postproduction functional tests of individual units. The Board has been advised by Boeing that the test procedures have been modified so that a unit's susceptibility to abnormal operation under unique conditions will be identified.

Analysis 124 Aircraft Accident Report 2.5 Environmental Factors 2.5.1 General Conditions The accident occurred in visual meteorological conditions (VMC). The sun was at an elevation of 33.2 degrees at an azimuth of 134.9 degrees. Clear skies and a visibility of 100 miles was reported at COS at 0850 and 0950. Most of the witnesses to the accident reported clear skies. During the approach to COS and prior to the right roll, flight 585 encountered moderate turbulence below 9,000 feet. According to the National Weather Service (NWS) Operations Manual, moderate turbulence occurs with peak acceleration greater than .5 to 1.0 g. Air Weather Service (AWS) CAT Forecasting Techniques notes that a 15- to 25-knot variation in airspeed can result from moderate turbulence. In addition, several pilots in the immediate COS area reported turbulence of moderate intensity. Based on other pilot reports of low altitude severe turbulence, a SIGMET for severe turbulence and a Center Weather Advisory for severe turbulence should have been issued by the NWS. It should be noted that the possibility of isolated severe turbulence below 18,000 feet was included by the Denver Center (ZDV) Meteorologist in his Area Forecast for the ZDV area. In addition, a low altitude turbulence (CAT) advisory should have been issued by the UAL Meteorology Department. However, these omissions are not factors in the accident. The crew anticipated turbulent conditions along the route from DEN to COS. They also encountered turbulence during the entire flight from DEN until the initiation of the uncontrollable right roll. The Safety Board believes that immediately before the loss of control, the turbulence encountered by flight 585 was moderate. Moderate turbulence was forecast by the NWS in the Area Forecast. The FDR information shows that flight 585 was encountering no greater than +/-10 knot airspeed fluctuations and moderate vertical acceleration excursions prior to the onset of the lateral upset. A pilot report for COS at 0920 stated that a B-737 (Continental 166) approaching runway 35 encountered an airspeed loss of 15 knots at 500 feet agl, an airspeed gain of 15 knots at 400 feet agl, and an airspeed gain of 20 knots at 150 feet agl. Another aircraft located in the area of the accident reported that its airspeed fluctuated between 65 to 105 knots while trying to maintain 80 knots airspeed. While the changes in airspeed of flight 585, Continental 166, and the other aircraft in the area are not indicative of a microburst or convective windshear, the rapid positive and negative changes in airspeed are consistent with an environment characterized by gusty winds. Based on the Pilot Report of Continental 166 (20 knot airspeed gain) the COS terminal forecast (COS FT AMD 2 031410) should have been amended by the NWS Forecast Office in Denver to include a nonconvective LLWS advisory. However, other aspects of the COS FT were substantially correct. An LLWS potential statement should also have been included in the Area Forecast issued at 1145Z (SLC FA 031145).

Analysis 125 Aircraft Accident Report While this omission by the NWS was not a factor in the accident, the Safety Board is concerned that information on LLWS pertinent to aviation safety was not included in the Terminal and Area Forecasts. 2.5.2 Characteristics of Horizontal Axis Vortex (Rotor) The Safety Board investigated the pressure distribution in a horizontal axis vortex to determine whether a corresponding pressure differential was evident in the air speed and altitude data recorded at the time of the accident. Equations provided by NOAA to calculate the pressure drop in a vortex showed about a 21.5 millibar pressure decrease in the core of a vortex of strength omega equals .6 radians per second.93 At the core edge (radius equals 250 feet), the decrease was about 10.7 millibars. At a radius of 600 feet, the decrease was about 1.9 millibars. Since 1 millibar equals .03 inches of Hg., the above pressure decreases would amount to altitude increases of about 645 feet, 321 feet, and 57 feet, respectively. In a .4 radian per second vortex the pressure decrease in a core with a radius of 250 feet would amount to about 9.2 millibars. At the core edge, the decrease would have been about 4.6 millibars and at a radius of 600 feet, the decrease would have been about .8 millibars. These pressure decreases amount to altitude increases of about 276 feet, 138 feet, and 24 feet, respectively. The equations used to calculate the pressure drop in a vortex show that the pressure drop in the core is a function of the density and the tangential speed but not a function of the core radius. The pressure drop at the core boundary is equal to about 1/2 the pressure drop in the core. Therefore, given a tangential speed of 100 feet per second, the pressure drop in the core is the same regardless of the core radius (tangential speed and density the same). However, the pressure gradient would increase as the core radius decreases given the same tangential speed and density. According to NOAA personnel, these values of pressure decrease are valid only if the vortex is stationary or if the vortex is moving with the medium. If the vortex is moving on the edge of a wind surge or if the vortex is moving relative to the medium, the situation regarding the pressure decrease is more complicated. NOAA calculated the pressure distribution associated with a vortex with an angular velocity of .4 and .6 radians per second (clockwise rotation) moving relative to the medium with a translation speed of 100 feet per second (west to east). The calculation showed that pressure increases can occur above the core center. At around 200 feet above the core center, near the core edge, in a .4 radians per second translating vortex, a pressure increase of about 5 millibars occurs (corresponding to an indicated altitude decrease of about 150 feet). A pressure increase of about 2 millibars occurs about 200 feet above the core center (corresponding to an indicated altitude decrease of about 60 feet). About 200 feet below the core center near the core edge, a pressure decrease of about 14 millibars occurs (corresponding to an indicated altitude increase of about 420 feet). 93 According to Boeing’s later (1998/1999) simulations, a vortex strength of 1.8 radians per second would be required for the United flight 585 accident scenario (see section 2.7).

Analysis 126 Aircraft Accident Report About 200 feet below the core center, a pressure decrease of about 30 millibars is seen (corresponding to an indicated altitude increase of about 900 feet). In the core center, the pressure decrease is about 6 millibars (corresponding to an indicated altitude increase of about 180 feet). In a .6 radians per second translating vortex, a pressure increase of about 5 millibars is seen about 200 feet above the core center near the core edge. At 200 feet above the core center, the increase in pressure amounts to about 1 millibar (corresponding to an indicated altitude decrease of about 30 feet). About 200 feet below the core center near the core edge, a pressure decrease of about 25 millibars (corresponding to an indicated altitude increase of about 750 feet) is seen. At 200 feet below the core center, a decrease of about 50 millibars (corresponding to an indicated altitude increase of about 1500 feet) is seen. In the core center, the pressure decrease is about 20 millibars (corresponding to an indicated altitude increase of about 600 feet). It can be seen from these results that there are regions in a strong translating vortex where the pressure change is small and positive, resulting in small decreases in the indicated altitude.94 Whereas in other regions of the vortex the pressure change is large and negative, resulting in large increases in the indicated altitude. A review of the accident report on Delta Air Lines flight 191, which is cited in the factual section of this report, showed that the airplane penetrated horizontal axis vortices in the thunderstorm outflow. Penetration of these vortices resulted in an increase (spike) of about 100 feet in the altitude, as seen on the FDR. If a vertical tangential flow of 49 feet per second occurred, as noted in the report of that accident, the NOAA equations show about an 80-foot increase in indicated altitude. The calculations thus show good correlation with flight recorded data. Therefore, the pressure decrease can be calculated using the equations supplied by NOAA for a vortex moving with the medium. In addition, data supplied by NASA personnel showed significant recorded altitude increases (pressure decreases) experienced by aircraft penetrating vortices at high altitude. These increases were on the order of 150 to 300 feet (Wingrove Report dated April 16, 1992). Therefore, this report also showed that the altitude increases (pressure decreases) seen are consistent with those expected using the equation supplied by NOAA. Other data show that a vortex moving relative to the medium or on the edge of a wind surge would still have a significant pressure decrease at and below the core. However, above the core a small pressure decrease or a positive pressure increase may occur. According to NOAA, if a vortex existed at the time and location of the accident it would have likely been moving on the edge of a wind surge. However, in this case, the associated pressure changes as a function of distance from the core would be very complex, and further study is needed to accurately define them. 94 Boeing’s and the Safety Board’s later (1998/1999) computer simulations indicated that United flight 585 would have had to remain in the vortex core for the duration of the accident sequence. These simulations indicated that the rotor would have had to translate from a horizontal to a vertical orientation while increasing in strength as the airplane descended to the ground with a large change in indicated altitude (see section 2.7).

Analysis 127 Aircraft Accident Report The NCAR atmospheric simulation for the COS area for March 3 was inconclusive. NCAR scientists had insufficient data to initialize the model. However, a January 9, 1989, windstorm showed the existence of concentrated regions of upward motion (or jumps) in the Boulder and COS areas. There are similarities between windstorm events on a case-by-case basis. However, the regions of upward motion generated by the model for the January 9 case were not of sufficient strength to cause controllability problems in a B-737. Shear values (change in the vertical velocity with horizontal distance) were much too small; about 10 meters per second per kilometer (.01 per second). Boeing used this data in a simulation involving a B-737 and found that it was essentially a nonevent. Shear values in the rotor simulation were on the order of .4 to .6 per second, 40 to 60 times greater than those of the January 9 case. Larger shear values may exist in these regions although there is no direct evidence of such values. There is evidence of the existence of a horizontal axis vortex at the time and in the area of the accident. The strongest evidence regarding the existence of a vortex of the strength Boeing calculated as necessary to cause airplane controllability problems are the witness reports east of the accident site of a 90 mile per hour gust and gusts of 50 to 70 knots. The 90 mile per hour gust was estimated based on a previous 70 mile per hour recorded gust that did not shake the house of the witness. The gust encountered about the time of the accident did shake his house. Another witness who was approximately 1.25 miles east of the accident site reported gusts of 50 to 70 knots. However, these two witness reports were not from a direct measurement of wind speed. In addition, these gusts could have been straight line gusts rather than the result of a horizontal axis vortex hitting the ground. Normally, intense rotors produce a distinctive “roaring” sound. A person 12 miles north of COS reported a rotor hitting the ground about noon. He was inside a building and went outside to observed the rotor after hearing what he described as a roaring sound. However, there were no reports from witnesses to this accident regarding such sounds. Further, because a horizontal axis vortex strong enough to cause airplane control problems would have a core pressure several tenths of an inch of Hg. lower than the ambient pressure, a transient increase in altitude of several hundred feet should have been noted on the FDR if flight 585 had penetrated the core of a vortex. Transients in altitude were seen in the FDR data of Delta Air Lines flight 191 and other aircraft that penetrated vortices. Such an altitude spike was not seen in the FDR data. Most of the weather investigation focused on the possibility of a rotor as a cause or a factor in this accident. However, another atmospheric phenomenon was considered as possibly occurring at the time. This phenomenon is a concentrated region of upward vertical motion (or jump). Based on data supplied by NCAR, Boeing simulated the aircraft response to a jump. Boeing found it to be a nonevent. Shear values needed to be about 40 to 60 times greater to present problems to the airplane. Although no direct evidence exists, scientists at NCAR believe that atmosphere jumps can have much greater shear values. These values may be strong enough to cause airplane controllability problems.

Analysis 128 Aircraft Accident Report While approaching COS, flight 585 probably encountered orographically induced atmospheric phenomena, such as updrafts and downdrafts, gusts, and vertical and horizontal axis vortices. The most likely phenomenon that would cause the airplane to roll was a horizontal axis vortex. As discussed in section 2.6, the Safety Board does not consider it likely that flight 585 encountered a strong horizontal axis vortex that induced a rolling moment which exceeded the airplane's control capabilities, and the FDR data is not consistent with such an encounter. 2.5.3 Flight Simulations with Atmospheric Disturbances The airplane simulator was “flown” through various atmospheric rotors and windshears. The changing flow fields relative to an airplane encountering such a rotor produce changes in angle of attack, sideslip angle, or lift distribution across the wing. The resulting lateral or directional imbalances contribute to uncommanded airplane motions. The rotor size and strength were varied as was the orientation of the rotor's longitudinal axis. The elevation angle of the rotor was varied from horizontal to vertical. The azimuth angle was generally north-south, but varied +/- 30 degrees. The approach path of the airplane was varied to intercept the rotor from many angles. NOAA originally estimated, and NOAA research work has confirmed, that a typical rotor on the day of the accident could have a rotational velocity of 0.06 radians/second (3.4 degrees per second) with a radius of 1,640 feet. The tangential velocity at the core radius would have been 100 feet per second. Simulations showed that such a rotor had little effect on airplane control except that performance problems could develop if the airplane remained in the downflow field of the rotor. In a sustained downflow, the airplane would either have to lose altitude or airspeed, similar to the outcome of entering the downflow field of a microburst. Performance calculations have shown that the accident airplane could have been in a downflow field of about 80 feet/second for about 30 seconds, possibly induced by a rotor's downflow field or some other atmospheric disturbance. The airplane did lose altitude at a higher than normal rate, but the airspeed remained constant at the flaps reference speed plus 20 knots for the approach to landing. In a sequence of simulations, the severity of the rotor was increased until encounters produced extreme control difficulties. It was determined that rotors with rotation rates of 0.6 radians/second (34 degrees per second) with a 250 feet core radius (150 feet/second tangential velocity) generated extreme control difficulties. A more moderate rotor with 0.4 radian/second rotation and a 250 feet core radius (100 feet/second tangential velocity) produced significant control problems and even loss of control if recovery procedures were not promptly implemented. A “loss of control” as defined by the pilot group did not necessarily result in a crash, but in the loss of precise operating control of the airplane, such as the inability to maintain a desired heading or roll angle for short periods of time. Gust fronts (wind gusts that impact the side of the airplane) can produce large sideslip angles with the potential for loss of control. However, once through the

Analysis 129 Aircraft Accident Report disturbance, the sideslip angles quickly return to near zero unless other factors, such as rudder deflection, remain. Simulations show that as an airplane penetrates a shear, large side slips develop with predictable airplane responses. Windshears or gust fronts severe enough to produce control difficulties also produced flight responses that were clearly different than those recorded by the accident airplane’s FDR. Gust fronts produced large changes in heading into the wind, large increases in airspeed, and rapid rolling away from the wind if not controlled by the pilot. As the roll angle increased, the wind-induced sideslip angle transitioned into wind-induced angle of attack with marked increases in normal acceleration (G-load). Heading data from the FDR was clearly not consistent with data recorded during simulation efforts. Although United flight 585 was obviously affected in varying degrees by windshears and gusts during its approach to Colorado Springs, the Safety Board does not consider it likely that large sideslip angles resulting from atmospheric disturbances directly resulted in the loss of control of the airplane. 2.6 United Flight 585 Upset 2.6.1 Computer Simulation Analysis As part of its investigation of the USAir flight 427 accident, the Safety Board conducted computer simulation studies of the United flight 585 upset. FDR95 and radar data, the accident location, and wreckage orientation were used as data points. Because the FDR did not record roll or sideload information, it was not possible to positively determine whether the recorded heading changes were the result of a roll or a sideslip followed by a roll.96 Other variables had to be factored into the simulation studies. The winds and turbulence encountered by United flight 585 during the approach undoubtedly acted on the airplane during the upset and descent. Because the exact winds encountered by the airplane were not known, the winds could be reasonably varied during the simulations, resulting in a number of possible scenarios that would be consistent with the radar data and the limited FDR data. Pilot pedal input force was another variable that was incorporated in the simulations. The Safety Board employed several computer simulation scenarios in which the resulting heading data matched the available FDR data. These simulations used rudder position time histories that assumed jams of the secondary slide to the valve housing at various positions from the neutral position (100, 71, 50, 40, and 30 percent) and a concomitant rudder reversal. (Each of the rudder-related solutions required a control wheel response opposing the roll.) 95 United flight 585 was equipped with a five-parameter FDR, which recorded microphone keying, airspeed, altitude, and heading at once-per-second intervals and vertical Gs eight times per second. 96 Simulations using a control wheel input could produce a scenario involving only a roll, whereas simulations using a rudder movement could produce a scenario involving a sideslip followed by a roll, both of which could be consistent with the recorded data.

Analysis 130 Aircraft Accident Report The Safety Board’s best-match computer simulation was one in which the secondary slide jammed at 100 percent off its neutral position and, about 0943:32, the rudder reversed in response to the pilot’s attempt to make a left rudder input. In this simulation, the airplane’s right yaw rate had reached 4.7° per second just before the rudder reversal because of the effects of a wind gust (a 17-knot decrease in the wind velocity for 3 seconds as the airplane descended on its approach). The Safety Board incorporated this wind velocity change with decreased altitude into its computer simulation to match the heading data recorded by the FDR from about 0943:28 to about 0943:31. The heading output from the Safety Board’s best-match simulation matched the FDR heading data within 1° or less and matched the character of the data. The Safety Board’s computer simulations that used right control wheel input alone (and no rudder movement) also produced heading results that matched the available FDR data. However, that solution was not considered to be realistic because it required the pilots to fly the airplane into the ground when simple wheel corrections could prevent this occurrence. The Safety Board has no evidence that the pilots of United flight 585 would have deliberately flown the airplane into the ground.97 The Safety Board could also match the FDR data by assuming that the increasing roll was the result of a rotational external wind, such as a mountain rotor.98 The Safety Board considered the possibility that a mountain rotor forced the airplane along the accident flightpath.99 With the weather conditions present in the area on the day of the accident (strong westerly winds flowing over the mountains located west of the accident site), rotors could have been generated, rotating in a clockwise direction (from United flight 585’s perspective on the approach). These rotors would have likely been moving to the east (pilots’ left to right) with the wind at an unknown altitude; however, it is possible for a mountain wave to trap a rotor, resulting in a “standing” rotor, which would not move with the wind. In a June 23, 1997, letter to the Safety Board, Boeing indicated that a “rudder hardover scenario” did not fit the United flight 585 FDR data but that a “new rotor model” it developed did fit the data. This Boeing model proposed an encounter with a rotor that followed the flightpath of the accident airplane and increased in strength to about 1.8 radians (103°) per second as the airplane descended to the ground. However, according to NOAA scientists, the strongest rotors ever documented in the Colorado Springs area had a strength of about 0.05 radians per second. Further, a NOAA/NCAR 97 Reports from other pilots who had flown with the captain (the flying pilot) indicate that he was a very conservative and conscientious pilot. These reports are consistent with the captain’s conduct on the accident flight, as documented on the CVR. 98 A rotor is an atmospheric disturbance produced by high winds, often in combination with mountainous terrain, and expressed by a rotation rate (in radians per second), a core radius (in feet), and a tangential speed (in feet per second). Rotation can occur around a horizontal or vertical axis. 99 The Safety Board considered several mountain rotor scenarios, including moving rotors above, below, and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s flightpath; and horizontal rotors that transition to vertical rotors along the airplane’s flightpath.

Analysis 131 Aircraft Accident Report report100 indicated that researchers have not documented rotors that would descend to the ground in increasing strength, such as the one proposed by Boeing. The Safety Board evaluated the accident airplane’s FDR information for signatures that would be expected if the airplane encountered a rotor. In addition to changes in heading, the signatures would have included changes in indicated airspeed and altitude resulting from the effects of the low ambient pressure within the rotor. None of these expected pressure signatures were found. Although encounters with translating rotors at certain angles might not produce these pressure signatures, the masking of the FDR signatures would occur only while an airplane was entering such a rotor. United flight 585 could not have penetrated a rotor’s low pressure core and remained there for 8 seconds (the time that the airplane would have had to remain in the rotor for the heading output and the flightpath to match the FDR data) without pressure changes from the rotor producing changes in airspeed and altitude. Further, none of the sounds that are normally characteristic of intense rotors were recorded by the accident airplane’s CVR, and witnesses on the ground did not report such sounds at the time and location of the accident. On the basis of the absence of the signatures of a rotor penetration on the FDR, the absence of recorded/reported characteristic rotor sounds, and the small likelihood that a rotor of the necessary strength and orientation would have matched the airplane’s flightpath to the point of ground contact, the Safety Board concludes that it is very unlikely that the loss of control in the United flight 585 accident was the result of an encounter with a mountain rotor. 2.6.2 Human Performance Analysis On the day of the United flight 585 accident, pilots flying in the area of the Colorado Springs airport had reported moderate to severe turbulence, gusty winds, and windshear. Information recorded by the CVR and FDR indicated that, as the captain (who was the flying pilot) maneuvered the airplane in the traffic pattern, the airplane encountered wind gusts and windshear that resulted in 10-knot airspeed changes. Because of the turbulence and wind gusts, and because he was preparing for a crosswind landing, the Safety Board considers it likely that the captain had his feet on the rudder pedals as he aligned the airplane on its final approach. According to the Safety Board’s best-match computer simulation, about 0943:20, the airplane rolled rapidly (about 10° per second) to the right to a bank angle of about 27° and returned to approximately a level flight attitude. This bank was entered more rapidly and was steeper than the bank a pilot would likely have commanded for a heading adjustment to track the extended centerline of the runway. Consequently, the Safety Board 100 The NOAA/NCAR interim report (prepared in response to Safety Recommendation A-92-57) was titled “A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs Area: Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997).” As of March 1999, the NOAA/NCAR final report had not been completed; however, the Safety Board has reviewed a draft of the final report and reflected its content in this analysis.

Analysis 132 Aircraft Accident Report assumed that the right roll was caused by an eddy or rotational wind component. (The recovery from this right roll, however, was presumed to have been a result of control wheel inputs made by the captain beginning about 1 second after the airplane’s roll accelerated to the right.) The Safety Board’s review of the CVR, FDR, and radar information revealed that, about 0943:28 (8 seconds after the 27° uncommanded right roll), the airplane was flying at 160 knots with 30° of flaps and the landing gear extended and was nearly aligned on the final approach for the runway. According to the CVR, at 0943:28.2, the first officer advised “we’re at a thousand feet [above the ground].” The FDR indicated that, about 0943:30, another right heading change began and continued at a rate of 4.7° per second. In its computer simulation, the Safety Board matched this heading change by introducing a crosswind gust component, resulting in right yaw. The yaw rate was sustained for more than 3 seconds before a rapid right roll developed. This sustained yaw would have been apparent to the captain as motion of the ground and sky features relative to the fixed reference of the airplane’s windshield area. This heading change would have been especially salient to the captain because the runway, with which he was trying to maintain alignment, would have been visible ahead. The Safety Board’s simulation scenario assumed that the captain responded to the sudden, rapid, and sustained heading change by applying left rudder pedal input about 0943:32. The timing of this input (about 3 seconds after the peak yaw rate was attained) would be consistent with the time required for the pilot to perceive the yaw, wait a moment for the effect of the turbulence to subside (to avoid overcontrolling), decide that a left rudder input was required, and then apply the left rudder pedal input. The Safety Board’s simulation postulated that this left rudder input initiated a rudder reversal to the right. According to the Safety Board’s simulation, at 0943:33.5 (about 1.5 seconds after the rudder reversal began), when the captain signaled his decision to abandon the approach by stating “fifteen flaps,” the bank angle had not exceeded 20°, and the pitch angle was 8° nose down (approximately what it had been during the normal descent in the period leading up to the upset). However, speech analysis indicated that the captain’s “fifteen flaps” statement displayed a heightened level of speech fundamental frequency that was consistent with a sense of urgency. This sense of urgency was also indicated by the captain’s omission of a call-out item in the normal go-around procedure.101 Although many factors may have precipitated a go-around decision by the captain, a flight control difficulty, such as that produced by a rudder reversal, would have been consistent with the captain’s speed and urgency in making this decision. If the captain applied force to the left rudder pedal, he would have felt the pedal push strongly back against his foot pressure. Further, the Safety Board assumed that the captain would have acted to oppose a continuing uncommanded right yaw that was being 101 The captain did not state aloud “go-around thrust,” as specified in United’s go-around procedure.

Analysis 133 Aircraft Accident Report sustained by a reversing rudder; thus, the Safety Board’s computer simulation of the event increased the captain’s force on the left rudder pedal to 300 pounds within 1 second.102 During postaccident simulator exercises, the Safety Board determined that an immediate full left control wheel response during a right rudder reversal in the airspeed and flap configuration of United flight 585 could have allowed the flight crew to maintain control of the airplane. However, during a rudder jam and reversal, the captain of United flight 585 would have been contending with the distraction of the malfunctioning rudder and thus would have been devoting his physical effort to overpowering the rudder pedals. Further, the airplane’s yawing motion and heading changes (derived from the Board’s computer simulations) would have produced stronger cues than those produced by the rolling motion during the first few seconds of the upset, so the captain was likely focusing his attention on the rapid yaw acceleration that he could not control with the rudder. These circumstances would have been extremely confusing and distracting and would have been unknown to the flight crew based on previous experience. Thus, it would be understandable for the captain to have initially made a partial wheel input while contending with the powerful physical and mental demands of the problem with the rudder. The CVR evidence of increasing engine thrust indicated that the captain would have been using his right hand to advance the thrust levers for an attempted go-around. Thus, the captain would have had only his left hand available to rotate the wheel to the left, which would have made it difficult to achieve large left control wheel deflections. (This motion would have required the captain to pull his left arm down and across his body while twisting his left wrist.) Further, at the time of the left rudder input in the Safety Board’s simulation, the airplane was in about a 5° right bank. According to the Board’s assumption that the captain applied moderate left wheel (about one-third of the available control wheel) about 2 seconds later, the airplane would have been in a right bank of about 30°. On the basis of the time required for the captain to perceive the need for and execute his control input (about ¾ second), the bank angle that the captain would have been responding to with this moderate control wheel input was about 15°. With this relatively shallow roll angle, it would be normal for a pilot (especially an air carrier pilot) to first apply a moderate control input and then gauge the airplane’s response before making an extreme control input. (The Safety Board considers it likely that the first officer’s statement “Oh God” at 0943:32.6 referred to her concerns about the abrupt, sustained yaw rate and heading change resulting from the rudder’s reversal movement to its right blowdown limit and not about the airplane’s roll attitude or rate of change because the roll attitude was not excessive at that time.) The Safety Board’s computer simulation further indicated that the captain applied full control wheel to the left about 2 seconds later. 102 Although the Safety Board’s best-match simulation used 300 pounds of force reducing to 200 pounds, based on ergonomic and other research data (as discussed in section 1.18.3), the Safety Board was also able to obtain an excellent match with the FDR data using only the minimum pedal force necessary to sustain full rudder authority (about 70 pounds) and using 500 pounds of force.

Analysis 134 Aircraft Accident Report The computer simulation results also indicated that, within 2 seconds of rudder reversal, the pilots were experiencing as much as 0.44 G of sideforce from the right yaw acceleration. This sideforce would have made a left wheel input even more difficult for the captain because his body would have been pulled to the left and away from the control wheel, causing a tendency to level the wheel unless he quickly returned his right hand to the controls. Therefore, because of the unknown nature of a rudder reversal, the initially shallow roll angle, and the physical limitations that would have hindered an immediate full left control wheel input, the Safety Board considers it understandable that the captain might not have immediately applied a full left control wheel input to counter a reversing rudder. The Safety Board’s computer simulation showed that, about 0943:34, the bank angle of the airplane transitioned suddenly; by about 0943:35, only 3 seconds after the reversal, the right bank angle had increased to more than 80°. The Safety Board’s computer simulation also showed that the captain, at that time, rapidly moved the control wheel fully to the left. The airplane’s pitch angle had decreased to almost 30° nose down, and the pilots would have been able to see only the ground through the windshield. The Safety Board would expect that the captain would no longer be applying as much force to the left rudder pedal because he was likely focusing on holding a full left wheel input and attempting a go-around and the left rudder pedal would have forced him to a less efficient knee angle. Consequently, the Board’s computer simulation of the event moderated the captain’s force on the left rudder pedal to 200 pounds at that time. Shortly thereafter (perhaps in response to the loss of attitude reference), the captain apparently removed some of his left wheel inputs, perhaps because he was concentrating on aft control column pressure in an attempt to raise the airplane’s nose. By about 0943:36, the airplane rolled into an inverted attitude and the captain said “no” very loudly. Ground impact occurred about 5 seconds later, only 9 seconds after the rudder reversal began. The Safety Board concludes that analysis of the CVR, Safety Board computer simulation, and human performance data (including operational factors) from the United flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide. Also, because the United flight 585 upset occurred when the airplane was less than 1,000 feet above the ground, the pilots had very little time to react to or recover from the event. Thus, the Safety Board concludes that the flight crew of United flight 585 recognized the initial upset in a timely manner and took immediate action to attempt a recovery but did not successfully regain control of the airplane. The Safety Board further concludes that the flight crew of United flight 585 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight. The Safety Board also concludes that the training and pilot techniques developed as a result of the USAir flight 427 accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions

Analysis 135 Aircraft Accident Report of the flight envelope; such training was not yet developed and available to the flight crews of United flight 585 and USAir flight 427.103 2.7 Rudder System Jam Scenarios During the investigation of the USAir flight 427 accident, the Safety Board examined the rudder systems of the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes and was unable to identify any obvious physical evidence that a jam occurred within the servo valves. Further, the investigation had not revealed how the secondary slide could jam to the servo valve housing under conditions that would normally be encountered by an airplane in air carrier operations and not leave any physical evidence that the jam occurred. However, the Safety Board demonstrated that, in servo valves with tight clearances,104 the secondary slide could jam to the servo valve housing and leave no physical evidence of that jam (albeit under thermal conditions that would not normally be encountered by an airplane in air carrier operations). Further, small particulate matter in the hydraulic fluid could reduce the already tight clearances in the servo valve, requiring less of a thermal differential for the valve to jam. In addition, it is possible for a large amount of small particles to provide the jamming potential of a larger, stronger piece of metal without leaving a mark.105 Further, testing showed that, when the secondary slide was jammed to the servo valve housing and a sufficiently high-rate force was applied on the input crank, compliance within the rudder system could allow the primary slide to overtravel and result in a reverse rudder command. Therefore, the Safety Board concludes that it is possible that, in the main rudder PCUs from the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid, or other unknown factors), the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position without leaving any obvious physical evidence and that, combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input.106 In one or more of the three upset events, the main rudder PCU system could have malfunctioned in some way other than the rudder reversal scenario described such that the rudder moved uncommanded by a pilot to its aerodynamic blowdown limit, without 103 For more information about these training and piloting techniques, see the Board’s final report on the USAir flight 427 accident. 104 The Safety Board’s dimensional examination of the main rudder PCU servo valves from the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident revealed that the USAir and Eastwind servo valves had relatively tight clearances. The United servo valve was damaged so severely that accurate internal measurements could not be obtained. 105 Safety Board tests found that pieces of high-strength material could jam the servo valve but that they would leave a mark as a result of the jam. 106 For the Safety Board’s complete analysis of the USAir flight 427 accident and the Eastwind flight 517 incident, see the Board’s final report of the USAir flight 427 accident.

Analysis 136 Aircraft Accident Report leaving any physical evidence, just before the pilot commanded opposite rudder. However, the Safety Board is unaware of any mechanism by which this possibility could have occurred. Such a malfunction scenario would need to include an explanation for the reduction in the rudder hinge moment on Eastwind flight 517 to be consistent with the rudder movement on that upset event.107 To summarize, the Safety Board’s analysis indicates that the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident involved rudder deflections that could have only been the result of inappropriate pilot input or a malfunction of the rudder system (or possibly a rotor in the case of United flight 585). The Board and Boeing were able to perform computer simulations and kinematic analyses involving these explanations that resulted in good matches of the available FDR data. Further, Safety Board testing showed that the main rudder PCU servo valve could jam, without leaving a physical mark, in a way that could lead to rudder reversal. Additionally, in all three upset events, the available human performance data comported well with a rudder system malfunction but were inconsistent with an inappropriate pilot input (or a rotor in the case of United flight 585). The statements of the Eastwind flight 517 flight crew were fully consistent with an uncommanded rudder input. In addition, the Safety Board’s and Boeing’s computer simulation and kinematic studies both indicated that, in the Eastwind flight 517 incident, the rudder moved to a position consistent with rudder reversal but inconsistent with a normally operating rudder system (given the pilots’ consistent recollections of the captain applying great force to the rudder pedals). Therefore, the Safety Board concludes that the upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides. In addition to this reversal potential, the Safety Board’s investigation revealed two other potential failure mechanisms108 within the 737 rudder control system that could result in a deflection to the rudder’s blowdown limit. One of these potential failure mechanisms is a physical jam in the rudder system input linkage (between the PCU’s input crank and body stop), preventing the main rudder PCU control valve from closing; 107 The aerodynamic blowdown limit for the Eastwind flight 517 incident airplane, assuming normal (unreversed) operation, far exceeded the 6 to 6.5° rudder deflection that was apparently involved in the incident. According to Boeing, the rudder blowdown limits for the incident airplane (including the reduced hinge moment from the PCU’s excessive leakage at the bypass valve) would have been about 9° when operating at 250 knots under normal (unreversed) pilot command, with the variation depending on the sideslip value. Given the airplane’s leaking bypass valve and the reduced rudder hinge moment from a secondary slide jam at 55 percent from neutral), the aerodynamic blowdown limit would have been about 6.5°. 108 A third potential failure mechanism—a jam of the primary to the secondary slide with overtravel of the secondary slide—was identified as a result of testing after the July 1992 United Airlines rudder anomaly that occurred during a ground check. Although the testing determined that this mechanism could cause a rudder reversal, Boeing indicated that subsequent design changes in the servo valve eliminated this possibility.

Analysis 137 Aircraft Accident Report the other is a jam of the primary to the secondary slide of the main rudder PCU servo valve combined with a jam of the secondary slide to the servo valve housing at positions other than neutral (known as a dual jam). These failure mechanisms probably did not play a role in the USAir flight 427, United flight 585, and Eastwind 517 upsets.109 Nonetheless, the failure mechanisms are cause for concern because they further illustrate the vulnerability of the 737 rudder system to jams that could produce rudder deflections and result in catastrophic consequences. 2.8 Flight Data Recorder For updated information about FDR capabilities, see the Safety Board’s final report of the USAir flight 427 accident. 109 The Safety Board considers that a dual slide jam is a less likely accident scenario than a jam of the secondary slide to the servo valve housing because the dual jam would require two extremely rare failures to exist in the servo valve at the same time.

138 Aircraft Accident Report 3. Conclusions Note: Because the Safety Board’s analysis of the United flight 585 accident also included analysis of the USAir flight 427 accident and the Eastwind flight 517 incident, some of the findings pertain to these two events. 3.1 Findings 1. The flightcrew was certificated and qualified for the flight. 2. The airplane was properly certificated and maintained in accordance with existing regulations. Maintenance actions to correct the previous discrepancies related to uncommanded rudder inputs were proper and in accordance with maintenance manual procedures. 3. The airplane was dispatched in accordance with company procedures and Federal regulations. Dispatch of the airplane with an inoperative APU generator was not a factor in the accident. 4. There was no evidence that the performance of the flightcrew was affected by illness or incapacitation, fatigue or problems associated with personal or professional backgrounds. Procedures and callouts were made in accordance with UAL procedures. 5. There were no air traffic control factors in the cause of the accident. 6. There was no evidence of any preimpact failure or malfunction of the structure of the airplane or of the airplane's electrical, instrument, or navigation systems. 7. Both engines were operating and developing power at the time of impact. 8. The crew did not report any malfunction or difficulties. 9. Galling found on the input shaft and bearing from the standby rudder actuator power control unit could not cause sufficient rudder deflection to render the airplane uncontrollable.

1. It is very unlikely that the loss of control in the United flight 585 accident was

the result of an encounter with a mountain rotor.

1. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors) from the United Airlines flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

Conclusions 139 Aircraft Accident Report

1. The flight crew of United flight 585 recognized the initial upset in a timely

manner and took immediate action to attempt a recovery but did not successfully regain control of the airplane.

1. The flight crew of United flight 585 could not be expected to have assessed

the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.

1. Training and piloting techniques developed as a result of the USAir flight 427

accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions of the flight envelope; such training was not yet developed and available to the flight crews of USAir flight 427 or United flight 585.

1. It is possible that, in the main rudder power control units from the USAir

flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid, or other unknown factors), the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position without leaving any obvious physical evidence and that, combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input.

1. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517

were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the United Airlines flight 585 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.

140 Aircraft Accident Report 4. Recommendations Following incidents that involved anomalies in the B-737 rudder system, on November 10, 1992, the National Transportation Safety Board made the following recommendations to the Federal Aviation Administration: A-92-118 Require that Boeing develop a repetitive maintenance test procedure to be used by B-737 operators to verify the proper operation of the main rudder power control unit servo valve until a design change is implemented that would preclude the possibility of anomalies attributed to the overtravel of the secondary slide. A-92-119 Require that Boeing develop an approved preflight check of the rudder system to be used by operators to verify, to the extent possible, the proper operation of the main rudder power control unit servo valve until a design change is implemented that would preclude the possibility of rudder reversals attributed to the overtravel of the secondary slide. A-92-120 Require the operators, by airworthiness directive, to incorporate design changes for the B-737 main rudder power control unit servo valve when these changes are made available by Boeing. These changes should preclude the possibility of rudder reversals attributed to the overtravel of the secondary slide. A-92-121 Conduct a design review of servo valves manufactured by Parker Hannifin having a design similar to the B-737 rudder power control unit servo valve that control essential flight control hydraulic power control units on transport-category airplanes certified by the Federal Aviation Administration to determine that the design is not susceptible to inducing flight control malfunctions or reversals due to overtravel of the servo slides. On January 3, 1994, the FAA issued AD 94-01-07, which required repetitive tests of 737 main rudder PCUs to detect internal hydraulic fluid leakage until they are replaced with new PCUs containing servo valves designed to prevent secondary slide overtravel. On the basis of this AD, the Safety Board classified A-92-118 and –120 “Closed— Acceptable Action” in a letter dated August 11, 1994, and classified A-92-119 “Closed— Acceptable Alternate Action” in a letter dated August 14, 1994. With respect to A-92-121, on June 10, 1993, the Safety Board classified this recommendation “Closed—Acceptable Action” on the basis of the FAA’s review of servo valves manufactured by Parker Hannifin

Recommendations 141 Aircraft Accident Report on all transport-category airplanes and its determination that a problem existed only in 737 airplanes. Because of its concern about galled standby rudder actuator bearings on other B-737s and B-727s, on August 20, 1991, the Safety Board issued the following Safety Recommendation to the FAA: A-91-77 Issue an Airworthiness Directive requiring a check on all Boeing 737 and 727 model airplanes with the P/N 1087-23 input shaft in the rudder auxiliary actuator unit for the force needed to rotate the input shaft lever relative to the P/N 1087-22 bearing of the auxiliary actuator unit. During this check, the bearing should be inspected to determine if it rotates relative to the housing. All shaft assemblies in which rotation of the bearing occurs, or in which excessive force is needed to move the input lever, should be removed from service on an expedited basis and the assemblies should be replaced with a P/N 1087-21 shaft assembly that has a reduced diameter on the unlubricated portion of the shaft in accordance with revision G of the P/N 1087-23 engineering drawing. All assemblies meeting the force requirement should be rechecked at appropriate intervals until replaced with a P/N 1087-21 shaft assembly containing a P/N 1087-23 shaft that has a reduced diameter on the unlubricated portion of the shaft. The FAA's response to this recommendation, dated October 9, 1991, stated that it agreed with the intent of the safety recommendation and that it was considering the issuance of a notice of proposed rulemaking (NPRM) to address the problem. On November 21, 1991, the Safety Board responded to the FAA's letter, indicating that it was pleased with this response. Pending notification of progress on the NPRM, the Safety Board classified Safety Recommendation A-91-77 as “Open—Acceptable Response.” On January 3, 1992, the FAA issued an NPRM (Docket No. 91-NM-257-AD) proposing to adopt an airworthiness directive (AD) applicable to all Boeing Model 727-series airplanes and certain Model 737-series airplanes. This NPRM proposed to require inspection of the input shaft in the auxiliary (standby) rudder power control unit and to require reporting to the FAA on units that fail the inspection test procedure. In a letter dated March 27, 1992, the Safety Board expressed its concern to the FAA that the second part of the Safety Board's recommendation regarding inspection of the bearing was not included in the NPRM. The Safety Board believes that inspection of the bearing for rotation in the housing and for the integrity of the safety wire is an essential part of the entire inspection. Further, the Safety Board advised the FAA that it believed the proposed time frame for compliance with the inspection (4,000 flight hours) might be excessive. The letter stated that the proposed AD, if it included the modifications described above, would fulfill the intent of Safety Recommendation A-91-77. Pending notification of progress on the NPRM, the Safety Board classified A-91-77 as “Open— Acceptable Response.”

Recommendations 142 Aircraft Accident Report In its December 8, 1992, report on this accident, the Safety Board stated that because there had been no further action taken by the FAA on its proposed rulemaking and because another airline had found galled bearings during an inspection, it reiterated Safety Recommendation A-91-77 and urged the FAA to expedite action on its AD. In that report, the Safety Board classified A-91-77 as “Open—Unacceptable Action.” On April 19, 1993, the FAA issued a notice in the Federal Register to withdraw the NPRM. In an August 5, 1993, letter to the Safety Board, the FAA explained that it had reevaluated the design of the rudder control system on 727 and 737 airplanes and determined that fighters would be capable of detecting a galled condition by (1) increased force necessary to move the rudder pedal; (2) erratic nose gear steering with the yaw damper engaged; (3) rudder yaw damper kick back or yaw damper back drives on the rudder pedals during flight; and (4) erratic operation of the rudder yaw damper or erratic rudder oscillations with the yaw damper engaged. On November 15, 1993, the Safety Board noted it had no further evidence that galling could result in uncommanded rudder deflections of a significant magnitude and classified Safety Recommendation A-91-77 “Closed—Acceptable Alternate Action.” In addition, as a result of information developed during the course of this investigation, in its December 8, 1992, report on this accident the Safety Board reiterated the following two safety recommendations that it issued on July 20, 1992 to the Federal Aviation Administration: A-92-57 Develop and implement a meteorological program to observe, document, and analyze potential meteorological aircraft hazards in the area of Colorado Springs, Colorado, with a focus on the approach and departure paths of the Colorado Springs Municipal Airport. This program should be made operational by the winter of 1992. A-92-58 Develop a broader meteorological aircraft hazard program to include other airports in or near mountainous terrain, based on the results obtained in the Colorado Springs, Colorado, area. The FAA's response to these recommendations, dated October 8, 1992, stated that it agreed with the intent of these safety recommendations. The FAA anticipated, based on budget constraints and program priorities, that the work on these projects could start in fiscal year 1995. In its December 8, 1992, report on this accident, the Safety Board noted that the FAA agreed with the intent of these safety recommendations and that it planned to address their intent through an interagency program with the National Oceanic and Atmospheric Administration/Forecast Systems Laboratory or the National Science Foundation/National Center for Atmospheric Research. However, in that report the Safety

Recommendations 143 Aircraft Accident Report Board expressed its concern that the FAA believed that due to budget constraints and program priorities, these projects could not be started until fiscal year 1995. The Safety Board stated it understood the difficulty in funding these projects in fiscal year 1993, but believed that the FAA should reevaluate its priorities to include them in 1993. Pending further information concerning fiscal year 1993 funding, the Safety Board classified Safety Recommendations A-92-57 and A-92-58 as “Open—Unacceptable Response.” In a letter dated April 3, 1998, the FAA stated that it had completed several actions to improve the safety of flying in mountainous areas by providing pilots, dispatchers, and others in aviation operations with a series of products that will detect, display, and forecast hazardous mountain winds. Specifically, the FAA noted that, in conjunction with NOAA and NCAR, it had published Advisory Circular 00-57, “Hazardous Mountain Winds and Their Visual Indicators,” to assist pilots in diagnosing the potential for severe wind events in the vicinity of mountainous areas and to provide information on preflight planning techniques and inflight evaluation strategies for avoiding destructive turbulence and loss of aircraft control. In addition, the FAA noted that NOAA and NCAR personnel had collected data on the intensity and direction of wind flows at the Colorado Springs Airport during the period January through March 1997, when mountain-induced activity was known to be prevalent. The FAA stated that the original scope of the experiment at Colorado Springs that had been anticipated in response to Safety Recommendations A-92-57 and –58 had been reduced because of funding constraints and the overall assessments of the priority of safety-related research and, as a result, the project had been terminated. In a letter dated January 20, 1999, the Safety Board stated that it recognized the large amount of meteorological data collected during the Colorado Springs meteorological program in 1997 and urged the FAA to make every effort to ensure the complete and detailed analysis of these data and the timely publication of the results. On the basis of the results, and pending the issuance of a final report by NOAA and NCAR, Safety Recommendation A-92-57 was classified “Open—Acceptable Response.” Regarding Safety Recommendation A-92-58, the Safety Board stated its belief that the FAA should develop a broader meteorological aircraft hazard program to include other airports in or near mountainous areas. Pending the receipt of further information from the FAA about such a program, Safety Recommendation A-92-58 was classified “Open— Unacceptable Response.”

Recommendations 144 Aircraft Accident Report On March 2, 2000, the Safety Board requested that the FAA provide a progress report on the actions taken in response to Safety Recommendations A-92-57 and –58. BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: March 27, 2001

145 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing Investigation The National Transportation Safety Board was notified of the accident about 1200 hours Eastern Standard Time, on March 3, 1991. An investigation team was dispatched from Washington, D.C. late that afternoon and was met at the Colorado Springs Airport by personnel from the Safety Board's Fort Worth Regional office. After a brief visit to the accident site, an organizational meeting was held, during which on-scene investigative groups were formed for operations, structures, systems, weather, powerplants, survival factors and air traffic control. Later, groups were formed for aircraft performance, CVR, FDR, sound spectrum, human performance, maintenance records, and metallurgical examinations. Parties to the investigation were the FAA, United Airlines, Boeing Commercial Airplane Group, United Technologies-Pratt and Whitney, the National Air Traffic Controller Association, the International Association of Machinists and Aerospace Workers, and the Air Line Pilots Association. Public Hearing The Safety Board did not hold a public hearing on this accident.

146 Aircraft Accident Report Appendix B Personnel Information The captain, age 52, possessed an Airline Transport Pilot (ATP) certificate No. 1573331 dated September 19, 1989, which carried the following ratings: airplane multiengine land; B-737/A; commercial privileges for airplane single engine land. His current first class airman medical certificate, dated December 7, 1990, contained the restriction that he possess correcting glasses for near vision while exercising the privileges of his airman certificate. He had experience as a copilot (first officer) on UAL's B-727 and B-737 airplanes, as well as flight engineer experience (second officer) on the DC-8 and B-727. He had accrued a total flight time of 9,902 hours while employed with UAL, of which 1,732 was in the B-737-200. His pilot-in-command time in the B-737-200 was 891 hours and 31 minutes. His block to block time during the previous 24 hours, 72 hours, 30 days, and 90 days were 4 hours 15 minutes; 14 hours 27 minutes; 68 hours 20 minutes; and 195 hours 49 minutes, respectively. The first officer, age 42, held an ATP certificate No. 429961904 with the following ratings and limitations: airplane multiengine land; commercial privileges airplane single engine land. Her first class airman medical certificate, dated August 21, 1990, contained no limitations. She had accrued a total flight time of 3,903 hours of which 1,303 were with UAL. Her flight time in the B-737-200, all with UAL, was 1,077 hours. Her flight time the previous 24 hours, 72 hours, 30 days, and 90 days were 4 hours 15 minutes; 5 hours 24 minutes; 67 hours 42 minutes; and 189 hours 48 minutes. This was her second landing at Colorado Springs. She had conducted a total of 3 flights into and out of Denver during the 90-day period prior to the accident.

147 Aircraft Accident Report Appendix C Airplane Information The airplane was powered by two Pratt & Whitney JT8D-17 engines; serial number 702691 on the left, and serial number 708831 on the right. Engine records indicate that the left engine was installed on December 9, 1989, and had 26,659 hours and 20,627 cycles of operation. The right engine was installed on January 17, 1989, with 22,303 hours and 18,831 cycles of operation.

148 Aircraft Accident Report Appendix D Cockpit Voice Recorder Transcript Legend of communication descriptions, abbreviations, acronyms and symbols used in the attached CVR transcript: CAM Cockpit area microphone voice or sound source RDO Radio transmission from the accident aircraft COM Radio transmission to the accident aircraft (other than live ATC) NAV Navigational radio transmission to the accident aircraft PA Aircraft public address system –1 Voice (or position) identified as Captain –2 Voice (or position) identified as First Officer –? Unidentifiable voice DENTWR Denver Local Controller (tower) DENDEP Denver Departure Controller COSAPP Colorado Springs Approach Controller COSTWR Colorado Springs Local Controller (tower) * Unintelligible word # Expletive deleted … Pause ( ) Questionable text [ ] Editorial insertion – Break in continuity

Appendix D 149 Aircraft Accident Report

150 Aircraft Accident Report

Appendix D 151 Aircraft Accident Report

Appendix D 152 Aircraft Accident Report

Appendix D 153 Aircraft Accident Report

154 Aircraft Accident Report

Appendix D 155 Aircraft Accident Report

Appendix D 156 Aircraft Accident Report

Appendix D 157 Aircraft Accident Report

Appendix D 158 Aircraft Accident Report

Appendix D 159 Aircraft Accident Report

Appendix D 160 Aircraft Accident Report

Appendix D 161 Aircraft Accident Report

Appendix D 162 Aircraft Accident Report

Appendix D 163 Aircraft Accident Report

Appendix D 164 Aircraft Accident Report

Appendix D 165 Aircraft Accident Report

Appendix D 166 Aircraft Accident Report

Appendix D 167 Aircraft Accident Report

Appendix D 168 Aircraft Accident Report

Appendix D 169 Aircraft Accident Report

Appendix D 170 Aircraft Accident Report

Appendix D 171 Aircraft Accident Report

Appendix D 172 Aircraft Accident Report

Appendix D 173 Aircraft Accident Report

Appendix D 174 Aircraft Accident Report

Appendix D 175 Aircraft Accident Report

Appendix D 176 Aircraft Accident Report

Appendix D 177 Aircraft Accident Report

Appendix D 178 Aircraft Accident Report

179 Aircraft Accident Report Appendix E NCAR Weather Study

Appendix E 180 Aircraft Accident Report

Appendix E 181 Aircraft Accident Report

Appendix E 182 Aircraft Accident Report

Appendix E 183 Aircraft Accident Report

Appendix E 184 Aircraft Accident Report

Appendix E 185 Aircraft Accident Report

Appendix E 186 Aircraft Accident Report

Appendix E 187 Aircraft Accident Report

Appendix E 188 Aircraft Accident Report

Appendix E 189 Aircraft Accident Report

190 Aircraft Accident Report Appendix F Review of Literature and Correspondence Related to Severe Weather Phenomena The following are excerpts from literature and correspondence dealing with orographically induced weather phenomena: From "Aviation Aspects of Mountain Waves" World Meteorological Organization (WMO - No. 68. TP. 26): • By far the most common and most important seat of turbulence in mountain waves is the area of the rotor clouds. These clouds form in standing eddies under the wave crests at an altitude which is comparable with the height of the mountain that produces the wave. Measurements made in standing eddies downwind from the Montagne de Lure in France (height 1,400 meters above surrounding terrain) have revealed that the strong variations in the wind speed ranging from 10 to 25 meters per second (m/sec) occur inside these eddies and that the vertical speeds can vary from +8 m/sec to -5 m/sec in 2 or 3 seconds. This is equivalent to a vertical acceleration of 2 to 4 G. • Rotor turbulence is much more intense in waves generated by the larger mountains. Violent sharp-edged gusts exceeding 12 m/sec have been measured in some Sierra waves, and experienced pilots have reported complete loss of control of their aircraft for short periods while flying in the rotor areas. • The danger of rotor turbulence to aviation is accentuated by the fact that the downdraft in the lee of the rotor and the updraft on the other side of it can drag the aircraft into the rotor cloud. • The most dangerous situation occurs when lack of moisture prevents rotor cloud formation. In this case, no prior visual warning is given. • Mountain wave formation requires a marked degree of atmospheric stability in the lower layers. • Vertical variation of the wind is also important; and wind normal to the mountain ridge and the wind direction is almost constant with height. • Wave streaming occurs in the lower layers with strong winds that increase with height; in the lower levels stationary vortices form with reversed flow at ground level. • Rotor streaming occurs when a very strong wind extends to a limited height not to exceed 1.5 times the height of the ridge, and is capped by a layer of appreciably weaker wind. The disturbed part of the air flow is in the form of a system of quasi-stationary vortices rotating in opposite directions.

Appendix F 191 Aircraft Accident Report • Winds need to be within 30 degrees of the direction normal to the mountain ridge. • The presence of a jet stream with its high wind speeds and strong vertical windshear is an important factor in the occurrence of powerful waves particularly in the lee of large mountains such as the Rockies. • The turbulence within a system of standing lee-waves is most frequent and most severe in the standing eddies under the wave crests at mountain top level. From "Atmospheric Turbulence," John C. Houbolt, April 1973, AIAA Journal: • Wind flow over mountains often exhibits four characteristics: turbulence on the immediate lee side; a stratified gravity wave pattern, extending for great distances on the lee side; shear-induced rotors under the crests of the gravity waves; and lenticular like clouds at altitude in the wave crests. The lee side turbulence and turbulence associated with the rotors can be especially severe. • Generation by shear of severe rotors by a moving cold front is believed to be the cause of the crash of a BAC-111 airplane in Nebraska in August 1966. From "Synoptic Features of the Mountain Wave at Denver, Colorado," United Air Lines Meteorology Circular No. 41, October 1, 1956: • Requirements for mountain wave formation: wind flow normal to the range, with a wind speed of 25 knots or more at mountain top level; a wind profile which shows an increase in wind speed with altitude near mountain top level and a strong steady flow at higher levels to the tropopause; an inversion or stable layer somewhere below 600 millibars. From Aerospace Safety, April 1964, "B-52 Incident at Sangre de Cristo Mountains, Colorado": • We elected, since we were going to overfly the low level course at this intermediate altitude, to run through the 350 knot condition at 14,000 feet altitude. From this relatively smooth air, we hit what I would term near catastrophic turbulence. The encounter was very sudden and lasted about 10 seconds. During the first part of the encounter, the airplane appeared to be stable in that it wasn't moving in roll nor particularly in yaw, and there wasn't anything on the instruments that would indicate anything more than normal excursions. As the encounter progressed, we received a very sharp-edged blow which was followed by many more. As the first sharp-edged encounter started bleeding off, we developed an almost instantaneous rate of roll at fairly high rate. The roll was to the far left and the nose was swinging up and to the right at a rapid rate. During the second portion of the encounter, the airplane motions actually seemed to be negating my control inputs. I had the rudder to the firewall, the column in my lap, and full wheel, and I wasn't having any luck righting the airplane.

Appendix F 192 Aircraft Accident Report • The aircraft was struck by severe clear air turbulence of mountain wave origin. The winds about the time of the incident were 65 knots out of the west and 27 knots out of the south (resultant vector magnitude 70 knots). Additional information regarding the above incident: From Boeing memorandum on January 28, 1964: • Turbulence in the lee of a peak due to high winds can be expected to cause some sharp-edged gusts which may excite structural modes. • The airplane is believed to have flown through an area containing the combined effects of a rotor associated with a mountain wave and lateral shear due to airflow around a large peak. • The gust initially built up from the right to a maximum of about 45 feet per second (TAS) [true airspeed], then reversed to a maximum of 36 feet per second (TAS) from the left, before swinging to a straight downdraft of 85 feet per second (TAS). Next, there was a build-up to a maximum of about 147 feet per second (TAS) from the left, followed by a return to 31 feet per second (TAS). • This pattern of variation of gust velocity and intensity is believed to be consistent with the probable occurrence of mountain waves in the area. Its character is essentially that which is associated with the rotor or roll cloud, which stands in the lee of a ridge at approximately the same altitude. From "Turbulent Kinetic Energy Budgets Over Mountainous Terrain," Theodore S. Karcostas and John D. Marwitz, Journal of Applied Meteorology, February 1980: • Airflow around Elk Mountain in Wyoming. The streamlines diverge on the windward side of the mountain and converge behind it, causing the air to flow up the lee slope. A flow separation occurred due to a contribution of factors, including the adverse pressure gradient, the friction and the shape of the mountain. A reverse eddy-type flow occupied the space between the separated streamlines and the mountain. The separated area was characterized by generally high mixing rates, lower wind speed and regions of systematic reverse flow. This reversal was accompanied by the formation of a large semipermanent eddy. The wind speed increased along either side of the mountain. Due to the flow separation, two high speed jets of 18 meters per second were present on each side of the mountain. • A rather interesting phenomenon was observed downwind of Elk. A buoyant eddy of less than 1 kilometer in size was detected by aircraft. From “Mesoscale Meteorology and Forecasting,” American Meteorological Society, 1986: • Strong mountain waves are likely to develop when mountain barrier has a steep lee slope; upstream temperature profile exhibits an inversion or a layer of strong stability near mountain top height with weaker stability at higher levels.

Appendix F 193 Aircraft Accident Report • The strongest Colorado Chinooks occur during wave events when there is a large region of high pressure upstream of the mountains to the west, and a rapidly developing lee-side trough or low pressure center in the high plains to the east or northeast. From "Mesoscale Atmospheric Circulations," B.W. Atkinson, 1981: • Beneath a well-established mountain wave lay a rotor in which the air at the base generally moves toward the mountain front. This is now a well- established phenomenon of lee-wave situations, particularly when the latter are well developed. Owing to the large vertical shear in the rotor, the characteristic roll cloud which often forms has the appearance of rotating about a horizontal axis. The low level winds beneath rotors are much lighter than elsewhere, but violent turbulence frequently occurs in the vicinity of rotor clouds. From “A Review of the Evidence for Strong, Small-Scale Vortical Flows During Downslope Windstorms,” A.J. Bedard, Jr.,1990: • Paper presents evidence for the existence of vortical flows and other small- scale features associated with downslope windstorms. • Some of these obstacle-induced circulations appear directly related to mountain lee waves producing near-surface effects. Hallet (1969) described an observation of a rotor-induced dust devil, and Bergen (1976) reviewed evidence for the occurrence of “mountainadoes” as a significant source of damage in the Boulder, Colorado, region. • One interpretation of these observations of damage is that a concentrated jet of air approached the surface. If it is associated with a lee wave segment interacting with an upstream obstacle, or gap between obstacles, such a jet could have strong vertical axis vorticity on its periphery. • From the tree damage pattern, a radius of 30 meters seems reasonable for an eddy core size. For a mean wind speed of 30 meters per second, a maximum tangential speed of the eddy of greater than 75 meters per second is obtained. From "Front Range Windstorms Revisited," Edward J. Zipser and Alfred J. Bedard, Jr., Weatherwise, April 1982: • The sporadic high wind events at Boulder took place in a limited easterly flow region, in a pattern aloft that could be attributed to a rather large rotor at low levels.

194 Aircraft Accident Report Appendix G LLWAS Sensors and Plots of Data

Appendix G 195 Aircraft Accident Report

Appendix G 196 Aircraft Accident Report

FD07232 ｜ 2001_美国_AAR0102.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 AIRCRAFT ACCIDENT REPORT PB2001-910402 NTSB/AAR-01/02 DCA99MA060 RUNWAY OVERRUN DURING LANDING AMERICAN AIRLINES FLIGHT 1420 MCDONNELL DOUGLAS MD-82, N215AA LITTLE ROCK, ARKANSAS JUNE 1, 1999 7195A

this page intentionally left blank

Aircraft Accident Report Runway Overrun During Landing American Airlines Flight 1420 McDonnell Douglas MD-82, N215AA Little Rock, Arkansas June 1, 1999 NTSB/AAR-01/02 PB2001-910402 National Transportation Safety Board Notation 7195A 490 L’Enfant Plaza, S.W. Adopted October 23, 2001 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2001. Runway Overrun During Landing, American Airlines Flight 1420, McDonnell Douglas MD-82, N215AA, Little Rock, Arkansas, June 1, 1999. Aircraft Accident Report NTSB/AAR-01/02. Washington, DC. Abstract: This report explains the accident involving American Airlines flight 1420, a McDonnell Douglas MD-82, which crashed after it overran the end of runway 4R during landing at Little Rock National Airport in Little Rock, Arkansas. Safety issues discussed in this report focus on flight crew performance, flight crew decision-making regarding operations in adverse weather, pilot fatigue, weather information dissemination, emergency response, frangibility of airport structures, and Federal Aviation Administration (FAA) oversight. Safety recommendations concerning these issues are addressed to the FAA and the National Weather Service. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-910402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5.3 The Flight Attendants. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.6.1 Maintenance Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.6.2 Spoiler System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.6.2.1 Testimony on Spoiler System Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.2.2 Other Spoiler Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.6.3 Braking System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.6.4 Weight and Balance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.6.5 N215AA’s Previous Flights on the Day of the Accident. . . . . . . . . . . . . . . . . . . . . 22 1.6.6 MD-80 Demonstrated Landing Distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.7.1 Airport Weather Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.7.2 National Weather Service Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.7.3 American Airlines Weather Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.7.4 Additional Weather Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.7.4.1 Lightning Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.7.4.2 Witness Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.7.4.3 Windshear Hazard Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.9 Communications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.10.1 Runway 4R/22L Safety Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.10.2 Runway 22L Approach Lighting System Support Structure . . . . . . . . . . . . . . . . . . 37 1.10.3 Runway 4R Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.10.3.1 Tire Marks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.10.3.2 Runway Surface Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.10.4 Air Traffic Control Tower Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.12.1 General Wreckage Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Contents iv Aircraft Accident Report 1.12.2 Spoiler System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.12.3 Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.12.4 Landing Gear and Brake Assemblies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.15.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.15.2 Evacuation of Passengers and Crewmembers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.15.3 Emergency Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.15.4 Passenger Statements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.16.1 Spoiler System Ground Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.16.1.1 Testing Conducted After the Palm Springs Incident . . . . . . . . . . . . . . . . . . . . . . 56 1.16.2 Main Landing Gear Tire Examination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.16.3 Cockpit Voice Recorder Sound Spectrum Study. . . . . . . . . . . . . . . . . . . . . . . . . . . 58 1.16.4 Airplane Performance Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 1.16.4.1 Calculated Ground Trajectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 1.16.4.2 Ground Deceleration Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 1.16.5 Engineered Materials Arresting System Computer Model . . . . . . . . . . . . . . . . . . . 63 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 1.17.1 Aviation Safety Action Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 1.17.2 Flight Crew Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 1.17.2.1 Simulator Flight Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.17.2.2 Observations of Simulator Sessions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 1.17.2.3 Human Factors and Safety Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1.17.3 Approach Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.17.3.1 Approach Briefing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.17.3.2 Before Landing Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.17.3.2.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.17.3.3 Crew Coordination Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 1.17.3.4 Stabilized Approach Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 1.17.3.4.1 Federal Aviation Administration Guidance . . . . . . . . . . . . . . . . . . . . . . . . . 75 1.17.3.5 Thunderstorm and Windshear Avoidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.17.3.6 Continuation of an Approach Below the Decision Height . . . . . . . . . . . . . . . . . 77 1.17.3.7 Missed Approach Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.17.4 Landing Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.17.4.1 Wind Landing Limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.17.4.1.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.17.4.2 Spoiler Deployment Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.17.4.2.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.17.4.3 Braking Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.17.4.3.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 1.17.4.4 Use of Reverse Thrust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 1.17.4.4.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 1.17.4.4.2 MD-80 All Operators Letter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 1.17.5 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 1.17.5.1 DC-9 Operating Manual Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.17.5.2 Flight Manual Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 1.17.6 Federal Aviation Administration Oversight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 1.17.6.1 Principal Operations Inspector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Contents v Aircraft Accident Report 1.17.6.2 Aircrew Program Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 1.18.1 Runway Friction Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 1.18.2 Study on Thunderstorm Penetration in the Terminal Area . . . . . . . . . . . . . . . . . . . 94 1.18.3 Studies on Flight Crew Decision-Making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 1.18.3.1 Safety Board Study of Flight Crew Involvement in Major Accidents. . . . . . . . . 95 1.18.3.2 National Aeronautics and Space Administration Study on Flight Crew Decision Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 1.18.4 Technologies to Detect and Locate Downed Airplanes. . . . . . . . . . . . . . . . . . . . . . 96 1.18.5 Previous Weather-Related Accidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 1.18.5.1 Previous Weather-Related Safety Recommendations . . . . . . . . . . . . . . . . . . . . . 98 1.18.6 Previous Fatigue-Related Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 1.18.6.1 Previous Fatigue-Related Safety Recommendation. . . . . . . . . . . . . . . . . . . . . . 103 1.18.6.2 Additional Fatigue Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 1.18.7 Other Previous Related Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 1.18.7.1 Accidents Involving Rescue Efforts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 1.18.7.2 Accidents Involving Delayed Emergency Response. . . . . . . . . . . . . . . . . . . . . 108 1.18.8 Other Previous Related Safety Recommendations . . . . . . . . . . . . . . . . . . . . . . . . 109 1.18.8.1 Aircraft Operations in the Airport Environment . . . . . . . . . . . . . . . . . . . . . . . . 109 1.18.8.2 Stabilized Approach Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.18.8.3 Manufacturer’s Operating Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.2 Accident Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.2.1 The Approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.2.1.1 Descent Into the Terminal Area. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.2.1.2 Maneuvering to the Airport for Final Approach . . . . . . . . . . . . . . . . . . . . . . . . 115 2.2.1.3 Final Approach Segment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.2.1.4 Summary of the Flight Crew’s Performance During the Approach . . . . . . . . . 126 2.2.2 The Landing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.2.2.1 Lack of Spoiler Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.2.2.1.1 Autospoiler Arming. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 2.2.2.1.2 Checklist Design Regarding Spoiler Arming . . . . . . . . . . . . . . . . . . . . . . . 132 2.2.2.1.3 Manual Spoiler Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 2.2.2.2 Use of Reverse Thrust Above 1.3 Engine Pressure Ratio . . . . . . . . . . . . . . . . . 135 2.2.2.3 Use of Manual Braking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 2.2.2.4 Summary of the Landing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.2.3 Human Factors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 2.2.3.1 The Role of Situational Stress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 2.2.3.1.1 Industry Standards and Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 2.2.3.2 The Role of Fatigue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 2.3 Meteorological Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 2.3.1 Weather Information Provided by the Local Controller . . . . . . . . . . . . . . . . . . . . 146 2.3.1.1 Weather Information Depiction on Air Traffic Control Radar Systems . . . . . . 147 2.3.2 Additional En Route Weather Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.3.2.1 Dispatch Office Weather Radar. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.3.2.2 Center Weather Service Unit Staffing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 2.3.2.3 Automated Surface Observing System Lockout Period . . . . . . . . . . . . . . . . . . 149 2.3.3 Airport Weather Equipment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Contents vi Aircraft Accident Report 2.3.3.1 Runway Visual Range System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 2.3.3.2 Low Level Windshear Alert System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 2.4 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 2.4.1 Aircraft Rescue and Fire Fighting Staffing Levels . . . . . . . . . . . . . . . . . . . . . . . . 154 2.4.2 Crash Detection and Location Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 2.4.3 Interagency Emergency Response Critique. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 2.5 Airport Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 2.5.1 Runway Safety Areas. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 2.5.2 Nonfrangible Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 2.6 American Airlines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 2.6.1 Stabilized Approach Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 2.6.2 Spoiler System Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 2.6.3 Spoiler and Braking Systems Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 2.7 Federal Aviation Administration Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
2. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

A: Investigation and Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 C: Automated Surface Observing System Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

vii Aircraft Accident Report Figures

1. Flight 1420’s Approach Path to the Airport and Key CVR Comments. . . . . . . . . . . . . . . . . . . . . . . . 7
2. Spoiler Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3. Spoiler Hydraulic System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4. Spoiler Handle in the Unarmed Position. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5. Spoiler Handle in the Armed Position. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
6. Position of the Crank Arm and Roller With the Spoiler Handle in the

Unarmed and Armed Positions (View From Forward Right to Aft Left) . . . . . . . . . . . . . . . . . . . . . . 19

1. 0.4° Base Reflectivity Scan at 2334:27. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2. 0.4° Base Reflectivity Scan at 2340:28. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3. 0.4° Base Reflectivity Scan at 2345:57. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4. 0.4° Base Reflectivity Scan at 2351:59. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5. Radial Velocity Image Surrounding the Time of the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
6. Aerial Photograph of Runway 4R/22L, Airplane Wreckage, and

Runway 22L Approach Lighting System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

1. Airplane Wreckage and Runway 22L Approach Lighting System. . . . . . . . . . . . . . . . . . . . . . . . . . . 45
2. View of Left Side of Airplane Wreckage and Runway 22L Approach Lighting System. . . . . . . . . . 45
3. Interior Airplane Configuration and Occupant Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4. Effects of Spoilers, Brakes, and Reverse Thrust on Stopping Distance . . . . . . . . . . . . . . . . . . . . . . . 62
5. Categories of the Postaccident Audit Recommendations According to

Expected Completion Date and Safety Value . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

1. Weather and Flight Information for 2339:12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
2. Weather and Flight Information for 2339:45 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
3. Weather and Flight Information for 2342:55 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
4. Weather and Flight Information for 2344:30 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118

Figures viii Aircraft Accident Report

1. Weather and Flight Information for 2345:47 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
2. Weather and Flight Information for 2346:52 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
3. Weather and Flight Information for 2347:08 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
4. Weather and Flight Information for 2349:12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
5. Weather and Flight Information for 2350:02 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

ix Aircraft Accident Report Abbreviations AC advisory circular ACARS aircraft communication addressing and reporting system AD airworthiness directive afl above field level agl above ground level AIM Aeronautical Information Manual APM aircrew program manager ARFF aircraft rescue and fire fighting ARTCC air route traffic control center ASAP American Airlines Safety Action Program ASOS Automated Surface Observing System ASR Airport Surveillance Radar ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service ATOS Air Transportation Oversight System CAMI Civil Aerospace Medical Institute CFR Code of Federal Regulations CVR cockpit voice recorder CWSU center weather service unit DA decision altitude D-BRITE Digital Bright Radar Indicator Terminal Equipment dBz decibel DEVS Driver’s Enhanced Vision System DH decision height DOT Department of Transportation

Abbreviations x Aircraft Accident Report ELT emergency locator transmitter EMAS Engineered Materials Arresting System EPR engine pressure ratio FAA Federal Aviation Administration FCOM flight crew operating manual FDR flight data recorder fpm feet per minute GPWS ground proximity warning system HBAT Flight Standards Handbook Bulletin for Air Transportation Hg mercury HIWAS Hazardous In-flight Weather Advisory Service Hz hertz IFR instrument flight rules ILS instrument landing system IOE initial operating experience LLWAS Low Level Windshear Alert System LOFT line-oriented flight training MDA minimum descent altitude MEL minimum equipment list MEMS Metropolitan Emergency Medical Services METAR meteorological aerodrome report mHz megahertz msl mean sea level NASA National Aeronautics and Space Administration nm nautical mile NPRM notice of proposed rulemaking NWS National Weather Service POI principal operations inspector psi pounds per square inch

Abbreviations xi Aircraft Accident Report PTRS Program Tracking and Reporting System RVR runway visual range SDR service difficulty report SIGMEC significant meteorological condition SIGMET significant meteorological information SPECI special weather observation TAF terminal aerodrome forecast TDWR Terminal Doppler Weather Radar TRACON terminal radar approach control TSA time since awakening UTC coordinated universal time Vref reference airspeed for landing VFR visual flight rules VOR very high frequency omnidirectional radio range WSP Weather Systems Processor WSR-88D Weather Surveillance Radar 1988 Doppler system

xii Aircraft Accident Report Executive Summary On June 1, 1999, at 2350:44 central daylight time, American Airlines flight 1420, a McDonnell Douglas DC-9-82 (MD-82), N215AA, crashed after it overran the end of runway 4R during landing at Little Rock National Airport in Little Rock, Arkansas. Flight 1420 departed from Dallas/Fort Worth International Airport, Texas, about 2240 with 2 flight crewmembers, 4 flight attendants, and 139 passengers aboard and touched down in Little Rock at 2350:20. After departing the end of the runway, the airplane struck several tubes extending outward from the left edge of the instrument landing system localizer array, located 411 feet beyond the end of the runway; passed through a chain link security fence and over a rock embankment to a flood plain, located approximately 15 feet below the runway elevation; and collided with the structure supporting the runway 22L approach lighting system. The captain and 10 passengers were killed; the first officer, the flight attendants, and 105 passengers received serious or minor injuries; and 24 passengers were not injured. The airplane was destroyed by impact forces and a postcrash fire. Flight 1420 was operating under the provisions of 14 Code of Federal Regulations Part 121 on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable causes of this accident were the flight crew’s failure to discontinue the approach when severe thunderstorms and their associated hazards to flight operations had moved into the airport area and the crew’s failure to ensure that the spoilers had extended after touchdown. Contributing to the accident were the flight crew’s (1) impaired performance resulting from fatigue and the situational stress associated with the intent to land under the circumstances, (2) continuation of the approach to a landing when the company’s maximum crosswind component was exceeded, and (3) use of reverse thrust greater than 1.3 engine pressure ratio after landing. The safety issues in this report focus on flight crew performance, flight crew decision-making regarding operations in adverse weather, pilot fatigue, weather information dissemination, emergency response, frangibility of airport structures, and Federal Aviation Administration (FAA) oversight. Safety recommendations concerning these issues are addressed to the FAA and the National Weather Service.

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On June 1, 1999, at 2350:44 central daylight time,1 American Airlines flight 1420, a McDonnell Douglas DC-9-82 (MD-82), N215AA, crashed after it overran the end of runway 4R during landing at Little Rock National Airport in Little Rock, Arkansas. Flight 1420 departed from Dallas/Fort Worth International Airport, Texas, about 2240 with 2 flight crewmembers, 4 flight attendants, and 139 passengers aboard and touched down in Little Rock at 2350:20. After departing the end of the runway, the airplane struck several tubes extending outward from the left edge of the instrument landing system (ILS) localizer array, located 411 feet beyond the end of the runway; passed through a chain link security fence and over a rock embankment to a flood plain, located approximately 15 feet below the runway elevation; and collided with the structure supporting the runway 22L approach lighting system. The captain and 10 passengers were killed; the first officer, the flight attendants, and 105 passengers received serious or minor injuries; and 24 passengers were not injured.2 The airplane was destroyed by impact forces and a postcrash fire. Flight 1420 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 on an instrument flight rules (IFR) flight plan. Flight 1420 was the third and final leg of the first day of a 3-day sequence for the flight crew. The flight sequence began at O’Hare International Airport, Chicago, Illinois. According to American Airlines company records, the captain checked in for the flight about 1038, and the first officer checked in about 1018. Flight 1226, from Chicago to Salt Lake City International Airport, Utah, departed about 1143 and arrived about 1458 (1358 mountain daylight time). Flight 2080, from Salt Lake City to Dallas/Fort Worth, departed about 1647 (1547 mountain daylight time) and arrived about 2010, 39 minutes later than scheduled because of an airborne hold during the approach resulting from adverse weather in the airport area. The captain was the flying pilot for flight 1226, and the first officer was the flying pilot for flight 2080. Flight 1420, from Dallas/Fort Worth to Little Rock, was scheduled to depart about 2028 and arrive about 2141. However, before its arrival at Dallas/Fort Worth, the flight crew received an aircraft communication addressing and reporting system (ACARS)3 message indicating a delayed departure time of 2100 for flight 1420. After deplaning from flight 2080, the flight crew proceeded to the departure gate for flight

1. The flight crew then received trip paperwork for the flight, which included an

American Airlines weather advisory for a widely scattered area of thunderstorms along 1Unless otherwise indicated, all times in this report are central daylight time, based on a 24-hour clock. 2 See section 1.2 for an injury chart. 3 ACARS is a data link system that, among other things, enables airline dispatchers and flight crews to communicate via text messages while an airplane is in flight.

Factual Information 2 Aircraft Accident Report the planned route and two National Weather Service (NWS) in-flight weather advisories for an area of severe thunderstorms4 along the planned route.5 The airplane originally intended to be used for the flight was delayed in its arrival to Dallas/Fort Worth because of the adverse weather in the area. After 2100, the first officer notified gate agents that flight 1420 would need to depart by 2316 because of American’s company duty time limitation.6 The first officer then telephoned the flight dispatcher to suggest that he get another airplane for the flight or cancel it.7 Afterward, the accident airplane, N215AA, was substituted for flight 1420. The flight’s 2240 departure time was 2 hours 12 minutes later than the scheduled departure time. The captain was the flying pilot, and the first officer was the nonflying pilot. About 2254, the flight dispatcher sent the flight crew an ACARS message indicating that the weather around Little Rock might be a factor during the arrival. The dispatcher suggested that the flight crew expedite the arrival to beat the thunderstorms if possible, and the flight crew acknowledged this message. The first officer indicated, in a postaccident interview, that “there was no discussion of delaying or diverting the landing” because of the weather. According to the predeparture trip paperwork, two alternate airports—Nashville International Airport, Tennessee, and Dallas/Fort Worth— were specified as options in case a diversion was needed. Beginning about 2258, flight 1420 was handled by controllers from the Fort Worth Air Route Traffic Control Center (ARTCC). About 2304, the Fort Worth center broadcast NWS Convective SIGMET [significant meteorological information] weather advisory 15C for an area of severe thunderstorms that included the Little Rock airport area. The cockpit voice recorder (CVR) indicated that the flight crew had discussed the weather and the need to expedite the approach. At 2325:47, the captain stated, “we got to get over there quick.” About 5 seconds later, the first officer said, “I don’t like that…that’s lightning,” to which the captain replied, “sure is.” The CVR also indicated that the flight crew had the city of Little Rock and the airport area in sight by at 2326:59. About 2327, the Fort Worth center cleared the flight to descend to 10,000 feet mean sea level (msl) and provided an altimeter setting of 29.86 inches of mercury (Hg). The flight was transferred about 2328 to the Memphis ARTCC, which provided the same altimeter setting.8 4 A severe thunderstorm has winds measuring 50 knots (58 mph) or greater, 3/4-inch or larger hail, or tornadoes and can produce torrential rain and frequent lightning. 5 See section 1.7 for specific details on weather advisories discussed in this section. 6 American Airlines’ maximum pilot duty time (by contractual agreement with the Allied Pilots Association) is 14 hours from the scheduled time of check-in for the first flight leg to the time that the last flight leg is scheduled to land. 7 The flight dispatcher stated that he received the first officer’s call between 2150 and 2200. 8 The Center Weather Service Unit (CWSU) of the Memphis center was staffed for 16-hour operation and had closed about 2130.

Factual Information 3 Aircraft Accident Report According to the CVR, the flight crew contacted the Little Rock Air Traffic Control Tower (ATCT) at 2334:05. The controller advised the flight crew that a thunderstorm located northwest of the airport was moving through the area and that the wind was 280º at 28 knots gusting to 44 knots. The first officer told the controller that he and the captain could see the lightning. The controller told the flight crew to expect an ILS approach to runway 22L.9 The first officer indicated in a postaccident interview that, during the descent into the terminal area, the weather appeared to be about 15 miles away from the airport and that he and the captain thought that there was “some time” to make the approach. The CVR indicated that, between at 2336:04 and at 2336:13, the captain and first officer discussed American Airlines’ crosswind limitation for landing. The captain indicated that 30 knots was the crosswind limitation but realized that he had provided the limitation for a dry runway. The captain then stated that the wet runway crosswind limitation was 20 knots, but the first officer stated that the limitation was 25 knots. In testimony at the National Transporation Safety Board’s public hearing on this accident,10 the first officer stated that neither he nor the captain checked the actual crosswind limitation in American’s flight manual. The first officer testified that he had taken the manual out but that the captain had signaled him to put the manual away because the captain was confident that the crosswind limitation was 20 knots.11 At 2339:00, the controller cleared the flight to descend to an altitude of 3,000 feet msl. The controller then asked the flight crew about the weather conditions along the runway 22L final approach course, stating his belief that the airplane’s weather radar was “a lot better” than the weather radar depiction available in the tower. At 2339:12, the first officer stated, “okay, we can…see the airport from here. We can barely make it out but we should be able to make [runway] two two…that storm is moving this way like your radar says it is but a little bit farther off than you thought.” The controller then offered flight 1420 a visual approach to the runway, but the first officer indicated, “at this point, we really can’t make it out. We’re gonna have to stay with you as long as possible.” At 2339:45, the controller notified flight 1420 of a windshear alert,12 reporting that the centerfield wind was 340º at 10 knots, the north boundary wind was 330º at 25 knots, 9 The ILS is a precision approach system consisting of a localizer and a glideslope, which provide lateral and vertical guidance, respectively, to a runway. The system uses ground-based radio transmitters that provide both the localizer and the glideslope signals. 10 The Safety Board held a public hearing on this accident from January 26 to 28, 2000, in Little Rock (see appendix A). The Board may hold a public hearing as part of its investigation into an accident to supplement the factual record of the investigation. The Board calls technical experts and material witnesses to testify, and Board investigative staff and designated representatives from the parties to the investigation ask questions to obtain additional factual information. The hearing is not intended to analyze factual information for cause. 11 The captain correctly indicated that 20 knots was the crosswind limitation for landing on a wet runway. See section 1.17.4.1 for additional information on American’s crosswind limitations. 12 Windshear is generally defined as a change in wind direction and/or speed over a short distance. Windshear alerts for Little Rock airport are issued by a Low Level Windshear Alert System (LLWAS), which is explained in section 1.7.1.

Factual Information 4 Aircraft Accident Report and the northwest boundary wind was 010º at 15 knots. The flight crew then requested runway 4R so that there would be a headwind, rather than a tailwind, during landing. At 2340:20, the controller instructed the flight crew to fly a heading of 250º for vectors to the runway 4R ILS final approach course. After reaching the assigned heading, the airplane was turned away from the airport and clear of the thunderstorm that had previously been reported by the controller. The CVR indicated that, between 2340:46 and 2341:31, the first officer stated the localizer frequency and course, the decision altitude, the minimum safe altitude, and a portion of the missed approach procedure for runway 4R. Between 2342:19 and 2342:24, the CVR indicated that the captain asked the first officer, “do you have the airport? Is that it right there? I don’t see a runway.” At 2342:27, the controller told the flight crew that the second part of the thunderstorm was apparently moving through the area and that the winds were 340º at 16 knots gusting to 34 knots. At 2342:40, the first officer asked the captain whether he wanted to accept “a short approach” and “keep it in tight.” The captain answered, “yeah, if you see the runway. ‘cause I don’t quite see it.” The first officer stated, “yeah, it’s right here, see it?” The captain replied, “you just point me in the right direction and I’ll start slowing down here.” At 2342:55, the first officer said, “it’s going right over the…field.” At 2342:59, the first officer told the controller, “well we got the airport. We’re going between clouds. I think it’s right off my, uh, three o’clock low, about four miles.” The controller then offered a visual approach for runway 4R, and the first officer accepted. At 2343:11, the controller cleared flight 1420 for a visual approach to runway 4R and indicated “if you lose it, need some help, let me know please.” At 2343:35, the first officer stated, “you’re comin’ in. There’s the airport.” Three seconds later, the captain stated, “uh, I lost it,” to which the first officer replied, “see it’s right there.” The captain then stated, “I still don’t see it...just vector me. I don’t know.” At 2343:59, the controller cleared flight 1420 to land and indicated that the winds were 330º at 21 knots. At 2344:19, the captain stated, “see we’re losing it. I don’t think we can maintain visual.” At 2344:30, the first officer informed the controller that visual contact with the airport had been lost because of a cloud between the airplane and the airport. The controller then cleared the airplane to fly a heading of 220º for radar vectors for the ILS approach to runway 4R and directed the flight to descend to and maintain 2,300 feet msl. At 2345:47, the first officer told the controller “we’re getting pretty close to this storm. we’ll keep it tight if we have to.” The controller indicated to the flight crew that, “when you join the final, you’re going to be right at just a little bit outside the marker if that’s gonna be okay for ya.” The captain stated, “that’s great,” and the first officer told the controller, “that’s great with us.” At 2346:39, the controller advised the flight crew that the airplane was 3 miles from the outer marker.13 13 The outer marker is located 5.9 miles from the airport. In a postaccident interview, the first officer stated that, at this point, there was urgency to land because the weather was “up against” the airport.

Factual Information 5 Aircraft Accident Report At 2346:52, the captain stated, “aw, we’re goin’ right into this.” At the same time, the controller reported that there was heavy rain at the airport, the automatic terminal information service (ATIS) information in effect at the time was no longer current,14 the visibility was less than 1 mile, and the runway visual range (RVR)15 for runway 4R was 3,000 feet. The first officer acknowledged this information. At 2347:08, the controller again cleared flight 1420 to land and indicated that the wind was 350º at 30 knots gusting to 45 knots. The first officer then read back the wind information as 030º at 45 knots. At 2347:22, the captain stated, “three thousand RVR. We can’t land on that.” Four seconds later, the first officer indicated that the RVR for runway 4R was 2,400 feet, and the captain then said, “okay, fine.”16 At 2347:44, the captain stated, “landing gear down,” and the CVR recorded a sound consistent with the landing gear being operated. About 5 seconds later, the captain stated, “and lights please.” At 2347:53, the controller issued a second windshear alert for the airport, reporting that the centerfield wind was 350º at 32 knots gusting to 45 knots, the north boundary wind was 310º at 29 knots, and the northeast boundary wind was 320º at 32 knots. This transmission was not acknowledged by the flight crew. At 2348:10, the captain stated, “add twenty [knots],” to which the first officer replied, “right.” At 2348:12, the controller reported that the runway 4R RVR was now 1,600 feet. About 2348:18, the captain indicated that the flight was established on final approach;17 6 seconds later, the first officer informed the controller that the flight was established on the inbound portion of the ILS. The controller repeated the clearance to land; stated that the wind was 340º at 31 knots, the north boundary wind was 300º at 26 knots, and the northeast boundary wind was 320º at 25 knots; and repeated the RVR. At 2348:41, the first officer acknowledged this information. The controller did not receive any further transmissions from flight 1420. At 2349:02, the first officer asked the captain, “want forty flaps?” The captain indicated that he thought he had already called for the landing flaps, after which the first officer stated, “forty now.” At 2349:10, the controller informed the flight crew that the wind was 330º at 28 knots. Two seconds later, the captain stated, “this is a can of worms.” According to the CVR, the first officer stated, “there’s the runway off to your right, got it?” at 2349:24. The captain replied, “no,” to which the first officer stated, “I 14 ATIS information Romeo, which was issued about 2326, was based on a 2322 special weather observation indicating (among other things) a thunderstorm with frequent in-cloud and cloud-to-cloud lightning located west through northwest and moving northeast, winds from 190º at 14 knots, a visibility of 7 miles, and an altimeter setting of 29.88 inches of Hg. 15 RVR is a measurement of the visibility near a runway’s surface. This measurement represents the horizontal distance that a pilot should be able to see down a runway from the approach end. 16 According to the Jeppesen Sanderson approach plate for the ILS approach to runway 4R (dated February 20, 1998), the lowest authorized RVR for that runway was 2,400 feet. 17If the weather is reported to be below published minimums, American Airlines and the Federal Aviation Regulations (14 CFR 121.651) allow airplanes that are established on the final approach segment to continue the approach to the appropriate decision height (DH) or minimum descent altitude (MDA) and land in accordance with the conditions for the type of approach being conducted. For this Category I ILS approach, the DH was 200 feet.

Factual Information 6 Aircraft Accident Report got the runway in sight. You’re right on course. Stay where you’re at.” The captain then stated, “I got it. I got it.” At 2349:32, the controller reported the wind to be 330º at 25 knots. At 2349:37, an unidentified voice in the cockpit stated, “wipers,” and the CVR then recorded a sound consistent with windshield wiper motion. (This sound continued throughout the rest of the flight.) At 2349:53, the controller reported the wind to be 320º at 23 knots. The CVR indicated that, at 2349:57, an unidentified voice in the cockpit stated, “aw…we’re off course” and that, 1 second later, an unintelligible comment was made by an unidentified voice in the cockpit. In a postaccident interview, the first officer stated that he thought the approach was stabilized until about 400 feet above field level (afl), at which point the airplane drifted to the right. The first officer also stated that he said “go around” about that time but not in a very strong voice. The first officer indicated that he had looked at the captain to see if he had heard him but that the captain was intent on flying and was doing “a good job.” The CVR indicated that, at 2350:00, the first officer said, “we’re way off.” Flight data recorder (FDR) information indicated that the localizer deviation value was about one dot to the right at that point.18 About 1 second later, the captain stated, “I can’t see it.” About 3 seconds afterward, the first officer asked, “got it?” to which the captain replied, “yeah I got it.” At 2350:13 and :14, the CVR recorded the sound of the ground proximity warning system (GPWS) radio altitude callout “sink rate.”19 Calculations based on FDR data indicated that the airplane was descending through an altitude of about 70 feet afl at the time of the first sink rate warning and about 50 feet afl at the time of the second warning. Figure 1 shows flight 1420’s flightpath to Little Rock and runway 4R along with key CVR comments and the airplane’s location when the comments were made. FDR and CVR data indicated that the airplane touched down on the runway about 2350:20. About 2350:22, the first officer stated “we’re down;” about 2 seconds later, he stated, “we’re sliding.” FDR data also indicated that, over a 7-second period after touchdown, both thrust reversers were deployed and the left and right engines’ engine pressure ratios (EPR) reached settings of 1.89 and 1.67, respectively.20 The thrust reversers were subsequently moved to the unlocked status (neither deployed nor stowed). 18 Cockpit instrumentation shows the airplane’s location relative to the glideslope and localizer signals. Displacement is shown in terms of the airplane’s angular deviation above or below the glideslope and left or right of the localizer. Pilots can judge the amount of displacement by needle deflections that reference “dots” on the face of the instruments. Because the dots represent an angular measurement of an airplane’s deviation from an ILS component, the amount of feet of displacement depends on the airplane’s distance from the ILS antennas. 19 The sink rate alert indicates a rate of descent that exceeds predetermined thresholds. 20 Thrust reversers redirect engine exhaust to help slow an airplane. EPR is a measurement of engine power as a ratio of gases in the exhaust pipe compared with air entering the inlet.

Factual Information 7 Aircraft Accident Report According to the FDR, the flight spoilers did not deploy symmetrically at touchdown,21 but a momentary 8° deflection of the left outboard flight spoiler concurrent with a left aileron deflection was recorded.22 Figure 1. Flight 1420’s Approach Path to the Airport and Key CVR Comments 21 A spoiler is a device located on an airplane wing’s upper surface that, when activated, provides increased drag and decreased lift by disrupting the flow of air over the wing. After touchdown, the spoilers increase the load on the landing gear tires, which is essential for maximizing braking and obtaining the shortest stopping distance. 22 FDR data also showed that the flight spoilers extended symmetrically for 55 seconds, beginning at 2336:42, during the descent into Little Rock. -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 -15 -14 -13 -12 -11 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 2350:05/430 ft. Captain: "yeah I got it." 2350:01/472 ft. Captain: "I can't see it." 2349:31/940 ft. Captain: "I got it, I got it." 2349:12/1,138 ft. Captain: "this is a can of worms." 2346:52/2,300 ft. Captain: "we're goin' right into this." 2345:47/2,546 ft. F/O to controller: "we're getting pretty close to this storm." 2339:12/5,325 ft. F/O to controller: "we can see the airport from here." Radar returns Runway 4R Selected CVR information Distance north of runway 4R threshold, nm Distance east of runway 4R threshold, nm 2344:19/3,300 ft. Captain: "see we're losing it. I don't think we can maintain visual." 2342:55/3,300 ft. F/O: "it's going right over the field." 2344:30/3,300 ft. F/O to controller: "there's a cloud between us and the airport. We just lost the field." 2347:08/2,300 ft. Controller to crew: "runway 4R, cleared to land. The wind 350 at 30, gusts 45."

Factual Information 8 Aircraft Accident Report FDR data indicated that the right and left brake pedals began to move at 2350:25 and :30, respectively, and both pedals reached full travel at 2350:31. About the time that the brakes were applied, the thrust reversers were deployed again. At 2350:32, the CVR recorded an unidentified voice in the cockpit stating “on the brakes.”23 The left engine reached a maximum setting of 1.98 reverse EPR, and the right engine reached a setting of 1.64 reverse EPR. The left brake pedal was relaxed at 2350:34 before returning to its full position 2 seconds later. About the time that the left brake pedal was relaxed, the reversers were returned to the unlocked status. As the right thrust reverser was being moved to the unlocked status, the right engine reached a maximum setting of 1.74 reverse EPR. At 2350:36, FDR data indicated a full 60º deployment of the right inboard flight spoiler, concurrent with a full aileron deflection.24 At 2350:40, the left thrust reverser was moved back to the deployed position, but the right reverser moved briefly to the deployed position and then moved to the stowed position. According to FDR data, the left thrust reverser remained deployed, and the right thrust reverser remained stowed, for the remainder of the flight. About 1 second later, the CVR recorded expletives stated by an unidentified voice in the cockpit, which were followed by the sounds of initial impact at 2350:44 and several additional impacts beginning at 2350:47. The CVR stopped recording at 2350:48. The airplane came to rest about 800 feet from the departure end of runway 4R, 34° 44.18 minutes north latitude and 92° 11.97 minutes west longitude. The accident occurred during the hours of darkness. 1.2 Injuries to Persons Table 1. Injury chart Note: Title 14 CFR 830.2 defines a serious injury as any injury that (1) requires hospitalization for more than 48 hours, starting within 7 days from the date that the injury was received; (2) results in a fracture of any bone, except simple fractures of fingers, toes, or the nose; (3) causes severe hemorrhages or nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns or any burns affecting more than 5 percent of the body surface. A minor injury is any injury that does not qualify as a fatal or serious injury. 23 In a postaccident interview, the first officer indicated that he did not help with the flight controls until the captain said “brakes” as the airplane was nearing the end of the runway, at which time the first officer helped with the brakes. 24 The FDR recorded only the left aileron position, which indicated a full trailing edge-down deflection at the time. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 1 0 10 0 11 Serious 1 3 41 0 45 Minor 0 1 64 0 65 None 0 0 24 0 24 Total 2 4 139 0 145

Factual Information 9 Aircraft Accident Report 1.3 Damage to Airplane According to American Airlines, the damage to the airplane was estimated at $10.7 million. 1.4 Other Damage The airplane destroyed several tubes extending outward from the left edge of the runway 4R ILS localizer array, part of a chain link security fence, and approximately 250 feet of the runway 22L approach lighting system support structure and walkway. The damage was estimated at $325,000. 1.5 Personnel Information 1.5.1 The Captain The captain, age 48, was hired by American Airlines in July 1979. He held an Airline Transport Pilot certificate and a Federal Aviation Administration (FAA) First Class medical certificate dated February 9, 1999, with no restrictions. The captain was type rated on the Boeing 727 (727) and the MD-80. He qualified as a 727 flight engineer on August 24, 1979; first officer on March 15, 1985; and captain on September 21, 1988. He qualified as an MD-80 captain on July 31, 1991. The captain was also a lieutenant colonel in the U.S. Air Force Reserves. The captain began his aviation career with the U.S. Air Force in 1972. He flew T-33 and EB-57 airplanes and was a command flight examiner and instructor pilot for the B-57 airplane. He left active military service in 1979 at the rank of captain and began working for American Airlines afterward. The captain was furloughed after 1 year with American but was recalled by the company 3 1/2 years later.25 In July 1998, the captain was promoted to check airman on the MD-80. In a postaccident interview, the MD-80 Fleet Manager stated that the captain was recommended for this position by the Chicago-O’Hare base manager and another check airman because of his technical competence, performance as a line pilot, and ability and desire to instruct. In January 1999, the captain was promoted to chief pilot at the Chicago-O’Hare base.26 The base manager indicated that the captain wanted to be a chief pilot because he had been flying the MD-80 for a long time and wanted a change. The base manager also indicated that the captain was selected for a chief pilot position because of his flying background, company achievements, and leadership skills. 25 During his furlough from American Airlines, the captain worked as a nuclear engineer on submarine propulsion plants. 26 American Airlines policy requires chief pilots to fly 1 month per year as line pilots. The Chicago-O’Hare base manager encouraged chief pilots to fly once a week as line pilots.

Factual Information 10 Aircraft Accident Report The Chicago-O’Hare base manager, who flew with the captain twice in May 1999, said that he was “extremely comfortable flying with the captain” and that the captain had “a great deal of common sense.” A first officer who had flown with the captain from Chicago to Dallas/Fort Worth indicated that he was “a knowledgeable pilot who was not intimidating.” American Airlines records indicated that the captain had accumulated 10,234 hours total flying time, including 7,384 hours as a company pilot-in-command (5,518 of which were on the MD-80). His last recurrent ground training and proficiency check occurred on July 19, 1998, and his last line check occurred July 26, 1998. He had flown approximately 54, 46, 14, and 12 hours in the 90, 60, 30, and 7 days, respectively, preceding the accident. FAA records indicated no accident, incident, or enforcement action. The captain’s wife described his activities in the 3 days before the accident as routine, adding that the captain had no scheduled events during that time. She stated that the captain went to sleep about 2200 the night before the accident and slept until between 0700 and 0730. She further stated that, on nonflying days, the captain would typically go to sleep between 2130 and 2200, wake up about 0515, and leave for work about 0600. The captain’s wife indicated that he slept later than usual on the morning of the accident because the timing of the first day of the trip did not necessitate an early rising. The captain’s wife indicated that his health was good, he was a nonsmoker, and he consumed a minimal amount of alcohol. At the time of the accident flight, the captain was not taking any prescription drugs. No significant life events occurred in the weeks before the accident, and his finances and personal situation were reported to be stable. Records at the National Driver Register showed no indication of driver’s license revocation or suspension for the captain. The captain and first officer had not flown together before the day of the accident. According to two flight attendants who were working aboard the two legs before the accident flight (flights 1226 and 2080), the captain and first officer seemed to have a good working relationship with each other. The first officer for flight 1420 stated, in a postaccident interview, that the captain had made him feel comfortable in the cockpit. Also, the first officer testified at the public hearing on this accident that his interaction with the captain was not affected by the fact that he was a chief pilot. 1.5.2 The First Officer The first officer, age 35, was hired by American Airlines in January 1999. He held an Airline Transport Pilot certificate and an FAA First Class medical certificate dated November 12, 1998, with no restrictions. He qualified as a first officer on the MD-80 on February 22, 1999. He was serving a 1-year probation period required of new company hires. The first officer was type rated on the Learjet and the Boeing 737.

Factual Information 11 Aircraft Accident Report The first officer received his private pilot’s license in 1983. He began his career in 1988 with the U.S. Navy and completed primary flight training. The first officer had been selected for advanced jet training but was given an honorable discharge in 1991 because of a reduction in force. Before he was hired by American Airlines, the first officer worked as a corporate pilot, flying C-210, Learjet 35, and King Air E-90 airplanes. He was also the director of operations and the chief pilot for an air charter company and a flight instructor. A captain who flew with the first officer in May 1999 stated that he was an “above average new hire who was very competent and knowledgeable.” Another captain who flew with the first officer in May 1999 stated that he was an “experienced pilot with good cockpit discipline.” According to American Airlines records, the first officer had accumulated 4,292 hours of flying time, 182 of which were as a company MD-80 pilot. He had flown approximately 176, 112, 65, and 7 1/2 hours in the 90, 60, 30, and 7 days, respectively, preceding the accident. His proficiency check occurred on February 22, 1999, and his line check occurred on March 10, 1999. FAA records indicated no accident, incident, or enforcement action. On May 30, 1999, the first officer traveled from his home outside Los Angeles, California, to Chicago. The first officer indicated that he had been commuting from his home to the Chicago-O’Hare base for about 3 months and that, as a result, he was adjusted to the central time zone. The first officer indicated that he was involved in routine activities while in the Chicago area. He went to bed between 2000 and 2200 the night before the accident and woke up about 0730. The first officer indicated that he was a nonsmoker and that he was not taking any prescription medications at the time of the accident flight. Records at the National Driver Register showed no indication of driver’s license revocation or suspension for the first officer. 1.5.3 The Flight Attendants Flight 1420 was staffed with four flight attendants hired by American Airlines between June 1987 and August 1992. All of the flight attendants were qualified on MD-80 series airplanes. The flight attendants completed the company’s initial training, which included instruction in emergency procedures and evacuation drills, and their most recent company recurrent emergency procedures training was completed in either 1998 or 1999. On the day before the accident flight, three of the flight attendants began the same 3-day trip sequence. On the day of the accident flight, they had worked three trip segments before flight 1420. The fourth flight attendant began a 2-day trip sequence on the day of the accident flight. She had worked two trip segments before flight 1420.

Factual Information 12 Aircraft Accident Report Flights 1226 and 2080 (the two legs before the accident flight) were not among the trip segments worked by any of the flight attendants. 1.6 Airplane Information The MD-80 airplane is a derivative model of the DC-9 airplane. As a result, much of the MD-80’s structure and many of its systems, components, and installations are similar to the earlier DC-9 model. According to Boeing,27 the Douglas DC-9 airplane entered service in December 1965; the final DC-9 was delivered in October 1982. The MD-80 airplane’s first flight occurred in October 1979. The FAA certified the MD-80 series airplane in August 1980, and the airplane entered service in November 1980. The MD-80 model airplanes—the MD-81, -82, -83, -87, and -88—were in production through

1. The DC-9 family of airplanes also includes the MD-90 and the Boeing 717.

The accident airplane, N215AA, serial number 49163, was delivered new to American Airlines on August 1, 1983. At the time of the accident, the airplane had accumulated 49,136 flight hours and 27,103 cycles.28 A review of American Airlines’ Air Carrier Certificate, which included the standards, terms, conditions, and limitations contained in the FAA-approved Operations Specifications, revealed no discrepancies. The FAA’s Type Certificate Data Sheet, which prescribes the conditions and limitations under which airplanes meet airworthiness requirements, noted no discrepancies for DC-9 or MD-80 series airplanes. The FAA’s Program Tracking and Reporting System (PTRS)29 indicated no discrepancies for the accident airplane from January 1998 to May 1999. N215AA was equipped with two Pratt & Whitney JT8D-217C turbofan engines. The No. 1 (left) engine, serial number 718427, was installed on N215AA on September 7, 1997; the No. 2 (right) engine, serial number 725712, was installed on July 30, 1998. American Airlines’ records indicated that, for engine No. 1, the time since new was 29,734 hours (15,711 cycles),30 the time since overhaul was 11,216 hours (5,189 cycles), and the time since installation was 5,256 hours (2,447 cycles). The records also indicated that, for engine No. 2, the time since new was 25,131 hours 27 The Boeing Company and McDonnell Douglas Corporation merged in August 1997. Douglas Aircraft Company and McDonnell Aircraft Company merged in April 1967. 28 An airplane cycle is one complete takeoff and landing sequence. 29 The PTRS is an FAA computer tracking system that includes information on inspection and surveillance activities by FAA inspectors. In 1997, the FAA began developing the Air Transportation Oversight System (ATOS) as the FAA’s new oversight system and the eventual replacement for PTRS. The Manager of the Flight Standard Division for the FAA’s Western Pacific Region, who testified at the Safety Board’s public hearing on this accident, stated that ATOS was intended to replace PTRS because that data repository system had reached a plateau and there was no way to make further safety gains with PTRS. Only surveillance data for 10 major U.S. air carriers (including American Airlines) are currently recorded under ATOS; certification activities and data for the 10 carriers are still recorded under PTRS. 30 An engine cycle is one complete startup and shutdown sequence.

Factual Information 13 Aircraft Accident Report (13,216 cycles), the time since overhaul was 11,658 hours (5,421 cycles), and the time since installation was 2,618 hours (1,229 cycles). The accident airplane was equipped with two AlliedSignal VOR31/ILS receivers and an AlliedSignal GPWS computer. The accident airplane was also equipped with a forward-looking X-band airborne weather radar unit that depicted three levels of reflectivity in green, yellow, and red (according to intensity from lightest to heaviest). X-band airborne weather radar systems are subject to attenuation, that is, the scattering or absorption of electromagnetic energy with heavy precipitation. The accident airplane’s airborne weather radar did not have attenuation alerts to warn the flight crew of any masking of weather resulting from heavy precipitation, and the radar was not able to detect lightning strikes. The airborne weather radar had a power output of approximately 125 watts and was integrated with a 30-inch antenna that provided a 3.4º beam width. The radar had a stabilization feature that helped to keep the radar beam steady during turns and pitch changes. The radar had range selections of 10, 20, 40, 80, 160, and 320 miles, a 180º horizontal azimuth display, and a vertical tilt control of ±15º. In a postaccident interview, the first officer stated that the airborne weather radar was being operated in the 10-, 20-, and 40-nautical mile (nm) ranges and that the tilt was set at the maximum up (+15º) setting. In public hearing testimony, the first officer indicated that he saw only green radar returns depicted on the weather radar unit. 1.6.1 Maintenance Records American’s engineering specification maintenance intervals for MD-82 airplanes include “Periodic Service”; “A,” “B,” and “C” checks; and “HC” [heavy C] checks. Periodic Service checks are to be accomplished a maximum of 2 flying days from the last periodic service or higher check. A and B checks are to be accomplished every 65 and 470 flight hours, respectively. The first C check is to be accomplished within 5,000 flight hours, and all subsequent C checks are to be accomplished within 4,200 flight hours of the last C check. The first HC check is to be accomplished within 14,000 flight hours, the second one within 12,000 flight hours since the previous HC check or a total time of 24,000 flight hours, and the third and subsequent HC checks within 12,000-flight hour intervals. The accident airplane’s last Periodic Service and A checks were performed on May 31, 1999. All tires and wheels were checked for airworthiness. Tire inflation and brake wear were also checked. No maintenance items were deferred. The last B check was performed on April 21, 1999. All tires and wheels were checked for airworthiness. Tire pressure, flight and ground spoilers, and hydraulic subsystems were also checked. In addition, the requirements of FAA Airworthiness Directive (AD) 98-11-10 were performed. This AD mandated an inspection of the spoiler handle latching lever pin and actions to prevent it from jamming. (According to the AD, a jammed spoiler handle pin 31 VOR stands for very high frequency omnidirectional radio range.

Factual Information 14 Aircraft Accident Report can result in retraction of the spoilers and full advancement of the left throttle during a go-around.) The last C check was performed on January 6, 1999, and the last HC check was performed on January 22, 1994. The No. 1 (left) and No. 2 (right) nose gear tire and wheel assemblies were last replaced on May 27 and February 4, 1999, respectively. The No. 1 (outboard) and 2 (inboard) left main landing gear tire and wheel assemblies were last replaced on May 7,

1. The No. 3 (inboard) and 4 (outboard) right main landing gear tire and wheel

assemblies were last replaced on May 15 and April 7, 1999, respectively. The No. 1 and 2 left main landing gear brakes were last replaced on April 3 and April 2, 1999, respectively. The No. 3 and No. 4 right main landing gear brakes were last replaced on December 29, 1998, and April 3, 1999, respectively. No discrepancies were noted after these replacements. All but one of the replacements were nonroutine discrepancies generated from Periodic Service inspections; the No. 1 left nose gear tire and wheel assembly replacement resulted from a pilot report of excessive nose wheel vibration at liftoff. Discrepancies recorded in American Airlines airplane maintenance logbooks are entered into the company’s Field Maintenance Reliability System. Entries from May 15, 1998, to June 1, 1999, in the accident airplane’s maintenance logbook were reviewed for discrepancies that referenced flight controls/spoilers, antiskid control, wheels, brakes, rain protection, engine controls, and engine reversing. Also, Field Maintenance Reliability reports, which include descriptions of any mechanical discrepancy, any corrective maintenance actions, and any minimum equipment list (MEL) deferrals, were generated for the accident airplane from June 1, 1998, to May 31, 1999. Selected discrepancies involving autothrottle/speed control, landing, spoilers/drag devices, windows/windshields, brakes, fuselage, engine fuel and control, engine controls, and thrust reversers were reviewed for corrective maintenance actions. No discrepancies were noted. FAA service difficulty reports (SDR) were reviewed from all DC-9-82 airplane operators regarding the airplane’s flight controls/spoilers. Between January 1984 and August 1999, 49 SDRs were submitted regarding flight controls/spoilers; no maintenance trends or discrepancies were found. Also, SDRs for all systems on the accident airplane were reviewed. Between September 1985 and August 1999, 14 SDRs were submitted, but none were relevant to the circumstances of the flight 1420 accident. In addition, SDRs were reviewed from all DC-9 type-certificated airplanes regarding the airplane’s drag control system and drag control actuator. Between January 1995 and October 23, 2001, there were 62 reports regarding the drag control system and 21 reports regarding the drag control actuator, including 13 reports submitted after the flight 1420 accident. Most of the reports were inspection related, false indications, or adjustment or chaffing problems. No maintenance trends or discrepancies were noted; however, one report, which involved a DC-9-32, was noted as being relevant to the circumstances of this accident. Specifically, the discrepancy report stated the following: “Discrepancy: unable to arm ground spoilers on approach, and spoilers did not deploy manually on landing. Corrective Action: Replace spoiler control actuator and

Factual Information 15 Aircraft Accident Report spoiler control box. Spoilers adjusted and checked serviceable. Note: the report does not state if the autospoiler ‘do not use’ light was illuminated.” 1.6.2 Spoiler System Information The MD-80 series airplane has one ground spoiler, one inboard flight spoiler, and one outboard flight spoiler on each wing. Each of the flight spoilers is extended and retracted by its own hydraulic actuator. The left hydraulic system, through the left spoiler bypass valve and a 1,500-pounds per square inch (psi) pressure reducer valve, supplies hydraulic power for the two inboard flight spoiler actuators. The right hydraulic system, through the right spoiler bypass valve and a 1,500-psi pressure reducer valve, supplies hydraulic power for the two outboard flight spoiler actuators.32 Both hydraulic systems supply hydraulic power, through the two ground spoiler control valves, to the two ground spoiler actuators, which are at full system pressure (3,000 psi) and do not have pressure reducer valves. Two position sensors—one mounted on the right inboard flight spoiler panel and the other on the left outboard flight spoiler panel—provide information to the FDR on the position of those spoilers. The FDR records each spoiler position alternately at a sampling rate of two times per second. The flight spoilers are manually operated through the aileron control system by either the control wheel or the spoiler handle in the cockpit. A control wheel input can supplement lateral control (provided by the ailerons) by extending the flight spoilers on the downward-moving wing to a maximum of 60º. An input from the spoiler handle extends the flight spoilers symmetrically on both wings to a maximum of 35º in flight (referred to as the speed brake function) and a maximum of 60º on the ground. A spring-loaded torsion bar mechanically holds the flight spoilers in the retract position when they are not extended.33 The ground spoilers are manually operated by an input from the spoiler handle on the cockpit center pedestal and electrical signals from the proximity system electronic unit via several spoiler control relays. The ground spoilers are extended to 60º only during landing or a rejected takeoff. The ground spoilers are locked down by hydraulic power and a mechanical overcenter link during all other phases of flight. The ground and flight spoilers can be automatically operated by the autospoiler system.34 This system consists of two ground spoiler control valves, the autospoiler switching unit, four wheel spin-up transducers (by way of a ground spoiler control box), and two ground control nose oleo switches. To use the autospoiler system for landing, a 32 If one of the hydraulic pumps were to fail or was rendered inoperable for maintenance reasons, a power transfer unit would allow the remaining hydraulic system to supply power to the inoperative system. The MD-82 is also equipped with an auxiliary hydraulic pump to power the right hydraulic system on the ground. 33 The MD-80 can be configured with a spoiler lockout mechanism to prevent in-flight spoiler deployment when the flaps are extended. None of American’s MD-80s are configured with the mechanism. 34 MD-80 airplanes can be dispatched with the autospoiler system inoperative. Under that circumstance, the pilot would be required to manually deploy the spoilers upon touchdown.

Factual Information 16 Aircraft Accident Report pilot raises the spoiler handle up to the ARM position (before touchdown), which reveals a red ARM indicator stripe and positions the roller on the spoiler handle in front of an autospoiler crank arm. (The red indicator stripe provides a visual cue to the flight crew that the autospoiler system is armed.) When the autospoiler switching unit commands the autospoiler actuator to move the crank arm from the retract to the extend positions, the crank arm pushes the spoiler handle fully aft and extends all of the flight and ground spoilers. After touchdown, the autospoiler switching unit commands the autospoiler actuator to move the crank arm, which in turn moves the spoiler handle fully aft when either the wheel spin-up transducers signal main wheel spin-up or the ground control nose oleo switches signal nose gear touchdown (in case of a failure of the spin-up transducers). The autospoiler system activates the autospoiler actuator on each landing regardless of whether the handle is in the ARM position. The MD-80 is configured with a spoiler autoretract mechanism that retracts the ground and flight spoilers if the left throttle is advanced above idle (about 1 3/4 to 2 inches). The left throttle arm has a crank that “knocks down,” or dislodges, the spoiler handle from the latching mechanism so that the handle return spring can return the spoilers to the stowed position. (The spoiler handle can also be manually dislodged.) The right throttle does not have a crank to knock down the spoiler handle. An amber AUTO SPOILER DO NOT USE light illuminates on the overhead annunciator panel in the cockpit if the autospoiler system detects certain failures. Specifically, the light will illuminate if (1) the ground spoiler actuator fails to change positions within 10 seconds after being so commanded, (2) the spoiler control relay circuit or the ground spoiler control box circuit has an internal short to ground, (3) only one takeoff or land relay channel is energized, or (4) the two weight-on-wheel sensors (proximity sensors on the main landing gear that indicate when the struts are compressed) and the landing gear handle are inconsistent. If this light appears for one of the first three causes, the flight crew must manually deploy the ground spoilers upon landing. If the light appears for the last cause, the autospoiler actuator will operate as intended as long as it receives normal inputs. Figures 2 through 6 show the MD-80 spoiler system. Figure 2 shows the spoiler control system, including the locations of the flight and ground spoilers. Figure 3 shows the spoiler hydraulic system. Figures 4 and 5 are photographs showing the location of the spoiler handle in the unarmed and armed positions, respectively. Figure 6 shows the position of the crank arm and roller with the spoiler handle in unarmed and armed positions.

Factual Information 17 Aircraft Accident Report Figure 2. Spoiler Control System Figure 3. Spoiler Hydraulic System

Factual Information 18 Aircraft Accident Report Figure 4. Spoiler Handle in the Unarmed Position Figure 5. Spoiler Handle in the Armed Position

Factual Information 19 Aircraft Accident Report Figure 6. Position of the Crank Arm and Roller With the Spoiler Handle in the Unarmed and Armed Positions (View From Forward Right to Aft Left) 1.6.2.1 Testimony on Spoiler System Operation According to the Boeing Company’s Engineering Manager for Landing Gear, Brake, and Hydraulic Systems, who testified at the Safety Board’s public hearing on this accident, the autospoiler system provides “quick, timely, and full 60º deployment” of all spoiler panels with “minimal flight crew input” during a rejected takeoff or after a landing touchdown. The Engineering Manager stated that the only human factor involved in the system’s operation is the arming of the spoilers to ensure that the autospoiler system can successfully engage and actuate the spoiler system. The Engineering Manager also testified that the spoiler system is very reliable. For example, if the spoilers were armed and tire spin-up did not occur upon touchdown, the spoilers would still automatically deploy because the system was designed to use nose gear compression as the backup signal for spoiler deployment. The Engineering Manager indicated that the two spoiler parameters on the accident airplane’s FDR appeared to be functioning normally. He explained that a full turn of the steering yoke in the cockpit (that is, a full aileron deflection) would have caused the right inboard flight spoiler to fully deflect momentarily, as indicated by FDR data. The Engineering Manager testified that the right flight spoilers reduced lift on that wing for only about 2 seconds, which would not have made much difference in the airplane’s braking. SPOILER HANDLE CRANK ARM (ACTUATOR EXTENDED) UNARMED ARMED SPOILER HANDLE ROLLER CRANK ARM

Factual Information 20 Aircraft Accident Report The Engineering Manager said that there are no design features in the autospoiler system to warn pilots that the spoiler handle has not been armed. He added that some changes have been made to the system since it was designed in the 1960s, but most of these changes have been to ensure that the ground spoilers do not inadvertently deploy during flight. According to the Engineering Manager’s testimony, the electrical signal required to deploy the ground spoilers requires all of the following: the landing gear handle switch is in the down position, the left or right main landing gear weight-on-wheels signal is received from the proximity system electronic unit, and the left throttle switch is in the idle position. The Engineering Manager further testified that there are no aural or visual warnings in the cockpit to indicate that the spoilers did not deploy. However, there are some aural and visual cues to indicate to the flight crew that the spoilers have been deployed, including the extensive motion of the spoiler handle as it is moving into the extend position and the associated “clanking” sound. An aerodynamics engineer from Boeing presented information on the effect of the spoilers on the weight on the wheels for a 127,000-pound MD-80 series airplane at 1 second after touchdown (the point during the landing roll when the airplane is at its highest speed and is developing the highest lift). The weight distribution of the airplane was estimated according to the percent of total landing weight supported by the wings, the main landing gear, and the nose gear. With the spoilers deployed, about 20 percent of the airplane’s total landing weight is supported by the wings, about 77 percent of the total weight is supported by the main gear, and about 3 percent of the total weight is supported by the nose gear. Without spoilers, about 70 percent of the airplane’s total landing weight is supported by the wings, about 27 percent of the total weight is supported by the main gear, and about 3 percent of the total weight is supported by the nose gear.35 Without spoilers and with an additional 20 knots of speed, about 90 percent of the airplane’s total landing weight is supported by the wings, about 7 percent of the total weight is supported by the main gear, and about 3 percent of the total weight is supported by the nose gear. According to the Boeing engineer, this finding is important because, when less weight is applied on the main gear, it has less braking force and produces less cornering force in a skid. 1.6.2.2 Other Spoiler Events During the public hearing on this accident, the Safety Board requested that Boeing determine whether it had received any reports of armed autospoilers not deploying on MD-80 or DC-9 aircraft. Boeing sent two letters, dated April 20 and October 24, 2000, to the Safety Board that indicated that the company was able to find nine records of such reports. Most of these events could be explained by either 35 The estimated weight distribution for landings without spoilers assumed a 10º nose-down elevator. The Boeing engineer stated that applying nose-down elevator reduces the weight on the main gear by transferring it to the nose gear. He also stated that, because the nose gear does not have any brakes, the braking force is reduced and the distance to stop is increased.

Factual Information 21 Aircraft Accident Report component or procedural failures. For example, Boeing stated that an autospoiler actuator on a DC-9 was removed and replaced because the spoiler handle did not come all of the way back and latch. In another example, Boeing indicated that the autospoilers on a DC-9 did not deploy on landing but that an inspection revealed that the autospoiler circuit breaker was open. For the remaining events, the data were insufficient to verify the details of the event or determine the cause. American Airlines reported two instances in which the spoiler handle aboard an MD-80 series airplane extended and then retracted after main landing gear touchdown. The events occurred at Dallas/Fort Worth on June 15, 2000, aboard flight 497 and on September 17, 2000, aboard flight 787. The FDR from the flight 497 airplane only recorded the right outboard spoiler position at a sampling rate of once per second, and the FDR indicated that the spoiler deployed at touchdown and then retracted about 1 second later. The FDR from the flight 787 airplane showed that both the left outboard and right inboard flight spoilers deployed at touchdown and then retracted about 1 second later. According to American, both flight crews could feel the spoilers retract, after which the crews manually deployed the spoilers and safely decelerated the airplanes. American also indicated that the flight crews believed the throttles were idle at touchdown. 1.6.3 Braking System Information The MD-80 series airplane braking system can be operated manually or automatically. The automatic braking (autobrake) system on the MD-80 is optional; the accident airplane was equipped with the system. According to Boeing’s Engineering Manager for Landing Gear, Brake, and Hydraulic Systems, the MD-80 autobrake system provides “rapid and full application of the brakes” in the event of a rejected takeoff and “timely and consistent brake application” during landing. The first officer stated in a postaccident interview that the captain elected to use only manual brakes for landing.36 The autobrake system control panel is on the aft right portion of the center pedestal. To arm the system before landing, a pilot selects one of three deceleration levels—minimum, medium, and maximum—and moves the arm switch to the ARM position. After landing, the spoiler handle is moved aft either manually or automatically by the autospoiler system, and the autobrake switches then initiate the automatic application of the brakes. (The autobrakes will operate only if the spoiler handle is in the extended position.) With the minimum and medium levels, brake application begins about 3 seconds after landing; with the maximum level, brake application begins about 1 second after landing. The autobrake system can be unarmed so that the braking function is returned to the pilots. The system is unarmed by manually depressing any brake pedal more than 25 percent of its maximum travel, advancing any throttle out of the near-idle range, 36 The CVR indicated that, at 2331:22, the first officer stated, “manual brakes?” to which the captain replied, “uh, manual’s fine.”

Factual Information 22 Aircraft Accident Report moving the arm switch to the DISARM position, or returning the spoiler handle to the stowed position. MD-80 series airplanes are equipped with an antiskid braking system. This system adapts braking pressure (applied manually or automatically) to runway conditions by sensing an impending skid condition and adjusting the brake pressure on each individual wheel to allow for maximum braking performance. The inboard brakes have touchdown protection to prevent them from being applied before or at touchdown. The outboard brakes do not have touchdown protection. 1.6.4 Weight and Balance According to the trip paperwork, the takeoff center of gravity for N215AA was 16.7 percent of mean aerodynamic chord, which was within the approved limits of the airplane. The trip paperwork also included the following information for the airplane: basic operating weight, 83,123 pounds; passenger weight, 25,020 pounds; baggage weight, 3,475 pounds; zero fuel weight, 111,618 pounds; fuel, 24,500 pounds; ramp weight, 136,118 pounds; taxi fuel burn, 2,080 pounds; takeoff weight, 134,038 pounds; estimated fuel burn, 6,289 pounds;37 and estimated landing weight, 127,749 pounds. The zero fuel, ramp, takeoff, and landing weight maximums were 122,000; 150,500; 136,300; and 130,000, respectively. 1.6.5 N215AA’s Previous Flights on the Day of the Accident On the day of the accident, N215AA flew from Dallas/Fort Worth to Denver and back to Dallas/Fort Worth. The captain of those flights indicated, in a postaccident interview, that the spoilers were armed and deployed normally for each landing. He also indicated that the weather radar worked well during deviations around weather in the Denver area. The first officer of those flights stated, in a postaccident interview, that the spoilers, thrust reversers, and manual brakes worked normally. He also stated that the airplane’s weather radar operated normally in the 20-, 40- 80- and 160-mile ranges. FDR data for the accident airplane’s previous landing at Dallas/Fort Worth showed that the flight spoilers deployed symmetrically immediately after touchdown to their full 60° position and remained that way for about 33 seconds until they returned to their stowed position. Boeing’s Engineering Manager for Landing Gear, Brake, and Hydraulic Systems indicated that the FDR data for the airplane’s previous landing “definitely” showed normal spoiler deployment. FDR data also showed that both thrust reversers deployed after the airplane touched down at Dallas/Fort Worth.38 37 The flight dispatcher sent the flight crew an ACARS message about 2311, which revised the fuel burn amount to allow for en route weather deviations. The message also included a reminder to the flight crew that Nashville and Dallas/Fort Worth airports were the flight’s two alternate airports. 38 According to FDR data, both thrust reversers also deployed when the airplane powered back from the gate during its departure from Dallas/Fort Worth to Little Rock.

Factual Information 23 Aircraft Accident Report 1.6.6 MD-80 Demonstrated Landing Distance As part of an airplane’s certification, a manufacturer must demonstrate the distance to land from a 50-foot height to a complete stop (14 CFR 25.125). The aerodynamics engineer from Boeing, in public hearing testimony, stated that the MD-80 “demonstrated landing distance” was measured in two parts—the air distance, from 50 feet to touchdown, and the ground distance, from touchdown to stop—and on a dry, hard-surfaced runway. According to the aerodynamics engineer, the operating requirements in Part 121 provide for additional safety margins beyond the demonstrated landing distance, specifically, variations in the speed, touchdown point, runway surface condition, tire condition, temperature, and runway slope. The Part 121 minimum dry runway length is the demonstrated landing distance plus 67 percent. The Part 121 minimum wet runway length is the minimum dry runway length plus 15 percent. The Boeing engineer testified that the MD-80’s landing performance was demonstrated to the FAA using the following test conditions: forward center of gravity, Vref (1.3 times the stalling speed) at 50 feet, 40º flaps, autospoilers, pilot-actuated (manual) antiskid braking, no reverse thrust, and a weight range of 109,200 to 149,500 pounds. The engineer presented information regarding the required landing distances for an MD-80 with a landing weight of 127,000 pounds. The actual demonstrated landing distance was 2,830 feet, so the Part 121 minimum dry and wet runway lengths were 4,715 and 5,425 feet, respectively. Runway 4R/22L at Little Rock National Airport is 7,200 feet in length, so there is about an 1,800-foot margin between the required minimum wet runway length and the end of the runway. 1.7 Meteorological Information 1.7.1 Airport Weather Information Weather observations at Little Rock National Airport are made by an Automated Surface Observing System (ASOS), which is maintained by the NWS. The ASOS records continuous information on wind speed and direction, cloud cover, temperature, precipitation, and visibility. The ASOS wind anemometer is installed 32 feet afl. The ASOS transmits an official meteorological aerodrome report (known as a METAR) at 53 minutes past each hour and a special weather observation (known as a SPECI) as conditions warrant; such conditions include a wind shift, change in visibility, and change in ceiling (cloud cover or height). The system is prevented from issuing any reports between 47:20 and 53:20 after the hour (known as the lockout period) so that the hourly observation can be prepared, edited, and transmitted. ASOS observations at the Little Rock airport are augmented by certified weather observers under contract with the FAA. The augmentation station is located in the airport’s terminal building, and the ASOS unit is located near the approach end of runway 4L. The NWS inspected the ASOS unit on May 21, 1999, and found it to be working properly.

Factual Information 24 Aircraft Accident Report The ASOS special weather observation for 2323 was as follows:39 Special weather observation for Little Rock at 0423Z, winds from 180º at 09 knots, visibility 7 miles with thunderstorms, a few clouds at 7,000 feet in cumulonimbus clouds, ceiling broken at 10,000 feet, temperature 25º C, dew point temperature 23º C, altimeter 29.86 inches of Hg. Remarks: ASOS observation, thunderstorm began at 23 minutes past the hour, frequent lightning in-cloud and cloud-to-cloud located from the west through the northwest,[40] thunderstorm west through northwest, moving northeast. The ASOS edit log indicated that, at 2347:22, a special observation was canceled because it occurred during the lockout period. The ASOS edit log also indicated that the following observation was recorded about the time of the accident but was not disseminated because of the lockout period: Little Rock weather observation at 0450:31Z, winds from 290º at 16 knots gusting to 28 knots, visibility 1 1/2 miles in thunderstorm and heavy rain[41] and mist, a few clouds at 3,700 feet, ceiling overcast 5,000 feet, temperature 18.9º C, dew point 16.7º C, altimeter 29.94 inches of Hg. Remarks: ASOS observation, peak wind from 290º at 35 knots at 0433Z, wind shift at 0431Z, thunderstorm began at 0423Z, rain began at 0424Z, sea level pressure 1014.0 mb [millibars], frequent lightning in-cloud, and cloud-to-cloud, west through northwest, occasional lightning in-cloud, cloud-to-cloud, and cloud-to-ground east, thunderstorm west through northwest, thunderstorm east moving east, precipitation since last hourly observation 0.37 inches. The hourly observation about 2353 indicated that the wind was from 280º at 18 knots gusting to 26 knots and that visibility was 1 mile in thunderstorms and heavy rain and mist. A special observation was issued about 2355, indicating that the wind was from 290º at 13 knots gusting to 26 knots and that visibility was 3/4 mile in thunderstorms and heavy rain and mist. Another special observation, issued about 2358, indicated that the wind was from 290º at 10 knots gusting to 76 knots; the winds were varying from 210 to 030º; the visibility was 1/2 mile in thunderstorms, small hail, heavy rain, and mist; and a peak wind from 320º at 76 knots was measured about 2356. ASOS also provides precipitation measurements in 1- and 15-minute increments. Between 2331 and 2345, the ASOS measured 0.14 inch of rain, with the first measurable rain greater than trace amounts (less than 0.01 inch) about 2336. About 2350 (immediately before the time of the accident), the system measured a total of 0.37 inch of rain. The 15-minute measurement for 2346 to 0000 indicated that 1.09 inches of rain had 39 Weather observations are transmitted in coordinated universal time (UTC). The “Z” designation that follows the time in the weather observation stands for Zulu, which indicates UTC time. Central daylight time is 5 hours behind UTC time. 40 The Federal Meteorological Handbook number 1 defines frequent lightning as one to six flashes per minute. 41 The NWS defines heavy rain as 0.03 inch of rain within 6 minutes or more than 0.30 inch of rain per hour.

Factual Information 25 Aircraft Accident Report fallen. Appendix C shows detailed ASOS wind information and precipitation amounts surrounding the time of the accident. ATIS information is based on ASOS observations provided to the tower by the official airport weather observer.42 ATIS information Romeo, which was current beginning about 2326, stated: Good evening Little Rock Adams Field[43] information Romeo zero four two two Zulu special observation, wind one niner zero at one four, visibility seven, thunderstorm, few clouds at seven thousand, cumulonimbus, ceiling one zero thousand broken, temperature two five, dew point two three, altimeter two niner eight eight, frequent lightning in-cloud, cloud-to-cloud, west through northwest, moving northeast. ILS runway two two left approach in use. Notices to Airmen, runway two two right, four left ILS out of service. Attention all aircraft, hazardous weather information for the Little Rock area available on HIWAS [Hazardous In-flight Weather Advisory Service], flight watch, or flight service...advise on initial contact you have Romeo. In addition to ASOS, Little Rock National Airport is equipped with an FAA Type FA-10240 Low Level Windshear Alert System (LLWAS), which was operational at the time of the accident. The LLWAS uses six wind sensors at remote stations located around the airport to collect wind speed, direction, and gust data.44 One of the six sensors is the centerfield wind sensor, which is installed 70 feet afl. Readings from this sensor are used by tower controllers as the source of real-time wind data for pilots. LLWAS alerts are displayed in the ATCT so that controllers can warn flight crews of potentially hazardous windshear conditions. (As discussed in section 1.1, the controller transmitted windshear alerts to the 1420 flight crew about 2339 and 2347.) The FAA performed a sensor performance evaluation after the accident, which determined that all of the LLWAS sensors were working properly at the time of the accident. The Safety Board requested that the Massachusetts Institute of Technology’s Lincoln Laboratory review the LLWAS data. According to public hearing testimony by Lincoln Laboratory’s Source Scientist for the LLWAS and TDWR45 algorithms, the 42FAA Order 7110.65, section 2-9-2, states that towers are required to make a new ATIS recording whenever the following situations occur: any new official weather is received (even if there has not been a change in values), runway braking action reports indicate that runway braking is worse than the description included in the current ATIS broadcast, and any other pertinent information has changed (for example, the runway or the instrument approach in use and new or canceled notices to airmen, pilot reports, or HIWAS updates). 43Little Rock National Airport is also known as Adams Field. 44 According to the FAA’s Program Manager for LLWAS, the FAA plans to upgrade the current system in May 2002 to an LLWAS-RS, which will involve adding and relocating sensors and upgrading software. Other airports will have their LLWAS systems upgraded to either the LLWAS-RS or LLWAS-NE version, which will involve a network expansion. LLWAS-NE versions will be integrated with Terminal Doppler Weather Radar (TDWR) systems or the Weather Systems Processor (WSP, see section 1.18.5.1). 45 TDWR is a C-band radar installed at 41 major U.S. airports. TDWR provides timely and accurate detection of hazardous windshear in and near airport terminal approach and departure areas. It also provides microburst, gust front, wind shift, and precipitation intensity information.

Factual Information 26 Aircraft Accident Report LLWAS alerts issued on the night of the accident “were very credible and gave a good interpretation of what was going on.” This witness also testified that, after the airplane landed on the runway, the LLWAS centerfield sensor surged to 41 knots and that a microburst had begun to impact the airport by 2352.46 (An LLWAS alert related to this event was recorded at 2352:10.) The Safety Board reviewed the tapes made by the airport’s surveillance cameras for additional information on the weather conditions before the time of the accident. The surveillance cameras recorded heavy rain, strong gusting winds, lightning, and deteriorating visibility. 1.7.2 National Weather Service Information The NWS prepared several weather products describing the conditions surrounding the time of the accident. A terminal aerodrome forecast (TAF), prepared by the North Little Rock Forecast Office, was issued about 1830 and was amended about 2258.47 The amended TAF, which was valid starting about 2300, stated, in part, the following:48 Beginning at 0400Z, winds forecasted from 200º at 12 knots gusting to 20 knots, visibility greater than 6 miles, scattered clouds at 2,500 feet, ceiling overcast at 6,000 feet. Temporary condition between 0400Z and 0600Z, winds variable at 25 knots gusting to 40 knots, visibility 1 mile in thunderstorm, heavy rain and mist, ceiling overcast at 1,500 feet in cumulonimbus clouds. NWS in-flight weather advisories notify pilots en route of the possibility of encountering hazardous flying conditions that may not have been forecast at the time of their preflight briefing. Two of the five NWS in-flight weather advisory categories— Convective SIGMET and Severe Weather Forecast Alert—were in effect at the time of the accident.49 Convective SIGMET50 No. 15C, prepared by the NWS Aviation Weather Center in Kansas City, Missouri, was issued about 2255 and was valid until 0555 on June 2, 1999. The advisory was broadcast in its entirety to the flight crew about 2304 and stated the following: 46 A microburst is a severe localized wind blasting down from a thunderstorm. A microburst usually covers an area of less than 2 1/2 miles in diameter and lasts less than 20 minutes. 47 TAFs are normally issued every 6 hours with amendments issued as conditions warrant. 48 The NWS Aviation Forecaster in North Little Rock indicated that he amended the 1830 TAF because, by 2250, he realized that the line of thunderstorms and heavy rain would be impacting the airport within the next hour. The 1830 TAF was included in the preflight weather package to the flight crew (see section 1.7.3). 49 The other three NWS in-flight weather advisory categories are SIGMETs, center weather advisories, and airman’s meteorological information (better known as AIRMETs). 50A Convective SIGMET implies severe or greater turbulence and microburst/windshear activity.

Factual Information 27 Aircraft Accident Report Attention all aircraft, Convective SIGMET 15 Central valid until 0555 Zulu for Arkansas and Oklahoma...area of severe thunderstorms moving from 300 at 20 knots, tops above flight level 450, hail to two inches, and wind gusts to seven zero knots possible. Additional hazardous weather information for Arkansas and Oklahoma available from flight service, flight watch, or HIWAS frequencies. Severe Weather Forecast Alert No. 357, prepared by the NWS Storm Prediction Center in Norman, Oklahoma, was issued about 2123 and was valid until 0300 on June 2,

1. The advisory, which encompassed portions of northern Texas, northwest

Louisiana, Arkansas (including Little Rock), and southeast Oklahoma, warned of a few severe thunderstorms with hail to 2 inches, extreme turbulence, and surface wind gusts to 70 knots; a few cumulonimbus clouds with maximum tops to 50,000 feet; and a mean storm motion from 280º at 20 knots. A Weather Surveillance Radar 1988 Doppler (WSR-88D) system located in North Little Rock (6 miles north-northwest of the airport) provides a three-dimensional volume scan of the atmosphere at varying degrees of elevation and within a range of 240 miles. The five lowest elevation angles for this WSR-88D are 0.4, 1.5, 2.4, 3.3, and 4.3º.51 The volume scan process takes 6 minutes. The WSR-88D’s composite reflectivity image of all elevation scans from 2345 depicted a northeast-to-southwest-oriented band of weather, with several large areas indicating reflectivities of level 6 (extreme) activity,52 encompassing the Little Rock airport area. Reflectivities over the airport ranged from 50 to 64 decibels (dBz), or level 5 (intense) to 6 (extreme) activity. The 2351 composite reflectivity image continued to depict the large weather band surrounding the airport and the 50- to 64-dBz reflectivity range over the airport. The WSR-88D’s base reflectivity images provided the radar reflectivities at the individual elevation scans. The images documented the line of thunderstorms moving across the Little Rock airport area during flight 1420’s approach. The WSR-88D 0.4º elevation scan of base reflectivity that was completed at 2334:27 depicted reflectivities of 50 dBz, or NWS level 5 (intense) activity over the northwest section of the airport. By 2340:28, the 0.4º base reflectivity image depicted a large area of activity over the airport with reflectivities of 45 dBz, or level 4 (very strong) activity, and greater. The two strongest areas of activity were located approximately 5 miles west-northwest and northeast at this time. Another area of activity located approximately 3 miles southwest of Little Rock was beginning to move toward the east-southeast with reflectivities reaching 54 dBz, or level 6 (extreme) activity. Figures 7 and 8 show the base reflectivity products for 2334:27 and 2340:28, respectively. 51 The 0.4º elevation scan covered conditions near the surface of the airport. The 1.5º elevation scan covered conditions encountered in the area approaching the airport. 52 The NWS categorizes reflectivity according to a six-level intensity scale; level 6 is the highest, measuring greater than 54 decibels. The other levels are 1, very light; 2, light to moderate; 3, strong; 4, very strong; and 5, intense.

Factual Information 28 Aircraft Accident Report Figure 7. 0.4° Base Reflectivity Scan at 2334:27 Figure 8. 0.4° Base Reflectivity Scan at 2340:28

Factual Information 29 Aircraft Accident Report The WSR-88D’s 0.4º elevation scan of base reflectivity that was completed at 2345:57 indicated that the area over the airport and the approach end of runway 4R reached reflectivities of 54 dBz, or level 5 (intense) activity, and that the area approximately 5 miles west of runway 4R reached maximum reflectivities of 61.5 dBz, or level 6 (extreme) activity. Figure 9 shows the base reflectivity product for this time period. Figure 9. 0.4° Base Reflectivity Scan at 2345:57 At 2351:59, the 0.4º base reflectivity image depicted a maximum of 52 dBz, or level 5 (intense) activity, along the flight track, with maximum reflectivities of 60 dBz, or level 6 (extreme) activity, located 1 1/2 miles to the northwest. Figure 10 shows the base reflectivity product for this time period. Also, the 1.5º elevation scan at 2353:03 indicated returns of 58 dBz, or level 6 activity, with maximum reflectivities of 62.5 dBz 1/2 mile from the approach end of runway 4R. The WSR-88D’s radial velocity image (showing components of the wind speed that are coming directly toward or away from the radar) for 2346:29 indicated that winds from the northwest at 15 meters per second (30 knots) were over runway 4R. Figure 11 shows the radial velocity image for this time period with the airplane’s flight track. At 2352:30, the radial velocity image depicted winds from the northwest at 18 meters per second (36 knots) over the runway with winds reaching 30 meters per second (60 knots) within 1/2 mile of the approach end of the runway.

Factual Information 30 Aircraft Accident Report Figure 10. 0.4° Base Reflectivity Scan at 2351:59

Figure 11. Radial Velocity Image Surrounding the Time of the Accident

Factual Information 31 Aircraft Accident Report The 1900 upper air sounding (that is, an evaluation of the conditions supporting the development of severe storms) from the NWS Forecast Office in North Little Rock was valid beginning about 2000. The upper air sounding included several stability indexes, which indicated that the atmosphere was unstable with a high potential for severe thunderstorms. In addition, the NWS issued two public weather warnings for severe thunderstorms in the Little Rock area. The first warning was issued about 2156 and was valid until 2245, and the second warning was issued about 2317 and was valid until 0020 on June 2, 1999. Both warnings indicated the threat of strong winds and the potential for hail, and the general public was warned to stay indoors until the storms passed. These weather warnings were made available to the local Little Rock area, and the tower received these warnings through its direct line with the NWS. The FAA does not require controllers to provide pilots with public weather warnings because they are not considered aviation products and contain no aviation references. The local controller did advise a pilot of a light multiengine airplane, which departed the airport about 2328, of the second public weather warning because that airplane was traveling northbound toward the counties covered by the warning. Flight 1420 was approaching the airport from the south and was not on the tower’s frequency at the time. 1.7.3 American Airlines Weather Information At Dallas/Fort Worth, the flight crew viewed a graphical display of the weather radar and received a preflight weather package that contained weather information issued about 2205. The information included reports, forecasts, and notices to airmen for the departure, destination, and alternate airports and the current in-flight weather advisories for the routes. A thunderstorm SIGMEC [significant meteorological condition] stated the following: 53 En route thunderstorm SIGMEC. Valid from 0255Z through 0800Z on June 2,

1. Over Texas, Louisiana, Arkansas, and Oklahoma. Coverage widely

scattered area of thunderstorms located from 10 miles northeast of Fayetteville, AR, to Little Rock, AR, to Texarkana, AR, to Paris, TX, to Fayetteville, AR, then back to 10 miles northeast of Fayetteville. Thunderstorms moving to the east at 20 knots. Maximum tops at and above 50,000 feet. Outlook, thunderstorms increasing through 0600Z and then decreasing. Other in-flight weather advisories included in the preflight weather package were a brief of NWS Severe Weather Forecast Alert No. 357 and NWS Convective SIGMET No. 11C, which indicated an area of severe thunderstorms moving from 300º at 20 knots with cloud tops above 45,000 feet and the possibility of hail to 2 inches and wind gusts to 70 knots. The SIGMET was valid over portions of Arkansas (including Little Rock), Oklahoma, and Texas until 2355, but Convective SIGMET 15C replaced it about 2255. The preflight weather information also included the 2153 ASOS observation, the TAF 53 A SIGMEC is an American Airlines-issued weather advisory about conditions that may influence the safety of flight operations.

Factual Information 32 Aircraft Accident Report issued at 1830,54 and airport field conditions for Little Rock (all runways were open and wet, with 0 inch of water and no reports of braking action problems). The American Airlines flight dispatcher was using a high-resolution Weather Services International radar mosaic product to track the weather in relation to an airplane’s flightpath. The radar mosaics eliminate false echoes and ground clutter, but the product is delayed by several minutes.55 The flight dispatcher indicated, during public hearing testimony, that he received updates on the weather every 15 minutes but that the radar data were 5 to 15 minutes old by that time. The dispatcher also indicated that he did not have access to real-time WSR-88D single-site weather data or TDWR.56 The flight dispatcher’s 2254 ACARS message to the flight crew stated the following: Right now on radar there is a large slot to Little Rock. Thunderstorms are on the left and right, and Little Rock is in the clear. Sort of like a bowling alley approach.[57] Thunderstorms are moving east-northeastward toward Little Rock and they may be a factor for our arrival. I suggest expediting our arrival in order to beat the thunderstorms to Little Rock if possible. About 2257, the flight crew sent an ACARS message, requesting weather information for Little Rock airport. The flight crew received the 2153 ASOS observation, which was already included in the preflight weather package. The 2253 ASOS observation was not available to the flight crew until after 2300. The flight dispatcher stated that he did not see the 2258 amended TAF (which changed the wind direction and was more specific regarding the impact period of the thunderstorm). The dispatcher did not receive the amended TAF because it was issued when American’s primary weather circuit from the FAA was preparing to receive hourly weather observation information. 54 This TAF, which was valid beginning about 1900, indicated that the visibility beginning about 2300 would be greater than 6 miles and that the probability of a thunderstorm between 2300 and 0300 on June 2 was greater than 50 percent. 55 To eliminate ground clutter, a computer program compares the images with previous observations and local ground clutter patterns and then overlays the images with the other data to correct for beam height and distance errors. 56 The flight dispatcher indicated that the Internet has sites that use Doppler weather radar technology to depict weather information but that he did not have access to such information. 57 In public hearing testimony, the flight dispatcher indicated that the “bowling alley” message was meant to be as brief and concise as possible but give the pilots an image of what to expect because the airborne weather radar was not able to show a full area of coverage. According to the CVR, the captain stated at 2326:52, “this is the bowling alley right here,” and at 2332:31, “down the bowling alley.”

Factual Information 33 Aircraft Accident Report 1.7.4 Additional Weather Information 1.7.4.1 Lightning Data American Airlines provided the Safety Board with a display from the National Lightning Detection Network58 depicting 1,177 lightning strikes over the state of Arkansas between 2345 and 2400. The Board used lightning verification reports from this network to determine that, between 2346 and 2351, 903 cloud-to-ground lightning strikes were detected within 20 miles of the center of the airport and 46 cloud-to-ground lightning strikes were detected within 5 miles of the center of the airport. 1.7.4.2 Witness Statements The Safety Board interviewed two witnesses to the weather conditions surrounding the time of the accident. One witness, a cross-country truck driver in the vicinity of the airport, indicated that “torrential rain” was occurring when he saw the accident airplane “coming in cocked with the wings tilted to the right.” He also stated that “strong gusty winds,” “intermittent golf ball size hail,”59 and “almost continuous” lightning were occurring after he saw the airplane. The other witness was waiting in the airport terminal for his wife. He indicated that hail had started just before the airplane landed and that the hail was “really hard” when the airplane touched down. He stated that thunder and lightning were occurring simultaneously. He further stated that the thunder vibration “felt like it would break the glass [on the windows in the terminal]” and that the hail had cracked the glass. 1.7.4.3 Windshear Hazard Study A research scientist with the National Aeronautics and Space Administration’s (NASA) Langley Research Center in Hampton, Virginia, examined available weather data and conducted modeling simulations to determine the turbulence, windshear, and crosswind hazards surrounding the time of the accident. The draft report on this research indicated that a strong “bow echo” squall line system approached the airport during the time of the accident and produced hazardous crosswinds.60 According to the report, a bow echo refers to a radar echo that appears to undergo a forward acceleration at its midpoint, thus forming a bulge in the radar signature, and is known to harbor severe weather.61 The report also indicated that the accident airplane might not have encountered hazardous levels of windshear. The report suggested that crosswind and windshear hazards were not synonymous because each affected airplane control differently. The report indicated that the hazards 58 Global Atmospherics, Inc., in Tucson, Arizona, operates the National Lightning Detection Network. 59 The leading edges of the airplane’s wings showed no damage that would be consistent with a heavy hail encounter. 60 Proctor, Fred H. 1999. Investigation of the Storm Associated With the 1 June 1999 Aircraft Accident at Little Rock, Arkansas. NASA Langley Research Center. 61 The report added that a bow echo could be detected with conventional and Doppler radar.

Factual Information 34 Aircraft Accident Report associated with a crosswind threat were “collision with obstacles, lack of control authority on touchdown resulting in damage to aircraft and injury to passengers, [and] impaired directional control on the runway.” The report further indicated that the hazard associated with a windshear threat was “flight into terrain.” In addition, the report stated that hazardous crosswinds and windshear could affect airplanes at low altitudes during the approach and departure phases of flight but that crosswind could only affect airplanes during the takeoff and landing flight phases. The report concluded that advisories and alerts for hazardous crosswinds could be developed and implemented into existing LLWAS systems. 1.8 Aids to Navigation The Little Rock VOR is on the 113.9 megahertz (mHz) radio frequency and has distance measuring equipment associated with it. The runway 4R/22L ILS is on the 111.3 mHz radio frequency. No problems with these navigational aids were reported. 1.9 Communications No communications problems were reported between the flight crew and any of the air traffic control (ATC) facilities that handled flight 1420. 1.10 Airport Information Little Rock National Airport is located immediately south of the Arkansas River and approximately 2 miles east of metropolitan Little Rock at an elevation of 260 feet msl. The airport is owned by the city of Little Rock and is operated by the Little Rock Municipal Airport Commission. Little Rock National Airport has three concrete transverse grooved runways: 4L/22R, 4R/22L, and 18/36. Runway 4R/22L is 7,200 feet long and 150 feet wide and is equipped with high-intensity runway edge lights62 and centerline lights. (Runway 4L/22R is 8,273 feet long and 150 wide; runway 18/36 is 5,124 feet long and 150 feet wide.) Runway 4R is equipped with a medium-intensity approach lighting system with runway alignment indicator lights. Runway 22L has a medium-intensity approach lighting system with sequenced flashing lights and a precision approach path indicator. There are published ILS approaches for runways 4L, 4R, 22L, and 22R. At the time of the accident, the ILS equipment for runway 4L/22R was out of service because of 62 The RVR system log, which records runway edge light settings once per hour indicated that, about 2344, the runway 4R edge lights were set at step 3. (Step 1 is the lowest edge light setting; step 5 is the highest.) The RVR log is the only available recorded information on the light setting before the accident. In a postaccident interview, the controller could not recall whether he changed the light setting after 2344 in response to the decreasing visibility.

Factual Information 35 Aircraft Accident Report the installation of upgrades. (Although the upgrade work had been completed, this ILS equipment remained unusable because it had not yet been flight checked.) Equipment monitor logs showed that the ILS equipment for runway 4R was operating normally. A postaccident flight check could not be conducted because the ILS localizer antenna was damaged during the accident sequence. The FAA’s Lead Systems Engineer for Navigation and Landing, in testimony at the Safety Board’s public hearing on this accident, stated that a new-generation RVR system was installed for runway 4R/22L in August 1996. The new-generation system consists of an infrared transmitter source and an infrared transmitter receiver, which can detect rain, mist, or snow, and a runway sensor light, which computes the RVR.63 The digital readout is transmitted to the tower, and local controllers use this information to indicate to pilots upward, downward, or steady trends. The display can be updated every 2 seconds based on the average for the preceding minute. The RVR sensors are mounted about 18 feet above the ground and are located at both ends of the runway, near the ILS glideslope antennas and the painted touchdown zone markers, to detect the touchdown and rollout RVRs.64 The system has a quarterly maintenance period involving calibration and certification. The system’s last maintenance before the accident was on May 17, 1999. According to the Lead Systems Engineer, there were no indications of problems with the RVR system on the night of the accident. Also, an inspection was done on June 2, 1999, during which the system was recertified. An archiving function within the RVR data processor unit can retain 12 hours of RVR data (the previous 2 hours and the following 10 hours). The unit must be set to start an event log within 2 hours of an occurrence, or the data will be lost. The 1-minute RVR data surrounding the time of this accident were not retained because an event log was not started within 2 hours. RVR data at Little Rock are not reported directly to the airport’s ASOS unit; the contract weather observer must obtain the 10-minute average visibility reading from the tower for inclusion in an observation.65 The manager for the contract weather observers at Little Rock stated in a postaccident interview that the observers would not delay the transmission of an ASOS observation for an RVR reading. 63 The earlier system used transmissometers—light sources that transmitted beams to receivers mounted on stanchions—to determine the RVR. The new system has been installed at about 150 U.S. airports. 64 Runway 4R/22L was not equipped with sensors to detect the midpoint RVR. 65 Annex 3 to the Convention on International Civil Aviation (Chicago Convention), Chapter 4 (dated May 11, 1998), includes recommended practices for Contracting States regarding meteorological observations and reports. Paragraph 4.1.8 states that “[weather] observation systems should include automated equipment for measuring or evaluating, as appropriate, and for monitoring and remote indicating of surface wind, runway visual range, cloud height, and…other meteorological parameters affecting landing and take-off operations.” The United States is 1 of 185 countries that are signatories to the Chicago Convention.

Factual Information 36 Aircraft Accident Report Little Rock National Airport is certified by the FAA as an aircraft rescue and fire fighting (ARFF) index C facility.66 At the time of the accident, the FAA’s most recent annual airport certification inspection was from July 29 to 31, 1998. The last full-scale airport disaster drill was held in October 1996. According to the Airport Manager, Little Rock’s Airport Certification Manual was approved by the FAA on May 10, 1999. Title 14 CFR 139.205 states that the manual must include “a grid map or other means of identifying locations and terrain features on and around the airport which are significant to emergency operations.” The Manager of the Airport Safety and Certification Branch, FAA Office of Airport Safety and Standards, indicated that the airport’s Emergency Access Plan (a diagram that shows emergency vehicle access points) was considered by the FAA to be a satisfactory alternative means of identifying locations and terrain features. The access plan was part of the airport’s FAA-approved Airport Emergency Plan and was included in the Airport Certification Manual. 1.10.1 Runway 4R/22L Safety Areas Runway 4R/22L was opened for aircraft operations in September 1991. According to an FAA November 23, 1999, memorandum, runway 4R/22L was built to abate noise over the communities located southeast of the airport. Runway 4R (oriented southwest to northeast) was intended to be used primarily for takeoffs, and runway 22L (oriented northeast to southwest) was intended to be used primarily for landings. The memorandum detailed the site constraints on the design and construction of the runway, including a flood plain of a creek and rising terrain to the southwest and the flood plain of the Arkansas River to the northeast. The total length available for the runway and its associated safety areas was 8,650 feet. A runway length of 7,200 feet was needed,67 so 1,450 feet was available for the safety areas. The runway was designed so that a 1,000-foot safety area extended from the southwest (runway 22L) and a 450-foot safety area extended from the northeast (runway 4R).68 The specifications for runway safety areas are contained in 14 CFR 139.309, “Safety Areas,” which became effective on January 1, 1988. The specifications state the following: (a) To the extent practicable, each certificate holder shall provide and maintain for each runway and taxiway which is available for air carrier use— 66 According to 14 CFR 139.315 and 139.317, an ARFF index C facility is to have two or three firefighting vehicles with a total of at least 3,000 gallons of water and aqueous film forming foam. The Little Rock airport has three ARFF vehicles, each with the capacity to carry 1,500 gallons of water and 200 gallons of aqueous film forming foam. 67 The FAA’s memorandum did not specify how the 7,200-foot length requirement was established. 68 The FAA’s memorandum stated that accident data indicated that runway overruns during landing are twice as likely to occur than underruns, which explains the decision to placed 1,000-foot runway safety area at the southwest end of the runway.

Factual Information 37 Aircraft Accident Report (1) If the runway or taxiway had a safety area on December 31, 1987, and if no reconstruction or significant expansion of the runway or taxiway was begun on or after January 1, 1988, a safety area of at least the dimensions that existed on December 31, 1987; or (2) construction, reconstruction, or significant expansion of the runway or taxiway began on or after January 1, 1988, a safety area which conforms to the dimensions acceptable to the Administrator at the time construction, reconstruction, or expansion began. Paragraph (c) of this section states that “FAA Advisory Circulars in the 150 series contain standards and procedures for the configuration and maintenance of safety areas acceptable to the Administrator.” Table 3-3 in FAA Advisory Circular (AC) 150/5300-13, “Airport Design,” dated June 5, 1991, indicates that the runway safety area length should be 1,000 feet. The FAA’s memorandum stated that the Little Rock airport operator was required to comply with Section 139.309(a)(1) because, according to FAA records, five grants for the construction of runway 4R/22L were issued before January 1, 1988 (with the first one in 1982). The memorandum also stated that the runway safety areas for runway 4R/22L met the regulatory requirements. In July 2001, the Little Rock Airport Manager indicated that the airport was working with the Army Corps of Engineers, the Federal Emergency Management Agency, Pulaski County, and the cities of Little Rock and North Little Rock to extend the runway safety area at the departure end of runway 4R to 1,000 feet. The airport manager also indicated that, if all hydraulic studies and permits are approved, the runway safety area extension could be completed by July 2002. 1.10.2 Runway 22L Approach Lighting System Support Structure The runway 22L approach lighting system support structure, which is located in a flood plain area of the Arkansas River, is not considered frangible. (The top portion of the structure—its walkway—is considered frangible.) According to AC 150/5300-13, a frangible navigational aid “retains the structural integrity and stiffness up to a designated maximum load, but on impact from a greater load, breaks, distorts, or yields in such a manner as to present the minimum hazard to aircraft.”69 The FAA’s Lead Systems Engineer for Navigation and Landing stated that a structure mounted in a flood plain, such as the runway 22L approach lighting system structure, cannot be frangible because of the possibility of moving water, ice, and floating debris. The Lead Systems Engineer stated that there are benefits to placing or establishing frangible structures in runway safety areas, citing the November 12, 1995, American Airlines flight 1572 accident in East Granby, Connecticut, as an example. In 69 AC 150/5300-13 indicates that frangible navigational aids include electrical and visual air navigational aids, lights, signs, and associated supporting equipment.

Factual Information 38 Aircraft Accident Report that accident, a McDonnell Douglas MD-83 was on final approach, at night and in strong, gusty wind conditions, to runway 15 at Bradley International Airport in Windsor Locks, Connecticut, when it collided with trees. The airplane landed short of the runway and then struck an ILS localizer array (a frangible structure), which properly broke into pieces and thus minimized further damage to the airplane.70 The Lead Systems Engineer also indicated that the FAA’s effort to replace nonfrangible structures with frangible ones (where appropriate) has been a relatively slow process but that work at about three-fourths of the 450 sites with such structures has been accomplished.71 1.10.3 Runway 4R Assessments 1.10.3.1 Tire Marks Tire marks72 consistent with those from the left main landing gear began 5,228 feet before the departure end of runway 4R, about 1 foot to the right of the runway’s centerline, and continued for 149 feet (5,079 feet before the departure end). Tire marks were not present on the runway’s next 207 feet but began again 4,872 feet from the departure end of the runway, about 13 feet to the right of the centerline, and continued until the edge of a gravel downslope located 459 feet beyond the end of the runway. The tire marks were approximately 98 feet to the left of the centerline at the end of the runway surface. Also, the grass to the left of the runway showed tire marks consistent with those from the left main landing gear beginning about 710 feet before the departure end of the runway. Tire marks consistent with those from the right main landing gear began 4,303 feet before the departure end of runway 4R, about 47 feet to the right of the runway’s centerline, and continued until the edge of the gravel downslope located 459 feet beyond the end of the runway. The tire marks were approximately 82 feet to the left of the centerline at the end of the runway surface. In addition, the grass to the left of 70 For more information, see National Transportation Safety Board. 1996. Collision With Trees on Final Approach, American Airlines Flight 1572, McDonnell Douglas MD-83, N566AA, East Granby, Connecticut, November 12, 1995. Aircraft Accident Report NTSB/AAR-96/05. Washington, DC. 71 One airport with nonfrangible structures that need to be replaced is Chattanooga Metropolitan Airport, Tennessee. The Safety Board received a copy of a June 3, 1999, letter from the President of the Chattanooga Metropolitan Airport Authority to the FAA Administrator. The letter expressed concern about nonfrangible poles in the airport’s runway safety area and cited a 1973 accident involving a DC-9 airplane that struck approach lights mounted on such poles while landing during a thunderstorm. No one was killed in that accident, but the airport authority recognized that the nonfrangible poles were a hazard. The letter further indicated that the approach lighting system was scheduled for replacement but that the date continued to be postponed. The Lead Systems Engineer stated that the replacement lighting system has been delivered by the manufacturer and is in storage but has not yet been installed because of a lack of funding. 72 The tire marks were more whitish in color than the surrounding off-white concrete surface. At those points where the tire marks crossed white runway paint markings, the white paint was cleaner and whiter than the surrounding paint. At those points where the tire marks crossed black runway paint markings, the black paint was cleaner and darker than the surrounding paint, and there were no white marks. For information on the relationship between the tire marks and runway friction, see section 1.18.1.

Factual Information 39 Aircraft Accident Report the runway showed tire marks consistent with those from the right main landing gear beginning about 465 feet before the departure end of the runway. Tire marks consistent with those from the nose gear began 5,079 feet before the departure end of runway 4R, about 6 feet to the right of the runway’s centerline, and continued for 207 feet (4,872 feet before the departure end). Tire marks were not present on the runway’s next 119 feet but began again 4,753 feet before the departure end of the runway, about 18 feet to the right of the centerline, and continued with occasional interruption until the left edge of the ILS localizer array located 411 feet beyond the end of the runway. The tire marks were approximately 67 feet to the left of the centerline at the end of the runway surface. Section 1.12.1 contains a photograph showing the tire marks off the end of the runway. 1.10.3.2 Runway Surface Information The following assessments of runway 4R were made starting the day after the accident: • A visual inspection revealed several small holes (about 4 inches in diameter) in the pavement on the approach end of runway 4R. Some of the holes had been filled with epoxy. There was evidence of light and medium rubber deposits on the runway surface. No evidence of structural pavement failure was present. • Friction survey tests, using an Airport Surface Friction Tester, were conducted at 40 to 60 mph in both runway directions. AC 150/5320-12C, “Measurement, Construction, and Maintenance of Skid-Resistant Airport Pavement Surfaces” (dated March 18, 1997), states that the maintenance planning friction levels at 40 and 60 mph are 0.60 and 0.47, respectively. The average friction readings for runway 4R were 0.69 at 40 mph and 0.55 at 60 mph. • The groove specifications for runway 4R were 1/4-inch deep by 1/4-inch wide and spaced 2 inches apart (center to center). An inspection of selected grooves found that all met the 1/4-inch width and 2-inch spacing specifications. Thirteen panels (19 feet in length) along the full length of runway 4R, including several located by the marks left by the main landing gear tires, were selected for an inspection of groove depth. The average depth was 1/4 inch. • Field measurements for the runway’s transverse slope (from crown to shoulder) averaged 1.42 percent. The construction drawings indicated a transverse slope of 1.5 percent.

Factual Information 40 Aircraft Accident Report • The average surface texture depth measurements for runway 4R were 0.055 inch (clean grooved concrete) and 0.015 inch (clean ungrooved concrete).73 The average surface texture depth for the rubber-coated, grooved touchdown area of runway 4R was 0.050 inch. (The average surface texture depth for the rubber-coated, grooved touchdown area of runway 22L was 0.055 inch.) AC 150/5320-12C states that, when the average texture depth measurement falls below 0.045 inch (the recommended average texture depth for newly constructed pavements), the airport operator should conduct texture depth measurements each time a runway friction survey is conducted. The AC indicates that corrective actions need to be taken when the average texture depth is below 0.030 inch. In addition, the transverse water flow characteristics of runway 4R were measured by water drainage tests performed on November 16, 1999. The tests involved the release of water from a tanker truck hose onto the centerline of the runway at 100- and 500-feet increments, starting at 5,608 feet before the departure end of the runway (just before the initial left main landing gear tire marks). Dry and wet runway drainage tests were performed, and the winds were calm at the time of the tests. The test data indicated that the average flow rates from the left to right shoulder edges when the surface was wet were about 10 percent higher than the rates when the surface was dry. Also, a senior research engineer from NASA’s Langley Research Center (who was a member of the Airplane Performance Group) determined that, with no winds and the cross (or transverse) slope and surface texture depth values measured after the accident, runway 4R was capable of handling rainfall rates up to 1.4 inches per hour before surface flooding (that is, water depths reaching 0.1 inch and greater) would occur at 15 feet from the centerline. Crosswinds from the left side of the runway, which existed at the time of the accident, would result in deeper water and more flooding on the left side of the runway and shallower water and less flooding on the right side of the runway. The NASA Langley engineer testified that the measurements taken in November 1999 of runway 4R indicated that the cross slope was “very uniform” and provided good drainage of the water from the centerline to the shoulder. 1.10.4 Air Traffic Control Tower Information The Little Rock ATCT is located on the terminal building and includes a terminal radar approach control (TRACON). The tower cab has positions for cab coordinator, local control-1 and -2, ground control, and flight data. The local control-1 and ground control positions have panels showing readings for the LLWAS system sensors. The local control-1 position also has a Digital Bright Radar Indicator Tower Equipment (D-BRITE) radar display. A System Atlanta Information Display System–4 monitor, located to the right of the flight data position, contains airport-related information and displays hourly and special ASOS observations. 73 The transverse grooves end about 13 feet from the runway’s left and right shoulder edges.

Factual Information 41 Aircraft Accident Report ATC radar data are provided by an Airport Surveillance Radar (ASR)-8 sensor located on the airport between runways 4L and 4R. Radar data processing is performed by an Automated Radar Terminal System IIE system that is linked with the TRACON and D-BRITE radar display. At the time of the accident, the ATCT was operating with midnight shift staffing—one local controller and one controller-in-charge. All approach and tower control positions were combined at the local control-1 position. The local controller who was handling flight 1420 at the time of the accident was initially certified as a control tower operator in December 1986. The controller served as an air traffic controller for Mather Air Force Base in California for 3 years before beginning work with the FAA. According to his training records, the controller started at the Midway ATCT in Chicago in October 1988 and became a certified professional controller there in June 1990. He transferred to the Little Rock ATCT in November 1992 and has been a certified professional controller there since September 1993. His last medical certification was in October 1997. On the day of the accident, the local controller had worked the 0600 to 1400 shift. Afterward, he went home, slept for about 4 hours, and returned to the ATCT about 2250 for the 2300 to 0700 shift. He received a position relief briefing from the evening shift controller and then called the TRACON to combine the radar positions in the tower cab. The controller-in-charge was in the TRACON performing administrative duties. Flight 1420 was the first air carrier operation of the local controller’s shift. The controller stated that he first saw the airplane when it was about 1 mile out during final approach and that the landing appeared “normal” and “within the touchdown zone.” Because of the reduced visibility, the controller lost sight of the airplane during its rollout. The ATCT transcript indicated that, at 2350:54, the controller requested that flight 1420 report clear of the runway. The controller attempted to contact flight 1420 five more times, between at 2351:16 and 2353:22, and called the ARFF units on the crash phone at 2352:00.74 Section 1.15.3 provides information on the emergency response. The local controller also called the controller-in-charge, asking for his assistance. When the controller-in-charge arrived in the tower cab, the local controller informed him about the possibility of an accident. The ATCT transcript indicated that, about 0003:16, the ARFF units reported that they had located the airplane off the end of the runway. The controller-in-charge then began administrative notification activities. About 0015, the controller-in-charge relieved the local controller, at which time the local controller continued the notification process. 74 In a postaccident interview, ARFF personnel indicated that the call on the crash phone was received about 2355—3 minutes later than the controller reported initiating the call. Because the ATC and CVR times could be fairly well correlated, the ARFF response times in this report are based on ATC times.

Factual Information 42 Aircraft Accident Report 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The accident airplane was equipped with a Fairchild model A-100A CVR, serial number 53282. The exterior of the CVR showed no evidence of structural damage but was coated with soot. The interior of the CVR and the tape sustained no apparent heat or impact damage. The CVR was sent to the Safety Board’s audio laboratory in Washington D.C., for readout and evaluation. The CVR data started at 2319:44 and continued uninterrupted until 2350:48.1 when electrical power to the CVR ceased. The recording consisted of four channels of “good quality” audio information.75 The four channels contained the cockpit area microphone, the captain’s audio panel, the first officer’s audio panel, and the interphone and public address system. A transcript was prepared of the entire 31-minute 4-second recording (see appendix B). No sounds that were consistent with the arming or the deployment of the spoilers could be detected on the CVR tape. Two flight tests were conducted on August 27, 1999, to determine whether such sounds could be detected on a CVR recording. Both flight tests were conducted on an American Airlines revenue passenger flight, and both airplanes were MD-82 models equipped with a Fairchild model A100A CVR that was similar to the one installed on the accident airplane. As part of the flight tests, the nonflying pilot verbally confirmed when the spoilers were armed and deployed. The first flight test was conducted on American flight 1829 from Ronald Reagan Washington National Airport to Chicago-O’Hare. The second flight test was conducted on American flight 154 from Chicago to Washington, D.C. Both tests revealed that the spoiler arming and automatic deployment could be clearly heard on the CVR recordings. In fact, the captain on the second test flight attempted to arm the spoiler handle very slowly to make minimum noise, but a definite “click” sound was recorded on the CVR as the spoiler handle was lifted. 1.11.2 Flight Data Recorder The accident airplane was equipped with an L3 model FA2100 FDR, serial number 00718. The FDR used solid-state flash memory technology as the recording medium and was configured to digitally record a minimum of 25 hours of operational data before the oldest data were overwritten. 75 The Safety Board ranks the quality of CVR recordings in five categories: excellent, good, fair, poor, and unusable. For a recording to be considered good quality, most of the crew conversations need to be accurately and easily understood. The transcript developed from the recording might indicate several words or phrases that were not intelligible; such losses are attributed to minor technical deficiencies or momentary dropouts in the recording system or simultaneous cockpit/radio transmissions that obscure one another.

Factual Information 43 Aircraft Accident Report The FDR was sent to the Safety Board’s FDR laboratory in Washington, D.C., for readout and evaluation.76 The exterior of the FDR showed evidence of fire and smoke damage. The interior of the FDR showed no signs of damage, and the recording was retrieved from the crash-survivable storage unit. The FDR contained more than 62 hours of data, and American Airlines provided conversion formulas for the data. Examination of the recovered data indicated that the FDR operated normally. Data transcribed included flight 1420’s pushback from the gate at Dallas/Fort Worth and the accident airplane’s previous landing at Dallas/Fort Worth. 1.12 Wreckage and Impact Information 1.12.1 General Wreckage Description The Safety Board performed a complete survey of the accident site and airplane structure. The airplane was found approximately 800 feet beyond the departure end of runway 4R. Wreckage was found throughout the flood plain located approximately 15 feet below the runway elevation and down a rock embankment. Wreckage was also found up to 150 feet laterally from the runway 22L approach lighting system and approximately 500 to 850 feet from the end of runway 4R. No fluid markings or airplane components were found on the runway surface. The fuselage had separated into three main sections (forward, center, and aft). The forward and center fuselage sections were oriented on a magnetic heading of approximately 115º; the rear fuselage section and the empennage were oriented on a magnetic heading of approximately 205º. No evidence of fire damage was found in the forward and center sections of the fuselage, but a postcrash fire had completely consumed the passenger cabin in the rear fuselage section. The left wing was fractured and was completely severed near its root and wing tip. The right wing was found attached to the fuselage. Both engines were attached to their pylons, which were attached to the fuselage. The nose gear and right main landing gear were sheared from their attachments, and the left main landing gear had folded into its main gear wheel well. The airplane’s collision with the approach lighting system crushed the nose of the airplane rearward and destroyed the left side of the fuselage from the airplane’s nose to the cockpit’s rear bulkhead and from the beginning of the first-class section aft to the second row of the coach section. Large sections of the approach lighting system were intermingled with fuselage structure that had been peeled away from the airplane. The collision with the approach lighting system also created a hole in the left side of the cabin that extended from the overhead stowage bins to the cabin floor in the first-class and coach sections. 76 For a listing of the parameters recorded by the FDR, see the FDR Group Chairman’s Factual Report in the public docket for this accident. Data from the accident flight and the airplane’s previous landings indicated that two parameters—brake pressure left and brake pressure right—were inactive on N215AA.

Factual Information 44 Aircraft Accident Report Figures 12 through 14 are photographs of the airplane wreckage. Figure 12 shows the airplane wreckage, the tire tracks off the end of runway 4R, and the damage to the runway 22L approach lighting system.77 Figure 13 shows the airplane wreckage and the runway 22L approach lighting system. Figure 14 shows a closer view of the airplane and the runway 22L approach lighting system. Additional details about the airplane wreckage are presented in sections 1.12.2 through 1.12.4. Figure 12. Aerial Photograph of Runway 4R/22L, Airplane Wreckage, and Runway 22L Approach Lighting System 77 The runway 22L approach lighting system is supported by steel columns or platform assemblies that include steel columns. Five steel columns and two platform assemblies were struck by the accident airplane during its overrun. Each of these seven support structures was spaced 50 feet apart along a line that coincided with the centerline of runway 4R/22L. The first support structure was located about 530 feet from the end of the runway, and the seventh was located 830 feet from the end of the runway.

Factual Information 45 Aircraft Accident Report Figure 13. Airplane Wreckage and Runway 22L Approach Lighting System Figure 14. View of Left Side of Airplane Wreckage and Runway 22L Approach Lighting System

Factual Information 46 Aircraft Accident Report 1.12.2 Spoiler System The left flight spoilers and left ground spoiler were found in the retracted position. No damage was noted on either of the flight spoilers. The left ground spoiler panel was fractured inboard of the actuator hinge attachment. The inboard half of the left ground spoiler was heavily sooted on its entire upper surface; no soot was found on the outboard half. The ground spoiler actuator exhibited heat and fire damage and moved freely. The right flight spoilers and right ground spoiler were found in the retracted position. No damage was noted on either of the flight spoilers. The right ground spoiler panel was fractured outboard of the actuator hinge. The mechanical overcenter link was latched. The cockpit center pedestal had considerable displacement and deformation in the left downward direction. The spoiler handle was found fully aft. About one-half of the autospoiler system ARM red indicator stripe was visible, and the handle guide was resting on the pedestal surface. Tests performed on the accident airplane’s spoiler system are discussed in section 1.16.1. 1.12.3 Engines Both engines showed no evidence of any uncontainments, case ruptures, or precrash fires. The engines’ low pressure rotors rotated freely, and the fan blades had minor impact damage on the leading edges of the airfoils. The left engine thrust reverser was partially deployed, and the right engine’s thrust reverser was completely stowed. The left engine’s fuel control was in the reverse thrust range, and the right engine’s fuel control was in the forward thrust range. On June 8, 1999, the two engines, thrust reversers, and EPR transmitters were examined and tested at American Airlines Maintenance and Engineering Center. The engines were able to produce normal-rated takeoff thrust without exceeding operating limitations. The thrust reversers were able to cycle from the stowed-to-deployed and deployed-to-stowed positions. The EPR transmitters were found to function normally. 1.12.4 Landing Gear and Brake Assemblies The left main landing gear was lodged into its wheel well, and the wheel assembly was oriented 90º clockwise from its normal position. The outboard (No. 1) and inboard (No. 2) tires were found deflated and exhibited deformation. Both tires had large cuts and lacerations on the tread surface and sidewalls. The tread depths for the No. 1 and 2 tires ranged from 0.156 to 0.250 inch. No flat spots were present on either of the tires.78 78 According to Michelin Aircraft Tire Corporation (the manufacturer of the accident airplane’s tires), flat spots result from skidding without tire rotation, for example, during brake lockup.

Factual Information 47 Aircraft Accident Report The right main landing gear and its rear spar attachment fitting was found separated from the rear spar and aft of the right inboard wing. The inboard tire (No. 3) was found deflated, and the outboard tire (No. 4) was found pressurized at about 195 psi (unloaded). The tires had large cuts and lacerations on both the tread surfaces and sidewalls. The tread depths for the No. 3 and 4 tires ranged from 0.094 to 0.313 inch. No flat spots were present on either of the tires. The nose gear strut and wheel assembly were found protruding from beneath the right side of the fuselage belly. Both tires were found deflated, and both inboard wheel halves were cracked. The tread depths for the left and right tires ranged from 0.125 to 0.188 inch. The nose-wheel steering cylinders were found in the debris field with both their pistons extended almost equal amounts. The left main landing gear brake assemblies showed no evidence of overheat damage but showed evidence of impact damage. The No. 1 brake had approximately 1 inch of wear pin remaining, and the No. 2 brake had 11/16 inch of wear pin remaining. The right main landing gear brake assemblies showed no evidence of impact or overheat damage. The No. 3 brake had approximately 3/4 inch of wear pin remaining, and the No. 4 brake had about 1 inch of wear pin remaining. The antiskid control box was tested at Crane Hydro-Aire (the manufacturer), Burbank, California, on August 3, 1999. The control box passed all functional tests described in the manufacturer’s TP42-807 test procedure. Tests performed on the accident airplane’s main landing gear tires are discussed in section 1.16.2. 1.13 Medical and Pathological Information According to the Pulaski County Coroner, the captain and the passengers in seats 3A, 8A, 17B, 18A, and 18B died as a result of traumatic injuries, and the passengers in seats 19A, 19B, 19D, 27E, and 28D died from smoke and soot inhalation and/or thermal injuries. Two of the passengers (seats 8A and 28D), died on June 10 and June 16, 1999, respectively.79 Tissue and fluid specimens from the captain were transported to the FAA’s Civil Aerospace Medical Institute (CAMI) in Oklahoma City, Oklahoma, for toxicological analysis. The CAMI laboratory performed its routine analysis for major drugs of abuse and prescription and over-the-counter medications, and the results were negative. The analysis detected no ethanol in the captain’s blood and tissue specimens. American Airlines’ Area Medical Director indicated in a September 1, 1999, letter to the Safety Board that postaccident drug testing was not performed on the first officer because of his medical condition after the accident and his inability (because of sedation) to comprehend the documentation requiring knowledge and consent. The letter 79 According to 14 CFR 830.2, fatalities that occur within 30 days after an accident are to be included in the total number of fatal injuries.

Factual Information 48 Aircraft Accident Report also stated that a representative of the FAA’s Office of Drug Testing agreed with the decision not to test the first officer. 1.14 Fire A fuel-fed fire erupted between the center and aft fuselage sections after the impact sequence. The fire spread and eventually consumed the interior of the aft fuselage section. The ARFF trucks arrived at the accident scene about 0008. The firefighters applied water and aqueous film forming foam to the fire and extinguished the exterior fire within 60 seconds. Firefighters then suppressed smaller fires, including one under the left wing, by applying aqueous film forming foam for another hour. The Safety Board’s investigation revealed no evidence of an in-flight fire. 1.15 Survival Aspects 1.15.1 General The accident airplane’s interior was original equipment installed in 1983. The airplane was configured with 139 passenger seats, 14 in first class and 125 in coach class. The cockpit contained two flight crew seats and one observer seat. An aft-facing, double-occupancy flight attendant jumpseat was located by the 1L exit door; an aft-facing, single-occupancy flight attendant jumpseat was located by the 2L exit door; and a forward-facing, double-occupancy flight attendant jumpseat was mounted on the tailcone exit door. Figure 15 shows the interior airplane configuration and the injuries sustained by the passengers and crewmembers according to seat location. The airplane was equipped with an overhead emergency lighting system and a floor proximity escape path lighting system. The wiring and lamps on both systems forward of row 17 were tested after the accident using an alternate electrical power source. All undamaged lamps in both systems operated normally.80 The remaining battery packs and control units from both systems were tested at American Airlines facilities in Dallas according to the manufacturers’ test procedures. All of the batteries and control units performed as designed. 80 Some ARFF and Metropolitan Emergency Medical Service (MEMS) personnel reported that they found the cabin floor lights illuminated.

Factual Information 49 Aircraft Accident Report Figure 15. Interior Airplane Configuration and Occupant Injuries

Factual Information 50 Aircraft Accident Report 1.15.2 Evacuation of Passengers and Crewmembers The first officer could not evacuate the airplane on his own because his left femur had been fractured during the accident sequence. He was removed from the airplane wreckage by rescue workers, who had to cut through metal and step on the center pedestal to extricate him.81 The on-scene commander indicated that rescue workers also had to remove some surviving passengers from the first-class section. The flight attendants seated on the forward jumpseat were seriously injured in the crash and could not assist with passenger evacuations. The flight attendants in the aft cabin were able to assist with passenger evacuations. Passengers that were forward of the fuselage separation at row 18 escaped through a large hole on the left side of the first-class section and through a separation in the fuselage at row 12. The forward entrance (1L) and forward galley (1R) doors could not be used because of structural deformation of the fuselage. Six passengers seated on the left side of the first class section (seats 3A and B, 4A and B, and 5A and B) were ejected in their seats through the large hole. (Five of these six passengers survived.) The flight attendant seated on the inboard forward jumpseat was carried out of the airplane by a passenger through the large hole in first class. The flight attendant seated on the outboard forward jumpseat also left the airplane through the large hole in the first-class section. Seven passengers (seated in 17A and B, 18A and B, and 18D through F) were ejected in their seats into the area between the fuselage sections—aft of row 16 on the left, aft of row 17 on the right, and forward of row 19. (Four of these seven passengers survived.) One passenger reportedly exited the airplane at the fuselage break aft of row 17 on the right side. Two passengers exited the airplane through the fuselage separation directly forward of row 19. All four overwing emergency exits were opened by passengers from inside the cabin. Several passengers who were seated aft of row 19 and forward of row 29 used three of the four overwing emergency exits to escape. The passengers seated next to the left and right forward overwing exits reported that they had trouble opening the respective doors but that someone else was able to open these doors. A fire was outside of the left forward overwing exit, and no passengers reported or were observed escaping the airplane through that exit. Four passengers used the right forward overwing exit to escape. The passenger seated next to the left aft overwing exit was able to open the hatch, reporting that the door “seemed to pop out easily and quickly.” The passenger seated next to the right aft overwing exit initially had trouble opening the hatch but was able to get it open. Four passengers used the left aft overwing exit to escape, and at least 26 passengers used the right aft overwing exit. 81 Because emergency personnel had to step on the center pedestal to extricate the first officer from the wreckage, the documented positions of cockpit instruments after the accident might not indicate their positions at the time of the accident. In addition, the emergency personnel indicated that they had turned switches off when they went through the airplane.

Factual Information 51 Aircraft Accident Report The aft galley (2L) door could not be used because of impact damage from the runway 22L approach lighting system. The flight attendant seated in the aft galley jumpseat and four passengers used the gap between the fuselage and the top of the door to escape. The flight attendant seated in the aft cabin jumpseat opened the aft bulkhead door (leading to the tail cone exit) with the assistance of passengers. The flight attendant and several passengers entered the tail cone area, but the tail cone did not fall away from the airplane after the flight attendant and at least one passenger pulled the release handle. The flight attendant and passengers then kicked and jumped on the tail cone and created a gap between the fuselage and the tail cone that 12 people used to escape from the airplane. 1.15.3 Emergency Response As discussed in section 1.10.4, the local controller indicated that he called the ARFF units on the crash phone about 2352. According to ARFF personnel, the controller stated that an American Airlines airplane was down on runway 4R but did not specify the approach or departure end of the runway. The ARFF station responded with all available assets—four firefighters (including a fire captain) and three fire trucks.82 The driver of fire truck No. 2 indicated that the fire trucks had departed the station within 1 minute of the local controller’s call. The driver of fire truck No. 3 reported that he drove into “blinding rain and wind.” All three fire trucks proceeded toward the approach end of runway 4R. (The Little Rock Fire Department District Chief testified at the Safety Board’s public hearing that all three units went in the same direction because they were trained to work as a team.) ARFF personnel indicated that the trucks proceeded slowly (estimated at 15 to 20 mph) because of the restricted visibility (estimated to be about 100 feet) and unknown location of the airplane. The fire captain notified Little Rock Central Communications about 2355 that ARFF vehicles were responding to the report of an American Airlines airplane down on runway 4R. The ATCT transcript indicated that, at 0000:11, fire truck No. 2 indicated that the airplane was not at the approach end of runway 4R and asked the controller whether the fire trucks should “sweep the runway.” Five seconds later, the controller stated that the airplane was at the departure end of the runway and cleared the fire trucks to proceed in 82 Title 14 CFR 139.319(j) requires that “sufficient rescue and firefighting personnel are available during all air carrier operations to operate the vehicles, meet the response times, and meet the minimum agent discharge rates required by this part.”

Factual Information 52 Aircraft Accident Report the other direction.83 The ATCT transcript also indicated that, at 0001:08, the controller informed fire truck no. 2 that “I saw him [the airplane] as he went past midfield.” In postaccident interviews, the firefighters indicated that visibility improved once past the midfield point on their way to the departure end of runway 4R. Fire truck no. 2 indicated that it experienced sliding on the pavement and noted airplane tire tracks leaving the runway surface and a missing runway light. When the trucks arrived at the “22L” painted on the runway, ARFF personnel saw a glow and blowing smoke. The ATCT transcript indicated that, at 0003:16, fire truck No. 1 reported that the airplane was off the end of the runway and on fire and stated “this is an alert three” twice.84 The fire captain informed Little Rock Central Communications of the alert 3 status and indicated that the airplane was off the northern end of runway 4R outside of the airport. The fire captain requested a “full response” from Central Communications. The fire trucks were unable to proceed directly to the airplane because of the slope at the end of the runway. As a result, the trucks had to travel in the opposite direction to an access road and then turn onto a perimeter road back in the direction of the accident site. The fire captain and another firefighter indicated that they had to stop to open a locked perimeter security gate, which took about 20 seconds, before continuing on the perimeter road to the accident site. The three ARFF vehicles reached the accident scene about 0008, and firefighters began extinguishing the fire immediately upon arrival.85 The Little Rock Fire Department District Chief was monitoring his radios at Central Communications when he overheard a report from fire truck No. 2 that the tower had lost communication with an American Airlines airplane. The district chief advised Central Communications that he would report to the accident scene as the on-scene commander. The chief arrived on scene and assumed command from the fire captain, who had set up a command post by that time. The chief reported that most of the fire had been put out by the time he arrived on scene. The district chief testified that the rain helped to extinguish the fire and keep it abated. The chief also testified off-airport help began arriving on scene about 2 to 3 minutes after the ARFF units had arrived. Metropolitan Emergency Medical Services (MEMS) records indicated that dispatch received notification of the alert 3 status about 0005 from an off-duty dispatcher who overheard ARFF radio transmissions on his scanner.86 MEMS dispatch confirmed the 83 The Little Rock Fire Department Chief testified at the public hearing on this accident that the standard phraseology between the fire department and the control tower regarding the location of an airplane normally involves runway and taxiway numbers. He indicated that, when the controller stated that an airplane was down on runway 4R, the firefighters assumed that the airplane was located at the approach end. The chief further indicated that, if the controller had known that the airplane was at the departure end of runway 4R, he would have “more than likely” told the rescue personnel to go to runway 22L. 84 “Alert 3” is defined in the Airport Emergency Plan as an aircraft accident that has occurred on or in the vicinity of the airport. It is the most serious of the airport’s three alert categories. 85 The district chief stated that ARFF personnel’s first priority is fire control so that an escape path can be provided. The chief also stated that, once the fire is controlled, ARFF personnel can assume rescue responsibilities and begin treating victims.

Factual Information 53 Aircraft Accident Report alert 3 status with Little Rock Central Communications about 0006, and dispatch contacted the MEMS supervisor about 0008. Central communications informed MEMS about 0011 that an American Airlines airplane was down and that “a big response” was needed. The MEMS supervisor departed for the accident site about 0012. The supervisor arrived in the accident area about 0017 but could not report on scene because he encountered a locked gate adjacent to the airport’s United Parcel Service facility. He contacted the on-scene commander by radio and was directed to an open gate. The MEMS supervisor reported on scene about 0022 and set up a triage area. A MEMS unit (comprising two emergency medical technicians and a paramedic) arrived 2 minutes later and began triage activities. Another MEMS unit arrived on scene afterward and continued triage activities. Some ambulatory survivors were transported on a bus to a fire station before MEMS personnel could assess them, so a separate triage area was established at the fire station. The Little Rock Fire Department District Chief indicated that, to check for passengers and crewmembers after the accident, firefighters went inside the airplane and did “line abreast searches” about 50 to 100 feet on each side of the airplane and from the airplane to the Arkansas River. The district chief also indicated that, to be sure that everyone was accounted for, the firefighters repeated this process once daybreak occurred. The Little Rock Fire Department reported that 13 engine companies, one ladder company, 1 heavy rescue unit, 1 hazardous materials unit, and 9 staff vehicles were involved during the peak of the emergency response. MEMS estimated that 19 ambulances and a number of other medical support or supply vehicles participated in the emergency response. Also, a medical helicopter made two flights to local hospitals, transporting four people. Survivors of the crash were taken to Arkansas Children’s Hospital, Arkansas Heart Hospital, Baptist Medical Center, Baptist Memorial Medical Center, Southwest Regional Medical Center, St. Vincent Hospital, and the University of Arkansas Medical Center. The Little Rock Fire Department Chief testified that, since the accident, six more ARFF personnel were hired and that the number of personnel for each shift increased to six. He also indicated that the fire department has looked into getting a Driver’s Enhanced Vision System (DEVS). (See section 1.18.4 for information about this system.) At the time of the public hearing on this accident, Little Rock National Airport had not conducted a formal debriefing with all of the parties involved in the emergency response on the night of the accident. In July 2001, the Little Rock Airport Manager stated that the airport conducted individual critiques in February and March 2000 with the Little Rock Fire Department, the Little Rock ATCT, the Little Rock Office of 86 The Little Rock Fire Department indicated that its recorded times were ahead of MEMS times by 2 minutes 46 seconds. Because the fire department’s times appeared to correlate with the original ARFF times, which were adjusted back by about 3 minutes to correlate with ATC times, no time adjustments were necessary for MEMS times.

Factual Information 54 Aircraft Accident Report Emergency Services, airlines that fly into the airport, MEMS, and the Little Rock Police Department. According to the airport manager, the purpose of these critiques was to review the airport’s emergency plan. The airport manager also indicated that the airport conducted a group critique on March 15, 2000. All of the emergency response agencies were invited to attend and provide comments. Present at the group critique were representatives from the airport, the Little Rock ATCT, FAA Flight Standards District Office, six airlines, and three local hospitals. The agenda for the group critique indicated various issues to be discussed, including communications, access to an accident site, triage and treatment areas, grid map parameters, and water rescue capabilities. The Deputy Airport Manager sent a memorandum, dated March 16, 2000, to the emergency response agencies and group critique participants. The memorandum documented the recommendations, observations, and concerns that the hospital representatives expressed during the group critique. 1.15.4 Passenger Statements The Safety Board interviewed 56 surviving passengers in person or by telephone after the accident. Also, the Board sent questionnaires to all 129 surviving passengers, and 110 questionnaires were returned. Passengers reported that the flight was bumpy and that a pilot had announced over the public address system the possibility of some rough weather. Passengers also stated that they saw lightning outside the airplane during the final descent and that a pilot had indicated over the public address system that there was a “light show” outside the airplane. Passengers reported that the rain became harder, and some passengers described turbulence and hail, as the final descent continued. Passengers reported that the touchdown was very hard and that the airplane did not slow down. One passenger indicated that the wheels were “shuddering.” Another passenger stated that he heard a sound similar to car brakes and that the airplane “fishtailed.” Other passengers indicated that they heard the thrust reversers come on and off. Passengers also reported that the flight attendants yelled “brace” to prepare for the impending impact. Passengers indicated that most people evacuated the airplane in an orderly manner (although there were a few reports of passengers pushing or jumping over others) and that some passengers helped others get out of the airplane and away from the wreckage. Passengers also indicated that the fire did not enter the aft fuselage interior until after the passengers had evacuated from that part of the cabin but that smoke entered the aft cabin immediately after the fire began. Passengers further indicated that, once outside the airplane, they encountered heavy rain, strong winds, and hail. Some passengers reported huddling in groups, and others reported sheltering themselves from the weather with bales of hay in a field, until emergency workers arrived. Two passengers reported information regarding the passenger in seat 27E (a 21-year-old male), who was killed in the accident. The passenger in seat 21D indicated in

Factual Information 55 Aircraft Accident Report a postaccident interview that, when the back of the airplane had apparently cleared of passengers, he stuck his head inside the cabin, through the right aft overwing exit, and yelled, “is anybody else in there?” three times, to which someone answered, “that’s everyone—that’s all.” The passenger in seat 21D identified the voice inside the airplane as that of the passenger in seat 27E. (The passenger in seat 21D was the director of a church choir group, and the passenger in seat 27E was a member of the group.) In addition, the passenger in seat 27D stated in a postaccident interview that he saw the passenger in seat 27E “scoot” toward the aisle and stand up after the crash. The body of the passenger from seat 27E was found in the area by rows 32 and 33. 1.16 Tests and Research 1.16.1 Spoiler System Ground Tests To better understand MD-80 spoiler system operation, the Safety Board, while on scene in Little Rock, requested that American conduct ground tests on an MD-82 airplane similar to the accident airplane. These tests, which were conducted at American Airlines’ Maintenance and Engineering Center in Tulsa, Oklahoma, included verification of the maximum spoiler deflection with a full right roll input and the response of the system to the spoiler autoretract mechanism. These tests were intended to assist the Board in gathering on-scene evidence; as a result, the tests were not witnessed by the Board, and the test data were not recorded by American. After a subsequent incident at Palm Springs, California, involving an American Airlines MD-80 series airplane that did not experience autospoiler extension at touchdown, the tests were repeated and additional tests were conducted so that spoiler panel positions could be recorded and CVR and FDR data could be obtained. These tests and the Palm Springs incident are discussed further in section 1.16.1.1. Other tests conducted on the accident airplane’s spoiler system were as follows: • The autospoiler switching unit and ground spoiler control box were tested at American Airlines’ Maintenance and Engineering Center on July 1, 1999. Both passed functional tests. The tests were done in accordance with American Airlines Engineering Specification Order 80503 functional test procedures chapter 10 and American’s Engineering Specification Order 80340 functional test procedure chapter 8. • The two ground control nose oleo switches were tested at the Safety Board’s laboratory in Washington, D.C., on July 10, 1999. Both switches operated smoothly, and electrical continuity was verified in the air (open) and ground (closed) switch positions. • The center pedestal was examined at the Safety Board’s laboratory on July 15,

1. No significant marks were found on the spoiler control handle or handle

slot that would indicate the handle’s position at impact. The autospoiler crank arm was found in the extended position and above the roller on the handle.

Factual Information 56 Aircraft Accident Report The left throttle autoretract crank was measured to be 1 3/4 inches from the idle stop. No evidence of preexisting failures was found on any center pedestal switch or control. • The autospoiler actuator was examined at Telair International (the manufacturer of the actuator), Oxnard, California, on August 6, 1999, and at the Safety Board’s laboratory. The actuator had sustained impact damage. Members of the Systems Group who participated in the teardown agreed that the actuator was most likely capable of functioning within its operational parameters.87 During the disassembly, the wire to the direct current brake was found broken, and the brake plate was found to have excessive wear.88 1.16.1.1 Testing Conducted After the Palm Springs Incident On February 16, 2000, about 0708 Pacific standard time, American Airlines flight 9503, an MD-83, N597AA, departed the left edge of runway 13R while landing at Palm Springs International Airport, Palm Springs, California. The airplane was on a positioning flight from Los Angeles International Airport to Palm Springs. The captain and first officer were not injured, and the airplane received minor damage.89 Tests on the Palm Springs incident airplane were initially conducted at American Airlines’ Maintenance and Engineering Facility on August 24, 2000, but were repeated on October 12, 2000, because of a problem with data recording. The tests and their results are as follows: • Spoiler knockdown: The spoilers were extended, and the left throttle was advanced until the spoiler handle automatically retracted. The spoiler handle was observed to slowly depress until the point at which it was knocked down and automatically retracted. The throttle was measured to be 1 3/4 inches above idle. • Touchdown retract: The crank arm on the left throttle knocked down the spoiler handle when the throttle was advanced about 1 3/8 inch above idle (about 1.16 EPR) before the handle was extended. Six of these “handle knockdown” operations were conducted; for each operation, the FDR recorded an input for both spoiler positions. The recorded left outboard flight spoiler positions ranged from 1.0° and 9.8°, and the recorded right inboard flight spoiler positions ranged from 1.3° and 10.5°. (The recorded positions depended on when the sample was taken in relation to spoiler extension.) The right spoiler panels were observed during some of the operations. The Systems Group estimated that the right flight spoilers extended to about 8° to 87 The actuator passed all functional tests except one. The actuator failed to operate when it was positioned at mid-stroke, a weight was attached to the arm, and a reduced voltage was applied. This failure was not significant to the overall outcome of the testing. 88 Because of the successful brake test and the characteristics of the damage to the wire, the Systems Group determined that the damage to the wire occurred most likely during the accident sequence and that the wire was completely separated during the disassembly. 89 The description for this incident, DCA00IA027, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

Factual Information 57 Aircraft Accident Report 10° before immediately retracting. The time interval for the spoiler panels to extend and then immediately retract was about 1/2 second. The ground spoilers did not move. • Autospoiler extension with roll inputs: Normal autospoiler extensions were conducted with full left and right roll inputs. • Engine response: The throttles were quickly advanced from idle to between 1 3/8 and 1 3/4 inches and then immediately retracted. When the engines were at ground idle, no movement of any engine parameters could be seen in the cockpit. When the engines were at flight idle, a momentary movement of the EPR and N1 indicators was seen in the cockpit. The CVR was running continuously throughout the tests, and the cockpit door was closed during portions of the tests to better replicate in-flight sounds. Recordings were made of the autospoiler actuator operating with the spoiler handle in the armed position, the left throttle at 1 3/4 inches above idle and at idle, and the spoiler handle in the unarmed position. The CVR also recorded the sounds associated with arming and unarming of the spoiler handle. 1.16.2 Main Landing Gear Tire Examination All four main landing gear tires from the Little Rock accident airplane were inspected at the Michelin Aircraft Tire Corporation, Greenville, South Carolina, on October 10, 2000. The entire tread surface (internal and external) of each tire was inspected, and all four tires exhibited typical wear characteristics for bias-ply tires and were estimated to be about 50 percent worn. None of the tires showed any evidence of external reverted rubber or internal ply separation. Superficial scrub marks were found laterally on the tread surface. The tires’ inner liners showed no evidence of underinflation or excessive load. To determine whether the tires had been heated because of reverted rubber hydroplaning,90 Shore hardness tests were performed using a device, known as a durometer, to measure the hardness of the rubber in the tires. (Reverted rubber hydroplaning tends to soften the rubber on the tires.) Durometer measurements were taken every 90° on the tread surface, and all readings were within the tires’ expected operating range. Michelin engineers believed that storage length and conditions would 90 An article, titled “Landing on Slippery Runways,” in Boeing’s October to December 1992 Airliner magazine, explained reverted rubber hydroplaning as follows: “when a tire locks up on a smooth, wet, or icy surface, the friction heat generates steam. The steam pressure then lifts the tire off the runway, and the steam heat reverts the rubber to a black gummy deposit.”

Factual Information 58 Aircraft Accident Report have had only minor effects on the hardness readings and would not have affected reverted rubber if it were present. 91 At the request of investigators, Michelin conducted a more extensive measurement of tire tread hardness by taking measurements every 10° on all four tire ribs. These measurements confirmed that the hardness of each tire was within operational standards.92 Further tests (holographic imaging and sectional, rubber, and microscopic analyses) were considered but not performed because they would not provide any additional data on whether reverted rubber hydroplaning occurred during the accident sequence. Michelin engineers presented information on reverted rubber hydroplaning and the conditions that cause internal reverted rubber. The engineers stated that reverted rubber hydroplaning, which occurs on the molecular level on the surface of the tire tread, happens very quickly and does not cause internal heating of the rubber because of its very low thermal conductivity. The engineers indicated that evidence of reverted rubber hydroplaning could be worn away fairly quickly. The engineers further indicated that, for internal heating of the tires to occur, the tires must have a significant load and be rolling for a substantial distance and that damage from internal heating could accumulate over time. 1.16.3 Cockpit Voice Recorder Sound Spectrum Study To determine whether the autospoiler actuator operated at touchdown, the Safety Board conducted a CVR sound spectrum study at its headquarters in Washington, D.C. The sound spectrums from the CVRs aboard the Little Rock accident airplane, Palm Springs incident airplane, flight test airplanes, and ground test airplane were examined on a spectrum analyzer, which gives a visual presentation of the frequency contents of signals, and a computer signal analyzer, which presents the specific frequency content of the signals and detailed timing and waveform information. Charts were prepared for all of the airplanes to document the sounds heard on the cockpit area microphone. The sound spectrum study indicated that most of the noise made by the autospoiler actuator was at a frequency centered around 1200 hertz (Hz). For the Little Rock accident airplane, the sound associated with the autospoiler actuator lasted about 0.08 second. A “clunk” sound was heard about 0.32 second after the initial actuator sound. For the Palm Springs incident airplane, the sound associated with the autospoiler actuator lasted 0.06 second, and the “clunk” sound was heard 0.30 second after the initial actuator sound. The sound spectrums were compared with those from the flight and ground tests. As stated in section 1.11.1, the flight tests were conducted in August 1999 aboard two 91 The tires had been in storage for more than 1 year in a hangar that was not environmentally controlled. 92 Two of the tires had localized soft spots, which were associated with tread contamination or rib damage as a result of the impact sequence.

Factual Information 59 Aircraft Accident Report American Airlines flights. The flight crews armed the autospoiler handle during approach and conducted a normal touchdown, upon which the wheel spin-up sensors triggered the motor to automatically deploy the spoiler handle. For the first flight test airplane, the sound associated with the autospoiler actuator lasted 0.18 second, and the “clunk” sound was heard 0.30 second after the initial actuator sound. For the second flight test airplane, the sound associated with the autospoiler actuator lasted 0.19 second, and the “clunk” sound was heard 0.32 second after the initial actuator sound. As stated in section 1.16.1.1, the ground tests were conducted in August and October 2000 aboard the Palm Springs incident airplane. The CVR was run continuously during the tests, and several autospoiler actuator sequences were analyzed. For the test that triggered the autospoiler system with the spoiler handle in the unarmed position, the sound associated with the autospoiler actuator lasted about 0.06 second, and the “clunk” sound was heard 0.18 second after the initial actuator sound. For the test that involved the autospoiler system with an armed spoiler handle, two actuator sequences were analyzed. For both sequences, the sounds associated with the autospoiler actuator lasted 0.16 second, and the “clunk” sounds were heard 0.30 second after the initial actuator sounds. 1.16.4 Airplane Performance Study An Airplane Performance Study was conducted to determine the motion of American Airlines flight 1420 and the physical forces that produced that motion. The study considered data from the following sources: wreckage location, runway scars and markings, radar data, FDR and CVR data, weather information, and ground deceleration computer program results. The radar, CVR, and FDR data times were synchronized to a single reference time. The airplane performance parameters that were of primary interest in this accident were those that defined the motion of the airplane on the runway, including the airplane’s position; ground speed; heading, track, and drift angles; and deceleration. The approach parameters of primary interest included the airplane’s position relative to the ILS localizer and glideslope beams; airspeed; heading, bank, pitch, drift, and flightpath angles; and the rate of climb or descent. The control inputs, power settings, and winds that affected the airplane were also important considerations during the approach and landing segments. The FDR and radar data were used together, along with weather information, runway tire markings, and wreckage location, to calculate the airplane’s flightpath. The position of the airplane was determined in two different segments: the “in air” trajectory, which incorporated data from 440 to 20 feet afl, and the “on ground” trajectory, which incorporated data from 20 feet afl to about 600 feet beyond the end of runway 4R (at which point the FDR ceased to record data). The calculated ground trajectory is discussed further in section 1.16.4.1.

Factual Information 60 Aircraft Accident Report The altimeter setting reported by air traffic controllers during flight 1420’s approach to the airport was 29.86 inches of Hg. The Airplane Performance Study indicated that, because the atmospheric pressure was rising rapidly during the descent and landing, an altimeter setting of 29.92 inches of Hg would have been more accurate for the final approach segment of the flight.93 An altimeter setting of 29.86 inches of Hg would have resulted in an indicated altitude that was about 55 feet lower than the altitude with an altimeter setting of 29.92 inches of Hg. (After the accident, the altimeter setting for the airport was recorded as 29.98 inches of Hg.) 1.16.4.1 Calculated Ground Trajectory On final approach, the accident airplane’s airspeed averaged 156 knots, which was about 25 knots faster than the Vref, and jumped erratically within a band of ±5 knots, which was consistent with the gusty and turbulent winds on approach.94 The wind was blowing mostly along the airplane’s lateral axis, from the left to the right sides of the airplane. The airplane touched down 2,000 feet from the runway threshold at a ground speed of 160 knots, drifting about 5º to the right,95 and a tailwind component of about 5 knots was present. A ground speed of 160 knots was about 20 knots faster than the zero-wind touchdown ground speed that would result from an approach at the reference airspeed plus 10 knots. Flight 1420 continued to drift while on the runway by as much as 16º both to the right and the left of the direction of travel. Just before the FDR data ended, the airplane’s heading was 20º to the right of the direction of travel. The airplane was returning to the extended centerline of the runway when it impacted the runway 22L approach lighting system support structure. From 3,000 to 5,800 feet beyond the runway 4R approach end threshold, the airplane’s rudder was consistently in the trailing edge right direction (nose right), but the airplane’s heading was continuously decreasing (nose left) at 1º to 3º per second. The heading stopped decreasing between 4,000 and 4,600 feet, coinciding with FDR data indicating a brief stowing of the thrust reversers. About 5,200 feet beyond the runway threshold, as full right rudder was being applied, the heading decreased about 1.5º per second until 5,800 feet, when FDR data indicated that the thrust reversers were stowed again. At this point, the yaw rate reversed, and the heading started to increase up to 7º per second. About 6,600 feet beyond the runway threshold, the left reverser was deployed, but the right reverser remained stowed; with the engine EPRs at an idle power level, the airplane continued to yaw nose right about 4º per second. The ground trajectory and FDR data showed that, between 2,800 and 5,000 feet beyond the threshold, both the right and left elevator surfaces were deflected full nose down (15º). 93 The FDR records pressure altitude, that is, altitude data based on an altimeter setting of 29.92 inches of Hg (the standard pressure at sea level). 94 Gusty winds involve a fluctuation in wind speed of 10 knots between lulls and peaks. Turbulent winds imply vertical motion and rolling. 95 The drift angle is the difference between the airplane’s heading and the direction of the velocity vector of the center of gravity.

Factual Information 61 Aircraft Accident Report The left engine EPR was greater than 1.3 almost continuously between 3,200 and 5,800 feet beyond the runway 4R approach end threshold while the thrust reverser was deployed. The right engine EPR also reached levels above 1.3 several times while the thrust reverser was deployed. The left brake pedal was relaxed briefly about 5,500 feet beyond the runway threshold, coinciding with a stowing of the thrust reversers and a loss of deceleration. The calculated ground trajectory indicated that the flight 1420 airplane departed runway 4R at about 97 knots and impacted the runway 22L approach lighting system support structure at about 83 knots. 1.16.4.2 Ground Deceleration Study The effects of various deceleration devices on flight 1420’s stopping distance was evaluated using The Boeing Company’s MD-80 Operational Landing Program. The conditions tested in the program were as follows: • airplane weight, 127,000 pounds; • center of gravity position, 16.7 percent of mean aerodynamic chord; • temperature, 25º C (77º F); • rolling friction coefficient, 0.02; • wet runway braking friction coefficient, ranging from 0.21 to 0.28 at flight 1420’s speeds from touchdown to the end of the runway; • touchdown speed, 152 and 162 knots; • reverse thrust, none and constant symmetric reverse at 1.3 EPR; • braking, none, flight 1420’s braking profile (initial braking at 5 seconds after touchdown and full braking 6 seconds later), and a braking profile in which initial braking occurred 1/4 second after touchdown and full braking 1 1/4 seconds later; and • spoilers, deployed and not deployed. Computer runs were made to test airplane deceleration with different combinations of spoiler deployment, reverse thrust, and braking scenarios. Selected computer runs showing ground speed versus distance from the runway 4R threshold were compared with flight 1420’s calculated ground speed profile. All of the selected computer runs were based on an initial ground speed of 162 knots, which was close to the 160-knot touchdown ground speed determined from the ground trajectory calculation, and an initial position on the runway of 2,000 feet from the threshold, which was about the point where flight 1420’s tire markings began. Constant, symmetrical reverse thrust at 1.3 EPR was maintained until the ground speed was zero, and all of the braking was based on flight 1420’s braking profile. With no braking, spoilers, or reverse thrust, the airplane would depart the runway with a ground speed of about 142 knots, which is 45 knots faster than the flight 1420 airplane. With no spoilers or brakes but with a constant, symmetrical reverse thrust at

Factual Information 62 Aircraft Accident Report 1.3 EPR, the airplane would leave the runway at 117 knots, which is 20 knots faster than the flight 1420 airplane. With no spoilers but with 1.3 EPR reverse thrust and the flight 1420 braking profile, the airplane would have departed the runway at 95 knots. This computer run matched the flight 1420 data best and indicated that the accident airplane experienced a braking coefficient of at least 0.21 to 0.23 at speeds between 160 and 140 knots, respectively.96 Figure 16 shows the results of the computer runs compared with the flight 1420 profile. Figure 16. Effects of Spoilers, Brakes, and Reverse Thrust on Stopping Distance Two additional computer runs demonstrated that proper spoiler deployment is critical to deceleration and stopping distance. Without reverse thrust and with the spoilers deployed and the flight 1420 braking profile, the airplane would depart the runway at 20 knots, which is 75 knots less than the airplane with no spoilers but with reverse thrust and braking. With constant reverse thrust, deployed spoilers, and the flight 1420 braking profile, the airplane could have stopped about 700 feet before the end of the runway. Computer runs were also performed to determine the effect of the touchdown ground speed on stopping distance. One computer run indicated that an airplane with no 96 Typical braking coefficients for a hydroplaning airplane range from 0.02 to 0.04. 0 1000 2000 3000 4000 5000 6000 7000 8000 0 20 40 60 80 100 120 140 160 180 Notes:

• For reverse thrust runs, reverse thrust at 1.3 EPR

is maintained until ground speed is zero.

• Braked runs are based on AA flight 1420 braking profile.

Line Spoilers Brakes Reverse Thrust A AA flight 1420 data B No No No C No Yes Yes D No No Yes E Yes Yes No F Yes Yes Yes Runway end Touchdown point F E D C B A Ground speed, kts. Distance from runway 4R threshold, ft.

Factual Information 63 Aircraft Accident Report spoiler deployment but with reverse thrust and a 10-knot reduction in the touchdown ground speed would have departed the runway at 60 knots and would have impacted the runway 22L approach lighting system support structure at a speed of 20 knots, which is a 94-percent reduction in the kinetic energy compared with the calculated 83-knot impact speed in the flight 1420 profile. Another run that allowed for a loss in braking performance after the airplane departed the hard surface of the runway indicated that the impact speed would have been 45 knots, which is a 72-percent reduction in the kinetic energy compared with the calculated 83-knot impact speed. In addition, without reverse thrust but with spoilers deployed and a 10-knot reduction in the ground speed, an airplane would have been able to stop about 400 feet before the end of the runway. Finally, computer runs were conducted to determine the effect on stopping distance of a braking profile in which initial braking occurred 1/4 second after touchdown and full braking 1 1/4 seconds later. (Because of a limitation in Boeing’s Operational Landing Program, this comparison could only be done using a touchdown ground speed of 152 knots.) The computer runs indicated that, without spoiler deployment but with reverse thrust, the normal braking profile would stop an airplane 200 feet sooner that the flight 1420 braking profile. With spoiler deployment and no reverse thrust, the normal braking profile would stop an airplane 800 feet sooner that the flight 1420 braking profile. 1.16.5 Engineered Materials Arresting System Computer Model The Safety Board requested that Engineered Arresting Systems Corporation of Lester, Pennsylvania, survey the accident area and provide information on any safety benefit that a soft-ground aircraft arresting system would have provided for flight 1420 if such a system had been installed at the departure end of runway 4R.97 At the Board’s public hearing on this accident, a consultant for Engineered Arresting Systems discussed the company’s Engineered Materials Arresting System (EMAS). The consultant described the EMAS as a passive system that decelerates an airplane when its wheels roll through a soft foamy material.98 He added that the system was designed to be compatible with all of the airplanes with which it would come in contact. The computer program that was used for the analysis assumed the following conditions based on data from the accident sequence: • runway departure speed, 98 knots; • gross weight, 128,000 pounds; 97 On April 14, 1999, the FAA, the Little Rock Municipal Airport Commission, and the airport’s tenants met at a joint planning conference to identify airport development needs for the next 5 years. According to the conference report, an arresting system for runway 4R/22L was identified as a recommended project for 2000. In the fall of 2000, an EMAS measuring 304 feet long and 200 feet wide was installed at the departure end of runway 4R. 98 The consultant stated that the material has an average strength in compression of 80 psi and that the material would retain its properties over a wide temperature range.

Factual Information 64 Aircraft Accident Report • center of gravity, 16.7 percent mean aerodynamic chord; • yaw angle, 20º; • yaw rate, 0.069 radians per second; • lateral velocity, 8 knots; • roll angle, 2º right wing down; and • distance offset from runway, 7 feet. The analysis also included an EMAS that was designed to reflect the conditions that existed at the departure end of runway 4R. The total length of this EMAS was 402 feet. In a December 7, 1999, report to the Safety Board, Engineered Arresting Systems concluded that the benefit of an EMAS in this accident would have been limited by the airplane traveling partly outside the runway edges; thus, the airplane would not have been able to use the full length of the EMAS. The report also concluded that an EMAS would have reduced the speed of the airplane by 15 knots but would not have enabled the airplane to stop within runway 4R’s runway safety area. In addition, the report concluded that, in this accident, an EMAS could have led to two landing gear failures because the loads exceeded the ultimate values determined by the airplane manufacturer.99 1.17 Organizational and Management Information American Airways was incorporated in 1930, and its name changed to American Airlines, Inc., in 1934. American is owned by the AMR Corporation and is headquartered in Dallas, Texas. American provides passenger and cargo service throughout North America, the Caribbean, Latin America, Europe, and the Pacific. AMR Corporation also owns and operates American Eagle, a regional airline that provides service at American’s hubs and other cities throughout the United States, Canada, the Bahamas, and the Caribbean.100 In February 1999, American acquired Reno Air, which was fully integrated 99 The Safety Board notes that, although the Engineered Arresting Systems report indicated that an EMAS would not have stopped the flight 1420 accident airplane, the system’s safety benefit was demonstrated in the May 8, 1999, accident involving American Eagle flight 4925, which overran the approach end of runway 4R at John F. Kennedy International Airport, Jamaica, New York, during landing. The airplane crossed the runway threshold at a speed of about 180 knots and touched down 7,000 feet beyond the end of the runway at a speed of about 157 knots. The flight crew applied reverse thrust and maximum braking, but the airplane departed the 8,400-foot runway at a speed of about 75 knots. Approximately 300 feet of skid marks were observed before the end of the runway. The airplane then traveled over a 6-inch deflector and approximately 248 feet across a 400-foot long EMAS. The landing gear sank approximately 30 inches into the EMAS, and the airplane came to a stop. Of the 30 people aboard the airplane, 1 person was seriously injured, and the rest were not injured. The airplane received substantial damage. See section 1.18.6 for additional details on this accident. 100At the public hearing, the AMR Corporation’s Vice Chairman stated that, even though American Eagle operates under its own certificate, the airline is considered to be a “sister company” to American Airlines, and both airlines are increasingly sharing human and other resources.

Factual Information 65 Aircraft Accident Report into American’s operations at the end of August 1999. In April 2001, American acquired Trans World Airlines. According to the AMR Vice Chairman, American Airlines experienced a period of substantial growth during the 1980s, both in the number of aircraft and the number of employees. American’s Web site indicated that, as of March 2000, the airline had 649 transport-category airplanes in its fleet with an average age of 8 years. The fleet consisted of Airbus A300; Boeing 727, 737, 757, 767, and 777; Fokker F.100; and McDonnell Douglas DC-10, MD-11, and MD-80 airplanes.101 At the time of the accident, American Airlines employed 9,661 pilots, 2,812 of whom were qualified on the MD-80 (1,440 captains and 1,372 first officers). The company had 279 MD-80 series airplanes in its fleet and 10 MD-80 bases throughout the United States. The company had a total of 498 check airmen, 108 of whom were MD-80 check airmen. American Airlines underwent an executive reorganization on January 5, 2000. According to the AMR Corporation’s Vice Chairman, changes to the company’s organization were proposed before the Little Rock accident but had not been implemented because of a lack of consensus that “any particular change was appropriate or meaningful.” The AMR Vice Chairman indicated that the new organizational setup was a “highly integrated but extensive attempt to provide more safety emphasis at the company.” At the time of the accident, the Managing Director of Flight Safety reported to the Vice President of Flight/Chief Pilot, who was responsible for hiring pilots, training them, and managing flight operations. The Vice President of Flight/Chief Pilot reported to the Executive Vice President of Operations,102 who reported to the Chairman of American Airlines and AMR Corporation. Under the reorganization, the Executive Vice President of Operations was elevated to the Office of the Chairman as the AMR Corporation Vice Chairman, and he retained the primary responsibility for operations. Eight organizational units report to the Office of the Chairman, including a new unit, Safety, Security, and Environmental.103 These three functions existed separately under the former organization but are now 101 The AMR Vice Chairman indicated that American was planning to retire its older fleets— the 727 and DC-10. 102 The Executive Vice President of Operations (now the AMR Corporation Vice Chairman) was responsible for eight other organizational units: Maintenance and Engineering, Operations Planning and Performance, Cargo, Reno Air Integration, Corporate Real Estate, Purchasing, Security, and Safety. In public hearing testimony, the AMR Vice Chairman indicated that the areas that received most of his attention as Executive Vice President of Operations were maintenance and flight. 103 The seven other organizational units that report to the Office of the Chairman are Human Resources, General Counsel, Operations, Customer Services, Marketing and Planning, Finance, and Government Affairs.

Factual Information 66 Aircraft Accident Report placed under a single vice president-level leadership.104 The Managing Director of Safety reports to the Vice President of Safety, Security, and Environmental and coordinates with the Vice President of Flight/Chief Pilot, who is responsible for the Flight Department.105 Four main organizational units exist within the Flight Department, one of which is Flight Training and Standards. Ground school and simulator training are separate organizational units within Flight Training and Standards rather than a combined unit within the training organization. The AMR Vice Chairman indicated that the training and standards (that is, checking) functions were separated to provide improved objectivity and standardization. 1.17.1 Aviation Safety Action Program The American Airlines Safety Action Program (ASAP) was implemented in 1994 after 2 years of development and coordination with the FAA and the Allied Pilots Association.106 ASAP is a voluntary, confidential pilot reporting program designed to collect and disseminate information on safety issues and incidents to prevent their recurrence. The program receives about 3,600 reports each year.107 No disciplinary actions are taken against pilots as a result of an ASAP report submission. The Managing Director of Flight Safety administered the program at the time of the accident. At the Safety Board’s public hearing, the Vice Chairman of AMR Corporation testified the following: [ASAP] is a true accident prevention program. It operates on the basis of the following principle, and that is that the best safety information is the information that we don’t know, and, so, any way that we can create to bring information that otherwise would not be known to those who can effect change, to bring that information to the surface is very, very valuable, and that’s what ASAP’s principle concept is all about. ASAP requires that pilots submit a report of an event within 24 hours of its occurrence (or within 24 hours of the time at which the pilot became aware that an event occurred). ASAP reports are sent to the ASAP Event Review Team, which consists of a representative from American, the FAA’s Certificate Management Office for American, and the Allied Pilots Association.108 The team meets weekly to review submitted reports, 104 Two new functions were also added to the Safety, Security, and Environmental organizational unit: Operational Audits and Compliance. The AMR Vice Chairman testified that, “in these areas, we intend to substantially pick up...our auditing processes by third parties who are not responsible for...particular operational functions throughout the company.” 105 The Vice President of Flight/Chief Pilot reports to the Managing Director of Operations, who reports to the Managing Director of Safety. 106 The program is consistent with the guidance in AC 120-66, “Aviation Safety Action Programs.” 107 ASAP reports do not include deliberate or criminal acts or events that are already known within the FAA. 108 Confidential reports are also sent to the manager of the ASAP program, the appropriate manager within American’s Flight Safety Department, and NASA for inclusion in its Aviation Safety Reporting System. In addition, the FAA has immediate access to ASAP reports.

Factual Information 67 Aircraft Accident Report decide which ones represent a significant safety concern or deviation from procedure, and determine who should investigate the events and recommend corrective actions. According to American’s pilot magazine, Flight Safety,109 ASAP reports identify, in order of frequency, altitude deviations; heading deviations; other flight irregularities, communication problems with ATC, or clearance deviations during flight; deviations from regulations or operational procedures, including the MEL; general irregularities or communication problems with ATC on the ground; runway or taxiway incursions; and other categories, including aircraft damage, turbulence encounters, and mechanical problems. The Managing Director of Safety stated that ASAP does not currently collect information about the relationship between an event and the flight crew’s flight and duty time.110 Selected information from deidentified ASAP reports is distributed to company pilots via bulletins every 6 weeks. Information from ASAP reports can also be communicated quarterly through the company’s pilot magazine. In addition, ASAP reports are entered into an American Airlines database, which provides the company with trend information on particular subjects and areas of focus for training and surveillance. 1.17.2 Flight Crew Training American’s flight crew training academy is located in Dallas/Fort Worth. All first-time pilots at American Airlines attend a basic indoctrination course, where they are taught general information on the way the company operates. According to the MD-80 Fleet Manager at the time of the accident,111 basic indoctrination training includes an alertness strategies course, which focuses on fatigue countermeasures more than fatigue recognition. Pilots then attend initial and/or transition ground school and simulator flight training. According to the American Airlines DC-9 Initial and Transition Training Syllabus (dated December 15, 1998), the typical initial and transition training consists of 10 days of ground school, 10 days of simulator flight training, and 25 hours of initial operating experience (IOE). Ground school training is presented using self-paced computer-based training with graphics and audio, videotapes, and a performance workbook with printed practice problems. Days 1 through 5 of simulator training are conducted by an American Airlines simulator instructor, and days 6 through 10 are conducted by an American Airlines check airman. For their IOE, new and upgrade pilots fly with a check airman, who references a worksheet that details the airplane maneuvers, procedures, or functions that are required 109 Chidester, T. “ASAP Turns Five and a Half.” Flight Safety. American Airlines, Vol. 1, No. 2, First Quarter (2000): pp. 11-16. 110 Although the reports contain time-of-day information, the Managing Director of Flight Safety stated that the information is used only to correlate reports with ATC records. 111 American Airlines’ MD-80 Fleet Manager at the time of the accident became the company’s Managing Director of Flight Crew Relations in December 1999.

Factual Information 68 Aircraft Accident Report to be covered. In addition, all pilots are required to attend recurrent training (a 2-hour line-oriented flight training [LOFT] session) and perform a 2-hour proficiency check ride every year.112 The recurrent training and the proficiency check ride are conducted by company check airmen. The former MD-80 Fleet Manager indicated that, in all phases of training and IOE, American attempts to put the pilot in a situation in which he or she is required to make the best decision for the particular circumstances. The former fleet manager also indicated that first officers are trained to provide feedback to captains; specifically, first officer trainees are presented with various situations and are critiqued on their actions and the consequences of those actions. 1.17.2.1 Simulator Flight Training Day 1 of the 10-day initial and transition simulator flight training course includes a briefing on American’s checklist philosophy for flying and nonflying pilots. The simulator profile during that day emphasizes how each checklist is accomplished and which items require a response. Day 6 of the course is dedicated to takeoff and landing exercises. According to the former MD-80 Fleet Manager, the day begins with a 2-hour briefing that covers the key points regarding the airplane’s handling characteristics and the windshear escape and recovery maneuvers. The former Fleet Manager indicated that the simulator session starts out with little or no crosswind and a dry runway and that the crosswind component is gradually increased until the MD-80’s demonstrated maximum crosswind component is attained. Afterward, the runway surface friction component is reduced. This process is repeated until the pilots have experienced the control difficulties that they need to learn to correct.113 The former MD-80 Fleet Manager stated that the simulator can replicate rudder blanking (that is, the decrease in rudder effectiveness resulting from an increase in reverse power) and that this feature allows the company to train pilots to reduce the amount of reverse thrust until they have regained directional control. The training syllabus indicates that windshear profiles, slippery runways, crosswind landings,114 and nighttime landings are discussed during day 6. The syllabus did 112 American’s recurrent training syllabus changes on February 1 of each year. According to the former MD-80 Fleet Manager, the recurrent training course beginning on February 1, 2000, was expected to include a briefing on manual spoiler operation and the spoilers’ effect on braking and stopping. Each pilot would then have a chance to manually operate the spoilers in the simulator. The recurrent training was also expected to include a review of the stabilized approach concept, wet and slippery runway reversing, and automatic braking. 113 American’s Instructor/Check Airman Guide, MD-80 Supplement, did not contain any guidance for instructing landings with crosswinds or on wet runways. According to American, its instructor guides refer the instructor to the appropriate flight and operating manuals for this information. 114 The former MD-80 Fleet Manager stated that crosswind training is also taught in ground school during a day in which the contents of the performance manual are discussed. The manual contains a chart depicting the headwind, tailwind, and crosswind components in relation to wind speed and the angle between the wind and the runway direction.

Factual Information 69 Aircraft Accident Report not contain any description of the specific scenarios taught during those sessions but did contain a reference to the company’s DC-9 Operating Manual. Day 8 of the training includes the captain’s rating ride preparation and the first officer’s check ride. The captain’s rating ride occurs on Day 9 of the training and is administered entirely in the DC-9 flight simulator. The rating ride consists of about 15 basic profiles, and the training manual indicates that the rating ride is conducted “in real time and in as realistic an ATC environment as possible.” LOFT is conducted on Day 10 of flight training. The LOFT session consists of two legs of a real-time flight in the simulator. According to the syllabus, the first leg is usually routine and flown by the first officer, and the second leg is an abnormal situation that is flown by the captain. The manual stated that the check airman provides realistic flight plans, a weather briefing, and takeoff performance system data for each leg of the flight and that communications with ATC and the company are provided. 1.17.2.2 Observations of Simulator Sessions In July 1999, two members of the Operations Group observed separate sessions of day 6 (takeoffs and landings) of American’s MD-80 simulator training. The sessions were conducted by two different instructors. One of the simulator sessions (referred to in this report as session A) did not include any “failed spoiler” events during the landing portion of the training. The other simulator session (referred to in this report as session B) included seven failed spoiler events. The students in session B noticed two of the seven events; in both instances, the first officer student manually extended the spoilers. However, American’s procedures stated that the captain was to manually extend the spoilers if they did not automatically extend during landing (see section 1.17.4.2). The effects of the spoilers not extending during landing were discussed.115 In session A, the instructor recommended that heavy manual braking be used on contaminated runways and stated that he did not like the autobrakes for landing. In session B, the instructor stated that medium autobrakes should be used when landing on slippery runways. However, American’s procedures at the time of the accident stated that aggressive manual brakes or maximum autobrakes should be used with wet runway conditions (see section 1.17.4.3). No discussion occurred in either session regarding what constitutes a slippery runway and what distinguishes it from a wet runway. During session A, the training focused on using the 1.6 EPR reverse thrust setting (the normal setting used by American for landing on dry runways). There was no discussion or training on company procedures to limit reverse thrust to 1.3 EPR during 115 The two Operations Group members passed along their spoiler training observations to the former MD-80 Fleet Manager who, in turn, met with the simulator instructors to inform them of the observations and implement actions to improve the training. The former fleet manager indicated, during the public hearing, that training on recognizing no-spoiler extensions and performing the appropriate response had been added to day 6.

Factual Information 70 Aircraft Accident Report landing on a slippery runway (see section 1.17.4.4). Rudder blanking was discussed. During session B, the simulator instructor taught that 1.6 EPR was acceptable for landing on a slippery runway unless a crosswind was present,116 and the students applied 1.6 EPR reverse thrust during 10 to 12 landings on slippery runways. The instructor subsequently realized that 1.3 EPR should have been the maximum reverse thrust used and informed the students of this information. Rudder blanking was discussed. Session A did not include a discussion of company procedures for crosswind limits for reduced visibility operations and contaminated runways but emphasized the importance of avoiding thunderstorms. Session B included a discussion of crosswinds and their effects on takeoffs and landings. 1.17.2.3 Human Factors and Safety Training In 1990, American Airlines established a manager position dedicated to human factors and safety training.117 This manager is supported by 10 staff facilitators who are company line captains and first officers on detail to the Human Factors and Safety Training program.118 At the time of the accident, five of the facilitators were qualified on the MD-80. The human factors and safety training program courses emphasize four fundamental principles—situational awareness, communication, teamwork, and technical proficiency—through lectures, slide and videotape presentations, and group discussions. The videotapes present event scenarios that were recreated in a simulator. Many of the recreated events were derived from ASAP reports. The facilitators guide the group discussion to ensure that every element of the event is addressed, including factors that may have prevented the event from occurring. American provides separate human factors and safety training courses to its pilots, flight attendants, and dispatchers. The courses for pilots include a 3-hour basic indoctrination course, a 4-hour first officer upgrade course, a 1-day captain upgrade course, a 2-hour recurrent course, and a 2-day check airman course. The first officer upgrade course, attended by new first officers, emphasizes their roles and responsibilities in the cockpit, including the need to speak up when an airplane is being handled improperly or placed in jeopardy. The captain upgrade course, attended by new captains, emphasizes strategies for being an efficient manager of events. The recurrent course, attended jointly each year by captains, first officers, and flight engineers, emphasizes areas that parallel those taught during recurrent simulator training.119 116 A member of the Operations Group informed the instructor of the discrepancy between this statement and the operating manual requirement to limit reverse thrust to 1.3 EPR when landing on slippery runways. 117 Before 1996, this program was known as the crew resource management program. 118 While on detail to this program, captains serve half of the time as check airmen for an airplane fleet, and first officers fly as line pilots two times per month and then every third month. 119 The 1999 recurrent training course emphasized decision-making and managing the environment when faced with conflicting demands and information.

Factual Information 71 Aircraft Accident Report 1.17.3 Approach Procedures 1.17.3.1 Approach Briefing American Airlines’ Flight Manual, Part I, Section 10, “Approach and Landing,” page 12 (dated April 7, 1999), states that the captain will ensure that the first officer and the flight engineer (if applicable) are briefed before every approach.120 American’s DC-9 Operating Manual, Volume 1, Normals, page 87 (dated April 26, 1999), indicates that, for all instrument approaches, the approach briefing is to include the following:121 • landing runway and reported visibility or RVR; • type of approach to be conducted; • if a nonprecision or Category I ILS approach, who will be the flying pilot; • approach chart to be used and the applicable minimum visibility or RVR; • approach facility and frequency; • final approach course; • airport elevation; • outer marker crossing altitude or minimum crossing altitude at final approach fix; • minimum descent altitude, decision altitude, and decision height, as applicable; • missed approach procedure; • minimum safe altitude; • initial approach altitude; and • terrain awareness. 1.17.3.2 Before Landing Checklist The Before Landing checklist is accomplished using a mechanical checklist in the cockpit. According to American’s DC-9 Operating Manual, Normals, page 7 (dated December 21, 1998), the mechanical checklist shows 10 items: hydraulic pumps, altimeters, flight instruments and bugs (that is, moveable markers for key airspeed values), seat belt/no smoking signs, tail deice, gear, spoiler lever, autobrakes, flaps and slats, and annunciator lights.122 American’s Instructor/Check Airman Guide, MD-80 Pilot Supplement, Section 3.01, page 9 (dated July 15, 1996), states that the nonflying pilot 120 At the public hearing, the former MD-80 Fleet Manager stated that either pilot could conduct an approach briefing but that the captain was responsible for ensuring that a briefing was completed. 121 The first officer stated in a postaccident interview that the captain conducted a formal briefing for runway 22L. 122 The Before Landing checklist was designed so that the first five items are completed early in the approach and that the last five items are completed late in the approach.

Factual Information 72 Aircraft Accident Report was to accomplish the Before Landing checklist and was to “discuss those items requiring responses and emphasize proper challenges and responses.” American’s DC-9 Operating Manual, Normals, page 71 (dated December 21, 1998), states the following regarding the Before Landing checklist:123 After each item has been accomplished, the pilot-not-flying will call out that item on the checklist, call out the appropriate response and then move the corresponding switch on the Mechanical Checklist. Any item that cannot be verified by the pilot-not-flying as accomplished will require a challenge and response. ALTIMETERS and FLT INSTR & BUGS will be challenged by the pilot-not-flying and responded to by both pilots. When all items have been accomplished, the pilot-not-flying will advise, “Before Landing checklist complete.” American’s DC-9 Before Landing checklist is found in the DC-9 Operating Manual, Normals, pages 71 through 74 (dated April 26, 1999). Page 72 indicates that the nonflying pilot is responsible for announcing that the spoiler lever has been armed and that the spoilers should not be armed if the AUTO SPOILER DO NOT USE light is illuminated, but no reference could be found to indicate which pilot was responsible for physically arming the spoiler lever. According to postaccident interviews with American Airlines pilots, instructors, and check airmen, pilots were instructed during simulator training that the nonflying pilot was to arm the spoilers. However, company line pilots said that, during actual flights, either pilot could arm the spoilers but that the captain usually did because the spoiler handle was on that side of the center pedestal. The Before Landing checklist also indicates that the flying pilot is responsible for commanding the landing gear down and that the nonflying pilot is to respond “down three green.” In addition, the Before Landing checklist indicates that the nonflying pilot is to arm the autobrakes as required (see section 1.17.4.3); verbally verify the flap/slat handle position, the flaps position indicator, and SLAT LAND light illumination, and advise the flying pilot of the status of the annunciator panel. For information on American’s postaccident changes to its Before Landing checklist guidance, see section 1.17.5.1. 1.17.3.2.1 Manufacturer’s Information Boeing’s Flight Crew Operating Manual (FCOM),124 Volume II, section 2, contains the following guidance on MD-80 spoiler and autobrake arming under the heading “Before Landing Expanded Procedures”: Lift SPOILER lever, observe lever remains up when released and red arm placard is visible at the base of the lever. 123 The FAA reviewed human factors principles of checklist design and incorporated them into its January 1995 publication, Human Performance Considerations in the Use and Design of Aircraft Checklists, which is available to airlines and FAA inspectors.

Factual Information 73 Aircraft Accident Report Rotate AUTO BRAKE selector to desired deceleration rate (MIN, MED, or MAX). Move ARM/DISARM switch to ARM. 1.17.3.3 Crew Coordination Procedures American’s DC-9 Operating Manual, Volume 1, Normals, pages 101 and 102 (dated December 21, 1998), states the following regarding crew coordination procedures for a Category I approach: • Use of autopilot (if operative) is recommended with less than 4000 RVR • Either pilot callout—“Radio Altimeter Alive” • Pilot-Flying callouts: – “Track—Track” – “Outer Marker” and MSL crossing altitude – “Auto Go—Auto Land” (if applicable) The manual also states the following: Approach • Pilot-Flying: Fly approach. • Pilot-Not-Flying: Monitor approach. • Pilot-Not-Flying: Callouts: – “1000” AFL on barometric altimeter—Verbally verify when Flaps/Slats at landing setting – “500” AFL on barometric altimeter—Airspeed ± Approach Speed and Descent Rate At 100 feet above DA decision altitude Pilot-Flying: When advised that visual references are in sight, confirm requirements to descend below DA are satisfied, callout—“Landing” and complete approach and landing. 124 The Chief Pilot for Flight Operations at Boeing’s Long Beach Division (who, at the time of the flight 1420 accident, was Boeing’s Chief Test Pilot for Flight Operations at Boeing’s Long Beach Division) indicated that the company’s FCOM is the primary tool used by the company to conduct its training program and establish training programs for operators. Boeing’s FCOM provides guidelines for operating procedures, but an operator, along with its principal operations inspector (POI), may change the procedures. The Boeing Chief Pilot stated that the company sends the operators updated information of proposed changes to the manual and that the operator is responsible for coordinating the proposed changes with its POI.

Factual Information 74 Aircraft Accident Report Pilot-Not-Flying: Callouts: • “100 above” • visual references when in sight Pilot-Not-Flying: Direct primary attention to monitoring instruments. At DA (on the Baro[metric] Altimeter) Pilot-Flying: Execute a missed approach if not completing the landing. Pilot-Not-Flying: Call out—“Decision Altitude” Pilot-Not-Flying: Callouts: • “100” AGL [above ground level] on Radio Altimeter • “50, 40, 30, 20, 10” AGL on Radio Altimeter (if automated voice callouts are inoperative) 1.17.3.4 Stabilized Approach Concept American’s DC-9 Operating Manual, Volume 1, Techniques,125 page 19 (dated November 15, 1995), indicates the following under the heading “General”: The stabilized approach concept requires that, before descending below the specified minimum stabilized approach altitude, the airplane should be – • in the final landing configuration (gear down and final flaps), • on Approach Speed, • on the proper flight path and at the proper sink rate, • and at stabilized thrust. These conditions should then be maintained throughout the rest of the approach. 125 Regarding American’s use of the word “techniques,” its DC-9 Operating Manual, Volume 1, Conditionals, page 1 (dated November 15, 1995), states the following: “Techniques are not procedures, but are suggested ways of accomplishing a task. These suggestions are based on experience and recognized practices. Generally, they offer the best method to complete the task in most cases. However, another technique may be just as appropriate, or even better, when considering the particular circumstances.” The former MD-80 Fleet Manager indicated that American was gradually editing out the Techniques section of all of its manuals. The information contained in this section will be integrated into the Normals section so that all of the information for a particular phase of flight will appear in one section.

Factual Information 75 Aircraft Accident Report The minimum recommended stabilized approach altitudes are: • VFR [visual flight rules] – 500 feet AFL • IFR – 1000 feet AFL In all cases, select landing flaps by 1000 feet AFL. For information on American’s postaccident changes to its stabilized approach procedures, see section 1.17.5.2. American’s DC-9 Operating Manual, Volume 1, Normals, page 89 (dated December 21, 1998), states that “on final, a callout will be made anytime any crewmember observes LOC [localizer] displacement greater than 1/3 dot and/or G/S [glideslope] displacement greater than 1/2 dot. The other pilot will acknowledge this deviation.”126 Page 89 also states that the pilot-not-landing is to make the following deviation callouts: with landing flaps, any time airspeed varies more than ±5 knots from approach speed and, inside the final approach fix, when rate of descent exceeds 1,000 feet per minute (fpm). 1.17.3.4.1 Federal Aviation Administration Guidance FAA Order 8400.10, “Air Transportation Operations Inspector’s Handbook,” volume 4, chapter 2, section 3, paragraph 511, “Stabilized Approach Concept,” states that “maintaining a stable speed, descent rate, vertical flightpaths, and configuration is a procedure commonly referred to as the stabilized approach concept” and that “operational experience has shown that the stabilized approach concept is essential for safe operations with turbojet aircraft.” The guidance also includes the following information: A stabilized approach for turbojet aircraft means that the aircraft must be in an approved landing configuration…, must maintain the proper approach speed with the engines spooled up, and must be established on the proper flightpath before descending below the minimum “stabilized approach height” specified for the type of operation being conducted. These conditions must be maintained throughout the rest of the approach for it to be considered a stabilized approach. Operators of turbojet aircraft must establish and use procedures which result in stabilized approaches. In addition, the guidance indicates that a stabilized approach needs to be established before descending below 500 feet above the airport elevation during VFR conditions or visual approaches and 1,000 feet above the airport or touchdown zone elevation during any straight-in instrument approach in IFR conditions. 126 In postaccident interviews, the MD-80 Fleet Manager and several MD-80 check airmen explained that captains used their discretion to determine the maximum acceptable deviation from the glideslope or the localizer.

Factual Information 76 Aircraft Accident Report 1.17.3.5 Thunderstorm and Windshear Avoidance American’s Flight Manual, Part I, Section 12, “Weather,” page 12 (dated November 30, 1998), states the following regarding thunderstorm avoidance: Do not enter or depart terminal areas when such areas are blanketed[127] by thunderstorms except where known thunderstorm-free routes exist and are followed. Airborne radar and all available weather reports will be used to make this determination. American’s DC-9 Operating Manual, Volume 1, Environmental, page 13 (dated August 22, 1997), states the following regarding windshear avoidance: Avoid areas of known severe windshear.[128] PIREPS [pilot reports] of windshear in excess of 20 knots or 500 fpm climb or descent below 1000 feet AFL are a good indication of such areas. Consider the time elapsed since the report and the change in reported or observed (radar or visual) weather. Microbursts in particular can create severe windshear conditions, but these conditions develop, change, and dissipate rapidly. The most dangerous form of windshear is a convective microburst. Some have been documented with wind changes in excess of 200 knots. Because microbursts intensify for several minutes after they first impact the ground, the severity may be up to twice which is initially reported. Search for clues which may indicate the presence of severe windshear. Severe windshear has been encountered under the following conditions:[129] • Thunderstorm and convective clouds • Rain and snow showers • Frontal systems • Low altitude jet streams • Strong or gusty surface winds Page 14 of the operating manual states that, when positive indications of severe windshear exist, avoid the areas by diverting around them, initiating a go-around maneuver on approach, or holding on approach until conditions improve. Page 14 also indicates that LLWAS can detect microbursts within 2 1/2 miles of the airport. 127The former MD-80 Fleet Manager testified that “blanketed” meant “a significant amount of coverage of the area.” 128A precise definition of “severe windshear” was not found in American’s DC-9 operating or flight manuals. 129 In public hearing testimony, the former MD-80 Fleet Manager stated that he believed that at least four of the five criteria were probably present during the approach to Little Rock. However, this official also stated that conditions conducive to windshear would necessitate a heightened level of awareness but would not require an approach to be abandoned.

Factual Information 77 Aircraft Accident Report American’s Flight Manual, Part I, Section 12, page 13 (dated December 19, 1997), indicates that LLWAS wind reports are “advisory only.” The manual also states that “the reported surface winds, as presently obtained from the centerfield instrumentation, are controlling for our Flight Operations.” The former MD-80 Fleet Manager stated at the public hearing that he would expect a pilot to evaluate an LLWAS alert by considering the magnitude of the shear and its direction and then decide, with the other pilot, whether to continue or abort the approach. If the crew’s decision was to continue the approach, the former fleet manager stated that he would expect the pilot to increase speed and be ready to immediately perform the escape maneuver if an uncommanded change in pitch, roll, or rate of descent occurred because of the windshear. The former MD-80 Fleet Manager also testified that, in November 1999, American strengthened its guidance for handling windshear warnings. Specifically, the guidance indicates that, if pilots receive a “microburst alert,” they are required to execute a go-around or escape maneuver. 1.17.3.6 Continuation of an Approach Below the Decision Height American’s Flight Manual, Part I, Section 10, page 13 (dated November 30, 1998), states the following regarding weather deterioration after the final approach segment has started, in accordance with 14 CFR 121.651(c):130 After the aircraft is established on the final approach segment, if the weather is reported to be below published minima, the approach may be continued to the appropriate DH [decision height] or MDA [minimum descent altitude], and landing may be accomplished in accordance with the conditions for the type approach being conducted. The flight manual further states, “the final approach segment for an ILS approach begins on the glide slope at the glide slope intercept altitude as shown in the [approach chart] profile.” The DC-9 Operating Manual, Volume 1, Normals, page 102, requires the following to continue an approach below the MDA or DH, in accordance with 14 CFR 121.651(c)(1), (2), and (3): • Airplane must be continuously in a position from which a descent to a landing on the intended runway can be made at a normal rate of descent using normal maneuvers, and where that descent rate will allow touchdown to occur within the touchdown zone of the runway of intended landing. • Flight visibility must not be less than the visibility prescribed in the standard instrument approach being used. 130 Title 14 CFR 121.651(c) states the following: “If a pilot has begun the final approach segment of an instrument approach procedure…and after that receives a later weather report indicating below-minimum conditions, the pilot may continue the approach to the DH or MDA.”

Factual Information 78 Aircraft Accident Report • Except for Category II or Category III approaches where any necessary visual reference requirements are specified by authorization of the [FAA] Administrator, at least one of the following visual references for the intended runway is distinctly visible and identifiable to the pilot: – Approach light system, except that the pilot may not descend below 100 feet above the touchdown zone elevation using the approach lights as reference unless the red terminating bars or the red side row bars are also distinctly visible and identifiable. – Threshold – Threshold markings – Threshold lights – Runway End Identifier Lights (REIL) – Visual Approach Slope Indicator (VASI) – Touchdown zone or touchdown zone markings – Touchdown zone lights – Runway or runway markings – Runway lights 1.17.3.7 Missed Approach Policy American’s Flight Manual, Part I, section 10, page 21 (dated April 15, 1998), includes the following procedure for performing a missed approach: When landing cannot be accomplished and, upon reaching the MAP [missed approach point] defined on the approach chart, the pilot must comply with the missed approach procedure or with an alternate missed approach procedure specified by ATC. The missed approach procedures were revised on August 15, 1999, to add an introductory paragraph that is titled “General” and states the following: American Airlines has a no-fault go-around policy, recognizing that a successful approach can end in a missed approach. Captains are required to execute/order a missed approach if the aircraft is not stabilized by 1000’ AFL (IFR) or 500’ AFL (VFR), or if in the pilot’s judgement a safe landing cannot be accomplished within the touchdown zone, or the aircraft cannot be stopped within the confines of the runway.131 131 The former MD-80 Fleet Manager indicated that American always had a policy of not holding a pilot accountable for performing a go-around and that this revision would ensure that all pilots were aware of this policy.

Factual Information 79 Aircraft Accident Report 1.17.4 Landing Procedures 1.17.4.1 Wind Landing Limits American’s Flight Manual, Part 1, section 10, page 20 (dated April 7, 1999), indicates that “pilots shall secure the latest surface wind direction and velocity prior to making a landing at an airport.” Section 12 of the flight manual, page 3 (dated April 4, 1997), indicates that “the latest surface wind for use for crosswind and/or headwind and tailwind limitations will be that in the latest weather observation unless a more recent oral report is available from an operating control tower.” Section 10 of the flight manual, page 20, also states that, for approaches conducted with an RVR of 4,000 feet or a visibility of 3/4 mile or greater, the dry runway132 maximum demonstrated landing crosswind component for a DC-9 is 30 knots. The manual further states that, for approaches conducted with an RVR of less than 4,000 feet or 3/4-mile visibility, the maximum landing crosswind component is 15 knots and that, for approaches conducted with an RVR of less than 1,800 feet or 1/2-mile visibility, the maximum landing crosswind component for the DC-9 is 10 knots. According to the manual, if the captain believes that “environmental conditions or braking reports indicate that the runway is wet or slippery, the maximum acceptable crosswind should be reduced to 20 knots.” American’s DC-9 Operating Manual, Limitations, page 3 (dated April 26, 1999), states that the maximum tailwind limit for takeoffs and landings is 10 knots. The manual also states that the tailwind limit might be further reduced by performance requirements. 1.17.4.1.1 Manufacturer’s Information According to Boeing, the MD-80 is required to safely land with a crosswind of at least 20 knots.133 An aerodynamics engineer from Boeing testified at the public hearing that, during crosswind certification testing, the airplane was found to be capable of handling 30 knots of crosswind. The Procedures section of Boeing’s MD-80 Airplane Flight Manual states the following: The limiting crosswind value has not been determined; however, the maximum demonstrated crosswind component for takeoff and landing is 30 knots reported wind at the fifty foot height. This value was demonstrated on a dry runway…. The accepted industry practice is that the operator use this demonstrated capability and their operational experience to construct their crosswind landing guidance material which is approved by the FAA. 132 Section 10 of the flight manual, page 25 (dated April 7, 1999), states that an airport runway is considered to be dry when no snow, slush, ice, or water have been reported and “no more than the following conditions” have been reported: scattered showers in the airport area; intermittent drizzle with an intensity no greater than moderate, intermittent light rain with surface temperatures above freezing; and light snow with surface temperatures below 28º F. Precise definitions for a “wet” or “slippery” runway were not found in American’s DC-9 Operating Manual or Flight Manual. 133 The FAA’s crosswind certification requirement is that an airplane must be capable of safely landing with a 90º crosswind component of at least 20 percent of the stall speed for dry runway conditions.

Factual Information 80 Aircraft Accident Report Boeing’s MD-80 FCOM states, under the heading “Operational Limitations,” that the limiting tailwind component is 10 knots. 1.17.4.2 Spoiler Deployment Procedures American Airlines’ DC-9 Operating Manual, Volume 1, Techniques, page 21 (dated November 15, 1995), states that the automatic deployment of the spoilers after touchdown should be monitored and that, if the spoilers do not deploy automatically, the captain should manually deploy them. The manual also indicated, in its Normals section, page 75 (dated December 21, 1998), that “if Spoiler Lever does not move back to full aft (EXT) [extend] position, the Captain, regardless of which pilot is making the landing, will manually deploy spoilers.” Page 75 also indicated that the flying pilot and the nonflying pilot are to check that the spoiler lever is full aft after the airplane has touched down. For information on American’s postaccident changes to its spoiler deployment procedures, see section 1.17.5.1. 1.17.4.2.1 Manufacturer’s Information Boeing’s FCOM, Volume II, section 2, contains the following guidance on MD-80 spoiler deployment under the heading “Landing Roll Expanded Procedures”: For automatic deployment of inboard (ground) spoilers, throttles must be at idle. If throttles are above idle at touchdown, outboard and inboard spoilers may deploy and retract and ABS will disarm. If SPOILER lever does not move aft or does not remain at EXT [extend] position, PNF call, “No Spoilers,” PF move lever aft to full extend position and up to latched position.[134] 1.17.4.3 Braking Procedures American’s DC-9 Operating Manual, Volume 1, Techniques, page 21 (dated November 15, 1995), states that “the prudent use of manual braking has been shown to reduce brake wear” and that “unless circumstances dictate otherwise, manual braking is generally recommended for landing.” Volume 1, Normals, page 74 (dated April 26, 1999), indicates that pilots should use aggressive manual braking or maximum autobrakes on short or slippery runways. Volume 1, Environmental, page 3 (dated November 15, 1995), states under the section “Manual Brake Stopping” that “for short or slippery runways, immediately after nose gear touchdown, use full brake pedal.” Volume 1, Environmental, page 27 (dated April 26, 1999), states that, for landing on a 134 The Boeing MD-80 Chief Pilot stated his belief that this procedure had been a part of the company’s manual since 1991. The Chief Pilot indicated that most, if not all, of the domestic operators coordinate with the manufacturer, normally by requesting a letter of no technical objection, before making any changes to a manual. The Chief Pilot pointed out that there is no legal requirement for the operator to request a letter of no technical objection. In its April 20, 2000, letter to the Safety Board (see section 1.6.2.2), Boeing indicated that it could not find any record of issuing a letter of no technical objection to American regarding alteration of the manufacturer’s recommended spoiler or autobrake procedures.

Factual Information 81 Aircraft Accident Report slippery runway, “use aggressive manual braking or maximum auto brakes and auto spoilers.” American’s DC-9 Operating Manual, Volume 1, Environmental, page 4 (dated January 31, 1997), states the following regarding the anti-skid system: When brakes are applied on a slippery runway, several skid cycles will occur before the anti-skid system establishes the right amount of brake pressure for the most effective braking. If the pilot modulates the brake pedals, the anti-skid system is forced to readjust the brake pressure to re-establish optimum braking. During this readjustment time, braking efficiency is lost. On extremely slippery runways at high speeds, the pilot is confronted with a rather gradual deceleration and may interpret the lack of an abrupt sensation of deceleration as a total anti-skid failure. The natural response might be to pump the brakes or turn off the anti-skid. Either action will degrade braking effectiveness. For information on American’s postaccident changes to its braking procedures, see section 1.17.5.1. 1.17.4.3.1 Manufacturer’s Information Boeing’s FCOM, Volume II, section 2, contains the following guidance on MD-80 braking procedures under the heading “Landing Roll Expanded Procedures”: When nose gear is firmly on runway, apply sufficient down elevator after nose gear contact to increase weight on the nosewheel for improved steering effectiveness. (An excessive amount of down elevator will unload the main gear and reduce braking efficiency.) Volume II, section 3, of the manual contains the following information on operating on wet or slippery runways: On contaminated surfaces, full braking should be used to realize optimum antiskid operation. Autobrakes if available, should be used in the maximum setting. The normal braking technique on slippery runways is that immediately after nose gear touchdown, apply brake pressure smoothly and symmetrically with maximum pedal pressure and hold until a safe stop is assured. If a landing is planned on a runway contaminated with snow, slush, standing water, or during heavy rain, the following factors must be considered: available runway length; visibility of runway markers and lights; wind direction and velocity; crosswind effect on directional control; braking action; and the probability of hydroplaning and its effect on stopping distances. If a skid develops, especially in crosswind conditions, reverse thrust will increase the sideward movement of the airplane, in this case release brake pressure and reduce reverse thrust to reverse idle, and if necessary, forward idle. Apply rudder

Factual Information 82 Aircraft Accident Report as necessary to realign the airplane with the runway and reapply braking and reversing to complete the landing roll. 1.17.4.4 Use of Reverse Thrust American Airlines’ DC-9 Operating Manual, Volume 1, Techniques, page 21, (dated November 15, 1995), indicates the following: The application of reverse thrust tends to blank out the rudder. The effectiveness of the rudder starts decreasing with the application of reverse thrust and at 90 knots, at 1.6 EPR (in reverse) it is almost completely ineffective. If the airplane starts drifting across the runway while reversing, immediately return the reverse thrust levers to idle reverse to assist in regaining directional control and to restore rudder effectiveness. American’s DC-9 Operating Manual, Volume 1, Environmental, page 7 (dated April 26, 1999), states the following under the heading “Slippery Runway – Crosswind”: One of the worst situations occurs when there is a crosswind and sufficient water and speed to produce total tire hydroplaning. Reverse thrust tends to disrupt airflow across the rudder and increase the tendency of the airplane to drift downwind, especially if a crab or yaw is present. As reverse thrust increases above 1.3 EPR, rudder effectiveness decreases until it provides no control at about 1.6 EPR. Do not exceed 1.3 EPR reverse thrust on the slippery portions of the runway, except in an emergency. Page 27 includes the following guidance for landing on a slippery runway: • Apply reverse thrust as soon as possible after nosewheel touchdown. Do not exceed 1.3 EPR reverse thrust on the slippery portions of the runway, except in an emergency. • When reversing, be alert for yaw from asymmetric thrust. If directional control is lost, bring engines out of reverse until control is regained. • Do not come out of reverse at a high RPM. Sudden transition of reversers before engines spool down will cause a forward acceleration. For information on American’s postaccident changes to its guidance on the use of reverse thrust, see section 1.17.5.1. 1.17.4.4.1 Manufacturer’s Information At the Safety Board’s public hearing on this accident, the Chief Pilot for Flight Operations at the Boeing Commercial Airplane Group’s Long Beach, California, Division presented information on MD-80 rudder effectiveness during reverse thrust operation. The MD-80 Chief Pilot described thrust reversers as “clam shells” that open up

Factual Information 83 Aircraft Accident Report and redirect engine air flow to help slow the airplane. He indicated that, during reverse thrust operation, the overall effectiveness of the rudder to steer the airplane could be reduced because of the disrupted air flow over the rudder and the vertical stabilizer. According to the Chief Pilot, the thrust reversers disrupt the air that would normally be flowing in a streamline across the rudder and vertical stabilizer, creating a field of air that would be turbulent. The Chief Pilot stated that an MD-80 traveling at 90 to 100 knots with a 1.6 EPR (dry runway) setting would lose directional control from the rudder. He also stated that, because of the reduced rudder effectiveness, Boeing recommended coming out of reverse thrust until the airplane was going in the intended direction and that, once directional control from the rudder is restored, reverse thrust could be reapplied. Boeing’s FCOM, Volume II, section 2, contains the following guidance on MD-80 reverse thrust operations under the heading “Landing Roll Expanded Procedures”: On a dry runway, reverse thrust of no more than 1.6 EPR should be used, except in an emergency. On wet or contaminated runways, reverse thrust of no more than 1.3 EPR should be used, except in an emergency. If difficulty in maintaining directional control is experienced during reverse thrust operations, reduce thrust as required and select forward idle, if necessary, to maintain or regain directional control. Do not attempt to maintain directional control by using asymmetric reverse thrust. 1.17.4.4.2 MD-80 All Operators Letter On February 15, 1996, McDonnell Douglas issued an all operators letter to all MD-80 operators regarding handling characteristics when landing on wet or slippery runways and a change to reverse thrust management techniques. The letter stated that, because of the reverser efflux pattern resulting from the MD-80’s canted reverse thrust buckets, “the aerodynamic forces acting on the vertical stabilizer and rudder are disrupted by an increase in reverse thrust above approximately 1.3 EPR, thus reducing the ability of the rudder and vertical stabilizer to provide optimum directional control.” The letter further stated that, “as reverse thrust increases above approximately 1.3 EPR, rudder and vertical stabilizer effectiveness continue to decrease until at reverse thrust greater than approximately 1.6 EPR the rudder and vertical stabilizer provide little or no directional control.” The letter emphasized that rudder effectiveness is extremely important when surface friction is low and crosswind or tailwind conditions are present. The letter indicated that, under these conditions, directional control may only be available from the rudder. The letter also indicated that McDonnell Douglas was revising its recommended FCOM procedures to limit reverse thrust to 1.3 EPR when landing on wet or slippery

Factual Information 84 Aircraft Accident Report runways. (Section 1.17.4.4.1 shows the revised recommended procedures, which were in effect at the time of the Little Rock accident. The procedures that were in effect at the time the all operators letter was issued recommended reverse thrust settings up to 1.6 EPR.) The letter also stated that, on wet or slippery runways, sufficient nose down elevator should be applied after nose gear contact for improved steering effectiveness. The letter cautioned that an “excessive amount” of down elevator should not be applied because it would unload the main gear and reduce braking efficiency. 1.17.5 Postaccident Actions After the Little Rock accident, American conducted a three-phase operational and safety evaluation from August to November 1999.135 The first part of the evaluation was an independent audit that focused on flight training and the organization and operations of the Flight Department; American sought the input of professional pilots outside the organization who had managed airline operations. According to the AMR Vice Chairman, American “wanted the benefit of having outside eyes looking at how we did business.” The second part of the evaluation was a review by the Allied Pilots Association of the same subjects as in the first evaluation. The third part of the evaluation was conducted by the “System Analysis Team,” which consisted of representatives from American, the Allied Pilots Association, and the FAA. The team performed a 120-day review of six accidents and two incidents that occurred during the previous 5 years at American to determine why those events occurred and what approaches the airline could take to prevent such events from recurring. The three phases of the evaluation produced 85 recommendations.136 American and the Allied Pilots Association prioritized the recommendations according to importance or safety impact and created a timeline in which to accomplish the recommendations.137 At the public hearing, the AMR Vice Chairman indicated that the list of recommendations had been reviewed by the FAA’s Certificate Management Office for AMR Corporation and presented to the Flight Standards Group at FAA headquarters. Figure 17 shows a table, presented by the AMR Vice Chairman, that highlights recommendation categories, their expected completion dates, and their safety impact. 135 The former MD-80 Fleet Manager cited two more company actions that were also the result of the Little Rock accident. First, American presented an in-depth review of material related to landing with adverse runway conditions to all MD-80 check airmen at their third quarter 1999 standardization meeting. Second, American retained a radar expert to conduct a 1-day seminar for its check airmen on the use of airborne weather radar. These seminars, which were held between October and December 1999, reviewed each airplane’s individual weather radar systems, the types of echoes that the systems might portray, and the conditions that would be associated with those echoes. 136 Because the audits were conducted independently, many of the recommendations addressed common issues. The audits made recommendations in the following general issue areas: structure and effectiveness of the Flight Safety Department, flight training and flight standards, and flight operations. 137 The FAA’s POI for American Airlines stated that 17 recommendations were deemed “high priority” with the goal for immediate implementation.

Factual Information 85 Aircraft Accident Report Figure 17. Categories of the Postaccident Audit Recommendations According to Expected Completion Date and Safety Value On July 20, 2001, American Airlines provided the Safety Board with an update on actions to address the issues that had been identified during the three postaccident safety and operational audits. In addition to the actions involving the reorganization of the company that were previously discussed at the beginning of section 1.17 and the changes to the go-around policy previously stated in section 1.17.3.7, American made changes to its checklist philosophy to require challenges by the nonflying pilot and responses by the flying pilot for all mechanical checklist items (section 1.17.5.1 for the changes to the Before Landing checklist items) and expanded its stabilized approach guidance (see section 1.17.5.2). American’s Flight Safety Department undertook actions to increase its ability to identify and track operational trends and enhanced its internal evaluation program. American is also developing a formal risk management program and a Flight Operations Quality Assurance program that will be integrated with ASAP. In addition, Systems Analysis Team projects were completed, including one associated with pilot decision-making during the approach and landing phases of flight and one associated with stabilized approaches. American has also acted to improve its severe weather operational guidance. For example, the company revised and expanded its thunderstorm avoidance policies, clarified its wind landing limits to include gusts, expanded the quick reference crosswind table, strengthened guidance for landing on slippery runways during crosswinds, provided all pilots with the manufacturer’s weather radar booklet, and entered into a Highlights by Category • Ensure all crewmembers attend the fatigue countermeasures program • Develop computer-based training and digital video training for special airports • Improve Chief Pilot communication skills • Independent Flight Standards program to monitor flight training • Implement Special Procedures Operational Training • Flight Operations/System Operations Control Department reorganization • Reexamine Advanced Qualification Program and Single Visit Exemption • Publish Flight Safety magazine • Improve human factors focus on pilot decision-making • Implement Flight Operations Quality Assurance • Enhance safety audits • Develop safety performance metrics • Upgrade safety tracking system • Revise thunderstorm avoidance policy • Revise approach and landing policy • Safety Department reorganization • Vice President of Safety • Departmental Safety Directors • Restore relationship with Allied Pilots Association Safety Committee Jan-Mar 00 April-June 00 July 00-Jan 02 S A F E T Y V A L U E

Factual Information 86 Aircraft Accident Report contract to retrofit airborne predictive windshear weather radar on all company airplanes. In addition, American added pilot decision-making guidance during the approach and landing phases of flight to its Airplane Flight Manual Part I and distributed a technical bulletin to MD-80 pilots that addressed rollout deceleration factors and considerations specific to that airplane. In addition, training and evaluation standards were revised. For example, American provided its check airmen with additional weather radar training, updated its Human Factors and Safety Training to include additional events that involve flight crew decision-making, and modified the frequency and duration of training cycles under the Single Visit Exemption of the Advanced Qualification Program. Also, “Hot Briefing Items” on thunderstorm avoidance, weather radar usage, landing on contaminated runways, spoiler and deceleration device logic, and autobrake usage have been presented by all of American’s fleets. Further, American is developing an intranet-based continuing education training program on radar use and is considering the use of Special Procedures Operational Training as a replacement to LOFT. American also indicated that it established and implemented fatigue and reserve rest policies for its flight crews. In addition, the company published a “Commitment to Safety” statement to all employees and work groups. 1.17.5.1 DC-9 Operating Manual Changes American made several changes to its DC-9 Operating Manual after the Palm Springs incident, which occurred 8 months after the Little Rock accident. On February 23, 2000, 1 week after the Palm Springs incident, American issued Revision No. 31 to its DC-9 Operating Manual. The revision indicated that the Before Landing checklist would be accomplished as follows: • The pilot-not-flying will call out each item on the mechanical checklist. • The pilot-flying will visually verify that the item has been accomplished, and make the appropriate responses aloud. • The pilot-not-flying will also visually verify each item, and after obtaining a response, will move the corresponding switch on the mechanical checklist. • Both pilots will respond to the ALTIMETERS and FLT INSTR & BUGS items. The revision also stated that the “captain will always arm the spoiler for landing.” On June 22, 2000, American issued DC-9 Operating Manual Bulletin DC-9-42, which further revised the procedures for accomplishing the Before Landing checklist. The bulletin indicated that pilots were to “accomplish the Before Landing checklist by challenge and response as follows”:

Factual Information 87 Aircraft Accident Report Pilot-Not-Flying • Call out each item on the mechanical checklist. • Verify that item has been accomplished. • Call out response and move corresponding switch on mechanical checklist. Pilot-Flying • Verify and respond to the following items: – ALTIMETERS – FLT INSTR & BUGS – GEAR – SPOILER LEVER – FLAPS & SLATS In conjunction with the 1000 foot AFL callout, both pilots will visually confirm that all tabs on mechanical checklist are closed-out, and the pilot-not-flying will call out – “Before Landing checklist complete.” According to American’s February 23, 2000, revision to its DC-9 Operating Manual, both pilots are to check for spoiler deployment. The revision indicates that the captain is still to manually deploy the spoilers if the spoiler lever does not move back to the full aft (extend) position. The revision further indicates that, when the spoilers deploy, the nonflying pilot is to call out “deployed”; if the spoilers do not deploy or fail to remain deployed, the nonflying pilot is to call out “no spoilers,” and the captain is to manually deploy the spoilers. On June 27, 2000, American issued DC-9 Operating Manual Bulletin DC-9-43, which revised the policy on the use of autobrakes for landing. The revision stated the following: Autobrakes If operative, must be armed prior to landing when any of the following conditions exist: • Runway length less than 7000 feet • RVR less than 4000 or visibility less than 3/4 mile • Runway contaminated with standing water, snow, slush, or ice • Braking conditions reported less than good In addition, the use of autobrakes is recommended when landing with gusty winds or crosswinds.

Factual Information 88 Aircraft Accident Report Autobrake settings should be appropriate to the conditions: MAX must be used when minimum stopping distance is required (MAX autobrake deceleration rate is slightly less than that produced by full manual braking). After landing, intervene with manual braking as necessary to slow the airplane at the desired rate. American’s February 23, 2000, revision to its DC-9 Operating Manual indicated that the following reverse thrust procedures were effective immediately for all MD-80 landings: When nosewheel steering is on the ground, the PF will select idle reverse and apply slight forward pressure on the yoke. With spoilers deployed and directional control assured, reverse thrust may be left at idle or increased to a target of approximately 1.3 EPR. Reverse thrust of more than 1.3 EPR should not be used unless stopping distance is in doubt. Do not remain in reverse thrust if directional control cannot be maintained and do not use asymmetrical reverse thrust to regain directional control. 1.17.5.2 Flight Manual Changes American’s Flight Manual, Part I, Section 10, page 3 (dated July 21, 2000), revised the company’s stabilized approach criteria to state the following:138 Significant speed and configuration changes during an approach can complicate aircraft control, increase the difficulty of evaluating an approach as it progresses, and complicate the decision at the decision point; i.e., DA, DH, MDA. A pilot must assess the probable success of an approach before reaching the decision point. This requires the pilot to determine that requirements for a stabilized approach have been met and maintained. To limit configuration changes at low altitude, the airplane must be in a landing configuration by 1,000 feet AFL (gear down and landing flaps). A stabilized approach must be established before descending below the following minimum stabilized approach heights: • IMC [instrument meteorological conditions] – 1000 feet AFL • VMC [visual meteorological conditions] – 500 feet AFL 138 This information also appears in American’s DC-9 Operating Manual in a section titled “Approach—Landing—Go Around” (dated April 27, 2001).

Factual Information 89 Aircraft Accident Report A stabilized approach means that the airplane must be: • At Approach Speed (VREF + additives) • On the proper flight path at the proper sink rate • At stabilized thrust These requirements must be maintained throughout the rest of the approach for it to be considered a stabilized approach. If the stabilized approach requirements cannot be satisfied by the minimum stabilized approach heights or maintained throughout the rest of the approach, a go-around is required. Section 10, pages 1 and 2 (dated July 21, 2000), provide expanded approach and landing decision-making guidance. For example, under the heading “Thunderstorms and Microburst,” the guidance explicitly states that “takeoffs and landings are not permitted when thunderstorms are near the airport unless the runway and flight path are clear of thunderstorm hazards.” In addition, under the heading “Decision Factors,” the guidance provides a list of factors that can influence the decision to begin and continue an approach to either a landing or missed approach, including convective activity, turbulence, visibility/RVR, crosswind, precipitation, and weather trends. Further, the guidance indicates that “pilots should be especially aware of the cumulative factors and trends. For example…thunderstorms approaching an airport suggests holding until passage.” 1.17.6 Federal Aviation Administration Oversight The FAA Certificate Management Office for AMR Corporation is located in Dallas, Texas. The principal operations inspector (POI) for American Airlines stated that the Certificate Management Team was staffed with 17 air safety inspectors and 1 cabin safety inspector at the time of the flight 1420 accident. Of the 17 air safety investigators, 10 were operations inspectors, including the MD-80 Aircrew Program Manager (APM) and the Assistant MD-80 APM, and 7 were geographic inspectors who worked on the American certificate and were assigned to the Air Transportation Oversight System (ATOS) program office.139 139 The ATOS program was implemented at American Airlines in February 1999. As part of the program, each carrier was to be assigned an FAA analyst to determine trends in reported data. At the time of the accident, the analyst for American had not been assigned. In fact, at the time of the Safety Board’s public hearing on this accident, only 1 of the 10 carriers had been assigned an analyst. American’s analyst has now been hired and was expected to begin work on April 24,

1. The ATOS program will be discussed in detail in the Board’s final report on the January 31,

2000, Alaska Airlines flight 261 accident.

Factual Information 90 Aircraft Accident Report 1.17.6.1 Principal Operations Inspector The POI for American Airlines authorizes the airline’s operations through the issuance of operations specifications. The POI is also responsible for approving manuals and their revisions and reviewing surveillance records of training and line operations. The POI indicated during public hearing testimony that, when a manufacturer has recommended revisions to its operating manual, he routes the revisions to the appropriate APM, who reviews the information with the carrier. The POI stated that he relies very heavily on the opinion of the appropriate APM in deciding whether to approve a change to the operating manual because the APM has the technical expertise for the specific airplane and works closely with the FAA’s Aircraft Evaluation Group, the manufacturer, and the carrier. The POI also indicated that a carrier might choose not to make a manufacturer’s suggested change because of the way that carrier has configured the particular airplane. According to his testimony, the POI indicated that he ensures that pilot training is being performed satisfactorily through the APMs. The POI also stated that he is notified when any training event is not in compliance with company procedures and when line operations do not comply with company procedures. The POI testified that a hiring freeze had severely impacted his office’s ability to conduct surveillance. According to the POI, his emphasis areas at the time of the flight 1420 accident included the surveillance of American’s two new airplane fleets (the 737 and the 777) and the company’s South American operations. The POI indicated that, at the time of the public hearing, he had 16 air safety inspectors (6 of which were geographic inspectors) but wanted a total of 30 air safety inspectors (10 of which would be geographic inspectors). In addition, the POI indicated that he did not have a say in where the geographic inspectors were physically located. For example, at the time of the public hearing, the POI’s staff included a geographic inspector in Las Vegas but not one in New York or San Francisco, where American has a large volume of operations.140 1.17.6.2 Aircrew Program Manager The FAA’s APM for American’s MD-80 program at the time of the accident had worked in this position since 1984. The APM, along with the Assistant APM for American’s MD-80 program, were responsible for all operational aspects of American’s MD-80 fleet, including the flight training program. The APM and Assistant APM were current and qualified on the MD-80. In a postaccident interview, the APM stated that workload and personnel constraints did not allow him or the Assistant APM to monitor most of American’s proficiency check rides and type rating certifications of pilots. The APM indicated during 140 In August 2000, the POI for American indicated that he was “finally” assigned a geographic inspector who is located in New York. The POI indicated that the inspector would be ready to conduct inspections at the beginning of 2001—after he completes ATOS training and receives carrier-specific briefings.

Factual Information 91 Aircraft Accident Report that interview that, under his supervision, approximately 17 check airmen from American (appointed by the FAA as aircrew program designees) did most of the airman certification activities.141 He further indicated that the only certification work he performed was examining a new aircrew program designee or rechecking a pilot who had failed two consecutive check rides. The APM stated that he tried to observe the aircrew program designees each year before they were renewed, in accordance with volume 5 of FAA Order 8400.10, “Air Transportation Operations Inspector’s Handbook.” The APM indicated that workload constraints prevented him from observing all of American’s check airmen on a regular basis. The APM stated that he observed all check airmen at least every 2 years, in accordance with FAA Order 8400.10, volume 3. The APM explained that he and the Assistant APM were the only ones responsible for observing American’s MD-80 training. He further stated that they were “spread thin” and that it was “extremely difficult to cover all of the things that are going on at American Airlines, from an observation standpoint of training.” The APM stated that he tried to review the training manuals once a year and that the only simulator training he had time to observe was when a check airman was performing a proficiency check. The APM testified that he relied heavily on American Airlines to ensure standardization in its simulator training program. According to his testimony, American’s senior designated examiners, referred to as coordinators, observe every check airman and every simulator instructor at least once a year. The APM stated that these coordinators were “highly qualified.” In addition, the APM indicated that he tried to further efforts to standardize simulator training through discussions with the MD-80 check airmen during American’s quarterly check airmen meetings. The APM stated that the MD-80 was among the airplane models in American’s junior fleet and that about 75 percent of American’s new upgrade captains and 50 percent of the company’s new hire pilots were assigned to the MD-80 fleet. He also indicated that American’s MD-80 fleet averages about 28 new captains per month and that the number of check airmen tripled and the number of designated examiners doubled between the second half of 1998 and the end of 1999. The APM stated that, because of the training workload and personnel constraints, geographic inspectors (including those from offices in Chicago, New York, and Nashville) provided some assistance in observing IOE and line checks. The FAA’s PTRS showed that, for American’s MD-80 fleet, surveillance of check airmen was performed 27 times in 1998; surveillance of check airmen administering a line check, 25 times; and surveillance of check airmen during IOE, 60 times. From January to June 1, 1999, surveillance of check airmen had been performed 9 times for American’s MD-80 fleet; surveillance of check airmen 141 The APM testified that, 10 to 15 years ago, 5 or 6 inspectors from his program did all of the certification work but that the FAA did not have that “luxury” any longer because of a reduction in personnel.

Factual Information 92 Aircraft Accident Report administering a line check, 18 times; and surveillance of check airmen during IOE, 49 times. According to the APM’s testimony, he and the Assistant APM conducted en route inspections to observe whether American’s procedures were being correctly performed during line operations. The APM indicated that he critiques flight crews immediately if differences are observed. He further indicated that he has never seen a major problem during en route inspections but that flight crewmembers are on “good behavior” when inspectors are present. The FAA’s PTRS showed that, for American’s MD-80 fleet, en route surveillance was performed 795 times in 1998 and 537 times from January to June 1, 1999. 1.18 Additional Information 1.18.1 Runway Friction Information The senior research engineer from NASA’s Langley Research Center presented information at the public hearing about the three types of friction loss that can occur on a wet runway surface.142 They are viscous hydroplaning, dynamic hydroplaning, and reverted rubber skidding (or locked tires). His description of each follows: The contributing factors for viscous hydroplaning are a damp or wet pavement, medium to high speed, poor pavement texture, and worn tire tread. If a runway has good microtexture143 and grooving and the aircraft tires have a good tread design, viscous hydroplaning could be alleviated.144 The contributing factors for dynamic hydroplaning are a flooded pavement, high speed, low tire pressure, and worn tire tread. If a runway has good macrotexture145 and grooving and the aircraft tires have high pressure and good tread design, dynamic hydroplaning could be alleviated.146 142 The NASA Langley engineer presented the following runway wetness classifications: damp— moisture present on the surface to a depth of less than 0.01 inch, wet—standing water on the surface to a depth between 0.01 and 0.1 inch, and flooded—standing water on the surface to a depth that exceeds 0.1 inch. The NASA Langley engineer testified that the left side of runway 4R was flooded but that the right side was not. He also indicated that the crosswind conditions were not severe enough for the flooding from the left side to have exceeded the runway’s centerline. 143 Microtexture is a small sandpaper-type of texture that can only be felt. 144 According to the article, “Landing on Slippery Runways,” in Boeing’s October to December 1992 Airliner magazine, “viscous hydroplaning occurs on all wet runways and is a technical term used to describe the normal slipperiness or lubricating action of the water.” The article also stated that viscous hydroplaning reduces friction but not to the level that would prevent an airplane’s wheel from spinning up shortly after touchdown. 145 Macrotexture is the large roughness in the surface that is visible to the eye. 146 According to the article, “Landing on Slippery Runways,” in Boeing’s October to December 1992 Airliner magazine, dynamic hydroplaning “lifts the tire completely off the runway and causes such a substantial loss of tire friction that wheel spin up may not occur.”

Factual Information 93 Aircraft Accident Report The contributing factors for reverted rubber skidding147 are a wet or flooded pavement, high speed, poor pavement texture, and a deficient brake system. To alleviate reverted rubber skidding, a good pavement structure and grooving and improved antiskid control devices are necessary. The NASA Langley engineer indicated that a pavement’s capability to alleviate slipperiness improves as its microtexture and macrotexture increase. The potential to alleviate slipperiness on smooth pavement surface that is damp or flooded is poor, whereas the potential to alleviate slipperiness on a porous pavement surface that is damp or flooded is excellent. For a transverse grooved runway, such as runway 4R at Little Rock, the potential to alleviate slipperiness during damp conditions is excellent, and the potential to alleviate slipperiness during flooded conditions is good to excellent. The engineer stated that runway 4R’s microtexture was above average, macrotexture was excellent, and grooving was satisfactory. In addition, he stated that the runway’s ability to prevent hydroplaning and other braking problems was excellent.148 The engineer stated that dynamic hydroplaning was not a factor in the accident because of the scrub marks on the runway.149 He further stated that the water depth that would have produced a dynamic hydroplaning effect on runway 4R was approximately 0.28 inches and that, at flight 1420’s touchdown point, there would have been less than 0.10 inch of water in that area of the runway located 15 feet from the centerline because of the crosswinds that were moving from left to right.150 In addition, the engineer stated that he found no evidence of reverted rubber skidding because the runway had good pavement texture and grooving and there was no tread reversion on the four main landing gear tires and no reverted rubber on the runway surface. The NASA research engineer also provided testimony about antiskid operations. The engineer indicated that normal antiskid operation would be expected with high wheel spin-up accelerations on a high-to-medium runway traction surface and early spoiler deployment at touchdown. He also stated that abnormal antiskid operation would be expected with low- to no-wheel spin-up accelerations on a low- to no-traction runway surface and delayed spoiler deployment at touchdown. According to the NASA engineer, a dilemma with antiskid control systems during crosswind operations is that, to preserve 147 The terms “reverted rubber skidding” and “reverted rubber hydroplaning” can be used interchangeably. 148 The Boeing aerodynamics engineer stated during his testimony that runway 4R is “very good” because it has been grooved and has good surface texture. 149 The NASA Langley engineer indicated that the scrub marks (white-appearing tracks on the pavement that were lighter in color than the adjacent areas, as described in section 1.10.3.1) resulted from the high pressure between the tire print and the wet pavement. He indicated that the marks were caused by the braking action between the tire and the pavement and the steering forces being developed between the tire and the pavement. The NASA Langley engineer stated that the scrub marks led up to tire marks going through the grass and to the accident site. He also stated that no black rubber tire marks were evident on the runway because the pavement surface was wet. 150 The NASA Langley engineer explained that, under the accident conditions and with the high vertical sink rate at which the airplane touched down, he had “no problem or no question about the wheels spinning up on touchdown.”

Factual Information 94 Aircraft Accident Report braking, the antiskid must operate at increasing slip ratios as the airplane yaws but that, to preserve cornering, the antiskid must operate at low slip ratios.151 The engineer stated his belief that flight 1420 could not develop any cornering friction with the wet runway conditions because of the yaw angles the airplane experienced during the accident sequence. 1.18.2 Study on Thunderstorm Penetration in the Terminal Area Research staff at the Massachusetts Institute of Technology’s Lincoln Laboratory conducted a study, sponsored by NASA, of the variables that are correlated with arriving pilots’ convective weather penetrations or deviations in the Dallas/Fort Worth terminal airspace.152 (This airspace encompasses Dallas/Fort Worth International Airport and Dallas/Love Field.) The study analyzed 63 hours of convective weather and flight data for arriving aircraft. The data were collected over nine stormy days between late April and early July 1997. During that time, 1,279 aircraft encountered storm cells 1,952 times; about one-third of the encounters (642) resulted in deviations, and about two-thirds (1,310) resulted in penetrations. The study did not include information from the flight crews regarding the reasons for the actions documented by the flight data. The data included very few encounters with NWS level 1 (very light) precipitation because of the threshold values used to identify penetrations and deviations. The data indicated that the number of penetrations for level 2 (light to moderate) precipitation was about six times greater than the number of deviations. Further, the data indicated that pilots were more likely to penetrate than deviate around level 3 (strong) thunderstorms, but pilots were more likely to deviate around rather than penetrate level 4 (very strong) and 5 (intense) thunderstorms. Finally, the data showed very few encounters with level 6 (extreme) thunderstorms, but all of the pilots encountering such thunderstorms deviated around them. In addition, the data indicated that most of the encounters within 20 to 30 kilometers (10 to 16 nm) of the destination airport resulted in penetrations. For example, there were 918 encounters with level 3, 4, and 5 thunderstorms during the data collection period. Of the 297 such encounters within 25 kilometers of the destination airport, 266 (90 percent) resulted in penetrations. However, of the 611 such encounters farther than 25 kilometers from the destination airport, 157 (26 percent) resulted in penetrations. The study also found that, farther from the airport, pilots nearly always deviated around intense storms and penetrated weaker storms and that, closer to the airport, pilots mostly penetrated the storms regardless of their intensity. Several flight-related variables were tested to determine whether they were correlated to a pilot’s decision to penetrate thunderstorms. The tests determined that 151 Slip ratios measure the amount of rolling and skidding in tire motion. For a rolling tire, the ratio is zero; for a skidding tire (or locked wheel), the ratio is one. 152 Rhoda, D.A. and Pawlak, M.L. 1999. An Assessment of Thunderstorm Penetrations and Deviations by Commercial Aircraft in the Terminal Area. Massachusetts Institute of Technology, Lincoln Laboratory, Project Report NASA/A-2.

Factual Information 95 Aircraft Accident Report pilots were more likely to penetrate convective weather when they were following another aircraft, behind schedule by more than 15 minutes, or flying after dark. According to public hearing testimony by the primary author of this study, there were no discernible differences among air carriers regarding the propensity to penetrate or deviate around thunderstorms or among jet versus turboprop airplanes. 1.18.3 Studies on Flight Crew Decision-Making 1.18.3.1 Safety Board Study of Flight Crew Involvement in Major Accidents The Safety Board issued a 1994 safety study that examined the operating environments and errors made by flight crewmembers in 37 major accidents between 1978 and 1990.153 The Board identified 302 flight crew errors in the 37 accidents, 232 of which were considered primary errors and 70 of which were considered secondary errors. The 232 primary errors were grouped according to type of error. The primary error categories and the number of errors in each category were as follows: procedural (for example, not conducting or completing required checklists or not following prescribed checklist procedures), 73 errors; tactical decision (for example, improper decision-making, failing to change a course of action in response to a signal to do so, and failing to heed warnings or alerts that suggest a change in course of actions), 51 errors; aircraft handling, 46 errors; situational awareness (for example, controlling the airplane at an incorrect target altitude), 19 errors; communication, 13 errors; systems operation, 13 errors; resource management, 11 errors; and navigational, 6 errors. Secondary errors resulted from the failure of a crewmember to monitor or challenge a primary error made by another crewmember. The study also examined the effect of the length of time since awakening (TSA) on the errors made by flight crewmembers. The performances of flight crews in which the captain and the first officer had been awake an average of 13.8 and 13.4 hours, respectively (referred to as high TSA crews), were compared with the performances of flight crews in which the captain and the first officer had been awake an average of 5.3 and 5.2 hours, respectively (referred to as low TSA crews).154 The Safety Board found that both the number and type of errors made by the flight crews varied significantly according to the TSA length. Specifically, high TSA crews made an average of 40 percent more errors than low TSA crews. Also, high TSA crews made significantly more procedural and tactical decision errors than low TSA crews. According to the study report, these results suggested that the degraded performance by high TSA crews tended to involve ineffective decision-making and procedural slips rather than a deterioration of aircraft handling skill. 153 National Transportation Safety Board. 1994. A Review of Flightcrew-Involved Major Accidents of U.S. Air Carriers, 1978 Through 1990. Safety Study NTSB/SS-94/01. Washington, DC. 154 The safety study’s findings related to fatigue are based on only 12 of the 37 accidents examined in the study. There were six high TSA crews and six low TSA crews.

Factual Information 96 Aircraft Accident Report 1.18.3.2 National Aeronautics and Space Administration Study on Flight Crew Decision Errors Researchers at NASA’s Ames Research Center in Moffett Field, California, conducted a study that examined the Safety Board’s findings in its 1994 safety study.155 The purpose of the NASA study was to analyze the accident data on the most common flight crew decision errors to determine any themes or patterns within which the errors occurred. The NASA researchers found that the most common decision errors occurred when the flight crew decided to “continue with the original plan of action in the face of cues that suggested changing the course of action.” The study stated that cues that signal a problem are not always clear and that a decision-maker’s situation assessment may not keep pace with conditions that deteriorate gradually. The study also stated that individuals have a natural tendency to maintain their originally selected course of action until there is clear and overwhelming evidence that the course of action should be changed. Further, the study stated the following: [A] recurring problem is that pilots are not likely to question their interpretation of a situation even if it is in error. Ambiguous cues may permit multiple interpretations. If this ambiguity is not recognized, the crew may be confident that they have correctly interpreted the problem. Even if the ambiguity is recognized, a substantial weight of evidence may be needed to change the plan being executed. In addition, the study noted that pilots under stress might not evaluate the consequences of various options. 1.18.4 Technologies to Detect and Locate Downed Airplanes Several technologies could help ATC facilities and ARFF units in detecting, locating, and expediting emergency response efforts after aircraft accidents. These technologies include emergency locator transmitters (ELT) and the DEVS. An ELT is a device aboard an airplane that is intended to transmit a signal after an accident to aid rescue personnel in locating the airplane. Airplanes operating under 14 CFR Part 121 are not required to be equipped with an ELT, but it is a recommended practice, under Annex 6 to the Convention on International Civil Aviation, for all airplanes to carry an automatically activated ELT. According to AC 150/5210-19, “Driver’s Enhanced Vision System (DEVS),” dated December 23, 1996, the purpose of the DEVS program is to reduce ARFF response times in poor visibility conditions. The system is “aimed at the difficult aspects of poor visibility response: locating the accident, navigating to the accident site, and avoiding obstacles and locating people on the way to the accident site.” 155Orasanu, J.; Martin, L.; and Davison, J. Errors in Aviation Decision Making: Bad Decisions or Bad Luck? NASA Ames Research Center, Moffett Field, California. Presented to the Fourth Conference on Naturalistic Decision Making, Warrenton, Virginia, May 29-31, 1998.

Factual Information 97 Aircraft Accident Report DEVS consists of three components: a forward-looking infrared device, a global positioning system, and a tracking system. The FAA’s Manager of the Airport Safety and Certification Branch, Office of Airport Safety and Standards, stated that the most important part of DEVS is the forward-looking infrared device because it allows a vehicle’s driver to see in almost zero or zero visibility. The range that the system can look ahead depends mostly on the weather conditions. According to the Branch Manager, the device is looking for heat sources, so an airplane on fire in the rain may be harder for the device to find because the rain would cool the plume of smoke from the fire. He added that the device would be effective in snow but that the device’s range would be less. The Branch Manager indicated that the FAA requires a forward-looking infrared device to be installed on all of its new fire trucks that carry 1,500 or more gallons. There is no requirement, however, for ARFF personnel aboard these trucks to use this device. 1.18.5 Previous Weather-Related Accidents USAir Flight 1016, Charlotte, North Carolina, July 2, 1994 On July 2, 1994, USAir flight 1016, a Douglas DC-9-31, N954VJ, collided with trees and a private residence after executing a missed approach to runway 18R at Charlotte/Douglas International Airport, Charlotte, North Carolina.156 At the time, adverse weather conditions existed over the airport and along the flightpath. Of the 57 people aboard the airplane, 37 passengers were killed; 2 flight attendants and 14 passengers received serious injuries; and the 2 flight crewmembers, 1 flight attendant, and 1 passenger received minor injuries. The airplane was destroyed by impact forces and fire. The Safety Board determined that the probable causes of this accident were (1) the flight crew’s decision to continue an approach into severe convective activity that was conducive to a microburst; (2) the flight crew’s failure to recognize a windshear situation in a timely manner; (3) the flight crew’s failure to establish and maintain the proper airplane attitude and thrust setting necessary to escape the windshear, and (4) the lack of real-time adverse weather and windshear hazard information dissemination from ATC, all of which led to an encounter with and failure to escape from a microburst-induced windshear that was produced by a rapidly developing thunderstorm located at the approach end of runway 18R. Contributing to this accident were (1) the lack of ATC procedures that would have required the controller to display and issue ASR-9 weather information to the pilots of flight 1016; (2) the Charlotte tower supervisor’s failure to properly advise and ensure that all controllers were aware of and reporting the reduction in visibility and the RVR value information; (3) the inadequate remedial actions by USAir to ensure adherence to 156 National Transportation Safety Board. 1995. Flight Into Terrain During Missed Approach, USAir Flight 1016, DC-9-31, N954VJ, Charlotte/Douglas International Airport, Charlotte, North Carolina, July 2, 1994. Aircraft Accident Report NTSB/AAR-95/03. Washington, DC. Section 1.18.7.2 discusses the ARFF emergency response to this accident.

Factual Information 98 Aircraft Accident Report standard operating procedures; and (4) the inadequate software logic in the airplane’s windshear warning system that did not provide an alert upon entry to the windshear. Delta Air Lines Flight 191, Dallas, Texas, August 2, 1985 On August 2, 1985, Delta Air Lines flight 191, a Lockheed L-1011-385-1, N726DA, crashed while approaching to land on runway 17L at Dallas/Fort Worth International Airport.157 The airplane entered a microburst, which the pilot was unable to traverse successfully. The airplane struck the ground about 6,300 feet short of the runway, hit a car on the highway north of the runway, struck two water tanks at the airport, and broke apart. The 3 flight crewmembers, 5 flight attendants, and 126 passengers were killed; 1 flight attendant and 14 passengers received serious injuries; 2 flight attendants and 10 passengers received minor injuries; and 2 passengers were not injured. In addition, the driver of the car was killed, and 1 rescuer received minor injuries. The airplane was destroyed by impact forces and a postcrash fire. The Safety Board determined that the probable causes of this accident were the flight crew’s decision to initiate and continue the approach into a cumulonimbus cloud, which the crewmembers observed to contain visible lightning; the lack of specific guidelines, procedures, and training for avoiding and escaping from low altitude windshear; and the lack of definitive, real-time windshear hazard information. This resulted in the airplane’s encounter at low altitude with a microburst-induced, severe windshear from a rapidly developing thunderstorm located on the final approach course. 1.18.5.1 Previous Weather-Related Safety Recommendations Since 1974, the Safety Board has issued at least 90 weather-related safety recommendations to the FAA, NWS, National Oceanic and Atmospheric Administration, and others. Three of these recommendations have relevance to the current investigation and are detailed below. A-95-48 and -52 On April 4, 1995, as part of its final report on the USAir flight 1016 accident, the Safety Board issued Safety Recommendations A-95-48 and -52 to the FAA and NWS, respectively. These recommendations asked each agency to cooperate with the other to Reevaluate the Central Weather Service Unit program and develop procedures to enable meteorologists to disseminate information about rapidly developing hazardous weather conditions, such as thunderstorms and low altitude windshear, to FAA TRACONs and tower facilities immediately upon detection. On August 14, 1995, the FAA stated that it had reevaluated its existing procedures to disseminate information about rapidly developing hazardous weather 157 National Transportation Safety Board. 1986. Delta Air Lines, Inc., Lockheed L-1011-385-1, N726DA, Dallas/Fort Worth International Airport, Texas, August 2, 1985. Aircraft Accident Report NTSB/AAR-86/05. Washington, DC.

Factual Information 99 Aircraft Accident Report conditions to ATC facilities and believed that the procedures were appropriate. On July 26, 1996, the Safety Board stated that additional procedures must be developed to efficiently use and disseminate hazardous weather information that is available from current and planned meteorological systems for the center weather service units (CWSU),158 such as WSR-88D. The Board also indicated that the FAA, along with the NWS, must make a timely, detailed, and comprehensive effort to reevaluate the CWSU program. On January 6, 1997, the FAA stated that it had been working with the NWS regarding air traffic aviation weather needs associated with the performance of the CWSUs and that it was developing a program to explore the concept of using enhanced weather-trained FAA ATC personnel to perform all CWSU duties. On June 9, 1997, the Safety Board acknowledged the FAA’s efforts to date but expressed concerns about its initiative to replace NWS meteorologists at the CWSUs with enhanced weather-trained FAA ATC personnel. On February 28, 1998, the FAA stated that NWS meteorologists would continue to staff the CWSUs. The FAA also stated that it would work with the NWS to standardize CWSU operations and rewrite the national CWSU order based on air traffic requirements. On May 29, 1998, the Board recognized these efforts. On June 5, 2000, the FAA stated that it and the NWS held a meeting in February 2000 with most of the CWSU meteorologists-in-charge and representatives from both agencies to review current CWSU products and procedures. The FAA stated that the participants agreed on the need to review and update all documentation on CWSU duties and standardize procedures and products. The FAA also stated that the participants determined that equipment should be installed to enable the FAA to relay all weather information, including hazardous weather conditions, to controllers without the need for manual intervention. As a result, the FAA indicated that it was installing an ASOS Controller Equipment–Information Display System (designed to consolidate all weather and aeronautical information into one controller display) in eight TRACON or associated facilities. The FAA anticipated that all eight systems would be installed by September 2001 if funding were available. On July 14, 2000, the Safety Board indicated that, although the FAA was taking the actions specified in this recommendation, its work was not scheduled to be completed until 6 1/2 years after the recommendation was issued. On August 21, 2001, the FAA indicated that two of the eight ASOS Controller Equipment–Information Display Systems were operational and that the installation of the remaining systems would be completed by the fall of 2001, as long as funding was available for this project. The FAA also indicated that it and the NWS would revise, in early 2002, FAA Order 7210.38A, Center Weather Service Unit, to standardize CWSU operations nationwide. On October 22, 2001, the Board reemphasized its concern about the length of time that had passed since the recommendation was issued but recognized that the FAA appeared to be in the final stages of completing its planned actions. Pending completion of the FAA’s 158 There are 21 CWSUs throughout the United States.

Factual Information 100 Aircraft Accident Report planned actions, Safety Recommendation A-95-48 was classified “Open—Acceptable Response.” On November 17, 1997, the NWS indicated that it had several programs underway that were relevant to the intent of Safety Recommendation A-95-52, including programs at NASA and the FAA. On April 15, 1998, the Safety Board stated that it wanted to review the NWS’ actions to identify future goals and responsibilities of the CWSUs, identify any deficiencies in the CWSU program, and institute any necessary improvements. On August 28, 2000, the NWS indicated that the Integrated Terminal Weather System, which would produce fully automated and integrated terminal weather information, had been developed by the FAA and would be fully implemented in 2003. On January 5, 2001, the Board expressed its concern that the NWS appeared to have made little progress in addressing this recommendation and requested that the NWS provide, within 3 months, a schedule of all activities taken in response to this recommendation. On April 5, 2001, the NWS explained that it was beyond the scope of present CWSU operations for weather forecasters to provide continuous weather information services to support terminal operations. The NWS further stated that any increase in the scope of responsibilities for CWSU forecasters would require direction from the FAA, which, according to the NWS, has “reserved the right to make the final decision regarding any changes to the CWSU concept of operations.” On August 7, 2001, the Safety Board acknowledged that the FAA funds and makes final decisions regarding the CWSU program, but the Board did not believe that the concept of operations regarding center weather support was driven solely by the FAA. The Board indicated that the NWS and FAA should discuss the issues in Safety Recommendation A-95-48 and -52 as part of routine discussions regarding CWSU operations and make plans to address the issues. The Board further noted that, in the 6 years since this recommendation was issued, the NWS has provided few updates on the status of its actions, including the schedule of all recommendation-related activities requested in the Board’s January 2000 letter. Pending receipt of this information and completion of the recommended action, Safety Recommendation A-95-52 was classified “Open—Unacceptable Response.” A-90-84 On June 18, 1990, the Safety Board issued a safety recommendation letter to the FAA about its windshear program. The letter indicated that the program had generally been well managed and productive and that elements of the program had been well coordinated within the Government and industry. However, the Board determined that additional actions were required by the FAA to ensure maximum protection against low-altitude windshear. As a result, the Board issued Safety Recommendation A-90-84, which asked the FAA to Develop the modular windshear detection enhancement to the Airport Surveillance Radar (ASR-9) and implement the enhanced ASR-9 at air carrier airports not scheduled for a Terminal Doppler Weather Radar (TDWR) system or as an interim measure at airports scheduled for late TDWR installations.

Factual Information 101 Aircraft Accident Report On February 21, 1995, the FAA stated that it was proceeding with the development of an ASR Weather Systems Processor (WSP). The FAA explained that the WSP is a “cost-effective, add-on, passive radar receiver and weather processor on a host ASR” and that the WSP adds “full TDWR-like performance to existing ASR-9 search radars” by providing windshear and microburst detection, storm cell motion, and prediction of gust fronts for use by air traffic controllers and control tower operators. The FAA further explained that the WSP would consolidate other weather data from the LLWAS or ASOS into a single display. The FAA indicated that WSP component testing would conclude at the end of 1995 and that the system would be integrated by September 2002 at 33 airports that have medium air traffic density, are subject to windshear, and are not qualified to receive TDWR. On June 20, 1995, the Safety Board indicated that it was pleased with the FAA’s plan to develop the WSP but urged the FAA to expedite its efforts to provide windshear protection at airports that are not served by TDWR. The FAA’s letters to the Safety Board between August 1996 and December 1999 detailed the FAA’s progress in developing and procuring the WSP systems. The Board’s letters to the FAA between December 1996 and March 2000 acknowledged the FAA’s efforts to date and restated the Board’s concern about the hazard of low-altitude windshear at airports before the WSP systems are delivered. On July 24, 2000, the FAA stated that it was continuing its efforts to complete the development of the production version of the WSP. The FAA indicated that two WSP prototypes were operating continuously at Albuquerque, New Mexico, and Austin, Texas. The FAA also stated that three limited-production WSP systems were installed at the FAA’s Academy, the FAA’s William J. Hughes Technical Center, and Albuquerque in January, May, and June 2000, respectively; a fourth limited-production system was in the process of being installed at Austin; a fifth limited-production system would remain with the contractor to serve as a depot repair system; and a sixth limited-production system was scheduled to be delivered to Norfolk, Virginia, in September 2000. In addition, the FAA stated that operational tests and evaluations were to be completed in December 2000 and that full production system deliveries would occur between March 2001 and July 2002 at a rate of two systems per month. On September 14, 2000, the Safety Board expressed its concern about the WSP project’s slow pace and pointed out that the project’s anticipated completion date of mid-2002 would be 12 years after this recommendation was first issued. On March 16, 2001, the FAA indicated that, between July and December 2000, it completed initial operational testing and evaluation of the WSP and that all six limited-production systems were continuously operating. The FAA also indicated that, in November 2000, it procured an additional system to be installed in at the FAA’s program support facility in Oklahoma City, Oklahoma. In addition, the FAA stated that it had conducted the first operators’ training course in November 2000 and the first maintenance training course in December 2000. Further, the FAA stated that follow-on operational testing and evaluation was scheduled to be completed in April 2001 and that

Factual Information 102 Aircraft Accident Report initial full-production deliveries would begin then. On May 16, 2001, the Safety Board stated that it would appreciate receiving updates on the delivery schedule. On July 2, 2001, the FAA stated that, in April 2001, it held a dedication ceremony to commemorate the installation of the first three key site operational WSP systems in Austin, Albuquerque, and Norfolk; the delivery of the first of 32 full-production units to the FAA’s program support facility in Oklahoma City; and the initiation of WSP production. The FAA indicated that it had updated WSP software to improve system maintainability and that WSP deliveries would begin by August 2001. On August 27, 2001, the Safety Board noted its concern about the amount of time that has passed since this recommendation was first issued but acknowledged that the FAA was working to have the WSP fully deployed soon. Pending full deployment and operation of all WSP systems by July 2002, Safety Recommendation A-90-84 was classified “Open— Acceptable Response.” 1.18.6 Previous Fatigue-Related Accidents American Eagle Flight 4925, Jamaica, New York, May 8, 1999 On May 8, 1999, American Eagle flight 4925, a Saab 340B, N232AE, overran the end of runway 4R during landing at John F. Kennedy International Airport, Jamaica, New York.159 The captain flew the approach with excessive altitude, airspeed, and rate of descent and remained above the glideslope, and the first officer failed to make required callouts, including a missed approach callout. As previously discussed in section 1.16.5, an EMAS installed at the end of the runway stopped the airplane. Of the 30 persons on board, 1 was seriously injured, and 29 were not injured. The airplane received substantial damage. During postaccident interviews, both pilots stated that they were fatigued. They had been working a continuous-duty overnight schedule (that is, a trip sequence that is flown during the late night hours and the early morning hours of the next day in which the break between flights is not sufficient to qualify as a duty rest period, even if the flight crew is provided with a hotel room for rest). On May 7, 1999, the flight crewmembers awoke during the morning hours, did not sleep during the day, and reported for duty about 2200 for a flight scheduled about 2246. The flight was delayed but arrived at the destination airport—Baltimore-Washington International Airport— about 0025 on May 8. The pilots went to sleep about 0130 and awoke about 0445 for the accident flight, which was scheduled to depart about 0610. The Safety Board determined that the probable cause of this accident was the captain’s failure to perform a missed approach, as required by company procedures. Contributing to the cause of this accident were the captain’s improper in-flight decisions 159 The description for this accident, NYC99FA110, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

Factual Information 103 Aircraft Accident Report and failure to comply with FAA regulations and company procedures, inadequate crew coordination, and fatigue. Korean Air Flight 801, Nimitz Hill, Guam, August 6, 1997 On August 6, 1997, Korean Air flight 801, a Boeing 747-300, Korean registration HL7468, crashed at Nimitz Hill, Guam.160 The airplane had been cleared to land on runway 6L at Guam International Airport, Agana, Guam, and crashed into high terrain about 3 miles southwest of the airport. Of the 254 persons on board, 228 were killed (including the three flight crewmembers), and 23 passengers and 3 flight attendants survived the accident with serious injuries. The airplane was destroyed by impact forces and a postcrash fire. The accident happened after midnight in the flight crew’s home time zone (0142 Guam local time). According to the final report on this accident, research has indicated that this time of day is often associated with degraded alertness and performance and a higher probability of errors and accidents. Also, the arrival time for flight 801 was several hours after the captain’s (the flying pilot) normal bedtime. At the time of the accident, the captain had been awake for 11 hours,161 and the CVR recorded unsolicited comments made by the captain related to fatigue. The Safety Board concluded that the captain was fatigued, which degraded his performance and contributed to his failure to properly execute the approach. The Safety Board determined that the probable cause of this accident was the captain’s failure to adequately brief and execute the nonprecision approach and the flight crew’s failure to effectively monitor and cross-check the captain’s execution of the approach. Contributing to these failures were the captain’s fatigue and Korean Air’s inadequate flight crew training. Contributing to the accident was the FAA’s intentional inhibition of the minimum safe altitude warning system at Guam and the agency’s failure to adequately manage the system. 1.18.6.1 Previous Fatigue-Related Safety Recommendation Since 1989, the Safety Board has issued at least 70 safety recommendations related to fatigue for all modes of transportation. In addition, human fatigue in transport operations has been included in the Board’s annual list of Most Wanted Transportation Safety Improvements since the list’s inception in September 1990. One recent aviation fatigue-related recommendation is detailed below. 160 National Transportation Safety Board. 2000. Controlled Flight Into Terrain. Korean Air Flight 801, Boeing 747-300, HL7468, Nimitz Hill, Guam, August 6, 1997. Aircraft Accident Report NTSB/AAR-2000/01. Washington, DC. 161 The captain’s wife indicated that, on August 5, 1997, he woke up about 0600 and took a nap between 1100 and 1340 (Seoul local time).

Factual Information 104 Aircraft Accident Report A-99-45 In May 1999, the Safety Board adopted a safety report that evaluated the U.S. Department of Transportation’s (DOT) efforts in the 1990s to address operator fatigue.162 In its report, the Board noted that in 1989 it issued three recommendations to the DOT addressing needed research, education, and revisions to hours-of-service regulations.163 The Board stated that, even though the DOT and modal administrations had responded positively to the recommendations addressing research and education, little action had occurred with respect to revising the hours-of-service regulations. The safety report discussed the activities and efforts by the DOT and the modal administrations to address operator fatigue and the resulting progress that has been made over the past 10 years to implement the actions called for in the Safety Board’s fatigue-related recommendations. The report also provided background information on current hours-of-service regulations, fatigue, and the effects of fatigue on transportation safety. As a result of its findings, the Safety Board issued Safety Recommendation A-99-45, which asked the FAA to Establish within 2 years scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements. On July 15, 1999, the FAA stated that, on December 11, 1995, it issued Notice of Proposed Rulemaking (NPRM) 95-18, “Flight Crewmember Duty Period Limitations, Flight Time Limitations and Rest Requirements.” The NPRM proposed amending existing regulations to establish one set of duty period limitations, flight time limitations, and rest requirements for flight crewmembers involved in air transportation. The FAA stated that the NPRM considered scientific data from studies conducted by NASA relating to flight crewmember duty periods, flight times, and rest and that Safety Recommendation A-99-45 would be included in this rulemaking project. The FAA indicated that its Aviation Rulemaking Advisory Committee was tasked to review reserve 162 National Transportation Safety Board. 1999. Evaluation of U.S. Department of Transportation Efforts in the 1990s to Address Operator Fatigue. Safety Report NTSB/SR-99/01. Washington, DC. 163 Safety Recommendation I-89-1 asked the DOT to expedite a coordinated research program on the effects of fatigue, sleepiness, sleep disorders, and circadian factors on transportation system safety. Safety Recommendation I-89-2 asked the DOT to develop and disseminate educational material for transportation industry personnel and management regarding shift work; work and rest schedules; and proper regimens of health, diet, and rest. Safety Recommendation I-89-3 asked the DOT to review and upgrade regulations governing hours of service for all transportation modes to ensure that they are consistent and that they incorporate the results of the latest research on fatigue and sleep issues. Safety Recommendations I-89-1 and -2 were classified “Closed—Acceptable Action” on July 19, 1996, and May 25, 2001, respectively. Safety Recommendation I-89-3 was classified “Closed—Unacceptable Action/Superceded” with the issuance of Safety Recommendation I-99-1, which asked the DOT to “require the modal administrations to modify the appropriate Codes of Federal Regulations to establish scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements. Seek Congressional authority, if necessary, for the modal administrations to establish these regulations.” The Safety Board classified Safety Recommendation I-99-1 “Open— Acceptable Response” on December 4, 2000.

Factual Information 105 Aircraft Accident Report issues related to the NPRM but was unable to agree on a recommendation. The FAA further indicated that it was conducting a risk assessment to determine the probability of preventing future incidents related to fatigue and did not know when a supplemental NPRM would be issued. In addition, the FAA stated that, on June 15, 1999, it published a Notice of Intent in the Federal Register to indicate the agency’s intent to enforce regulations concerning flight time limitations and rest requirements. On January 3, 2000, the Safety Board stated that it was pleased that the FAA would include this safety recommendation in any future action regarding NPRM 95-18 and that the FAA was committed to enforcing its existing regulations. However, the Board indicated that it was disappointed that, even though the NPRM was issued over 4 years earlier, the existing regulations had not been upgraded. Also, the Board indicated that it wanted to understand the FAA’s rationale for a supplemental NPRM. In addition, at an October 7, 1999, meeting to discuss aviation issues on the Board’s list of Most Wanted Transportation Safety Improvements, FAA representatives said that the FAA would not be able to meet the specified 2-year timeframe for a new rule. On December 5, 2000, the FAA stated that it planned to issue a supplemental NPRM that would address the technical and operational concerns that were raised during the NPRM comment period. According to the FAA, the supplemental NPRM would prescribe “a maximum duty period linked to a maximum flight time restriction that is associated with a minimum rest period based on the number of pilots.” Also, the FAA indicated that the supplemental NPRM, which was expected to be issued by spring 2001, would address the issue of fatigue “concretely” and give the airlines the flexibility they need to operate. The FAA further indicated that it would have to issue a supplemental NPRM rather than a final rule because of the numerous comments that were received as a result of NPRM 95-18. On April 26, 2001, the Safety Board indicated that it was frustrated by the FAA’s lack of progress concerning this safety issue. The Board stated that, in the 5 years since the issuance of NPRM 95-18 and the 1 1/2 years since the need for a supplemental NPRM was first communicated, the FAA has not taken action. The Board urged the FAA to expeditiously complete action to develop and implement flight and duty regulations. Pending the issuance of the supplemental NPRM and expeditious action to implement a final rule, Safety Recommendation A-99-45 was classified “Open—Unacceptable Response.” 1.18.6.2 Additional Fatigue Information On April 28, 2000, a fatigue researcher from the University of Pennsylvania School of Medicine was interviewed as part of the investigation of the flight 1420 accident.164 The researcher stated that the term “fatigue” generally refers to an individual’s 164 The fatigue researcher is a Professor of Psychology in the Department of Psychiatry and the Chief of the Division of Sleep and Chronobiology at University of Pennsylvania School of Medicine. He also directs the Unit for Experimental Psychology, a laboratory that conducts research studies related to alertness and performance capabilities in individuals who work long or unusual hours.

Factual Information 106 Aircraft Accident Report difficulty maintaining a certain level of performance as a function of time. The researcher described how fatigue could affect human performance. For example, individuals who are fatigued tend to have decreased vigilance in tasks that require monitoring or detecting signals and increased short-term and working memory errors. Also, individuals who are fatigued tend to keep trying one specific solution to a situation even if it no longer works, take more risks (that is, cut corners and accept lower standards), and pay less attention or not be aware of peripheral events. The fatigue researcher reviewed factual documents related to the flight 1420 accident. He stated that, because the accident happened a couple of hours after the captain’s usual bedtime, his circadian system was already in a downward phase. The professor indicated that the captain could have been feeling “pretty good” and “alert” when he left Dallas but that he could have experienced “an increased physiologic fatigue level” as he began to approach Little Rock. The researcher further indicated that the captain’s total time awake (over 16 hours) might have made him more vulnerable to making errors. In addition, he stated that the captain’s prolonged wakefulness and the time of the accident (compared with his usual bedtime) made it “highly likely” that the captain was fatigued at the time of the crash. 1.18.7 Other Previous Related Accidents 1.18.7.1 Accidents Involving Rescue Efforts The Safety Board has investigated or learned of accidents in which the survival of airplane occupants was aided by or was dependent on the ability of rescue personnel to enter an airplane to perform interior firefighting or remove a person to safety.165 A brief discussion of three such accidents follows. British Airtours Charter Flight, Manchester, England, August 22, 1985 On August 22, 1985, a British Airtours charter Boeing 737-226, G-BGJL, was taking off from Manchester International Airport, England, when an uncontained failure in the left engine occurred.166 The wing fuel tank was punctured, which led to a fuel-fed fire. The flight crew abandoned the takeoff immediately and ordered the evacuation of the passengers through the exits on the right side of the airplane. By the time the airplane had come to a stop, fire had penetrated the hull, and smoke had entered the cabin. Of the 6 crewmembers and 131 passengers aboard the airplane, 55 were killed, 15 were 165 The Safety Board had previously commented on the need for additional ARFF resources. Specifically, in an August 1996 letter to the FAA, the Board commented on its review of the FAA’s draft report, Aircraft Rescue and Firefighting Services—Mission Response Study. The Board stated that the mission set forth in 14 CFR Part 139 for ARFF personnel to “provide an escape path from a burning airplane” was no longer sufficient and that it supported a broader mission in which adequate ARFF resources would be available “to rapidly extinguish interior fires and extricate aircraft occupants from such interior fires.” 166 For more information, see Air Accidents Investigation Branch. Report on the Accident to Boeing 737-236 Series 1, G-BGJL, at Manchester International Airport on 22 August 1985, Aircraft Accident Report 8/88. Farnborough, England.

Factual Information 107 Aircraft Accident Report seriously injured, and 67 received minor injuries or were not injured. The airplane was destroyed. About 5 1/2 minutes after the airplane had stopped, a 14-year-old boy was pulled out of the right overwing exit by a firefighter. He was the last evacuee to survive the accident. Horizon Air Flight 2638, Seattle, Washington, April 15, 1988 On April 15, 1988, Horizon Air flight 2638, a DeHavilland DHC-8, N819PH, had departed from Seattle-Tacoma International Airport when the right engine lost power.167 The flight crew decided to return to the airport for a precautionary landing. As the landing gear was lowered, a fire broke out in the right engine nacelle. The engine was then shut down. After the airplane landed, almost all of the directional control and braking capability had been lost. The airplane departed the paved surface of the runway and struck several objects on a paved ramp area. Of the 40 airplane occupants, 4 received serious injuries, and 36 received minor or no injuries. The airplane was destroyed by the fire and impact. Firefighters entered the cabin and extricated two passengers who were trapped by wreckage—one of whom had a lacerated aorta—and assisted other airplane occupants, including the captain and the first officer, off the airplane. The Safety Board determined that the firefighters’ rescue of the passenger with a lacerated aorta (which occurred before the fire was extinguished) was “instrumental” in saving his life. USAir Flight 1493/Skywest Flight 5569, Los Angeles, California, February 1, 1991 On February 1, 1991, USAir flight 1493, a Boeing 737-300, N388US, and Skywest Flight 5569, a Fairchild Metroliner SA-227-AC, N683AV, collided on runway 24L at Los Angeles International Airport, California.168 The USAir airplane was landing, and the Skywest airplane was positioned on the same runway awaiting clearance for takeoff. There was an explosion and fire upon impact, and the two airplanes slid into an unoccupied fire station. Of the 95 airplane occupants aboard the USAir airplane, 22 were killed, 13 were seriously injured, 15 received minor injuries, and 37 were uninjured. All of the 12 occupants aboard the Skywest airplane were killed. Both airplanes were destroyed by impact forces and postcrash fire. Firefighters assisted some passengers in evacuating the 737. One of the firefighters removed the first officer from the wreckage and, with the help of another firefighter, moved him to a safe area. Also, firefighters brought hand lines into the airplane, including one firefighter who brought a hand line to the cockpit to protect the captain from fire (he was pinned in the wreckage and appeared lifeless).169 The firefighters 167 For more information, see National Transportation Safety Board. Horizon Air, Inc., DeHavilland DHC-8, Seattle-Tacoma International Airport, Seattle, Washington, April 15, 1988. Aircraft Accident Report NTSB/AAR/89-02. Washington, DC. 168 For more information, see National Transportation Safety Board. Runway Collision of USAir Flight 1493, Boeing 737, and Skywest Flight 5569, Fairchild Metroliner, Los Angeles International Airport, Los Angeles, California, February 1, 1991. Aircraft Accident Report NTSB/AAR/91-08. Washington, DC. 169 The first officer survived the accident. The captain died as a result of traumatic injury to the head.

Factual Information 108 Aircraft Accident Report remained in the cabin until the interior fire was extinguished. The Safety Board’s final report stated that “the rapid availability of adequate numbers of ARFF-trained firefighters…allowed ARFF personnel to implement an interior fire attack immediately.” 1.18.7.2 Accidents Involving Delayed Emergency Response The Safety Board has investigated accidents in which the emergency response was delayed because the crash was not detected or the wreckage was not located in a timely manner. A brief discussion of three such accidents follows. Northwest Airlines Flights 1482 and 299, Detroit, Michigan, December 3, 1990 On December 3, 1990, Northwest Airlines flight 1482, a Douglas DC-9-14, N3313L, and Northwest flight 299, a 727, N278US, collided near the intersection of two runways in dense fog at Detroit Metropolitan/Wayne County Airport, Romulus, Michigan.170 Of the 40 passengers and 4 crewmembers aboard the DC-9, 8 were killed, 10 received serious injuries, and 26 received minor or no injuries. None of the 146 passengers and 8 crewmembers aboard the 727 were injured. The DC-9 was destroyed, and the 727 was substantially damaged. In its final report on the accident, the Safety Board stated that the low visibility and the lack of immediate, accurate location information available in the control tower resulted in the fire department being unable to locate the DC-9 until about 5 minutes after the collision. In addition, by the time the first ARFF vehicle reached the DC-9, its cabin was fully involved with fire. That ARFF vehicle, however, had no heavy fire-fighting equipment, so the driver had to radio the other units (which were responding to the 727) and request that they respond to the DC-9. USAir Flight 1016, Charlotte, North Carolina, July 2, 1994 In the July 2, 1994, USAir flight 1016 accident in Charlotte, North Carolina, (previously discussed in section 1.18.5), the control tower’s initial notification to the ARFF station was made about 2 minutes after the accident occurred. The initial notification, however, did not identify any specific location of the downed airplane because of the restricted visibility conditions. The fire trucks began to traverse the airport, in heavy rain, searching for the airplane. The controller then saw a large area of smoke and described the location to the ARFF units. The first ARFF unit arrived at the accident scene about 8 minutes after the accident. 170 For more information, see National Transportation Safety Board. 1991. Runway Incursion and Collision, Northwest Airlines, Inc., Flights 1482 and 299, Detroit Metropolitan/Wayne County Airport, Romulus, Michigan, December 3, 1990. Aircraft Accident Report NTSB/AAR/91-05. Washington, DC.

Factual Information 109 Aircraft Accident Report American Airlines Flight 1340, Chicago, Illinois, February 9, 1998 On February 9, 1998, American Airlines flight 1340, a Boeing 727-223, N845AA, crashed 180 feet short of the runway 14R threshold at Chicago O’Hare International Airport.171 During the ground impact sequence, the main landing gear and aft air stairs separated from the airplane, and the nose gear folded back into the avionics compartment. The airplane came to rest on its fuselage 2,245 feet from the initial impact point. Of the 3 flight crewmembers, 3 flight attendants, and 116 passengers aboard the airplane, 1 flight attendant and 22 passengers received minor injuries. The airplane received substantial damage. A City of Chicago Department of Aviation vehicle radioed the control tower about 5 minutes after the accident had occurred, informing the local controller that an airplane was down and that debris was on the runway. Until that point, the controller was not aware that flight 1340 had crashed.172 Fire department personnel arrived at the accident scene 2 minutes after receiving notification, which was about 7 minutes after the accident. 1.18.8 Other Previous Related Safety Recommendations 1.18.8.1 Aircraft Operations in the Airport Environment A-94-211 On April 27, 1994, Action Air Charters flight 990, a Piper PA-31-350 Navajo Chieftain, N990RA, crashed into a blast fence at the end of runway 6 at Sikorsky Memorial Airport, Stratford, Connecticut.173 Nine airplane occupants were killed, and one was seriously injured.174 The airplane was destroyed by impact forces and a postcrash fire. As a result of this accident, the Safety Board issued Safety Recommendation A-94-211 on December 13, 1994, which asked the FAA to Inspect all 14 CFR Part 139 certificated airports for adequate runway safety areas and nonfrangible objects, such as blast fences, and require that substandard 171 The description for this accident, DCA98MA023, can be found on the Safety Board’s Web site at http://www.ntsb.gov. 172 Before he became aware of the crash, the controller had been clearing arriving aircraft for landing on the same runway. One airplane had completed a landing with the debris on the runway, and a second airplane had touched down momentarily on the runway while executing a go-around maneuver. 173 National Transportation Safety Board. 1994. Impact With Blast Fence Upon Landing Rollout, Action Air Charters Flight 990, Piper PA-31-350, N990RA, Stratford, Connecticut, April 27, 1994. Aircraft Accident Report NTSB/AAR-94/08. Washington, DC. 174 The blast fence was located 342 feet northeast of the runway 24 displaced threshold. The departure end of runway 6 (the approach end of runway 24) had no runway safety area. This runway was exempt from the standards in the FAA’s June 5, 1991, version of AC 150/5300-13 (see section 1.10.1); otherwise, a runway safety area of 800 feet would have been required. In its final report on this accident, the Safety Board concluded that the destruction of the airplane and the resulting occupant injuries were a direct result of the airplane’s collision with the blast fence but that the crash forces resulting from the collision were survivable (the nine fatalities resulted from smoke inhalation and/or thermal injuries).

Factual Information 110 Aircraft Accident Report runway safety areas be upgraded to AC 150/5300-13 minimum standards wherever possible. On October 15, 1997, the FAA indicated that it had conducted a study and found that 58 percent of the runways at 14 CFR Part 139 certificated airports have runway safety areas that meet this standard, 25 percent have safety areas that do not meet the standard but could with feasible improvements, and 17 percent have safety areas that could not be feasibly improved to meet the standard. The FAA stated that runway safety area improvement projects would be scheduled as part of overall runway improvement projects because of the associated cost and infrequency of aircraft overruns and undershoots. On February 10, 1999, the Safety Board classified Safety Recommendation A-94-211 “Closed—Unacceptable Action” because runway safety area upgrades might be delayed by many years, allowing nonstandard conditions to continue. A-84-36 The Safety Board conducted a special investigation in response to three accidents in 1982 that involved long-standing concerns regarding the safety of aircraft operations in the airport environment.175 On April 16, 1984, the Board issued Safety Recommendation A-84-36, which asked the FAA to Initiate research and development activities to establish the feasibility of submerged low-impact resistance support structures for airport facilities and promulgate a design standard if such structures are found to be practical. On October 30, 1996, the FAA stated that it and the National Institute of Standards and Technology studied the feasibility of submerged low-impact structures and concluded that, with the technology currently available, any structure deemed frangible would most likely be destroyed by wave motion produced by small storms. On the basis of the FAA’s actions, the Safety Board classified Safety Recommendation A-84-36 “Closed—Acceptable Action” on December 20, 1996. 1.18.8.2 Stabilized Approach Guidance A-97-85 On October 19, 1996, Delta Air Lines flight 554, an MD-88, N914DL, struck the approach lighting structure at the end of the runway deck during an approach to runway 13 at LaGuardia Airport, Flushing New York.176 The 2 flight crewmembers, the 3 flight attendants, and 55 passengers were not injured; 3 passengers received minor injuries. The airplane was substantially damaged. In its final report on this accident, the Safety Board 175 These accidents were Air Florida flight 90 near Washington National Airport, January 13, 1982; World Airways flight 30H at Boston Logan International Airport, January 23, 1982; and Pan American World Airways flight 759 near New Orleans International Airport, July 9, 1982. 176 National Transportation Safety Board. 1997. Descent Below Visual Glidepath and Collision With Terrain, Delta Air Lines Flight 554, McDonnell Douglas MD-88, N914DL, LaGuardia Airport, New York, October 19, 1996. Aircraft Accident Report NTSB/AAR-97/03. Washington, DC.

Factual Information 111 Aircraft Accident Report stated that Delta’s manuals did not specify operational criteria for a stabilized approach or contain procedural guidance for pilots to follow if an approach became unstabilized. The Board concluded that the lack of guidance on the stabilized approach concept did not contribute to the accident. However, the Board was concerned that, if Delta’s manuals at the time of the accident contained inadequate information on stabilized approaches, other air carriers’ guidance might also be inadequate. As a result, the Board issued Safety Recommendation A-97-85, which asked the FAA to Require all 14 CFR Part 121 and 135 operators to review and revise their company operations manuals to more clearly delineate flight crewmember (pilot flying/pilot not flying) duties and responsibilities for various phases of flight and more clearly define terms that are critical for safety-of-flight decision-making, such as “stabilized approach.” On June 26, 1998, the FAA stated that it issued Flight Standards Handbook Bulletin for Air Transportation 98-22, “Stabilized Approaches,” on May 26, 1998. The bulletin directed 14 CFR Part 121 and 135 POIs to review operators’ training and operations manuals to ensure that the stabilized approach concept was addressed. The POIs were also to ensure that the manuals contained the minimum requirements for a stabilized approach, the immediate actions that needed to be taken if the stabilized approach conditions were not met, and the flying and nonflying pilots’ responsibilities during the approach phase of flight. On the basis of the FAA’s actions, the Safety Board classified Safety Recommendation A-97-85 “Closed—Acceptable Action” on November 20, 1998. 1.18.8.3 Manufacturer’s Operating Information A-98-102 On January 9, 1997, Comair flight 3272, an Embraer EMB-120RT, N265CA, crashed during a rapid descent after an uncommanded roll excursion near Monroe, Michigan.177 The 2 flight crewmembers, 1 flight attendant, and 26 passengers were killed, and the airplane was destroyed by impact forces and a postcrash fire. In its investigation of this accident, the Safety Board concluded that the FAA’s policy of allowing air carriers to elect not to adopt airplane flight manual operational procedures without clear written justification could result in air carriers using procedures that may not reflect the safest operating practices. As a result, the Board issued Safety Recommendation A-98-102, which asked the FAA to Require air carriers to adopt the operating procedures contained in the manufacturer’s airplane flight manual and subsequent approved revisions or provide written justification that an equivalent safety level results from an alternate procedure. 177 National Transportation Safety Board. 1998. In-flight Icing Encounter and Uncontrolled Collision With Terrain, Comair Flight 3272, Embraer EMB-120RT, N265CA, Monroe, Michigan, January 9,

1. Aircraft Accident Report NTSB/AAR-98/04. Washington, DC.

Factual Information 112 Aircraft Accident Report On September 16, 1999, the FAA stated that, on May 28, 1999, it issued Joint Flight Standards Handbook Bulletin for Air Transportation, Airworthiness, and General Aviation, Flight Standards Policy—Company Operating Manuals and Company Training Program Revisions for Compliance. According to the FAA, the bulletin directed that POIs encourage their operators to have a reliable delivery system in place for flight manual revisions, which ensures that the operators receive the revisions within 30 calendar days of approval, and develop an action plan to notify, in writing, respective POIs of new flight manual revisions within 15 days after receipt. The FAA also stated that it was considering a regulatory change that would require the bulletin’s safety policy to be mandatory. On April 11, 2000, the Safety Board noted that the bulletin, although not regulatory in nature, was a positive step toward meeting the goals of the recommendation. On July 7, 2000, the FAA stated that it had initiated an NPRM proposing to revise 14 CFR Part 121, Subparts N and O, and that the policy included in the handbook bulletin would be reflected in the NPRM. On January 12, 2001, the Board acknowledged the FAA’s actions and stated that, pending the issuance of the NPRM and the implementation of the proposed regulation, Safety Recommendation A-98-102 was classified “Open—Acceptable Response.” On August 2, 2001, the FAA stated that it was continuing to develop the NPRM.

113 Aircraft Accident Report 2. Analysis 2.1 General The captain and the first officer of American Airlines flight 1420 were properly certificated and qualified under Federal and company requirements. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. The accident airplane was properly certified, equipped, and maintained in accordance with Federal regulations and approved company procedures. No evidence indicated preexisting engine, system, or structural failures. This analysis focuses primarily on the flight crew’s performance and the airplane’s spoiler system. The flight crew’s performance on approach to the airport is examined during three segments of the approach and in the context of the weather information and cues that were available. The flight crew’s and the airplane’s performance during the landing and overrun sequences are also examined. The analysis also addresses the roles of situational stress and fatigue in the accident sequence; meteorological support, including ATC services; emergency response efforts; airport issues; and American and FAA oversight. 2.2 Accident Scenario 2.2.1 The Approach The flight crew had multiple sources of information indicating that thunderstorms might become a factor during the approach. The preflight weather package (discussed in section 1.7.3) included two NWS weather advisories for severe thunderstorms and a company SIGMEC [significant meteorological condition] for a widely scattered area of thunderstorms along the planned route. Also, the dispatcher’s 2254 message via the aircraft communication addressing and reporting system informed the crew of the lines of thunderstorms to the left and right of the planned route and suggested that the crew expedite the arrival to the airport “to beat the thunderstorms.” In addition, NWS Convective SIGMET [significant meteorological information] 15C, received about 2304, warned of a line of severe thunderstorms moving southeast through Arkansas with hail up to 2 inches in diameter and the possibility of wind gusts to 70 knots. Finally, automatic terminal information service (ATIS) information Romeo, which was current beginning about 2326, indicated that a thunderstorm with frequent lightning was located west through northwest of the airport and moving northeast.

Analysis 114 Aircraft Accident Report The flight crewmembers also had weather information from the airborne weather radar and their view outside the cockpit. Statements from the CVR indicated that the flight crew had discussed the weather and the need to expedite the approach. For example, at 2325:47, the captain said, “we got to get over there quick.” The first officer then stated, “I don’t like that...that’s lightning,” to which the captain replied, “sure is.” At 2328:30, the captain repeated, “we gotta get there quick.” At 2329:55, the first officer stated, “I say we get down as soon as we can.” The CVR also indicated that the crew had the city of Little Rock and the airport area in sight by at 2326:59. Further, the CVR recorded the captain’s announcement to the passengers, beginning at 2327:31, that “quite a light show” was to the left of their course and that they would be passing the lightning on the way to Little Rock. 2.2.1.1 Descent Into the Terminal Area At 2334:11, the local controller told the flight crew, upon initial contact, that a thunderstorm located northwest of the airport was “moving through the area now” and that the winds were from 280º at 28 knots gusting to 44 knots. Even though the flight crewmembers had previously discussed the need to expedite the approach because of the weather, the CVR indicated that they had not discussed the possibility that the thunderstorm might reach the airport before the flight landed. In a postaccident interview, the first officer stated that, during the descent, the weather appeared to be about 15 miles away from the airport and that he and the captain thought that there was “some time” to make the approach. At 2339:12, the first officer told the controller, “that storm is moving this way like your radar says it is but a little bit farther off than you thought.” At that point, flight 1420 was about 11 miles south of the airport. Figure 18 shows a map of the weather conditions at 2339:12 and flight 1420’s location. After receiving the controller’s next wind report (330º at 11 knots), the first officer indicated that the winds were “a little bit better” than they had been earlier. Weather data obtained after the accident depicted the weather conditions in the area shortly before the time of the accident. For example, airport weather observation data showed that heavy rain—defined by the NWS as 0.03 inch of rain within 6 minutes—had begun falling at the airport by about 2338, 12 minutes before the accident. In addition, the National Lightning Detection Network detected 903 cloud-to-ground lightning strikes within 20 miles of the airport in the 15 minutes before the accident and 46 strikes within 5 miles of the airport in the 5 minutes before the accident; most of the strikes were located northeast, west, and southwest of the airport and along a line that was parallel to (and to the west of) flight 1420’s final approach path. American’s policy did not prohibit flight crews from continuing an approach with thunderstorms in the terminal area as long as the crews ensured that their intended route was clear of the thunderstorms. During the descent into the terminal area, there was no evidence to indicate that the route was not clear. In public hearing testimony, the first officer stated that, during the descent, the weather was to the left and moving off to the right and that the airport looked clear. Thus, the Safety Board concludes that, during the

Analysis 115 Aircraft Accident Report descent into the terminal area, the flight crewmembers could have reasonably believed that they could reach the airport before the thunderstorm. Figure 18. Weather and Flight Information for 2339:12 2.2.1.2 Maneuvering to the Airport for Final Approach The flight crewmembers had been previously told by the controller to expect an instrument landing system (ILS) approach to runway 22L. At 2339:45, the local controller broadcast the first of two windshear alerts, reporting that the centerfield wind was 340º at 10 knots.178 At this point, the airplane was about 8 miles from the airport. Afterward, the flight crew requested a change in runways from 22L to 4R because the winds had shifted to the northwest. The use of runway 22L could have resulted in a tailwind at the time of landing, so runway 4R was a more appropriate choice because of the expectation of a headwind. (NWS radar data indicated that the leading edge of a line of thunderstorms was over the airport at this time with the heaviest activity located northwest through northeast 5 miles from the runway.)179 Figure 19 shows a map of the weather conditions at 2339:45 and flight 1420’s location. 178 The windshear alert also indicated that the north boundary wind was 330º at 25 knots and that the northwest boundary wind was 010º at 15 knots. 179 The leading edge is one of the most hazardous areas in thunderstorms because of the updraft-downdraft interaction.

Analysis 116 Aircraft Accident Report Figure 19. Weather and Flight Information for 2339:45 The controller instructed the flight crew to turn right to a heading of 250º for vectors to the runway 4R approach course. The right turn, which routed the airplane away from the airport, was necessary because the airplane was only about 4 miles southeast of runway 4R/22L. However, the turn, and the subsequent maneuvering south of the airport, meant that the flight crew had temporarily lost its ability to use the airborne weather radar (because of its forward-looking design) to monitor the storm’s intensity and location relative to the airport. The flight crew would regain the use of the airborne weather radar to evaluate the storm and its location relative to the airport when the airplane turned back toward the airport to intercept the final approach course for runway 4R. However, until the airplane completed its base-to-final turn and leveled off, the radar data would have likely been difficult to interpret, especially for detecting features in the direction of the turn. (Thus, for about 7 minutes, the crew did not have precise information from the airborne weather radar about the location of the storm relative to the airport.) After the runway change from 22L to 4R, the CVR recorded the first officer performing an abbreviated briefing for the newly assigned runway.180 This briefing consisted of the localizer frequency and course, the minimum safe altitude, the missed approach procedure, and the decision altitude. Regarding the missed approach procedure, 180 Although American’s flight manual states that the captain is to ensure that a briefing is conducted before every approach, it does not contain any procedure for performing an abbreviated briefing for an instrument approach to a changed runway. The first officer stated in a postaccident interview that the captain conducted a formal briefing for runway 22L. The CVR recording did not include an approach briefing for runway 22L, but it is possible that the briefing occurred before the beginning of the recording at 2319:44.

Analysis 117 Aircraft Accident Report the CVR recorded the first officer’s statement, “missed approach right turn to four thousand,” followed immediately by an unintelligible comment. The Jeppesen approach plate for the airport indicated that the right turn at 4,000 feet was to be accomplished via a 110° heading. The Safety Board could not conclusively determine whether the first officer briefed that part of the missed approach procedure. However, the CVR contained no discussion between the flight crewmembers about the missed approach procedure in relation to the location of the storm, specifically, that the right turn would maneuver the airplane clear of the weather. The flight crew continued to receive, but did not discuss, wind reports from the controller. The flight crew’s actions and conversations during this phase of the approach largely consisted of steps to expedite the approach to the airport. For example, at 2342:40, the first officer asked the captain if he wanted to conduct a “short approach” and “keep it in tight.” The captain accepted the suggestion but with the qualification “if you see the runway, ‘cause I don’t quite see it.” (The airport was off the right, or first officer’s, side of the airplane.) The first officer began to radio the controller at 2342:54 to suggest a visual approach but interrupted this transmission 1 second later when he stated to the captain, “it’s going right over the…field.” In a postaccident interview, the first officer indicated that he was referring to a temporary obstruction of his view of the airport because of clouds. The first officer’s next transmission, 4 seconds later, informed the controller that “we got the airport” and that “we’re going between clouds.” Figure 20 shows a map of the weather conditions at 2342:55 and flight 1420’s location. Figure 20. Weather and Flight Information for 2342:55

Analysis 118 Aircraft Accident Report The controller offered the flight crew a visual approach to runway 4R, which the crew accepted. The CVR indicated that, during the attempted visual approach, the captain could not see the airport and was relying on the first officer to guide him toward the airport.181 The airplane’s position (that is, its orientation, proximity, and altitude) relative to the airport likely made visual contact with the airport environment difficult for the captain. At 2344:19, the captain stated, “see we’re losing it. I don’t think we can maintain visual.” The first officer notified the controller at 2344:30 that visual contact with the airport had been lost because of a cloud between the airplane and the airport. The controller then cleared the airplane to fly a heading of 220º for radar vectors for the ILS approach to runway 4R. (ATC radar indicated that, at this time, flight 1420 was about 6 miles south of runway 4R, heading westbound and away from the runway. Weather radar data indicated that heavy rain was occurring at the airport at the time that the airplane was flying on the 220° heading.) Figure 21 shows a map of the weather conditions at 2344:30 and flight 1420’s location. Figure 21. Weather and Flight Information for 2344:30 181 At 2343:26, the first officer said, “…there’s the airport right there. Okay?” Five seconds later, the captain asked, “where?” At 2343:31, the first officer said, “okay, you’re set up on a base for it. Okay?” to which the captain questioned, “I’m on a base now?” At 2343:35, the first officer said, “well, you’re on a dog leg. You’re comin’ in. There’s the airport.” Three seconds later, the captain said, “I lost it,” and the first officer said, “right there, you’re you’re downwind. See it’s right there.” The captain then said, “I still don’t see it...well just vector me. I don’t know.”

Analysis 119 Aircraft Accident Report The weather south of the airport became the next focus of the flight crew’s attention. NWS radar data indicated that, in the 6 minutes before the accident, a line of thunderstorms, with several large areas of intense and extreme activity, was encompassing the Little Rock airport area and runway 4R approach path. At 2345:47, the first officer told the controller “we’re getting pretty close to this storm. we’ll keep it tight if we have to.” The controller indicated to the flight crew that, “when you join the final, you’re going to be right at just a little bit outside the marker if that’s gonna be okay for ya.” The captain stated, “that’s great,” and the first officer told the controller, “that’s great with us.” Figure 22 shows a map of the weather conditions at 2345:47 and flight 1420’s location. Figure 22. Weather and Flight Information for 2345:47 The airplane was once again turned westbound, and the controller provided the flight crew with heading instructions to position the airplane to intercept the runway 4R final approach course. At 2346:39, the controller informed the flight crew that the airplane was 3 miles from the outer marker, instructed the crew to maintain 2,300 feet until the airplane was established on the localizer, and cleared the crew for the runway 4R ILS approach. In a postaccident interview, the first officer stated that, at this point, there was urgency to land because the weather was “up against” the airport. However, the first officer also stated that, after being vectored to the runway 4R ILS approach course, he had visual contact with the runway throughout the rest of the approach. At 2346:52, the controller advised the flight crew that heavy rain was falling at the airport, visibility was less than 1 mile, ATIS information Romeo was no longer current, and the runway visual range (RVR) was 3,000 feet. Simultaneously, the captain

Analysis 120 Aircraft Accident Report stated, “aw, we’re goin’ right into this.” Figure 23 shows a map of the weather conditions at 2346:52 and flight 1420’s location. About this point in the approach, the flight crew should have regained the use of the airborne weather radar to depict precipitation levels in front of the airplane. However, the Safety Board could not determine whether the radar was displaying this information or whether the flight crewmembers, given their workload, were able to perceive and interpret the information that the radar was providing. Figure 23. Weather and Flight Information for 2346:52 At 2347:08, the controller cleared flight 1420 to land and stated that the wind was 350º at 30 knots gusting to 45 knots. The CVR indicated that flight crew did not discuss the wind information, the heavy rain that was already falling at the airport, or the depiction of the weather on the airborne weather radar. Figure 24 shows a map of the weather conditions at 2347:08 and flight 1420’s location. Statements from the CVR and the first officer’s postaccident interviews indicated the flight crew’s concern about the location of the thunderstorm in relation to the airport and the airplane. However, the Safety Board concludes that, because the first officer was able to maintain visual contact with the runway as the airplane was vectored for the final approach course, both flight crewmembers might still have believed that flight 1420 could arrive at the airport before the thunderstorm. The Board understands that some other flight crews might continue an approach to a runway under the same circumstances. On the other hand, the Board also recognizes that the approaching storm and the reports of heavy rain, dropping visibility, and increasing crosswinds (from 10 to 30 knots with

Analysis 121 Aircraft Accident Report gusts to 45 knots) would be sufficient for some flight crews to hold until the storm passed or proceed to an alternate airport. Figure 24. Weather and Flight Information for 2347:08 2.2.1.3 Final Approach Segment The final approach segment began when the airplane intercepted the localizer, at 2347:16. Simultaneously, the first officer erroneously read back the controller’s previous wind report of 350º at 30 knots gusting to 45 knots as “zero three zero at four five.” The flight crew then discussed the effect of the previously reported RVR on the approach. The captain stated, “three thousand RVR. we can’t land on that.” The first officer then correctly told the captain that the approach required a 2,400-foot RVR, and the captain said, “ok, fine.” The CVR contained no discussion between the flight crew about the fact that the winds reported by the controller exceeded the company’s maximum crosswind component for wet runways and the prevailing RVR. According to American’s flight manual, the maximum crosswind component for a DC-9 landing on a runway with an RVR less than 4,000 feet was 15 knots. The latest winds reported by the controller resulted in a crosswind component of 23 knots for the steady-state wind and 34 knots for the gusting wind. Thus, the landing for runway 4R could no longer be conducted in accordance with company procedures. However, the flight crew likely did not recognize that an operational criterion for conducting the landing had been exceeded because the incorrect wind information read back by the first officer (030º at 45 knots) would have resulted in a crosswind component under 10 knots.

Analysis 122 Aircraft Accident Report The CVR recorded the captain commanding the landing gear down at 2347:44. According to American’s procedures, this callout indicated that the second half of the Before Landing checklist—landing gear, spoiler lever, autobrakes, flaps and slats, and annunciator lights—was to be accomplished using a mechanical checklist in the cockpit (see section 1.17.3.2). The CVR recorded the sound of the landing gear being operated 2 seconds after the callout and the captain’s statement “and lights, please” 5 seconds after the callout. The CVR indicated that, at this point in the approach, none of the remaining checklist items had been performed. At 2347:53, the controller provided the flight crew with the second of the two windshear alerts, stating that the centerfield wind was 350º at 32 knots with gusts to 45 knots.182 The captain then indicated that he wanted 20 knots added to the approach speed.183 There was no further discussion of the winds, which still exceeded American’s maximum crosswind limitations for landing.184 (NWS and ATC radar data indicated that, about this time, flight 1420 was on the leading edge of a line of thunderstorms.) The Safety Board concludes that, when the second windshear alert was received, the flight crew should have recognized that the approach to runway 4R should not continue because the maximum crosswind component for conducting the landing had been exceeded. Additionally, the flight crew should have recognized an apparent wind shift of 40° (a change from the mistaken 030º read back to the current 350º wind direction). This apparent wind shift should have given the flight crew the impression of an acutely changing weather situation, yet no related discussion was recorded on the CVR. At 2348:12, the controller informed the flight crew that the RVR was 1,600 feet. This RVR reading further reduced the company’s maximum crosswind component for landing to 10 knots, which was required when an RVR was less than 1,800 feet. However, the CVR still contained no discussion between the flight crew about the exceeded maximum crosswind component. During public hearing testimony, the first officer stated that he was still able to see the airport and that the RVR information provided by the controller “did not concur” with what he and the captain were seeing. Because the maximum crosswind component had been exceeded, the landing on runway 4R would no longer be conducted in accordance with company procedures. However, the Federal Aviation Regulations did not prohibit the approach to the runway from continuing, even with weather that was below published minimums. Specifically, 14 CFR 121.651 (and American’s flight manual) allowed the crew to continue to the decision height (200 feet afl, or 460 feet msl) because the airplane was already established on its final approach segment. After hearing that the runway 4R RVR had decreased to 1,600 feet, the captain stated, “well we’re established on the final,” and the 182 The windshear alert also indicated that the north boundary wind was 310º at 29 knots and that the northeast boundary wind was 320º at 32 knots. 183 The former MD-80 Fleet Manager stated at the public hearing that, if a flight crew decided to continue an approach after receiving an LLWAS alert, he would expect the pilots to increase speed. 184 In a postaccident interview, the first officer indicated that neither he nor the captain had checked the crosswind limitation in the flight manual. The first officer also indicated that he had started to look at his flight manual but that the captain had signaled him to put the manual away.

Analysis 123 Aircraft Accident Report first officer informed the controller that the airplane was “established inbound.” The controller then cleared the flight crew to land and provided updated winds. At this point in the approach, there were cues (for example, the heavy rain that was previously reported by the controller, the rapidly decreasing RVR, and the shifting and gusting winds) that the weather at and around the airport had deteriorated substantially. However, the CVR contained no discussion between the flight crewmembers about whether the approach should continue. In the Safety Board’s judgment, the deteriorating weather conditions would have prompted some flight crews to abort the approach. The CVR recorded the first officer’s required announcement of the 1,000-foot altitude at 2348:50. At 2349:02, the first officer recognized that the final landing flap configuration had not been established and asked the captain whether he wanted landing flaps. The captain indicated that he thought he had already called for the landing flaps,185 after which the first officer stated “forty now” and “forty forty land” to verify the flap/slat handle position, the flaps position indicator, and the illumination of the SLAT/LAND light. American’s DC-9 Operating Manual stated that landing flaps are to be selected by 1,000 feet afl. The first officer indicated in a postaccident interview that he thought the airplane was about 900 feet afl when he selected the 40º final flap setting for landing, which was consistent with calculations based on FDR data. The CVR did not indicate any other Before Landing checklist callouts. At 2349:10, the controller indicated that the winds were 330º at 28 knots. About 2 seconds later, the captain stated, “…this is a can of worms.” FDR data indicated that the airplane was about 1,140 feet msl (880 feet afl) at this time and that the captain was making active control inputs to keep the airplane on the localizer and glideslope. Also, the FDR data showing fluctuating airspeed (±5 knots, with one excursion to +8 knots and one to –10 knots) and vertical acceleration (±0.2 G with occasional excursions to ±0.25 G)186 were consistent with the presence of gusty and turbulent winds. Figure 25 shows a map of the weather conditions at 2349:12 and flight 1420’s location. The first officer called the runway in sight at 2349:24, and the captain identified the runway about 7 seconds later. FDR data indicated that, at the time that the first officer called the runway in sight, the airplane’s altitude was about 990 feet msl (730 feet afl), airspeed was 160 knots, glideslope deviation was 0.3 dot high, and localizer deviation was less than 0.1 dot to the left. FDR data also indicated that, at the time that the captain identified the runway, the airplane’s altitude was 940 feet msl (680 feet afl), airspeed was 158 knots, glideslope deviation was 0.6 dot high, and localizer deviation was 0.1 dot to the left. At 2349:41, the CVR recorded a sound consistent with windshield wiper motion; the airplane’s altitude at this time was about 820 feet msl (560 feet afl). 185 The captain also did not call for flaps 28 earlier in the approach. The CVR indicated that, at 2348:03, the first officer had asked the captain, “flaps twenty eight?”. 186 G is a unit of measurement equivalent to the acceleration caused by the earth’s gravity (32.174 feet/sec2).

Analysis 124 Aircraft Accident Report Figure 25. Weather and Flight Information for 2349:12 The first officer made his required 500-foot altitude callout at 2349:46. About 10 seconds later, an unidentified voice in the cockpit stated, “…we’re off course.” One second later, the CVR recorded an unintelligible statement made by an unidentified voice in the cockpit. In a postaccident interview, the first officer indicated that, about this time, he said quietly “go around.” At 2350:00, the first officer stated, “we’re way off.” In a postaccident interview, the first officer indicated that he made this statement because the airplane was off the localizer and the right-side runway edge lights were drifting to his left. Calculations based on FDR data indicated that the airplane was about 477 feet msl (217 feet afl) and that the localizer deviation was between 0.9 and 1.0 dot to the right. As the airplane descended through the decision height (460 feet msl), the glideslope deviation was between 1.0 and 1.5 dots high and increasing. American’s DC-9 Operating Manual states that, on final approach, a callout will be made whenever either crewmember observes localizer displacement greater than 1/3 dot and/or glideslope displacement greater than 1/2 dot and that the other crewmember will acknowledge this deviation. FDR data indicated that the localizer and glideslope were both displaced in excess of these values, but the CVR contained no callout from either the captain or the first officer regarding the fact that the airplane was high on the glideslope and was to the right on the localizer. The first officer’s statement, “we’re way off,” at 2350:00 (apparently in reference to the localizer displacement) was not a proper callout according to company procedures because it did not specifically inform the captain which ILS component was “off” and by what amount.

Analysis 125 Aircraft Accident Report Although American’s DC-9 Operating Manual instructed pilots to call out if the glideslope or localizer was displaced, the guidance did not indicate what displacement amount would result in an unstabilized approach and require a missed approach. In postaccident interviews, the MD-80 Fleet Manager and several check airmen explained that captains had the discretion to determine the maximum acceptable deviation from the glideslope or the localizer. (The adequacy of American’s stabilized approach guidance is discussed in section 2.6.1.) In addition, FAA guidance on the stabilized approach concept in the Air Transportation Operations Inspector’s Handbook does not provide any specific criteria for a stabilized approach; the guidance instead states that “operators of turbojet aircraft must establish and use procedures which result in stabilized approaches” (see section 1.17.3.4).187 Thus, the Safety Board was not able to gauge whether the flight 1420 approach was considered unstabilized according to company procedures or FAA guidance. At 2350:02, the captain stated, “I can’t see it.” Calculations based on FDR data indicated that the airplane was between 5 and 20 feet above the decision height at that time. The Safety Board was not able to determine whether the captain’s comment referred to his loss of visual contact with the runway or with its environment. Figure 26 shows a map of the weather conditions at 2350:02 and flight 1420’s location. Figure 26. Weather and Flight Information for 2350:02 187 The Safety Board notes that the FAA’s guidance does provide general parameters and that American based its stabilized approach guidance on these parameters rather than specific ones.

Analysis 126 Aircraft Accident Report Title 14 CFR 121.651 (c)(3) and American’s DC-9 Operating Manual allow a pilot to continue an approach below the decision height if a visual reference for the intended runway is “distinctly visible and identifiable.” Such references include the approach lighting system; the runway threshold or its markings; and the runway, its markings, or its lights. At 2350:05, the captain stated, “I got it”; calculations based on FDR data indicated that the airplane was between 10 and 30 feet below the decision height at the time. However, the Safety Board could not determine whether the captain’s comment referred to the runway or to its environment and the altitude at which the captain regained visual contact. Further, the Board could not determine what altitude would have been displayed on the altimeters as the airplane descended below the decision height.188 At 2350:11, the first officer made his required 100-foot callout. The CVR then recorded the airplane’s GPWS announcement of the first of two sink rate alerts about 2350:13. FDR data indicated that the airplane was about 330 feet msl (70 feet afl) at the time. The second sink rate alert was recorded about 1 second later, and FDR data indicated that the airplane was about 310 feet msl (50 feet afl) at the time. These alerts indicated that the airplane’s air data computer system was computing rates of descent that exceeded predetermined thresholds. The first officer made his required 50-, 40-, 30-, 20-, and 10-foot callouts between about 2350:13 and 2350:18, and the captain continued the approach to a landing. 2.2.1.4 Summary of the Flight Crew’s Performance During the Approach As the flight crew was maneuvering the airplane for landing, there were events that, individually, might not necessitate aborting an approach: a runway change because of a shifting wind, a failed visual approach to the newly assigned runway, the temporary inability of the airborne weather radar to show the weather conditions at the airport because of the airplane’s direction of travel, the controller’s report of the second part of the thunderstorm moving through the airport area, and the acceptance of a short approach near the outer marker because of the airplane’s location in relation to the storm. However, these events, collectively, should have heightened the crewmembers’ awareness that they might not be able to safely continue the approach. Thus, it would have been appropriate for the flight crew to have discussed specific options (holding, diverting to one of the two alternate airports, or performing a missed approach after the airplane was established on the final approach segment) in the event that the weather would necessitate aborting the approach later.189 As the airplane intercepted the ILS final approach course for runway 4R, the flight crew entered an event-dependent, high workload phase of flight. Under normal 188 Flight 1420 received an altimeter setting of 29.86 inches of Hg. An altimeter with this setting and zero instrument error would display an altitude that was about 55 feet lower than the airplane’s actual altitude during the final approach segment. However, because the Federal Aviation Regulations (14 CFR Part 43, Appendix E) allow instrument error of up to ± 75 feet, the altimeters could have been reading up to 20 feet higher than the airplane’s actual altitude. 189 The Safety Board notes that the airplane would have had an adequate fuel supply for each of these options.

Analysis 127 Aircraft Accident Report conditions, tasks during this phase of flight include controlling and maneuvering the airplane, configuring the airplane to land, performing final landing checks, and evaluating the airplane’s performance relative to the landing criteria. In this case, the flight crew’s earlier decision to accept a short approach increased the crew’s already high workload by compressing the amount of time that was available to accomplish required tasks. In fact, the first officer highlighted this issue at the public hearing when he stated, “I remember around the time of making that base-to-final turn, how fast and compressed everything seemed to happen.” During the final approach, the flight crew had a significant amount of weather information that had to be simultaneously evaluated. This information included the controller’s previous report of heavy rain at the airport with visibility less than 1 mile, the second windshear alert,190 a rapidly decreasing RVR, and several wind reports. Under these circumstances, some flight crews would have decided to abandon the approach. The flight 1420 crew then poorly performed, and did not complete, the second half of the Before Landing checklist. Although the sound of the landing gear being operated was recorded by the CVR, there is no CVR evidence to indicate that the first officer verbalized this checklist item as “down, three green” as required, which would have indicated that all three landing gear systems were in the down and locked position. Also, the captain commanded the 40° final landing flap configuration only after being queried by the first officer. As previously stated, the captain did not realize that he had not yet called for the flaps; as a result, this checklist item was performed late. In addition, there is no CVR evidence to indicate that the first officer called out that the spoiler lever was armed, checked the annunciator lights, and completed the Before Landing checklist or that either pilot had armed the spoiler lever and considered the use of automatic rather than manual braking in light of the deteriorating weather conditions.191 As previously discussed, the flight crew should have initiated a go-around during the final approach segment when a specific operational criterion was not met, that is, when the company’s maximum crosswind component for conducting the landing was exceeded. The flight crewmembers’ failure to establish the final landing flap configuration before reaching 1,000 feet afl and their failure to maintain a normal rate of descent, under different circumstances, might not necessitate a go-around. However, the Safety Board concludes that, because of the flight crew’s failure to adequately prepare for the approach and the rapidly deteriorating weather conditions, the likelihood of safely completing the approach was decreasing, and the need to take a different course of action 190 Even though American’s flight manual indicated that windshear alerts were advisory, its DC-9 Operating Manual instructed pilots to avoid areas of known severe windshear and search for clues to indicate the presence of severe windshear. The operating manual indicated that such clues included thunderstorm and convective clouds, rain showers, and strong or gusty surface winds. All of these conditions were present at some point and to some degree during flight 1420’s approach to the airport. 191 The Safety Board notes that several events were competing for the first officer’s attention at the time that he was performing the Before Landing checklist, as detailed in section 2.2.1.3. The Board further notes that, even though the first officer did not verbalize that the Before Landing checklist had been completed, as required, the CVR indicated that he did verbalize (early in the approach) that the Descent checklist had been completed.

Analysis 128 Aircraft Accident Report was progressively increasing; as a result, the flight crew should have abandoned the approach. Factors that contributed to the flight crew’s performance during the accident flight are discussed in section 2.2.3. Finally, it is important to note that a microburst, with a peak wind gust of 76 knots and rainfall rates of 9 inches per hour, impacted the airport shortly after the flight 1420 accident and thus was not a factor. NWS radar data, however, detected that the microburst was over runway 4R at 2353:00. Thus, if flight 1420’s takeoff, en route flight, or approach to landing had been delayed by less than 2 minutes, the flight could have encountered the microburst on final approach. Microbursts can result in vertical and horizontal windshear that can be extremely hazardous to aircraft, especially at low altitudes, as demonstrated by the 1994 USAir flight 1016 accident in Charlotte, North Carolina, and the 1985 Delta Air Lines flight 191 accident in Dallas, Texas (see section 1.18.5). As a result, the Safety Board is concerned that the flight crew was operating in an environment that was conducive to microburst conditions.192 Section 2.2.3.1.1 presents an industry-wide recommendation to develop operational strategies and guidance to promote better flight crew decision-making regarding the penetration of severe convective activity. 2.2.2 The Landing Flight 1420 touched down on runway 4R at 2350:20 at a speed of 160 knots. The airplane touched down about 2,000 feet down the 7,200-foot runway, slightly to the right of the centerline and sliding to the right. According to calculations based on FDR data, the airplane was subjected to a 5-knot tailwind component upon touchdown and a 20- to 25-knot left-to-right crosswind component during the landing. The NWS’ Automated Surface Observing System (ASOS) weather data indicated that surface winds from 290° at 16 knots gusting to 22 knots were present about the time that flight 1420 touched down, but this information was not available to the flight crew or the controller because the system’s 2-minute wind data are not directly reported to the control tower. The controller’s final wind report to the flight crew (320º at 23 knots, which was transmitted 27 seconds before touchdown) would not have indicated the possibility of a tailwind component at touchdown. Although the 5-knot tailwind component was within the 10-knot limitation required by American’s flight manual and advised by Boeing in its MD-80 Flight Crew Operating Manual (FCOM), the Safety Board notes that the flight crew’s purpose in changing runways from 22L to 4R was to avoid a tailwind component. The 20- to 25-knot crosswind component, however, exceeded the 10-knot limitation required by American’s flight manual for a runway with an RVR of less than 1,800 feet. 192 The Safety Board notes that, during flight 1420’s final approach segment, the microburst was located northwest of the airport and that the missed approach procedure would have taken the airplane east of the airport.

Analysis 129 Aircraft Accident Report Flight 1420 departed the end of runway 4R sliding to the left, with its nose gear on the left edge of the runway and the main gear off the left edge of the runway, at a calculated speed of 97 knots. The airplane sustained no damage before its departure from the runway. The airplane likely collided with the runway 22L approach lighting system support structure at a calculated speed of about 83 knots. With the use of Boeing’s MD-80 Operational Landing Program, the Safety Board predicted that the accident airplane experienced a wet runway braking coefficient of at least 0.23 at 140 knots and 0.25 at 160 knots. Typical braking coefficients to indicate dynamic hydroplaning range from 0.02 to 0.04. Thus, flight 1420 experienced a maximum braking coefficient that was over six times greater than the maximum typical hydroplaning braking coefficient. Examination of the accident airplane’s hydraulic brake system and the lack of hydraulic fluid contamination on the runway indicated that the hydraulic brake system was most likely capable of functioning within operational parameters. Examination and testing of the airplane’s antiskid system and the lack of flat spots or reverted rubber on any main landing gear tire indicated that the antiskid system was most likely capable of functioning within operational parameters. The Safety Board’s examination of runway 4R determined that it was in good condition with normal or better-than-normal surface conditions for friction levels and counter-hydroplaning effectiveness. A senior research engineer from NASA’s Langley Research Center stated at the public hearing that runway 4R’s grooving was satisfactory but that its microtexture was above average and macrotexture was excellent. More importantly, the engineer stated that the runway’s ability to prevent hydroplaning and other braking problems was excellent. The Safety Board concludes that dynamic or reverted rubber hydroplaning did not occur during the accident airplane’s landing rollout. Flight 1420’s substantial drift angle while on the runway (as much as 16º both to the right and the left of the direction of travel) was evidence of a directional control problem. The Safety Board examined the lack of spoiler deployment upon touchdown, the use of reverse thrust greater than 1.3 engine pressure ratio (EPR), and the use of manual rather than automatic brakes and evaluated the role that each played in the flight crew’s inability to maintain directional control of the airplane on the runway and stop the airplane within the remaining available runway length (5,200 feet). 2.2.2.1 Lack of Spoiler Deployment The spoiler system aboard the accident airplane was reported to be operating properly by the previous flight crew. FDR data from the airplane’s previous landing showed that the left outboard and right inboard flight spoilers (the only two spoiler parameters recorded) deployed upon touchdown and remained fully deflected for about 33 seconds. Also, FDR data from the accident flight indicated that the flight spoilers extended symmetrically (in response to a pilot input using the spoiler handle) for about 55 seconds during the descent into Little Rock.

Analysis 130 Aircraft Accident Report After the accident, the ground and flight spoilers were found in the retracted position. FDR data showed that, other than a momentary deflection by the left outboard flight spoiler concurrent with a left aileron deflection, the spoilers did not deploy upon touchdown. FDR data also showed a momentary full deflection of the right inboard flight spoiler concurrent with a full right aileron roll input during the landing rollout. The spoiler movement recorded on the FDR indicated that the spoiler position sensors and the spoiler control and hydraulic systems were working properly before and during the landing rollout. 2.2.2.1.1 Autospoiler Arming As stated in section 2.2.1.3, autospoiler arming was one of the 10 items on the Before Landing mechanical checklist. According to American’s DC-9 Operating Manual procedures that were in effect at the time of the accident, the nonflying pilot was responsible for ensuring that each checklist item had been accomplished. For autospoiler arming, the nonflying pilot was to state “spoiler lever,” announce that the spoilers had been armed, and move the spoiler lever switch on the mechanical checklist. American’s DC-9 Operating Manual procedures, however, did not specify which pilot was responsible for physically arming the spoilers. The company’s June 25, 2001, party submission indicated that, for flight 1420, the first officer (the nonflying pilot) was responsible for arming the spoilers. According to postaccident interviews with company line pilots, instructors, and check airmen, American’s MD-80 pilots were instructed during simulator training that the nonflying pilot was to arm the spoilers. In contrast, the line pilots indicated that it was accepted practice for captains to arm the spoilers, regardless of whether they were the flying or nonflying pilot, because the spoiler handle is located on the forward left, or captain’s, side of the center pedestal.193 The Safety Board notes that, on February 23, 2000, American revised its procedures to state that the captain is always responsible for arming the spoilers. As the chief pilot at American’s Chicago base of operations, the captain was required to fly less frequently than line pilots. However, the captain had become a chief pilot only months before the accident and had flown 54 hours in the 90 days before the accident flight. Thus, it is likely that he was aware of the common practice during line operations for the captain, rather than the nonflying pilot, to arm the spoilers. However, as a check airman, the captain would have likely been ensuring during check rides that the nonflying pilot was arming the spoilers. 193 To arm the spoilers on the MD-80 series airplane, the handle must be grasped and squeezed while it is lifted up toward its full travel limit. The pilot in the left seat of the airplane can reach the handle without obstruction, but the pilot in the right seat of the airplane must reach in front of, or behind, the throttle levers (and possibly around the captain’s arm if his or her hand were on the throttle at the time) to manipulate the spoiler handle. A search of NASA’s Aviation Safety and Reporting System database using the terms “spoiler handle” and “spoiler arming” did not reveal any reports consistent with flight crews having difficulty arming the spoiler handle.

Analysis 131 Aircraft Accident Report The first officer for flight 1420 stated, in a postaccident interview, that he did not arm the spoilers because he thought that the captain had armed them. The first officer indicated that he had moved the switch on the mechanical checklist to indicate that the spoilers had been armed. However, the CVR did not indicate any mention of the first officer’s required “spoiler lever” callout or any verbal verification that the spoilers were armed.194 In addition, there were no sounds or other indications on the CVR that were consistent with the spoiler handle being armed. During postaccident examination, the spoiler handle appeared to be in the full aft position with the red ARM indicator stripe partially visible; however, the cockpit center pedestal showed deformation and displacement in the left downward direction as a result of the damage to the cockpit floor structure during the impact sequence. Teardown of the center pedestal revealed no significant marks on the spoiler handle or handle slot to indicate the handle’s position at impact. In addition, the teardown revealed that the autospoiler crank arm was found in its fully extended position and was positioned above the spoiler handle’s roller—the contact point against which the crank arm pushes to extend the handle during normal autospoiler extension. Teardown of the autospoiler actuator revealed that the actuator was in the fully extended (deployed) position, which was consistent with proper autospoiler operation with the autospoiler handle in the unarmed position. Thus, the spoiler handle was actually in the stowed position at impact but appeared to be in the fully extended position only because of impact damage. Further, testing of the primary components of the autospoiler system—the autospoiler actuator, the autospoiler switching unit, the ground spoiler control box, and the two ground nose oleo switches—revealed that all were capable of functioning properly. The CVR transcript identified the sound of two “thuds” similar to the sound of an airplane touching down on a runway along with a “squeak” sound at 2350:20.2, 2 seconds before the first officer stated, “we’re down.” Analysis of the CVR sound spectrum for the accident airplane indicated that the first “thud” was main landing gear touchdown and that the second “thud” was nose gear touchdown. Safety Board investigators determined that the squeak sound, which occurred in between the two “thud” sounds, was the autospoiler actuator operating. Because of the placement of the squeak sound, Board investigators further determined that the actuator was triggered at main landing gear touchdown by the wheel spin-up transducers. 194 There are straightforward visual cues to indicate the position of the spoiler handle to the flight crew (see section 1.6.2), and a visual assessment of the handle’s status can be made from either seat in the MD-80 cockpit. The pilot in the left seat has an unobstructed view of the entire length of the spoiler handle. As a result, no change in head or body position is required to visually assess the status of the handle. However, the pilot in the right seat of the airplane normally has a partially obstructed view of the spoiler handle. Obstructions in the normal field of view include the throttle handles, the thrust reverser levers, and the right hand of the pilot in the left seat. If the pilot in the right seat were to adjust his or her head position, an unobstructed view of the handle could be achieved to assess the status of the spoiler handle. A search of the Aviation Safety and Reporting System database using the terms “spoiler handle” and “spoiler arming” did not reveal any reports consistent with flight crew difficulty confirming the spoiler handle’s status on MD-80 series airplanes.

Analysis 132 Aircraft Accident Report The Safety Board compared the CVR sound spectrum for the accident airplane with those for other CVR recordings obtained during the Palm Springs incident and the flight and ground tests that were conducted as part of the investigations of this accident and the Palm Springs incident.195 According to the CVR sound spectrum study, the sound durations associated with the autospoiler actuator extension for the Little Rock and Palm Springs flights (0.08 and 0.06 second, respectively) were consistent with the ground test in which the spoiler handle was unarmed (0.06 second). The study also indicated that, for the two flight tests and two ground tests involving normal autospoiler operation (that is, when the spoiler handle was armed before touchdown and the spoilers fully deployed after touchdown), the sounds associated with the activation of the autospoiler actuator lasted at least two times longer for the flight and ground test airplane recordings (between 0.16 and 0.19 second) than the sounds for the Little Rock airplane recording. The ground tests conducted on the Palm Springs airplane also indicated that, when the left throttle was at least 1 3/8 inches above idle and the autospoiler actuator operated, the spoiler handle would fully extend (by means of the autospoiler actuator), be knocked down, and retract about 0.5 second later to the stowed position. Because the two spoiler positions—the left outboard and right inboard—are recorded alternately every 0.5 second with about 0.25 second in between recordings, it is likely that an autoretract event would be captured by an FDR. In fact, the ground test FDR captured all of the autoretract events, and the two spoiler autoretract events reported by American (see section 1.6.2.2) were captured on FDR data. However, no indication of an autoretract event was found on the flight 1420 FDR data. The CVR sound spectrum study, physical evidence, and testing and teardown results indicate that the autospoiler actuator on the flight 1420 airplane operated properly at touchdown and that the spoiler handle was in the unarmed position when the autospoiler actuator extended. Accordingly, the Safety Board concludes that the autospoiler system operated properly and that the spoilers did not automatically deploy because the spoiler handle was not armed by either pilot before landing. 2.2.2.1.2 Checklist Design Regarding Spoiler Arming At the time of the accident, American did not require spoiler arming to be a dual crewmember challenge and response checklist item. Dual callouts protect against the failure that one pilot would identify an item as complete before it has been accomplished or omitting an item entirely during a high workload phase of flight.196 The human factors principles of checklist design established by the FAA and incorporated in its publications are available to airlines and FAA inspectors. These 195 As discussed in section 1.16, the Little Rock accident and the February 16, 2000, Palm Springs incident were similar in that they both involved American Airlines MD-80 series airplanes that did not experience autospoiler extension at touchdown. 196 See U.S. Department of Transportation, Federal Aviation Administration. 1995. Human Performance Considerations in the Use and Design of Aircraft Checklists. Also see Degani, A., and Wiener, E.L. 1990. Human Factors of Flight-Deck Checklists: The Normal Checklist. National Aeronautics and Space Administration Contractor Report 177549.

Analysis 133 Aircraft Accident Report principles prescribe that checklist items affecting safety of flight should ensure that the proper levels of operational redundancy have been achieved. For example, many checklists require both flight crewmembers to positively confirm the status of flap settings before takeoff and gear position before touchdown. The Safety Board recognizes that MD-80 series airplanes can be dispatched with the autospoiler system inoperative; thus, the system is not considered to be an item that is critical to safety of flight. However, spoiler deployment after touchdown is crucial to optimal landing performance, and the autospoiler system, if installed and operative, is the most reliable and efficient way to engage the flight and ground spoilers during landing. The Safety Board notes that, on June 22, 2000, American revised its Before Landing checklist procedures, requiring both the flying and nonflying pilots to verify and respond that the spoilers have been armed. The Board acknowledges that American’s procedures now require dual crewmember confirmation of the spoiler arming checklist item but is concerned that other airplane operators may not include this requirement in their operating procedures. The Safety Board concludes that a high level of operational redundancy should exist to ensure that spoiler arming has been completed before landing. Therefore, the Safety Board believes that the FAA should require, for all 14 CFR Part 121 and 135 operators of airplanes equipped with automatic spoiler systems, dual crewmember confirmation before landing that the spoilers have been armed and that the FAA should verify that these operators include this procedure in their flight manuals, checklists, and training programs. 2.2.2.1.3 Manual Spoiler Deployment At the time of the accident, American’s DC-9 Operating Manual required both pilots to monitor the automatic deployment of the spoilers after touchdown. Pilots can verify that the spoilers have automatically deployed by the extensive movement of the handle to the extend position and the distinct “clanking” sound associated with the handle’s travel. No written procedure in any of American’s manuals required either pilot to announce the failure of the spoilers to automatically deploy. However, American’s DC-9 Operating Manual indicated that, if the spoilers failed to deploy automatically, the captain was responsible for manually extending them regardless of which pilot was making the landing. Even though American’s manuals did not require pilots to announce if the spoilers failed to automatically extend, the MD-80 Fleet Manager and several MD-80 check airmen stated, during postaccident interviews, that pilots were trained to make this announcement. (The adequacy of American’s spoiler system training at the time of the accident is discussed in section 2.6.2.) However, the CVR did not record any announcement by either pilot that the spoilers had failed to deploy automatically or any sounds that could be associated with an attempt to manually extend the spoilers. The Safety Board concludes that the flight crew failed to verify that the spoilers had automatically deployed after landing and that the captain failed to manually extend the spoilers when they did not deploy. As a result, the wings continued to support most of the airplane’s weight, and very little weight was transferred to the landing gear,

Analysis 134 Aircraft Accident Report preventing the main landing gear tires from developing the braking and cornering forces required to achieve expected deceleration and directional control performance. In the Little Rock accident, the pilots’ workload associated with attempting to maintain directional control of the airplane on the runway may have prevented them from detecting that the spoilers had not automatically deployed. The flight crew’s failure to detect that the spoilers had not deployed might have been avoided if a procedural requirement similar to the one in Boeing’s MD-80 FCOM had been in place at the time. According to the Boeing manual, the nonflying pilot should call out “no spoilers” if the spoiler lever does not move aft after touchdown, and the flying pilot should then move the lever aft to the full extend position and up to the latched position. American’s February 23, 2000, revision to its DC-9 Operating Manual incorporated a similar requirement. The Safety Board acknowledges American’s revision but is disappointed that this change and those related to spoiler arming (that is, the captain will always arm the spoilers and both crewmembers will confirm that the spoilers have been armed) were not put into effect until after the Palm Springs incident, which occurred more than 8 months after the Little Rock accident. The Safety Board is concerned that other air carriers may not require callouts regarding the status of the spoilers after touchdown. The Safety Board concludes that, because spoiler deployment is critical for optimal landing performance, procedures to ensure that the spoilers have deployed after touchdown should be a required part of all air carriers’ landing operations. Therefore, the Safety Board believes that the FAA should require, for all 14 CFR Part 121 and 135 operators, a callout if the spoilers do not automatically or manually deploy during landing and a callout when the spoilers have deployed and that the FAA should verify that these operators include these procedures in their flight manuals, checklists, and training programs. The procedures should clearly identify which pilot is responsible for making these callouts and which pilot is responsible for deploying the spoilers if they do not automatically or manually deploy. The Safety Board’s Airplane Performance Study demonstrated that spoiler deployment is critical to an airplane’s braking force. For example, when the spoilers on an MD-80 series airplane weighing 127,000 pounds and traveling at 140 knots are extended, about 65 percent of the airplane’s weight is supported by the main landing gear; when the spoilers are not extended, only about 15 percent of the airplane’s weight is supported by the main landing gear.197 In this accident, the light loading of the landing gear substantially reduced the effectiveness of the brakes and the ability of the gear to develop cornering loads to counter the aerodynamic side loads produced by the 197 These findings were consistent with information presented by the Boeing aerodynamics engineer at the public hearing for this accident regarding the spoilers’ effect on the weight applied to the wheels immediately after touchdown for an MD-80 series airplane with a similar landing weight as the accident airplane.

Analysis 135 Aircraft Accident Report crosswind.198 The Safety Board concludes that the lack of spoiler deployment led directly to the flight crew’s problems in stopping the airplane within the remaining available runway length and maintaining directional control of the airplane on the runway. Regarding the inability to stop an airplane within an available runway length, the lack of spoiler deployment is far more critical than the use of reverse thrust (discussed in section 2.2.2.2). 2.2.2.2 Use of Reverse Thrust Above 1.3 Engine Pressure Ratio American’s DC-9 Operating Manual indicated that, for landings on slippery runways, pilots were not to exceed 1.3 EPR on the “slippery portions of the runway” except in an emergency situation. Likewise, Boeing’s MD-80 FCOM indicated that reverse thrust of no more than 1.3 EPR should be used on wet or contaminated runways, except in an emergency. However, FDR evidence indicated that reverse thrust exceeded 1.3 EPR several times during flight 1420’s landing sequence.199 Further, American’s and Boeing’s maximum reverse thrust setting for landings on dry runways was 1.6 EPR, and FDR data showed that even this setting was exceeded many times during the landing. The CVR recorded the first officer’s statement “we’re sliding ” about 4 seconds after the airplane touched down on the runway. FDR data indicated that, about 1 1/2 seconds after this statement, 1.89 and 1.67 reverse EPR were being applied to the left and right engines, respectively. FDR data indicated that the thrust reversers were returned to the unlocked status as the airplane was continuing to slide.200 However, the thrust reversers were deployed again; the left engine reached a maximum setting of 1.98 reverse EPR, and the right engine reached a setting of 1.64 reverse EPR. The reversers were returned again to the unlocked status; as the right thrust reverser was moving to the unlocked status, the right engine reached a maximum setting of 1.74 reverse EPR. By this point, the captain was likely applying excessive reverse thrust because he perceived that the landing had become an emergency situation. 198 The effects of the light loading on the main landing gear may have been exacerbated by the position of the elevator surfaces during the landing roll. McDonnell Douglas’ 1996 all operators letter indicated that, when operating on wet or slippery runways, pilots should not apply an excessive amount of down elevator because it will unload the main gear and reduce braking efficiency. However, the left and right elevator surfaces were deflected full nose down between 2,800 and 5,000 feet beyond the runway 4R threshold. 199 The thrust reverser deployment recorded on the FDR when the airplane powered back from the gate during its departure from Dallas/Fort Worth to Little Rock indicated that the thrust reverser position sensors were working properly. 200 American’s DC-9 Operating Manual stated that, if an airplane begins to drift across the runway while reversing, pilots should immediately come out of reverse thrust to help regain directional control and restore rudder effectiveness.

Analysis 136 Aircraft Accident Report On the MD-80 series airplane, excessive reverse thrust can reduce or eliminate rudder and vertical stabilizer effectiveness.201 In fact, FDR data for the flight 1420 airplane were consistent with deteriorated rudder and vertical stabilizer performance because of the use of excessive reverse thrust.202 Specifically, at the time that the heading of the airplane was moving nose left from 1º to 3º per second despite substantial nose right rudder inputs, the thrust reversers were deployed. The left engine EPR reached values of 1.3 or greater almost continuously; the right engine EPR reached values of 1.3 or greater several times. The heading stopped moving left, and rudder effectiveness was restored, when the thrust reversers were briefly stowed. When reverse thrust was applied again, the airplane started to yaw left once more (the heading was moving left about 1.5º per second) despite full right rudder inputs. The airplane then reacted dramatically to the rudder inputs when the thrust reversers were stowed for the second time; the yaw rate reversed, and the heading started to move right up to 7º per second. The airplane was continuing to yaw to the right (the heading was increasing 4º per second) when it departed the left side of the runway; at that time, the left engine thrust reverser was deployed, but the engine’s EPR was at an idle power level. The Safety Board concludes that the use of reverse thrust at levels greater than 1.3 EPR significantly reduced the effectiveness of the airplane’s rudder and vertical stabilizer and resulted in further directional control problems on the runway. Postaccident observations of American’s MD-80 simulator training sessions revealed that the training focused on applying 1.6 EPR reverse thrust when landing. There was no discussion of the company’s procedures to limit reverse thrust to 1.3 EPR when landing on slippery runways, and pilots were observed exceeding 1.3 EPR when slippery runway conditions were presented. In fact, one of the simulator instructors initially taught that 1.6 EPR was acceptable for landing on a slippery runway unless a crosswind was present (see section 1.17.2.2). On February 23, 2000, American revised its DC-9 Operating Manual, indicating that, for all MD-80 landings, reverse thrust should not exceed 1.3 EPR unless stopping distance is in doubt. The Safety Board concludes that the maximum reverse thrust for MD-80 landings on wet or slippery runways should be 1.3 EPR, except when directional control can be sacrificed for a marginal increase in deceleration. Therefore, the Safety Board believes that the FAA should issue a flight standards information bulletin that requires the use of 1.3 EPR as the maximum reverse thrust power for MD-80 series airplanes under wet or slippery runway conditions, except in an emergency in which directional control can be 201American’s DC-9 Operating Manual stated that the rudder is almost “completely ineffective” at 1.6 EPR and a speed of 90 knots. McDonnell Douglas, in its 1996 all operators letter, warned that, as reverse thrust increases above approximately 1.3 EPR, rudder effectiveness continues to decrease and that, at a reverse thrust greater than approximately 1.6 EPR, the rudder provides little or no directional control. During the time that the accident airplane’s reverse thrust settings were 1.6 EPR and greater, the airplane was traveling down the runway at speeds greater than 90 to 100 knots. 202 Loss of directional control associated with high reverse thrust EPRs has been observed in other accidents involving DC-9 airplanes landing on wet or contaminated runways, including the March 5, 1997, American Airlines flight 320 accident in Cleveland, Ohio. The description for this accident, IAD97FA052, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

Analysis 137 Aircraft Accident Report sacrificed for decreased stopping distance. The Safety Board also believes that the FAA should require principal operations inspectors (POI) of all operators of MD-80 series airplanes to review and determine that these operators’ flight manuals and training programs contain information on the decrease in rudder effectiveness when reverse thrust power in excess of 1.3 EPR is applied. The Safety Board further believes that the FAA should require all operators of MD-80 series airplanes to require a callout if reverse thrust power exceeds the operators’ specific EPR settings. 2.2.2.3 Use of Manual Braking The preflight weather package (which contained weather information issued about 2205) indicated that the runways at Little Rock airport were wet with no measurable rain and no braking action reports. According to the CVR, the captain had decided, at 2331:24 (before establishing contact with the Little Rock tower), to use manual brakes. At that point in the approach, the flightpath was still free of convective activity. However, the CVR did not record any discussion between the pilots regarding whether the use of manual brakes for the landing was still prudent in light of the changing weather conditions on approach to the airport. The flight crewmembers had received a report from the controller that heavy rain was falling at the airport, so they should have been concerned that the runway would be slippery. The crewmembers had also received a report from the controller about a strong crosswind, so they should have been aware that significant rudder inputs could be required to maintain directional control of the airplane on the runway and that these inputs could take away from their ability to maximize manual braking. In addition, the flight crew recognized that runway 4R was considered a short runway for a DC-9 landing,203 so maximum efficiency of the brakes was critical. These conditions justified the use of autobrakes for the landing on runway 4R. In fact, Boeing’s procedures indicated that maximum autobrakes should be used for landing on a wet or slippery runway.204 According to FDR data, the initial application of manual brakes began about 5 seconds after touchdown, and full application of the manual brakes was not recorded until about 11 seconds after touchdown.205 These time intervals are not indicative of aggressive manual braking. The use of autobrakes requires either automatic or manual spoiler deployment at touchdown, which did not occur in this situation; therefore, autobrakes would not have helped decelerate the accident airplane. However, if the spoilers had deployed and the 203 In a postaccident interview, the first officer stated that the captain briefed 40° flaps for the landing because of the short runway. 204 As stated in section 1.17.4.3, American’s DC-9 Operating Manual stated that maximum autobrakes could be used on short or slippery runways but did not specify the type of braking that should be used on wet runways or during crosswind conditions. 205 As stated in section 1.17.4.3, American’s DC-9 Operating Manual stated that aggressive manual braking could be used on short or slippery runways. The manual further stated that, for manual brake stopping on short or slippery runways, the full brake pedal should be used immediately after nose gear touchdown.

Analysis 138 Aircraft Accident Report flight crew had selected maximum autobrakes for the landing, initial brake application could have occurred about 4 seconds sooner. On June 27, 2000, American issued a revision to its DC-9 Operating Manual, requiring the use of autobrakes for four specific circumstances: when a runway is less than 7,000 feet long; an RVR is less than 4,000 feet or visibility is less than 3/4 mile; a runway is contaminated with standing water, snow, slush, or ice; or braking conditions are reported to be “less than good.” Also, the revision recommended, but did not require, the use of autobrakes when landing with gusty winds or crosswinds. The Safety Board acknowledges that American has implemented specific criteria requiring the use of autobrakes but is concerned that the company still does not require autobrakes during landings with crosswinds. In the aviation industry, it is generally understood that landing during high crosswinds (that is, in excess of 10 knots) requires the pilot to make significant rudder pedal inputs to maintain directional control of the airplane. Because manual braking is accomplished by applying pressure to the upper portion of the rudder pedals, the Safety Board is concerned that a pilot who uses manual brakes during high crosswind conditions might not be able to immediately apply and maintain aggressive manual braking. In this accident, the captain likely did not apply full manual braking for 11 seconds because he was making significant rudder pedal inputs to keep the airplane on the runway. In fact, the first officer stated that he had to help the captain with his braking efforts as the airplane was nearing the end of the runway. FDR data showed that the left brake pedal was relaxed momentarily after full braking was achieved. However, this brake relaxation occurred while the airplane was drifting to the right (that is, its nose was pointed to the left of the direction of travel) and coincided with the application of full right rudder. Thus, the brake pedal relaxation may have been the result of the captain’s attempt to apply differential brakes to correct the airplane’s heading or his inability to maintain full braking while applying full right rudder. The use of automatic brakes is also important for airplanes landing on wet or slippery runways. Brakes decrease stopping distance most effectively when they are applied at a high speed. Any delay in brake application after touchdown results in a considerable increase in the required stopping distance because the highest speed during the ground roll (the most distance traveled per unit of time) occurs immediately after touchdown. An interruption in brake application at lower speeds is less critical because the airplane does not travel as far (that is, it does not consume as much runway) in the same time at low speed as it does at high speed. Because wet or slippery runway conditions degrade an airplane’s landing performance, fast brake application in these circumstances is critical. The Safety Board recognizes that airplane operators may not choose to require automatic braking because that type of braking, compared with manual braking, will wear out brakes faster and thus require brake replacement more often. The Board also recognizes that, during optimal landing situations, pilots can apply manual brakes more

Analysis 139 Aircraft Accident Report quickly than automatic brakes.206 However, during high workload landing situations that may require active or aggressive use of the rudder pedals, the use of automatic brakes provides pilots with a faster, more consistent means for stopping an airplane within the available runway length. The Safety Board concludes that automatic brake systems reduce pilot workload during landings in wet, slippery, or high crosswind conditions. Therefore, the Safety Board believes that the FAA should require, for all 14 CFR Part 121 and 135 operators, the use of automatic brakes, if available and operative, for landings during wet, slippery, or high crosswind conditions and that the FAA should verify that these operators include this procedure in their flight manuals, checklists, and training programs. 2.2.2.4 Summary of the Landing The airplane’s performance during the landing roll indicates that flight 1420 experienced many of the difficulties discussed in McDonnell Douglas’ February 1996 MD-80 all operators letter regarding landing operations on wet or slippery runways: greatly reduced reaction forces on the gear (because of the spoiler position), unloading of the main gear because of large nose-down elevator inputs, strong crosswinds, loss of vertical stabilizer and rudder effectiveness because of reverse thrust greater than 1.3 EPR, and a slight tailwind (see section 1.17.4.4.2). In addition, the airplane touched down about 2,000 feet down the 7,200-foot runway going 29 knots faster than the zero-wind touchdown ground speed that would result from an approach at the reference airspeed. The resulting ground trajectory of the airplane is consistent with the expected airplane performance, as determined from Boeing’s Operational Landing Program, and the operational experience outlined in the all operators letter. The Safety Board’s Airplane Performance Study indicated that the accident airplane could have stopped about 700 feet before the end of the runway if the spoilers had deployed, a constant symmetrical reverse thrust at 1.3 EPR had been maintained, and the flight 1420 manual braking profile had been applied. In contrast, with the spoilers not extended, the airplane could not have stopped within the remaining runway length even if maximum manual braking had been applied immediately after touchdown and symmetrical reverse thrust at 1.3 EPR had been maintained throughout the landing roll. Thus, the Safety Board concludes that the lack of spoiler deployment was the single most important factor in the flight crew’s inability to stop the accident airplane within the available runway length. 206 Boeing’s MD-80 FAA-approved Airplane Flight Manual, Appendix 5, “Automatic Brake System,” states that, because of the delay in automatic brake application and the conservative testing conditions that were used to construct the automatic brake landing distance data, stopping performance in the MAX setting does not achieve the same level of performance compared with manual braking. In addition, the manual states, “stopping distances are provided for guidance information only to assist in the selection of the most desirable setting.”

Analysis 140 Aircraft Accident Report 2.2.3 Human Factors During the accident flight, both crewmembers made basic errors in flight management and the completion of routine tasks, including required callouts.207 In addition, the flight crew did not appear to be effectively evaluating the weather cues that were available or considering their cumulative effect, specifically, that the thunderstorm had likely already arrived at the airport. The Safety Board recognizes that the flight crew was provided with only general, advisory information on severe weather avoidance rather than specific operational decision-making criteria regarding the penetration of convective activity (see section 2.3.1.1). However, the Safety Board concludes that the flight crewmembers’ performance during the accident flight was degraded, as evidenced by their operational errors and impaired decision-making. The flight crew’s degraded performance was inconsistent with the level of performance that would have been expected from both pilots, considering that the captain was a chief pilot and check airman and that the first officer, as a new hire, had been recently trained in American’s standards and procedures. Also, the flight crew’s performance deviated significantly from the positive statements that other pilots made about both pilots’ skills, abilities, and cockpit style. The captain was described in postaccident interviews as a conservative pilot who used common sense, demonstrated wisdom and experience, and was professional. The first officer was described in postaccident interviews as an above-average new hire who was very competent and knowledgeable and an experienced pilot with good cockpit discipline, and his probationary file contained favorable comments about his performance. In addition, the captain was appointed to the chief pilot position because he possessed good technical skills and leadership abilities. Factors that contributed to the flight crew’s degraded performance—situational stress and fatigue—are discussed in section 2.2.3.1 and 2.2.3.2, respectively. The pairing of the first officer, a new hire who was 5 months into his probationary year, with the captain, a chief pilot and check airman with over 10,000 flight hours (more than half of which were as an MD-80 captain), was evaluated and determined not to be a factor in the accident. Although it is possible that a probationary first officer might find speaking and challenging a captain who is a chief pilot to be difficult, CVR evidence indicated that this first officer was assertive during most of the flight for which CVR information was available. For example, the first officer initiated an abbreviated approach briefing after the change in runways and queried the captain when he failed to 207In addition to the callout errors discussed in section 2.2.1.3, the captain did not call out “Track— Track” when he had the initial movement of the localizer needle on his horizontal situation indicator, nor did he call out “Outer Marker” and the msl crossing altitude as the airplane crossed the outer marker beacon on the ILS approach course. Finally, he did not call out “Landing” before descending below the decision altitude, which would have confirmed that he had adequate visual reference with the runway. The first officer did not challenge the captain on these required Category I ILS callouts. Also, neither pilot made the required “radio altimeter alive” callout, and the first officer did not call out, as required, “decision altitude,” speed deviations of ±5 knots, and rates of descent exceeding 1,000 feet per minute.

Analysis 141 Aircraft Accident Report command the final landing flap configuration. Further, the first officer was instrumental in directing the captain to the airport during the attempted visual approach. 2.2.3.1 The Role of Situational Stress The presence of weather as a potential threat to the safety of flight and efforts to expedite the landing were stresses to the flight crew. Research has demonstrated that decision-making can be degraded when individuals are under stress because they selectively focus on only a subset of cues in the environment. As a result, any situation assessment may be incomplete, and the resulting decision, even when made by an expert, may be degraded. Stress can also impede an individual’s ability to evaluate an alternative course of action, resulting in a tendency to proceed with an original plan even though it may no longer be optimal. Research on decision-making has demonstrated a natural tendency for individuals to maintain their originally selected course of action until there is clear and overwhelming evidence that the course of action should be changed (see section 1.18.3.2). The CVR contained no evidence to indicate that the flight crew had reevaluated its original plan to expedite the landing because of the approaching weather. The actions taken by the flight crewmembers throughout the approach were consistent with their original plan. Despite several cues that indicated that the weather at the airport had deteriorated, neither crewmember discussed a need to initiate a go-around, enter a holding pattern, or divert to an alternate airport. The Safety Board also notes that any delay in landing would have further extended the pilots’ duty day, but there is no evidence to indicate that this factor affected the flight crew’s decision to continue the approach. The flight crewmembers’ intention to expedite the landing despite the weather diverted their attention away from other activities during the final minutes of the flight and, as a result, affected the crew’s ability to properly assess the situation and make effective decisions. Therefore, the Safety Board concludes that the flight crewmembers’ focus on expediting the landing because of the impending weather contributed to their degraded performance. 2.2.3.1.1 Industry Standards and Practices The Safety Board evaluated the flight crew’s decision to conduct an approach to an airport environment surrounded by severe convective activity in relation to contemporary industry standards and practices. Most airlines and flight training programs instruct pilots to avoid thunderstorms during routine operations. However, data from accidents and incidents demonstrate that pilots penetrate thunderstorms—in some cases with catastrophic results, as shown by the USAir flight 1016 and the Delta flight 191 accidents. In fact, in its final report on the Delta flight 191 accident, the Safety Board stated that “there is an apparent lack of appreciation on the part of some, and perhaps many, flight crews of the need to avoid thunderstorms and to appraise the position and severity of the storms pessimistically and cautiously.”

Analysis 142 Aircraft Accident Report A June 1999 report sponsored by NASA and conducted by research staff at the Massachusetts Institute of Technology’s Lincoln Laboratory (see section 1.18.2) used weather radar and ATC radar data sources to document flight crew behavior during 60 hours of observations in the Dallas/Fort Worth terminal area during convective activity. This research documented that pilots routinely penetrated thunderstorms with NWS precipitation intensity levels of 3 (strong), 4 (very strong), and 5 (extreme) rather than deviated around them, especially when approaching an airport to land. Of the 1,952 encounters with thunderstorm cells recorded in these data, pilots penetrated the thunderstorms 1,310 times (67 percent). However, the study did not include information from the pilots regarding the reasons for the actions documented by the flight data. The study concluded that pilots were more likely to penetrate a thunderstorm when they were flying after dark, flying within 10 to 16 miles of the airport, following another aircraft, or running behind schedule by more than 15 minutes. All but one of these factors (following another aircraft) applied to the accident flight. In its final report on the Delta flight 191 accident, the Safety Board stated its concern that “the present training within the industry for windshear encounters on the final approach seems to advocate the philosophy that the retrieval of the approach profile is the desired end result and not escape from the environment.” The results of the NASA study, which was completed 13 years after the Delta flight 191 accident report was issued, demonstrate that this industry philosophy can also apply to the penetration of severe thunderstorms. Some air carriers, including American, provide their flight crews with only general, advisory information on severe weather avoidance. As a result, the individual flight crews are responsible for making decisions on whether an approach near convective activity should continue, and such decisions are typically based on the pilots’ subjective assessment of the severity of the situation and their experience. The Safety Board is aware that some other air carriers provide their pilots with specific operational guidance, including decision aids and flow charts in quick reference checklists, from which flight crews can make “go” or “no go” decisions concerning operations near hazardous weather. Such information includes a detailed list of specific cues and operational criteria from which pilots can easily assess weather conditions and objectively determine whether they can safely continue or need to take a different course of action. As a result, the pilots do not have to rely on an open-ended decision-making process regarding whether and at what point to deviate around weather. Further, these explicit, formalized cue recognition and decision aids minimize the potential for thunderstorm penetrations resulting from impaired judgment and decision-making because of situational stress or fatigue. In addition, as demonstrated in this accident, airborne weather radar does not always facilitate a flight crew’s assessment of a thunderstorm regarding the storm’s location and movement relative to the airport and its severity, including the potential for microburst conditions. The Safety Board is aware that recent technologies, such as moving airport map displays integrated with airborne weather radar displays and real-time wind readouts, are available in new-generation airplanes with “glass cockpits.”208 Also,

Analysis 143 Aircraft Accident Report NASA, the FAA, and avionics manufacturers are testing whether ground-based advanced weather graphics, such as regional radar mosaics and single Doppler radar images, can be up-linked to airplanes. These graphics can show enhanced detail of a thunderstorm (including its intensity, movement, and tops) and other weather information; therefore, they have the potential for providing flight crews with in-flight information to improve their situational awareness and decision-making regarding hazardous weather. Because the NASA study showed no discernible differences among operators and airplane types regarding the propensity to penetrate thunderstorms, the Safety Board concludes that aircraft penetration of thunderstorms occurs industry-wide. Therefore, the Safety Board believes that the FAA should establish a joint Government-industry working group to address, understand, and develop effective operational strategies and guidance to reduce thunderstorm penetrations and should verify that these strategies and guidance materials are incorporated into air carrier flight manuals and training programs as the strategies become available. The working group should focus its efforts on all facets of the airspace system, including ground- and cockpit-based solutions. The near-term goal of the working group should be to establish clear and objective criteria to facilitate recognition of cues associated with severe convective activity and guidance to improve flight crew decision-making. 2.2.3.2 The Role of Fatigue The CVR contained no statements to indicate that either pilot was tired, but the CVR did record a yawn at 2324:13 from one of the pilots. The first officer stated, after the accident, that it had been a long day and that he was getting tired but that he felt fine when flying to Little Rock. In addition, the first officer stated that he did not remember talking with the captain about whether he was tired, but the first officer was not concerned about the captain being fatigued. However, research indicates that self-assessment of fatigue impairment and detection of fatigue in others are inaccurate. Thus, the Safety Board examined whether cumulative sleep loss, continuous hours of wakefulness, and the time of the accident relative to the flight crew’s normal schedule were consistent with the development of fatigue.209 First, the captain and the first officer reportedly received a normal amount of sleep the night before the accident; both went to sleep about 2200 and awoke about 0730. 208 The term “glass cockpit” refers to cockpits with cathode ray tubes or flat plate screens that integrate multiple sources of flight information formerly displayed on analog dials and gyro instruments. An example of a glass cockpit system is the Enhanced Flight Information System. 209 In its final report on the American International Airways flight 808 accident in Guantanamo Bay, Cuba, the Safety Board explained that these three background factors are commonly examined for evidence related to fatigue. For more information, see National Transportation Safety Board. 1994. Uncontrolled Collision With Terrain, American International Airways Flight 808, Douglas DC-8-61, N814CK, U.S. Naval Air Station, Guantanamo Bay, Cuba, August 18, 1993. Aircraft Accident Report NTSB/AAR-94/04. Washington, DC. For additional information on fatigue-related factors, see Federal Aviation Administration. 1998. An Overview of the Scientific Literature Concerning Fatigue, Sleep, and the Circadian Cycle. Prepared for the FAA’s Office of the Chief Scientific and Technical Advisor for Human Factors.

Analysis 144 Aircraft Accident Report Also, there was no evidence that either pilot had experienced cumulative sleep loss in the days before the accident. Second, at the time of the accident (2350:44), the captain and the first officer had been continuously awake for at least 16 hours.210 Research indicates that the normal waking day is between 14 and 16 hours and that lapses in vigilance increase and become longer if the normal waking day is extended.211 In addition, the Safety Board’s 1994 study of flight crew-related major aviation accidents (see section 1.18.3.1) found that flight crews that had been awake for an average of about 13 hours made significantly more errors, especially procedural and tactical decision errors, than crews that had been awake for an average of about 5 hours. Thus, the flight crew’s extended continuous hours of wakefulness was consistent with the development of fatigue. Third, the 2350:44 accident time was nearly 2 hours after the time that both pilots went to bed the night before the accident and the captain’s routine bedtime (between 2130 and 2200). According to a recognized expert in fatigue research who reviewed the flight and duty time and CVR data associated with this accident, because the flight crewmembers were conducting an approach at a time of night when they would have normally been asleep, their circadian systems were not actively promoting alertness in the last hours of their duty period. Thus, the time at which the accident occurred was consistent with the development of fatigue.212 Research indicates that the ability to consider options decreases as people who are fatigued become fixated on a course of action or a desired outcome (which is also the case with situational stress, as discussed in section 2.2.3.1.1) and that it can be more difficult for a fatigued person to remember whether tasks have been accomplished.213 In this accident, the flight crew did not consider delaying or diverting the landing, the first officer did not ensure that the autospoilers had been armed for landing, and the captain did not realize that he had not called for flaps 40. Also, automatic processes (such as radio calls and routine behavior) are affected less by fatigue than controlled processes (such as more 210 The flight crew had accumulated 7 hours 49 minutes of flight time during this period. Because of differences in check-in times, the captain had accumulated 5 hours 24 minutes of ground time, and the first officer had accumulated 5 hours 44 minutes of ground time. Therefore, when the accident occurred, the captain’s duty day was 13 hours 13 minutes, and the first officer’s duty day was 13 hours 33 minutes. Both pilots’ total continuous time awake at the time of the accident was at least 16 hours 21 minutes. 211 Kruger, G.P. 1989. “Sustained Work, Fatigue, Sleep Loss, and Performance: A Review of the Issues.” Work and Stress. Vol. 3, pp. 129-141. 212 Continuous hours of wakefulness and accident time were also factors in the August 1997 Korean Air flight 801 accident in Guam (see section 1.18.6). The captain had been awake for 11 hours at the time of the crash, which occurred after midnight in the flight crew’s home time zone (0142 Guam local time). The time of the crash was also several hours after the captain’s (the flying pilot) normal bedtime. 213 Caldwell, J.A. 1997. “Fatigue in the Aviation Environment: An Overview of the Causes and Effect as Well as Recommended Countermeasures.” Aviation, Space, and Environmental Medicine. Vol. 68, pp. 932-938.

Analysis 145 Aircraft Accident Report complex behavior, responses to new situations, and decision-making);214 in this accident, however, both automatic and controlled processes were affected during the flight. Further, fatigue deteriorates performance on work-paced tasks that are characterized by time pressure and task-dependent sequences of activities, as demonstrated by the flight crew’s failure to properly perform routine tasks during the final approach phase of flight. Therefore, the Safety Board concludes that the flight crew’s degraded performance was consistent with known effects of fatigue. Fatigue in transportation operations has been on the Safety Board’s list of Most Wanted Safety Improvements since the list’s initiation in September 1990. In May 1999, the Board issued a safety report that evaluated the DOT’s efforts to address operator fatigue among the transportation modes, including aviation. (The Board first asked the DOT to upgrade flight and duty times and hours-of-service regulations for all modes in 1989.) The Board’s report concluded that, despite acknowledgement by the DOT that fatigue is a significant factor in transportation accidents, little progress has been made to revise the hours-of-service regulations to incorporate the results of the latest research on fatigue and sleep issues. As a result, the Board issued Safety Recommendation A-99-45, asking the FAA to “establish within 2 years scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements.” On July 15, 1999, the FAA stated that, on December 11, 1995, it issued Notice of Proposed Rulemaking (NPRM) 95-18, “Flight Crewmember Duty Period Limitations, Flight Time Limitations and Rest Requirements.” The NPRM proposed amending existing regulations to establish one set of duty period limitations, flight time limitations, and rest requirements for flight crewmembers involved in air transportation. At an October 7, 1999, meeting with the Safety Board, FAA representatives stated that the FAA would not be able to meet the recommendation’s time requirement for a new rule. On January 3, 2000, the Board indicated that, even though the NPRM was issued over 4 years earlier, the existing regulations concerning flight time regulations and rest requirements had not been upgraded. On December 5, 2000, the FAA stated that it planned to issue, in spring 2001, a supplementary NPRM that would address the issue of fatigue “concretely” and give the airlines the flexibility they need to operate. On April 26, 2001, the Board indicated that, in the 5 years since the issuance of NPRM 95-18 and the 1 1/2 years since the need for a supplemental NPRM was first communicated, the FAA has not taken action. As a result, Safety Recommendation A-99-45 was classified “Open—Unacceptable Response.” In a May 14, 2001, press release, the FAA stated that it “is confident that, overall, the airline industry complies with current FAA rules on pilot time limitations and rest requirements.” The press release also stated the following: On Nov. 20, 2000, the FAA responded to a letter from the Allied Pilots Association that set forth specific scenarios that could affect a very small number 214 Humphrey, D.G.; Kramer, A.F.; and Stanny, R.R. 1994. “Influence of Extended Wakefulness on Automatic and Nonautomatic Processing.” Human Factors. Vol. 36, pp. 652-669.

Analysis 146 Aircraft Accident Report of all commercial pilots. The FAA’s response was consistent with the agency’s long-standing interpretation of the current rules. In summary, the FAA reiterated that each flight crew member must have a minimum of eight hours of rest in any 24-hour period that includes flight time. If a pilot’s actual rest was less than nine hours in the 24-hour period, the next rest period must be lengthened to provide for the appropriate compensatory rest. Ensuring that all pilots, especially those on reserve duty, receive adequate rest is key to maintaining a safe aviation system. On May 17, 2001, the FAA published a notice in the Federal Register that reiterated its interpretation of pilot flight time and rest rules. The notice stated that the FAA intended to enforce its rules in accordance with the interpretation and that, 6 months after the issuance of the notice, the FAA would review airline flight scheduling practices and deal stringently with any violations.215 The Safety Board is encouraged by the FAA’s increased efforts to enforce the current pilot flight time and rest rules. However, the Little Rock accident and the May 1999 American Eagle flight 4925 accident in New York (see section 1.18.6) highlight the need to expedite efforts to comprehensively address the issue of fatigue in aviation. Therefore, the Safety Board reiterates Safety Recommendation A-99-45.216 2.3 Meteorological Support 2.3.1 Weather Information Provided by the Local Controller The local controller was working all of the tower cab positions on the night of the accident and was not handling any other in-flight traffic, so flight 1420 had virtually his full attention. The controller responded promptly to all of the flight crew’s requests. The CVR indicated that, between 2339:59 and 2340:12, the first officer and the controller discussed a change from runway 22L to 4R (after the wind shift to the northwest) and that the controller responded at 2340:20 with a heading change for vectors to the runway 4R ILS approach course. At 2344:30, the first officer informed the controller that the visual approach to runway 4R could not continue because of a cloud between the airplane and the airport, and the controller provided vectors for the ILS approach at 2344:39. The first officer told the controller, at 2345:47, that the airplane was getting close to the storm, and the controller returned with a new heading at 2345:52. 215 In June 2001, the Air Transport Association and the Regional Airline Association asked the U.S. Court of Appeals for the District of Columbia to stay the pending enforcement of the FAA’s interpretation of pilot flight time and rest rules, citing that enforcement of these rules constituted illegal rulemaking. On September 5, 2001, the U.S. Court of Appeals granted the Air Transport Association’s and the Regional Airline Association’s request for a stay of enforcement. As of October 29, 2001, the court was expected to hear arguments on this case in January 2002. 216 The Safety Board notes that this safety recommendation asked the FAA to take the recommended action “within 2 years.” By reiterating this safety recommendation, the Board is not suggesting that the recommended action should occur within 2 years from the data of this reiteration. Rather, because the original 2-year period has already expired, the Board urges the FAA to expedite its efforts to accomplish the action specified in this recommendation.

Analysis 147 Aircraft Accident Report The controller also provided the flight crew with ongoing information about the wind direction and speed, including the two windshear alerts, while the airplane was approaching the airport and updated the wind information four times while the airplane was on final approach. The controller also kept the crew apprised of the progress of the thunderstorm. When the crew made initial contact with the tower, the controller indicated that a thunderstorm located northwest of the airport was moving through the area. He also informed the crew when the second part of the storm was moving through the area and when heavy rain was falling at the airport. Further, the controller alerted the crew when the RVR for runway 4R had decreased first to 3,000 feet and then to 1,600 feet and when ATIS information Romeo was no longer valid. The Safety Board could not find any instance in which the controller did not provide the flight crew with aviation weather information that was available to him in the tower or any delay in relaying this information, which is especially noteworthy considering that the weather conditions were rapidly changing during the last several minutes of flight 1420’s approach to the airport. The Safety Board concludes that the local controller provided appropriate, pertinent, and timely weather information to the flight crew regarding the conditions on approach to and at the airport. The controller’s actions after the crash occurred are discussed in section 2.4. 2.3.1.1 Weather Information Depiction on Air Traffic Control Radar Systems Although the controller accurately reported the weather information available in the tower, he appeared to lack confidence in the tower’s radar weather depiction. For example, the controller asked the flight crew how the final approach to runway 22L looked on the airplane’s radar presentation because the airplane’s radar was “a lot better” than what he had available in the tower. In addition, the ATC transcript indicated that a controller from the Memphis ARTCC called the local controller to determine whether flights headed toward Little Rock would be able to land. As part of his response to this query, the local controller said, “my radar is not that good by the weather you know.” The center controller’s response to this comment was “better than ours.” The Safety Board notes that the radar used in ATC facilities was designed to depict air traffic; it was not designed to show weather. If near-real-time color weather radar had been available at ATC facilities, the Little Rock local controller would likely have been able to relay to the flight 1420 crew that a thunderstorm with extreme reflectivities had moved over the airport. In this case, the Board cannot determine whether such a report would have changed the flight crew’s course of action because of the workload at the time that the report would have been received, as well as the flight crewmembers’ impaired performance. Nevertheless, ATC near-real-time color weather radar information would enable controllers to provide flight crews with a better source of weather information than is currently available in the tower. The Safety Board concludes that, if near-real-time color weather radar showing precipitation intensity were available, it would provide air traffic controllers with improved representation of weather conditions in their areas of responsibility. Therefore, the Safety Board believes that the FAA should incorporate, at all ATC facilities, a

Analysis 148 Aircraft Accident Report near-real-time color weather radar display that shows detailed precipitation intensities. This display could be incorporated by configuring existing and planned Terminal Doppler Weather Radar (TDWR) or Weather Systems Processor (WSP) systems with this capability or by procuring, within 1 year, a commercial computer weather program currently available through the Internet or existing stand-alone computer hardware that displays the closest single-site Weather Surveillance Radar 1988 Doppler (WSR-88D) data or regional mosaic images. 2.3.2 Additional En Route Weather Information 2.3.2.1 Dispatch Office Weather Radar After flight 1420 was underway (about 2240), the flight dispatcher transitioned from a flight-releasing to a flight-following role, which required him to provide the pilot-in-command with any safety-of-flight information that was pertinent to the flight’s operation. However, the FAA does not generally provide Part 121 flight dispatch offices with access to TDWR real-time weather radar information. Although American’s dispatchers receive high-resolution weather radar mosaic updates every 15 minutes on their workstations, the mosaics are delayed several minutes so that a clutter-free image can be presented. Even though the 15-minute updates indicate the organization and intensity of weather activity, the inherent delay in displaying the information (so that images can be compared with other weather observations and corrected for beam height and distance errors) prevents it from being depicted to the dispatcher in a timely manner. In this accident, the thunderstorm activity was moving rapidly, and the 15-minute radar updates could not adequately portray to the dispatcher the real-time conditions that flight 1420 could encounter. Dallas/Fort Worth is 1 of the 41 airports at which the FAA has installed TDWR; Little Rock airport does not have the system, and the FAA does not plan to install the system there. The availability of TDWR data to the flight dispatcher would not have affected the outcome of the accident because TDWR presents only site-specific data; thus, the TDWR at Dallas/Fort Worth would not have provided the dispatcher with information about the weather conditions in the Little Rock airport area. However, for those airports equipped or planned to be equipped with TDWR, information from that radar system relayed by dispatchers would allow flight crews to have more detailed current weather information en route than their airborne weather radar systems are able to depict. This information would also help the dispatchers in planning, releasing, and following flights. WSP systems, when they become available (which the FAA expects to be in mid-2002), could provide the same benefits as TDWR for dispatchers located at airports without TDWR. (Little Rock is not among the airports that will be receiving the WSP system.) The Safety Board concludes that the ability of flight dispatchers to provide timely and accurate weather support would be enhanced if they had access to TDWR information at airports where it is available and WSP information when the system becomes available. Therefore, the Safety Board believes that the FAA should provide

Analysis 149 Aircraft Accident Report U.S. air carriers operating under 14 CFR Part 121 access to TDWR, at airports where the system is available, and access to the WSP system, when it becomes available, so that their flight dispatch offices can use this information in planning, releasing, and following flights during periods in which hazardous weather might impact safety of flight. 2.3.2.2 Center Weather Service Unit Staffing Flight 1420 was handled by the Memphis ARTCC before the flight entered Little Rock airspace. The controllers at this center did not have access to real-time weather radar data, and no internal meteorological support was available to them because the center weather service unit (CWSU) had closed. The CWSU at the Memphis center was not staffed for 24-hour operation and had closed on the night of the accident about 2130, even though severe weather was predicted to affect the center’s airspace. The CWSU meteorologists have access to WSR-88D weather products and thus could have provided the center controller with better information regarding the line of thunderstorms moving into the area. However, the availability of this information likely would not have affected the outcome of the accident because of the flight crew’s impaired performance. In its final report on the USAir flight 1016 accident, the Safety Board issued Safety Recommendations A-95-48 and -52, which asked the FAA and NWS, in cooperation with each other, to reevaluate the CWSU program and develop procedures to enable meteorologists to immediately disseminate information about rapidly developing hazardous weather conditions to Terminal Radar Approach Control and tower facilities. On October 22, 2001, and August 7, 2001, the Board acknowledged that the FAA and NWS, respectively, were working to address the actions specified in the recommendations but expressed concern that the work was not scheduled to be completed in a timely manner. Pending completion of the FAA’s and NWS’ planned actions, Safety Recommendations A-95-48 and -52 were classified “Open—Acceptable Response” and “Open—Unacceptable Response,” respectively. Even after the FAA and NWS have completed actions to address these recommendations, their intent cannot be fully achieved unless the CWSUs are adequately staffed at all times when rapidly developing hazardous weather conditions are possible. (In letters to the Safety Board regarding the progress in implementing these safety recommendations, neither agency has described such staffing for CWSUs.) The Safety Board concludes that CWSUs should be staffed at all times when any significant weather is predicted to affect their areas of operation, even if the weather is predicted to occur before or after normal operating hours. Therefore, the Safety Board believes that the FAA and the NWS, in cooperation with the other, should ensure that CWSUs are adequately staffed at all times when any significant weather is forecast. 2.3.2.3 Automated Surface Observing System Lockout Period The lockout feature on the ASOS (that is, the time period between 47:20 and 53:20 after each hour when METARs [meteorological aerodrome reports] are prepared, edited, and transmitted) prevented the system from issuing pertinent weather information for the flight crew. If the lockout had not been in place, the system would have issued a

Analysis 150 Aircraft Accident Report special observation when the reduced visibility, heavy rain, and strong gusting winds associated with the thunderstorm were detected. An additional special observation would have been issued when the visibility was further reduced. (The ASOS edit log indicated that a special observation at 2347:22 was canceled, and a 2350:31 special observation was recorded but not disseminated.) The canceled observation would have likely indicated that the thunderstorm was at the airport and provided the flight crew with critical situational awareness information about the intensity of the storm. Because the accident airplane did not touch down until 2350:20, the information in the canceled 2347:22 special observation would have provided the flight crew with another indication that it was unsafe to land. The NWS advised the Safety Board that the next ASOS software implementation would eliminate the lockout period but that a target date for implementation has not been established because of problems with the software. The Safety Board concludes that the ASOS lockout period can prevent the relay of critical weather information to flight crews. Therefore, the Safety Board believes that the NWS should eliminate the ASOS lockout feature as soon as possible. 2.3.3 Airport Weather Equipment 2.3.3.1 Runway Visual Range System Although the new-generation RVR system at Little Rock was designed to provide a more accurate reading than that provided by the previous RVR system, the Safety Board has two concerns about the new system. First, the RVR data were not directly transmitted to the ASOS. Second, the Board did not have access to 1-minute RVR data for this accident because an event log was not started. The 1-minute RVR data were not included in the FAA’s initial specifications for ASOS recorded data. As a result, certified weather observers are required to contact tower controllers to obtain the 10-minute average RVR readings, and the weather observers use this information in preparing METARs and SPECIs [special weather observations]. However, it is a recommended practice, under Annex 3 to the Convention on International Civil Aviation, for RVR data to be included in automated weather observation systems because of the data’s importance to takeoff and landing operations. This accident demonstrates how an RVR reading can decrease drastically in a short timeframe; the RVR reading of 3,000 feet at 2346:52 had decreased to 1,600 feet less than 1 1/2 minutes later. Because a change in visibility is one of the conditions that generates a special weather observation, the Safety Board concludes that RVR data should be directly reported to automated weather systems. Therefore, the Safety Board believes that the FAA should modify automated weather systems to accept RVR data directly from RVR sensors. In addition, an RVR event log presents a total of 12 hours of the system’s data. When an event log is started, the previous 2 hours of recorded RVR data are saved, and

Analysis 151 Aircraft Accident Report the next 10 hours of RVR data are recorded and saved. Thus, after this accident, an event log needed to be started no later than 0150 on June 2, 1999, to have preserved 1-minute RVR data before and at the time of the accident. Because an event log was not started, these data were overwritten by newer data. Airways facility personnel are responsible for starting event logs; however, these personnel are not always present in the 2 hours after an event occurs. This small timeframe during which personnel are required to start event logs does not account for the possibility that RVR data will need to be retrieved. The Safety Board concludes that the current 2-hour RVR archiving capability is inadequate to ensure that data can be preserved for future use. Therefore, the Safety Board believes that FAA should maintain at least a 48-hour archive of 1-minute RVR data. Such an archive could be accomplished either by modifying RVR systems or by interfacing RVR systems with local automated weather systems. 2.3.3.2 Low Level Windshear Alert System The Low Level Windshear Alert System (LLWAS) alerts about 2339 and 2347 correctly detected actual windshear conditions associated with the gust front and other wind surges. No windshear alerts were current or were being issued at the time that flight 1420 touched down.217 LLWAS centerfield wind sensors are typically mounted between 70 and 100 feet above field elevation; at Little Rock, the sensor is mounted at 70 feet. ASOS wind sensors are mounted at a standard height of 32 feet; thus, ASOS wind data may be more representative of the surface winds that will be present when an airplane is landing. At the time that flight 1420 landed on runway 4R, the ASOS was measuring the wind from 290° at 16 knots with gusts to 22 knots, resulting in a 5-knot tailwind component upon touchdown that increased the airplane’s speed on the runway and affected the airplane’s directional control and braking performance. As stated in section 2.2.2, the controller’s last wind report of 320° at 23 knots (at 2349:53) would not have indicated to the flight crew the possibility of a tailwind at touchdown. Thus, the LLWAS centerfield wind information does not always reflect surface wind conditions, and the difference in height between LLWAS and ASOS sensors, in some cases, may be critical. The FAA’s Aeronautical Information Manual (AIM) Section 1, “Meteorology,” Part 7, “Safety of Flight,” includes only general information on the LLWAS. The information does not indicate that, in some circumstances, LLWAS centerfield wind information alone may not accurately represent the winds that are present at the runway surface. The information also does not caution that the LLWAS alerts at some airports (including Little Rock) currently do not distinguish between windshear and microburst events. (A future software change to LLWAS will allow all system models to differentiate between microburst and windshear alerts, but the only LLWAS systems that currently make this differentiation are those that are integrated with TDWR systems. 217 The LLWAS first detected winds associated with the microburst at 2351:30 and issued alerts from 2352:10 to 0005:10.

Analysis 152 Aircraft Accident Report Airports with such LLWAS systems include Dallas/Fort Worth, Chicago O’Hare, Denver International Airport, and Atlanta Hartsfield.) In addition, at the public hearing on this accident, the expert on LLWAS from the Massachusetts Institute of Technology’s Lincoln Laboratory indicated his concern that pilots may be disregarding LLWAS alerts and continuing to operate into the terminal area because they perceive that the alerts are false and that no windshear threat exists. This situation may be occurring because pilots may not realize that the LLWAS sensors in use today are not the same as those used in the late 1970s through the late 1980s, which alerted when normal gusting winds were present. The latest LLWAS sensors include technologies to reduce such false alerts, yet this information also does not appear in the AIM. The Safety Board concludes that, if detailed information on the LLWAS were contained in the FAA’s AIM, pilots could have a better understanding of the system. Therefore, the Safety Board believes that the FAA should provide additional information on the LLWAS in the AIM, including that an LLWAS alert is a valid indicator of windshear or a microburst. 2.4 Emergency Response The local controller reported that he called the Aircraft Rescue and Fire Fighting (ARFF) units on the crash phone about 2352 after several attempts to contact the flight crew after the airplane landed. The controller indicated the possibility of an accident at the end of runway 4R but did not specify which end of the runway. The ARFF units proceeded to the approach end of runway 4R, but the airplane was off the departure end of the runway. As a result, the ARFF units had to travel back to the taxiway at which they entered the runway and then proceed to the other end of the runway. The ARFF units located the airplane about 0003, 11 minutes after the initial call from the local controller. However, they did not arrive on scene until 5 minutes later, about 0008 (16 minutes after the initial notification), because they had to travel in the opposite direction to an access road, turn onto a perimeter road back in the direction of the accident site, stop to manually unlock a perimeter security gate, and then continue on the perimeter road to the accident site. If the ARFF units had known the approximate location of the airplane when they left the fire station, the time spent traveling from the taxiway to the approach end of the runway and back would have been saved. The ARFF units reported that they were initially traveling very slowly because of the limited visibility toward the approach end of the runway and the unknown location of the airplane. The Safety Board recognizes that the controller could have provided a more precise description of the accident location to the ARFF units, especially since he knew the direction in which the airplane was landing and had seen the airplane travel past midfield. However, the Board also recognizes that the ARFF personnel could have queried the controller to see if he knew any additional information about the airplane’s location.

Analysis 153 Aircraft Accident Report The Safety Board concludes that part of the delay in locating the flight 1420 wreckage was preventable and that several minutes in the emergency response time might have been saved if the ARFF units had proceeded directly to the departure end of runway 4R. Because the delay can be partly attributed to the incomplete location information provided to the ARFF units by the local controller, the Safety Board believes that the FAA should issue a mandatory briefing item to tower controllers that describes the circumstances of this accident, including the interactions between the controller and ARFF crews. This briefing item should emphasize that location information provided to ARFF crews should be as complete and specific as possible to minimize opportunities for confusion. The Safety Board also believes that the FAA should amend FAA Order 7110.65, “Air Traffic Control,” to require controllers to monitor the progress of ARFF crews responding to emergencies to ensure that the response is consistent with known location information. In addition, the Safety Board believes that the FAA should amend FAA Order 7210.3R, “Facility Operation and Administration,” to direct tower managers to establish mutual annual briefings between ATC and ARFF personnel to ensure that these personnel have a common understanding of the local airport emergency plan and sections of the FAA’s AC 150/5210-7C, “Aircraft Rescue and Firefighting Communications,” that are applicable to local ATC/ARFF emergency response procedures. The accident was not survivable for those who were seated on the forward left side of the airplane in the area of the collisions with the runway 22L approach lighting structure (the captain and the passengers in seats 3A and 8A) and those who were immediately exposed to lethal impact forces (seats 17B and 18A and B) or fire (seats 19A, B, and C) in the area where the fuselage separated.218 The accident, however, was potentially survivable for the passenger fatalities in seats 27E and 28D.219 Because the accident was potentially survivable for the passengers in seats 27E and 28D, the Safety Board considered whether a shorter ARFF response time could have prevented the fatalities but determined that the passengers’ lives would not have been 218 In a 2001 safety report, the Safety Board defined a survivable accident as follows: “For the accident to be deemed survivable, the forces transmitted to occupants through their seat and restraint system cannot exceed the limits of human tolerance to abrupt accelerations, and the structure in the occupants’ immediate environment must remain substantially intact to the extent that a livable volume is provided for the occupants throughout the crash.” See National Transportation Safety Board. 2001. Survivability of Accidents Involving Part 121 U.S. Air Carrier Operations, 1983 Through 2000. Safety Report NTSB/SR/01-01. Washington, DC. 219 The passenger in seat 27E died of smoke and soot inhalation. After stating “that’s everyone— that’s all” in response to another passenger’s query about whether anyone was still inside the cabin, the passenger in seat 27E continued farther aft in the cabin (for undetermined reasons) and was overcome by smoke; his body was found in the extreme aft part of the cabin on the right side. The passenger would have most likely survived if he had evacuated the airplane when he was near the right aft overwing exit. The passenger in seat 28D received serious burns when she evacuated the airplane through the left aft overwing exit and died 15 days later of complications from the burn injuries. This passenger would have likely survived if she had exited the airplane through the right aft overwing exit or the tailcone exit. The Safety Board recognizes that three other passengers who used the left aft overwing exit survived the accident, one of whom was burned severely. The passenger in seat 28D may have experienced a more intense fire than the other passengers because of the variable winds that were present or the progression of the fire.

Analysis 154 Aircraft Accident Report saved if emergency responders had arrived on scene earlier. Even with the shortest possible response time, the passenger in seat 28D would have already received the second- and third-degree burns to over half of her body and the severe inhalation injury from which she later died. The passenger in seat 27E remained on the airplane and therefore needed to be rescued from the wreckage. However, the four ARFF personnel that responded to the accident were not available to enter the airplane because they were involved in positioning the fire trucks and operating fire suppression equipment.220 Thus, an interior search of the airplane could not be conducted until off-airport firefighters arrived on scene about 0022. 2.4.1 Aircraft Rescue and Fire Fighting Staffing Levels The Safety Board could not determine whether the passenger in seat 27E would have survived if sufficient ARFF personnel had been available to perform a rescue. However, previous accidents in which the occupants’ survival was aided by or depended on the abilities of rescue personnel to enter an airplane (see section 1.18.7.1) provide lessons learned that highlight the need for an adequate number of ARFF personnel to perform rescue operations. The FAA’s January 1997 final report, Aircraft Rescue and Firefighting Services— Mission Response Study, indicated that evacuation of an aircraft was a primary responsibility of the air carriers and that the carriers have crew complements trained for that function. This finding concerns the Safety Board because, in the event that crewmembers are incapacitated or the conditions aboard the airplane deteriorate to the point that the crew is forced to leave, the remaining airplane occupants must rely on ARFF personnel to assist in the evacuation. In fact, the first officer and two of the four flight attendants in the Little Rock accident sustained serious injuries and were unable to assist with the evacuation. Title 14 CFR 139.319(j) requires that “sufficient rescue and firefighting personnel are available during all air carrier operations to operate the vehicles, meet the response times, and meet the minimum agent discharge rates required by this part.” However, the regulation does not contain any specific staffing requirement for ARFF units. Thus, the regulation does not ensure that ARFF units will be staffed at a level that would allow timely entry into an airplane for rescue and firefighting activities. Insufficient ARFF staffing levels were demonstrated in two recent events. First, on October 10, 2000, a Canadair Challenger Model 604, C-FTBZ, owned by Bombardier Inc., and being operated as a test flight, crashed into terrain and collided with an airport perimeter fence during a failed takeoff from runway 19 at the Wichita Mid-Continent Airport, Kansas.221 A fuel-fed fire erupted after the collision. Two ARFF fire trucks and 220 The Safety Board recognizes that Little Rock airport is now staffed with six ARFF personnel at all times. 221 The description for this accident, CHI01MA006, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

Analysis 155 Aircraft Accident Report three ARFF personnel responded within about 90 seconds and applied a mass application of firefighting agent to extinguish the exterior fire. The firefighters stated that they could hear screams for help coming from the cockpit. One of the ARFF trucks carried a “penetrating nozzle”;222 however, the nozzle could not be used because two trained firefighters were required to operate it, and only one was available. (Two of the three personnel were occupied in their vehicles with firefighting activities.) The pilot and flight test engineer were killed, the copilot received serious injuries and died more than 1 month later, and the airplane was destroyed. Second, on August 8, 2000, Air Tran flight 913, a DC-9-32, N838AT, made an emergency landing in Greensboro, North Carolina, because of dense smoke in the cockpit.223 The airplane landed successfully, and an emergency evacuation was conducted. All occupants were able to evacuate the airplane. Four crewmembers received minor injuries from smoke inhalation in flight, 1 passenger received a minor injury during the evacuation, and 1 crewmember and 57 passengers were uninjured. As with the flight 1420 emergency response, three ARFF vehicles and four ARFF personnel responded to the Air Tran event. If the occupants aboard the Air Tran flight had not been able to evacuate, there would not have been adequate ARFF resources to enter the airplane and rescue individuals. In fact, no ARFF personnel entered the airplane until after off-airport emergency responders arrived, despite the fire progressing through the airplane. The Safety Board concludes that ARFF units may not be staffed at a level that enables ARFF personnel, upon arrival at an accident scene, to conduct exterior firefighting activities, an interior fire suppression attack, and a rescue mission. Therefore, the Safety Board believes that the FAA should amend 14 CFR 139.319(j) to require a minimum ARFF staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. 2.4.2 Crash Detection and Location Technology The accident airplane was not equipped with a technology, such as an emergency locator transmitter (ELT), that might have assisted the controller in directing the ARFF units to the airplane’s location after it crashed.224 Also, the ARFF vehicles were not equipped with the Driver’s Enhanced Vision System (DEVS), which was designed to help reduce emergency response times in poor visibility conditions such as those experienced after the flight 1420 crash. The DEVS includes a forward-looking infrared device, which searches for heat sources. Even though the heavy rain at the airport was cooling the plume 222 A penetrating nozzle is a tool that is used to puncture the skin of a burning airplane and apply extinguishing agent to the interior of the airplane. 223 The description for this accident, DCA00MA079, can be found on the Safety Board’s Web site at http://www.ntsb.gov. 224 Tower facilities monitor ELT frequencies at all times. The Little Rock ARFF units did not have an ELT receiver.

Analysis 156 Aircraft Accident Report of smoke from the postcrash fire, it is likely that the device would have detected the smoke plume sooner than the ARFF units were able to see it.225 The Safety Board has investigated other accidents in which the use of crash detection and location equipment would have significantly helped with the emergency response effort (see section 1.18.7.2). It is extremely important that ATC facilities receive immediate information about a downed aircraft and that ARFF units and other emergency responders arrive at the accident scene in the shortest possible time. ELTs, DEVS, and other current technologies that can be used to help detect, locate, or respond to downed aircraft offer the potential for improving emergency response times. The Safety Board concludes that a crash detection and location technology would help expedite the arrival of emergency responders at an accident scene, thus maximizing the possibility for saving lives and reducing the severity of injuries. Therefore, the Safety Board believes that the FAA should evaluate crash detection and location technologies, select the most promising candidate(s) for ensuring that emergency responders could expeditiously arrive at an accident scene, and implement a requirement to install and use the equipment. 2.4.3 Interagency Emergency Response Critique Little Rock National Airport did not conduct a postaccident interagency emergency response critique shortly after the flight 1420 accident. Nine months after the accident, the airport completed individual critiques with all of the agencies involved with the emergency response and a group critique with some of these agencies. All of the agencies involved with the emergency response were invited to attend the group critique; however, the Little Rock Fire and Police Departments, the Little Rock Office of Emergency Services, and Metropolitan Emergency Medical Services did not attend. In addition, although the agenda for the group critique included many areas of discussion affecting all facets of an emergency response, the only documented information resulting from these discussions that was provided to the Safety Board was a summary of the hospitals’ recommendation, observations, and concerns. The FAA does not currently require airport operators to perform postaccident emergency response critiques. The Federal Railroad Administration (FRA), however, requires rail carriers to conduct postaccident emergency response critiques. Specifically, 49 CFR 239.105 requires that “each railroad operating passenger train service shall conduct a debriefing and critique session after each passenger train emergency situation” to determine the effectiveness of the railroad’s emergency preparedness plan and amend or improve the plan according to the information gleaned. The FRA requires the critique to assess, among other items, how much time elapsed between the emergency situation and the notification to the emergency responders, whether the emergency responders arrived quickly on scene after receiving notification, and whether the emergency 225 As stated in section 1.18.4, the FAA requires a forward-looking infrared device to be installed on all of its new fire trucks that carry 1,500 or more gallons. DEVS is currently in use at Logan International Airport in Boston, Massachusetts.

Analysis 157 Aircraft Accident Report response was effective. The FRA further requires that the debriefing and critique session be conducted within 60 days after the passenger train emergency situation and that the railroad maintain records of the session (including the names of all the participants) and make these records available to FRA representatives. Although a formal postaccident interagency emergency response critique was not required by 14 CFR Part 139, such a critique, if performed in a timely manner after an aviation accident, would enable participants to take immediate, appropriate actions to rectify any identified emergency response deficiencies. The Safety Board investigated two aviation accidents, 3 years apart, at Dallas/Fort Worth International Airport that demonstrate how corrective actions implemented after one accident response prevented a recurrence of the problem during a subsequent accident response. In the August 2, 1985, Delta flight 191 accident investigation (see section 1.18.5), the Board determined that, although the on-airport emergency response was timely and effective and contributed significantly to saving a number of lives, the amount of time required to complete all of the emergency notifications was excessive (45 minutes). The Board recommended that the Dallas/Fort Worth Airport Board improve its Airport Emergency Plan to provide for more efficient and timely notification of the mutual aid agencies and area hospitals. On August 31, 1988, Delta flight 1141, a Boeing 727-232, N473DA, crashed during its takeoff roll.226 Of the 108 airplane occupants, 14 were killed, 26 were seriously injured, 50 received minor injuries, and 18 were uninjured. The airplane was destroyed by impact forces and postcrash fire. In its final report on this accident, the Board found that the time to complete emergency notifications, including those to the mutual aid agencies and hospitals, had been significantly reduced (21 minutes). The decreased notification time was partly attributed to the installation and use of the Automated Voice Notification System in the airport’s Emergency Operations Center. The Board concluded that the corrective actions taken by the Dallas/Fort Worth Airport Board after the flight 191 accident “greatly improved” the communications and coordination of the ARFF personnel and medical units responding to the flight 1141 accident. The Safety Board concludes that a timely postaccident interagency emergency response critique that identifies deficiencies that need corrective action and successes that should be repeated in similar circumstances would be beneficial for all parties involved in an aviation accident response. Therefore, the Safety Board believes that the FAA should develop specific criteria, using the FRA’s requirements as guidance, to be evaluated during a postaccident interagency emergency response critique and amend 14 CFR Part 139 to require airport operators to conduct this critique within 60 days after any air carrier accident and provide the results of the critique to the FAA. 226 For more information, see National Transportation Safety Board. 1989. Delta Air Lines, Inc., Boeing 727-232, N473DA, Dallas/Fort Worth International Airport, Texas, August 31, 1988. Aircraft Accident Report NTSB/AAR/89-04. Washington, DC.

Analysis 158 Aircraft Accident Report 2.5 Airport Factors 2.5.1 Runway Safety Areas Runway 4R/22L, which was opened in September 1991, has runway safety areas of 1,000 feet at the departure end of 22L and 450 feet at the departure end of 4R. Although the FAA’s June 5, 1991, version of AC 150/5300-13 stated that the standard runway safety area was 1,000 feet, runway 4R/22L was exempt from this standard under the provisions of 14 CFR 139.309(a)(1), which allowed runways that had a safety area on December 31, 1987, to be maintained, as long as no reconstruction or significant expansion of the runway had begun after January 1, 1988.227 The Safety Board notes that, in this accident, an extra 550 feet at the departure end of runway 4R would not have prevented the airplane from departing the end of the runway or impacting the approach lighting system; however, the airplane’s speed would have further decreased with an extra 550 feet at the end of the runway, resulting in a lower impact speed. Because safety areas of at least 1,000 feet would provide an extra margin of safety under most circumstances, the Board is concerned about runway safety areas that are less than the current FAA standard. Another recent accident involved an overrun beyond the threshold of a runway with a nonstandard safety area. Specifically, on March 5, 2000, Southwest Airlines flight 1455, a Boeing 737-300, N668SW, departed the end of runway 8 during landing at Burbank-Glendale-Pasadena Airport, Burbank, California. The airplane traveled through a nonfrangible metal blast fence beyond the departure end of the runway and came to rest on a highway outside the airport perimeter. Of the 142 airplane occupants, 2 received serious injuries, 42 received minor injuries, and 98 were uninjured.228 The runway safety area at the approach (west) end of runway 8/26 is 200 feet; no safety area exists at the departure (east) end of the runway. As with runway 4R/22L in Little Rock, runway 8/26 in Burbank was exempt, under 14 CFR 139.309(a)(1), from the 1,000-foot runway safety area standard in AC 150/5300-13. On December 13, 1994, the Safety Board issued Safety Recommendation A-94-211, which asked the FAA, among other things, to require that substandard runway safety areas be upgraded to AC 150/5300-13 minimum standards wherever possible.229 In its October 15, 1997, response, the FAA indicated that 25 percent of the runways at 14 CFR Part 139 certificated airports have safety areas that do not meet AC 150/5300-13 minimum standards but could with feasible improvements and that 17 percent have safety areas that could not be feasibly improved to meet the standard. However, the FAA stated that runway safety area improvement projects would be scheduled only as part of overall 227 Construction of runway 4R/22L began as early as September 1982. Work on the runway continued after January 1, 1988, but none of the efforts involved reconstruction or significant expansion. 228 The description for this accident, DCA00MA030, can be found on the Safety Board’s Web site at http://www.ntsb.gov. 229 This recommendation was issued as a result of the April 27, 1994, Action Air Charters flight 990 accident in Stratford, Connecticut (see section 1.18.8.1).

Analysis 159 Aircraft Accident Report runway improvement projects because of the associated cost and infrequency of aircraft overruns and undershoots. On February 10, 1999, the Board expressed its concern that the delay in runway safety area upgrades would allow nonstandard conditions to continue and classified Safety Recommendation A-94-211 “Closed—Unacceptable Action.” The Safety Board recognizes that the design of some airport runways makes it difficult for runway safety areas to be upgraded to the standards of AC 150/5300-13 and that those airport runways that can be upgraded may not be improved for some time based on the FAA’s current plans. However, those runways should provide equivalent runway protection. One way to achieve this goal is to install a type of soft-ground aircraft arresting system, such as the Engineering Materials Arresting System (EMAS). The safety benefit of EMAS was demonstrated by the American Eagle flight 4925 accident when the airplane departed an 8,400-foot runway but was stopped approximately 248 feet into a 400-foot EMAS (see section 1.16.5). According to a report by Engineered Arresting Systems Corporation, which developed EMAS, the flight 1420 airplane would not have been significantly slowed by a standard EMAS installed at the approach end of runway 22L because the airplane’s track was outside the extended runway edges. Thus, the flight 1420 airplane would not have been able to use the full length of a standard EMAS. However, according to FAA AC 150/5220-22, “Engineered Materials Arresting System for Aircraft Overruns,” most airplane runway overruns “come to rest within 1,000 feet of the runway end and between the extended edges of the runway.” Therefore, the Safety Board continues to support the installation of EMAS, especially for those runways in which the safety area is less than the minimum standards established in AC 150/5300-13. The Board notes that an EMAS was installed at the departure end of runway 4R at Little Rock in the fall of 2000. The Board further notes that Little Rock airport is working with Federal and local government agencies to extend the runway safety area at the departure end of runway 4R to 1,000 feet by July 2002. 2.5.2 Nonfrangible Structures The FAA determined that the runway 22L approach lighting system at Little Rock, which is located in a flood plain area of the Arkansas River, could not be retrofitted to a frangible design because of the possibility that moving water, ice, and floating debris would affect the structural integrity of the system. The Safety Board recognizes the current design limitations of this approach lighting system and acknowledges that, if the approach lighting system had been frangible, it is possible that the accident airplane would not have been stopped on the ground and would have gone into the Arkansas River. However, the Board also recognizes that frangible structures, because of their ability to break, distort, or yield on impact with aircraft, generally present less risk than nonfrangible ones. In this accident, the airplane’s collision with the nonfrangible approach lighting system was the direct cause of the fatal blunt force trauma injuries sustained by the captain and the passengers in seats 3A and 8A and the destruction to the airplane on the left side of the fuselage.

Analysis 160 Aircraft Accident Report In 1984, the Safety Board issued Safety Recommendation A-84-36, which asked the FAA to “initiate research and development activities to establish the feasibility of submerged low-impact resistance support structures for airport facilities and promulgate a design standard if such structures are found to be practical.” The FAA conducted research in this area with the National Institute of Standards and Technology. In October 1996, the FAA concluded that, with the current technology, any submerged low-impact frangible structure would most likely be destroyed by wave motion from small storms. Because of the FAA’s research activities, the Board classified the recommendation “Closed—Acceptable Action.” The FAA has had an effort underway for some time to replace selected nonfrangible structures with frangible ones. However, technological advances since the time of the FAA/National Institute of Standards and Technology research activities, especially those involving the use of new materials, might allow some additional nonfrangible structures to be replaced by frangible ones. The Safety Board concludes that the development of recent technologies to convert nonfrangible structures to frangible ones would provide a safety benefit to airport facilities. Therefore, the Safety Board believes that the FAA should conduct research activities to determine if recent technological advances would enable submerged low-impact structures and other nonfrangible structures at airports to be converted to frangible ones. 2.6 American Airlines 2.6.1 Stabilized Approach Criteria At the time of the accident, American’s only written guidance for MD-80 pilots regarding the stabilized approach concept was in the “Techniques” section of the DC-9 Operating Manual. The guidance indicated that the minimum recommended stabilized approach altitudes for instrument flight rules (IFR) and visual flight rules (VFR) conditions were 1,000 and 500 feet, respectively, and that landing flaps were to be selected by 1,000 feet afl. The guidance also stated that, before descending below the specified minimum stabilized approach altitude, the airplane was to be in the final landing configuration (gear down and final flaps), on approach speed, on the proper flightpath, at the proper sink rate, and at stabilized thrust; these conditions were expected to be maintained throughout the rest of the approach. However, the guidance did not define what was meant by “on” approach speed, “on” the proper flightpath, and “at” the proper sink rate. In addition, the guidance did not describe the necessary flight crew actions if the stabilized approach criteria were not met. Further, information presented in the “Techniques” section was not considered by American to be required procedures but rather suggested ways of accomplishing a task.230 The Safety Board notes that American revised its stabilized approach criteria after the accident and included this information in both its Airplane Flight Manual and DC-9 Operating Manual. The revised company procedures state that the airplane must be “at approach speed (Vref plus additives)” rather than “on approach speed.” The procedures

Analysis 161 Aircraft Accident Report also state that the minimum stabilized approach height is 1,000 feet afl in instrument meteorological conditions and 500 feet afl in visual meteorological conditions rather than present minimum recommended stabilized approach altitudes for IFR and VFR conditions. In addition, the procedures explicitly state that a go-around is required if stabilized approach requirements cannot be maintained until landing. At the public hearing on this accident, the first officer discussed the training and guidance that he had received at American concerning a decision to execute a go-around. The first officer indicated that this decision was based on the stabilized approach theory. He stated that, if the sink rate was excessive or if the airplane was deviated to the left or right of course (among other criteria), then the approach would not meet the stabilized approach definition and a go-around should be performed. American’s flight manual contains the only written guidance regarding the performance of a missed approach. At the time of the accident, the manual stated that, when a landing cannot be accomplished, the pilot must comply with the missed approach procedure, or an alternate missed approach procedure specified by ATC, upon reaching the missed approach point defined on the approach chart. The missed approach procedures were revised on August 15, 1999, to state that American Airlines has a “no-fault go-around policy” and recognize that a successful approach can end in a missed approach. The revised procedures require captains to execute or order a missed approach if the aircraft is not stabilized by 1,000 feet afl (in IFR conditions) or 500 feet afl (in VFR conditions) or if the captain believes that a safe landing cannot be accomplished within the touchdown zone or that the airplane cannot be stopped within the available runway length. The Safety Board acknowledges that American revised its missed approach procedures to ensure that its pilots are aware that they will not be faulted if they perform a missed approach and that the revised procedures specify the altitude at which a go-around is required if an approach is not stabilized. However, the new stabilized approach requirements still do not explicitly state what is meant by “proper” flightpath and “proper” sink rate. Further, the requirements do not provide pilots with specific amounts of glideslope and localizer displacement for determining whether an approach is stabilized. The new requirements also do not contain specific, corrective actions for pilots to take if an approach becomes unstabilized before the required minimum stabilized approach heights.231 Thus, the Safety Board concludes that American Airlines has 230 The Safety Board recognizes that American plans to integrate the “Techniques” section with the “Normals” section of the DC-9 Operating Manual, which contains required, rather than suggested, procedures for accomplishing tasks. However, American did not provide any timetable for combining the two sections, stating at the public hearing that it was “gradually” editing out the “Techniques” section. Thus, the minimal stabilized approach guidance that does exist may remain only as a suggested procedure for some time. Even after the information is placed in the “Normals” section, it will still lack the necessary specificity to assist pilots in recognizing an unstabilized approach. 231 In the February 6, 1997, American Airlines flight 699 accident in St. John’s, Antigua, the Safety Board determined that a contributing factor in the accident was American’s inadequate procedures to address corrective actions for approaches that become unstabilized. The description for this accident, DCA97LA027, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

Analysis 162 Aircraft Accident Report insufficient guidance to assist its pilots in performing a stabilized approach and recognizing when an approach has become unstabilized. On August 29, 1997, the Safety Board issued Safety Recommendation A-97-85, which asked the FAA to require all 14 CFR Part 121 and 135 operators to review and revise their company operations manuals to more clearly define terms that are critical for safety-of-flight decision-making, such as “stabilized approach.”232 On May 26, 1998, the FAA issued Flight Standards Handbook Bulletin for Air Transportation (HBAT) 98-22, “Stabilized Approaches,” which directed 14 CFR Part 121 and 135 POIs to review operators’ training and operations manuals to ensure that they addressed, among other things, the minimum requirements for a stabilized approach and the immediate actions that needed to be taken if the stabilized approach conditions were not met. On the basis of the FAA’s actions, the Safety Board classified Safety Recommendation A-97-85 “Closed—Acceptable Action” on November 20, 1998. The Safety Board is concerned that, even with the requirement for POIs to ensure that their carrier’s stabilized approach guidance is in accordance with Flight Standards HBAT 98-22, some carriers may still have stabilized approach guidance that lacks specificity (as demonstrated by American’s revised MD-80 stabilized approach guidance.) In addition, guidance to air carriers on stabilized approach criteria in the FAA’s Air Transportation Operations Inspector’s Handbook is not sufficiently detailed to ensure that carriers provide their pilots with defined guidelines for determining a stabilized approach and deciding when a missed approach is necessary. The Safety Board concludes that, because a stabilized approach is a critical part of safe flight operations, it is imperative that air carriers have specific stabilized approach criteria. Therefore, the Safety Board believes that the FAA should define detailed parameters for a stabilized approach, develop detailed criteria indicating when a missed approach should be performed, and ensure that all 14 CFR Part 121 and 135 carriers include this information in their flight manuals and training programs. 2.6.2 Spoiler System Training During observations of day 6 (takeoffs and landings) of American Airlines’ MD-80 simulator training sessions, spoiler system training deficiencies were noted. One session presented no landings in which the spoilers had failed to deploy. The other session presented seven landings in which the spoilers had failed to deploy, but none of the trainees had called out that the spoilers had not extended. As indicated in section 2.2.2.1.3, American’s MD-80 Fleet Manager at the time of the accident and several company MD-80 check airmen indicated that pilots were trained to announce if the spoilers failed to automatically extend, yet the instructor did not point out to the students that they had failed to make this announcement. 232 This recommendation was issued as a result of the October 19, 1996, Delta Air Lines flight 554 accident in New York (see section 1.18.8.2).

Analysis 163 Aircraft Accident Report The spoilers were manually deployed in only two of the failed spoiler landings, but a first officer trainee was the pilot who extended the spoilers. This action was contrary to American’s policy, which indicated that the captain was to extend the spoilers if they failed to deploy, regardless of which pilot was making the landing. Further evidence of problems with American’s spoiler system training came to light after the Palm Springs incident. During the 8 months in between the Little Rock accident and the Palm Springs incident, company managers had been aware of the spoiler deployment problems experienced by the Little Rock pilots. In fact, the former MD-80 Fleet Manager testified at the public hearing that spoiler system training now included recognizing the lack of spoiler extensions and performing the appropriate response. The Palm Springs captain had completed MD-80 captain upgrade training in November 1999, during which time he would have attended day 6 of the simulator training and should have been instructed on the revised simulator spoiler training procedures. The Palm Springs first officer had completed MD-80 recurrent training in August 1999, during which time he should have also been instructed on the revised simulator spoiler training procedures. However, both flight crewmembers in the Palm Springs incident failed to verify that the spoilers had automatically deployed after landing, and the captain failed to manually extend the spoilers when they did not deploy. The Safety Board recognizes that, on February 23, 2000 (1 week after the Palm Springs incident), American revised its DC-9 Operating Manual to prevent a situation similar to the Little Rock and Palm Springs events from recurring. The revisions specified that the nonflying pilot was responsible for making a “deployed” or “no spoilers” callout at touchdown and that the captain was always responsible for deploying the spoilers if they did not extend after touchdown. 2.6.3 Spoiler and Braking Systems Procedures At the time of the accident, American had not adopted Boeing’s MD-80 spoiler deployment and autobrake procedures. Boeing’s procedures recommended a “no spoilers” callout by the nonflying pilot if the spoiler handle did not move aft after touchdown and the use of maximum autobrakes for landings on wet or slippery runways. As stated in section 2.2.2.1.3, the flight crew’s failure to detect that the spoilers had not deployed at touchdown might have been avoided if a procedure similar to Boeing’s had been in place at American at the time. As stated in section 2.2.2.3, if the spoilers had deployed and the flight crew had selected maximum autobrakes for the landing, initial brake application could have occurred about 4 seconds sooner. At the public hearing on this accident, Boeing’s MD-80 Chief Pilot for Flight Operations indicated that operators are not required to adopt the operating procedures in Boeing’s FCOM and that operators, along with their POIs, can change the procedures. The Chief Pilot also indicated that most, if not all, of the domestic operators coordinate with the manufacturer—normally by requesting a letter of no technical objection—before making any changes to their flight manual, even though there is no legal requirement to do so. In an April 20, 2000, letter to the Safety Board, Boeing indicated that it could not

Analysis 164 Aircraft Accident Report find any record of issuing a letter of no technical objection to American regarding alteration of the manufacturer’s recommended spoiler deployment or autobrake procedures. On November 30, 1998, Safety Recommendation A-98-102 was issued because air carriers had the prerogative not to adopt certain manufacturer procedures without clear written justification.233 Safety Recommendation A-98-102 asked the FAA to “require air carriers to adopt the operating procedures contained in the manufacturer’s airplane flight manual and subsequent approved revisions or provide written justification that an equivalent safety level results from an alternate procedure.” In response to this recommendation, the FAA issued, in May 1999, the Joint Flight Standards HBAT, Airworthiness, and General Aviation, Flight Standards Policy—Company Operating Manuals and Company Training Program Revisions for Compliance. The handbook bulletin directed that POIs encourage their operators to (1) have a reliable delivery system in place for flight manual revisions, which ensures that the operators receive the revisions within 30 calendar days of approval, and (2) develop an action plan to notify, in writing, respective POIs of new flight manual revisions within 15 days after receipt. In addition, on July 7, 2000, the FAA stated that it had initiated an NPRM proposing to revise 14 CFR Part 121, Subparts N and O, to reflect the policy included in the May 1999 Joint Flight Standards HBAT, Airworthiness, and General Aviation, Flight Standards Policy—Company Operating Manuals and Company Training Program Revisions for Compliance. On January 12, 2001, the Safety Board acknowledged the FAA’s actions and stated that, pending the issuance of the NPRM and implementation of the proposed regulation, Safety Recommendation A-98-102 was classified “Open— Acceptable Response.” On August 2, 2001, the FAA stated that it was continuing to develop the NPRM. At the public hearing on this accident, the POI for American indicated that a carrier might choose not to make a manufacturer’s suggested change because of the way that the carrier has configured the particular airplane. However, it is critical that the carrier provide written justification to the FAA regarding the reasons for not making a change or for implementing an alternative procedure in case the manufacturer’s performance data do not support the carrier’s justification. It is also critical that the carrier make its POI and respective aircrew program manager (APM) aware of any manufacturer’s recommended procedure that is not being adopted or is being altered. The Safety Board recognizes that American, since the time of the accident, has revised its DC-9 Operating Manual to include spoiler deployment and autobrake procedures similar to Boeing’s. The Board further recognizes that the FAA has taken positive steps toward implementing the intent of this recommendation. However, this accident highlights the need for timely action to ensure that pilots are operating airplanes according to procedures that reflect the manufacturer’s safest operating practices. Therefore, the Safety Board reiterates Safety Recommendation A-98-102. 233 This recommendation was issued as a result of the January 9, 1997, Comair flight 3272 accident near Monroe, Michigan (see section 1.18.8.3).

Analysis 165 Aircraft Accident Report 2.7 Federal Aviation Administration Oversight Within the FAA’s Certificate Management Office for the AMR Corporation, the POI for American Airlines is responsible for the overall oversight of American’s training and line operations and for approving training and flight manuals and their revisions. At the public hearing, the POI stated that he needed more inspectors to conduct surveillance but that a hiring freeze was in effect. The POI also indicated that he needed almost double the number of air safety inspectors he had in his office at the time and that his inability to hire more inspectors had severely impacted his office’s surveillance activities. Further, the POI expressed concern that his office did not have geographic air safety inspectors in some locations where American has a large volume of operations. An APM and an Assistant APM were responsible for providing oversight of American’s MD-80 fleet. This oversight responsibility included reviewing and approving the contents of the flight manuals, monitoring the training program, reviewing recommended changes to the manuals and training program, and monitoring daily line operations. The APM indicated that his ability to oversee American’s MD-80 fleet was affected by personnel constraints. For example, the APM stated that, because he and the Assistant APM were the only ones responsible for observing American’s MD-80 training, they were “spread thin” and found it “extremely difficult” to observe all facets of the training program. In addition, the APM stated that budget constraints had limited the amount of oversight that could be performed and the locations where it could be performed. The APM said that a thorough job of oversight required many personnel, which he did not have. According to the APM, selected check airmen from American Airlines, named aircrew program designees, performed most of the airman certification activities under the APM’s supervision. Also, senior designated examiners at American were responsible for observing every company check airman and simulator instructor at least once a year. Further, the APM relied heavily on American Airlines to ensure standardization in its simulator training program. It is clear that the FAA’s oversight responsibilities for American’s MD-80 training were highly dependent on the work of American’s check airmen, aircrew program designees, and senior designated examiners. Although the Safety Board acknowledges that American and the FAA’s Certificate Management Office for the AMR Corporation have developed a cooperative working relationship with each other, the Board is concerned about the lack of direct FAA oversight of American’s MD-80 fleet. The problems found during observations of American’s simulator training sessions (for example, the students’ use of reverse thrust above 1.3 EPR on wet runways and failure to notice the lack of spoiler extension) might have been detected earlier if the FAA had been directly monitoring the training. In its final report on the USAir flight 1016 accident, the Safety Board expressed its concern about the relationship between USAir and the FAA POI for USAir. Specifically, the Board faulted the POI for relying entirely on USAir to rectify a situation

Analysis 166 Aircraft Accident Report in which many pilots were not in compliance with a standard operating procedure. The Board stated that “overreliance on the air carrier to carry out its [the FAA’s] responsibility could limit the POI’s ability to maintain an adequate oversight program and monitor the operation for noncompliance.” The flight 1420 accident has brought attention to another circumstance of FAA overreliance on a carrier to perform oversight activities. Independent oversight for American’s MD-80 fleet is necessary, especially because three-quarters of the new upgrade captains and one-half of the new hire pilots are assigned to the MD-80 fleet, according to the APM. The Safety Board concludes that effective FAA oversight of American Airlines’ MD-80 flight training and flight operations has not occurred. In light of the comments made by the POI for American at the public hearing, the Board is concerned that similar oversight problems might be occurring in the company’s other fleets. Therefore, the Safety Board believes that the FAA should provide additional personnel to accomplish direct oversight of American Airlines’ flight training and flight operations and include the POI for American in decisions regarding where these personnel are to be placed. In addition, the Board encourages the FAA to review oversight staffing levels at all Part 121 and 135 carriers and make appropriate changes to ensure that effective oversight of flight training and flight operations is occurring.

167 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The captain and the first officer of American Airlines flight 1420 were properly certificated and qualified under Federal and company requirements. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. 2. The accident airplane was properly certified, equipped, and maintained in accordance with Federal regulations and approved company procedures. No evidence indicated preexisting engine, system, or structural failures. 3. During the descent into the terminal area, the flight crewmembers could have reasonably believed that they could reach the airport before the thunderstorm. 4. Because the first officer was able to maintain visual contact with the runway as the airplane was vectored for the final approach course, both flight crewmembers might still have believed that flight 1420 could arrive at the airport before the thunderstorm. 5. When the second windshear alert was received, the flight crew should have recognized that the approach to runway 4R should not continue because the maximum crosswind component for conducting the landing had been exceeded. 6. Because of the flight crew’s failure to adequately prepare for the approach and the rapidly deteriorating weather conditions, the likelihood of safely completing the approach was decreasing, and the need to take a different course of action was progressively increasing; as a result, the flight crew should have abandoned the approach. 7. Dynamic or reverted rubber hydroplaning did not occur during the accident airplane’s landing rollout. 8. The autospoiler system operated properly, and the spoilers did not automatically deploy because the spoiler handle was not armed by either pilot before landing. 9. A high level of operational redundancy should exist to ensure that spoiler arming has been completed before landing.

1. The flight crew failed to verify that the spoilers had automatically deployed after

landing, and the captain failed to manually extend the spoilers when they did not deploy.

Conclusions 168 Aircraft Accident Report

1. Because spoiler deployment is critical for optimal landing performance, procedures to

ensure that the spoilers have deployed after touchdown should be a required part of all air carriers’ landing operations.

1. The lack of spoiler deployment led directly to the flight crew’s problems in stopping

the airplane within the remaining available runway length and maintaining directional control of the airplane on the runway.

1. The use of reverse thrust at levels greater than 1.3 engine pressure ratio significantly

reduced the effectiveness of the airplane’s rudder and vertical stabilizer and resulted in further directional control problems on the runway.

1. The maximum reverse thrust for MD-80 landings on wet or slippery runways should

be 1.3 engine pressure ratio, except when directional control can be sacrificed for a marginal increase in deceleration.

1. Automatic brake systems reduce pilot workload during landings in wet, slippery, or

high crosswind conditions.

1. The lack of spoiler deployment was the single most important factor in the flight

crew’s inability to stop the accident airplane within the available runway length.

1. The flight crewmembers’ performance during the accident flight was degraded, as

evidenced by their operational errors and impaired decision-making.

1. The flight crewmembers’ focus on expediting the landing because of the impending

weather contributed to their degraded performance.

1. Aircraft penetration of thunderstorms occurs industry-wide.
2. The flight crew’s degraded performance was consistent with known effects of fatigue.
3. The local controller provided appropriate, pertinent, and timely weather information

to the flight crew regarding the conditions on approach to and at the airport.

1. If near-real-time color weather radar showing precipitation intensity were available, it

would provide air traffic controllers with improved representation of weather conditions in their areas of responsibility.

1. The ability of flight dispatchers to provide timely and accurate weather support would

be enhanced if they had access to Terminal Doppler Weather Radar information at airports where it is available and Weather Systems Processor information when the system becomes available.

1. Center Weather Service Units should be staffed at all times when any significant

weather is predicted to affect their areas of operation, even if the weather is predicted to occur before or after normal operating hours.

Conclusions 169 Aircraft Accident Report

1. The Automated Surface Observing System lockout period can prevent the relay of

critical weather information to flight crews.

1. Runway visual range data should be directly reported to automated weather systems.
2. The current 2-hour runway visual range archiving capability is inadequate to ensure

that data can be preserved for future use.

1. If detailed information on the Low Level Windshear Alert System were contained in

the Federal Aviation Administration’s Aeronautical Information Manual, pilots could have a better understanding of the system.

1. Part of the delay in locating the flight 1420 wreckage was preventable, and several

minutes in the emergency response time might have been saved if the Aircraft Rescue and Fire Fighting units had proceeded directly to the departure end of runway 4R.

1. Aircraft Rescue and Fire Fighting (ARFF) units may not be staffed at a level that

enables ARFF personnel, upon arrival at an accident scene, to conduct exterior firefighting activities, an interior fire suppression attack, and a rescue mission.

1. A crash detection and location technology would help expedite the arrival of

emergency responders at an accident scene, thus maximizing the possibility for saving lives and reducing the severity of injuries.

1. A timely postaccident interagency emergency response critique that identifies

deficiencies that need corrective action and successes that should be repeated in similar circumstances would be beneficial for all parties involved in an aviation accident response.

1. The development of recent technologies to convert nonfrangible structures to

frangible ones would provide a safety benefit to airport facilities.

1. American Airlines has insufficient guidance to assist its pilots in performing a

stabilized approach and recognizing when an approach has become unstabilized.

1. Because a stabilized approach is a critical part of safe flight operations, it is

imperative that air carriers have specific stabilized approach criteria.

1. Effective Federal Aviation Administration oversight of American Airlines’ MD-80

training and line operations has not occurred. 3.2 Probable Cause The National Transportation Safety Board determines that the probable causes of this accident were the flight crew’s failure to discontinue the approach when severe

Conclusions 170 Aircraft Accident Report thunderstorms and their associated hazards to flight operations had moved into the airport area and the crew’s failure to ensure that the spoilers had extended after touchdown. Contributing to the accident were the flight crew’s (1) impaired performance resulting from fatigue and the situational stress associated with the intent to land under the circumstances, (2) continuation of the approach to a landing when the company’s maximum crosswind component was exceeded, and (3) use of reverse thrust greater than 1.3 engine pressure ratio after landing.

171 Aircraft Accident Report 4. Recommendations As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendations: —To the Federal Aviation Administration For all 14 Code of Federal Regulations Part 121 and 135 operators of airplanes equipped with automatic spoiler systems, require dual crewmember confirmation before landing that the spoilers have been armed, and verify that these operators include this procedure in their flight manuals, checklists, and training programs. (A-01-49) For all 14 Code of Federal Regulations Part 121 and 135 operators, require a callout if the spoilers do not automatically or manually deploy during landing and a callout when the spoilers have deployed, and verify that these operators include these procedures in their flight manuals, checklists, and training programs. The procedures should clearly identify which pilot is responsible for making these callouts and which pilot is responsible for deploying the spoilers if they do not automatically or manually deploy. (A-01-50) Issue a flight standards information bulletin that requires the use of 1.3 engine pressure ratio as the maximum reverse thrust power for MD-80 series airplanes under wet or slippery runway conditions, except in an emergency in which directional control can be sacrificed for decreased stopping distance. (A-01-51) Require principal operations inspectors of all operators of MD-80 series airplanes to review and determine that these operators’ flight manuals and training programs contain information on the decrease in rudder effectiveness when reverse thrust power in excess of 1.3 engine pressure ratio is applied. (A-01-52) Require all operators of MD-80 series airplanes to require a callout if reverse thrust power exceeds the operators’ specific engine pressure ratio settings. (A-01-53) For all 14 Code of Federal Regulations Part 121 and 135 operators, require the use of automatic brakes, if available and operative, for landings during wet, slippery, or high crosswind conditions, and verify that these operators include this procedure in their flight manuals, checklists, and training programs. (A-01-54)

Recommendations 172 Aircraft Accident Report Establish a joint Government-industry working group to address, understand, and develop effective operational strategies and guidance to reduce thunderstorm penetrations, and verify that these strategies and guidance materials are incorporated into air carrier flight manuals and training programs as the strategies become available. The working group should focus its efforts on all facets of the airspace system, including ground- and cockpit-based solutions. The near-term goal of the working group should be to establish clear and objective criteria to facilitate recognition of cues associated with severe convective activity and guidance to improve flight crew decision-making. (A-01-55) Incorporate, at all air traffic control facilities, a near-real-time color weather radar display that shows detailed precipitation intensities. This display could be incorporated by configuring existing and planned Terminal Doppler Weather Radar or Weather Systems Processor systems with this capability or by procuring, within 1 year, a commercial computer weather program currently available through the Internet or existing stand-alone computer hardware that displays the closest single-site Weather Surveillance Radar 1988 Doppler data or regional mosaic images. (A-01-56) Provide U.S. air carriers operating under 14 Code of Federal Regulations Part 121 access to Terminal Doppler Weather Radar, at airports where the system is available, and access to the Weather Systems Processor, when it becomes available, so that their flight dispatch offices can use this information in planning, releasing, and following flights during periods in which hazardous weather might impact safety of flight. (A-01-57) In cooperation with the National Weather Service, ensure that Center Weather Service Units are adequately staffed at all times when any significant weather is forecast. (A-01-58) Modify automated weather systems to accept runway visual range (RVR) data directly from RVR sensors. (A-01-59) Maintain at least a 48-hour archive of 1-minute runway visual range data. (A-01-60) Provide additional information on the Low Level Windshear Alert System (LLWAS) in the Aeronautical Information Manual, including that an LLWAS alert is a valid indicator of windshear or a microburst. (A-01-61)

Recommendations 173 Aircraft Accident Report Issue a mandatory briefing item to tower controllers that describes the circumstances of this accident, including the interactions between the controller and Aircraft Rescue and Fire Fighting (ARFF) crews. This briefing item should emphasize that location information provided to ARFF crews should be as complete and specific as possible to minimize opportunities for confusion. (A-01-62) Amend Federal Aviation Administration Order 7110.65, “Air Traffic Control,” to require controllers to monitor the progress of Aircraft Rescue and Fire Fighting crews responding to emergencies to ensure that the response is consistent with known location information. (A-01-63) Amend Federal Aviation Administration (FAA) Order 7210.3R, “Facility Operation and Administration,” to direct tower managers to establish mutual annual briefings between air traffic control (ATC) and Aircraft Rescue and Fire Fighting (ARFF) personnel to ensure that these personnel have a common understanding of the local airport emergency plan and sections of the FAA’s Advisory Circular 150/5210-7C, “Aircraft Rescue and Firefighting Communications,” that are applicable to local ATC/ARFF emergency response procedures. (A-01-64) Amend 14 Code of Federal Regulations 139.319(j) to require a minimum Aircraft Rescue and Fire Fighting staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. (A-01-65) Evaluate crash detection and location technologies, select the most promising candidate(s) for ensuring that emergency responders could expeditiously arrive at an accident scene, and implement a requirement to install and use the equipment. (A-01-66) Develop specific criteria, using the Federal Railroad Administration’s requirements as guidance, to be evaluated during a postaccident interagency emergency response critique, and amend 14 Code of Federal Regulations Part 139 to require airport operators to conduct this critique within 60 days after any air carrier accident and provide the results of the critique to the Federal Aviation Administration. (A-01-67) Conduct research activities to determine if recent technological advances would enable submerged low-impact structures and other nonfrangible structures at airports to be converted to frangible ones. (A-01-68) Define detailed parameters for a stabilized approach, develop detailed criteria indicating when a missed approach should be performed, and ensure that all 14 Code of Federal Regulations Part 121 and 135 carriers include this information in their flight manuals and training programs. (A-01-69)

Recommendations 174 Aircraft Accident Report Provide additional personnel to accomplish direct oversight of American Airlines’ flight training and flight operations, and include the principal operations inspector for American in decisions regarding where these personnel are to be placed. (A-01-70) —To the National Weather Service In cooperation with the Federal Aviation Administration, ensure that Center Weather Service Units are adequately staffed at all times when any significant weather is forecast. (A-01-71) Eliminate the Automated Surface Observing System lockout feature as soon as possible. (A-01-72) In addition, the Safety Board reiterates the following recommendations to the Federal Aviation Administration: Establish within 2 years234 scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements (A-99-45) Require air carriers to adopt the operating procedures contained in the manufacturer’s airplane flight manual and subsequent approved revisions or provide written justification that an equivalent safety level results from an alternate procedure. (A-98-102) 234 As previously stated, because the 2-year timeframe specified in this recommendation has already expired, the Safety Board urges the FAA to expedite its efforts to accomplish this recommendation. BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman JOHN A. HAMMERSCHMIDT Member CAROL J. CARMODY Vice Chairman JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: October 23, 2001

175 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing Investigation The National Transportation Safety Board was initially notified of this accident on June 2, 1999, about 0115 eastern daylight time. A full go-team was assembled and departed about 0430 eastern daylight time from Ronald Reagan National Airport in Washington, D.C., for Little Rock. The team and arrived on scene about 0700 eastern daylight time (0600 central daylight time). Accompanying the team to Little Rock was Board Member George Black. The following investigative teams were formed: Aircraft Operations, Human Performance, Aircraft Structures, Aircraft Systems, Powerplants, Maintenance Records, Air Traffic Control, Meteorology, Aircraft Performance, Survival Factors, and Airport/Search/Fire/Rescue. Specialists were also assigned to conduct the readout of the FDR and transcribe the CVR in the Safety Board’s laboratory in Washington, D.C. Parties to the investigation were the Federal Aviation Administration (FAA), American Airlines, the Boeing Commercial Airplane Group, Pratt & Whitney Engines, the Allied Pilots Association, the Association of Professional Flight Attendants, the National Air Traffic Controllers Association, the National Weather Service, Little Rock National Airport, and Little Rock Fire Department. Public Hearing The Safety Board held a public hearing on this accident on January 26 through 28, 2000, in Little Rock. Former Chairman Jim Hall presided over the public hearing. The issues presented at the hearing were flight crew decision-making, availability and dissemination of weather data, aircraft performance, passenger safety and emergency response, runway overrun protection, American Airlines’ operational practices and procedures, American’s internal oversight, and the FAA’s oversight of American. Parties to the public hearing were the FAA, American, Boeing, the Allied Pilots Association, the Association of Professional Flight Attendants, the National Weather Service, Little Rock National Airport, and Little Rock Fire Department.

176 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is the transcript of the Fairchild A-100A cockpit voice recorder serial number 53282, installed on American Airlines flight 1420, a McDonnell Douglas MD-82, N215AA, that overran the end of the runway at Little Rock National Airport, on June 1, 1999. Note 1: Times are expressed in central daylight time (CDT).

Note 2: Generally only radio transmissions to and from the accident aircraft were transcribed. Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken. LEGEND RDO Radio transmission from accident aircraft CAM Cockpit area microphone voice or sound source PA PA voice transmitted over aircraft public address system INT Voice transmitted over aircraft interphone system CTR Radio transmission from Little Rock center controller APR Radio transmission from the Little Rock approach/tower controller -1 Voice identified as Pilot-in-Command (PIC) -2 Voice identified as Co-Pilot (SIC) -3 Voice identified as 1st female flight attendant -4 Voice identified as 2nd female flight attendant -5 Voice identified as aircraft mechanical voice -? Voice unidentified * Unintelligible word @ Non-pertinent word # Expletive

Break in continuity ( ) Questionable insertion [ ] Editorial insertion ..... Pause

Appendix B 177 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1119:44

START of RECORDING START of TRANSCRIPT

1119:53

CAM-2 I warmed it up pretty good.

1119:55

CAM-1 aah.

1119:56

CAM-2 like it. ** .…

1119:56

CAM-1 actually, it's getting pretty hot.

1120:07

CAM-2 did they complain about the temperature?

1120:09

CAM-1 naw, it's getting warm up here.

1120:11

CAM-2 ah, okay.

1120:15

CTR American fourteen twenty, are you gonna want still want lower?

1120:18

CAM-1 ah, so far it's okay.

1120:20

RDO-2 so far so good ma'am. fourteen twenty we'll let you know.

1120:24

CTR right.

Appendix B 178 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1120:52

CAM-2 twenty five for twenty four. set and armed.

1121:01

CAM-2 this stuff is working out pretty well. * get ahead of that stuff.

1121:45

CAM-1 **, we're almost down to max landing weight.

1121:55

CAM-1 we'll be there.

1121:57

CAM-2 yeah.

1122:17

CAM-2 you want to use one thirty, right?

1122:19

CAM-1 yeah, well. I don't know. we've got a hundred miles to go. yeah, I guess so.

1122:32

CAM-1 and we'll use flaps forty since **.

1122:35

CAM-2 sure.

1122:47

CAM-? **.

1122:50

CAM-? **.

1123:02

CAM-1 we're right on the edge of this **.

Appendix B 179 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1123:24

CAM-? **.

1123:58

CAM-2 this is the ground over here on the right.

1124:00

CAM-1 yeah I see an occasional ground **.

1124:13

CAM-? [sound of yawn]

1124:24

CAM-1 boy, this is too much (return).

1124:44

CAM [sound of "ding dong" similar to flight attendant call chime]

1124:47

CAM-2 there's a moon out there. or a space ship.

1124:53

CAM-1 yeah. the mother ship.

1124:56

CAM-2 [sound of chuckle] got your Nike's on?

1125:00

CAM-1 yeah, right.

1125:01

CAM-? [sound of chuckle]

1125:03

CAM-1 what was that guy's name?

1125:04

CAM-2 @, @ or.

Appendix B 180 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1125:06

CAM-1 yeah @.

1125:10

CAM-2 center pumps comin' off.

1125:11

CAM-1 all right.

1125:12

CAM [sound of two clicks]

1125:17

CAM-2 there's your big wadiddily.

1125:19

CAM-1 yeah.

1125:23

CAM-2 thirteen miles?

1125:25

CAM-? ***.

1125:30

CAM [sound similar to ice bag being struck in galley]

1125:47

CAM-1 we got to get over there quick.

1125:52

CAM-2 I don't like that…. that's lightning.

1126:00

CAM-1 sure is.

Appendix B 181 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1126:24

CAM-2 oh.

1126:40

CAM-1 that's about as far as we can go.

1126:41

CAM-2 yeah, I would say right about. maybe a little bit more and that's about it. we could start down here pretty soon.

1126:49

CAM-1 I'm gonna ask her to come **….

1126:52

CAM-1 this is the bowling alley right here.

1126:54

CAM-2 yeah, I know.

1126:59

CAM-1 in fact those are the city lights straight out there.

1127:01

CAM-2 that's it.

1127:07

CAM-2 want to go down?

1127:09

CAM-1 uuh, not just yet…. but, pretty soon.

1127:14

CAM-1 (seventy two), yeah.

1127:15

CAM-? **.

Appendix B 182 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1127:15

CTR American fourteen twenty descend and maintain one zero thousand. the, Little Rock altimeter, is two niner eight six.

1127:24

RDO-2 ten thousand, two niner eight six. American fourteen twenty, thanks.

1127:27

CAM-1 ten set and armed.

1127:28

CAM-2 thanks.

1127:31

PA-1 uh, we're now just uh, eighty miles from the airport and we have started our descent uh, toward it. quite a light show off the left hand side of the aircraft. we'll be passing that on our way toward Little Rock…. and we should be landing here in about uh, probably about twenty minutes. I'm gonna have to slightly over-fly the airport, in or.… order to turn back around to land. it's been a pleasure having you on board for this short flight and I'd like to take this opportunity to thank you for flying American Airlines.

1128:06

CAM-2 descent checks are complete.

1128:08

CAM-1 okay.

1128:23

CTR American fourteen twenty contact Memphis center one three five point eight. good day.

1128:27

RDO-2 thirty five eight, American fourteen twenty, good night.

Appendix B 183 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1128:30

CAM-1 we gotta get there quick.

1128:31

CAM-2 yep.

1128:44

RDO-2 American fourteen twenty leaving two two zero for one zero thousand.

1128:51

CTR Amer…. fourteen twenty, Memphis rog....

1129:02

CAM-2 sit'em down early?

1129:03

CAM [sound of "ding dong, ding dong" similar to flight attendant call chime]

1129:06

INT-3 this is Nancy.

1129:07

INT-1 yeah, how you guys uh, doing back there?

1129:08

INT-4 this is Jennifer.

1129:09

INT-1 yeah, how you guys doing back there?

1129:10

INT-4 um, pretty okay.

1129:11

INT-3 they're still out in the in the aisle with the cart doing the service.

Appendix B 184 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1129:14

INT-4 yeah.

1129:14

INT-1 really uh.…

1129:15

INT-3 yeah.

1129:15

INT-1 it's uh, I think it's gonna get a little bumpy here again and if you don't mind uh….

1129:18

INT-4 do we need to sit down?

1129:19

INT-1 yeah, how far through are you?

1129:21

INT-4 we're almost done but not quite, so….

1129:23

INT-1 okay, well, finish it real quick.

1129:24

INT-4 okay.

1129:25

INT-1 all right.

1129:25

INT-4 'bye.

1129:26

INT-1 'bye.

Appendix B 185 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1129:35

CTR American fourteen twenty, roger. Little Rock altimeter's two niner eight six.

1129:40

RDO-2 two niner eight six, American fourteen twenty.

1129:47

CAM-2 yeah, that alley's getting' big…. closing to the west.

1129:51

CAM-1 yeah it is.

1129:52

CAM-2

• be okay.

1129:55

CAM-2 I say we get down as soon as we can.

1129:59

CAM-1 two nine eight six?

1130:00

CAM-2

• nine eight six. altimeters are set and cross checked.

1130:09

CAM-2 aw #, no right side **.

1130:52

CAM-2 okay, hydraulic pumps are on, high, and on.

1130:55

CAM-1 okay.

1130:55

CAM-2 altimeters? two nine eight six.

Appendix B 186 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1130:59

CAM-1 reset, two nine eight six.

1131:00

CAM-2 flight instruments and bugs?

1131:02

CAM-1 uuh, I got a hundred, and thirty.

1131:06

CAM-2 yeah.

1131:08

CAM-1 with the flaps forty, a hundred and thirty thousand pounds. four hundred and sixty feet, two hundred feet ***….

1131:16

CAM-2 set and cross checked.

1131:18

CAM-2 tail de-ice? uh, not required?

1131:21

CAM-1 uh, not required.

1131:22

CAM-2 manual brakes?

1131:24

CAM-1 uuh, manual's fine.

1131:32

CAM-1 I have to go a little to the right here.

1131:33

CAM-2 yeah.

Appendix B 187 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1131:34

CAM-? (don't turn left)

1131:38

CAM-2 actually there's the city right there.

1131:39

CAM-1 yeah.

1131:42

CAM-2 breaking out of this (crud). good…. doing good.

1131:55

CAM-2 whoa. looks like it's movin' this way though.

1131:57

CAM-1 yeah *.

1131:58

CAM-2 ***.

1132:08

CAM-1

• just some lightning straight ahead.

1132:14

CAM-2 *** think we're gonna be okay. right there.

1132:18

CAM-? *.

1132:31

CAM-1 down the bowling alley.

1132:47

CAM-2 as my friends would say, California cool.

1132:51

CAM-1 cool.

Appendix B 188 Aircraft Accident Report of 38

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1132:52

CAM-2 [sound of chuckle]

1132:54

CAM-1 peachy.

1132:55

CAM-2 exactly.

1133:48

CAM-1 that's forty miles.

1133:49

CTR American fourteen twenty, contact Little Rock approach one three five point four.

1133:50

CAM-2 yeah.

1133:55

RDO-2 thirty five four, American fourteen twenty. you have a good night.

1133:57

CTR good night.

1134:05

RDO-2 American uh, fourteen twenty at uh, eleven three for ten thou- sand.

1134:11

APR American fourteen twenty, Little Rock approach roger. ah we have a thunderstorm just northwest of the airport moving uh, through the area now. wind is two eight zero at two eight, gusts four four and uh, I'll have new weather for you in just a moment I'm sure.

Appendix B 189 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1134:23

RDO-2 yeah we can see the uh, lightning and uh, you wanta repeat those winds again.

1134:28

APR right now the wind current wind is two niner zero at two eight, gusts four four.

1134:34

CAM-1 all right two eight zero at four four.

1134:36

CAM-2 gusts to forty four *.

1134:38

CAM-1 right near the limit.

1134:39

CAM-2 yeah, it's uh, forty degrees off. what's our cross(wind) *.

1134:43

APR American fourteen twenty expect an ILS runway two two left.

1134:46

CAM-1 thirty.

1134:47

RDO-2 two two left, we've got that, fourteen twenty.

1134:50

CAM-2 no that's that's *, you're, not out of the limits because of the angle *, but it's pretty close.

1134:56

CAM-1 yeah.

1135:21

CAM-2 two two left is the right one…. so uh….

Appendix B 190 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1135:29

CAM-2 I uh, I didn't realize that.

1135:32

CAM-? eerraaw.

1135:37

APR American fourteen twenty, descend at pilot's discretion. main- tain four thousand.

1135:40

RDO-2

• down to four thousand, American uh, fourteen twenty.

1135:46

CAM-1 four thousand set.

1135:50

CAM-2 okay, ten thousand foot, seatbelt sign no smoking.

1135:52

CAM [sound of "ding dong" similar to flight attendant call chime]

1135:53

CAM-1 yeah I'll get down in a second *.

1135:55

CAM-2 okay.

1136:02

CAM-2 yeah it's ten knots uh.…

1136:04

CAM-1 thirty knots is the crosswind limitation but….

1136:06

CAM-1 thirty knots is the…. wet, well.

Appendix B 191 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1136:08

CAM-2 that's the dry.

1136:09

CAM-1 yeah, dry.

1136:10

CAM-2 what about wet?

1136:11

CAM-1 wet.

1136:12

CAM-2 yeah.

1136:12

CAM-1 is twenty.

1136:13

CAM-2 ah, it's twenty five. aw, what the #.

1136:30

PA-1 flight attendants prepare for landing please.

1136:40

CAM-2 you got the NOTAMS, with ya?

1137:17

CAM-2 see the airport?

1137:18

CAM-1 see it blinking out there.

1137:20

CAM-2 ** to the north,

1137:20

CAM-1 straight ahead.

Appendix B 192 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1137:21

CAM-2 well there's a couple runways here so, the problem is we're sixteen miles south of the VOR and the airport's another five miles past that.

1137:29

CAM-1 all right. (doesn't) matter.

1137:32

CAM-2 so we've still got a little ways to go.… bad part..… I'll tell you what. I'm gonna stay on the run.… the VOR till we get a little closer.

1138:22

CAM-1 oh I think I see, I see where it is.

1138:25

CAM-2 yeah it's on **.

1138:26

CAM-1 it's straight up there, yeah….

1138:27

CAM-2

• (blinking) *.

1138:28

CAM-1 it looks like there's stratus a layer, right over there.

1138:36

CAM-2 * I definitely got . (I'll show you this later).

1138:54

CAM-1 he said there was a storm just northwest of the field?

1138:56

CAM-2 he said northwest.

Appendix B 193 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1138:57

CAM-1 yeah.

1138:58

CAM-2 lightning strike he said storm, uh.

1139:00

APR American fourteen twenty, descend and maintain, three thou- sand.

1139:03

RDO-2 out of four for three, American uh, fourteen twenty.

1139:06

APR American fourteen twenty uh, you're equipment's a lot better than uh, what I have. how 's the final for two two left lookin'?

1139:12

CAM-1 what's that?

1139:12

RDO-2 okay, we can uh, see the airport from here. we can barely make it out but uh, we should be able to make two two. uh, that storm is moving this way like your, radar says it is but a lit- tle bit farther off than you thought.

1139:23

APR American fourteen twenty roger, would you just want to shoot a visual approach?

1139:27

CAM-1 naw.

1139:28

RDO-2 uh, at this point we can't really make it out. we're gonna have to stay with you as long as possible.

Appendix B 194 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1139:32

APR American fourteen twenty roger. and uh, the winds kinda kicked around a little bit right now. it's three three zero, at uh, one one.

1139:38

CAM-1 whoa.

1139:39

RDO-2 okay, well that's a little bit, better than it was.

1139:42

CAM-1

• thirty is a, tailwind though.

1139:45

APR *.

1139:45

APR and uh, right now I have a uh, windshear alert. the center field wind is three four zero at one zero north boundary wind is three three zero at two five. northwest boundary wind is zero one zero at one five.

1139:53

CAM-? *.

1139:56

CAM-1 ** be landing on four?

1139:59

RDO-2 is there a possibility to get runway four?

1140:01

APR American fourteen twenty yes sir. we can do runway four if * you'd prefer that.

1140:05

CAM-1 it'd be a headwind.

Appendix B 195 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1140:06

CAM-2 yeah.

1140:06

CAM-2 I think we're gonna need.…

1140:08

RDO-2 …we would rather do the headwinds sir.

1140:09

APR I'm sorry, say again American fourteen twenty.

1140:12

RDO-2 yeah, we're gonna want the headwind of course…. runway four.

1140:19

CAM-1 we're going to three, right?

1140:20

APR American uh, fourteen twenty uh, turn right heading of uh, two five zero vectors for the ILS runway four right final approach course.

1140:22

CAM-2 yeah, three thousand.

1140:26

RDO-2 okay, a right turn to two five zero uh, the long way around?

1140:29

APR uh, yes sir, you're a little close to the airport.

1140:31

CAM-1 yeah right.

Appendix B 196 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1140:32

RDO-2 two five zero, that'll work.

1140:36

CAM-2 *, runway four.

1140:46

CAM-2 four right. one one one point three…. zero four two. I think we were, I think that was the airport right below us.

1141:02

CAM-1 yeah it was. okay, one eleven three.

1141:07

CAM-2 one eleven three. zero four two. four sixty on decision alti- tude.

1141:14

CAM-2 four thousand for three thousand, is armed.

1141:16

CAM-1 okay.

1141:19

CAM-2 uh, MSA is thirty three hundred feet all the way around.

1141:22

APR American fourteen twenty uh, maintain three thousand three hundred for now please.

1141:25

RDO-2 three thousand three hundred. we just saw it, thanks.

1141:28

CAM-1 yeah, the uh *.

Appendix B 197 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1141:31

CAM-2 okay. and two two seventeen glide slope intercept all the way down missed approach right turn to four thousand…. ***.

1141:57

CAM-2 let's see, you got the airport? tell you what. *.

1142:00

CAM-1 yeah. ** I don't have the airport.

1142:03

CAM-2 **, I'm saying you got the ILS.

1142:04

CAM-1 yeah, I got the ILS

1142:07

CAM-1 it's uh….

1142:13

CAM-2 yeah, there it is. I got the airport.

1142:16

CAM-1 okay, and decision height is four sixty.

1142:17

CAM-2 yeah.

1142:19

CAM-1 do you have the airport?

1142:20

CAM-2 *.

1142:20

CAM-1 is that it right there?

Appendix B 198 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1142:21

CAM-? okay.

1142:23

CAM-2

• see, I can't.

1142:24

CAM-1 I don't see a runway.

1142:26

CAM-2 go out this way.

1142:27

APR American fourteen twenty, it appears we have uh, second part of this storm moving through. the winds now, three four zero at one six, gusts three four.

1142:34

CAM-1 okay.

1142:35

RDO-2 roger that.

1142:40

CAM-2 you wanna accept a short approach? want to keep it in tight?

1142:42

CAM-1 yeah, if you see the runway. 'cause I don't quite see it.

1142:45

CAM-2 yeah, it's right here, see it?

1142:48

CAM-1 [sound of grunt] you just point me in the right direction and I'll start slowing down here. give me flaps eleven.

Appendix B 199 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1142:54

RDO-2 and uh….

1142:55

CAM-2 #, it's going right over the.… f-field.

1142:55

CAM-1 *.

1142:56

APR American fourteen twenty, did you call me?

1142:59

RDO-2 well we got the airport. we're going between clouds. I think it's right off my uh, three o'clock low, about four miles.

1143:05

APR American fourteen twenty, that's it. do you wanna shoot the visual approach or you wanna go out for the ILS?

1143:09

RDO-2 I can, we'll, we'll (start) the visual. if we we can do it.

1143:11

APR American fourteen twenty's cleared visual approach runway four right. if you lose it, need some help. let me know please.

1143:15

RDO-2 I'll stay with you as long as possible, OK?

1143:18

APR that's fine, I'm working everything, American fourteen twenty.

Appendix B 200 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1143:20

RDO-2 that works for me.

1143:21

APR all right.

1143:23

CAM-1 well you keep me straight.

1143:23

CAM-2 keep it right here, keep it right here, ** right here.

1143:25

CAM-1 what?

1143:26

CAM-2 okay, did you notice something? there's the airport right there. okay?

1143:31

CAM-1 where?

1143:31

CAM-2 okay, you're set up on a base for it. okay?

1143:33

CAM-1 I'm on a base now?

1143:35

CAM-2 well, you're on a dogleg. you're comin' in. there's the airport.

1143:38

CAM-1 uh, I lost it.

1143:39

CAM-2 right there, you're you're downwind. see it's right there.

Appendix B 201 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1143:44

CAM-1 I still don't see it. [sound of chuckle] well just vector me. I don't know.

1143:47

CAM-2 okay, well just go * right here.

1143:49

CAM-1 okay.

1143:59

APR American fourteen twenty, you can monitor one one eight point seven, runway four right, cleared to land. the wind right now three three zero at two one.

1144:05

RDO-2 eighteen seven, we'll monitor, American fourteen twenty, thanks. cleared to land runway four.

1144:10

CAM-1 ******.

1144:13

CAM-2 if you look at ….

1144:14

CAM-1 those red lights out there. where, where's that in relation to….

1144:18

CAM-2 there's another, there's two runways here. there's three run- ways.

1144:19

CAM-1 yeah I know. see we're losing it. I don't think we can maintain visual.

1144:22

CAM-2 ** yeah.

Appendix B 202 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1144:23

RDO-2 hold on and uh…..

1144:26

CAM-1 oh, you're on tower.

1144:27

CAM-2 oh, I'm sorry.

1144:28

RDO-2 and approach American fourteen twenty.

1144:29

APR American fourteen twenty, yes sir.

1144:30

RDO-2 and there's a cloud between us and the airport. we just lost the field and I'm uh, on this vector here, I have the uh, basi- cally last vector you gave us, we're on kind of a dog leg it looks like.

1144:39

APR American fourteen twenty, can you fly heading two two zero? I'll take you out for the ILS.

1144:42

CAM-1 **.

1144:43

RDO-2 yeah two two zero's fine.

1144:45

APR and it will be just one probably one turn on from uh, downwind to final, for the ILS.

Appendix B 203 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1144:49

RDO-2 'K that's how it's gonna have to be, thanks.

1144:51

CAM-2 yeah, I had it but I lost it with the clouds and that's what I was saying.

1144:54

CAM-1 okay.

1144:54

APR American fourteen twenty, descend and maintain two thou- sand three hundred.

1144:56

RDO-2 two thousand three hundred, American fourteen twenty.

1144:59

CAM-2 two thousand three hundred.

1145:00

CAM-1 set and armed. uh, now it is.

1145:07

CAM-2 #, * we had it.

1145:09

CAM-1 yeah. I just, I never saw the runway.

1145:11

CAM-2 no no, it's okay. I **.

1145:12

CAM [sound similar to stabilizer-in-motion horn]

1145:13

CAM-5 stabilizer motion

Appendix B 204 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1145:15

CAM-1 I hate droning around visual at night in weather without, having some clue where I am.

1145:23

CAM-2 yeah but, the longer we go out here the.…

1145:24

CAM-1 yeah, I know.

1145:25

CAM [sound similar to stabilizer-in-motion horn]

1145:26

CAM-5 stabilizer motion.

1145:29

CAM-2 see how we're going right into this crap.

1145:31

CAM-1 right.

1145:47

RDO-2 and approach American fourteen twenty, I know you're doing your best sir. we're getting pretty close to this storm. we'll keep it tight if we have to.

1145:52

APR

• American fourteen twenty uh, turn right heading of uh, two

seven zero.

1145:56

CAM [sound similar to stabilizer-in-motion horn]

1145:57

RDO-2 two seven zero, American fourteen twenty.

Appendix B 205 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1145:59

APR and uh, when you join the final, you're going to be right at just a little bit outside the marker if that's gonna be okay for ya.

1146:04

CAM-1 that's great.

1146:05

RDO-2 that's great with us.

1146:06

APR American fourteen twenty, roger.

1146:11

CAM [sound similar to stabilizer-in-motion horn]

1146:11

CAM-2 see we're right on the base of these clouds so.…

1146:13

CAM-1 yeah.

1146:14

CAM-2 … it's not worth it.

1146:15

CAM [sound similar to stabilizer-in-motion horn]

1146:20

CAM-2 two seven zero, two thousand three hundred?

1146:23

CAM-1 yes sir. * where I am.

1146:25

APR American fourteen twenty, turn right heading three, zero zero.

Appendix B 206 Aircraft Accident Report 30 o 38

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1146:29

RDO-2 right turn three zero zero American fourteen twenty.

1146:39

APR American fourteen twenty is uh, three miles from the marker. turn right heading zero two zero. maintain two thou- sand three hundred 'til established on the localizer. cleared ILS runway four right approach.

1146:43

CAM [brief sound of Morse Code identifier]

1146:47

RDO-2 zero two zero 'til established, American fourteen twenty, cleared four left approach.

1146:52

CAM-1 aw, we're goin' right into this.

1146:52

APR American fourteen twenty, right now we have uh, heavy rain on the airport. the uh, current weather on the ATIS is not cor- rect. I don't have new weather for ya, but the uh, visibility is uh, less than a mile. runway four right RVR is three thousand.

1146:53

CAM [sound similar to stabilizer-in-motion horn]

1147:04

CAM-1 three thousand.

1147:04

RDO-2 roger that, three thousand, American uh, fourteen twenty. this is four right, correct?

1147:07

CAM [sound similar to stabilizer-in-motion horn]

Appendix B 207 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1147:08

APR American fourteen twenty, that's correct sir. and runway four right, cleared to land. the wind three five zero at three zero, gusts four five.

1147:10

CAM-1 can we land?

1147:16

RDO-2 zero three zero at four five, American fourteen twenty.

1147:19

CAM-2 ** zero forecast right down the runway.

1147:22

CAM-1 three thousand RVR. we can't land on that.

1147:24

CAM-2 three thousand if you look at uh….

1147:26

CAM [sound similar to stabilizer-in-motion horn]

1147:27

CAM-1 what do we need?

1147:28

CAM-2 no it's twenty four hundred RVR.

1147:29

CAM-1 okay, fine.

1147:30

CAM-2 yeah, we're doing fine.

1147:31

CAM-1 all right.

Appendix B 208 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1147:34

CAM-1 uh, fifteen.

1147:36

CAM [sound of clicks similar to flap handle movement]

1147:40

CAM [sound similar to stabilizer-in-motion horn]

1147:44

CAM-1 lllanding gear down.

1147:46

CAM [sound similar to landing gear being operated]

1147:47

CAM [sound similar to stabilizer-in-motion horn]

1147:49

CAM-1 and lights ** please.

1147:51

CAM [sound similar to stabilizer-in-motion horn]

1147:52

CAM-5 stabilizer motion

1147:53

APR windshear alert, center field wind, three five zero at three two, gusts four five. north boundary wind three one zero at two niner. northeast boundary wind three two zero at three two.

1148:01

CAM [sound similar to stabilizer-in-motion horn]

1148:02

CAM-5 stabilizer motion.

Appendix B 209 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1148:03

CAM-2 flaps twenty eight?

1148:10

CAM-1 add twenty.

1148:12

CAM-2 right.

1148:12

CAM-1 add twenty knots.

1148:12

APR American fourteen twenty, the runway four right RVR now is one thousand six hundred.

1148:14

CAM-2 okay.

1148:17

CAM-2 aw #.

1148:18

CAM-1 well we're established on the final.

1148:20

CAM-2 we're established we're inbound, right.

1148:24

RDO-2 okay, American fourteen twenty, we're established inbound.

1148:26

APR American fourteen twenty roger, runway four right, cleared to land, and the wind, three four zero at three one. north wind, north uh, boundary wind is three zero zero at two six, north- east boundary wind three two zero at two five, and the four right RVR is one thousand six hundred.

Appendix B 210 Aircraft Accident Report 3 o 38

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1148:36

CAM [sound similar to stabilizer-in-motion horn]

1148:41

RDO-2 American uh, fourteen twenty, thanks.

1148:43

CAM-2 that's a good point.

1148:45

CAM [unidentified intermittent tone]

1148:47

CAM-2 keep the speed.

1148:50

CAM-2 thousand feet.

1148:54

CAM-1 I don't see anything. lookin' for four sixty.

1148:58

CAM [sound similar to stabilizer-in-motion horn]

1149:00

CAM-2 it's there.

1149:02

CAM-2 want forty flaps?

1149:04

CAM-1 oh yeah, thought I called it.

1149:05

CAM-2 forty now. thousand feet. twenty, forty forty land.

1149:10

CAM [unidentified tone similar to sound at time 1148:45]

Appendix B 211 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1149:10

APR wind is three three zero at two eight.

1149:12

CAM-1 this is, this is a can of worms.

1149:17

CAM [sound similar to stabilizer-in-motion horn]

1149:22

CAM [sound similar to stabilizer-in-motion horn]

1149:24

CAM-1 (I'm gonna stay above it a little)

1149:24

CAM-2 there's the runway off to your right, got it?

1149:26

CAM-1 no.

1149:27

CAM-2 I got the right runway in sight.

1149:30

CAM-2 you're right on course. stay where you're at.

1149:31

CAM-1 I got it, I got it.

1149:32

APR wind three three zero at two five.

1149:37.7 CAM-? wipers.

Appendix B 212 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1149:41.4 CAM [sound similar to windshield wiper motion]

1149:46.4 CAM-2 five hundred feet.

1149:50.1 CAM-? *.

1149:53.1 APR wind three two zero, at two three.

1149:53.7 CAM-1 plus twenty.

1149:56.6 CAM-? aw #, we're off course.

1149:57.6 CAM-? **.

1150:00.4 CAM-2 we're way off.

1150:01.5 CAM-1 I can't see it.

1150:04.4 CAM-2 got it?

1150:05.1 CAM-1 yeah I got it.

1150:07.9 CAM-2 hundred feet.

1150:09.4 CAM-? above.

Appendix B 213 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1150:11.1 CAM-2 hundred.

1150:12.8 CAM-5 sink rate.

1150:13.7 CAM-2 fifty.

1150:14.2 CAM-5 sink rate.

1150:14.5 CAM-2 forty.

1150:15.8 CAM-2 thirty.

1150:17.6 CAM-2 twenty.

1150:18.3 CAM-2 ten.

1150:20.2 CAM [sound of two thuds similar to aircraft touching down on run- way concurrent with unidentified squeak sound]

1150:22.2 CAM-2 we're down.

1150:24.4 CAM-2 we're sliding.

1150:26.1 CAM-1 #.… #.

Appendix B 214 Aircraft Accident Report

INTRA-COCKPIT COMMUNICATION

AIR-GROUND COMMUNICATION

TIME &

TIME & SOURCE

CONTENT

SOURCE CONTENT

1150:31.8 CAM-? on the brakes.

1150:33.1 CAM-? oh sh ….

1150:33.5 CAM [sound similar to increase in engine RPM]

1150:35.1 CAM-? other one, other one, other one.

1150:40.9 CAM-? aw #.

1150:41.6 CAM-? ##.

1150:43.8 CAM [sound of impact]

1150:44.3 CAM-? ##.

1150:46.9 CAM [sound of several impacts]

1150:48.1 END of RECORDING END of TRANSCRIPT

215 Aircraft Accident Report Appendix C Automated Surface Observing System Data Time Wind information Precipitation information 2 minute 5-second gust 1 minute 15 minute 2330 203° at 08 knots 244° at 09 knots 0.00 inch Trace amount 2331 241° at 11 knots 274° at 20 knots 0.00 inch 2332 273° at 19 knots 278° at 29 knots 0.00 inch 2333 291° at 25 knots 295° at 35 knots 0.00 inch 2334 298° at 27 knots 290° at 33 knots Trace amount 2335 298° at 26 knots 289° at 27 knots Trace amount 2336 289° at 21 knots 281° at 25 knots 0.01 inch 2337 286° at 15 knots 285° at 18 knots 0.00 inch 2338 304° at 17 knots 318° at 18 knots 0.01 inch 2339 320° at 17 knots 336° at 20 knots 0.02 inch 2340 320° at 17 knots 336° at 20 knots 0.01 inch 2341 338° at 17 knots 333° at 22 knots 0.01 inch 2342 351° at 18 knots 356° at 27 knots 0.01 inch 2343 359° at 21 knots 360° at 28 knots 0.02 inch 2344 352° at 20 knots 357° at 20 knots 0.02 inch 2345 320° at 17 knots 336° at 20 knots 0.03 inch 0.14 inch 2346 322° at 14 knots 333° at 16 knots 0.03 inch 2347 328° at 15 knots 329° at 26 knots 0.06 inch 2348 314° at 14 knots 283° at 11 knots 0.07 inch 2349 296° at 12 knots 291° at 20 knots 0.03 inch 2350 285° at 16 knots 302° at 22 knots 0.04 inch 2351 281° at 18 knots 291° at 21 knots 0.04 inch

Appendix C 216 Aircraft Accident Report Note: In the body of this report, wind directions were rounded to the nearest tenth. 2352 284° at 19 knots 287° at 24 knots 0.06 inch 2353 281° at 18 knots 287° at 21 knots 0.08 inch 2354 277° at 14 knots 264° at 14 knots 0.13 inch 2355 287° at 13 knots 296° at 18 knots 0.08 inch 2356 299° at 23 knots 317° at 76 knots 0.15 inch 2357 308° at 20 knots 281° at 16 knots 0.14 inch 2358 291° at 10 knots 241° at 21 knots 0.11 inch 2359 297° at 09 knots 012° at 08 knots 0.05 inch 0000 358° at 09 knots 023° at 14 knots 0.02 inch 1.09 inches Time Wind information Precipitation information 2 minute 5-second gust 1 minute 15 minute

FD07233 ｜ 2001_美国_HAR0101.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HIGHWAY ACCIDENT REPORT PB2001-916201 NTSB/HAR-01/01 MOTORCOACH RUN-OFF-THE-ROAD ACCIDENT NEW ORLEANS, LOUISIANA MAY 9, 1999 7381

this page intentionally left blank

THESE CORRECTIONS ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT: HIGHWAY ACCIDENT REPORT NTSB/HAR-01/01 (PB2001-916201)

MOTORCOACH RUN-OFF-THE-ROAD ACCIDENT NEW ORLEANS, LOUISIANA MAY 9, 1999

Page 50 has been updated to correct footnote reference number 145 for the Driver Program Unit, Oregon Department of Transportation, electronic-mail correspondence, May 2001.

THESE CORRECTIONS ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT:

this page intentionally left blank

Highway Accident Report Motorcoach Run-Off-The-Road Accident New Orleans, Louisiana May 9, 1999 NTSB/HAR-01/01 PB2001-916201 National Transportation Safety Board Notation 7381 490 L’Enfant Plaza, S.W. Adopted August 28, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Motorcoach Run-off-the-Road Accident, New Orleans, Louisiana, May 9, 1999. Highway Accident Report NTSB/HAR-01/01. Washington, DC. Abstract: On May 9, 1999, about 9:00 a.m., a 1997 Motor Coach Industries 55-passenger motorcoach, operated by Custom Bus Charters, Incorporated, was traveling eastbound on Interstate 610 in New Orleans, Louisiana. The bus, carrying 43 passengers, was en route from La Place, Louisiana, to a casino approximately 80 miles away in Bay St. Louis, Mississippi. As the bus approached milepost 1.6, it departed the right side of the highway, crossed the shoulder, and went onto the grassy side slope alongside the shoulder. The bus continued on the side slope, struck the terminal end of a guardrail, traveled through a chain-link fence, vaulted over a paved golf cart path, collided with the far side of a dirt embankment, and then bounced and slid forward upright to its final resting position. Twenty-two passengers were killed, the busdriver and 15 passengers received serious injuries, and 5 passengers received minor injuries. The following major safety issues were identified in this accident: • Inadequacy of the medical certification process, including the current Federal regulations. • Absence of a mechanism for identifying drivers who have tested positive for drugs. • Lack of Federal regulations or standards regarding passive and active occupant protection systems on large buses sold or operated in the United States. • Degraded condition of the guardrail posts along the interstate at the accident site. As a result of this accident investigation, the Safety Board makes recommendations to the Federal Motor Carrier Safety Administration, the American Association of Motor Vehicle Administrators, the National Conference of State Legislatures, the American Association of State Highway and Transportation Officials, and the State of Louisiana Department of Transportation and Development. In addition, the Safety Board is reiterating recommendations from its 1999 bus crashworthiness special investigation report to the National Highway Traffic Safety Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L'Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916201 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Busdriver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Medical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Medical Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Employment History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Violations Record . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Vehicle Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Roadside Barriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Guardrail Inspection Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Motor Carrier Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Motor Carrier Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Federal Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Passenger Compartment Safety Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Vehicle Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Passenger Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Accident Reconstruction and Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Medical Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Medical Examiner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Examination Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Medical Examination Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Alternative Qualifications, Exemptions, and Waivers . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Resolving Medical Evaluation Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Louisiana State Medical Qualification Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Medical Certification Program for Airmen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Previous Safety Board Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Recent Federal Initiatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Alcohol and Drug Testing Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Regulations on Commercial Vehicle Driver Drug Testing . . . . . . . . . . . . . . . . . . . . . . 42 Past Safety Board Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Recent Federal Initiatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Recent State Initiatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Contents iv Highway Accident Report Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 The Medical Certification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Medical Certification Process Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Adequacy of Examiner Qualifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Adequacy of the Federal Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Adequacy and Availability of Nonregulatory Guidance . . . . . . . . . . . . . . . . . . . . . . . . 57 Lack of a Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 The Lack of a Tracking Mechanism for Medical Certification Exams . . . . . . . . . . . . 60 The Role of Other Responsible Parties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Lack of Strong Certification Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Toward an Effective Medical Certification Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Drug Testing Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Bus Crashworthiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Guardrail Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Appendixes A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78 B: New Orleans Driver Medical Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79 C: Federal Motor Carrier Safety Ratings Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . .87 D: State Medical Certification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90 E: Instructions for Performing and Recording Physical Examinations . . . . . . . . . . . . . .96 F: Medical Advisory Criteria for Evaluation Under 49 CFR Part 391.41 . . . . . . . . . . . .99 G: State Laws Regarding Unfit Commercial Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . 110 H: Medical-Related Safety Board Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 I: International Commercial Vehicle Driver Certification Programs . . . . . . . . . . . . . . . 114 J: Drug-Related Safety Board Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

v Highway Accident Report Acronyms and Abbreviations AAAM -- Association for the Advancement of Automotive Medicine AAMVA -- American Association of Motor Vehicle Administrators AASHTO -- American Association of State Highway and Transportation Officials AME – aviation medical examiner ANPRM -- advance notice of proposed rulemaking BCT -- breakaway cable terminal C/TPA -- consortium or third party administrator CDL -- commercial driver’s license CFR -- Code of Federal Regulations CSS -- Consolidated Safety Services Custom -- Custom Bus Charters, Incorporated CVSA -- Commercial Vehicle Safety Alliance DER -- designated employee representative DMV -- Driver and Motor Vehicle Services Division DOT -- U.S. Department of Transportation DOTD -- State of Louisiana Department of Transportation and Development DVLA -- Driver and Vehicle Licensing Agency ECM -- electronic control module EEG -- electroencephalograph EMS -- emergency medical service EMT -- emergency medical technician FAA -- Federal Aviation Administration FHWA -- Federal Highway Administration FMCSA -- Federal Motor Carrier Safety Administration FMCSRs -- Federal Motor Carrier Safety Regulations I-610 -- Interstate 610 MCI -- Motor Coach Industries MCSAP -- Motor Carrier Safety Assistance Program MP -- milepost MRO -- medical review officer MTMC -- Military Traffic Management Command NBIS -- National Bridge Inspection Standards

Acronyms and Abbreviations vi Highway Accident Report NHTSA -- National Highway Traffic Safety Administration NOFD -- New Orleans Fire Department NOPD -- New Orleans Police Department NPRM -- notice of proposed rulemaking NYDMV -- New York Department of Motor Vehicles OMC -- Office of Motor Carriers OMCRS -- Office of Motor Carrier Research and Standards PCP -- phencyclidine SAP -- substance abuse professional SODA -- Statement of Demonstrated Ability SPE -- Skill Performance Evaluation TEA-21 -- Transportation Equity Act for the 21st Century THC -- tetrahydrocannabinol THC-COOH -- tetrahydrocannabinol carboxylic acid U.S.C. -- United States Code USFS -- U.S. Department of Agriculture Forest Service Products Laboratory

vii Highway Accident Report Executive Summary On May 9, 1999, about 9:00 a.m., a 1997 Motor Coach Industries 55-passenger motorcoach, operated by Custom Bus Charters, Incorporated, was traveling eastbound on Interstate 610 in New Orleans, Louisiana. The bus, carrying 43 passengers, was en route from La Place, Louisiana, to a casino approximately 80 miles away in Bay St. Louis, Mississippi. As the bus approached milepost 1.6, it departed the right side of the highway, crossed the shoulder, and went onto the grassy side slope alongside the shoulder. The bus continued on the side slope, struck the terminal end of a guardrail, traveled through a chain-link fence, vaulted over a paved golf cart path, collided with the far side of a dirt embankment, and then bounced and slid forward upright to its final resting position. Twenty-two passengers were killed, the busdriver and 15 passengers received serious injuries, and 6 passengers received minor injuries. The ensuing investigation established that the 46-year-old driver possessed a current commercial driver’s license and medical certificate, but suffered from several life-threatening medical conditions of the kidneys and heart. A witness riding in a van behind the bus stated that before the accident, she saw the bus drifting from the left lane to the center lane, then back to the left lane, before finally crossing the center and right lanes and departing the right side of the road. These observations corresponded with the statements of a passenger, who saw the busdriver “slouch down” as if reaching for a soda and then upright himself before slouching down again. The next thing this passenger remembered was waking up in the hospital. The National Transportation Safety Board determines that the probable cause of this accident was the driver’s incapacitation due to his severe medical conditions and the failure of the medical certification process to detect and remove the driver from service. Other factors that may have had a role in the accident were the driver’s fatigue and the driver’s use of marijuana and a sedating antihistamine. The following major safety issues were identified in this accident: • Inadequacy of the medical certification process, including the current Federal regulations. • Absence of a mechanism for identifying drivers who have tested positive for drugs. • Lack of Federal regulations or standards regarding passive and active occupant protection systems on large buses sold or operated in the United States. • Degraded condition of the guardrail posts along the interstate at the accident site.

Executive Summary viii Highway Accident Report As a result of this accident investigation, the Safety Board makes recommendations to the Federal Motor Carrier Safety Administration, the American Association of Motor Vehicle Administrators, the National Conference of State Legislatures, the American Association of State Highway and Transportation Officials, and the State of Louisiana Department of Transportation and Development. In addition, the Safety Board is reiterating recommendations from its 1999 bus crashworthiness special investigation report to the National Highway Traffic Safety Administration.

1 Highway Accident Report Factual Information Accident Narrative About 9:00 a.m. on May 9, 1999, a 1997 Motor Coach Industries (MCI), model 102DL3, 55-passenger motorcoach, operated by Custom Bus Charters, Incorporated (Custom), was traveling eastbound on Interstate 610 (I-610) in New Orleans, Louisiana. The bus, carrying 43 passengers, was en route from La Place, Louisiana, to a casino about 80 miles away in Bay St. Louis, Mississippi (figure 1). Visibility was good and the pavement, dry. As the bus approached milepost (MP) 1.6, it departed the right side of the highway, crossed the shoulder, and went onto the grassy side slope alongside the shoulder. The bus continued on the side slope, struck the terminal end of a guardrail, traveled through a chain-link fence, vaulted over a paved golf cart path, collided with the far side of a dirt embankment, and then bounced and slid forward upright to its final resting position (see figure 2). Twenty-two passengers were killed; the busdriver and 15 passengers received serious injuries, and 6 passengers had minor injuries. The injured were transported to four area hospitals. Figure 1. Accident area (map by Geographic Data Technology, Inc.).

Factual Information 2 Highway Accident Report Two witnesses in a van traveling eastbound in the center lane of I-610 told National Transportation Safety Board investigators that before the accident they saw a small green car in the center lane about 300 feet in front of them and a tour bus in the left lane beside the green car. They said that the bus drifted towards the center lane and almost hit the small car but then drifted back to the middle of the left lane. After that, the small car then slowed until it was no longer beside the bus. At this time, according to one witness in the van, the bus changed lanes without appearing to be drifting, crossed the center lane, and continued off the side of the road. She said that the bus was not out of control, did not have its brakes applied, and did not waiver or swerve in any direction. She said that it continued on a direct path and crashed into the embankment, then “flew through the air several feet and landed against a fence which was on the side of the interstate.” She added that she had not seen any vehicle in front of the bus before the lane change. The other witness in the van said that after the bus left the roadway, he pulled over to help. By this time, other vehicles had also stopped to help. At the time of the accident, New Orleans Police Department (NOPD) unit 303A was on routine patrol traveling westbound on I-610, when the officer driving noticed a red and white bus leaning against the chain-link fence on the eastbound right shoulder. Seeing Figure 2. Rescue workers attempt to stabilize the bus in its final resting position.

Factual Information 3 Highway Accident Report that the front end of the bus was heavily damaged, the officer pulled over onto the center emergency strip and notified his dispatcher of the accident at 9:02 a.m. The NOPD officer and the witness, who had previously pulled over his van, attempted to enter the bus through the left side. The witness stated that they tried first to break the side windows but when they could not, attempted unsuccessfully to enter the bus through other openings. The witness stated that he then moved toward the third or fourth window on the right side of the bus and saw an elderly woman hanging out of a side window with one of her feet trapped in the vehicle. When the witness could not remove the woman through the window, he tried to alleviate the pressure on her trapped foot by supporting her weight. He said that while supporting this passenger, he realized that he was standing on top of a body, which was underneath a large piece of shattered glass. After another rescuer arrived and pulled the body away from the side of the bus, the witness returned to supporting the woman. As he supported her, he peered into the vehicle and saw about four passengers on top of each other near the right side windows. By 9:10 a.m., fire and emergency medical service (EMS) personnel began arriving. The emergency medical technicians (EMTs) who arrived first at the accident scene told Safety Board investigators that they found 10 people on the ground outside of the bus, including the busdriver. The EMTs said that other victims were still in the bus and that the windows on the left side were still intact. The emergency responders entered the bus by breaking the left-side windows and removed the passengers. Emergency Response When the NOPD officer in unit 303A notified his dispatcher of the accident at 9:02 a.m., he requested emergency medical assistance. The NOPD dispatcher then initiated the incident emergency response and dispatched EMS personnel. At the same time, the dispatcher upgraded the incident from a priority one to a priority two incident, indicating that it was a mass casualty event. By 9:03 a.m., two other NOPD units were en route. At 9:04 a.m., the New Orleans Fire Department (NOFD) was notified. At 9:10 a.m., EMS contacted the NOPD dispatcher to request more EMS assistance. The dispatcher notified and dispatched additional NOPD and NOFD units to the accident site. By 11:03 a.m., 19 fatalities had been confirmed. EMS assistance continued to be dispatched until all of the passengers and the driver were removed from the scene. The NOPD cleared the accident scene at 10:51 p.m. In all, the NOPD dispatched approximately 30 personnel, including police officers, supervisory personnel, and public information officers. The NOFD dispatched 1 district chief; 7 fire captains; 4 equipment operators; 34 firefighters; and 12 fire units, including fire engines, a ladder truck, and a rescue truck to the accident scene. City Park Police officers also assisted with traffic control on the interstate, stabilization of the bus, and scene preservation.

Factual Information 4 Highway Accident Report Injuries Table 1 is based on the injury criteria of the International Civil Aviation Organization, which the Safety Board uses in accident reports for all transportation modes. Table 1. Injuries. Busdriver Information At the time of the accident, the 46-year-old busdriver had a current Louisiana Class B commercial driver’s license (CDL)1 with an expiration date of November 7, 1999. He also had a medical certificate, which was current until August 2000. The driver suffered serious injuries from the crash,2 but was treated and released. In August 1999, the driver returned to the hospital, where he died of “natural” causes, according to his autopsy report. Injuries* Driver Passengers Total Fatal 0 22 22 Serious 1 15 16 Minor 0 6 6 None 0 0 0 Total 1 43 44 *Title 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “Any injury which results in death within 30 days of the accident.” It defines serious injury as an injury that “(1) Requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second or third degree burns, or any burn affecting more than 5 percent of the body surface.” 1 A class B CDL allows an individual to drive a single vehicle with a gross vehicle weight rating of 26,001 or more pounds or any such vehicle towing a vehicle not in excess of 10,000 pounds, gross vehicle weight rating (49 Code of Federal Regulations [CFR] 383.91(a)(2)). 2 The driver sustained multiple fractures of his spinal column, a pelvic fracture, and thumb and finger fractures.

Factual Information 5 Highway Accident Report The driver was off duty on May 7 and 8, the 2 days before the day of the accident. On the afternoon of May 8, the driver underwent scheduled hemodialysis treatment3 between 2:55 and 6:35 p.m. According to medical records, he terminated the treatment early against medical advice. However, at 8:45 p.m., he returned to the hospital by ambulance because he was suffering from low blood pressure, dizziness, and nausea.4 He received one liter of intravenous fluid and was released at 11 p.m. The busdriver’s mother, with whom he lived, stated that he arrived home from the hospital about 11:30 p.m. She later heard him wake up about 5:30 a.m. Safety Board investigators were unable to obtain additional details from the busdriver himself because of the seriousness of his injuries and his refusal to be interviewed. According to the busdriver’s log entry for May 9, he conducted a pretrip inspection at 6:30 a.m. and left the bus terminal in Harvey, Louisiana, about 7:00 a.m. He then drove approximately 30 miles to La Place for a scheduled 8:00 a.m. pickup time at the Delchamps Grocery Store parking lot. Custom officials reported that he then drove to Kenner, Louisiana, where he made an unscheduled stop to pick up additional passengers. According to Custom, the unscheduled stop was agreed upon when the charter left La Place. At the time of the accident, the busdriver was en route to his last passenger pickup location, which was in east New Orleans, a short distance from the accident site. The driver was scheduled to arrive at the casino in Bay St. Louis, Mississippi, at 10:30 a.m. Toxicological Information Toxicological specimens of the driver’s blood and urine were obtained by the Safety Board from Charity Hospital, where the driver was transported for emergency medical treatment after the accident. The specimens were sent to the Civil Aeromedical Institute of the Federal Aviation Administration (FAA), in Oklahoma City, Oklahoma. Postaccident analyses of the busdriver’s blood and urine specimens detected the following: Blood: 8 (ng/ml, ng/g) tetrahydrocannabinol (THC) 48 (ng/ml, ng/g) tetrahydrocannabinol carboxylic acid (inactive metabolite of THC) 17 (ng/ml, ng/g) diphenhydramine Metoprolol 3 Hemodialysis describes the removal of certain elements from the blood by virtue of the difference in the rates of their diffusion through a semipermeable membrane, for example, by means of a hemodialysis machine or filter. This treatment is frequently used to treat end-stage kidney disease. 4 “Acute complications related to the dialysis procedure itself may severely compromise the quality of life in chronic dialysis patients. A mild degree of hypotension (low blood pressure) is normal in dialysis, but severe degrees may be disabling. Muscle cramps, chest or back pain, hypoxemia, fever, nausea, seizures, or cardiac arrhythmias may occur. In addition, mechanical problems related to dialysis machines, cartridges, and water purifiers may occur.” From “Morbidity and Mortality of Dialysis,” Consensus Statement No. 93, National Institutes of Health Consensus Development Conference, Bethesda, Maryland, November 1 through 3, 1993.

Factual Information 6 Highway Accident Report Urine: 193 (ng/ml, ng/g) tetrahydrocannabinol carboxylic acid5 Phenylpropanolamine Metoprolol Medical notes indicated that a 25-milligram oral dose of diphenhydramine had been given to the driver during hemodialysis at 3:30 p.m. on the day before the accident. Diphenhydramine is available over the counter as a sleep aid and is contained in many over-the-counter cold and allergy preparations, often in combination with a decongestant; it is also frequently used to control itching in dialysis patients. Diphenhydramine has both sedating and performance-impairing effects, and studies indicate that individuals may feel fine while on the medication but still be impaired in their driving performance.6 Phenylpropanolamine is available over the counter in numerous medications, frequently in combination with an antihistamine. It is often used as a stimulant (similar to caffeine) and can interfere with normal sleep. Recently, phenylpropanolamine has been the subject of Federal Drug Administration action to withdraw it from the market because of a very small but measurable risk of stroke, primarily in women who use it for weight loss.7 Metoprolol is a medication used to control blood pressure and other heart-related conditions. Although it is not typically regarded as impairing, it tends to reduce the heart’s response to stress. This tendency can increase the possibility of loss of consciousness with dehydration, as it prevents the heart rate from substantially increasing when blood pressure falls. The driver had been prescribed this medication. Small amounts of THC (the active substance in marijuana) and larger amounts of tetrahydrocannabinol carboxylic acid were detected in the driver’s blood collected more than an hour after the accident. Short-term effects of marijuana use include problems with memory and learning; distorted perception; difficulty in thinking and problem-solving; lethargy; loss of coordination; and increased heart rate, anxiety, and panic attacks.8 Medical Although the 46-year-old busdriver had a current medical certificate, which certified him as physically fit to drive a commercial vehicle, he suffered from several 5 The quantities listed for tetrahydrocannabinol exceed the reporting levels specified by the U.S. Department of Transportation in 49 CFR 40.87. 6 J.M. Weiler, J.R. Bloomfield, G.G. Woodworth, A.R. Grant, T.A. Layton, T.L. Brown, D.R. McKenzie, T.W. Baker, and G.S. Watson, “Effects of Fexofenadine, Diphenhydramine, and Alcohol on Driving Performance: A Randomized, Placebo-Controlled Trial in the Iowa Driving Simulator,” Annals of Internal Medicine, Vol. 132, No. 5 (2000): 354-363. 7 Information obtained on May 9, 2001, from the Center for Drug Evaluation and Research, Federal Drug Administration, Web site http://www.fda.gov/cder/drug/infopage/ppa/default.htm. 8 Information obtained on May 9, 2001, from the National Institute on Drug Abuse, National Institutes of Health, Web site http://www.nida.nih.gov/Infofax/marijuana.html.

Factual Information 7 Highway Accident Report serious medical conditions. Two years before the accident, the busdriver was diagnosed with dilated cardiomyopathy.9 This condition resulted in repeated admissions to the hospital for congestive heart failure.10 During hospitalizations in December 1998 and January 1999, he experienced several short asymptomatic episodes of ventricular tachycardia.11 Then, 2 months before the accident, the driver was admitted to the hospital for congestive heart failure and was subsequently placed on intravenous dobutamine12 therapy three times a week. In addition, the driver was diagnosed with kidney failure in July 1998 and had been scheduled to receive hemodialysis three times a week since December 1998. According to his medical records, during 5 months of dialysis treatment, he ended treatment prematurely on two occasions, and, on at least four occasions, did not keep appointments for scheduled treatment. Hospital and clinic records indicated that doctors and other medical staff were aware of the driver’s profession. (For further details, see appendix B.) A Custom representative stated that the company was aware of the driver’s kidney problems and hemodialysis treatments but had no knowledge of his heart condition. They had adjusted the driver’s work schedule to accommodate his medical treatments. As a result of the heart and kidney problems the driver had at the time of the accident, he was scheduled for hemodialysis treatment every Tuesday, Thursday, and Saturday (4 hours each day) and for outpatient intravenous dobutamine therapy every Monday, Wednesday, and Friday (3 hours each day). Medical Certification At the time he was hired by Custom in June 1997, the busdriver held a current Louisiana medical certificate, which was due to expire April 20, 1999. In March 1998, while on a trip to Shreveport, Louisiana, the driver contacted the dispatcher and advised that he was unable to complete the trip. He checked himself into a hospital, complaining of severe shortness of breath and sweating while moving luggage. He was transferred to Ochsner Hospital in New Orleans, where he was diagnosed with congestive heart failure. He was admitted to a hospital again in July 1998 for “progressive shortness of breath for 3 to 4 days.” Hospital records state, “The patient is on chronic medical therapy for this problem but continues to work. He gets breathless at low levels of activity….” As a result of his inability to complete a trip due to medical reasons and because of subsequent 9 Dilated cardiomyopathy is a disease of the heart muscle that leads to impaired heart function, enlargement of the heart, and congestive heart failure and is often associated with abnormal heart rhythms. The disease is generally progressive, with death usually occurring within 2 years of the onset of symptoms. 10 Inability of the heart to keep up with the demands on it and, specifically, the failure of the heart to pump blood with normal efficiency. When this occurs, the heart is unable to provide adequate blood flow to other organs such as the brain, liver, and kidneys. In the 2 years before the accident, the driver was diagnosed with congestive heart failure during five separate hospital admissions. 11 An abnormal heart rhythm that is rapid, regular, and originates from an area of the ventricle, the lower chamber of the heart. Ventricular tachycardias are life-threatening arrhythmias most commonly associated with heart attacks or the scarring of the heart muscle from a previous heart attack. 12 Dobutamine is often administered intravenously to patients with severe congestive heart failure to temporarily improve heart function.

Factual Information 8 Highway Accident Report hospital admissions, Custom had the driver submit to a medical examination, as is required under Federal regulations.13 The busdriver scheduled a commercial driver medical examination on August 19,

1. In a postaccident interview, the physician who performed the examination informed

Safety Board investigators that the driver initially indicated that he had no heart problems. She said that when the driver told her that he was taking warfarin, hydralazine, Lasix (furosemide), metoprolol, and Bumex (bumetanide),14 she asked again whether he had any heart problems, at which point he said that he had a history of high blood pressure and congestive heart failure. The physician told Safety Board investigators that she had performed commercial driver examinations before, “but not every day.” She stated that she had a page with limited guidance, including the regulations that covered the performance of the examination. She noted the regulatory restrictions regarding “no current clinical diagnosis of myocardial infarction, angina pectoris, coronary insufficiency, thrombosis, or any other cardiovascular disease of a variety known to be accompanied by syncope, dyspnea, collapse, or congestive cardiac failure,” but stated that at the time of the examination, the driver exhibited no current clinical evidence of congestive heart failure. Therefore, she believed that the regulations did not exclude him from operating a commercial vehicle. The examiner signed the busdriver’s medical certificate indicating that he was physically qualified to drive a commercial vehicle. The examiner informed Safety Board investigators that the driver had a trace amount of albumin in his urine,15 but that he had related no history of kidney disease. She said she recommended to the driver that he undergo an evaluation with his primary care doctor. The regulations themselves do not specifically address kidney disease, although examiner instructions following 49 Code of Federal Regulations (CFR) 391.43(f) do state that a urinalysis is required. The instructions that accompany the regulations also state that: Acute infections of the genitourinary tract, as defined by local and State public health laws, indications from urinalysis of uncontrolled diabetes, symptomatic albumin-urea in the urine, or other findings indicative of health conditions likely to interfere with the control and safe operation of a commercial motor vehicle, will disqualify an applicant from operating a motor vehicle. The examiner commented to Safety Board investigators that very little available guidance exists regarding cardiovascular issues for individual physicians, who must 13 Title 49 CFR 391.45 states that persons must be medically examined and certified as physically qualified to operate a commercial motor vehicle if their ability to perform normal duties has been impaired by a physical or mental injury or disease. 14 Warfarin is an anticoagulant used to prevent clotting. Hydralazine is an antihypertensive used to treat high blood pressure. Furosemide and bumetanide are diuretics often used to treat congestive heart failure. 15 The presence of albumin in the urine is a possible sign of kidney disease.

Factual Information 9 Highway Accident Report frequently rely upon their own judgment to determine whether a condition is disqualifying. Employment History The busdriver’s employment records showed the following information: May 1976–March 1989: The Regional Transit Authority employed the driver as a New Orleans public transit busdriver. He tested positive for marijuana in July 1988. He subsequently enrolled in, and successfully completed, a drug rehabilitation program. He was fired after a second positive drug test (for marijuana) in March 1989. 1988–1997: The driver was employed part-time by Turner’s Bus Service as a charter busdriver. April 1992–July 1996: The driver worked for Westside Bus Service as a public transit busdriver. He was fired because of a positive drug test (for marijuana). October 1996–April 1997: The driver worked for Hertz Corporation as a shuttle busdriver. He resigned following his third property damage accident. April 1997: The driver applied to Greyhound Lines, Inc., for a busdriver position. He underwent physical examination and preemployment drug screening and tested positive for cocaine. He was rejected for employment. June 1997–May 1999: The driver was employed by Custom as a busdriver. He underwent a preemployment drug test and three random drug tests during his tenure with negative results. When the New Orleans driver applied for the position at Custom, he listed his former positions with Hertz Car Rental and Turner’s Bus Service but did not mention the positions held with the Regional Transit Authority and with Westside Bus Service, where he had been fired for testing positive for marijuana. He explained the gaps in his employment record by stating that he was a musician in a brass band during those times. Custom sent authorized requests for information to both Hertz Car Rental and Turner’s Bus Service but did not receive a response from either company. Custom officials told Safety Board investigators that they considered the busdriver a part-time employee. In addition, they stated that he was thought to be a good driver and had not generated any customer complaints. Violations Record In 1977, the driver was convicted of drug possession, for which he received a suspended 2-year prison sentence. His motor vehicle record showed that between 1994 and 1998, he had been involved in three property damage accidents while driving a bus. He also had three convictions for traffic violations: a speeding violation in July 1996,

Factual Information 10 Highway Accident Report another speeding violation in August 1997 (the second offense was committed while operating a commercial vehicle), and a signs/signals violation in June 1997. Vehicle Information MCI of Pembina, North Dakota, manufactured the 55-passenger motorcoach in November 1996. Its overall length was 45 feet 6.25 inches, and its unladed16 weight was about 35,250 pounds. Its center of gravity was 39 inches above the ground.17 The motorcoach’s Detroit Diesel Series 60, 6-cylinder, 400-horsepower diesel engine was equipped with a DDEC III (Detroit Diesel, electronic control module, commonly referred to as an electronic control module [ECM]).18 This ECM did not contain active data pages that would have given a history of preaccident events (for example, speed, rpm, and braking). The motorcoach was equipped with an Allison model B500R automatic transmission with an integral “vane type” retarder. The motorcoach had a steering axle, a dual-wheel drive axle, and a self-steering auxiliary weight-bearing axle, commonly referred to as a tag axle.19 All of the wheels were equipped with air brakes. After the accident, the motorcoach was towed to the city impound lot. Safety Board investigators began inspecting the vehicle the day after the accident and performed a followup inspection on the self-steering tag axle on June 10, 1999. Data from the ECM revealed that two fault codes were recorded, one involving high engine coolant temperature and the other, high fuel temperature. The data indicated that both of these faults occurred at least 1,000 hours before the accident. The data also indicated that the engine had a governed speed of 75 mph and had traveled 194,337 miles. Investigators also removed the electronic control unit from the automatic transmission of the vehicle and examined it. The data extracted did not reveal any fault codes.20 The master switch for the transmission retarder was found in the “off” position.21 The coach was equipped with an air brake system that provided braking to all three axles and a Bendix DD3 emergency and parking brake system that operated only on the drive axle. The steering and drive axles had standard clamp-type foundation brakes (S-cam) with brake drums, and the tag axle had disc brakes. All of the brake shoes on the steering and drive axle were about 3/4 inches thick. The disc brake pads on the tag axle had been replaced with new pads 4 days before the accident. 16 Weight with no passengers or cargo. 17 As estimated by Motor Coach Industries staff. 18 The ECM’s primary function is to control fuel flow to the engine to provide maximum fuel economy and to meet Government emission standards. 19 A tag axle is a load-bearing, nondrive axle, located to the rear of a vehicle’s drive axle. 20 A fault code indicates a past or current defect in the transmission system. 21 A transmission retarder provides auxiliary braking forces to a vehicle and is activated when a driver releases his or her foot from the accelerator.

Factual Information 11 Highway Accident Report Due to extensive damage to air lines and valves, including the foot valve, the braking system could not be checked by supplying air to the external port and utilizing the foot valve (brake pedal). Therefore, the air chambers were plumbed directly into an external regulated air supply to obtain push rod measurements. All but one push rod measurement was within the maximum stroked allowed.22 One push rod was 1/8 inch over the maximum stroke allowed; based upon push rod travel, it was calculated that the brakes could still produce at least 90 percent of the forces that would be generated by a brake in good adjustment.23 The motorcoach was equipped with a TRW (Ross) hydraulically assisted power steering system with an integral steering gear box.24 A field examination of the steering system found that the steering wheel was deformed and the steering column displaced rearward. All of the linkages were still in place, but with some deformation. The axle stops were in place and undamaged. The steering gearbox and steering pump were removed and bench-tested at the manufacturer’s site; no defects were discovered. All six of the motorcoach tires were Bridgestone or Firestone radials, size 315/80R22.5, with highway tread. None of the tires were flat, with air pressure ranging from 84 to 100 psi. The inside of the left-front tire had a fresh cut, about 2 inches long; no other defects were noted. The tire tread depths were 5/32 inches or more. Federal regulations require that vehicles be placed out of service when the tire tread depth is less than 4/32 inches on the front wheels and less than 2/32 inches on the other wheels.25 Highway Information I-610 at the accident site has a speed limit of 60 mph, with three eastbound lanes and three westbound lanes, divided by a 32-inch-tall concrete median barrier. All lanes are 12 feet wide, with a 9-foot-wide inside shoulder, a 10-foot-wide outside shoulder, and a 30-foot-wide grassy side slope. Four-inch-wide and 10-foot-long broken retroflective painted white lines, spaced at 25-foot intervals, separate the travel lanes in each direction. A 6-inch-wide painted solid yellow edge line delineates the inside shoulder, and a 6-inch-wide retroflective painted solid white edge line delineates the outside shoulder. An overpass (bridge) near MP 1.6 accommodates a golf cart path under I-610. The overpass was situated on a 200-foot-long vertical curve with a 1.3-percent grade. The bus left the roadway approximately 180 feet west of the overpass, near the beginning of the transition to the vertical curve. 22 Commercial Vehicle Safety Alliance, North American Standard Out-of-Service Criteria (Bethesda, Maryland: CVSA, 2001). 23 R.B. Heusser, Heavy Truck Deceleration Rates as a Function of Brake Adjustment, Society of Automotive Engineers technical report 910126, 1991. 24 The term integral refers to the rotary control valve, hydraulic cylinder, and mechanical gears being located inside the gearbox housing, as opposed to being mounted in three separate locations. 25 Title 49 CFR 393.75 (b) and (c).

Factual Information 12 Highway Accident Report Gouge marks could be seen on the embankment on the far side of the golf cart path. A set of compressed grass tire marks was found on the grassy side slope. The angle of departure of the tire marks was between 6 and 7 degrees. At the time of the accident, the roadway and side slope were dry. (See figure 3.) Roadside Barriers A blocked-out W-beam (strong post) guardrail (barrier) system was attached to the bridge rail on the right side of the roadway. The W-beam guardrail, which is considered a component of the highway bridge, is the most common type of barrier system in use today, according to the American Association of State Highway and Transportation Officials (AASHTO). Crash tests have shown that this system can redirect vehicles in the 1,760- to 4,400-pound range.26 During testing, it has also redirected a 4,620-pound van, traveling at 57 mph and impacting at a 21-degree angle. This barrier system is not designed to restrict encroachment for heavier vehicles or vehicles with a higher center of gravity, such as motorcoaches and heavy trucks. 27 The guardrail system at the accident site was upgraded during a highway restoration project on I-610 in 1989. The system consisted of galvanized steel W-beam guardrail elements, supported by 6-foot-long wooden posts, 26-inch-long timber spacers, and a breakaway cable terminal (BCT) end assembly. The guardrail was approximately 27 inches high, with wooden posts spaced 6.25 feet apart. The end treatments of the guardrail were designed to prevent a passenger vehicle from becoming impaled on the guardrail, and the BCT ends were designed to fail at impact. The BCT had two endposts that were Figure 3. Departure angle of the bus, based on the 6- to 7-degree tire marks located on the grassy side slope of the roadway. 26 Vehicles are commonly tested using a speed of 60 mph and an approach angle of 25 degrees. (American Association of State Highway and Traffic Officials, Roadside Design Guide [Washington, DC: 1996] 5-10). 27 In tests to establish upper performance limits, this barrier system failed in a van and a school bus test (approach angles of 25 degrees) due to the rolling of the respective vehicles (Roadside Design Guide, 5-10).

Factual Information 13 Highway Accident Report attached to galvanized steel footings and designed to shear off when hit by a small truck or automobile, with the cable attached to the rail and footing designed to slow down the vehicle. The wooden posts were pretreated with preservatives before installation. According to the AASHTO Roadside Design Guide,28 preservative-treated wooden posts, such as the ones used at the accident site, require almost no maintenance, except for an occasional cleaning and treatment. During the collision sequence, the bus collided with the guardrail near the BCT, fractured 11 wooden posts, and damaged a 33-foot-long section of W-beam guardrail. (See figure 4.) During the investigation, Safety Board investigators found that some of the wooden posts were infested with termites. Due to the extensive collision damage to the posts, the exact number of posts with termite damage could not be determined. Portions of posts, with and without termite damage, were sent to the U.S. Department of Agriculture Forest Service Products Laboratory (USFS) for evaluation. According to the USFS report, two of the four samples had considerable termite damage, with a clear indication of feeding galleries, excrement, and soil. The USFS report noted that material suffering such 28 Roadside Design Guide, 5-17. Figure 4. Fractured wooden posts at accident site.

Factual Information 14 Highway Accident Report severe attack from termites would have had considerably lower mechanical properties, including shear strength. It stated that a “large portion of the original woody material has been removed reducing the post’s ability to resist impact loads.” Safety Board investigators then conducted 16 random inspections of guardrail systems constructed with wooden posts along the interstate system near New Orleans. Evidence of insect damage was observed at 3 of the 16 locations (19 percent) inspected. Several of the wooden posts at the three sites exhibited termite damage. The State of Louisiana Department of Transportation and Development (DOTD) replaced 11 wooden posts and spacers, the 33-foot-long section of W-beam guardrail, and the BCT end assembly damaged by the bus. Since the postaccident repairs to the guardrail system, DOTD has replaced five additional (nearby or adjacent) wooden posts that were not damaged in the accident but showed signs of insect infestation and reduced impact resistance. Guardrail Inspection Programs Federal. As noted previously, the guardrails involved in this accident were a component of a bridge overpass. The Federal Highway Administration (FHWA) National Bridge Inspection Standards (NBIS) constitute the Federal standards for bridge structures and guardrail designs. The States use FHWA standards for their bridge inspection programs but set their own maintenance policies. Federal standards do not address the inspection of guardrails apart from the bridge structures. Further, Federal standards do not address the inspection of guardrail posts (wooden or metal) or the effects of insect infestation or corrosion on a guardrail system. Louisiana Department of Transportation and Development. According to DOTD,29 the State’s inspection program follows the guidelines and specifications of the NBIS. DOTD also uses supplemental guidelines for bridge inspections based on the Federal standards.30 DOTD inspects its bridges and associated components, such as any attached superstructures and substructures, including guardrails, as a unit. These bridge structures are inspected for structural integrity as well as for major safety defects. DOTD does not specifically inspect the guardrail wooden posts and spacer blocks for termite or insect infestation. The guardrails are inspected during the bridge inspection, as required by the Federal standards, and are noted in the bridge inspection report. Normally, the bridge structures are inspected every 2 years, or every year if they have any critical safety features. DOTD has inspected the bridge at the accident site every 2 years. The DOTD National Bridge Inspection Report for 1995 indicated Very Good Condition—no problem 29 Robert Wegener, Jr., District Maintenance Engineer, DOTD. 30 Texas, Arkansas, Mississippi, Alabama, and Florida also use supplemental guidelines based on the NBIS.

Factual Information 15 Highway Accident Report noted; and for 1997, Good Condition—some minor problems. No further guardrail system explanation was cited. The DOTD bridge inspection reports do not refer to insect damage to the wooden posts. Motor Carrier Information Custom was an interstate, for-hire, carrier of passengers providing service within the continental United States and Canada, operating under the authority of the U.S. Department of Transportation (DOT). The company began operations in 1990 as a limousine service for the New Orleans area. In 1992, it began charter operations. Custom operated terminals in Harvey, Baton Rouge, and Lafayette, Louisiana, and Council Bluffs, Iowa. At the time of the accident, the company employed 147 workers, including 57 full-time drivers and 36 part-time drivers, as well as office and maintenance personnel. The average age of a Custom driver was 50 years. Custom ceased operations on July 1, 1999, for reasons stemming from this accident.31 At the time of the accident, Custom had 45 motorcoaches, 16 shuttle buses, and four 15-passenger vans. The motorcoaches were leased from Financial Services, Inc., of Norwalk, Connecticut; the average age of the fleet was 2 years. Custom officials reported that their business was 80 percent charter service. Custom also ran a shuttle service to and from the New Orleans airport and downtown area. Custom operations recorded 3.2 million miles traveled from May 1998 to May 1999. Motor Carrier Oversight Custom’s safety director had previously been a company busdriver. His duties included inspecting the logbooks of both local and long-distance drivers. He also conducted new-hire training and in-service training every 6 months for company drivers. Training topics have included driving a motorcoach, drug and alcohol testing, highway driving hazards, pretrip vehicle inspections, and hours-of-service regulations.32 The safety director was a State-certified third-party tester33 for CDL training. He said that he used five of Custom’s most experienced drivers to administer road tests to other drivers. Custom started its random drug testing program in 1996, in compliance with the Federal Motor Carrier Safety Regulations (FMCSRs), 49 CFR 382. Custom contracted with MRO Associates to conduct the company’s preemployment and random drug tests and to provide the services of a medical review officer (MRO) to analyze the test results. Company drivers were selected for random testing through a computer-generated program in the MRO’s office. The MRO notified Custom’s director of operations to advise a driver to report for testing within 3 hours, and the director, in turn, completed a slip to be 31 Kenneth Begovitch, former owner of Customer Bus Charters, Inc. 32 Terrell Walker, Safety Director, Custom Bus Charters, Inc. 33 Entity authorized by the State to administer skills tests to commercial drivers.

Factual Information 16 Highway Accident Report given to that driver. Failing to report within the required 3 hours was considered a refusal and resulted in the driver being terminated. If a driver were operating a charter trip when his name came up on the random list, he or she would be given the slip upon returning from the trip to report for the test. According to Custom, drivers had no advance warning of a test. Custom officials reported a “no tolerance” policy on positive drug test results, noting that the company terminates drivers who test positive. According to summary reports from the MRO’s office, 1 test out of the 100 administered in 1998 was positive. No refusal determinations34 occurred. Two tests out of the 106 administered in 1997 were positive, with both positive results coming from preemployment drug tests. Again, no refusal determinations occurred. Federal Oversight During its operations, Custom received three FHWA Office of Motor Carriers (OMC)35 compliance reviews.36 These occurred on February 12, 1996; June 1, 1998; and March 19, 1999. (See appendix C for information on Federal motor carrier ratings procedures.) Custom requested the February 1996 review because it needed a satisfactory rating to pursue a contract with the Military Traffic Management Command (MTMC) to transport military personnel. The subsequent review resulted in a “satisfactory” rating, although deficiencies were found in driver recordkeeping, hours of service, and the company’s drug and alcohol testing program. On July 10, 1996, Consolidated Safety Services (CSS), the civilian contract provider for the MTMC, conducted its own compliance review of Custom. The CSS review rated Custom “unsatisfactory,” based on deficiencies in driver recordkeeping, hours of service, and the company’s drug and alcohol testing program. (The Federal Motor Carrier Safety Administration [FMCSA] was aware of the CSS review’s findings.) During the June 1998 compliance review, inspectors found that one of Custom’s drivers had falsified his medical examiner’s examination date on the medical form. Several logbook and hours-of-service violations were also noted in the review, resulting in a “conditional” rating. 34 According to 49 CFR 382.107, there are nine circumstances in which a driver is considered to have refused to submit to a drug test. Included among these are the submission of a specimen verified to be substituted or adulterated and the failure to undergo a medical examination or evaluation as directed by the MRO as part of the verification process. 35 The 1999 Motor Carrier Safety Act separated the OMC from the FHWA and created a new administration called the Federal Motor Carrier Safety Administration (FMCSA). The FMCSA now handles compliance reviews and all other highway commercial transportation safety functions. 36 Title 49 CFR Part 385.3 defines “compliance review” as an on-site examination of motor carrier operations, such as drivers’ hours of service, maintenance and inspection, driver qualification, CDL requirements, financial responsibility, accidents, hazardous materials, and other safety and transportation records, to determine whether a motor carrier meets the safety fitness standard.

Factual Information 17 Highway Accident Report The March 1999 compliance review, which also resulted in a conditional rating, was conducted as an enforcement followup to the 1998 review. This review found that Custom operated a motorcoach that did not comply with local laws, ordinances, and regulations, a critical element in the rating process.37 Another critical element noted in the review was Custom’s high accident rate based on the number of miles traveled during the past year. In June 1999, the Custom safety director petitioned the FHWA to reconsider the rating from the March compliance review. The petition asserted that during the compliance review, the mileage generated by the shuttle service was omitted in calculating the accident rate for the company. The increase from 1.8 million miles traveled to the correct figure of 3.2 million miles traveled lowered Custom’s accident rate from 2.710 to 0.647 per million miles traveled. This rate was below the national average of 1.6 per million miles for motor carriers. With this modified accident rate, the FHWA changed Custom’s overall rating from conditional to satisfactory. Survival Aspects Passenger Compartment Safety Features The safety features of the accident bus are described in table 2. Table 2. Passenger Compartment Safety Features. Vehicle Damage The motorcoach body sustained massive frontal crush deformation within the driver, stairwell, and forward passenger areas, compromised by front axle upward intrusion into the floorboard. (See figures 5 and 6.) The dashboard instrument panel, steering wheel, and driver’s seat and partition had been crushed downward and rearward. 37 Custom was cited for operating a bus without a current State inspection sticker. Component Dimensions Feature Side windows (16) Driver side-8; passenger side-8 34 inches high, 52 inches wide, separated by 5.5-inch sidewall; bottom ledge 28.5 inches from floor All designated as emergency exit windows Front windshield (2 panes) 44.5-inch-wide panes: left-side glazing—42.5 inches high, right-side glazing—47 inches high Each with own visor, separated by 1.5 inches of metal frame Front window (1) 14.5 inches high, 90.5 inches wide Positioned 2 inches above windshield Emergency exit hatches (2) 29 inches long, 20 inches wide On roof Driver seat (1) — Three-point belt Passenger seats (55) — No seat belts

Factual Information 18 Highway Accident Report The forward passenger compartment floorboard had been deformed upward toward the interior roof in the first three rows. The first four left- and right-side window frames sustained damage, and the glazing38 was missing or shattered in most. Emergency responders removed seats 9 and 10, 13 through 18, 21 and 22, and 25 and 26 to extricate surviving and deceased passengers. (See figure 7 for seat layout.39) Seats 1, 2, 7, and 8 sustained partial separation of the vertical mounting leg of the “T” pedestal at the horizontal base that was attached to the seat track due to vehicle crush formation and intrusion. Some, but not all, seats rearward of the third row sustained varying degrees of frame damage. Seatbacks of these seats were deflected forward at different angles due to the accident sequence and to emergency responder activity during rescue operations. Passenger Statements One passenger told Safety Board investigators that she had been sitting on the right side of the bus in seat 12 when the accident occurred. She stated that she did not notice any sudden lane changes and that she did not observe other vehicles in the path of the bus before or after it left the roadway. She said that she recalled seeing the busdriver “slouch down,” and added, “I thought he was reaching for a coke. He came back up then went down again. Next thing I remember is waking up in Charity Hospital.” 38 Describes glass or other transparent materials used for windows. 39 Due to a lack of responses to a questionnaire mailed out to survivors of the crash and to the high number of passenger fatalities, a passenger seating chart could not be generated for this accident. Figure 5. Body damage to bus, which had been moved from its resting position when this photograph was taken (photograph by the New Orleans Police Department).

Factual Information 19 Highway Accident Report A second passenger reported that she was seated in the middle section of the bus in an aisle seat at the time the accident occurred. This passenger recalled that the ride was “nice and peaceful”; she did not recollect any maneuvering of the bus before the accident. She stated that she was thrown forward and landed on top of another passenger in the aisle and that she next awoke in the hospital. Another passenger stated that she was seated in the rear section of the bus in seat 48, facing rearward, when the accident occurred. She did not recall the bus making any maneuvers before the accident. For a time after the accident, she did not recall anything, but then awoke, still in her seat, and found emergency responders helping the injured. She stated that the emergency responders were “there right away.” Accident Reconstruction and Simulation As part of the Safety Board’s investigation, simulations were conducted to determine the estimated speed of the bus before leaving the roadway, its speed before impact with the breakaway cable guardrail, its vault speed over the golf cart pathway, and energy calculations for the crush of the accident bus on the upward sloping embankment. To crosscheck these calculations and to determine the occupant kinematics, the accident was simulated using a Human Vehicle Environment40 system. The speed of the bus before it left the roadway was estimated using the vault distance, the energy to break the guardrail posts, and witness accounts. Based on the bus trajectory over the golf cart pathway and the marks on the opposite side embankment, the bus’s speed before takeoff was calculated at 58 mph. Before the vault, the bus impacted Figure 6. Driver’s side view of the damaged bus (photograph by the New Orleans Police Department). 40 Developed by the Engineering Dynamics Corporation.

Factual Information 20 Highway Accident Report Figure 7. Seat layout.

Factual Information 21 Highway Accident Report and fractured 11 guardrail posts. Based on the energy dissipated by deforming the guardrail, fracturing the posts,41 and deforming the front of the bus, the bus speed before hitting the guardrail was calculated at between 58.6 and 61.9 mph. This range corresponds with statements made by the witness following the bus, that it was traveling approximately 60 mph before drifting off the roadway. The simulation study indicated that the bus underwent an 18-mph change in velocity during the initial 100 milliseconds of the impact with the opposite side embankment. Figure 8 illustrates a time history of the bus’s first and second impacts with the embankment and its slide to a final rest position. The simulation showed that upon initial impact of the bus with the embankment, simulated passengers located in the front and rear of the bus were propelled forward with roughly the same amount of force (longitudinal acceleration). However, the vertical accelerations experienced by passengers in the front and rear were different. (See figure 9.) Upon initial impact, passengers at the front of the bus were forced downward into the seat cushion, while those at the back of the bus were lifted from the seat. The passengers placed in the center of the bus were not as affected by the vertical accelerations. These acceleration differences help to explain the greater severity of the injuries and the displacement of the occupants in the front of the bus. During the second impact, when the back of the bus hit the embankment, longitudinal accelerations were low, but vertical accelerations again increased in the opposite direction for front and rear passengers. Here, simulated occupants at the back of the bus were forced downward while those at the front of the bus were elevated above the seats. The upward acceleration of the simulated occupants at the front of the bus, relative to the bus reference frame, appeared to be critical in facilitating ejection out of the front of the bus as the bus continued to decelerate during the slide to final rest. 41 This simulation assumed undecayed wooden posts.

Factual Information 22 Highway Accident Report

Figure 8. Simulation of primary and secondary bus impacts with the embankment. Time = 0 seconds Time = 0.7 seconds Time = 1.1 seconds Time = 1.9 seconds

Factual Information 23 Highway Accident Report Figure 9. Longitudinal and vertical accelerations at front and rear of bus. -40 -30 -20 -10 0 10 20 Primary Impact Secondary Impact Vertical Acceleration (G) Front of Bus Rear of Bus

24 Highway Accident Report Other Information According to medical records obtained by Safety Board investigators, the New Orleans driver had a severe cardiac condition and end-stage renal failure. In addition, he had been released from two jobs and was rejected by another potential employer for positive drug tests. Because of the circumstances leading to this accident, the Safety Board focused its investigation and part of a subsequent public hearing on two specific areas: the medical certification of commercial drivers and drug testing procedures used for commercial vehicle operations. This section describes the current medical certification process for interstate commercial drivers, including pertinent Federal regulations, and discusses actions taken by the Safety Board, FHWA, and the FMCSA to improve the process. Following that discussion is a description of drug testing procedures and of Safety Board and Federal actions to improve drug testing. Medical Certification Medical certification, which qualifies an individual as being fit to drive a commercial vehicle, became a Federal requirement under the Motor Carrier Act of 1935. The first physical qualification standards were established in 1939 and required that drivers be in good physical and mental health and have good eyesight, adequate hearing, and no addiction to narcotic drugs or alcohol. These qualifications have been modified and expanded three times since then, with the most recent major modification occurring in 1970.42 The Driver and Carrier Operations Division of the FMCSA has medical oversight over approximately 400,000 interstate carriers and 9 million commercial drivers. It does not have regulatory authority over the health care professionals who conduct the commercial driver examinations. In 1999, the division had a fiscal year budget of slightly over 1 million dollars.43 The division employs three registered nurses (two full-time and one part-time) and a transportation specialist at FMCSA headquarters. Three full-time health and welfare specialists are being hired to assist with the vision exemption program and in the development of driver qualification regulations. In addition, each of four field service centers has a medical programs specialist who conducts skill performance evaluations for limb-impaired drivers.44 42 FMCSA, Physical Qualification of Drivers; Medical Examination; Certificate (final rule), 65 Federal Register (FR) 59363, October 5, 2000. 43 Sandra Zyworkarte, R.N., M.P.H., FMCSA, testimony, National Transportation Safety Board public hearing, Effectiveness of Commercial Driver Oversight Programs, New Orleans, Louisiana, January 20 through 21, 2000.

Other Information 25 Highway Accident Report Medical certification is a requirement for all U.S. interstate commercial vehicle drivers who drive a vehicle that: • Has a gross vehicle weight rating or gross combination weight rating, or gross vehicle weight, or a gross combination weight of 10,001 pounds or more, whichever is greater; or • Is designed or used to transport more than 8 passengers (including the driver) for compensation; 45 or • Is designed or used to transport more than 15 passengers, including the driver, and is not used to transport passengers for compensation; or • Is used to transport material found by the Secretary of Transportation to be hazardous under 49 United States Code (U.S.C.) 5103 and transported in a quantity requiring placarding as prescribed by the Secretary under 49 CFR, subtitle B, chapter I, subchapter C.46 Intrastate drivers are subject to the physical qualification regulations of their home States. All of the States have adopted regulations based on the Federal requirements, although many grant exemptions for certain medical circumstances. Procedures not specifically covered in the Federal regulations vary from State to State (appendix D).47 Interstate commercial drivers are required to certify that they meet the medical requirements in 49 CFR 391.41. To drive a commercial vehicle, drivers must also obtain a CDL. The Federal regulations governing the CDL generally apply to both intrastate and interstate commercial drivers (49 CFR 383).48 The Federal regulations pertaining to the physical fitness qualifications required for a medical certificate are contained in 49 CFR 391.41, which states: A person shall not drive a commercial motor vehicle unless he/she is physically qualified to do so and, except as provided in 391.67, [49] has on his/her person the original, or a photographic copy, of a medical examiner’s certificate that he/she is physically qualified to drive a commercial motor vehicle. 44 According to Walter McVay, medical programs specialist for the FMCSA Eastern Service Center, medical programs specialists must attend a 3- to 5-day training program on the qualification standards for limb-impaired drivers. In addition, they are given guidelines to assist them in evaluating the performance of drivers with specific types of impairments. 45 Title 49 CFR 390.3 exempts drivers of vehicles that transport less than 16 passengers (including the driver) from obtaining medical certification. 46 Title 49 CFR 390.5. 47 Association for the Advancement of Automotive Medicine and Federal Highway Administration, Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs, PB97-194393INZ (Springfield, Virginia: National Technical Information Service [NTIS], 1997). 48 In general, a CDL is required when driving a vehicle that is: (1) over 26,000 pounds, (2) designed to transport 16 or more occupants, including the driver, or (3) used to transport hazardous materials. 49 Title 49 CFR 391.67 exempts farm vehicle drivers of articulated commercial motor vehicles.

Other Information 26 Highway Accident Report Medical Examiner All interstate commercial vehicle drivers must be examined at least every 2 years in accordance with 49 CFR 391.43, and certified by an examiner to operate a commercial vehicle. Before 1992, only medical doctors and doctors of osteopathy were allowed to perform examinations.50 In 1992, the regulations were modified to allow certain State licensed, certified, and/or registered health care professionals to perform examinations, including medical doctors, osteopaths, physician assistants, advanced practice nurses, and chiropractors.51 The laws of each State determine which of these types of health care professionals may perform commercial driver examinations. The FHWA hoped that by expanding the pool of examiners, it would lower the cost of the examination and give drivers greater flexibility in arranging for the exam.52 Federal regulations state that examiners must know the specific physical and mental demands associated with operating a commercial vehicle and be proficient in the medical protocols necessary to adequately perform an examination.53 There are no Federal training and certification programs to ensure that examiners are familiar with the regulations. In addition, no registry exists for commercial vehicle driver examiners. Instructions for performing and recording physical examinations accompany the regulations. (See appendix E for 49 CFR 391.43(f) instructions and appendix F for 49 CFR 391.41 medical advisory criteria.)54 The FMCSA distributes free medical advisory criteria upon request, and since 1997, has maintained a Web site containing medical advisory criteria. In addition, the FMCSA posts medical waiver and seminar reports on its Web site, with topics ranging from vision exemptions to cardiac disease. Examination Form The content and general format of the examination form used by the New Orleans examiner is specified in 49 CFR 391.43(f). An official form does not exist, but States, carriers, and other parties may produce their own version of the form as long as it contains the information specified in the Federal regulations. This information has three components: (1) health history (which is completed by the applicant), (2) the physical evaluation section, and (3) the medical certificate, which must be completed if the driver passes the physical. There are no instructions for an examiner who finds a driver unqualified to operate a commercial vehicle. 50 Qualification of Drivers: Medical Examination, 57 FR 33276, July 28, 1992. 51 Title 49 CFR 390.5. 52 N. Hartenbaum, The DOT Medical Examination: A Guide to Commercial Drivers’ Medical Certification (Beverly Farms, Massachusetts: OEM Press, 1997). 53 Title 49 CFR 391.43(c)(1). 54 Text portion of advisory reproduced on March 26, 2001, from the Web site of the FMCSA http://www.fmcsa.dot.gov/rulesregs/fmcsr/medical.htm.

Other Information 27 Highway Accident Report The medical examination instructions that regularly55 accompany the medical examination form include 13 basic requirements covering physical conditions such as loss of limbs, impairment of limbs, cardiovascular impairments (for example, myocardial infarction, angina pectoris, coronary insufficiency, thrombosis, high blood pressure), muscular impairment (including epilepsy), diabetes, eyesight and hearing problems, and use of controlled substance. A medical certificate is not to be granted to those with epilepsy, insulin-treated diabetes, poor hearing, or poor vision, as defined in the regulations. Other physical conditions may prevent an individual from obtaining a medical certificate, and Federal regulations make it the medical examiner’s responsibility to ensure that only qualified drivers obtain the certificate. In October 2000, the FMCSA published the final rule for a new 8-page examination form. The final rule provided for the changes to the content and format of the examination form without substantially changing the Federal regulations.56 The new form will be discussed in detail in later sections. Medical Examination Process If an examiner believes that an applicant is physically qualified to drive a commercial motor vehicle in accordance with 49 CFR 391.41, the examiner signs and completes the medical certificate and furnishes a copy to the applicant and employer. The medical certificate indicates that the completed examination form will be kept on file in the examiner’s office. The examiner may certify an applicant for less than 2 years if the applicant’s condition warrants further scrutiny. The examiner or driver is not required to inform the motor carrier, local or Federal governments, or any other party if the driver fails the physical examination. Although no requirement exists for the examination form to be reviewed or tracked by a State or Federal authority, a number of States do so, including Louisiana (see appendix D). Alternative Qualifications, Exemptions, and Waivers An individual who has a loss or impairment of a limb that would not otherwise prevent him or her from operating a commercial vehicle may still qualify to do so under the Alternative Physical Qualification Standard for the Loss or Impairment of Limbs.57 The individual must apply for a Skill Performance Evaluation (SPE) certificate from a State Director of the FMCSA. The SPE (formerly the Limb Waiver Program) was designed to allow persons with the loss of a hand, foot, or limb to meet fitness qualifications through the use of prosthetic devices or equipment modifications. Since there are no medical aids equivalent to the original body limb, certain risks are still present, and thus restrictions may be included on individual SPE certificates when a State Director of the FMSCA determines they are necessary to be consistent with safety and 55 Title 49 CFR 391.43(f) states that “The medical examination shall be performed, and its results shall be recorded, substantially in accordance with the following instructions and examination form….” However, it does not require that the instructions provided accompany the examination form itself. 56 65 FR 59363, October 5, 2000. 57 Title 49 CFR 391.49.

Other Information 28 Highway Accident Report public interest. If the driver is found otherwise medically qualified, the examining physician must include the statement “medically unqualified unless accompanied by a SPE certificate” on the driver’s medical certificate.58 Under 49 CFR 381.300, a carrier or a driver may apply for an exemption from certain FMCSRs. An exemption is defined as temporary regulatory relief from one or more FMCSRs given to a person or class of persons subject to the regulations or persons who intend to engage in an activity that would make them subject to the regulations. An exemption from the commercial driver fitness regulations provides the person or class of persons with relief from the regulations for up to 2 years and may be renewed. The FMCSA is only considering exemptions from the visual requirements at this time. A waiver is temporary relief from one or more FMCSRs given to a person subject to the regulations or given to a person who intends to engage in an activity subject to the regulations.59 A waiver provides the person with relief from the regulations for up to 3 months. It is intended for unique, nonemergency events and is not a source of relief from driver physical qualification requirements.60 Resolving Medical Evaluation Conflicts Motor carriers often contract with an examiner to conduct commercial driver physical examinations. When a carrier’s examiner and a driver’s physician disagree regarding the driver’s fitness to operate a commercial vehicle, 49 CFR 391.47 provides a method for resolving the conflict. The driver and the carrier must obtain the opinion of an impartial medical specialist in the field in which the medical conflict arose. The specialist’s opinion is submitted to the FMCSA Office of Motor Carrier Research and Standards (OMCRS), along with medical records supporting the specialist’s opinion, medical records and statements of the carrier’s and driver’s examiners, proof of the disagreement between the carrier and the driver, and other supporting documentation. The OMCRS director will determine the driver’s fitness. The driver is considered disqualified until the time a decision is made, or until the director orders otherwise. Enforcement As part of the Motor Carrier Safety Assistance Program (MCSAP),61 safety inspectors may check whether a driver possesses a current medical certificate, whether the 58 Text portion of advisory reproduced on March 26, 2001, from the Web site of the FMCSA http://www.fmcsa.dot.gov/rulesregs/fmcsr/medical.htm. 59 Title 49 CFR 381.200. 60 Sandra Zywokarte, FMCSA, telephone interview, May 2001. 61 The MCSAP is a Federal grant program that provides financial assistance to States to reduce the number and severity of accidents and hazardous materials incidents involving commercial motor vehicles (CMV). The goal of the MCSAP is to reduce CMV-involved accidents, fatalities, and injuries through consistent, uniform, and effective CMV safety programs. States accomplish aspects of this goal through inspections of carrier terminals and of commercial vehicles.

Other Information 29 Highway Accident Report driver has an SPE certificate or the proper exemption, and whether the carrier has included a current copy of a driver’s medical certificate in the driver’s file. Among other violations, drivers can be cited during the inspection for any of these five regulatory violations involving medical examination certificate or form. These are listed below: • 391.41(a) - no medical certificate in driver’s possession, • 391.43(e) – missing exemption on a medical certificate, • 391.43(g) - improper medical examiner’s certificate, • 391.45(b) - expired medical examiner’s certificate, and • 391.49(j) - no valid SPE certificate in the driver’s possession. According to the Commercial Vehicle Safety Alliance (CVSA) North American Standard Out-of-Service Criteria,62 a driver can be placed out of service if she or he does not have the proper SPE certificate or exemption or is not wearing corrective lenses or a hearing aid as required by his or her medical certificate. The States have also enacted laws that give them the power to disqualify drivers who do not meet the level of fitness described in the State or Federal regulations (appendix G).63 The Federal regulations contained in 49 CFR 390.35 prohibit making fraudulent or intentionally false statements on any application, certificate, report, or record required by the FMCSRs, to include the commercial driver medical examination form. The penalty for falsifying the medical examination form consists of civil fines.64 The FMCSA has performed 169 enforcement actions in the past 10 years on drivers and carriers who have falsified medical records, with fines totaling $92,761. Of those enforcement actions, 142 were conducted by the FMCSA against drivers and 27 against carriers. The FMCSA does not compile data on whether any of the enforcement actions against drivers also led to disqualifications.65 Louisiana State Medical Qualification Regulations Intrastate drivers in Louisiana are subject to the same fitness regulations as interstate drivers. In addition, since 1996, Louisiana has required individuals who were renewing or obtaining their commercial driver’s license to submit their most recently completed medical examination form to the State licensing agency. A trained staff66 reviews every examination form submitted for omissions, inconsistencies, and violations of the Federal fitness regulations. Approved forms are scanned into a computerized imaging system and filed as part of the driver’s records, where they can be accessed and reviewed by the licensing agency staff as needed. If the licensing agency needs 62 North American Standard Out-of-Service Criteria, 2001. 63 Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs. 64 Title 49 CFR 386, subpart B. 65 Sue Halladay, Transportation Specialist, FMCSA, April 2001. 66 According to the Louisiana CDL help desk supervisor, staff complete an informal 3- to 5-day course on the CDL and commercial driver medical certification process and are mentored for up to a year.

Other Information 30 Highway Accident Report clarification regarding an examination form, the licensing agency contacts the examiner who conducted the examination. The State has had a medical advisory board since 1968, consisting of 18 members from fields such as cardiology, internal medicine, neurology, ophthalmology, and psychiatry. The medical advisory board convenes every 3 months. It advises the licensing agency on medical and visual standards and also reviews individual cases, such as conflicts between the licensing administration and a driver regarding the driver’s physical fitness. Louisiana does not require commercial driver examiners to report drivers that they believe unfit. Although anyone may voluntarily report an unfit driver to the Louisiana Division of Motor Vehicles, reports of unfit drivers are not always confidential.67 Only health care providers that report unfit drivers have immunity from legal action, as stated in Article 40, Section 1356, of the Louisiana Revised Statutes: No person shall have a cause of action for damages or loss against any health care provider nor shall any criminal liability be imposed as a result of a report by the health care provider to the Department of Public Safety and Corrections or the Louisiana Medical Advisory Board of any visual ability or physical condition, impairment, or disability of an applicant for a driver’s license or of a licensed driver, which may impair such person’s general ability to exercise ordinary and reasonable control in the operation of a motor vehicle, whether the health care provider is statutorily mandated to make such a report or whether such report is made voluntarily, when the health care provider is acting without malice and in the reasonable belief that such action is warranted to protect the public. At least 19 States do not offer immunity to physicians or to other health care providers. At least 37 do not offer immunity to persons other than health care providers who report an unfit driver in good faith (see appendix G).68 If a health care provider in Louisiana sends written notification to the licensing agency that a driver presents an “immediate risk” or “should not be driving,” the driver’s license is immediately suspended and a pickup order issued for a law enforcement officer to seize the license. If the examiner expresses concern over a particular condition but does not specify that the driver may be a “danger” or a “risk,” the licensing agency sends the driver notification that he or she needs to provide a medical report on that condition. The driver’s license is put on a pending status, and the driver is given 30 days to respond. If the driver does not respond within the given timeframe, his or her license is suspended and a pickup order is issued.69 67 Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs. 68 Data are not available for all States. 69 Carla Doris, Louisiana Department of Motor Vehicle CDL help desk supervisor, telephone interview, December 2000.

Other Information 31 Highway Accident Report Medical Certification Program for Airmen In January 2000, the Safety Board conducted a 2-day hearing in New Orleans that examined the adequacy of commercial driver oversight, including the medical certification process.70 During the hearing, testimony was given regarding the FAA’s medical certification process for airmen71 and how it compares with that for commercial vehicle drivers. With an annual budget of $5.7 million in 1999, the FAA’s Division of Aeromedical Certification is responsible for certifying the health of approximately 600,000 airmen. Medical certification is required for any airman acting as pilot-in-command or other required crewmembers of an aircraft (except for free balloons, gliders, and ultralights). This includes student pilots in solo flight as well as private, commercial, and airline pilots.72 These airmen are required to go to one of approximately 5,500 FAA-trained and -registered aviation medical examiners (AMEs) for their certification. All AMEs are either doctors of medicine or osteopathy. To become an AME, an individual must attend a 1-week seminar on the FAA’s medical certification program and then take a refresher course every 3 years.73 Each AME receives a copy of the Aviation Medical Examiner’s Guide, which contains step-by-step instructions performing the physical examination, as well as specific guidance for handling the most commonly encountered abnormal findings. Each AME is assigned examination forms that can be used only by that individual. A unique serial number is printed on each form so that the form can be tracked by the Division of Aeromedical Certification. The AME must then send the completed examination form to the division, regardless of whether the airman passes the physical. As of October 2000, the process became fully computerized; now most examination forms are completed and transmitted to the division via the Internet. Data from nonelectronic forms are also entered into the system when received by the division. A computer system performs a preliminary review of all forms; forms that are considered nonstandard74 (for instance, when the airman was denied certification or the certification decision was deferred) are reviewed by hand. The division employs 33 reviewers especially trained for this purpose.75 The division’s database of examination information, which was established in 1953, gives the FAA the ability to use historical data to identify inconsistencies on an 70 National Transportation Safety Board public hearing, Effectiveness of Commercial Driver Oversight Programs, New Orleans, Louisiana, January 20 through 21, 2000. See http://www.ntsb.gov/events/2000/comm_driver/agenda.htm for the public hearing agenda. 71 A pilot, mechanic, or other licensed aviation technician. 72 For frequently asked questions regarding the medical certification of pilots, see the FAA Office of Aviation Medicine, Civil Aeromedical Institute, Web site http://www.cami.jccbi.gov/AAM-300/amcfaq.html. 73 Dr. Warren Silberman, Manager, Division of Aeromedical Certification, FAA, testimony, Commercial Driver Oversight Public Hearing, Safety Board. 74 A nonstandard form is one that has incomplete entries, has entries that are inconsistent with the certification decision, or has entries that for any other reason make the form conspicuous. 75 Rita Smith, Division of Aeromedical Certification, FAA, telephone interview, December 2000.

Other Information 32 Highway Accident Report individual’s examination form. In addition to utilizing its tracking capabilities, the FAA can make simple statistical queries on this data. The regulations describing the fitness standards that medically certified airmen must meet were last updated in 1996. The regulations cover physical and mental conditions ranging from vision, hearing, cardiovascular condition, diabetes, and epilepsy to an airman’s mental state.76 The regulations give AMEs some discretion in diagnosing and certifying the fitness of these airmen. As noted, AMEs receive training and guidance to help with their certification decision and may call the division for further guidance. Additionally, the FAA sends all AMEs the Federal Air Surgeon’s Medical Bulletin, a quarterly newsletter that provides current information on the medical certification process.77 The regulations state that it is unlawful to make fraudulent or intentionally false statements on an application for a medical certificate or any other document that is used to verify or validate an airman’s fitness.78 Doing so would be a basis for actions such as revoking the airman’s medical certificate, denying all applications for medical certification, denying applications for waivers, or revoking an airman’s pilot certificate, depending on how severe the FAA considers the offense. In addition, the U.S.C. allows for a $250,000 fine, 5 years of imprisonment, or both.79 An airman may apply for an authorization of special issuance of a medical certificate if he or she has a well-controlled condition or a condition that has been in remission. A special issuance authorization may be granted for such conditions as insulin-controlled diabetes, hypertension, and coronary artery disease, depending on the type of flying an airman does.80 An AME may authorize a special medical flight test, practical test, or medical evaluation to determine whether to grant special issuance. Airmen who are granted special issuance authorizations are usually required to have examinations more frequently than healthy pilots.81 An airman may also be granted, at the discretion of the Federal Air Surgeon, a Statement of Demonstrated Ability (SODA), instead of a special issuance authorization. This is given to a person whose disqualifying condition is static or nonprogressive and who has been found capable of performing airman duties without endangering public safety. A SODA does not expire and authorizes a designated aviation medical examiner to issue a medical certificate of a specified class if the examiner finds that the airman’s condition has not adversely changed.82 76 Title 14 CFR 67 contains the medical fitness standards that apply to airmen. 77 Current and past editions of the Federal Air Surgeon’s Medical Bulletin are archived at the FAA Office of Aviation Medicine, Civil Aeromedical Institute, Web site http://www.cami.jccbi.gov/AAM-400A/fasmb.html. 78 Title 14 CFR 67.403. 79 Title 18 U.S.C. 1001 and 3671. 80 Information obtained on May 30, 2001, from the FAA Office of Aviation Medicine, Civil Aeromedical Institute, Web site http://www.cami.jccbi.gov/AAM-300/medcon.html. 81 Title 14 CFR 67.401.

Other Information 33 Highway Accident Report Individuals may contact the FAA if they believe that an airman is not medically fit to operate an aircraft due to a specific condition. The FAA allows these contacts to be anonymous. An airman suspected of being medically unfit is asked by the FAA to submit relevant medical records. If an airman is unable to show that he or she is fit to fly, the FAA may revoke the medical certificate.83 Previous Safety Board Actions As part of its investigative process, the Safety Board verifies driver qualification information. Several of the accidents the Safety Board has investigated have involved driver fitness issues (appendix H). This section highlights the Safety Board’s recommendations in this area. Willow Creek, California. In 1983, an empty dump truck collided head on with a southbound school bus loaded with 37 passengers. The truckdriver and one school bus passenger were killed, and 31 others were injured. Available medical records indicated that the truckdriver had several medical problems, none of which were noted on his latest commercial medical examination form.84 The events leading to this accident prompted the Safety Board to make the following recommendation to the FHWA: H-83-68 Revise Federal Motor Carrier Safety Regulation 49 Code of Federal Regulations 391.43 to incorporate a provision, similar to that specified in 14 Code of Federal Regulations 67.20(A) for Airmen Medical Certification, which will prohibit the falsification or omission of medical information in connection with a medical certification physical examination. The FHWA responded to this recommendation in May 1988 by adding 49 CFR 390.35 to the FMCSRs. This part made fraudulent or intentionally false statements on any application, certificate, report, or record required by the FMCSRs an offense subject to criminal or civil penalties. Consequently, in September 1988, the Safety Board classified this recommendation “Closed—Acceptable Action.” Middletown, New Jersey. On September 6, 1987, an intercity bus ran off the road, struck a guardrail and bridge rail, and overturned onto its right side. The busdriver and one passenger sustained fatal injuries, and 32 passengers sustained minor to moderate injuries. Safety Board investigators found several pieces of evidence indicating that the driver routinely forged his medical certificates, including his most recent one.85 82 Title 14 CFR 67.401. 83 Jackie Bivins, FAA Division of Aeromedical Certification, telephone interview, May 2001. 84 National Transportation Safety Board, Collision of Humboldt County Dump Truck and Klamath-Trinity Unified District Schoolbus, State Route 96, Near Willow Creek, California, February 24, 1983, Highway Accident Report NTSB/HAR-83/05 (Washington, DC: NTSB, 1983).

Other Information 34 Highway Accident Report As a result of the information obtained from this accident, the Safety Board made the following recommendation to the FHWA: H-88-24 Revise Title 49 Code of Federal Regulations Part 391 (Federal Motor Carrier Safety Regulations) to require a motor carrier to verify the authenticity of a medical examiner’s certificate if the certificate has been prepared by a physician who has not been selected by the motor carrier to perform the examination. Information concerning the fact that verification was made should be retained as part of the driver’s qualification file. In July 1998, the Safety Board classified this recommendation “Closed— Unacceptable Action,” because of the FHWA’s failure to revise the relevant regulations. On October 1998, the FHWA stated that it had completed regulatory negotiation with representatives of the States, the motor carrier industry, and the medical community to include the certification of physical fitness of drivers to operate commercial motor vehicles as part of the CDL process. The FHWA stated that it expected to publish a notice of proposed rulemaking (NPRM) that would satisfy H-88-24 by early 1999. In March 2001, an FMCSA representative stated that the release of this NPRM would probably not occur until 2002, due to a shift in priorities. Nashville, Tennessee. On November 19, 1988, a Greyhound bus carrying 45 passengers went out of control, rotated 190 degrees clockwise, and overturned. The unrestrained bus driver and 38 passengers were injured in the accident. Safety Board investigators found that the bus driver had not informed his examiner about his hypertension or about the medications he was taking.86 As a result of this accident, the Safety Board made the following recommendation to the FHWA: H-89-31 Revise section 391.43 of the Federal Motor Carrier Safety Regulations to incorporate a provision that will prohibit the omission of medical information in connection with a medical certification physical examination; require that when commercial drivers are examined, they sign a statement certifying that the medical history they have provided is both complete and accurate and that the motor carrier has the authority to obtain information on the bus driver’s medical history from their personal health care providers; and require that the medical history form elicit more complete information on drivers, using commonly understandable terminology. In September 1992, the FHWA stated that it intended to publish a notice in the Federal Register regarding driver physical/medical requirements addressing, but not 85 National Transportation Safety Board, Academy Lines, Inc., Intercity Bus Run-off-Roadway and Overturn, Middletown, New Jersey, September 6, 1987, Highway Accident Report NTSB/HAR-88/03 (Washington, DC: NTSB, 1988). 86 National Transportation Safety Board, Greyhound Lines, Inc., Intercity Bus Loss of Control and Overturn Interstate Highway 65, Nashville, Tennessee, November 19, 1988, Highway Accident Report NTSB/HAR-89/03 (Washington, DC: NTSB, 1989).

Other Information 35 Highway Accident Report limited to, the Safety Board’s recommendation. The FHWA further stated that it was interested in simplification and improvement of the effectiveness of the examination form and whether the form should be reviewed and retained by the employer. Based upon the FHWA’s failure to revise the regulation in the almost 10 years since the recommendation had been issued, in July 1998, the Safety Board classified this recommendation “Closed— Unacceptable Action.” The new medical examination form, created in October 2000, requires that drivers sign a statement certifying that the medical history they have provided is both complete and true and that false or missing information may invalidate the examination and the medical examiners certificate. It also expands the health history section and uses more understandable terminology in the medical history section. It does not give the carriers permission to obtain driver medical history information from personal health care providers without the driver’s permission. 1990 Safety Study. In 1990, the Safety Board published a study that investigated the role of fatigue, alcohol, other drugs, and medical factors in 182 fatal-to-the-driver heavy truck crashes.87 The Safety Board found that the driver’s medical condition caused or contributed to 10 percent of the accidents. Over 90 percent of medical-condition-related accidents involved some form of cardiac incident. Because of these findings, the Safety Board recommended that the FHWA: H-90-24 Amend 49 Code of Federal Regulations 391.43 to require more extensive and frequent state-of-the-art cardiac screening tests and examinations of older commercial truck drivers (age 40 and above) and for all commercial drivers with cardiac conditions. Commercial drivers with a cardiac history or condition should be disqualified until cleared by a competent medical authority. H-90-25 Develop a clear set of medical standards for cardiac risk assessment and require physicians to use them in qualifying older commercial truck drivers and for commercial drivers with cardiac conditions. Medical certification should include medical state-of-the-art cardiac risk factors. H-90-27 Improve the medical examination form in 49 Code of Federal Regulations 391.43 to ensure that the examining physician is aware of truck operation risk factors and of the physical and other stress producing requirements of commercial truck operation. Provide for a means for physicians to acknowledge that they understand the rigors of commercial truck operation and that the driver being examined is qualified for such commercial truck operations. The physician should 87 National Transportation Safety Board, Vol. 1 of Fatigue, Alcohol, Other Drugs, and Medical Factors in Fatal-to-the-Driver Heavy Truck Crashes, Safety Study NTSB/SS-90/01 (Washington, DC: NTSB, 1990), 2 Vols.

Other Information 36 Highway Accident Report also certify that he understands the penalties for deliberate and/or false statements on the medical certificate and for medical certificate falsification. As noted, in October 2000, the FMCSA published its final rule on the new medical examination form. The new form has an expanded health history section and includes questions on heart surgery and high blood pressure. In addition, the physical evaluation section, which contains the list of health items the examiner must check, now includes guidelines for blood pressure evaluation, including information on recommended certifications periods for drivers with various severities of hypertension. Although the Safety Board noted in its June 20, 2001, response letter that it is unclear how the FMCSA would enforce the use of the form, since no one other than the examiner must see it, the Safety Board believed that the new form provided a substantially improved resource for examiners to more appropriately evaluate a driver’s cardiac condition. Therefore, the Safety Board classified H-90-24 and -25 as “Closed—Acceptable Alternate Action” in June 2001. The new medical examination form also includes a section describing the responsibilities, work schedules, physical demands, and emotional demands that commercial drivers may encounter. It also makes medical guidance material more accessible. Based on this information, Safety Recommendation H-90-27 was classified “Closed—Acceptable Action” in June 2001. Central Bridge, New York. The accident that occurred in Central Bridge is discussed here at length because of the similarities in medical certification issues found during that investigation to those in the New Orleans accident.88 The Safety Board deferred analyses of medical certification issues affecting the Central Bridge accident driver until this report.89 About 10:30 a.m. on October 21, 1999, in Schoharie County, New York, a Kinnicutt Bus Company school bus was transporting 44 students, 5 to 9 years old, and 8 adults on an Albany City School No. 18 field trip. The bus was traveling north on State Route 30A as it approached the intersection with State Route 7, which is about 1.5 miles east of Central Bridge. Concurrently, an MVF Construction Company dump truck, towing a utility trailer, was traveling west on State Route 7. The dump truck was occupied by the driver and a passenger. As the bus approached the intersection, it failed to stop as required and was struck by the dump truck. Seven bus passengers sustained serious injuries; 28 bus passengers and the truckdriver received minor injuries. Thirteen bus passengers, the busdriver, and the truck passenger were uninjured. The subsequent Safety Board investigation found that the 79-year-old busdriver had a history of serious heart and kidney problems. According to his medical records, the 88 National Transportation Safety Board, School Bus and Dump Truck Collision, Central Bridge, New York, October 21, 1999, NTSB/HAR-00/02 (Washington, DC: NTSB, 2000). 89 School bus operations are exempt from the Federal medical certification regulations. However, this accident has relevancy because many States, such as New York, have adopted the Federal medical certification regulations for its school bus drivers and intrastate commercial carriers. (See appendix C.)

Other Information 37 Highway Accident Report driver had a heart attack in 1993, experiencing congestive heart failure and dyspnea (difficulty breathing). He was found to have a severe blockage in the artery supplying blood to the right side of his heart. He underwent angioplasty, which was successful in opening the artery, but he developed a blood clot in his leg. He was placed on a blood thinner (Coumadin) as a result of the clot. He was placed on a diuretic as a result of his heart failure. Approximately 6 months after his angioplasty, he underwent a stress test to determine whether he had additional coronary artery disease. This test did show reversible ischemia, 90 but the driver’s cardiologist decided not to do additional testing or treatment, since the driver was “asymptomatic.” A year later, the driver had additional dyspnea due to “predominantly right-sided heart failure,” and his cardiologist increased his diuretic dose. The driver continued to use an additional diuretic occasionally (as often as every other day) to control fluid retention. He had at least one episode of an abnormal heart rhythm. The driver’s diabetes was essentially uncontrolled. He did not follow appropriate dietary restrictions, did not routinely check his blood sugar, and on two occasions was “totally confused”91 about how much medication he was supposed to be taking. His fasting blood sugar levels were routinely over 200 mg/dL, and within a year before the accident, had a blood sugar level of 460 mg/dL.92 His personal physician frequently noted that the driver was not motivated to control his diabetes, especially when it came to watching his diet. The physician had twice considered placing the driver on insulin, once in September 1996 and again in January 1999, but had not done so. According to his medical records, during one visit on October 1995, the driver told his personal physician that it was his practice to take his diabetes medication at 6:30 a.m., drive the school bus, then have breakfast at 10:30 a.m. The physician told him that this practice was unacceptable and that the driver ran the risk of having a low blood sugar reaction while driving the bus.93 The physician noted that the driver said he understood the dangers and would change his behavior. The driver’s medical records do not note anything further with regard to the driver’s diet and medication as it related to his driving schedule. On September 4, 1999, the driver visited a physician for his medical certification examination. The treating physician was not the driver’s regular physician, and she only had access to the medical history the driver provided. On the health history section of the examination form, the driver did not note treatment for congestive heart failure and did not list any of his cardiac medications or his blood thinner. The physician performing the CDL examination was aware that the driver was a diabetic, but did not direct the driver to obtain 90 Decreased blood flow to a portion of the heart as a result of exercise, a condition that improves with rest. 91 Physician’s notes from September 1997. See docket number HWY-00-FH-001. 92 The normal range for fasting blood sugar levels is approximately 75 to 115 mg/dL. 93 The American Diabetes Association list includes the following symptoms for hypoglycemia (low blood sugar): shakiness, dizziness, sweating, hunger, headaches, sudden moodiness or behavior changes, clumsy or jerky movements, difficulty paying attention, and confusion.

Other Information 38 Highway Accident Report a 6-month evaluation as required by the New York State Commissioner Regulations, Part 6, and the New York Department of Motor Vehicles (NYDMV), Article 19-A. Those requirements consist of “certification by the employee’s personal physician that his or her condition has remained stabilized and that he or she has not had an incident of hypoglycemic shock since the last certification.” No medical review of the driver’s physical examination form was apparently performed by anyone, other than the examining physician. Kinnicutt also was aware of the driver’s diabetic condition and requested a statement from his personal physician, to comply with the NYDMV regulations, regarding the driver’s diabetic condition in November 1998. The driver’s personal physician noted that “he has no hypoglycemic attacks” but did not note whether the driver’s condition was stabilized. The Safety Board concluded that the busdriver’s performance might have been affected by his medical condition, his advanced age, or both. Recent Federal Initiatives New Model Medical Examination Form. In October 2000, the FMCSA published its final ruling on a new model medical examination form and certificate. According to the FMCSA, the previous examination form had not been revised since 1970 and did not always reflect current knowledge and practice. The new form includes more updated and simplified information. The FMCSA expects the new form to reduce the incidence of errors and provide more uniform medical examinations to commercial motor vehicle drivers. Examiners may use the previous form until November 2001, but must use the new form after that date. The new form was developed under a contract with the Association for the Advancement of Automotive Medicine (AAAM), and was reviewed by a group of medical providers, State agency representatives, motor carriers, FHWA field staff, and other interested groups. Although the final ruling updated the examination form in content and format, it did not modify or update any of the underlying physical qualification standards contained in the regulations. The new form is organized into three sections.94 The first section inquires about the driver’s health history. This section has been modified and expanded over the previous form by replacing some medical terminology with a list of symptoms, expanding inquiries into cardiovascular diseases, and expanding inquiries to include sleep disorders and medication (prescription and over-the-counter). If a driver responds that he or she has a particular symptom or disease, the driver must expand on his or her answer. At the bottom of this section, the driver is required to certify that the information provided is complete and accurate and acknowledge that inaccurate, false, or missing information may invalidate both the examination and the medical certificate. The second section covers the physical examination and tests performed by the examiner. Several changes have been made to this section, mainly to reduce the potential for errors by an examiner. Not only does the form include the relevant Federal physical 94 As with the current form, the content of the new form is defined, but the States may determine its format.

Other Information 39 Highway Accident Report qualification standards, but it also has guidance on selected testing and evaluation procedures, such as evaluating a driver’s blood pressure and urine sample. The second section also includes an area to be completed if the driver does not qualify for a 2-year certificate but qualifies for a certificate of less than 2 years. The final section of the examination form details the Federal physical qualification standards found in 49 CFR 391.41, describes the driver’s role and the type of duties faced as a result of that employment, and contains the FMCSA’s advisory guidelines to help examiners better assess a driver’s physical qualifications. In addition, the form includes the telephone number for the FMCSA Office of Bus and Truck Standards and Operations; a representative of the FMCSA Driver and Carrier Operations Division stated that she has noticed an increase in the number of incoming telephone calls since publishing the new examination form. The Driver and Carrier Operations Division currently fields approximately 30 calls a day.95 Merger of the CDL and Medical Certification Processes. The Commercial Motor Vehicle Safety Act of 1986 created the CDL and gave the DOT the authority to link the CDL with the medical certificate. In 1990, FHWA began exploring the possibility of merging the CDL and medical certification processes and assigning stewardship of the program to the States. The FHWA saw several benefits to this.96 First, the merger would minimize the documents that a commercial vehicle driver would need to carry. Second, since the presence of a valid license would also indicate physical fitness, it would reduce the number of separate documents that law enforcement would have to authenticate. Third, transferring the medical certification process to the States could take advantage of their existing infrastructure to begin recording and tracking medical certificates. In addition, State medical advisory boards could process Federal, as well as State, SPE certificates and exemptions and attend to other fitness-related issues. In an effort to determine whether States would be able to manage medical certification along with the CDL process, six States (Alabama, Arizona, Indiana, Missouri, North Carolina, and Utah) were selected to participate in a pilot project that required each to create a prototype medical review program.97 As part of the program, the licensing agency of each State was required to collect the completed medical examination forms for review as part of the process for obtaining a license to operate a commercial motor vehicle. The results of this study prompted the FHWA to conclude that the pilot States “demonstrated the potential capability of assuming the responsibility of the commercial driver fitness certification.” The agencies were able to detect unfit drivers and could restrict them from driving within the parameters set by the licensing agency and the State medical advisory board. 95 Sandra Zywokarte, FMCSA, telephone interview, May 2001. 96 FHWA, “Commercial Driver Physical Qualifications as Part of the Commercial Driver’s License Process,” advance notice of proposed rulemaking (ANPRM); request for comments (July 15, 1994) and notice of intent to form a negotiated rulemaking committee (April 29, 1996), FHWA docket number MC-93-23. 97 Association for the Advancement of Automotive Medicine, Prototype State Review Program: Final Report, DTFH 61-90-C-00098 (Washington, DC: FHWA, 1995).

Other Information 40 Highway Accident Report During the pilot study, the FHWA tested the hypotheses that a significant number of commercial vehicle drivers were either forging the medical examiner’s signature, altering the long form, driving without a medical certificate, or driving with an expired certificate. The data gathered from the six pilot States indicated that these hypotheses were not always supported. However, several issues were uncovered. In three States, a high proportion of the examination forms had to be returned to the applicants because some entries were either incomplete or inconsistent with other entries.98 Many of the omissions or inconsistent entries were related to vision testing and blood pressure readings. One somewhat common mistake was examiners forgetting to note the expiration date on the certificate, which can be particularly important for drivers requiring periodic evaluation (such as, diabetes or borderline high blood pressure). The reviews also yielded a number of applicants who were issued medical certificates, but who did not meet the medical standards. For example, in Missouri, of the 8,086 examination forms received and analyzed by the licensing agency, 32 drivers were identified who did not meet Federal fitness standards, despite being issued medical certificates by certified examiners. In Arizona, of the 39,678 examination forms received and reviewed by the motor vehicle department, 2,662 drivers (6.7 percent) were found not to meet the Federal fitness standards. These drivers were subsequently denied medical certification and had their CDL driving privileges cancelled. Another 175 drivers had their driving privileges cancelled for falsifying their medical long form. In 1994, the FHWA released an advance NPRM (ANPRM) on the merger of the CDL and the medical certification processes.99 It described several reasons for considering the merger (many given above), and listed several issues that would need to be resolved for the merger to take place, to include the need for a medical fitness tracking and review system and the need for an examiner registry. In 1996, the FHWA released a notice of intent to form a Negotiated Rulemaking Advisory Committee on the merger. The purpose of the advisory committee was to promote an open exchange of ideas between interested parties, with the hope that it would lead to innovative resolutions to the issues surrounding the merger. The notice suggested six topics of discussion, which were based on prior interviews with potential committee members: • Whether the physical qualification guidelines currently used by the agency should be modified to more effectively implement the current medical standards. • The scope of any medical qualifications tracking system which might be used by law enforcement officials and carriers. 98 Alabama returned 43.3 percent of the long forms because they were incomplete; Arizona, 32.6 percent; and Missouri, 31 percent (noncertified examiners) and 17 percent (certified examiners). Two other States reported low return rates: Indiana, 5 percent, and Utah, 2.9 percent. A return rate was not given for North Carolina. 99 See FHWA docket number MC-93-23.

Other Information 41 Highway Accident Report • Whether useful information could be utilized from the federally funded State Prototype Medical Review pilot programs in drafting a rule on merging CDL and physical qualification requirements. • The amount of control various parties should have over the medical review process, and whether the current commonly used procedure, in which a company directs its drivers to physicians it selects, needed to be replaced or simply modified. • How best to clarify the current physical examination requirements and guidelines and communicate them effectively to the medical provider community. • Whether there was a way to merge the separate medical and CDL requirements without burdening the small operator who moves to another State. During the Safety Board’s January 2000 hearing on driver oversight, an FMCSA representative stated that an NPRM on the merger was expected sometime in the year 2000.100 However, changed priorities have delayed the projected release date of this NPRM until 2002.101 California, Arizona, Utah, and Nevada have already formally merged the medical certification and the CDL processes together. In California102 and Arizona,103 commercial drivers are required to provide their respective licensing agency with a complete and current medical examination form every 2 years. The licensing agency reviews and tracks each form. If a problem is found with the information on a form, the form is sent back to the driver for clarification. If the driver does not respond within 30 days, the licensing agency can take action.104 Since medical fitness is an integral part of having a CDL, drivers with invalid or missing medical certification risk immediate disqualification and a fine. Both States have systems that allow law enforcement to check a driver’s license status during routine stops and safety inspections. Because of this, law enforcement is able to prevent unfit drivers from driving.105 100 Robert Redmond, FMCSA, testimony, Commercial Driver Oversight Public Hearing, Safety Board. 101 Teresa Doggett, FMCSA contact for the NPRM on the CDL-medical certification process merger, telephone conversation, April 2001. 102 Soubeih Al-Jundi, Principal Driver Safety Officer, California Department of Motor Vehicles, telephone interview, April 2001. 103 Lupe Valdivia, Arizona Motor Vehicle Division Medial Review Program, telephone interview, May 2, 2001. 104 Arizona immediately suspends the driver’s license. California may take any one of a number of actions, including converting the CDL to a private vehicle license. 105 As part of its investigation, the Safety Board also reviewed the medical fitness requirements of Mexico, Canada, the United Kingdom, and Australia, and found that all but Australia have incorporated medical fitness requirements into their commercial driver’s license programs. (See appendix I.)

Other Information 42 Highway Accident Report Alcohol and Drug Testing Procedures Postcrash toxicological tests on the busdriver involved in the New Orleans crash detected THC, the major active substance in marijuana, in the driver’s blood and tetrahydrocannabinol carboxylic acid (THC-COOH), the major inactive metabolized derivative of THC, in the driver’s blood and urine. This driver had tested positive for drugs on four previous occasions—twice as an employee of The Regional Transit Authority, once as an employee of Westside Bus Service, and once when applying for a job with Greyhound. Below is the applicable background information on the drug testing regulations for commercial vehicle drivers. Regulations on Commercial Vehicle Driver Drug Testing According to 49 CFR Part 382, drivers holding a CDL must be tested for five controlled substances106 before holding a safety-sensitive position with a carrier and may also be tested at certain times during employment with that carrier. It is the carrier’s responsibility to comply with the drug testing regulations. Use of a controlled substance is determined by collecting a urine sample from the driver and having it analyzed by a drug testing laboratory certified by the U.S. Department of Health and Human Services. Title 49 CFR 40 details the procedures that must be followed to collect the sample. Results of the analyses are then relayed by the laboratory to an MRO107 who reviews the results and the chain of custody before releasing the results. If a controlled substance is found in concentrations above the reporting levels specified in 49 CFR 40.29,108 or if there is evidence that the specimen provided by the employee was substituted or adulterated, the MRO contacts the employee to determine whether there are legitimate reasons for the results and whether the employee would like a retest.109 The MRO informs the designated employee representative (DER) of all positive and negative test results.110 Alcohol tests are administered by a breath alcohol technician or a screening test technician111 who is trained in the operation of an evidential breath testing device or alcohol screening device. An employee found to have an alcohol concentration of 0.02 or more must take a confirmatory test. The results of all alcohol tests are submitted to the DER. 106 Marijuana, cocaine, opiates, phencyclidines (PCPs), and amphetamines. 107 Title 49 CFR 40, Subpart G, describes the qualifications and functions of an MRO. 108 Under the new drug testing rule that takes effect in August 2001, the controlled substance chart in 49 CFR 40.29 will appear under 49 CFR 40.87. 109 When a urine specimen is taken, the specimen is split and sent to two laboratories. One laboratory analyzes the urine, while the second laboratory stores the urine specimen in case the employee requests a retest following an initial positive drug test result. 110 The results may also be reported to a consortium or third party administrator, if so arranged by the carrier. 111 Title 49 CFR 40, Subpart J, describes the qualifications of a breath alcohol technician and a screening test technician.

Other Information 43 Highway Accident Report Consequences of a Positive Drug or Alcohol Test. If an alcohol test reveals an alcohol concentration exceeding 0.02, the carrier must not allow the driver to perform safety-sensitive functions, including driving a commercial vehicle, for at least 24 hours. If a driver tests above the reporting level for a controlled substance, or is found to have an alcohol level of more than 0.04, the driver is not allowed to perform safety-sensitive functions, including driving a commercial motor vehicle, until being evaluated by a substance abuse professional (SAP).112,113 Failure to prevent a driver from performing a safety-sensitive function until that time may subject the carrier and the driver to the penalty provisions of 49 U.S.C. section 521(b),114 which includes immediately placing the driver out of service and levying a civil penalty not to exceed $2,500. The SAP must determine a course of treatment to help the driver resolve problems with abuse. The SAP must also reevaluate the driver to determine whether he or she properly followed the prescribed treatment program. Before being able to return to duty following the evaluation and treatment for drug or alcohol abuse, a driver must pass a return-to-duty test. In addition, the driver is subject to at least six unannounced drug and alcohol tests during the first 12 months following his or her return to duty, with additional testing possible in the following 48 months (a total period of 5 years).115 An employer may also independently establish guidelines for disciplinary action, which may include the termination of employment.116,117 No regulatory requirement exists to report a driver who has tested positive to any regulatory or enforcement authority. Not all drivers who are required to have a current medical certificate are also required to be drug tested, but the regulations pertaining to the physical qualification of drivers do address the use of controlled substances. Title 49 CFR 391.41(12)(i) states that a person is physically qualified to drive a commercial motor vehicle if that person “does not use a controlled substance identified in 21 CFR 1308.11 Schedule I,118 an amphetamine, a narcotic, or any other habit-forming drug.” Preemployment Drug Tests. The Federal regulations state that an employer must not allow a new driver to drive or perform other safety-sensitive functions unless he or she has been tested for controlled substances and been found negative.119 The employer may 112 Referral, evaluation, and treatment regulations are given in 49 CFR 382.605(b). 113 Title 49 CFR 40, Subpart O, describes the qualifications for a substance abuse professional. 114 Title 49 CFR 382.507. 115 Title 49 CFR 382.605(c)(2)(ii). 116 Title 49 CFR 382.601(c). 117 During the Safety Board’s Driver Oversight hearing in January 2000, Peter Van Beek, Director of Safety, Coach USA, pointed out that States may restrict the actions of carriers in response to a positive drug test. 118 Title 21 CFR 1308.11, Schedule I, lists controlled substances under the following families: opiates, opiate derivatives, marijuana derivatives, hallucinogenics, depressants, and stimulants. It does not list cocaine, but 49 CFR 391.41(b)(12)(i) covers this drug under the phrase, “any other habit-forming drug.” 119 Title 49 CFR 382.301(a).

Other Information 44 Highway Accident Report waive the test, if, during the preemployment process, the employer had verified knowledge120 that the driver participated in a controlled substance testing program within the previous 30 days, and (1) was tested and found negative within the past 6 months or (2) participated in a random controlled substances testing program for the previous 12 months with no violations in the past 6 months. In addition to preemployment testing, the regulations specify that employers must test drivers: • as part of a random drug testing program (49 CFR 382.305), • after an accident of specified severity (49 CFR 382.303), • when there is reasonable suspicion of drug and alcohol use (49 CFR 382.307), • before being allowed to return to work after testing positive for a controlled substance or a concentration of alcohol above 0.04 (49 CFR 382.309), and • as an unannounced followup after having tested positive for drugs previously (49 CFR 382.605 (b)(2)(ii)). Employers are required to keep positive test results for alcohol (0.02 or greater) and controlled substances for 5 years, even if they go out of business. They are also required to retain for 5 years documentation of a driver’s refusal to take a required alcohol and/or controlled substance test. Records of negative tests, canceled tests, and tests with results of less than 0.02 must be kept for at least 1 year. Owner-operators must comply with the drug testing regulations by implementing “a random alcohol and controlled substances testing program of two or more covered employees in the random testing selection pool.”121 In general, owner-operators and carriers with only a few employees may join with other owner-operators and small carriers to form a pool. The pool is then administered by a testing facility and the “randomness” consists of selection of people from that pool. Therefore, an owner-operator meets the percentage requirements of 49 CFR 382.305 when the pool meets the requirement. This also means that an owner may never be tested, yet still be in compliance. Positive results are reported only to the employer, who in some cases is an owner-operator. Obtaining Past Controlled Substance and Alcohol Test Results. Drug testing results may not be released without the permission of the driver, except to Federal, State, and local officials with authority over the employer or any of its drivers.122 The driver may also request the information, and it may be released as part of legal action.123 Under 49 CFR 391.21, driver applicants must provide prospective employers with a complete and accurate list of previous employers from the last 3 years.124 Applicants 120 Title 49 CFR 382.301(c)(1). 121 Title 49 CFR 382.103(b). 122 Title 49 CFR 382.405(d). 123 Title 49 CFR 382.405(g).

Other Information 45 Highway Accident Report must also provide prospective employers with a list of all violations of motor vehicle laws from the last 3 years, as well as denials, revocations, or suspensions of licenses, permits, or privileges to operate a motor vehicle from the last 3 years. Prospective employers are required, under 49 CFR 382.413,125 to contact each applicant’s previous employers to determine whether, in the preceding 2 years, the applicant had failed an alcohol or controlled substance test, had refused to be tested, or had successfully completed return-to-duty requirements after having tested positive for alcohol or a controlled substance. Employers must not allow new drivers to continue performing a safety-sensitive function after 14 days of hire without having made a good faith effort to obtain this information.126 Employers must record efforts made in this regard for each driver’s qualification file. Before contacting previous employers for this information, employers must obtain a written authorization from each driver applicant. According to 49 CFR 382.405(f), previous employers must release a driver’s drug testing records to a new employer upon receipt of a written request from the driver. However, there is no penalty for not complying with this regulation. The previous employers of the New Orleans busdriver did not respond to Custom’s requests for driver history information, despite Custom having the driver’s signed permission to do so. As will be discussed shortly, two NPRMs were recently published that propose modifications to the process by which employers obtain past drug testing information regarding a driver. Final rules are expected later in 2001. Past Safety Board Actions Safety Study on Accidents Involving Drugs and Alcohol. The Safety Board has investigated numerous commercial vehicle accidents where drivers have used alcohol and illegal drugs (appendix J). In 1990, the Safety Board published a safety study that focused on the role of fatigue, drugs, alcohol, and medical factors in fatal-to-the-driver heavy truck crashes.127 One hundred and eighty-two accidents involving 186 trucks were included in this study. From the toxicological tests, the Safety Board found that 33 percent of the fatally injured drivers tested positive for alcohol and other drugs of abuse.128 The most prevalent drugs found in drivers who had tested positive were marijuana and alcohol (13 percent each), followed by cocaine (9 percent), methamphetamine/amphetamines (7 percent), other stimulants (5 percent), and codeine and phencyclidine (PCP) (less than 1 percent each). Stimulants (for example, cocaine and 124 Title 49 CFR 391.21(b)(10). If the driver is applying to operate a commercial vehicle that requires a CDL license, 49 CFR 391.21(b)(11) requires that the driver provide the prospective employer a list of commercial vehicle operator employers for up to 10 years. 125 Will also be required by 49 CFR 40.25, which takes effect August 2001. 126 Title 49 CFR 40.25 gives employers 30 days after hiring an employee to obtain this information. As will be discussed shortly, a new NPRM proposes to modify 382.413 to make it consistent with 49 CFR 40.25. 127 Safety Study NTSB/SS-90/01, Vol. 1. 128 These drugs included over-the-counter and prescription stimulants, as well as illegal drugs such as cocaine and marijuana.

Other Information 46 Highway Accident Report amphetamines) were the most frequently identified drug class among fatally injured truck drivers. As a result of this study, the Safety Board made several recommendations pertaining to drug screening and testing procedures to all levels of government, trucking associations, and the trucking industry, including the following to the FHWA: H-90-17 Require preemployment alcohol and other drug tests on all drivers of commercial trucks with a gross vehicle weight rating of 10,000 pounds and above as a condition of employment. H-90-18 Amend 49 Code of Federal Regulations 391.21, “Application for Employment” and 391.23, “Investigations and Inquiries,” to include a complete review of alcohol and other drug abuse treatment history prior to employment as a commercial truck driver. H-90-20 Require close supervision, including frequent, unannounced drug testing, for an appropriate period, of commercial truck drivers with an identified alcohol or other drug abuse problem. Such testing should be sufficiently frequent to create the likelihood of detection if the person uses drugs of abuse. In 1991, Congress passed the Omnibus Transportation Employee Testing Act, which made alcohol and drug testing a requirement for those holding a CDL. Therefore, only drivers of vehicles above 26,000 pounds are subject to preemployment testing. Because of this Act, the Safety Board classified Safety Recommendation H-90-17 as “Closed—Acceptable Alternate Action” on April 20, 1994. In January 1991, the FHWA responded that it planned to revise the physical examination form to include drug use treatment information, may amend the FMCSRs to require that motor carriers release drug test results and treatment history to prospective employers, and may require that prospective employers obtain this information before employment or use of a driver. Consequently, on April 20, 1994, the Safety Board classified Safety Recommendation H-90-18 as “Closed—Acceptable Action.” In February 1994, the FHWA passed the final rule for alcohol and drug testing, section 382.311, which states that a driver identified as abusing drugs or alcohol would be subject to at least six followup tests within the first 12 months upon returning to driving duties, with additional testing possible in the following 48 months. Consequently, on April 20, 1994, the Safety Board classified Safety Recommendation H-90-20 as “Closed— Acceptable Action.” Commercial Driver Oversight Public Hearing, January 2000. At the Safety Board’s Commercial Driver Oversight Public Hearing in January 2000,129 several witnesses expressed opinions on the adequacy of drug testing procedures, including (1)

Other Information 47 Highway Accident Report the accessibility of drug testing results, (2) driver privacy, and (3) the general effectiveness of current regulations. Several witnesses and panelists expressed concern that positive drug testing results are inaccessible and recommended that a drug registry be created to track previous positive drug tests. Currently, a company cannot release a former employee’s drug testing results to a prospective employer without the employee’s consent. In addition, drug tests done at the request of an employment agency or prospective employers (assuming the driver is not hired) do not have to be released because these parties are not considered previous employers. Some offered the opinion that a drug test registry might conflict with a driver’s right to privacy. A representative of FMCSA stated that he believed that more people are currently allowed access to a driver’s CDL record than are allowed access to drug and alcohol testing records, but he believed that decision makers should have as much information as they can get to make an informed assessment of a driver’s ability.130 A representative of the National Private Truck Council stated that the rights of the individual must be weighed against inherent public good.131 Panelists also commented on the feasibility of the drug testing system. A representative of the Owner-Operator and Independent Drivers Association, Inc., stated that the trucking industry spends easily $600 million a year on drug testing programs, but he knew of no evidence supporting the claim that drugs and alcohol are a problem in trucking. He further stated that the gaps in the New Orleans busdriver’s employment history should have been a “red flag” to the carrier that last employed him.132 A representative of Coach USA voiced a different concern, stating that State laws have sometimes curtailed the company’s safety efforts by prohibiting the termination of employees who test positive during drug tests.133 Recent Federal Initiatives NPRM on the Safety Performance History of New Drivers. In 1996, the FHWA published an NPRM to specify minimum safety information that new and prospective employers must seek from former employers during the investigation of a driver’s employment record.134 The NPRM would modify 49 CFR Parts 382, 383, 390, and 391135 to require that a motor carrier obtain a 3-year history of a driver’s hours-of-service 129 Docket number DCA-00-SH002. 130 Robert Redmond, FMCSA, testimony, Commercial Driver Oversight Public Hearing, Safety Board. 131 John McQuaid, National Private Truck Council, testimony, Commercial Driver Oversight Public Hearing, Safety Board. 132 Todd Spencer, Owner-Operator and Independent Drivers Association, Inc., testimony, Commercial Driver Oversight Public Hearing, Safety Board. 133 Peter Van Beek, Coach USA, testimony, Commercial Driver Oversight Public Hearing, Safety Board. In an April 2001 interview, Mr. Van Beek mentioned that Wisconsin and Iowa have laws that prohibit the termination of an employee after one positive drug test. 134 Safety Performance History of New Drivers, 61 FR 10548, March 14, 1996.

Other Information 48 Highway Accident Report violations, accident record, violations resulting in an out-of-service order, alcohol and drug violations, and failures to undertake or complete a rehabilitation program recommended by a substance abuse professional. Previous employers would have 30 days to respond to a request, and drivers would have an opportunity to review and comment on the information provided. The FMCSA requires only previous employers that are motor carriers to provide prospective employers with drug and alcohol information. Moreover, the NPRM only applies to drivers who operate commercial vehicles requiring a CDL, because only those drivers are subject to the drug and alcohol requirements described in Part 382. The NPRM also recommends modifications to Part 391 that would make it easier for motor carriers that operate commercial vehicles weighing between 10,000 and 26,000 pounds to better determine the fitness of their drivers. Although such employers would not be subject to all of Part 382, it would nevertheless require them to inquire whether a prospective driver had used a controlled substance or had failed to undertake or complete a recommended treatment program. These employers would not be allowed to assign a driver who had used alcohol or drugs illegally within the past 3 years to a safety-sensitive function until the driver had received the recommended treatment. According to an FMCSA representative, due to other pressing regulatory issues that have surfaced since the release of the NPRM, the FMCSA does not expect to release a final ruling on the NPRM regarding the safety performance history of new drivers until sometime in 2002.136 Transportation Equity Act for the 21st Century. The Transportation Equity Act for the 21st Century (TEA-21) was enacted on June 9, 1998, as Public Law 105-178, and authorized funding for Federal surface transportation programs in highway engineering, highway safety, and transit until the year 2003. TEA-21 also enacted new legislation on certain aspects of highway safety. One new piece of legislation limits the liability of motor carriers complying with regulations regarding the furnishing and use of driver safety performance records. 137 Regulations that will become effective August 1, 2001, will require motor carriers to request records showing the safety performance history of drivers they plan to hire from the former motor carrier employers of those drivers. In addition, these regulations will require former employers to furnish the requested information. As mentioned previously, 49 CFR 391.21 and 382.405(f) already require similar, if not identical, actions and information. However, TEA-21 addresses the fear of liability for both former and potential employers by limiting a carrier’s liability while protecting the driver’s rights and privacy.138 Motor Carrier Safety Improvement Act of 1999. The Motor Carrier Safety Improvement Act of 1999 separated the OMC from the FHWA to create the FMCSA. It 135 Part 382 concerns controlled substance and alcohol use and testing; part 383 concerns commercial driver licensing standards; and parts 390 and 391 concern driver qualifications. 136 Valerie Height, FMCSA contact for the NPRM on the safety performance history of new drivers, telephone conversation, April 27, 2001. 137 Section 4014, which modifies 49 U.S.C. 508.

Other Information 49 Highway Accident Report also included several rule changes and directives. One such directive was for the Secretary of Transportation to conduct a commercial driver drug test results study within the next 2 years, to evaluate the feasibility and merits of: • Requiring medical review officers or employers to report to the State that issued the driver’s CDL all verified positive controlled substances test results on any driver subject to controlled substances testing under 49 CFR Part 382, including the identity of each person tested and each controlled substance found, and • Requiring prospective employers, before hiring any driver, to query the State that issued the driver’s CDL for records of any verified positive controlled substances test on that driver. 139 NPRM on Drug and Alcohol Use and Testing. In April 2001, DOT published an NPRM preamble140 that described the DOT’s intent to make the drug testing requirements of its six administrations conform with the new 49 CFR 40, which was published in December 2000.141 The preamble states that: • The agencies would authorize, but not require, employers to conduct preemployment alcohol testing. However, an employer choosing to conduct preemployment alcohol testing under Federal authority must conduct it in accordance with the 49 CFR 40 requirements. • Employers would be allowed to apply for a stand-down waiver, which would allow an employer to prohibit an employee from performing a safety-sensitive function until verification of a positive drug test result. • Employers would be required to ask individuals applying for safety-sensitive positions whether they had ever tested positive on a preemployment test for an employer that subsequently did not hire them. If an applicant admits that he or she had a positive test or a refusal to test, the employer cannot use the applicant in a safety-sensitive position until successful completion of a return-to-duty process is documented. 138 Public Law 105-178, Section 4014, states that, “No action or proceeding for defamation, invasion of privacy, or interference with a contract that is based on the furnishing or use of safety performance records in accordance with regulations issued by the Secretary may be brought against (1) a motor carrier requesting the safety performance records of an individual under consideration for employment as a commercial motor vehicle driver as required by and in accordance with regulations issued by the Secretary; (2) a person who has complied with such a request….” 139 Motor Carrier Safety Improvement Act of 1999, Section 226. 140 Transportation Workplace Drug and Alcohol Testing Programs; Amendments to DOT Agency Rules Conforming to Department of Transportation Final Rule; Notices of Proposed Rulemaking; Common Preamble, 49 CFR part 382, 66 FR 21492, April 30, 2001. 141 Department of Transportation, Procedures for Transportation Workplace Drug and Alcohol Testing Programs; Final Rule, 65 FR 79462, December 19, 2000.

Other Information 50 Highway Accident Report • A consortium or third party administrator (C/TPA) who directs an owner-operator or other self-employed individual to appear for a drug or alcohol test can make a refusal determination142 if the individual does not appear and has no legitimate reason for doing so. The FMCSA NPRM that followed the preamble proposed changes to its drug testing procedures, as described in 49 CFR 382, to conform with the new 49 CFR 40.143 The FMCSA proposed to delete from 49 CFR 382 regulatory text regarding referral, evaluation, and treatment requirements; followup testing; inquiries for alcohol and controlled substances information from previous employers; and SAPs. Instead, the regulations would reference the appropriate provisions of 49 CFR 40. The NPRM also proposes new language to address changes to preemployment testing and the stand-down waiver provision and clarifies the regulations to allow employees to self-identify that they have an alcohol or drug problem without DOT consequences or penalties. A final rule is expected in August 2001. Recent State Initiatives In March 2000, the State of Oregon adopted legislation to supplement and strengthen Federal drug testing requirements. Among other things, it requires that the results of any positive drug test by an Oregon CDL driver be reported to the Oregon Department of Transportation’s Driver and Motor Vehicle Services (DMV) so it can be entered in the driver’s State driving record. This includes preemployment tests. When a medical review officer reports a positive drug test, the DMV will advise the driver of the right to a hearing. If a hearing is requested, no entry will be made on the driver’s commercial driving record pending the outcome of the hearing. Once the drug test result is entered into a driver’s driving record, it remains there for 5 years. The DMV will release drug test information contained on a commercial driving record only with the written permission of the driver. Although this legislation was adopted early in 2000, funding problems delayed implementation of the law until September 2000.144 According to an Oregon State representative, from September 2000 to May 2001, 269 positive drug tests were reported to the DMV, most originating from random drug tests.145 Twenty-five drivers have requested hearings because of positive drug tests. 142 A refusal determination would cause the individual to be removed from performing a safety-sensitive function. It is proposed that such a determination by a C/TPA be reported to the DOT or to the applicable DOT agency, which in the case of commercial drivers is the FMCSA. Presumably, the DOT would enforce the appropriate action. 143 FMCSA, Controlled Substances and Alcohol Use and Testing; Notice of proposed rulemaking (NPRM); request for comments, 49 CFR part 382, 66 FR 21538, April 30, 2001. 144 Because the Oregon attorney general ruled that the State could not use highway funds to support the new regulation, MCSAP funds were eventually used. 145 Julie Santos, Driver Program Unit, Oregon Department of Transportation, electronic-mail correspondence, May 2001.

51 Highway Accident Report Analysis Exclusions In the New Orleans investigation, the Safety Board examined several factors that may have caused or influenced the severity of the crash, including the performance of the driver, the vehicle, the motor carrier, the highway elements, emergency management, and survival factors. The Safety Board has identified several human performance issues with regard to driver medical certification and the accessibility of health history information during preemployment screening. In addition, survival factors and bus crashworthiness issues similar to those uncovered in a recent Safety Board report on bus crashworthiness were also observed.146 The investigation also found a highway infrastructure inspection and maintenance problem, although its presence did not influence the severity of the crash. These issues will be discussed in greater detail in later sections of this analysis. At the time of the accident, visibility was clear and the pavement dry, making it unlikely that weather contributed to the accident. Within 2 minutes of the accident, emergency management services were notified, and they responded quickly and effectively. After the accident, Safety Board investigators inspected the motorcoach and found no mechanical problems likely to have contributed to the accident. The Safety Board could find no procedural or operational problems with the motor carrier. The Safety Board’s evaluation of the 1996 FHWA and CSS compliance reviews revealed that the differences in safety rating were due to methodological differences. This resulted in CSS noting numerically more violations than the FHWA, although, substantially, the same violations were found. The Safety Board evaluated Custom’s actions with regard to the medical certification process to determine whether it followed the regulations and whether it could have done more to prevent this accident. In compliance with the regulations, Custom required that the driver submit to a medical examination after he was physically unable to complete a scheduled run and after several subsequent hospital admissions. The driver passed the physical examination, which likely indicated to Custom officials that despite their concerns, the driver was physically fit enough to drive under the Federal regulations. Custom officials did not have a medical background and had no reason to doubt the conclusions of the examiner, especially since the Federal regulations state that all commercial driver examiners must be knowledgeable of the physical and mental demands associated with operating a commercial vehicle, must be knowledgeable of the regulations pertaining to driver fitness, and must be proficient in the use of the medical protocols necessary to adequately perform a commercial driver medical examination. Custom 146 National Transportation Safety Board, Bus Crashworthiness Issues, Highway Special Investigation Report NTSB/SIR-99/04 (Washington, DC: NTSB, 1999).

Analysis 52 Highway Accident Report clearly relied on the knowledge and opinion of the commercial driver examiner to determine whether the New Orleans driver was physically fit enough to continue driving. The Safety Board believes that it might have been possible for Custom to better monitor the driver’s absences, frequency of medical appointments, and observed medical symptoms to make further evaluations on his health. However, in the Safety Board’s opinion, given the current state of the medical certification system, there was little that Custom could have done differently to avert the accident. Custom complied with the Federal regulations pertaining to drug testing. The driver underwent one preemployment and three random drug tests while with Custom, and all tests were negative for drugs. It also attempted to obtain information about the driver from previous employers, but received no responses. Even had Custom persisted and eventually obtained information about the driver from a former employer, the information obtained would probably not have been useful in making a hiring decision since the driver only listed former employers that had not fired him for positive drug test results. Therefore, the Safety Board concludes that the mechanical condition of the bus, the weather, emergency management, and motor carrier management did not contribute to or influence the severity of the accident. The remainder of this analysis will address the medical certification, drug testing, bus crashworthiness, and highway issues identified during the investigation. The Accident The driver did not have control of the bus before the accident, resulting in the bus departing the right side of the roadway, striking the terminal end of a guardrail, traveling through a chain link fence, vaulting over a paved golf cart path, and colliding with the far side of a dirt embankment. Several pieces of evidence point to incapacitation as the reason the driver failed to maintain control of the bus. First, one of the witnesses, who had been in a van behind the motorcoach, stated that the bus initially drifted towards the center lane and almost hit a small green car, but then drifted back to the middle of the left lane. Shortly after this, the bus left its lane and departed the side of the road. She stated that the bus was not out of control, did not have its brakes applied, and did not waiver or swerve in any direction. These observations of the motorcoach correspond with an eyewitness account by one of the bus passengers regarding the driver. According to this passenger, she recalled seeing the busdriver “slouch down,” as if reaching for a soda. He came back up, but then went down again. The next thing she remembered was waking up in the hospital. Postaccident toxicology tests of the driver revealed that the driver had used marijuana sometime before going on duty, which could have led to a loss of coordination, lethargy, and problem-solving difficulties. Diphenhydramine, a drug with both sedating

Analysis 53 Highway Accident Report and performance-impairing effects, was also found in his blood. In addition, due to his hospitalization the night before, the driver spent only 6 hours at home before leaving for work. These factors suggest that the driver may have been fatigued before the crash. However, although the driver’s health condition was likely exacerbated by the effects of marijuana and a sedating antihistamine, the witness’ descriptions of the driver’s actions and the bus’ motion suggest medically related incapacitation, rather than falling asleep at the wheel, as the probable cause of this accident. The observed behavior of the driver prior to the accident is consistent with his experiencing a significant reduction in blood flow to the brain, resulting in an impairment of consciousness. Consciousness was likely restored when the driver’s head descended to a level below that of his heart. When the driver resumed an erect posture, with his head once again above the level of his heart, this likely led to a repeated reduction or interruption of blood flow to his brain, again leading to a loss of consciousness from which the driver did not recover until after the accident. The witnesses’ description is less consistent with fatigue and falling asleep at the wheel, actions that are more associated with head nodding than a gross loss of body posture.147 The driver had several serious medical conditions, any of which could have caused a reduction or interruption of blood flow to the brain. Congestive heart failure is, by definition, an inability of the heart to maintain an adequate output of blood, and the driver had a history of recurrent episodes of congestive heart failure as a result of his dilated cardiomyopathy. In addition, cardiac arrest is common in individuals with dilated cardiomyopathy, frequently as a result of an abnormal heart rhythm, and the driver had experienced such abnormal heart rhythms without warning on previous occasions. Finally, dialysis treatment itself can leave an individual susceptible to episodes of low blood pressure (such as that experienced by the driver the night before the accident). This is made more likely with his use of medication, such as metoprolol, which reduces the capability of even a normal heart to compensate for reduced blood pressure. The Medical Certification Process The bus driver involved in the New Orleans accident had serious medical conditions that should have called into question his ability to safely operate a commercial vehicle. In this case, as in the Central Bridge accident and in the other accidents summarized in appendix H, the certification system failed to ensure even a cursory evaluation of the drivers’ medical conditions. In those investigations, evidence was available to the examiners suggesting that such an evaluation was necessary to determine the fitness of the drivers. 147 Physiological characteristics associated with fatigue include eyelid droop, blink frequency, head nodding, microsleep, and changes in electroencephalograph (EEG) readings. Studies have not mentioned a loss of body posture as a symptom of fatigue. From D.F. Dinges and M.M. Mallis, “Managing fatigue by drowsiness detection: Can technological promises be realized?,” L. Hartley, ed., Managing Fatigue in Transportation (Oxford, U.K.: Pergamon) 209-229 and J.C. Stutts, Sleep Deprivation Countermeasures for Motorist Safety, NCHRP Synthesis 287 (Washington, DC: National Academy Press).

Analysis 54 Highway Accident Report Federal regulations dictate the criteria by which interstate commercial drivers may be certified as medically fit to drive. Federal oversight of the biennial medical certification process conducted for an estimated 9 million licensed commercial vehicle drivers is accomplished almost exclusively by three full-time individuals in the FMCSA. State oversight of the medical certification process for interstate drivers is not mandated by Federal regulations, and the decision to certify a driver as fit to drive typically rests with the individual examiner performing the physical examination on the driver. Medical Certification Process Issues Despite suffering from potentially incapacitating medical conditions, the driver involved in the New Orleans accident was able to obtain a medical certificate by falsifying and omitting crucial health history information from the examination form. Even though the examiner was able to determine that the driver had heart disease, and possibly kidney disease, she believed that the available FMCSA guidance was insufficient to deny the driver a current medical certificate. Although several of the driver’s physicians were aware of the driver’s profession and were also aware of the seriousness of his illnesses, none reported their concerns to the State licensing agency. Other serious flaws found during the course of this investigation, and during the Safety Board’s driver oversight hearing, called into question the effectiveness of the entire medical certification process. The following section of the analysis describes the limitations of the current certification process, including: • Adequacy of examiner qualifications. • Adequacy of the Federal regulations. • Adequacy and availability of nonregulatory guidance. • Lack of a review process. • Lack of a tracking mechanism for medical certification exams. • Role of other responsible parties. • Lack of strong certification enforcement. • Accessibility of driver health history information. Adequacy of Examiner Qualifications The New Orleans driver received medical certification without a specialized or detailed medical evaluation, despite a history of serious disease. This was also true of the driver in the Central Bridge accident and of the drivers in the 15 other incidents noted in appendix H. Further instances of unfit drivers who obtained medical certificates are given in the Safety Board’s 1990 report on fatigue, alcohol, other drugs, and medical factors in fatal-to-the-driver heavy truck crashes.148 The Safety Board therefore concludes that the 148 Safety Study NTSB/SS-90/01, Vol. 2.

Analysis 55 Highway Accident Report failure of the medical certification process to remove unfit drivers is a systemic, not an isolated, problem. Although the Federal regulations require medical examiners to be familiar with the physical and mental demands facing commercial drivers, the instructions that generally accompany the old examination form do not describe these demands. In addition, there are no training or certification courses for examiners, so it is unclear how familiar the New Orleans and Central Bridge examiners were with these demands. The new medical examination form should make it easier for examiners to become familiar with some of the demands of operating a commercial vehicle. However, the Safety Board is still concerned that some examiners might not possess the skills or background necessary to evaluate common medical problems facing commercial vehicle drivers. An example of this concern is the inability of most chiropractors, who may serve as examiners in many States, to assess the possible effects of prescription drugs, nonprescription drugs, and drug interactions on commercial vehicle operators. The practice of chiropractic medicine specifically avoids the use of medications; chiropractors typically receive no formal training in pharmacology and are not licensed to prescribe medication. It is therefore unreasonable to expect that most doctors of chiropractic would know how certain medications affect driving performance. The FAA’s medical certification program stands in contrast to that for commercial drivers in both examiner qualifications and skills. All AMEs participating in the program are physicians, who must attend a 1-week seminar on the FAA’s medical certification program and take a refresher course every 3 years. In addition, they are kept abreast of new regulations and guidelines through a quarterly newsletter. Since not all commercial driver examiners have a background in drugs and drug interactions, or are familiar with the mental and physical demands of commercial driving, or are knowledgeable about the regulations and accompanying guidance material, the Board concludes that individuals who are authorized to perform medical examinations and certify commercial drivers as fit to drive may lack knowledge and information critical to certification decisions. Consequently, drivers with serious medical conditions may not be evaluated sufficiently to determine whether their condition poses a risk to highway safety. Adequacy of the Federal Regulations The accident driver had been diagnosed with kidney failure in July 1998 and had been receiving hemodialysis since December of that year. His medical records indicate that he failed to show up for dialysis treatments at least four times and that he terminated treatment prematurely on two occasions. One such occasion occurred the night before the accident, when the driver terminated hemodialysis treatment prematurely against medical advice. Although a person with kidney failure that is well controlled may experience few, if any, debilitating effects from the disease, a person with poorly controlled kidney failure can suffer symptoms ranging from fatigue and dizziness to seizures and coma.

Analysis 56 Highway Accident Report Kidney failure and other potentially debilitating diseases are not directly addressed in the regulations regarding the medical certification of commercial drivers, although the health history section of the medical examination form does provide a check box for kidney disease. A general clause requires disqualification for “any other condition, which is likely to cause loss of consciousness or any loss of ability to control a commercial motor vehicle,”149 but this requires the examiner to make a subjective assessment of the driver’s condition. Thus for a driver with significant diseases such as kidney failure, liver failure, breast cancer, gastrointestinal disease, or malignant melanoma, the regulations do not provide the examiner with specific, unambiguous language on which to deny medical certification. In addition, the regulations state that an examiner shall “be knowledgeable of the specific physical and mental demands associated with operating a commercial motor vehicle…,”150 but they do not define what constitutes “being knowledgeable.” One of the primary reasons for the new commercial driver examination form was to have it better reflect current medical knowledge, terminology, and practice. Yet the new form is still based on regulations that have not been updated substantially in 30 years.151 As a result, the form and the regulations do not reflect new knowledge in areas such as monocular vision (problems affecting one eye), kidney disease, sleep apnea, and fatigue. Strict application of the regulations could result in the disqualification of fit drivers and the certification of unfit drivers. Furthermore, examiners may be hampered in their ability to disqualify drivers that have medical problems mentioned in the new examination form but not specifically covered in the current regulations. Although the FAA’s medical fitness and certification criteria for airmen can appear as nonspecific as the criteria for commercial drivers (for example, kidney disease and cancer are also not specifically mentioned), the medical certification rules and procedures in place at the FAA make this less of a concern. For example, AMEs must also undergo certification training, are given a handbook containing examination procedures and guidance material, and are apprised of changes to the regulations and guidelines through a quarterly medical bulletin. In addition, examination forms are reviewed to better ensure that all certified airmen meet a consistent level of fitness. In contrast, commercial driver examiners are not required to attend a training or certification program, are not given a handbook of examination procedures, and do not receive regular updates of guidance information. Examination forms are not reviewed for completeness or consistency with the regulations and guidance information. Factors such as these make it all the more important that the regulations on commercial driver fitness be updated to reflect current knowledge and include more specific information on potentially disqualifying conditions. 149 Title 49 CFR 391.41(b)(8). 150 Title 49 CFR 391.43(c)(1). 151 In contrast, the “Medical Standards for Drivers” section of Canada’s National Safety Code, which has been voluntarily adopted by the provincial and territory licensing agencies as the minimum fitness requirement for drivers, is reviewed every 2 years by physicians representing each province and territory to keep it current with the medical literature.

Analysis 57 Highway Accident Report As the New Orleans accident clearly demonstrated, the regulations, as written, often do not permit examiners to determine whether drivers with common, potentially debilitating medical conditions should be issued a medical certificate. Coupled with the lack of certification training and the lack of knowledge about available guidance, this could result in some examiners incorrectly certifying unfit drivers. The Safety Board concludes that the regulations on the medical certification of commercial drivers do not reflect current medical knowledge and information and can be ambiguous regarding the conditions that may constitute disqualification. Adequacy and Availability of Nonregulatory Guidance Although the FMCSA had medical guidance information available on its Web site at the time of the New Orleans accident and provided guidance material to examiners who contacted its staff, the New Orleans examiner was apparently unaware of the additional guidance material. As a result, she may not have had the information she needed to adequately judge the health of the accident driver. The New Orleans crash clearly illustrates that some examiners may lack the proper resources to judge the fitness level of commercial vehicle drivers and may not know where to obtain it. During the Safety Board’s Commercial Driver Oversight Public Hearing, one witness testified that although examiners are expected to be knowledgeable of the regulations and guidance regarding commercial drivers and of the physical and mental requirements of the profession, some examiners do not know that the regulations or guidance exists.152 Further, even examiners who are aware of the regulations and guidance may not be aware of new information or changes to the material. The witness cited a study by the AAAM monitoring the performance of examiners, which indicated that, in some States, nearly half of the exams were done incorrectly.153 Although not a Federal requirement, the old commercial driver physical examination forms normally include instructions on the back regarding how to perform and record the medical examination. The new form created by the final rule published October 2000 includes a more thorough health history section that also prompts the driver to provide information on medication use. It contains the instructions and guidelines next to each item in the medical evaluation section, a section describing the type of duties that a driver might face as a result of his/her employment and an attached section containing the pertinent regulations and detailed instructions. However, because these instructions and guidelines are not a required part of the medical examination form, the possibility still exists that not all examiners will benefit from having this information. In addition, the final rule published in October 2000 notes that “existing forms may be used until November 6, 2001.” The old form is not as informative and the Safety Board is uncertain how this “sunset date” for the old form will be enforced, since no Federal requirement exists for anyone other than the examiner to see the form. 152 Dr. Natalie Hartenbaum, Occumedix, testimony, Commercial Driver Oversight Public Hearing, Safety Board. 153 Association for the Advancement of Automotive Medicine, Prototype State Medical Review Program: Final Report, DTFH 61-90-C-00098 (Washington, D.C.: Federal Highway Administration, 1995).

Analysis 58 Highway Accident Report Nevertheless, the Safety Board is encouraged by the progress that is being made to make the guidance information more accessible and to inform examiners of the occupational hazards of commercial driving. Under most situations, the medical examination instructions included with the new form may provide a satisfactory amount of information for examiners to evaluate drivers properly and a source of individualized guidance when available. Therefore, the Safety Board concludes that the new medical certification form for commercial drivers is a substantial improvement over the previous version and, if used in its entirety and in conjunction with attached instructions, will aid examiners in making certification decisions. During the Safety Board’s Commercial Driver Oversight Public Hearing, a witness stated that FMCSA staff members are “receptive and available for questions and guidance when an examiner knows to call them.”154 The FMCSA has made the medical advisory criteria available on its Web site and has included the criteria in the instructions for the new form, along with a telephone number. However, the FMCSA Driver and Carrier Operations Division has only one part-time and two full-time registered nurses on the medical team, who manage virtually the entire interstate medical certification process for an estimated 9 million commercial vehicle drivers. The Safety Board is encouraged by the attempts of the FMCSA to increase the dissemination of guidance to potential examiners through its Web site and the new medical examination form. However, the New Orleans accident, as well as other investigations that the Safety Board has conducted, have demonstrated that not all examiners are aware of such information. The Safety Board concludes that not all individuals who are authorized to perform medical examinations and certify commercial drivers as fit to drive are made aware of information sources that could assist them with certification decisions. Lack of a Review Process The medical examination forms completed for the drivers in the New Orleans and Central Bridge crashes noted significant medical histories, but received no further evaluation. The examiner of the New Orleans driver said that the driver was on medications for congestive heart failure, but she did not require further evaluation or disqualify him from driving. In the Central Bridge case, the physician noted the driver’s diabetes and his history of angioplasty, but she did not require a twice-yearly reevaluation of his diabetes, as mandated by State regulations, or additional evaluations of the driver’s heart condition. In addition, the Central Bridge driver did not complete the driver’s history section of his examination form, possibly allowing him to avoid questions about his heart condition. The current Federal medical certification program does not require that medical certificates or examination forms be reviewed by State licensing authorities or others once issued. A review process might have led to the detection of the inconsistencies and omissions present on the Central Bridge and New Orleans medical examination forms. 154 Dr. Natalie Hartenbaum, testimony, Commercial Driver Oversight Public Hearing, Safety Board.

Analysis 59 Highway Accident Report Concerns regarding the lack of a review process prompted the FHWA to require the six States participating in its pilot study to collect and review the medical examination forms of commercial vehicle drivers as part of the study. This requirement gave the State licensing authorities an opportunity to monitor the fitness of commercial drivers at the time of license application or renewal. Secondly, it allowed the licensing authorities to evaluate the quality of the medical certification process and the completeness and accuracy of the medical form. The results of the pilot program showed that the reviews uncovered several incomplete or otherwise unacceptable examination forms. The reviews also identified a number of applicants who did not meet the Federal or State fitness standards and who were subsequently disqualified. It is likely that these applicants would have obtained their CDLs and would have continued driving under the current Federal medical certification program. The NPRM for merging the CDL and the medical certificate, which is expected in 2002, is anticipated to propose several sweeping changes aimed at creating a more complete driver and examiner oversight system. The Safety Board is encouraged by the results of the pilot tests that drove the release of the ANPRM and the formation of a Negotiated Rulemaking Advisory Committee and hopes that the FMCSA moves quickly and aggressively towards enacting a complete and effective medical certification system. Louisiana does have a review process. Licensing agencies in the State review and track the latest medical examination form of drivers who are renewing their CDLs. However, because Louisiana requires that the CDL be renewed every 4 years, compared to every 2 years for the medical certificate, only every other medical examination form is reviewed and tracked by the licensing agency. The driver involved in the New Orleans accident renewed his CDL in November 1995 and submitted his latest medical examination form at that time. His health apparently began deteriorating after his last CDL renewal.155 Since he was not scheduled to renew his CDL until November 1999, the licensing agency did not have the results of his April 1998 and August 1998 commercial vehicle driver physicals. In comparison, California, Arizona, and Hawaii currently require that commercial drivers of vehicles heavier than 10,000 pounds submit their full medical examination form to the licensing agency for review and tracking. California and Arizona require that the form be submitted every 2 years, whereas Hawaii requires that the form be turned in during CDL issuance, renewal, or transfer.156 The District of Columbia and Indiana require that CDL holders submit the examination form every 2 years for review and tracking. Nevada requires intrastate CDL drivers to submit their examination forms.157 At least 11 155 The busdriver’s August 1997 medical records indicate that the busdriver had a 2-year history of high blood pressure and borderline diabetes. 156 In Hawaii, a CDL is current for 6 years. 157 From the Association for the Advancement of Automotive Medicine’s 1997 report to the FHWA, Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs. Wyoming requires that an examination form be submitted if it is known that a driver has a medical condition that might potentially impair his/her driving. Review and tracking information was not obtained for Alabama, Alaska, Oklahoma, and Pennsylvania.

Analysis 60 Highway Accident Report other States require drivers to submit a copy of their medical certificates to the licensing agency (see appendix D), but because the certificate only contains waiver information and the examiner’s endorsement and not the actual examination results, a full verification of the information that resulted in the certification is not possible. One of the most telling pieces of information about the New Orleans driver’s last medical examination was the date it was performed. Although the driver had a current medical certificate, his condition was such that Custom nevertheless required him to have another examination performed. Had this form been submitted to the State for review, the shortened renewal cycle would probably have been noticed and might have resulted in further scrutiny. Although a few States collect and review commercial driver examination forms more frequently than Louisiana, none has a system in place that could identify whether a driver had an examination performed within the 2-year medical certification cycle. The swift deterioration of the New Orleans driver’s medical condition illustrates that such a system is necessary for a reviewing agency to identify drivers who are potentially unfit. The FAA has such a system in place, with AMEs submitting every examination form to the Division of Aeromedical Certification. Therefore, the Safety Board concludes that the absence of a process under which every driver medical examination form is reviewed greatly increases the likelihood that medical certificates will be issued inappropriately, thereby allowing medically unqualified commercial vehicle drivers to continue driving. Other characteristics of the current commercial driver medical certification system support the need for a review process. During a commercial driver examination, examiners are placed in the difficult position of disqualifying some drivers, thereby depriving the drivers of their livelihood. This can be especially difficult for examiners who are also the drivers’ personal physicians. In addition, fear of legal action from drivers may exert further pressure on examiners to certify drivers with serious conditions that the regulations do not clearly establish as disqualifying, instead of requiring additional evaluation or disqualifying such drivers. A system of comprehensive review could eliminate some of the pressure on examiners, potentially allowing them to defer difficult cases; the FAA does this in its medical certification process. Finally, any agency designated to review medical examinations could serve as an effective source of guidance for examiners who have questions about a particular applicant. The Lack of a Tracking Mechanism for Medical Certification Exams When filling out his examination form, the New Orleans busdriver did not complete the health history section truthfully. In the check boxes provided, the driver indicated that he did not have a history of kidney or cardiovascular disease. He also told the examiner that he did not suffer from heart problems. When the examiner asked whether he was taking any medication, his response prompted her to ask him about heart problems again. Only then did he tell her that he indeed had a history of high blood pressure and congestive heart failure. The busdriver involved in the Central Bridge accident also failed to disclose his medical condition to the examiner. In the health history section of the examination form, the driver failed to indicate (either “yes” or “no”) whether he had a history of high blood pressure, heart disease, or vision problems. In

Analysis 61 Highway Accident Report addition, the driver failed to note past treatments for congestive heart failure and did not list his cardiac medications or his blood thinner. Any of this information might have helped the physician better establish the seriousness of the driver’s medical conditions. In each of these cases, the examiner issued the driver a medical certificate. However, even had the examiner denied the medical certificate, no regulation or mechanism existed to prevent the driver from simply visiting another examiner. Because such visits are not tracked, it is impossible to know whether a driver has, in fact, been denied medical certification by another examiner. The potential for an unfit driver to visit multiple examiners until one is found that will certify his or her health was a concern voiced by both physicians and licensing administrators during the Commercial Driver Oversight Public Hearing. “Doctor shopping” is possible because the current Federal regulations do not require examiners to contact a driver’s employer or the State licensing authority if a driver is found medically unqualified to operate a commercial vehicle.158 Therefore, only the driver and that administering examiner know whether the driver passed the fitness exam. Again, because of the lack of a tracking mechanism, the frequency of “doctor shopping” cannot be estimated reliably, but there are several reports of its occurrence.159 The Safety Board therefore concludes that, in the absence of a mechanism to track all medical certification examinations, a commercial driver with a serious medical condition who is denied a medical certificate by one examiner may be able to obtain a medical certificate from another examiner, thus subverting the purpose of the medical certification process. The current medical certification process for commercial vehicle drivers stands in contrast to the FAA’s certification system. The examination form used by the FAA can be obtained only through the Division of Aeromedical Certification. Each form is stamped with a unique number and must eventually be turned into the division regardless of whether it is used for an examination (for example, even if an examiner spills coffee on the form, making it unusable, it must still be turned in). In addition, the FAA maintains a registry of AMEs. The FAA also verifies, reviews, and tracks the information on every examination form. By tracking each form and by reviewing and maintaining a registry of examiners, the FAA has effectively eliminated the threat of “doctor shopping.” The Role of Other Responsible Parties The need for guidance extends beyond examiners to other health care professionals and individuals who may encounter commercial vehicle drivers between physical examinations. In the 2 years before the accident, several physicians and health 158 Dr. Natalie Hartenbaum testified that examiners at American College of Occupational and Environmental Medicine (ACOEM) seminars on DOT medical certification frequently asked whom they should notify upon examining a driver not meeting fitness requirements. (National Transportation Safety Board public hearing, Highway Transportation Safety Aspects of the North American Free Trade Agreement, Los Angeles, California, October 20 through 22, 1999.) 159 Some sources describing incidences of “doctor shopping” are N.P. Hartenbaum, The DOT Medical Examination (OEM Press: USA, 1997); S. Twedt, “Rigged for Disaster,” Pittsburgh Post Gazette, January 16, 2000; and testimony, Commercial Driver Oversight Public Hearing, Safety Board.

Analysis 62 Highway Accident Report care providers treated the New Orleans busdriver for heart failure and kidney failure. The driver was in the hospital as often as six times a week for hemodialysis treatment and dobutamine therapy. Many of them knew the busdriver’s profession, but apparently no one attempted to contact his employer or the State licensing authority concerning the busdriver’s fitness to operate a commercial vehicle. Louisiana has a procedure in place for physicians to report unfit drivers; as mentioned previously, it also offers immunity from criminal or civil action to any health care provider who files such reports in good faith. In August 1998, Custom required the driver to have a medical examination because of concerns about his fitness to operate a bus. However, Custom did not, and was not required to, report his condition to any regulatory authority. The health care providers that treated the driver during his frequent visits to the hospital knew he was a busdriver and were aware of his life-threatening medical conditions, but none reported, or were required to report, any concerns they might have had to any regulatory authority or to the driver’s employer. Similarly, the personal physician of the driver involved in the Central Bridge accident had expressed serious concerns about the driver’s condition and medication adversely impacting his ability to safely perform his job, but was not required to report his concerns, and apparently discussed them only with the driver. The Safety Board concludes that many drivers whose occupations and serious medical conditions are known to their employers, health care providers, and others are never reported, thereby potentially endangering the drivers themselves and others. Although Louisiana has an immunity law that protects physicians who report unfit drivers, it does not have one for other people who report unfit drivers in good faith. As shown in appendix G, at least 19 States do not offer immunity to physicians, and at least 30 do not offer immunity to those who report an unfit driver in good faith but are not physicians. Because of the critical importance of such reports in ensuring highway safety, the Safety Board believes that the National Conference of State Legislatures160 should inform State legislatures about this accident and make them aware of the importance of establishing immunity laws for the good-faith reporting of potentially impaired commercial drivers by all individuals and of ensuring that the medical community and the commercial transportation industry are familiar with these laws. Lack of Strong Certification Enforcement During his medical examination in August 1998, the New Orleans driver attempted to mislead the examining physician by stating in the health history section of the examination form that he did not have cardiovascular disease or kidney disease. The driver’s actions indicated that he clearly understood a full disclosure of his conditions would likely lead to a denial of his medical certification. However, it is also clear from the driver’s actions that the penalties for intentionally making false statements on the examination form were either not known to the driver or did not serve as an effective 160 The National Conference of State Legislatures provides State lawmakers with research and consulting services, publications, meetings, and seminars. The organization’s Web site http://www.ncsl.org states that the organization serves as a conduit for State lawmakers to communicate with one another and share ideas and assists States in representing their common interests before Congress, the administration, and Federal agencies.

Analysis 63 Highway Accident Report deterrent. The driver may have also known that an enforcement action was remote, given that this examination form did not need to be submitted to the Louisiana Division of Motor Vehicles. According to 49 CFR 390.37, making fraudulent or false statements on any application, certificate, report, or record described in that particular subchapter of the regulations (such as the commercial driver medical examination form) may result in civil or criminal penalties. As noted previously, the regulations do not mention any other penalties that apply specifically to the falsification of the medical examination form, such as the revocation of the medical certificate or the suspension of a driver’s CDL. The data compiled by the FMCSA on enforcement action only mention monetary penalties. Data are not readily available regarding whether any of the cited drivers had their medical certificate revoked or their license suspended or were disqualified from driving. This contrasts with the regulations that apply to the FAA’s medical examination form, for which there are specific penalties for making intentionally false statements. Airmen found to have made intentionally false statements on the form could have their licenses revoked if the FAA considers the offense serious. During their investigations, Safety Board investigators have occasionally encountered a driver who was carrying a forged medical certificate, such as in the Walker, California, and Middletown, New Jersey crashes (see appendix H). This is possible because the examination form is readily available from a variety of sources (for example, the new certificate and form can be ordered from a vendor), and no procedure or information source exists to validate the medical certificate itself or the name of the examiner who signed it. The absence of a procedure or information source to determine the validity of a current medical certificate has limited the effectiveness of MCSAP safety inspections. As noted previously, in most cases, MCSAP safety inspectors only check whether a driver has a current medical certificate, whether a driver meets medical exemption requirements, and whether the carrier has included a current copy of a driver’s medical certificate in the file. In most cases, inspectors can only determine whether a driver is unfit to operate a commercial vehicle when the driver clearly requires a medical exemption but does not have one; it is not surprising that only the lack of a proper SPE certificate or exemption, or the absence of corrective lenses or a hearing aid when one is required by a driver’s medical certificate, can result in the driver being placed out of service under Federal law.161, 162 Some States, such as California and Arizona, not only review and track commercial driver examination forms, but have also merged the CDL with the medical certificate. Both California and Arizona allow the licensing agency to disqualify a commercial driver if the driver does not posses a current medical examination form or if the agency has concerns about the accuracy or completeness of the form. Because law 161 North American Standard Out-Of-Service Criteria, 2001. 162 State laws may include other violations that could result in the driver being placed out of service.

Analysis 64 Highway Accident Report enforcement officers in these States are able to check on a driver’s license status during inspections and routine stops, they are able to prevent disqualified drivers from driving, effectively keeping potentially unfit drivers from operating commercial vehicles. Unfortunately, this enforcement program works only for commercial drivers licensed in California and Arizona, because most other States have not implemented a medical examination form review process and have not linked driver fitness with the CDL. The Safety Board concludes that enforcement authorities cannot, in most instances, determine the validity of a medical certificate during safety inspections and routine stops because of the absence of procedures or information sources to validate the medical certificate itself. The Safety Board further concludes that the inability to authenticate the information on a medical certificate hampers enforcement authorities in their ability to identify unfit drivers and place them out of service. Toward an Effective Medical Certification Program Based on the New Orleans accident and on other accidents involving drivers with known serious medical conditions who were still able to obtain medical certificates, the Safety Board finds a number of elements to be critical to the establishment of an effective medical certification program for commercial drivers, as discussed below: Qualified Examiners. Examiners should have specific training for performing examinations to determine the fitness of commercial drivers; in addition, examiners required to be the certifying authority should have a background permitting them to adequately evaluate all common medical conditions or medications for their potential to impair a driver. Medical Certification Regulations. The regulations are updated regularly to permit trained examiners to clearly determine whether to issue a medical certificate to drivers with certain common medical conditions. Adequate Guidance. Potential examiners should receive guidance that permits them to perform a physical examination adequate for making informed certification decisions on a commercial driver. Examiners, if required to be the certifying authority, are given guidance regarding the certification of medical conditions not covered by the regulations. Examiners should have a readily identifiable source of information for specific questions in which the guidance may be inadequate. Review Process. Completed examination forms should undergo at least one review by a trained individual other than the examiner so that certifications issued in error are corrected or prevented. All applications or completed medical examinations on commercial drivers are recorded and reviewed so that comparisons may be made of every subsequent application or examination. This comparison ensures that significant changes in medical information provided through the medical certification system can be adequately evaluated.

Analysis 65 Highway Accident Report Identification of Invalid Certification. Law enforcement will be able to establish, during safety inspections and routine stops, that a commercial driver’s medical certification is valid. Removal of Uncertified Drivers. Upon determining the validity of a certificate, law enforcement can disqualify a driver from operating a commercial vehicle. The driver will not be permitted to return to commercial driving until receiving a medical evaluation that establishes that the driver has no potentially impairing or incapacitating medical condition. Reporting of Medical Conditions. Drivers who are found by their employers, their health care providers, or others to have developed a potentially impairing or incapacitating condition between required medical certification examinations will be reported to the appropriate regulatory authority. All potential reporters of such information are aware of and are able to utilize procedures for such reports. All medical conditions discovered through such a reporting process will be adequately evaluated. The severity of the New Orleans busdriver’s medical condition might have been rare, but the situation is not unique. The ease in which the current medical certification procedures can be bypassed virtually assures that some unfit drivers will find their way behind the wheel of a commercial vehicle, endangering themselves and the motoring public. To curb this danger and to better accomplish the intent of the medical certification process, the Safety Board believes that the FMCSA should develop a comprehensive medical oversight program for interstate commercial drivers that contains the following program elements: • Individuals performing medical examinations for drivers are qualified to do so and are educated about occupational issues for drivers. • A tracking mechanism is established that ensures that every prior application by an individual for medical certification is recorded and reviewed. • Medical certification regulations are updated periodically to permit trained examiners to clearly determine whether drivers with common medical conditions should be issued a medical certificate. • Individuals performing examinations have specific guidance and a readily identifiable source of information for questions on such examinations. • The review process prevents, or identifies and corrects, the inappropriate issuance of medical certification. • Enforcement authorities can identify invalid medical certification during safety inspections and routine stops. • Enforcement authorities can prevent an uncertified driver from driving until an appropriate medical examination takes place.

Analysis 66 Highway Accident Report • Mechanisms for reporting medical conditions to the medical certification and reviewing authority and for evaluating these conditions between medical certification exams are in place; individuals, health care providers, and employers are aware of these mechanisms. The Safety Board is aware that all of the State licensing agencies have adopted the Federal requirements for interstate commercial driver fitness for their intrastate commercial drivers. The Board recognizes that the issues discussed here apply fully to intrastate drivers as well. The American Association of Motor Vehicle Administrators (AAMVA) represents State and provincial officials in the United States and Canada who administer and enforce laws pertaining to the motor vehicle and its use. The programs administered by the AAMVA, such as the Commercial Driver License Information System and the International Registration Plan,163 encourage uniformity and reciprocity among the States, other levels of government, and the private sector. The Safety Board recommends that AAMVA urge its member States to develop a comprehensive medical oversight program for intrastate commercial drivers containing the features discussed in the recommendation to the FMCSA. Drug Testing Procedures When the New Orleans driver applied for the position at Custom, he listed his former positions with Hertz Car Rental and Turner’s Bus Service, but did not mention positions held with The Regional Transit Authority and with Westside Bus Service, where he had been dismissed for testing positive for marijuana. He explained the gaps in his employment record by stating that he was a musician in a brass band during those times. Custom sent requests for information to both Hertz Car Rental and Turner’s Bus Service, both of which were authorized by the busdriver. However, Custom did not receive a response from either company. While with Custom, the driver underwent a preemployment and three random drug tests during his tenure with negative results. Three problems are evident from the events described above. First, the driver was able to avoid negative scrutiny from Custom by omitting parts of his employment history. Second, although Custom obtained the driver’s permission to investigate his employment history, it did not receive a response from any of the former employers it contacted. Third, no enforcement mechanism or incentive exists to compel previous employers to comply with information requests. Although the 1996 NPRM on new driver safety performance history proposes that prospective employers expand their inquiries into a driver’s background, it is still possible for drivers to hide positive drug test results in the manner of the New Orleans driver. Title 49 CFR 391.21 requires drivers to provide carriers with the names and addresses of employers from their previous 3 years of employment, including their employment dates 163 See http://www.aamva.org for an explanation of these programs.

Analysis 67 Highway Accident Report and reasons for leaving. However, drivers are unlikely to provide such history when it might limit their opportunities for employment. Additionally, enforcing this requirement is difficult because the only way to detect a false employment history would be to obtain employment information from someone other than the driver. The April 2001 NPRM on workplace drug and alcohol testing programs issued by the FMCSA proposes that employers ask individuals applying for safety-sensitive positions whether, in the past 2 years, they had ever tested positive on, or had refused to test for, any preemployment drug or alcohol test administered by an employer who subsequently did not hire them. The Safety Board does not believe this self-reporting method will effectively identify problem drivers because drivers are unlikely to provide information that may limit their employment opportunities. Because employees are unlikely to divulge positive drug test results and because prospective employers may not have sufficient employment history or the authority to obtain information from previous employers regarding positive drug tests, the Safety Board concludes that results of tests for controlled substances performed under the DOT testing guidelines, even when positive, are often not available to prospective employers, making it difficult for them to make well-informed hiring decisions. Drivers who own and operate their own commercial vehicles (owner-operators) are required by the regulations to comply with all the requirements stipulated for both drivers and employers. Owner-operators are thus in the precarious position of overseeing their own substance abuse program. No Federal requirements exist for reporting drivers who have tested positive for controlled substances to any regulatory or certifying authority. Therefore, the only entity with information regarding a positive test is the employer, who, if an owner-operator, may also be the individual being tested. Such an arrangement requires owner-operators who are abusing controlled substances to remove themselves from driving if they test positive for such substances. It seems highly unlikely that those owner-operators who are not complying with the regulations regarding the use of controlled substances will comply with other sections of the drug testing regulations. Therefore, the Safety Board concludes that the current Federal drug testing regulations cannot adequately identify owner-operators who abuse controlled substances. A database that records positive drug and alcohol test results and refusal determinations for all commercial drivers would provide an effective way for both employers and certifying authorities to verify and evaluate the drug test history of all commercial drivers. Such a database would allow employers to make more informed hiring decisions and would allow certifying authorities to determine whether a driver has a potentially disqualifying medical condition regarding substance abuse. Therefore, the Safety Board believes that the FMCSA should develop a system that records all positive drug and alcohol test results and refusal determinations that are conducted under the DOT testing requirements, require prospective employers to query the system before making a hiring decision, and require certifying authorities to query the system before making a certification decision.

Analysis 68 Highway Accident Report Bus Crashworthiness In the New Orleans accident, many of the passengers were thrown forward from their seating compartments and later found lying on top of other passengers near seat row four. In addition, EMS personnel found nine passengers and the driver lying outside the vehicle. In all, 22 passengers were fatally injured as a result of this accident. The loss of survivable space was apparent for some seating positions; in others, survivable space was present and could have been utilized had the passenger been retained within the seating compartment. Investigators determined, based upon the driver’s injuries and the distance that he was thrown from the bus, that the driver was not wearing a seat belt at the time of the accident. The driver’s seat was the only belted position on the motorcoach and is the only position required by Federal regulations to have a seat belt. From its investigations of past motorcoach accidents, the Safety Board has become concerned that motorcoach passengers are not adequately protected in collisions. Although Federal Motor Vehicle Safety Standards exist for large school buses relating to passenger seating, crash protection, and body joint strength, no similar standards apply to other types of large buses, including motorcoaches. In other words, no Federal regulation or standard requires that large buses sold or operated in the United States be equipped with active or passive occupant protection (other than for the driver). In September 1999, the Safety Board published a report titled Bus Crashworthiness Issues 164 that addressed these concerns and examined 36 motorcoach accidents investigated by the Board from 1968 through 1997. Based on the investigations and current knowledge of occupant protection systems, the Safety Board concluded that one of the primary causes of preventable injury in motorcoach accidents involving a rollover, ejection, or both is occupant motion out of the seat compartment during a collision when no intrusion occurs into the seating area. In addition, the Board concluded that the overall injury risk to occupants in motorcoach accidents involving rollover and ejection could be reduced significantly by retaining the passenger in the seating compartment throughout the collision. In the bus crashworthiness report, the Safety Board issued five recommendations to improve the structure and safety of motorcoaches. The Safety Board notes that the improvements identified in this report also apply to the New Orleans accident. Accordingly, the Board is reiterating Safety Recommendations H-99-47 through H-99-51 from the bus crashworthiness report to the National Highway Traffic Safety Administration (NHTSA): 164 NTSB/SIR-99/04.

Analysis 69 Highway Accident Report H-99-47 In 2 years, develop performance standards for motorcoach occupant protection systems that account for frontal impact collisions, side impact collisions, rear impact collisions, and rollovers. H-99-48 Once pertinent standards have been developed for motorcoach occupant protection systems, require newly manufactured motorcoaches to have an occupant crash protection system that meets the newly developed performance standards and retains passengers, including those in child safety restraint systems, within the seating compartment throughout the accident sequence for all accident scenarios. H-99-49 Expand your research on current advanced glazing to include its applicability to motorcoach occupant ejection prevention, and revise window glazing requirements for newly manufactured motorcoaches based on the results of this research. H-99-50 In 2 years, develop performance standards for motorcoach roof strength that provide maximum survival space for all seating positions and that take into account current typical motorcoach window dimensions. H-99-51 Once performance standards have been developed for motorcoach roof strength, require newly manufactured motorcoaches to meet those standards. NHTSA has responded favorably to these recommendations. With regard to H-99-47 and -48, NHTSA stated in March 2000 that it would consider whether seat belts would be beneficial in motorcoaches. However, NHTSA also noted that since only about five passengers are killed in motorcoach accidents each year, it would be inappropriate to reduce funding for other programs that have the potential to save many more lives to concentrate on motorcoach issues. NHTSA acknowledged that the crashworthiness issues raised by the Safety Board deserve to be analyzed and said that it would examine opportunities to share the cost of research with motorcoach manufacturers. With regard to H-99-49, in August 2001, a NHTSA representative stated that the agency is working on testing procedures for ejection mitigation in light vehicles. The procedures take into account window glazing as well as advanced designs for side curtains/airbags. NHTSA further stated that once it has an ejection mitigation testing procedure that works for light vehicles, the agency plans to use it as a starting point for investigating ejection mitigation in motorcoaches.

Analysis 70 Highway Accident Report With regard to H-99-50 and -51, NHTSA responded that it was unaware of recent incidents where roof crush was a predominant factor in the injuries to occupants in motorcoaches.165 It stated that although the increased sizes of side windows may lead to motorcoaches having fewer side support columns to support the weight of the motorcoach during rollovers, the material and manufacturing processes have improved in the 30 years since the Safety Board last reported an accident in which roof strength was a factor in occupant injuries. However, contingent upon the availability of resources, NHTSA stated that it will begin assessing the possibility of requiring motorcoaches to meet the same or similar standards for roof crush as do large school buses. In April 2001, the Safety Board acknowledged that NHTSA had initiated a research plan to address Safety Recommendations H-99-47 through -51. Accordingly, pending an update on NHTSA’s activities in this area, the Safety Board has classified Safety Recommendations H-99-47 through –51 as “Open—Acceptable Response.” Guardrail Performance During the accident sequence, the motorcoach struck the terminal end of a guardrail and fractured 11 wooden guardrail posts. The 27-inch-high guardrail at the accident scene was not designed to redirect vehicles as tall (center of gravity 39 inches above the ground) and heavy as a 35,250-pound motorcoach. Given an estimated speed of 60 mph and the approach angle of the motorcoach, it struck the guardrail with a force that was 62 times more than the guardrail was designed to absorb. If the guardrail had not failed, it may have caused the motorcoach to roll over166 because of the motorcoach’s having a higher center of gravity than the vehicles for which the guardrail was designed. A rollover may have led to side window ejections and roof crush that would have reduced the amount of survivable space in the bus. Although it is difficult to speculate on the extent of occupant injuries had the Custom motorcoach rolled over, the Safety Board has documented the risk to occupants of bus rollovers and roof crush in its special investigation report on bus crashworthiness issues.167 Although the presence of the guardrail system had little effect on the severity of the accident, Safety Board investigators were concerned that the extensive termite damage found in some of the guardrail posts could have compromised the safety of the smaller private passenger vehicles that the barrier system was designed to stop.168 According to the USFS report, the original shear strength of the undecayed portions of the posts was above 165 The Safety Board’s investigation into a December 1998 motorcoach accident in Old Bridge, New Jersey (docket number HWY99MH007), revealed that one passenger, who was alive after the accident, died due to asphyxiation from roof crush. In addition, the Safety Board is investigating another motorcoach accident, which occurred in Canon City, Colorado, in December 1999, that resulted in extensive roof crush. 166 NTSB/SIR-99/04. 167 NTSB/SIR-99/04. 168 This type of guardrail system is designed to redirect safely small and large passenger cars. It was performance tested with vehicles that weighed between 1,764 and 4,409 pounds.

Analysis 71 Highway Accident Report average. However, two of the four decayed samples were determined to have considerable insect damage, with clear indications of feeding galleries, excrement, and soil. These posts had suffered such severe attack from insects that their ability to resist impact loads was reduced, which suggests that the posts may have failed if hit by a passenger car. The Safety Board concludes that although it is highly unlikely that the breakaway cable terminal and W-beam guardrail system would have redirected the bus, even had the posts been in good condition, the damaged and weakened condition of the posts before the accident makes it likely that they would have been inadequate at redirecting private passenger vehicles as well. The DOTD was apparently unaware of the insect damage because it does not have a program to periodically inspect guardrail posts for structural integrity. Therefore, the Safety Board believes that the DOTD should inspect all wooden guardrail posts for structural integrity and replace those that do not meet the AASHTO crash performance design criteria. The AASHTO guidelines state that preservative-treated wooden posts, such as the ones used at the accident site, require almost no maintenance, except for an occasional cleaning and painting. However, evidence gathered from the accident site indicates that periodic inspections of wooden guardrail posts may be warranted. Therefore, the Safety Board believes that AASHTO should inform its members about the weakened guardrail conditions due to termite infestation found in this accident and urge them to perform periodic structural inspections of wooden guardrail posts.

72 Highway Accident Report Conclusions Findings 1. The mechanical condition of the bus, the weather, emergency management, and motor carrier management did not contribute to or influence the severity of the accident. 2. The failure of the medical certification process to remove unfit drivers is a systemic, not an isolated, problem. 3. Individuals who are authorized to perform medical examinations and certify commercial drivers as fit to drive may lack knowledge and information critical to certification decisions. Consequently, drivers with serious medical conditions may not be evaluated sufficiently to determine whether their condition poses a risk to highway safety. 4. The regulations on the medical certification of commercial drivers do not reflect current medical knowledge and information and can be ambiguous regarding the conditions that may constitute disqualification. 5. The new medical certification form for commercial drivers is a substantial improvement over the previous version and, if used in its entirety and in conjunction with attached instructions, will aid examiners in making certification decisions. 6. Not all individuals who are authorized to perform medical examinations and certify commercial drivers as fit to drive are made aware of information sources that could assist them with certification decisions. 7. The absence of a process under which every driver medical examination form is reviewed greatly increases the likelihood that medical certificates will be issued inappropriately, thereby allowing medically unqualified commercial vehicle drivers to continue driving. 8. In the absence of a mechanism to track all medical certification examinations, a commercial driver with a serious medical condition who is denied a medical certificate by one examiner may be able to obtain a medical certificate from another examiner, thus subverting the purpose of the medical certification process. 9. Many drivers whose occupations and serious medical conditions are known to their employers, health care providers, and others are never reported, thereby potentially endangering the drivers themselves and others.

Conclusions 73 Highway Accident Report

1. Enforcement authorities cannot, in most instances, determine the validity of a medical

certificate during safety inspections and routine stops because of the absence of procedures or information sources to validate the medical certificate itself.

1. The inability to authenticate the information on a medical certificate hampers

enforcement authorities in their ability to identify unfit drivers and place them out of service.

1. Results of tests for controlled substances performed under the U.S. Department of

Transportation testing guidelines, even when positive, are often not available to prospective employers, making it difficult for them to make well-informed hiring decisions.

1. The current Federal drug testing regulations cannot adequately identify

owner-operators who abuse controlled substances.

1. Although it is highly unlikely that the breakaway cable terminal and W-beam

guardrail system would have redirected the bus, even had the posts been in good condition, the damaged and weakened condition of the posts before the accident makes it likely that they would have been inadequate at redirecting private passenger vehicles as well. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the driver’s incapacitation due to his severe medical conditions and the failure of the medical certification process to detect and remove the driver from service. Other factors that may have had a role in the accident were the driver’s fatigue and the driver’s use of marijuana and a sedating antihistamine.

74 Highway Accident Report Recommendations To the Federal Motor Carrier Safety Administration: Develop a comprehensive medical oversight program for interstate commercial drivers that contains the following program elements: • Individuals performing medical examinations for drivers are qualified to do so and are educated about occupational issues for drivers. (H-01-17) • A tracking mechanism is established that ensures that every prior application by an individual for medical certification is recorded and reviewed. (H-01-18) • Medical certification regulations are updated periodically to permit trained examiners to clearly determine whether drivers with common medical conditions should be issued a medical certificate. (H-01-19) • Individuals performing examinations have specific guidance and a readily identifiable source of information for questions on such examinations. (H-01-20) • The review process prevents, or identifies and corrects, the inappropriate issuance of medical certification. (H-01-21) • Enforcement authorities can identify invalid medical certification during safety inspections and routine stops. (H-01-22) • Enforcement authorities can prevent an uncertified driver from driving until an appropriate medical examination takes place. (H-01-23) • Mechanisms for reporting medical conditions to the medical certification and reviewing authority and for evaluating these conditions between medical certification exams are in place; individuals, health care providers, and employers are aware of these mechanisms. (H-01-24) Develop a system that records all positive drug and alcohol test results and refusal determinations that are conducted under the U.S. Department of Transportation testing requirements, require prospective employers to query the system before making a hiring decision, and require certifying authorities to query the system before making a certification decision. (H-01-25)

Recommendations 75 Highway Accident Report To the American Association of Motor Vehicle Administrators: Urge your member States to develop a comprehensive medical oversight program for intrastate commercial drivers that contains the following program elements: • Individuals performing medical examinations for drivers are qualified to do so and are educated about occupational issues for drivers. • A tracking mechanism is established that ensures that every prior application by an individual for medical certification is recorded and reviewed. • Medical certification regulations are updated periodically to permit trained examiners to clearly determine whether drivers with common medical conditions should be issued a medical certificate. • Individuals performing examinations have specific guidance and a readily identifiable source of information for questions on such examinations. • The review process prevents, or identifies and corrects, the inappropriate issuance of medical certification. • Enforcement authorities can identify invalid medical certification during safety inspections and routine stops. • Enforcement authorities can prevent an uncertified driver from driving until an appropriate medical examination takes place. • Mechanisms for reporting medical conditions to the medical certification and reviewing authority and for evaluating these conditions between medical certification exams are in place; individuals, health care providers, and employers are aware of these mechanisms. (H-01-26) To the National Conference of State Legislatures: Inform State legislatures about this accident and make them aware of the importance of establishing immunity laws for the good-faith reporting of potentially impaired commercial drivers by all individuals and of ensuring that the medical community and the commercial transportation industry are familiar with these laws. (H-01-27) To the American Association of State Highway and Transportation Officials: Inform your members about the weakened guardrail conditions due to termite infestation found in this accident and urge them to perform periodic structural inspections of wooden guardrail posts. (H-01-28)

Recommendations 76 Highway Accident Report To the State of Louisiana Department of Transportation and Development: Inspect all wooden guardrail posts for structural integrity and replace those that do not meet the American Association of State Highway and Transportation Officials crash performance design criteria. (H-01-29) The NTSB also reiterates the following recommendations: To the National Highway Traffic Safety Administration: In 2 years, develop performance standards for motorcoach occupant protection systems that account for frontal impact collisions, side impact collisions, rear impact collisions, and rollovers. (H-99-47) Once pertinent standards have been developed for motorcoach occupant protection systems, require newly manufactured motorcoaches to have an occupant crash protection system that meets the newly developed performance standards and retains passengers, including those in child safety restraint systems, within the seating compartment throughout the accident sequence for all accident scenarios. (H-99-48) Expand your research on current advanced glazing to include its applicability to motorcoach occupant ejection prevention, and revise window glazing requirements for newly manufactured motorcoaches based on the results of this research. (H-99-49) In 2 years, develop performance standards for motorcoach roof strength that provide maximum survival space for all seating positions and that take into account current typical motorcoach window dimensions. (H-99-50) Once performance standards have been developed for motorcoach roof strength, require newly manufactured motorcoaches to meet those standards. (H-99-51)

Recommendations 77 Highway Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: August 28, 2001

78 Highway Accident Report Appendix A Investigation and Public Hearing The National Transportation Safety Board was notified of the New Orleans, Louisiana, accident about 1:00 p.m. on May 9, 1999. The Safety Board dispatched an investigative team with members from the Washington, D.C.; Atlanta, Georgia; Parsippany, New Jersey; Arlington, Texas; Denver, Colorado; and Gardena, California, offices. Groups were established to investigate highway, vehicle, and survival factors; human performance; and motor carrier operations. Parties to the on-scene investigation were the Federal Motor Carrier Safety Administration; Louisiana Department of Transportation; Louisiana State Police; New Orleans Police Department; United Motorcoach Association; Custom Bus Charters, Incorporated; National Seating Company; Motor Coach Industries; and TRW, Commercial Steering Systems. The Safety Board also conducted a public hearing for this accident on January 20 and 21, 2000, in New Orleans, Louisiana. Parties to the hearing were the U.S. Department of Transportation; American Automobile Association; American Association of State Highway and Transportation Officials; Commercial Vehicle Safety Alliance; National Association of Governors’ Highway Safety Representatives; American Trucking Associations, Inc.; National Private Truck Council; Owner-Operator Independent Drivers Association, Inc.; American Bus Association; United Motorcoach Association; Motor Coach Industries; Amalgamated Transit Union; International Brotherhood of Teamsters; Transport Workers Union of America; Advocates for Highway and Auto Safety; and Parents Against Tired Truckers.

79 Highway Accident Report Appendix B New Orleans Driver Medical Information Table 3. Information extracted from the driver’s medical records by the Medical Officer, National Transportation Safety Board. Date Information Source 8/21/97 Admitted to hospital with shortness of breath, exercise intolerance, orthopnea (shortness of breath when lying down), and pedal edema (swelling of the feet) worsening over “past month or so.” He was noted to have a 2-year history of high blood pressure and borderline diabetes, and it was stated that he “reports not taking his medication over the last 4 months,” and that he “had no medical workup in past 10 years.” Family history indicated “+/- father died at 54 with enlarged heart, ? if had myocardial infarction [heart attack].” On admission, he had abnormal laboratory values that included BUN (blood urea nitrogen) of 34, serum creatinine of 4, and 3+ protein and granular casts in his urine. He was admitted with a diagnosis of “new onset Congestive Heart Failure” and “renal insufficiency with proteinuria.” Records obtained under subpoena from Medical Center of Louisiana (Charity Hospital). 8/22/97 Echocardiogram performed as inpatient indicated “severe global left ventricular hypokinesis with an estimated ejection fraction of 10%.” The summary of the study stated “Findings consistent with end-stage dilated cardiomyopathy.” Records obtained under subpoena from Medical Center of Louisiana. 8/23/97 Discharged from hospital on medications: Lasix (furosemide) 40 mg per day, K-Dur (potassium) 20 meq per day, and Zestril (lisinopril) 10 mg per day. Records obtained under subpoena from Medical Center of Louisiana. 11/25/97 Seen in the emergency department with 5-day history of shortness of breath, orthopnea. Notes indicate that he “admits being non-compliant with Lasix regularly secondary to job (drives bus).” Comments under “Financial Information” state that he “has been unemployed 4 months,” but indicates “Hertz corporation” under “Employer Name.” Laboratory evaluation indicated a BUN of 56 and serum creatinine of 4.0. Impression was listed as “44 year-old with end-stage cardiomyopathy presents with shortness of breath after 2-3 weeks non-compliance.” It was noted that “patient needs close followup for congestive heart failure and chronic renal insufficiency. ” Records obtained under subpoena from Medical Center of Louisiana. 3/20/98 Transferred from hospital in Shreveport to Ochsner Foundation Hospital. Admission note indicates “Presented on 3/16/98 with 3 week history of dyspnea on exertion, 2 pillow orthopnea and paroxysmal noncturnal dyspnea [shortness of breath at night] all with increase progressively. On day of presentation he had severe shortness of breath and diaphoresis [sweating] while moving luggage. … MUGA scan 3/98 ejection fraction 17%.” Home medications were listed as Lasix (furosemide) 10 mg each day and Zestril (lisinopril) 10 mg each day. Laboratory evaluation on admission indicated a BUN of 62 and a serum creatinine of 5.5. Nursing admission note indicates occupation as “Driving” and admission record indicates employer as “Custom Bus Ch.” Right heart catheterization was performed indicating “high wedge pressure” of 30 and “poor cardiac output/cardiac index” of 3.47/1.48. Echocardiogram was performed indicating “global left ventricular systolic function appears severely depressed with a visually estimated ejection fraction of 10%.” Records obtained under subpoena from Ochsner Medical Institutions.

Appendix B 80 Highway Accident Report Date Information Source 3/23/98 Discharged from hospital with principal diagnosis of “Congestive Heart Failure Stage IV” and other significant diagnoses of “acute on chronic renal failure, dilated cardiomyopathy, hypertension, morbid obesity.” Progress notes indicate “not a transplant candidate due to renal failure and weight.” Discharge medications listed as hydralazine 75 mg three ties a day, Lopressor (metoprolol) 25 mg twice a day, Imdur (Isosorbide mononitrate) 60 mg per day, Coumadin (warfarin) 5 mg per day, aspirin one tablet per day, Axid (nizatidine) 150 mg per day, and Lasix (furosemide) 40 mg twice a day. Discharge summary notes level of activity as “some limitation” and states “rest if short of breath at work. No overexertion.” Records obtained under subpoena from Ochsner Medical Institutions. 7/5/98 Admitted to hospital with progressive shortness of breath for 3 to 4 days. Notes state “The patient is on chronic medical therapy for this problem but continues to work. He gets breathless at low levels of activity…” Medications on admission were listed as Lasix (furosemide), Coumadin (warfarin), Apresoline (hydralazine), nitrates, and Micro-K (potassium). The records note that he “initially developed problems in Shreveport while on a bus trip.” Laboratory evaluation on admission indicated a BUN of 55 and a serum creatinine of 6.3. His weight on admission was noted to be 89.1 kg. Records obtained under subpoena from West Jefferson Medical Center (Marrero, Louisiana). 7/8/98 Echocardiogram performed as inpatient indicated “dilated left ventricle. Assessment for wall motion and abnormalities is very difficult but appears to be akinetic posterior and posterolateral wall. Ejection fraction is estimated to be on the order of 20%” and “mitral regurgitation at least moderate…” Records obtained under subpoena from West Jefferson Medical Center. 7/10/98 Discharged from hospital with diagnoses: “congestive failure not compensated,” “dilated cardiomyopathy,” and “advanced renal failure.” Discharge medications were: Lopressor (metoprolol) 25 mg per day, Coumadin (warfarin) 5mg per day, Apresoline (hydralazine) 25 mg four times a day, and Bumex (bumetanide) 2 mg twice a day. Records obtained under subpoena from West Jefferson Medical Center. 7/17/98 Underwent kidney biopsy; pathology report indicated “severe global and segmental glomerulosclerosis,” “nephrosclerosis, severe,” and “acute interstitial nephritis, consistent with iatrogenic etiology.” Records obtained under subpoena from West Jefferson Medical Center. 8/7/98 Outpatient cardiology notes indicate “… comes in for follow up after his hospitalization at West Jefferson Medical Center for congestive heart failure. … He reports that since his discharge he has done fairly well except for some dyspnea [difficulty breathing] last night. He has not had any orthopnea, peripheral edema, chest pain or palpitations. He continues on his Coumadin although he is uncertain why he is on that medication.” Patient registration form indicates “Occupation” as “charter bus driver.” Medical history questionnaire indicates under “Have you ever been diagnosed with heart problems?” – “Yes – Congestive heart failure,” under “Has anyone in your immediate family been diagnosed with heart disease?” — “Yes – father died of enlarged heart,” under “have you ever or do you currently use any recreational drugs?” neither “Yes” nor “No” is marked, under “have you been diagnosed with …diabetes – Yes … high blood pressure – Yes … kidney or bladder problems – Yes.” Records obtained under subpoena from Heart Clinic of Louisiana. 8/19/98 Underwent examination for Commercial Driver’s License. All of the “Yes/No” blocks under health history are marked “No,” including those for kidney and cardiovascular disease. Written notes indicate past medical history of hypertension and congestive heart failure, and medications including warfarin, hydralazine, Lasix (furosemide), metroprolol, and Bumex (bumetanide). Urine albumin indicates “trace.” Under “General Comments” is the note “Patient must continue medication and follow up routinely with doctor.” The Medical Examiner’s Certificate is signed indicating that the individual was found qualified under 49 CFG 391.41 through 391.49. Records obtained from Westbank Primary Care (Westwego, Louisiana).

Appendix B 81 Highway Accident Report Date Information Source 10/8/98 Coumadin Therapy Record notes from Ochsner clinic indicate “Patient has not responded to our letter and we are unable to communicate with patient – never returns our calls.” Records obtained under subpoena from Ochsner Medical Institutions. 10/5/98 “Patient Information Form” for primary care physician indicates employer as “Custom Bus Charters.” Physician’s note indicates: “Wants to get referral to see his cardiologist … History of congestive heart failure twice in past … still with some shortness of breath. Snores. Sleepy days but shift changes constantly (charter bus driver).” Medications refilled: metoprolol 50 mg per day, Coumadin (warfarin) 5 mg per day, hydralazine 25 mg twice a day, and Bumex (bumetanide) 2.5 mg four times a day. Records obtained under subpoena from Dr. Janice S. Glenn. 10/12/98 Referral form from primary care physician to Cardiology indicates diagnosis of “Congestive Heart Failure - Hypertension.” Records obtained under subpoena from Dr. Janice S. Glenn. 10/15/98 Referral form from primary care physician for “Sleep Study” indicates diagnosis of “Sleep Apnea.” Records obtained under subpoena from Dr. Janice S. Glenn. 11/9/98 Primary care physician’s note indicates that the cardiologist phoned: “creatinine 7.7!! Referred him immediately….” Referral form from primary care physician to Nephrology indicates diagnosis of “Abnormal lab test (elevated creatinine).” Records obtained under subpoena from Dr. Janice S. Glenn. 12/1/98 Seen in emergency department for “progressive shortness of breath for 3-4 days, increased orthopnea.” Noted that he was “told he has moderate kidney problems and hypertension but is not aware that he has serious end-organ damage /very poor insight into his condition.” Laboratory evaluation indicated a BUN of 160 and a serum creatinine of 12.7. Medications on admission to hospital were noted to be prednisone 80 mg/day, Bumex (bumetanide) 2 mg twice a day, Coumadin (warfarin) 5mg per day, and Zaroxolyn (metolazone) 5 mg every other day. Records obtained under subpoena from West Jefferson Medical Center. 12/2/98 Inpatient echocardiogram performed showing “left ventricular chamber size is markedly enlarged,” “global mild to moderate hypokinesis,” and conclusions of “marked cardiomegaly” and “dilated cardiomyopathy” with “mild to moderate mitral regurgitation” and “mild to moderate aortic regurgitation.” Records obtained under subpoena from West Jefferson Medical Center. 12/3/98 Inpatient nursing notes and rhythm strip document 11 beats of ventricular tachycardia prior to inpatient surgery to place a catheter and arteriovenous fistula for hemodialysis access. Hemodialysis begun on Tuesday, Thursday, Saturday schedule. Weight after initial hemodialysis noted at 110.5 kg. Records obtained under subpoena from West Jefferson Medical Center. 12/8/98 Inpatient nursing notes and rhythm strip document 5 beats of ventricular tachycardia. Discharged from hospital on outpatient dialysis regimen. Discharge diagnoses were “congestive heart failure,” “cardiomyopathy/mitral insufficiency,” “end stage renal disease – begun on dialysis,” and insertion of AV fistula/Tesio catheter this admit.” Discharge medications were prednisone 80 mg per day and Coumadin (warfarin) 5 mg per day. Discharge orders signed by primary care physician. Records obtained under subpoena from West Jefferson Medical Center.

Appendix B 82 Highway Accident Report Date Information Source 12/10/98 Referral form for dialysis indicates “Employer Name” as “Custom Bus Charter” and “Occupation” as “Driver.” “Primary diagnosis” is noted as “Hypertension” and “Other conditions” noted as “Cardiomyopathy” and “Congestive heart failure.” Admission nursing assessment indicates weight as 124.8 kg. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 12/14/98 Primary care physician notes state “Patient is in for follow-up after being in hospital. Patient is ready to go back to work. On dialysis now Tuesday, Thursday, Saturday 5-8 pm. Anxious to return to work. Minor cramps in hands occasionally – not right after dialysis. Still has staples left arm shunt. Using Tesio catheter now.” Examination indicates “Alert, cheerful, no acute distress. Chest clear. Cardiac regular rate and rhythm without murmurs or gallops. No edema. Weight decreased 10 lbs. since 10/98.” Assessment indicates “On dialysis, doing well.” Prescription note signed by primary care physician indicates: “May return to work 12/17/98. Needs to be at West Jefferson Hospital by 5 p.m. Tuesdays, Thursdays, and Saturdays.” Records obtained under subpoena from Dr. Janice S. Glenn. 12/29/98 Dialysis notes indicate estimated dry weight: “try 111.5” kg. Pre-dialysis weight noted as 111.9 kg. Post-dialysis blood pressures noted as: sitting – 120/70, standing – 110/60. Post-dialysis pulse noted as 88. Post-dialysis weight noted as 111.4 kg. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 1/5/99 Outpatient Social Service evaluation performed; notes indicate: “Employment – ‘Custom Bus Charter’ – driver – 2 years” “His employer is very supportive – schedules his work around his treatment.” Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 1/20/99 Seen in emergency department for “coughing, fever, and chest pain for 4 days.” Medications on admission to hospital were listed as prednisone 80 mg/day, Bumex (bumetanide) 2 mg twice a day, Coumadin (warfarin) 5mg every other day, and Zaroxolyn (metolazone) 5 mg every other day. Right arm and neck noted to be swollen. Records obtained under subpoena from West Jefferson Medical Center. 1/21/99 Inpatient vascular ultrasound of right subclavian vein revealed “findings compatible with near complete thrombosis of the right jugular, right axillary and right subclavian veins.” Begun on intravenous heparin. Cardiology evaluation indicated the diagnosis of “subendocardial myocardial infarction – small.” Records obtained under subpoena from West Jefferson Medical Center. 1/22/99 Inpatient echocardiogram performed showing “left ventricle is severely dilated in both end diastolic and end systolic dimension,” “calculated ejection fraction is approximately 10 to 15%,” “evidence of concentric left ventricular hypertrophy,” “generalized akinesis,” “moderately severe bi-atrial enlargement,” “moderate mitral regurgitation,” and mild amount of aortic stenosis.” Conclusions included “severe left ventricular systolic dysfunction.” Records obtained under subpoena from West Jefferson Medical Center. 1/25/99 Inpatient surgery to remove Tesio catheter. Records obtained under subpoena from West Jefferson Medical Center. 1/27/99 Inpatient nursing notes document 13 beats of ventricular tachycardia. Records obtained under subpoena from West Jefferson Medical Center.

Appendix B 83 Highway Accident Report Date Information Source 1/28/99 Inpatient evaluation by social services – notes that he is “working full-time for Custom Bus Charters” and “will call him with home health agency that is to see patient Monday.” Notes and rhythm strip document 8 beats of ventricular tachycardia. Discharged from hospital on Coumadin (warfarin) 10 mg per day for two days, then 5 mg per day. Records obtained under subpoena from West Jefferson Medical Center. 2/4/99 Outpatient “Initial Nutrition Assessment” for dialysis notes “Occupation” as “Bus driver.” Estimated dry weight indicated as 108.5 kg. Dialysis notes indicate increase in scheduled dialysis time from 3 to 4 hours. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 2/8/99 Primary care physician’s notes written by student nurse practitioner and signed by primary care physician indicate “In hospital for 1 week for thrombus in right arm, ‘little touch’ of pneumonia, ‘mild heart attack.’ Was in cardiac care unit. Feels he is ready to go back to work, has no follow-up appointment with cardiologist … States has been taking meds religiously … Short of breath this morning after ‘really brisk walk.’ Also describes nausea with shortness of breath, symptoms went away after 10 minutes … States he rests frequently, taking it easy, no heavy lifting. Wants to go back to work part time on ‘short runs.’ … Heart rate regular at 112 beats per minute … (Patient is sweating) … No work. Refer to cardiologist … for follow-up and cardiac rehab program.” Records obtained under subpoena from Dr. Janice S. Glenn. 2/12/99 Outpatient medical questionnaire from cardiology clinic indicates “had heart attack was hospitalized and discharged on 1/21/99 and would like an OK to go back to work.” Indicated under “occupation” is “bus driver,” under “use of recreational drugs,” neither “Yes” nor “No” is marked. Outpatient cardiology notes indicate “comes in for follow up after his hospitalization in December for congestive heart failure when dialysis was started. He has been doing well with dialysis, no dyspnea, no chest discomfort, and no peripheral edema. He denies any palpitations or syncope or presyncope.” Pulse noted as “60 and regular.” Records obtained under subpoena from Heart Clinic of Louisiana. 2/15/99 Short-form health survey performed by dialysis center – responses include: “How would you rate your health in general now? – much worse now than one year ago.” “Does your health limit you now in … vigorous activities…? – Yes, limited a lot.” “During the past 4 weeks have you … cut down on the amount of time you spent on work or other activities — Yes.” accomplished less than you would like — Yes.” were limited in the kind of work or other activities — Yes.” had difficulty performing the work or other activities — Yes.” accomplished less than you would like — Yes.” didn’t do work or other activities as carefully as usually — Yes.” “During the past 4 weeks … did you feel worn out — All of the time.” “I expect my health to get worse — Definitely true.” Potassium level noted as 7.2. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 3/12/99 Admitted to hospital with “acute thrombosis of a Gortex AV loop graft.” Admission medications Prinivil (lisinopril) 2.5 mg twice a day, metoprolol 25 mg twice a day, and Coumadin (warfarin) 5 mg per day. Anesthesia note indicates “potassium 6.3. Unacceptably high for anesthesia due to risk of arrythmias especially in patient with recent myocardial infarction and congestive heart failure. Will recommend … dialysis before A-V access placed.” A Quinton catheter was placed in the left internal jugular vein and he underwent dialysis. Records obtained under subpoena from West Jefferson Medical Center.

Appendix B 84 Highway Accident Report Date Information Source 3/13/99 Inpatient surgery – AV graft was removed with “evidence of low-grade staph epidermitis infection” and a “brachial Cimino fistula” was constructed. Records obtained under subpoena from West Jefferson Medical Center. 3/15/99 Ultrasound of fistula – “AV fistula was thrombosed.” Discharged from hospital, to receive intravenous vancomycin at dialysis once a week for 6 weeks. Records obtained under subpoena from West Jefferson Medical Center. 3/27/99 Dialysis notes indicate estimated dry weight: “try 107.5” kg. Pre-dialysis weight noted as 110.5 kg. Post-dialysis blood pressures noted as: sitting – 142/90, standing – 150/90. Post-dialysis pulse noted as 100. Post-dialysis weight noted as 107.7 kg. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 4/1/99 Dialysis note states “trying a new estimated dry weight of 105.5 kilos.” Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 4/6/99 Outpatient placement of Quinton catheter into left internal jugular vein. Procedure note states “his last Quinton ‘fell out’ on Saturday [4/3/99].” Records obtained under subpoena from West Jefferson Medical Center. 4/7/99 Dialysis note states “no show for 2 treatments.” Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 4/8/99 Transplant referral form indicates “marginal candidate” and “patient’s cardiovascular condition precludes transplantation surgery.” Transplantation surgeon indicates “Please do not refer this patient for transplantation evaluation.” Dialysis notes indicate estimated dry weight: “try 105.0” kg. Pre-dialysis weight noted as 106.6 kg. Post-dialysis blood pressures noted as: sitting – 132/90, standing – 140/90. Post-dialysis pulse noted as 92. Post-dialysis weight noted as 104.9 kg. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 4/17/99 Admitted to hospital for “increasing shortness of breath at night over the last two weeks.” Medications on admission were indicated as Prinivil (lisinopril) 10 mg each morning and metoprolol 50 mg each morning. Records obtained under subpoena from West Jefferson Medical Center. 4/19/99 Dialysis notes state “Patient’s doctor contacted social worker and informed that patient is not returning to work and to assist patient in the necessary paperwork in applying for disability. Patient is in the hospital at present but when he returns to dialysis social worker will do so.” Records obtained under subpoena from BMA Marrero Artificial Kidney Center.

Appendix B 85 Highway Accident Report Date Information Source 4/20/99 Inpatient cardiac catheterization. Findings included: “left ventricle was markedly dilated”; “ejection fraction was approximately 10% to 20%”; “pulmonary capillary wedge mean of 23”; left main coronary artery, left anterior descending artery, left circumflex artery, and right coronary artery were all described as “normal.” Conclusion was “normal coronary angiogram with marked left ventricular dysfunction.” Records obtained under subpoena from West Jefferson Medical Center. 4/21/99 Inpatient vascular surgery consult for vascular access. “Recommendations” note “Agree with insertion of Tesio catheters, however, the patient refuses any intervention today.” Records obtained under subpoena from West Jefferson Medical Center. 4/22/99 Inpatient nephrology note indicates “re-assess estimated dry weight. Still increased wedge at 100 kg.” Discharged with orders for 3 hours of outpatient intravenous Dobutrex (dobutamine) treatment 5 mcg/kg/min 3 times per week. Records obtained under subpoena from West Jefferson Medical Center. 4/23/99 Outpatient procedure note indicates 3-hour treatment with intravenous Dobutrex. Records obtained under subpoena from West Jefferson Medical Center. 4/26/99 Outpatient procedure note indicates 3-hour treatment with intravenous Dobutrex. Records obtained under subpoena from West Jefferson Medical Center. 4/27/99 Dialysis notes state “Social worker provided the necessary paperwork for applying for disability at patient’s request. Patient is frustrated at not being able to return to work. Besides 3 times per week (Tues/Thurs/Sat) of dialysis, patient has 3 times per week (Mon/Wed/Fri) of Dobutrex therapy.” Notes also state “patient called and stated his catheter fell out.” Records obtained under subpoena from Marrero Artificial Kidney Center. 4/28/99 Admitted to hospital for vascular access. Underwent placement of Tesio catheter in left internal jugular vein. Nephrology note indicates “status post Tesio catheter placement (lost Quinton yesterday) unable to dialyze – last treatment Saturday [4/24/99].” Discharge note states “He required general anesthesia for the procedure. Tolerated well and underwent dialysis the same day and left the hospital against medical advice.” Nursing notes state “9:00 p.m. Patient going home without escort, denied transport.” Records obtained under subpoena from West Jefferson Medical Center. 4/29/99 Dialysis notes indicate “treatment terminated early against medical advice, patient cath soaked flushed per RN, vital signs stable, kidney cleared.” Pre-dialysis weight noted as 100.8 kg. Post-dialysis blood pressures noted as: sitting – 140/80, standing – 138/100. Post-dialysis pulse noted as 94. Post-dialysis weight noted as 100.1 kg. Potassium level noted as 5.2. Nephrology note indicates “left hospital against medical advice today intermittent shortness of breath. Started Dobutrex last week had cardiac catheterization showing dilated cardiomyopathy with normal coronaries — prognosis poor.” Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 4/30/99 Outpatient procedure note indicates 3-hour treatment with intravenous Dobutrex. Records obtained under subpoena from West Jefferson Medical Center.

Appendix B 86 Highway Accident Report Date Information Source 5/1/99 Dialysis notes state “no show.” Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 5/4/99 Dialysis notes indicate estimated dry weight: “try 100.0” kg. Pre-dialysis weight noted as 101.6 kg. Post-dialysis blood pressures noted as: sitting – 130/80, standing – 138/80. Post-dialysis pulse noted as 88. Post-dialysis weight noted as 99.4 kg. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 5/5/99 Outpatient procedure note indicates 3-hour treatment with intravenous Dobutrex. Records obtained under subpoena from West Jefferson Medical Center. 5/6/99 Dialysis notes indicate estimated dry weight: “try 99.0” kg. Pre-dialysis weight noted as 101.2 kg. Post-dialysis blood pressures noted as: sitting – 128/84, standing – 118/64. Post-dialysis pulse noted as 78. Post-dialysis weight noted as 98.5 kg. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 5/7/99 Outpatient procedure note indicates 3-hour treatment with intravenous Dobutrex. Records obtained under subpoena from West Jefferson Medical Center. 5/8/99 Dialysis notes indicate “Signed off against medical advice. Counseled on the possible consequences including death and is aware of the fluid and dietary regimes. Left vital signs stable.” Time on dialysis indicated as 2:55 p.m. Scheduled dialysis time indicated as 4 hours. Pre-dialysis weight noted as 103.4 kg. Post-dialysis blood pressures noted as: sitting – 120/64, standing – 118/60. Post-dialysis pulse noted as 72. Post-dialysis weight noted as 98.7 kg. Time off dialysis indicated as 6:35 p.m. Records obtained under subpoena from BMA Marrero Artificial Kidney Center. 5/8/99 Emergency department notes indicate that he was brought in to the emergency department by ambulance at 8:45 p.m. with a pulse of 105 and a blood pressure of 71/46. Physician’s notes state “patient came home from dialysis and had 2 episodes of nausea and weakness each of which lasted 5 minutes. Patient said he had no chest pain. Emergency Medical Technicians noted blood pressure of 70/palpable on arrival. Patient had received 1 liter intravenous fluid by time of my exam and was asymptomatic. Patient says the nephrologist was ‘fishing around’ for his dry weight. Says it used to be 102 kg, today after dialysis his weight was 96 kg. Patient believes ‘they took off too much fluid’ today in dialysis and that this is the reason for his symptoms tonight.” Blood pressure at 10:00 p.m .105/72, pulse 94. Discharged from emergency room at 11:00 pm with diagnosis of “near syncope – resolved.” Records obtained under subpoena from West Jefferson Medical Center.

87 Highway Accident Report Appendix C Federal Motor Carrier Safety Ratings Procedures The Motor Carrier Safety Act of 1984 directed the U.S. Secretary of Transportation to establish a procedure to determine the safety fitness of owners and operators of commercial motor vehicles operating in interstate or foreign commerce. Subsequently, the Federal Highway Administration set safety fitness standards and established a methodology for determining whether a carrier has adequate safety management controls to ensure acceptable compliance with the safety requirements. The original methodology was modified as a result of the Motor Carrier Safety Act of 1990 and a 1997 rulemaking. Six factors (see table C-1) form the basis for a carrier’s safety rating, that is, the degree to which a carrier is in compliance with the Federal Motor Carrier Safety Regulations and therefore meets the safety fitness standards. The six factors in the rating system shown in table C-1 represent the six major categories of a motor carrier’s operations covered by Federal regulations. The Federal Motor Carrier Safety Administration (FMCSA) has determined that certain sections of the referenced Federal Motor Carrier Safety Regulation Parts are more indicative of a safe motor carrier operation than others. These selected sections are classified “acute” or “critical” (see 49 Code of Federal Regulations [CFR] 385, appendix B, section VII). Sections classified acute define conditions that demand immediate corrective action regardless of the overall safety posture of the motor carrier, for example, requiring or permitting the operation of a vehicle declared out of service before repairs are made (49 CFR 396.9[c][2]). Sections classified critical define conditions that indicate breakdowns in a carrier’s management controls, for example, requiring or permitting a driver to drive after having been on duty for 15 hours (49 CFR 395.3[a][2]). Table 4. Motor carrier safety rating factors (49 CFR 385, appendix B). Factor* Applicable FMCSR 1 - General Parts 387 and 390 2 - Driver Parts 382, 383, and 391 3 - Operational Parts 392 and 395 4 - Vehicle Parts 393 and 396 5 - Hazardous Materials Parts 397, 171, 177, and 180 6 - Accident Factor Recordable Preventable Rate *All factors are given equal weight.

Appendix C 88 Highway Accident Report During an FMCSA compliance review, the carrier is evaluated on its compliance with each of the referenced Parts. A carrier that violates an acute section is assessed 1 point for that factor. A carrier that violates a critical section two or more times, with the number of violations exceeding 10 percent of the sample reviewed (termed a “pattern of violations”), is assessed 1 point for that factor. An exception to the above point assessment takes effect if the carrier’s accident rate (per million miles traveled) over the previous 12 months is greater than 1.7 for a carrier operating in an urban area (entirely within 100 air miles of the home terminal) or greater than 1.5 for all other carriers. In such cases, carriers are assessed 2 points. Ratings for individual factors are based on the number of points assessed for that factor: • 0 points—satisfactory. • 1 point—conditional. • 2 points—unsatisfactory. After all factors are rated, an overall rating for the carrier is determined by assembling the ratings assigned to each factor as shown in table C-2. Table 5. Motor carrier safety rating table. Factor ratings Number of unsatisfactory ratings Number of conditional ratings Safety rating 0 2 or fewer Satisfactory 0 more than 2 Conditional 1 2 or fewer Conditional 1 more than 2 Unsatisfactory 2 or more 0 Unsatisfactory

Appendix C 89 Highway Accident Report Examples

1. A carrier receiving no unsatisfactory factor ratings and 1 conditional factor

rating would receive an overall rating of satisfactory.

1. A carrier receiving 1 unsatisfactory factor rating and 1 conditional factor rating

would receive an overall rating of conditional.

1. A carrier receiving 2 unsatisfactory factor ratings would receive an overall

rating of unsatisfactory. Under 49 CFR 385.13, a carrier that receives an overall unsatisfactory rating is deemed “unfit” and has 60 days to correct the deficiencies found in the compliance review or to file an appeal with the FMCSA. A passenger carrier or a carrier transporting hazardous materials that receives an overall unsatisfactory rating has 45 days to correct the deficiencies found in the compliance review or to file an appeal with the FMCSA. If an appeal is not filed and the carrier does not correct the deficiencies noted in the compliance review, the carrier is deemed unfit and prohibited from continued operation.

90 Highway Accident Report Appendix D State Medical Certification Process All 50 States and the District of Columbia have substantially adopted the Federal Motor Carrier Safety Regulations for intrastate operations, including the commercial driver physical fitness regulations contained in 49 Code of Federal Regulations 391. Several States have exempted agricultural and Government transportation operations from certain aspects of these requirements. Several States have grandfathered intrastate commercial drivers who do not meet the Federal physical fitness requirements but have operated commercial vehicles before the State’s adoption of these requirements. Furthermore, a number of States have also adopted stricter rules for drivers of hazardous materials, school buses, and commercial passenger vehicles.

Appendix D 91 Highway Accident Report State Intrastate medical exemptions/waivers1 Interstate driver information kept by States2 Intrastate driver information kept by States2 CDL renewal cycle (years)3 Other information2 Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Alabama Limb, vision, diabetes No requirement Long form for new CDL; self-certification for renewals No requirement Long form for new CDL; self-certification for renewals N/A Long form required for hazmat renewals Alaska Limb, vision Self-certification Self-certification Self-certification Self-certification 5 Arizona Limb, vision Long form and medical certificate Long form and medical certificate Long form and medical certificate Long form and medical certificate 5 Long forms collected every 2 years Arkansas Limb, vision No requirement Self-certification No requirement Self-certification 4 California Limb, vision, hearing, diabetes, epilepsy, cardiovascular, others Long form and medical certificate Long form and medical certificate Long form and medical certificate Long form and medical certificate 4 Long forms collected every 2 years Colorado Limb, vision, diabetes, epilepsy, cardiovascular No requirement Medical certificate No requirement Medical certificate Connecticut Limb, vision, diabetes No requirement Medical certificate (long form required for passenger endorsement) No requirement Medical certificate (long form required for passenger endorsement) 4 Delaware Limb, vision, diabetes, epilepsy, cardiovascular, others No requirement None except for medical waiver situations No requirement None except for medical waiver situations 5 No intrastate waivers for passenger drivers 1Information obtained from Association for the Advancement of Automotive Medicine (AAAM), Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs, DT FH61-95-P-01200 (Washington, D.C.: Federal Highway Administration, 1997) and Motor Carrier Regulations Information System (MCREGIS). 2Information obtained from interviews with FMCSA State Directors or State Police Motor Carrier Division representatives. 3Information obtained from AAAM, Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs.

Appendix D 92 Highway Accident Report State Intrastate medical exemptions/waivers1 Interstate driver information kept by States2 Intrastate driver information kept by States2 CDL renewal cycle (years)3 Other information2 Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers District of Columbia Limb, vision No requirement Long form and medical certificate No requirement Long form and medical certificate 4 Long forms collected every 2 years Florida Limb, vision, diabetes Medical certificate Medical certificate Medical certificate Medical certificate 4 or 6 Georgia Limb, vision, hearing, diabetes, epilepsy, cardiovascular Self-certification Self-certification Self-certification Self-certification 4 Hawaii Limb, vision Long form Long form Long form Long form 4 Idaho Limb, vision Self-certification Self-certification Self-certification Self-certification 4 Illinois Limb, vision No requirement Self-certification No requirement Self-certification 4 Self-certification not required on transfers Indiana Limb, vision, hearing Medical certificate Long form and medical certificate Medical certificate Long form and medical certificate 4 Long forms collected every 2 years Iowa Limb, vision Self-certification Self-certification Self-certification Self-certification 2 or 4 Kansas Limb, vision, hearing, diabetes, epilepsy, cardiovascular No requirement Self-certification No requirement Self-certification 4 Kentucky Limb, vision, diabetes, epilepsy, cardiovascular, others No requirement Medical certificate No requirement Medical certificate 4 Louisiana Limb, vision No requirement Long form and medical certificate No requirement Long form and medical certicate 4 Maine Intrastate drivers operating within 100 miles exempt from fitness requirements No requirement Medical certificate No requirement Medical certificate 4 or 6 100-mile exemption not applicable to hazmat drivers

Appendix D 93 Highway Accident Report State Intrastate medical exemptions/waivers1 Interstate driver information kept by States2 Intrastate driver information kept by States2 CDL renewal cycle (years)3 Other information2 Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Maryland Limb, vision No requirement Medical certificate No requirement Medical certificate 5 Waivers other than limb may also be granted Massachuset ts Limb, vision, hearing, diabetes, epilepsy, cardiovascular No requirement Medical certificate No requirement Medical certificate 5 Michigan Limb, vision, hearing, diabetes, epilepsy, cardiovascular, others Medical certificate Medical certificate Medical certificate Medical certificate 4 Minnesota Limb, vision, diabetes No requirement Self-certification Self-certification Self-certification 4 Mississippi Limb, vision, hearing, epilepsy, cardiovascular Self-certification Self-certification Self-certification Self-certification 4 Missouri Limb, vision Self-certification Self-certification Self-certification Self-certification 3 Montana Limb, vision, diabetes, epilepsy No requirement Medical certificate No requirement Medical certificate 8 Nebraska Limb, vision No requirement Self-certification No requirement Self-certification 4 Nevada Limb, vision, hearing, diabetes, epilepsy, cardiovascular No requirement Long form No requirement Long form 4 New Hampshire Waivers granted through the Department of Safety (not listed in either MCREGIS or AAAM) Long form Long form Long form Long form 4 New Jersey Limb, vision Long form for drivers of 8+ passengers Long form Long form for drivers of 8+ passengers Long form 4 Long forms, including those for drivers of 8+ passengers, collected every 2 years

Appendix D 94 Highway Accident Report State Intrastate medical exemptions/waivers1 Interstate driver information kept by States2 Intrastate driver information kept by States2 CDL renewal cycle (years)3 Other information2 Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers New Mexico Limb, vision No requirement Medical certificate No requirement Medical certificate 4 New York Limb, vision, diabetes Self-certification Medical certificate Self-certification Self-certification 5 Medical certificate not required on transfers North Carolina Limb, vision, hearing, diabetes, epilepsy, cardiovascular No requirement Medical certificate No requirement Medical certificate 5 North Dakota Limb, vision, diabetes, epilepsy, cardiovascular, others Self-certification Self-certification Self-certification Self-certification 4 Ohio Limb, vision No requirement Not available No requirement Not available 4 Oklahoma Limb, vision Self-certification Self-certification Self-certification Self-certification 4 Oregon Limb, vision, diabetes, hearing, epilepsy, cardiovascular, others No requirement Medical certificate No requirement Medical certificate 4 Pennsylvania Limb, epilepsy Self-certification Self-certification Self-certification Self-certification 4 Rhode Island Limb, epilepsy No requirement Self-certification No requirement Self-certification 5 South Carolina Limb, vision No requirement Long form or certificate No requirement Long form or certificate 4 South Dakota Limb, vision, blackout No requirement No requirement No requirement No requirement 5 Medical requirements for school bus drivers only Tennessee Limb, vision No requirement Medical certificate No requirement Medical certificate 5 No requirement for medical certificate renewals

Appendix D 95 Highway Accident Report State Intrastate medical exemptions/waivers1 Interstate driver information kept by States2 Intrastate driver information kept by States2 CDL renewal cycle (years)3 Other information2 Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Non-CDL drivers (10,001 – 26,000 lbs) CDL drivers Texas Limb, vision No requirement Self-certification No requirement Self-certification 4 Drivers must sign an affidavit Utah Limb, vision No requirement Medical certificate No requirement Medical certificate 5 Presentation of medical certification only required upon initial issuance of CDL Vermont Limb, vision, diabetes No requirement Self-certification No requirement No requirement 2 or 4 Medical requirements for school bus drivers only Virginia Limb, vision, diabetes No requirement Medical certificate No requirement Medical certificate 5 Washington Limb, vision, hearing, diabetes, epilepsy, cardiovascular No requirement Medical certificate Medical certificate Medical certificate 4 West Virginia Limb, vision, hearing, diabetes, epilepsy, cardiovascular Long form for drivers of 8+ passengers Medical certificate and long form Long form for drivers of 8+ passengers Medical certificate and long form 5 Drivers of 8+ passengers and of vehicles above 8,000 lbs must present long form to Division of Motor Vehicles Wisconsin Limb, vision, diabetes No requirement Medical certificate No requirement Medical certificate 4 Wyoming Limb, vision, diabetes No requirement Self-certification No requirement Self-certification 4

96 Highway Accident Report Appendix E Instructions for Performing and Recording Physical Examinations167 The medical examiner must be familiar with 49 CFR 391.41, Physical qualifications for drivers, and should review these instructions before performing the physical examination. Answer each question “yes” or “no” and record numerical readings where indicated on the physical examination form. The medical examiner must be aware of the rigorous physical, mental, and emotional demands placed on the driver of a commercial motor vehicle. In the interest of public safety, the medical examiner is required to certify that the driver does not have any physical, mental, or organic condition that might affect the driver’s ability to operate a commercial motor vehicle safely. General information. The purpose of this history and physical examination is to detect the presence of physical, mental, or organic conditions of such a character and extent as to affect the driver’s ability to operate a commercial motor vehicle safely. The examination should be conducted carefully and should at least include all of the information requested in the following form. History of certain conditions may be cause for rejection. Indicate the need for further testing and/or require evaluation by a specialist. Conditions may be recorded which do not, because of their character or degree, indicate that certification of physical fitness should be denied. However, these conditions should be discussed with the driver and he/she should be advised to take the necessary steps to insure correction, particularly of those conditions, which if neglected, might affect the driver’s ability to drive safely. General appearance and development. Note marked overweight. Note any postural defect, perceptible limp, tremor, or other conditions that might be caused by alcoholism, thyroid intoxication or other illnesses. Head-eyes. When other than the Snellen chart is used, the results of such test must be expressed in values comparable to the standard Snellen test. If the driver wears corrective lenses for driving, these should be worn while driver’s visual acuity is being tested. If contact lenses are worn, there should be sufficient evidence of good tolerance of and adaptation to their use. Indicate the driver’s need to wear corrective lenses to meet the vision standard on the Medical Examiner’s Certificate by checking the box, “Qualified only when wearing corrective lenses.” In recording distance vision use 20 feet as normal. Report all vision as a fraction with 20 as the numerator and the smallest type read at 20 167 Extracted from 49 CFR 391.43(f).

Appendix E 97 Highway Accident Report feet as the denominator. Monocular drivers are not qualified to operate commercial motor vehicles in interstate commerce. Ears. Note evidence of any ear disease, symptoms of aural vertigo, or Meniere’s Syndrome. When recording hearing, record distance from patient at which a forced whispered voice can first be heard. For the whispered voice test, the individual should be stationed at least 5 feet from the examiner with the ear being tested turned toward the examiner. The other ear is covered. Using the breath which remains after a normal expiration, the examiner whispers words or random numbers such as 66, 18, 23, etc. The examiner should not use only sibilants (s-sounding test materials). The opposite ear should be tested in the same manner. If the individual fails the whispered voice test, the audiometric test should be administered. For the audiometric test, record decibel loss at 500 Hz, 1,000 Hz, and 2,000 Hz. Average the decibel loss at 500 Hz, 1,000 Hz and 2,000 Hz and record as described on the form. If the individual fails the audiometric test and the whispered voice test has not been administered, the whispered voice test should be performed to determine if the standard applicable to that test can be met. Throat. Note any irremediable deformities likely to interfere with breathing or swallowing. Heart. Note murmurs and arrhythmias, and any history of an enlarged heart, congestive heart failure, or cardiovascular disease that is accompanied by syncope, dyspnea, or collapse. Indicate onset date, diagnosis, medication, and any current limitation. An electrocardiogram is required when findings so indicate. Blood pressure (BP). If a driver has hypertension and/or is being medicated for hypertension, he or she should be recertified more frequently. An individual diagnosed with mild hypertension (initial BP is greater than 160/90 but below 181/105) should be certified for one 3-month period and should be recertified on an annual basis thereafter if his or her BP is reduced. An individual diagnosed with moderate to severe hypertension (initial BP is greater than 180/104) should not be certified until the BP has been reduced to the mild range (below 181/105). At that time, a 3-month certification can be issued. Once the driver has reduced his or her BP to below 161/91, he or she should be recertified every 6 months thereafter. Lungs. Note abnormal chest wall expansion, respiratory rate, breath sounds including wheezes or alveolar rales, impaired respiratory function, dyspnea, or cyanosis. Abnormal finds on physical exam may require further testing such as pulmonary tests and/or x-ray of chest. Abdomen and viscera. Note enlarged liver, enlarged spleen, abnormal masses, bruits, hernia, and significant abdominal wall muscle weakness and tenderness. If the diagnosis suggests that the condition might interfere with the control and safe operation of a commercial motor vehicle, further testing and evaluation is required. Genital-urinary and rectal examination. A urinalysis is required. Protein, blood or sugar in the urine may be an indication for further testing to rule out any underlying

Appendix E 98 Highway Accident Report medical problems. Note hernias. A condition causing discomfort should be evaluated to determine the extent to which the condition might interfere with the control and safe operation of a commercial motor vehicle. Neurological. Note impaired equilibrium, coordination, or speech pattern; paresthesia; asymmetric deep tendon reflexes; sensory or positional abnormalities; abnormal patellar and Babinski’s reflexes; ataxia. Abnormal neurological responses may be an indication for further testing to rule out an underlying medical condition. Any neurological condition should be evaluated for the nature and severity of the condition, the degree of limitation present, the likelihood of progressive limitation, and the potential for sudden incapacitation. In instances where the medical examiner has determined that more frequent monitoring of a condition is appropriate, a certificate for a shorter period should be issued. Spine, musculoskeletal. Previous surgery, deformities, limitation of motion, and tenderness should be noted. Findings may indicate additional testing and evaluation should be conducted. Extremities. Carefully examine upper and lower extremities and note any loss or impairment of leg, foot, toe, arm, hand, or finger. Note any deformities, atrophy, paralysis, partial paralysis, clubbing, edema, or hypotonia. If a hand or finger deformity exists, determine whether prehension and power grasp are sufficient to enable the driver to maintain steering wheel grip and to control other vehicle equipment during routine and emergency driving operations. If a foot or leg deformity exists, determine whether sufficient mobility and strength exist to enable the driver to operate pedals properly. In the case of any loss or impairment to an extremity which may interfere with the driver’s ability to operate a commercial motor vehicle safely, the medical examiner should state on the medical certificate “medically unqualified unless accompanied by a Skill Performance Evaluation Certificate.” The driver must then apply to the Field Service Center of the FMCSA, for the State in which the driver has legal residence, for a Skill Performance Evaluation Certificate under Sec. 391.49. Laboratory and other testing. Other test(s) may be indicated based upon the medical history or findings of the physical examination. Diabetes. If insulin is necessary to control a diabetic driver’s condition, the driver is not qualified to operate a commercial motor vehicle in interstate commerce. If mild diabetes is present and it is controlled by use of an oral hypoglycemic drug and/or diet and exercise, it should not be considered disqualifying. However, the driver must remain under adequate medical supervision. Upon completion of the examination, the medical examiner must date and sign the form, provide his/her full name, office address and telephone number. The completed medical examination form shall be retained on file at the office of the medical examiner.

99 Highway Accident Report Appendix F Medical Advisory Criteria for Evaluation Under 49 CFR Part 391.41168 Note: Unlike regulations, which are codified and have a statutory base, the recommendations in this advisory are simply guidance established to help the medical examiner determine a driver’s medical qualifications pursuant to Section 391.41 of the Federal Motor Carrier Safety Regulations (FMCSRs). The Office of Motor Carrier Research and Standards routinely sends copies of these guidelines to medical examiners to assist them in making an evaluation. The medical examiner may, but is not required to, accept the recommendations. Section 390.3(d) of the FMCSRs allows employers to have more stringent medical requirements. § 391.41(b)(1) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no loss of a foot, leg, hand, or arm, or has been granted a Skill Performance Evaluation (SPE) Certificate pursuant to Section 391.49. For any loss of a foot, leg, hand, or arm, a person who is otherwise qualified under the Federal Motor Carrier Safety Regulations (FMCSRs) must apply for a Skill Performance Evaluation (SPE) certificate. The State Director will make the final determination whether the defect will interfere with the driver’s ability to control and safely drive a motor vehicle. With the advancement of technology, medical aids and equipment modifications have been developed to compensate for certain disabilities. The Skill Performance Evaluation (formerly the Limb Waiver Program) was designed to allow persons with the loss of a hand, foot or limb to qualify under the FMCSRs by use of prosthetic devices or equipment modifications which enable them to safely operate a commercial motor vehicle. Since there are no medical aids equivalent to the original body limb, certain risks are still present, and thus restrictions may be included on individual SPE certificates when a State Director for the FMCSA determines they are necessary to be consistent with safety and public interest. If the driver is found otherwise medically qualified (§ 391.41(b)(3) through (13)), the examining physician must include the statement “medically unqualified unless accompanied by a SPE certificate” on the medical certificate issued pursuant to § 391.43(g). 168 Text portion of advisory reproduced on July 19, 2001, from the Web site of the Federal Motor Carrier Safety Administration http://www.fmcsa.dot.gov/rulesregs/fmcsr/medical.htm.

Appendix F 100 Highway Accident Report If a joint application is made, the letter of application must be submitted to the State Director in the Service Center in which the carrier’s principal place of business is located. If a unilateral SPE application is filed, the application must be submitted to the State Director in the Service Center in which the driver has legal residence. The addresses for these service centers are found in Section 390.27 of the FMCSRs. § 391.41(b)(2) - A person is physically qualified to drive a commercial motor vehicle if that person has no impairment of: i. A hand or finger which interferes with prehension or power grasping; or ii. An arm, foot, or leg which interferes with the ability to perform normal tasks associated with operating a motor vehicle; or Any other significant limb defect or limitation which interferes with the ability to perform normal tasks associated with operating a motor vehicle; or Has been granted a Skill Performance Evaluation (SPE) pursuant to Section 391.49. If the examining physician determines that an impairment (e.g., partial hand or finger amputation, or paralysis) in any way interferes with the driver’s ability to perform normal tasks associated with operating a commercial motor vehicle, then the driver becomes subject to the SPE certification program pursuant to Section 391.49. If the driver is found otherwise medically qualified (§ 391.41(b)(3) through (13)), the examining physician must include the statement “medically unqualified unless accompanied by a SPE certificate” on the medical certificate issued pursuant to § 391.43(g). The driver and the motor carrier are subject to appropriate penalty if the driver operates a motor vehicle in interstate commerce without a current SPE certificate for his/her physical impairment. If a joint SPE application is filed, it must be submitted to the State Director in the service center in which the carrier’s principal place of business is located. If a unilateral SPE application is filed, it must be submitted to the State Director in the service center in which the driver has legal residence. The addresses for these service centers are found in Section 390.27 of the Federal Motor Carrier Safety Regulations. § 391.41(b)(3) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no established medical history or clinical diagnosis of diabetes mellitus currently requiring insulin for control.

Appendix F 101 Highway Accident Report There is no provision in the Federal Motor Carrier Safety Regulations (FMCSRs) for an exemption from the minimum physical requirement with respect to the insulin-using diabetic. Diabetes mellitus is a disease which, on occasion, can result in a loss of consciousness or orientation in time and space. Individuals who require insulin for control have conditions which can get out of control by the use of too much or too little insulin, or food intake not consistent with the insulin dosage. Incapacitation may occur from symptoms of hyperglycemic or hypoglycemic reactions (drowsiness, semiconsciousness, diabetic coma, or insulin shock). The administration of insulin is, within itself, a complicated process requiring insulin, syringe, needle, alcohol sponge and a sterile technique. Factors related to long-haul commercial motor vehicle operations, such as fatigue, lack of sleep, poor diet, emotional conditions, stress, and concomitant illness, compound the diabetic problem. Because of these inherent dangers, the FMCSA has consistently held that a diabetic who uses insulin for control does not meet the minimum physical requirements of the FMCSRs. Hypoglycemic drugs, taken orally, are sometimes prescribed for diabetic individuals to help stimulate natural body production of insulin. If the condition can be controlled by the use of oral medication and diet, then an individual may be qualified under the present rule. § 391.41(b)(4) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no current clinical diagnosis of myocardial infarction, angina pectoris, coronary insufficiency, thrombosis, or Any other cardiovascular disease of a variety known to be accompanied by syncope, dyspnea, collapse, or congestive cardiac failure. The term “has no current clinical diagnosis of” is specifically designed to encompass (1) a current cardiovascular condition; and/or (2) a cardiovascular condition which has not fully stabilized regardless of the time limit. The term “known to be accompanied by” is defined to include a diagnosis of a cardiovascular disease which is (1) accompanied by symptoms of syncope, dyspnea, collapse, or congestive cardiac failure; and/or which is (2) likely to cause syncope, dyspnea, collapse, or congestive cardiac failure. It is the intent of the Federal Motor Carrier Safety Regulations to render unqualified a driver who has a current cardiovascular disease which is accompanied by and/or likely to cause symptoms of syncope, dyspnea, collapse, or congestive cardiac failure. The subjective decision of whether the nature and severity of an individual’s condition will likely cause symptoms of cardiovascular insufficiency is on an individual basis and qualification rests with the medical examiner and the motor carrier. In those cases where there is an occurrence of cardiovascular insufficiency (myocardial infarction,

Appendix F 102 Highway Accident Report thrombosis, etc.), it is suggested that, before a driver is certified, he/she have a normal resting and stress EKG, no residual complications, no physical limitations, and is taking no medication likely to interfere with safe driving. Coronary artery bypass surgery and pacemaker implantation are remedial procedures and thus not necessarily unqualifying. However, the final determination must be based on functional assessment. A pacemaker recipient should be followed by a center specializing in this field. Coumadin is a medical treatment which can improve the health and safety of the driver and should not, by its use, medically disqualify the commercial driver. § 391.41(b)(5) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no established medical history or clinical diagnosis of a respiratory dysfunction likely to interfere with his/her ability to control and drive a commercial motor vehicle safely. To function adequately the cells of the body require a continuous supply of oxygen and removal of carbon dioxide. Proper functioning of the respiratory system ensures this adequate gaseous exchange. Any interruption in respiration for more than a few minutes will result in irreversible brain damage and, ultimately death. Since a driver must be alert at all times, any change in his or her mental state is in direct conflict with highway safety. Even the slightest impairment in respiratory function under emergency conditions (when greater oxygen supply is necessary for performance) may be detrimental to safe driving. There are many conditions that interfere with oxygen exchange and may result in incapacitation, including emphysema, chronic asthma, carcinoma, tuberculosis, chronic bronchitis and sleep apnea. If the medical examiner detects a respiratory dysfunction, that in any way is likely to interfere with the driver’s ability to safely control and drive a motor vehicle, the driver must be referred to a specialist for further evaluation and therapy. Once the driver meets the minimum physical requirements of the Federal Motor Carrier Safety Regulations, a certificate can be issued. Anticoagulation therapy for deep vein thrombosis and/or pulmonary thromboembolism is not unqualifying once optimum dose is achieved, provided lower extremity venous examinations remain normal and the treating physician gives a favorable recommendation. § 391.41(b)(6) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no current clinical diagnosis of high blood pressure likely to interfere with his/her ability to operate a commercial motor vehicle safely.

Appendix F 103 Highway Accident Report Hypertension alone is unlikely to cause sudden collapse; however, the likelihood increases when target organ damage, particularly cerebral vascular disease, is present. This regulatory criteria is based on FMCSA’s Cardiac Conference recommendations, which used the report of the 1984 Joint National Committee on Detection, Evaluation, and Treatment of High Blood Pressure. Mild Hypertension is considered an initial BP of 161-180 systolic and/or 91-104 diastolic.

1. The driver is given a 3-month period to reduce the BP to less than or equal to

160/90; the medical examiner should state on the medical certificate that it is only valid for that 3-month period.

1. If at any time during or by the end of this 3-month period the BP is found to be

less than or equal to 160/90, a medical certificate may be issued for a 1-year period. However, the BP must confirm blood pressure control in the third month of this 1-year period.

1. The individual must be certified annually thereafter.

Moderate to Severe Hypertension is considered an initial BP of greater than 180 systolic and/or greater than 104 diastolic.

1. The driver should not be qualified, even temporarily, until the BP has been

reduced to less than 181/105.

1. Once the individual’s BP is below 181 and/or 105, the driver may be issued one

3-month certificate. During this 3-month period, the BP must be reduced to less than or equal to 160/90.

1. If at any time during or by the end of this 3-month period the BP is found to be

less than or equal to 160/90, a medical certificate may be issued for a 6-month period. However, the BP must be confirmed in the third month of this 6-month period.

1. For initial BP greater than 180 and/or 104, documentation of continued control

and recertification should be made every 6 months and the expiration date stated on the medical certificate. Commercial drivers who present for certification with a normal BP reading, but who are taking medication for hypertension should be certified on the same basis as individuals who present with BPs in the mild to moderate range. An elevated BP finding should be confirmed by at least two subsequent measurements on different days. Inquiry should be made regarding smoking, cardiovascular disease in relatives, and immoderate use of alcohol. An electrocardiogram (ECG) and blood profile, including glucose, cholesterol, HDL cholesterol, creatinine and potassium, should be made. An echocardiogram and chest x-ray are desirable in subjects with moderate or severe hypertension.

Appendix F 104 Highway Accident Report Since the presence of target organ damage increases the risk of sudden collapse, group 3 or 4 hypertensive retinopathy, left ventricular hypertrophy not otherwise explained (echocardiography or ECG by Estes criteria), evidence of severely reduced left ventricular function, or serum creatinine of greater than 2.5 warrants the driver being found unqualified to operate a commercial motor vehicle in interstate commerce. Treatment includes nonpharmacologic and pharmacologic modalities as well as counseling to reduce other risk factors. Most antihypertensive medications also have side effects, the importance of which must be judged on an individual basis. Side effects of somnolence or syncope are particularly undesirable in commercial drivers. Commercial drivers should be informed of the side effects of drug therapy and the interaction of these drugs with other prescription drugs, nonprescription drugs, and alcohol. Surgically Corrected Hypertension: A commercial driver who has normal blood pressure 3 or more months after a successful operation for pheochromocytoma, primary aldosteronism (unless bilateral adrenalectomy has been performed), renovascular disease, or unilateral renal parenchymal disease, and who shows no evidence of target organ damage may be qualified. Hypertension that persists despite surgical intervention with no target organ disease should be evaluated and treated following the guidelines set forth above. § 391.41(b)(7) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no established medical history or clinical diagnosis of a rheumatic, arthritic, orthopedic, muscular, neuromuscular or vascular disease which interferes with his/her ability to control and operate a commercial motor vehicle safely. Certain diseases are known to have acute episodes of transient muscle weakness, poor muscular coordination (ataxia), abnormal sensations (paresthesia), decreased muscular tone (hypotonia), visual disturbances and pain which may be suddenly incapacitating. With each recurring episode, these symptoms may become more pronounced and remain for longer periods of time. Other diseases have more insidious onsets and display symptoms of muscle wasting (atrophy), swelling and paresthesia which may not suddenly incapacitate a person but may restrict his/her movements and eventually interfere with the ability to safely operate a motor vehicle. In many instances these diseases are degenerative in nature or may result in deterioration of the involved area. Once the individual has been diagnosed as having a rheumatic, arthritic, orthopedic, muscular, neuromuscular or vascular disease, then he/she has an established history of that disease. The physician, when examining an individual, should consider the following:

Appendix F 105 Highway Accident Report

1. the nature and severity of the individual’s condition (such as sensory loss or

loss of strength);

1. the degree of limitation present (such as range of motion);
2. the likelihood of progressive limitation (not always present initially but may

manifest itself over time); and

1. the likelihood of sudden incapacitation.

If the medical examiner determines that the disease or condition is likely to interfere with a driver’s ability to safely operate a motor vehicle, the driver cannot be certified and must be sent to a specialist. In cases where more frequent monitoring is required, a certificate for a shorter time period may be issued. § 391.41(b)(8) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no established medical history or clinical diagnosis of epilepsy; or any other condition which is likely to cause the loss of consciousness; or any loss of ability to control a commercial motor vehicle. Epilepsy is a chronic functional disease characterized by seizures or episodes that occur without warning, resulting in loss of voluntary control which may lead to loss of consciousness and/or seizures. Therefore, the following drivers cannot be qualified:

1. a driver who has a medical history of epilepsy; or
2. a driver who has a current clinical diagnosis of epilepsy; or
3. a driver who is taking antiseizure medication.

If an individual has had a nonepileptic seizure or an episode of loss of consciousness of unknown cause which did not require antiseizure medication, the decision as to whether that person’s condition may result in the loss of consciousness or loss of ability to control a motor vehicle is made on an individual basis by the medical examiner in consultation with the treating physician. Before certification is considered, it is suggested that a 6-month waiting period elapse from the time of the episode. Following the waiting period, it is recommended that the individual have a complete neurological examination. If the results of the examination are negative and antiseizure medication is not required, then the driver may be qualified. In those individual cases where a driver had a nonepileptic seizure or an episode of loss of consciousness that resulted from a known medical condition (e.g., drug reaction, high temperature, acute infectious disease, dehydration, or acute metabolic disturbance), certification should be deferred until the driver has fully recovered from that condition, has no existing residual complications, and is not taking antiseizure medication.

Appendix F 106 Highway Accident Report § 391.41(b)(9) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no mental, nervous, organic, or functional disease or psychiatric disorder likely to interfere with the driver’s ability to drive a commercial motor vehicle safely. Emotional or adjustment problems contribute directly to an individual’s level of memory, reasoning, attention, and judgment. These problems often underlie physical disorders. A variety of functional disorders can cause drowsiness, dizziness, confusion, weakness, or paralysis that may lead to incoordination, inattention, loss of functional control and susceptibility to accidents while driving. Physical fatigue, headache, impaired coordination, recurring physical ailments, and chronic “nagging” pain may be present to such a degree that certification for commercial driving is inadvisable. Somatic and psychosomatic complaints should be thoroughly examined when determining an individual’s overall fitness to drive. Disorders of a periodically incapacitating nature, even in the early stages of development, may warrant disqualification. Many bus and truck drivers have documented that “nervous trouble” related to neurotic, personality, emotional or adjustment problems is responsible for a significant fraction of their preventable accidents. The degree to which an individual is able to appreciate, evaluate and adequately respond to environmental strain and emotional stress is critical when assessing an individual’s mental alertness and flexibility to cope with the stresses of commercial vehicle driving. When examining the driver, it should be kept in mind that individuals who live under chronic emotional upsets may have deeply ingrained maladaptive or erratic behavior patterns. Excessively antagonistic, instinctive, impulsive, openly aggressive, paranoid or severely depressed behavior greatly interfere with the driver’s ability to drive safely. Those individuals who are highly susceptible to frequent states of emotional instability (schizophrenia, affective psychoses, paranoia, anxiety or depressive neuroses) may warrant disqualification. Careful consideration should be given to the side effects and interactions of medications in the overall qualification determination. § 391.41(b)(10) - A person is physically qualified to drive a commercial motor vehicle if that person:

Appendix F 107 Highway Accident Report Has a distant visual acuity of at least 20/40 (Snellen) in each eye with or without corrective lenses; and distant binocular acuity of at least 20/40 (Snellen) in both eyes with or without corrective lenses; and field of vision of at least 70 degrees in the horizontal meridian in each eye; and the ability to recognize the colors of traffic signals and devices showing standard red, green, and amber. The term “ability to recognize the colors of” is interpreted to mean if a person can recognize and distinguish among traffic control signals and devices showing standard red, green, and amber, he/she meets the minimum standard, even though he/she may have some type of color perception deficiency. If certain color perception tests are administered (such as Ishihara, Pseudoisochromatic, Yarn, etc.), and doubtful findings are discovered, a controlled test using signal red, green, and amber may be employed to determine the driver’s ability to recognize these colors. Contact lenses are permissible if there is sufficient evidence to indicate that the driver has good tolerance and is well adapted to their use. Use of a contact lens in one eye for distant visual acuity and another lens in the other eye for near vision is not acceptable, nor are telescopic lenses acceptable for driving commercial motor vehicles. If an individual meets the criteria by the use of glasses or contact lenses, the following statement shall appear on the Medical Examiner’s Certificate: “Qualified only if wearing corrective lenses.” § 391.41(b)(11) - A person is physically qualified to drive a commercial motor vehicle if that person: First perceives a forced whispered voice in the better ear at not less than five feet with or without the use of a hearing aid, or if tested by use of an audiometric device, does not have an average hearing loss in the better ear greater than 40 decibels at 500 Hz, 1,000 Hz and 2,000 Hz with or without a hearing aid when the audiometric device is calibrated to the American National Standard formerly American Standard Association (ASA). There are two organizations that set forth frequently used audiometric calibration standards, the American National Standards Institute (ANSI, S3, 6-1969) and the International Standards Organization (ISO, 1964). Since the prescribed standard under the

Appendix F 108 Highway Accident Report Federal Motor Carrier Safety Regulations is the ANSI, it may be necessary to convert the audiometric results:

1. at 500 Hz subtract 14 dB from the ISO reading to get the ANSI reading,
2. at 1,000 Hz subtract 10 dB from the ISO reading, and
3. at 2,000 Hz subtract 8.5 dB from the ISO reading.

The final figure is derived by averaging the readings of the three frequencies (e.g., If the loss reading at 500 Hz is 30 dB, at 1,000 Hz is 30 dB, and at 2,000 Hz is 52 dB, the average of the three readings is 37 dB, and the driver should be qualified). If an individual meets the criteria by using a hearing aid, the driver must wear that hearing aid and have it in operation at all times while driving. Also, the driver must be in possession of a spare power source for the hearing aid. If an individual meets the criteria by the use of a hearing aid, the following statement must appear on the Medical Examiner’s Certificate “Qualified only when wearing a hearing aid.” § 391.41(b)(12) - A person is physically qualified to drive a commercial motor vehicle if that person: Does not use a controlled substance identified in 21 CFR 1308.11 Schedule I, an amphetamine, a narcotic, or any other habit-forming drug. Exception: A driver may use such a substance or drug, if the substance or drug is prescribed by a licensed medical practitioner who is familiar with the driver’s medical history and assigned duties; and has advised the driver that the prescribed substance or drug will not adversely affect the driver’s ability to safely operate a commercial motor vehicle. This exception does not apply to the use of methadone. The intent of the medical certification process is to medically evaluate a driver to ensure that the driver has no medical condition which interferes with the safe performance of driving tasks on a public road. If a driver uses a Schedule I drug or other substance, an amphetamine, a narcotic, or any other habit-forming drug, it may be cause for the driver to be found medically unqualified. Motor carriers are encouraged to obtain a practitioner’s written statement about the effects on transportation safety of the use of a particular drug. A test for controlled substances is not required as part of this biennial certification process. The FMCSA or the driver’s employer should be contacted directly for information on controlled substances and alcohol testing under Part 382 of the FMCSRs. The term “uses” is designed to encompass instances of prohibited drug use determined by a physician through established medical means. This may or may not involve body fluid testing. If body fluid testing takes place, positive test results should be confirmed by a second test of greater specificity. The term “habit-forming” is intended to

Appendix F 109 Highway Accident Report include any drug or medication generally recognized as capable of becoming habitual, and which may impair the user’s ability to operate a motor vehicle safely. The driver is medically unqualified for the duration of the prohibited drug(s) use and until a second examination shows the driver is free from the prohibited drug(s) use. Recertification may involve a substance abuse evaluation, the successful completion of a drug rehabilitation program, and a negative drug test result. Additionally, given that the certification period is normally two years, the examiner has the option to certify for a period of less than two years if this examiner determines more frequent monitoring is required. This is contingent on the treating/prescribing medical practitioner making a good faith judgment, with notice of the driver’s assigned duties and on the basis of available medical history, that use of the substance by the driver at the prescribed or authorized dosage level is consistent with the safe performance of the driver’s duties. Finally, the substance’s use must be at the dosage prescribed or authorized. § 391.41(b)(13) - A person is physically qualified to drive a commercial motor vehicle if that person: Has no current clinical diagnosis of alcoholism. The term “current clinical diagnosis” is specifically designed to encompass a current alcoholic illness or those instances where the individual’s physical condition has not fully stabilized, regardless of the time element. If an individual shows signs of having a possible alcohol-use problem, he or she should be referred to a specialist trained to deal in such matters. After this individual has been treated and/or undergone appropriate counseling, he/she may be considered for certification.

110 Highway Accident Report Appendix G State Laws Regarding Unfit Commercial Drivers Table 6. Ability of States to offer immunity to individuals reporting concerns regarding commercial vehicle driver fitness. State Power to disqualify Immunity to persons who in good faith report an unfit driver Immunity to physicians who report an unfit driver Alabama Yes N/A Yes Alaska Yes Yes Yes Arizona Yes No Yes Arkansas Yes No No California Yes No Yes Colorado Yes Yes Yes Connecticut Yes No Yes Delaware Yes No No District of Columbia Yes No No Florida Yes Yes Yes Georgia Yes Yes Yes Hawaii Yes No No Idaho Yes No No Illinois No Yes Yes Indiana Yes No No Iowa Yes No Yes Kansas Yes Yes Yes Kentucky Yes Yes Yes Louisiana Yes No Yes Maine Yes Yes Yes Maryland No Yes Yes Massachusetts Yes No No Michigan No No No Minnesota Yes No Yes Mississippi Yes N/A N/A

Appendix G 111 Highway Accident Report State Power to disqualify Immunity to persons who in good faith report an unfit driver Immunity to physicians who report an unfit driver Missouri Yes No No Montana Yes Yes Yes Nebraska Yes No No Nevada Yes N/A Yes New Hampshire Yes N/A N/A New Jersey Yes No Yes New Mexico Yes No Yes New York Yes Yes Yes North Carolina Yes No No North Dakota Yes No Yes Ohio Yes No No Oklahoma Yes Yes Yes Oregon Yes Yes Yes Pennsylvania Yes Yes Yes Rhode Island Yes No Yes South Carolina Yes N/A No South Dakota Yes No No Tennessee Yes No No Texas Yes No Yes Utah Yes Yes Yes Vermont Yes No No Virginia Yes N/A Yes Washington Yes No No West Virginia Yes No No Wisconsin Yes No Yes Wyoming Yes Yes No Source: From the Association for the Advancement of Automotive Medicine and Federal Highway Administration, Update of Medical Review Practices and Procedures in U.S. and Canadian Commercial Driver Licensing Programs, PB97-194393INZ (Springfield, Virginia: National Technical Information Service [NTIS], 1997).

112 Highway Accident Report Appendix H Medical-Related Safety Board Investigations Table 7. Accidents in which the driver’s medical condition may have been a factor. Report number Date Description Location Medical condition(s) Issue HAR-83/05 February 1983 Head-on collision of dump truck and school bus Willow Creek, California Hypoglycemia (low blood sugar) Dump truck driver did not mention hypoglycemia in medical history section of exam form HAR-84/07 July 1984 Collision of a patrol car and a tractor-semitrailer Ashdown, Arkansas None reported Tractor-semitrailer driver did not have a medical certificate (either valid or invalid) HAR-86/02 May 1985 Multivehicle collision Snow Hill, North Carolina Posttraumatic epilepsy; did not take medication as prescribed Tractor-semitrailer driver did not mention epilepsy in medical history section of exam form HAR-87/01 August 1985 Intercity bus loss of control and collision with bridge rail Fredrick, Maryland Insulin-controlled diabetes, high blood pressure, and recent kidney transplant Intercity bus driver checked “no” for diabetes on medical history section of exam form; did not mention kidney transplant HAR-87/04 May 1986 Intercity bus loss of control and rollover Walker, California Uncontrolled diabetes Intercity bus driver forged medical certificate HAR-88/03 September 1987 Intercity bus run off the road and overturn Middletown, New Jersey Diabetes Intercity bus driver forged medical certificate on several occasions HAR-89/03 November 1988 Motorcoach loss of control and overturn Nashville, Tennessee High blood pressure Motorcoach driver did not mention high blood pressure in medical history section of exam form

Appendix H 113 Highway Accident Report Report number Date Description Location Medical condition(s) Issue CRH-92-FH-004 December 1991 Two trucks Arlington, Texas Sleep apnea Truckdriver had sleep apnea, which is not covered under the current regulations CRH-93-TH-015 January 1993 Propane truck overturn Arlington, Texas Sleep apnea Propane truckdriver had sleep apnea, which is not covered under the current regulations HWY-98-FH-004 October 1997 School bus struck by load from a tractor-semitrailer Franklin, North Carolina Driving while intoxicated Tractor-semitrailer driver had a drinking problem and was on antidepressants HWY-98-FH-019 October 1997 Motorcoach loss of control New York, New York Seizure-like episode in 1992 attributed to alcohol detoxification Motorcoach driver checked “no” to having seizures on three most recent exam forms HWY-98-MH-022 March 1998 School bus struck by a train Buffalo, Montana Poor vision School bus driver had poor vision, but Montana allows drivers with 20/40 vision in one or both eyes to drive intrastate HWY-98-FH-045 September 1998 School bus collision with dump truck Holmdel, New Jersey None reported Dump truck driver did not have a valid medical certificate (had been cited for this previously) HWY-98-FH-046 September 1999 School bus collision with dump truck Holmdel, New Jersey Migraines that were being treated with barbiturates School bus driver’s use of barbiturates may have affected attention and cognitive processing HWY-00-FH-001 October 1999 School bus collision with dump truck Central Bridge, New York Hypertension, diabetes, cardiac condition Driver failed to mention cardiac condition during examination HWY-00-FH-046 July 2000 Police cruiser struck by a tractor-semitrailer Jackson, Tennessee Sleep apnea Tractor-semitrailer driver had been diagnosed with severe obstructive sleep apnea

114 Highway Accident Report Appendix I International Commercial Vehicle Driver Certification Programs The Safety Board conducted a brief survey of the medical certification programs of the United Kingdom, Canada, and Australia to compare them with U.S. programs. These countries were selected mainly because the common language made information gathering simpler. However, the striking differences between these three countries make a comparison of their programs worthwhile. Information on what is known about the Mexican medical certification system is also included. The United Kingdom In the United Kingdom, medical fitness requirements are part of the commercial driver’s license (that is, Group 2 licenses). Group 2 license holders include drivers of trucks (category C) or buses (category D). Licenses are normally issued at age 21 and are valid until age 45, with exceptions for armed forces and certain passenger carrying vehicle licenses. After age 45, licenses are renewable every 5 years to age 65 unless restricted to a shorter period for medical reasons. From age 65 onward, the licenses are renewable annually. The Driver and Vehicle Licensing Agency (DVLA) does not issue licenses for taxis, ambulances, or emergency service vehicles. However, the Medical Commission on Accident Prevention recommends that Group 2 medical standards be applied to these categories as an occupational health policy. Only physicians may perform examinations for the purpose of licensure. No registry of examiners exists; drivers are allowed to choose their examiner. Examiners are only required to perform the examination, complete the examination form (D4), and validate it with an individualized physician’s stamp. Examiners are not responsible for certifying the fitness of drivers and are not required to provide an opinion on that matter. Once an examination is completed, drivers send the D4 to the DVLA. The DVLA tracks and reviews each D4 submitted and makes a fitness determination for each driver. The D4, which can be obtained at any post office, lists the medical standards by which commercial drivers are evaluated. Physicians desiring information on the evaluation process can consult several sources of information. The DVLA provides its At A Glance booklet, including the regulations and guidelines that apply to Group 2 license holders, to all health care professionals requesting it. 169 If more specific information or advice is needed, doctors may write to the DVLA or may contact its medical advisers during office hours. In addition, the government-sponsored Medical Commission on 169 Department of Environment, Transport and the Regions, Driver and Vehicle Licensing Agency, At a Glance (Swansea, United Kingdom: DLVA, 2000). This information is also available on the DVLA Web site http://www.dvla.gov.uk/at_a_glance/content.htm.

Appendix I 115 Highway Accident Report Accident Prevention publishes a booklet entitled, Medical Aspects of Fitness to Drive,170 which offers further guidance for examiners. Drivers are responsible for informing the DVLA of health problems that may affect their ability to operate a commercial vehicle. This notification is via an honor system. However, insurance companies may deny coverage to drivers who have not informed the DVLA of a potentially disqualifying disease or injury. Australia State and Territorial licensing authorities carry out the administrative processes for licensing and medical certification. Although no national policy is in place for these processes, national guidelines setting the minimum standards of vehicle operation and allowing for interstate commerce are voluntarily followed by the State and Territorial licensing authorities. Commercial drivers in Australia are only required to possess a current valid driver’s license for the class of heavy vehicle they are driving. Upon application for issue or renewal of a license, drivers are required to self-certify that they do not have medical conditions that may impair driving. Drivers are also required to report to the licensing authority if they become aware of such a medical condition. A driver who informs the licensing authority of a medical condition receives an examination form. These forms can vary from state to state, but most require doctors to include their name, address, phone number, and signature. Most driver licensing authorities indicate (by name) which medical standards should be applied on this medical examination form. Additional guidelines instruct doctors unfamiliar with the medical criteria on how to obtain further information.171 The driver can make an appointment with a physician of his or her choice, who would conduct the examination and complete the form. Only physicians are allowed to perform examinations. An examiner registry does not exist, although it has been in consideration for several years. The main concern about establishing a registry is that it might severely limit or even eliminate the choice of physicians in low population areas. Once the examination is completed, the physician returns the original form to the licensing authority and may keep a copy if so desired. As is the case in the United Kingdom, the licensing authority certifies a commercial driver as fit to drive. In determining whether to issue a license based on the examination certificate, issuing officers often telephone the examining physician to discuss the information provided. 170 J.F. Taylor, Medical Aspects of Fitness to Drive: A Guide for Medical Practicioners (London: Medical Commission on Accident Prevention, 1995). 171 National Road Transport Commission, Medical Examination of Commercial Vehicle Drivers (Melbourne, Australia: National Road Transport Commission, 1999).

Appendix I 116 Highway Accident Report Law enforcement checks are normally not done on a person’s medical history; the possession of a current license would be the basis for assuming that the driver is medically fit. Canada In Canada, medical certification is part of the driver’s license. As in the United Kingdom and Australia, holding a current and valid license is proof of medical fitness. Licensing is under the exclusive jurisdiction of the Provinces and Territories. However, Canada’s National Safety Code includes a section devoted to the Medical Standards for Drivers, which has been voluntarily adopted by the Provincial and Territorial licensing agencies as the minimum fitness requirement for drivers. Physicians, representing each Province and Territory, review the standards every 2 years to keep them current. In addition, the Canadian Medical Association publishes a guide to further help physicians in their decision to qualify drivers. Medical examinations are required every 5 years before age 45. They are required every 3 years for drivers between 45 and 65 and annually thereafter. Not filing a medical examination results in either a license suspension or a downgrade (to a lower vehicle classification) of the commercial license. In addition to the periodic examinations, drivers must also complete a medical questionnaire on the back of their license renewal application. If a potentially disqualifying condition is indicated, further medical review is triggered, and the driver is sent a medical examination form. Only physicians may evaluate the physical fitness of commercial drivers. Although a national registry of physicians does not exist, most provinces do require drivers to visit “recognized” physicians. For example, physicians in Manitoba must be registered with the College of Physicians and Surgeons of Manitoba. Although physicians are asked to provide medical information and a recommendation on the fitness of the driver, the licensing agency ultimately approves or disapproves the driver’s medical information. Physicians are required by law to report to the licensing agency conditions that may interfere with a driver’s ability to safely operate a vehicle. In Manitoba, physicians are protected by legislation from liability for reporting.172 Canada does not have a waiver system; cases are reviewed individually by the provincial medical review boards. For example, diabetics are not automatically refused licenses but are evaluated using criteria developed by the Canadian Diabetes Association, the Medical Standards for Drivers, and the Canadian Medical Association.173 172 Shelley Serle, Assistant Supervisor, Medical Records Section, Driver and Vehicle Licensing, Manitoba Highway and Government Services, Canada, e-mail correspondence, August 25, 2000. 173 Dr. David Irving, Chairman, Manitoba Medical Review Board, testimony, National Transportation Safety Board public hearing, Highway Transportation Safety Aspects of the North American Free Trade Agreement, Los Angeles, California, October 20 through 22, 1999.

Appendix I 117 Highway Accident Report Mexico Mexico’s commercial driver’s licensing system incorporates medical certification. A commercial driver’s license can be issued to individuals who are least 18 (or at least 21 for international drivers). Commercial drivers’ licenses are renewed every 2 years, at which time drivers are required to be medically examined. However, drivers who suffer from medical conditions that may affect driving performance may be examined more frequently. Ninety-six percent of passenger transportation in Mexico is by bus. Because of this, drivers of commercial passenger vehicles are subjected to a much stricter medical examination process than other commercial drivers. They are medically examined before every trip by examiners located at the bus terminals. Mexico even has mobile medical testing, and a driver can be stopped while on duty to have the testing administered. Only physicians are allowed to become examiners. All examiners are Federal employees and are required to attend an examiners’ training program. After completing an examination, the form examiner forwards the form to a central site, where it is input into a database that can be used to review and track driver fitness information. Mexico currently does not have a waiver program.174 174 C.P. Alfonso Salinas Corral, Director General Adjunto de Operacion, Subsecretaria de Transporte, Mexico, interview, October 2000.

118 Highway Accident Report Appendix J Drug-Related Safety Board Investigations Table 8. Accidents in which driver’s use of illicit drugs may have been a factor. Report number Date Description Location Driver with condition Drugs in system Comments HAR-87/02 November 1985 School bus loss of control and collision with guardrail St. Louis County, Missouri School bus driver Phencyclidine (PCP) tetrahydrocannabinol (THC), from marijuana No prior drug charges; no reports of drug use from previous employers HAR-87/05 July 1986 Intercity bus collision with tractor-semitrailer Brinkley, Arkansas Tractor-semitrailer driver None detected Driver admitted to smoking marijuana 2 days prior to accident HAR-87/04 April 1987 Tour bus collision with bridge Alexandria, Virginia Tour bus driver Benzolylecognine (from cocaine); diazepam (from valium); marijuana metabolite Driver had active suspensions from two States at the time of accident HAR-89/02 August 1987 Flat-bed truck collision with school bus Bronson, Florida Flat-bed truck driver Tetrahydrocannabinol (THC), from marijuana Driver failed to stop at stop sign HAR-98/01 February 1997 Multivehicle crash Slinger, Wisconsin Refrigeration truck driver Tetrahydrocannabinol (THC), from marijuana Refrigeration truck driver not at fault CRH-92-F-H007 February 1992 Propane truck overturn Fort Smith, Arkansas Propane truck driver Tetrahydrocannabinol (THC), from marijuana; 0.1 blood alcohol concentration Two DWI convictions, 1985; one DWI conviction, 1987

FD07234 ｜ 2001_美国_HAR0102.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HIGHWAY ACCIDENT REPORT PB2001-916202 NTSB/HAR-01/02 COLLISION BETWEEN METROLINK TRAIN 901 AND MERCURY TRANSPORTATION, INC., TRACTOR-COMBINATION VEHICLE AT HIGHWAY-RAILROAD GRADE CROSSING IN GLENDALE, CALIFORNIA ON JANUARY 28, 2000 7410

this page intentionally left blank

Highway Accident Report Collision Between Metrolink Train 901 and Mercury Transportation, Inc., Tractor-Combination Vehicle at Highway-Railroad Grade Crossing in Glendale, California January 28, 2000 NTSB/HAR-01/02 PB2001-916202 National Transportation Safety Board Notation 7410 490 L’Enfant Plaza, S.W. Adopted November 27, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Collision Between Metrolink Train 901 and Mercury Transportation, Inc., Tractor-Combination Vehicle at Highway-Railroad Grade Crossing in Glendale, California, on January 28, 2000. Highway Accident Report. NTSB/HAR-01/02. Washington, DC. Abstract: About 5:56 a.m. on January 28, 2000, in Glendale, California, a tractor-combination vehicle was transporting an oil refinery condenser unit. The vehicle was attempting to traverse a highway-railroad grade crossing when it became lodged on the railroad tracks. A northbound commuter train collided with the vehicle. The engineer, conductor, and four passengers received minor injuries. Total damages were estimated to be over $2 million. The major safety issues discussed in this report were the appropriateness of the actions of the truckdriver, pilot car drivers, and police escorts; the weaknesses in the planning, coordination, and execution of this oversize/overweight movement; pilot car driver and truckdriver fatigue; and the lack of low-clearance warning signs. As a result of this accident investigation, the National Transportation Safety Board issued recommendations to the Federal Highway Administration; Federal Motor Carrier Safety Administration; city of Glendale, California; American Association of State Highway and Transportation Officials; American Association of Motor Vehicle Administrators; Commercial Vehicle Safety Alliance; International Association of Chiefs of Police; National Sheriffs’ Association; Specialized Carriers and Rigging Association; California Professional Escort Car Association; Texas Pilot Car Association; and United Safety Car Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916202 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Truck Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Train Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Truck Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Truckdriver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Pilot Car Drivers’ Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Motor Carrier Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Train Crew Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Railroad Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Accident Site Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Roadway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Grade Crossing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Toxicological Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Accident Crossing Warning Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Other Grade Crossings on Permitted Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Heavy Hauling Industry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Permit Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 California Department of Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Permit Companies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Pilot Car Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Pilot Car Industry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Pilot Car Driver Certification Programs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Pilot Car and Police Escort Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 California Highway Patrol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Other Accidents Involving Permitted Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Accident Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Preparation and Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Contents iv Highway Accident Report Grade Crossing Hazard Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Low-Clearance Warning Grade Crossing Sign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Fatigue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Oversize/Overweight Vehicle Movements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Truckdriver Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Pilot Car Driver Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Police Escort Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Permitting Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Coordination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 B: Terms Relating to Oversize/Overweight Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 C: California Department of Transportation Office of Truck Services Summary of Major Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 D: California Highway Patrol Teams 1 and 2 Escort Officers’ On-Duty Time for the 3 Days Prior to the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

v Highway Accident Report Acronyms and Abbreviations AASHTO -- American Association of State Highway and Transportation Officials Caltrans -- California Department of Transportation CDL -- commercial driver’s license CDLIS -- Commercial Driver’s License Information System CFR -- Code of Federal Regulations CHP -- California Highway Patrol DPS -- Department of Public Safety FHWA -- Federal Highway Administration Mercury -- Mercury Transportation, Inc. WASHTO -- Western Association of State Highway and Transportation Officials

vi Highway Accident Report Executive Summary On January 28, 2000, about 5:56 a.m. in Glendale, California, a tractor- combination vehicle, operated by Mercury Transportation, Inc., was transporting an oil refinery condenser unit. The vehicle missed a turn in its planned route, traversed a highway-railroad grade crossing, turned around, and was attempting to retraverse the crossing when it became lodged on the railroad tracks. About 90 seconds later, northbound Metrolink commuter train 901, operated by the Southern California Regional Rail Authority, collided with the vehicle. The engineer, conductor, and four passengers received minor injuries. Total damages were estimated to be over $2 million. The National Transportation Safety Board determines that the probable cause of the collision of the Metrolink passenger train with the tractor-combination vehicle was (1) inadequate preparation and route planning for the movement; (2) poor coordination of the movement among the truckdriver, pilot car drivers, police escort, and permitting authorities; and (3) a lack of recognition of the potential hazard caused by the accident vehicle at the grade crossing. Contributing to the accident was the fatigue of the pilot car drivers and the truckdriver. The following major safety issues were identified in this accident: the appropriateness of the actions of the truckdriver, pilot car drivers, and police escorts; the weaknesses in the planning, coordination, and execution of this oversize/overweight movement; pilot car driver and truckdriver fatigue; and the lack of low-clearance warning signs. As a result of this accident investigation, the National Transportation Safety Board makes recommendations to the Federal Highway Administration; Federal Motor Carrier Safety Administration; city of Glendale, California; American Association of State Highway and Transportation Officials; American Association of Motor Vehicle Administrators; Commercial Vehicle Safety Alliance; International Association of Chiefs of Police; National Sheriffs’ Association; Specialized Carriers and Rigging Association; California Professional Escort Car Association; Texas Pilot Car Association; and United Safety Car Association.

1 Highway Accident Report Factual Information Accident Narrative On January 28, 2000, about 5:56 a.m. (Pacific standard time) in Glendale, California, a tractor-combination vehicle, operated by Mercury Transportation, Inc., (Mercury) was transporting an oil refinery condenser unit, manufactured by Toromont Process Systems. The vehicle missed a turn in its planned route, traversed a highway- railroad grade crossing, turned around, and was attempting to retraverse the crossing when it became lodged on the railroad tracks. About 90 seconds later, westbound Metrolink commuter train 901, operated by the Southern California Regional Rail Authority, collided with the vehicle. (See figure 1.) The Metrolink train had been traveling about 70 mph at the time of the collision. The engineer, conductor, and four passengers received minor injuries. The tractor-combination vehicle measured 135 feet long, 15 feet wide, and 18 feet 6 inches high with a ground clearance of approximately 6 inches (see figure 2); the gross vehicle weight was 226,000 pounds.1 (See appendix B for terms relating to oversize/overweight loads.) The load, valued at $1.5 million, was being transported from Figure 1. Final rest positions of train and vehicle. (Photograph source: Glendale, California, Police Department.) 1 A typical tractor-semitrailer is made up of a tractor (18 to 20 feet long) and a semitrailer (40 to 53 feet long), both 8 feet wide, which together weigh 80,000 pounds.

Factual Information 2 Highway Accident Report Houston, Texas, to El Segundo, California, and possessed specialized moving permits requiring escort vehicles. At the time of the accident, two private pilot vehicles and three California Highway Patrol (CHP) officers were escorting the tractor-combination vehicle. The Metrolink train had been bound from Los Angeles to Burbank, California. Truck Events Preceding the Accident The transportation of this oversize/overweight load covered over 2,100 miles through 4 States (see figure 3); involved 5 pilot car companies, 2 permit companies, the permit issuing offices of 4 States, and in California, 12 local jurisdictions; and had been under way for 22 days at the time of the accident. The following description of the trip is segmented by State. Texas (January 6 to 14, 2000) According to Toromont Process Systems officials, the load was scheduled to begin moving from Houston on January 6 with a verbal agreement between the company and Mercury that the load was to be delivered as rapidly as possible. On January 6 about 8:45 a.m., the truckdriver arrived to transport the load. He stated that a tree had to be cut down before the vehicle could exit the Toromont Process Systems facility. The convoy of vehicles consisted of two police units;2 two private pilot Figure 2. Photograph of the tractor-combination vehicle before the accident. (Photograph source: Mercury Transportation, Inc.)

Factual Information 3 Highway Accident Report cars (one leading and one trailing) from different companies, Happy’s Pilot Car Service and L.P. Flag Car Company; and the transport vehicle. The convoy traveled about 51 miles to Sealy, Texas, where the truckdriver determined that the load was unstable and parked the vehicle. He then notified Townsend Transportation, the owner of the tractor- combination vehicle,3 that the vehicle needed a set of outrigger wheels to make the load more stable. The outrigger wheels were installed, and the Texas segment of the trip resumed on January 10. The truckdriver indicated that the convoy encountered subsequent problems with delays on seven other occasions in Texas (see figure 4): Sealy The load knocked down city hazard warning lights on a sign. Wallis The convoy encountered a raised railroad grade crossing that the truck could not traverse. They stopped for 3 hours until they received approved rerouting. 2 The truckdriver and pilot car driver indicated that police in Houston and Las Cruces, New Mexico, escorted the load; however, this information was not noted on the permits, and the National Transportation Safety Board was not able to verify which police departments conducted the escorts. Figure 3. Map indicating convoy route from Houston, Texas, to El Segundo, California. 3 Mercury leased the vehicle. El Segundo

Factual Information 4 Highway Accident Report San Antonio The convoy encountered a bridge with a height clearance lower than the load height and required rerouting. Castroville The load struck an overhead telephone line. Clint The load struck a traffic light. El Paso The convoy encountered overhead street signs with height clearances lower than the load height. A bucket truck had to be used to lift power lines to allow the load to pass through. Unknown location4 The convoy encountered a right turn that the truck could not negotiate and had to detour around. New Mexico (January 14 to 24, 2000) On January 14, the convoy entered New Mexico at Carlsbad, where the Port of Entry officials checked the New Mexico State permit and found that it had expired and had to be renewed.5 The renewal required contacting the New Mexico Department of 4 The driver was unable to recall the exact location. Figure 4. Map indicating convoy route through Texas. T E X A S El Paso Carlsbad Clint NEW MEXICO Castroville San Antonio Sealy Houston Wallis

Factual Information 5 Highway Accident Report Public Safety and Public Utilities to gain approval for another permit. The convoy also had to arrange for a bucket truck to raise power and telephone lines along the trip route. The convoy drove to El Paso, Texas, and waited for the new permit. On January 21, the convoy resumed the trip, leaving El Paso and entering New Mexico near Las Cruces. The trip through New Mexico was along a southern route, roughly parallel to Interstate Highway 10 through Deming and Lordsburg, New Mexico, into Arizona. In Lordsburg, a pilot car from Billy’s Pilot Car Company replaced the pilot car from Happy’s Pilot Car Service, and the truckdriver parked the truck at 4:15 p.m. on January 22 until 9:45 a.m. on January 24. According to the truckdriver and pilot car drivers, the trip through New Mexico was uneventful. (See figure 5.) Arizona (January 24 to 27, 2000) On January 24, the vehicle entered the State on State Route 80 near Douglas, Arizona, and traveled to the Sierra Vista (Arizona) Port of Entry, where it met officials from the Arizona Department of Public Safety (DPS). The Arizona permit specified a DPS 5 New Mexico has a fixed Port of Entry system, under which commercial vehicles entering the State, including special moving permitted vehicles, are checked for required licensing, equipment, and fuel tax documents. Figure 5. Map indicating convoy route through New Mexico. N E W M E X I C O Lordsburg Deming Las Cruces Carlsbad T E X A S El Paso

Factual Information 6 Highway Accident Report escort from Sierra Vista through Nogales and to Tucson, Arizona, but not through the remainder of the State. The trip route took the convoy on Interstate Highway 8 from Sierra Vista to Tucson to Yuma, Arizona, and north on U.S. 95 to Quartzsite, Arizona. At 1:30 p.m. on January 26, the convoy arrived in Quartzsite, where they encountered DPS officers who told them that a recreational vehicle festival was occurring in Quartzsite and that they would have to be escorted through the city because of the traffic conditions. The DPS officers added that another load was ahead of them and that they would have to wait.6 They parked on the shoulder of the two-lane roadway until about 5:00 p.m. when the officers returned. The officers told the truckdriver that they would be unable to escort the load through Quartzsite that day; the load remained parked on the side of the road all night. The truckdriver said he went to a truck stop in Quartzsite to obtain faxed copies of the California permits. The truckdriver and the rear pilot car driver said they awoke about 7:30 a.m. on January 27. The public safety officers did not come back, and the convoy drove through Quartzsite without them. About 9:00 a.m., the convoy arrived at the California-Arizona border, where the truckdriver acquired the last of the faxed California permits from Mercury at a nearby truck stop. (See figure 6.) 6 The vehicle and load ahead of them required an Arizona DPS escort per the conditions of the permit. Figure 6. Map indicating convoy route through Arizona. Blythe Quartsite Yuma Phoenix Tucson Sierra Vista Douglas A R I Z O N A Nogales

Factual Information 7 Highway Accident Report California (January 27 to 28, 2000) A driver from Dick’s Pilot Car Service (the lead pilot car driver) had driven from San Bernardino to Blythe, California, during the night7 and met with CHP officers at the California-Arizona border at 6:00 a.m. (Pacific standard time) on January 27.8 About 8:00 a.m., they met the truck and the rear pilot car at the Arizona truck scale facility about 1 mile from the border. While the truckdriver obtained the permits, the CHP officers examined the vehicle and load for proper securement and lighting. This check was a walk- around inspection and did not include matters such as brake adjustment, driver’s logbook (record-of-duty status), or measurement of the load to ensure compliance with the permit. The CHP officers explained that they used their experience in estimating the dimensions of the load for compliance and did not check the driver’s logbook because they believed that he had rested the day before in Quartzsite and had received the required 8 hours of rest before beginning this trip. The CHP officers had a copy of the California Department of Transportation (Caltrans) permit and the lead pilot car driver had copies of the permits supplied by West Coast Services,9 which included permit applications for Glendale and Hawthorne, California. The CHP officers examined the permits for routing only. They did not notice that the Glendale paperwork was not a permit but an application only. The Hawthorne paperwork read “Annual on File” in the permit number box, and they believed it to be a valid permit. The lead pilot car driver told investigators that the night before the trip he had created a master list of the designated routes in California by transcribing them from the various permits onto a handwritten sheet of paper. The movement of the convoy began about 8:30 a.m., and the convoy traveled several secondary routes from Blythe to Adelanto, California, through mostly desert area that was sparsely populated. Communication between vehicles was accomplished using CB and car-to-car CHP radios. Near Victorville, California, the convoy drove past a roadway10 onto which it should have turned. After driving one block, the convoy realized the error and turned around. The convoy arrived in Adelanto about 5:00 p.m., and the CHP officers from Blythe11 departed. (See figure 7.) The truckdriver went to a truck stop, where he fueled the truck, ate, showered, and contacted the company. He returned to the load about 8:30 p.m. and was rigging the vehicle with lights for the nighttime move when, about 9:00 p.m., three CHP officers from the Inland Division12 arrived. (Neither the truckdriver nor the pilot car drivers received any sleep during this stop.) The Inland Division CHP officers examined the permits. Again the examination was for routing and not for permit verification. None of the CHP 7 The pilot car driver said that he slept at home for 7 to 8 hours before the trip. 8 The time to drive from San Bernardino to Blythe is between 3 and 3 ½ hours. 9 A private permit company hired by Mercury to obtain the California permits. 10 The name of the roadway had been changed from Air Base Road, which was the name on the permit, to Air Express Way. 11 The CHP officers from Blythe are referred to as CHP team 1. 12 The CHP officers from the Inland Division are referred to as CHP team 2.

Factual Information 8 Highway Accident Report officers had copies of the moving permits; however, they indicated that they were familiar with the routes taken by oversized loads in their area. The officer-in-charge said that he relied on the lead pilot car driver to ensure that the convoy stayed on the correct routes. The truckdriver, who had been driving nearly 10 hours when he arrived at Adelanto, said that he talked with the CHP officer-in-charge about his hours of service; he told the officer-in-charge that he was almost out of hours13 and that they could not travel very far. The truckdriver said the officer-in-charge told him, “I guess we will not get very far.” The truckdriver also indicated that his hours of service were not discussed further throughout the remainder of the trip. According to the officer-in-charge and another officer who was standing nearby while the two conversed, the truckdriver’s hours of Figure 7. Map indicating convoy route through California. 13 The current hours-of-service rules permit a commercial driver to drive 10 hours before resting 8 hours. C A L I F O R N I A Victorville Blythe Adelanto Glendale El Segundo

Factual Information 9 Highway Accident Report service were not discussed. According to the officer-in-charge, he was unaware of the time the vehicle arrived in Adelanto, and he assumed the truckdriver had received sufficient rest. The CHP officers conducted a walk-around inspection of the vehicle and load, and the convoy departed Adelanto about 9:30 p.m. From Adelanto, the Caltrans permit routed the convoy southbound on Interstate Highway 15 to westbound Highway 138 to westbound Highway 18. Two weeks earlier the officer-in-charge had escorted another permit load through this area. The earlier permit had routed that load out of Adelanto westbound on Highway 18 to Highway 138 into Los Angeles County. The officer-in-charge indicated that when he read the route approved by Caltrans for the accident load, he thought it strange but relied on the Caltrans approval process. The convoy traveled the designated route and as it made the turn from southbound Interstate Highway 15 onto Highway 138, the bottom of the semitrailer scraped the roadway. On Highway 138, approximately 1/3 mile west of Interstate Highway 15, about 11:00 p.m., it approached a railroad bridge that had inadequate clearance. The CHP officer-in-charge ordered the vehicle to turn around and return to Adelanto. He went to the CHP Cajon Pass scale facility, about 2 miles away, and phoned the Caltrans 24-hour emergency number for permit routing to obtain a route variance. After business hours, the 24-hour number connects to a pager for an on-call official. The officer-in-charge said that a page response in these circumstances usually came within 5 minutes. He waited about 10 minutes and instructed the CHP scale officers to notify him via radio if the Caltrans official called. (CHP reported that Caltrans returned the page at 2:30 a.m., after the convoy was well within Los Angeles County.) The CHP officer-in- charge then authorized the convoy move from Adelanto west on Highway 18. The route led the convoy west on Highway 18 to Highway 138, to Pearblossom Highway, and to Sierra Highway near Palmdale, California, in Los Angeles County. En route the lead pilot car driver missed a turn around a bridge and another turn down a dirt roadway. The Los Angeles County permit required a Los Angeles County Department of Public Works escort, which was to meet the vehicle at the county line. The escort expected the vehicle to arrive about 11:30 p.m., but it did not arrive until about 1:30 a.m. on January

1. (While traveling southbound on Sierra Highway, the lead pilot car driver had missed a

bypass around a low bridge, and the convoy had to turn around.) The county escort and the CHP discussed the county and Los Angeles city permit curfew of 5:00 a.m., which meant the load would be prohibited from further movement after 5:00 a.m. The county escort said he stayed with the vehicle until about 3:45 a.m. when the convoy arrived at the Los Angeles city limit. According to the CHP officer-in-charge, the convoy reached the Los Angeles city limit about 4:20 a.m. Upon reaching the Los Angeles city limit, the county escort said, “you’re clear now”; the CHP officer-in-charge understood this statement to mean that he was clear to continue all the way to El Segundo.14 The Los Angeles city permit required a city department of public works escort. The city escort indicated that he had anticipated the vehicle to arrive about 1:00 a.m. at the 14 The CHP officer-in-charge said he was not familiar with the curfews imposed by any jurisdiction.

Factual Information 10 Highway Accident Report city limits near the intersection of Sierra Highway and Foothill Boulevard. The city escort said that he waited from 12:00 a.m. to 4:00 a.m., and when the load did not arrive, he went home. A city escort was required as a condition of the city permit, and when the vehicle continued into the city without the escort, it was in violation of the terms and conditions of the permit. The CHP officer-in-charge indicated that he was unaware of this requirement. The vehicle continued south on several major streets through Los Angeles and entered Burbank traveling east on Glenoaks Boulevard. The Burbank permit did not require a city escort. The vehicle continued east on Glenoaks Boulevard into Glendale. Although West Coast Services had applied for a permit from Glendale, one had not been issued because of missing insurance information from the carrier. The CHP officer-in-charge said that he was fairly familiar with the route taken until the convoy entered Glendale. He said he was less familiar with these streets and relied on the lead pilot car driver to take the correct route, although he was suspicious of the pilot car driver’s abilities since he had made several previous routing errors. The route on the permit application to Glendale specified travel east on Glenoaks Boulevard, south on Grandview Avenue, east on San Fernando Road, and south on Fletcher Drive. (See figure 8.) When the lead pilot car reached the intersection of Glenoaks Boulevard and Grandview Avenue, he continued east on Glenoaks Boulevard, failing to make the correct turn. The lead CHP officers notified him that he had missed the turn, and he went to the next intersection and turned around. By this time, the first CHP units and the truck had made the correct turn. The pilot car driver returned and drove ahead of the other vehicles on Grandview Avenue as they approached San Fernando Road. The pilot car driver had transcribed the route incorrectly on his handwritten sheet and had not recorded the turn from Grandview Avenue onto San Fernando Road. As a result, he told the CHP officers and the truckdriver that they were looking for Fletcher Drive as the next turn. The CHP officers entered the intersection of San Fernando Road and Grandview Avenue and stopped westbound and eastbound traffic to allow the truck to go safely through the intersection. The lead pilot car driver told the investigating police15 that he heard the truck making a sound like it had “bottomed out” when it first went over San Fernando Road. Grandview Avenue continued over a set of two Metrolink railroad tracks at an active highway-railroad grade crossing. The traffic control at the grade crossing consisted of pavement markings, signs, lights, bells, and gates. As the vehicle crossed over the tracks, the CHP officer-in-charge noticed that the vehicle scraped the surface of the grade crossing. He said he believed that this was not an unusual occurrence for a load of this size and ground clearance. The truckdriver said he did not feel the vehicle scrape when it went across the grade crossing. The time was approximately 5:15 a.m. 15 During a January 28, 2000, interview conducted by the Glendale Police Department.

Factual Information 11 Highway Accident Report After crossing the railroad tracks, the lead pilot car driver saw that the street came to a dead end 2 blocks from the grade crossing. He stated that he realized then that he had made a mistake and stopped. The three CHP officers, both pilot car drivers, and the truckdriver stopped and exited their vehicles; together they examined a map to determine the best route of egress and return to the permit route. They found that the best route was to go around the block, eastbound on Flower Street (curved to the north), to westbound on Airway Street, and back to Grandview Avenue; the convoy could then turn east on San Fernando Road. After the lead pilot car and one CHP officer drove the route to assess its safety, the convoy returned to northbound Grandview Avenue. (See figure 8.) Upon reaching Grandview Avenue, the convoy encountered an eastbound Metrolink commuter train at the grade crossing and waited for the train to pass. The lead pilot car and two lead CHP escort units then entered the intersection. The lead pilot car turned east on San Fernando Road, while one CHP unit blocked westbound traffic and the other CHP unit blocked eastbound traffic. The truck began to cross the railroad tracks, and the rear section of the vehicle became lodged on the tracks. At this point, no one except the truckdriver realized the vehicle was stuck. The truckdriver exited the tractor and went to the hydraulic controls on the left side of the vehicle to raise it off the tracks. The rear pilot car driver moved up to the right rear of the vehicle to determine why the truck was not moving. The CHP officer- Figure 8. Map indicating convoy route through section of Glendale. Thompson Ave Raymond Ave Western Ave Justin Ave Grover Ave Sonora Ave Davis Ave Rosedale Ave Newby St Willard Ave San Fernando Rd 5th St Air Way Flower St Lake St Fairfield St Randall St Garden St Blossom St Aristo St Truftt St Grand Central Ave Hazel St Circle Seven Dr Grendview Ave Sepulveda Bruce Ave Highland Ave Virginia Ave Hillcrest Ave Cleveland Rd Idlewood Rd Graynold Ave Norton Ave Alma St Tononi St Olmsted Dr N. Kenneth Rd Glenwood Rd South St Palm Dr W Dryden St W Glenoaks Blvd Arden Ave Kellogg Ave Patterson Ave Omar St Burchett St Faircourt Ln Fairmont Ave Fairmont Ave Grange St Cutter St Sperry St West Glendale Salem St San Fernando Rd Concord St State St Chester St N Zoo Dr Grendview Memorial Park Pelanconi Park Grandview Ave W. Glenoaks Blvd Ruberta Ave Zoo Dr Riverside Dr 134 Zoo Dr Doran St Western Heriatage Dr W Doran St W Doran St 134 5 0 300m 900ft

Factual Information 12 Highway Accident Report in-charge, who was the rear CHP unit at the time, began calling out for the truckdriver to move the truck off the tracks, not realizing the vehicle was lodged on the crossing. The railroad warning devices started to activate. Witnesses estimated that from the time the vehicle was initially stuck (stopped) on the tracks to the activation of the warning devices was less than 60 seconds. When the warning devices activated, several events happened at once. One CHP officer began to call on the CB radio for the truckdriver to get the truck off the tracks, believing the driver was still in the tractor. She did this several times until she saw the truckdriver running back toward the tractor from somewhere on the left side of the vehicle. The CHP officer-in-charge began to yell for the truckdriver to move the truck off the tracks. The rear pilot car driver began to call for the truckdriver to get the vehicle off the tracks. (See figure 9.) The truckdriver, seeing the approaching westbound train, ran back to the tractor and began to drive forward. He was able to move the tractor forward a few inches when the train struck the load. Two CHP officers said they saw the truck moving forward before the collision. The truckdriver said he was just starting to move off the tracks when the train hit the vehicle. The impact broke the semitrailer and rear “jeep”16 off the leading jeep. The train propelled the rear jeep about 101 feet west of the crossing where it came to rest along the south side of the tracks. The train carried the load about 1,100 feet west on Figure 9. Diagram of accident site. 16 The term jeep denotes various configurations of long-frame and short-frame dollies when they are combined to accommodate the weight of a load. A jeep dolly unit is usually positioned at each end of the cargo bed. North RAIL CROSSING ROAD RAIL CROSSING ROAD RR R R STOP STOP STOP R R R R R R Scalein Feet 0 40 80 20 60 100 Source: California Highway Patrol Air Way Grandview Avenue SanFernando Road Grandview Avenue

Factual Information 13 Highway Accident Report the tracks before coming to a stop on the tracks. (See figure 10.) Witnesses estimated the total time from the truck stopping on the tracks to impact was less than 90 seconds. Train Events Preceding the Accident17 The train operating crew, consisting of the locomotive engineer and the conductor, went on duty at Taylor Yard in Glendale at 4:25 a.m. They operated the commuter train without passengers to Los Angeles Union Station. Once the train arrived at the station, the crew changed operating ends of the train, loaded passengers, and prepared for departure. At 5:42 a.m., the engineer informed the train dispatcher that train 901 was ready to depart Figure 10. Aerial view of accident site. (Photograph source: Glendale, California, Police Department.) 17 A Safety Board railroad accident investigator interviewed both the engineer and the conductor on April 3, 2000.

Factual Information 14 Highway Accident Report on time; it left the station at 5:43 a.m. During the departure from the station, the engineer performed a running air brake test. The engineer stated that the test did not reveal any problems with the braking system. Further, she stated that the brakes worked properly during the trip from Los Angeles Union Station to Glendale, the first passenger stop. At the Glendale station, about 10 passengers exited, and no one boarded train 901. Moments after departing the station, train 901 passed an opposing train on the opposite track. Before the Grandview Avenue crossing, the train passed a wayside detector at milepost 7.8 that announced no defect was detected on the train and that the train speed was 76 mph. As the train rounded a slight left-hand curve, the engineer said that the crossing became fully visible and she saw a large object on the tracks. She sounded the train whistle as a warning. As the train approached the crossing, the engineer determined that the train was going to strike the object. About 1,000 feet18 before the crossing, the engineer applied the emergency brakes on the train. The engineer said that she “threw herself to the floor” to avoid possible personal injury during the inevitable collision. Once the train had stopped, the engineer radioed an emergency message to southbound commuter Metrolink train 100 on the opposing track. She recalled that she normally passed train 100 daily at this location on the adjacent track. As the trailer was shoved in front of her locomotive, she knew that it was obstructing the adjacent southbound track. She told the train 100 engineer “to stop his train immediately.” The other engineer heard this instruction and stopped his train 50 feet from the obstruction. Emergency Response Immediately after the collision, the CHP officer-in-charge radioed his dispatch officer about the accident. One of two Glendale police officers who were in the area and witnessed the collision immediately radioed the Glendale dispatcher about the collision. The Glendale Fire Department records19 indicate that a citizen notified the fire department of the accident at 5:57 a.m. The department dispatched 3 fire engines, 2 emergency medical ambulances, 2 pump trucks, 2 other rescue vehicles, and 21 firefighters. At 6:02 a. m., the first fire department vehicle, engine 27B, arrived on scene. Upon arrival, the firefighters advised responding units that the accident site was located 1/4 mile north of where it had been initially reported. Initial radio reports from the scene to the communications center indicated that “the front of the train was wrapped in a large metal structure that did not appear to be a semi [tractor trailer].” (See figure 11.) 18 Sand was applied when the brakes were placed in emergency; signs of sand were noted on the rail 955 feet before the crossing. 19 The Glendale Fire Department Field Incident Report No. 00-1149 provided information regarding the emergency response, as well as the hazard assessment, multiagency and emergency medical responses, and establishment of a safe area. The report of the management of the incident by emergency response agencies indicates the response was timely and adequate to meet the emergency situation.

Factual Information 15 Highway Accident Report Engine 27B initially had difficulty reaching the accident site because two chain link fences blocked the access route; these were later cut through by fire department personnel. After making their way to the train, firefighters found several local industry personnel assisting passengers away from the train. During the search of the train and immediate area, truck 21 firefighters found exposed wires from the rail crossing gate, notified Metrolink, and requested the power be turned off; Metrolink responded to the request immediately. The firefighters found the train engineer still in the locomotive and checked her for injuries. They then asked whether she had “shut down the engine” and notified the railroad of the accident; she replied she had. The engine access door was jammed, and the engineer was extricated from the engine by firefighters from truck 21. Firefighters from engine 27B and truck 26 searched the train cars for injured passengers; about 10 minutes later, they repeated the search to insure that all the injured had been located. The emergency responders established a triage area for treating the passengers in a parking lot adjacent to the railroad tracks at San Fernando Road. The two ambulances were assigned to transport injured passengers to local medical facilities, and a third rescue vehicle was based at the triage area to care for the injured. No passengers, train crewmembers, or emergency response personnel required medical attention. By 8:50 a.m., the emergency medical personnel and ambulances were released from the scene. Engine 22 was assigned to remain on scene to provide fire protection Figure 11. Postcollision view of condenser and train. (Photograph source: Glendale, California, Police Department.)

Factual Information 16 Highway Accident Report during the wreckage removal and site restoration process. The fire department officially completed its duties at 9:52 p.m. According to the Glendale Office of Emergency Services coordinator, the California and the Federal Emergency Management Agency guidelines form the basis for Glendale’s Emergency Response Plan, which is updated annually. Glendale employs the incident command system for all public safety and utility agencies, and the incident command system specifically addresses mass casualty transportation accidents. In addition, the response plan for “all hazards” provides guidelines for mass casualty incidents. The coordinator indicated that the responding fire and police department personnel used the emergency response plan at the accident scene and that the management of the accident scene was routine for the type of accident occurrence. Injuries The two train crewmembers and four passengers received minor injuries. (See table 1.) Table 1. Injuries. Damages The collision resulted in severe damage to the locomotive (see figure 12) and minor exterior sheet metal damage to two coaches. The signal mast, lights, bells, and gate on the north side of the crossing were removed in the collision. No significant track damage occurred. The tractor was not damaged. The vehicle separated into three parts, and the oil refinery condenser was destroyed. (See table 2.) Injuries Truckdriver Train crew Train passengers Total Minor 0 2 4 6 None 1 0 6 7 Total 1 2 10 13

Factual Information 17 Highway Accident Report

Truck Information The truck consisted of a 1997 Peterbilt tractor and a 1992 Aspen semitrailer configured with a two-axle jeep, a three-axle low-boy semitrailer, and another two-axle jeep. (See figure 13.) The semitrailer was equipped with a hydraulic lift with a 13-horsepower motor. The tractor-combination vehicle was leased from Townsend Transportation in Buda, Texas. Figure 12. Postcollision view of locomotive. (Photograph source: Glendale, California, Police Department.) Table 2. Damages. Equipment Amount Locomotive and cars $610,000 Signal and crossing warning devices 13,950 Vehicle 150,000 - 200,000 Condenser 1,500,000 Total $2,273,950+

Factual Information 18 Highway Accident Report The tractor’s most recent Commercial Vehicle Safety Alliance inspection sticker was from the first quarter (January through March) 1997. Train Information The Metrolink train 901 consisted of a 1992 3,000 horsepower General Motors, Inc., locomotive 861 (F59PH) and Bombardier Transportation coach cars 160 and 155 and coach/cab car20 611. Truckdriver Information The 30-year-old truckdriver held a valid Class A Texas commercial driver’s license (CDL) with endorsements21 for double/triple trailers, tank vehicles, and hazardous materials and had no restrictions. His valid medical certificate was to expire May 5, 2001. The motor carrier’s driving history records of the driver indicated no traffic violations and one noninjury traffic collision in the previous 5 years. A check of the Commercial Driver’s License Information System (CDLIS)22 indicated a traffic violation in November 1986 and a traffic accident in April 1995 involving a commercial vehicle. According to the truckdriver’s driver qualification file, he was employed as a truckdriver in January 1994 by DAD’s Trucking in Baytown, Texas. He left DAD’s Figure 13. Schematic of truck. 20 A coach/cab car is a passenger coach equipped with an operating cab at one end. The train can be operated from this car for movement with the car at the front of the train. The power and braking for the car is controlled through wiring and piping running through the train back to the locomotive. 21 Under 49 Code of Federal Regulations (CFR) 383.93, the endorsements for a CDL include (1) double/triple trailers, (2) passenger vehicles, (3) tank vehicles, or (4) vehicles required to be placarded for hazardous materials. 22 The CDLIS is a computer pointer system that records traffic violations and collisions for people holding CDLs. The CDLIS is operated by the American Association of Motor Vehicle Administrators, which is a State and federally funded organization.

Factual Information 19 Highway Accident Report Trucking in April 1994, when the company had insufficient business to employ him. The truckdriver worked for Mercury from May 1994 until November 1996, when he returned to DAD’s Trucking until April 1997, after which he was reemployed by Mercury. The truckdriver had been subject to several random drug and alcohol tests while employed by Mercury. All test results were negative. A review of the truckdriver’s logbook for November and December 1999 indicated no violations of the hours-of-service rules. The truckdriver logged off duty on January 4 and 5, 2000, the 2 days before the accident trip began. He reported to work at 8:45 a.m. on January 6 in Houston. The truckdriver’s log did not indicate any invalid entries until January 26, when he logged off duty from 1:30 p.m. until 8:00 a.m. on January 27 in Quartzsite. A receipt for a repair on the tractor from Ramsey International (truck dealer and repair service) in Blythe was found in the tractor during the postaccident vehicle inspection. The receipt was stamped with the date “01/26/2000” and the time 10:58 p.m. Ramsey International was contacted to determine the time it would take to complete the repair: based on the labor charge ($105) and the time necessary to process in and out (assuming the truck was accepted immediately for repair), it would have taken from 2 to 2.5 hours. The distance from Quartzsite to Blythe is about 24 miles or between 20 and 25 minutes’ driving time. Calculations based on this information indicate that the truckdriver needed a minimum of 3 to 3.5 hours to accomplish the vehicle repair. Based on the time- out stamp of 10:58 p.m. on the repair receipt, the truckdriver should have logged time for the repair from about 8:00 p.m. to 11:30 p.m. This time was not recorded in the truckdriver’s logbook. According to the Mercury driver’s manual,23 drivers are to log “rest and meal stops as off duty since you are on duty just prior to the rest period and are required to properly secure your vehicle prior to your rest period,” which is permitted under Federal rules if the company provides written instructions to do so. Under 49 Code of Federal Regulations (CFR) 395.2, driving to a repair facility and waiting for the repair work is considered driving and on-duty time and should be recorded as such. No times were recorded in the truckdriver’s logbook after the 8:00 a.m. entry on January 27. The truckdriver should have recorded 10 hours of driving time when he arrived in Adelanto, logged off duty for 4 hours, and recorded an additional 9 hours of driving time from Adelanto to Glendale. At the time of the accident, the driver was at least 9 hours beyond his allotted 10-hour driving time24 and was in violation of the 15-hour rule25 by at least 4 hours, not including the fueling time in Adelanto. The truckdriver said that he had informed the new CHP escort of his hours-of- service status in Adelanto, but they directed him to drive anyway. He indicated that he believed that CHP was in charge of the trip (determining the correct routes and allowing 23 Mercury Transportation, Inc., Driver’s Manual, revised September 27, 1998. 24 Title 49 CFR 395.3 (a)(1). 25 Title 49 CFR 395.3 (a)(2).

Factual Information 20 Highway Accident Report him to continue to drive). He said that he had relied on CHP and the lead pilot car driver for directions because he was unfamiliar with the route. Pilot Car Drivers’ Information The lead pilot car driver at the time of the accident held a valid California Class C driver’s license (noncommercial) scheduled to expire on June 5, 2003, with a restriction for wearing corrective lenses. His driving history showed one moving traffic violation in March 1998 for following too closely. He told a Safety Board investigator26 that he owned Dick’s Pilot Car Service and had been in business since 1992. The lead pilot car driver had received Utah pilot car driver certification in 1998. He indicated he was a member of the California Professional Escort Car Association; California does not require pilot car driver certification. West Coast Services contacted him for this job when the pilot car driver from Doug’s Pilot Car Service, who had conducted the route survey, was unable to escort the load. He said that he was unfamiliar with the route. He indicated that he had received the California permits from West Coast Services on January 26, 2000, but did not receive any of the permit attachments, which contained the rules and regulations relating to that load movement. He did not check the permits for validity, but he reviewed them and created a master route list from the routes indicated on the permits. After the collision, he checked his notes and discovered that he had failed to record the turn from Grandview Avenue to San Fernando Road. He stated that he had been in contact with the truckdriver and the CHP officers via CB radio. He said that he thought the Los Angeles County curfew was 5:00 a.m. and the Los Angeles city curfew was 6:00 a.m. In addition, immediately after the accident, he told the Glendale police that he did not know of any requirement to notify the railroad when about to traverse a grade crossing. His Utah pilot car certification curriculum did not include railroad notification of low-clearance vehicle27 track crossings. California does not require railroad notification.28 The rear pilot car driver from L. P. Flag Car Company held a Commonwealth of Virginia escort vehicle operator certificate scheduled to expire on November 25, 2001. He escorted the vehicle from Houston into California. 26 A Safety Board investigator interviewed the pilot car driver on February 8, 2000. 27 Defined by the Uniform Vehicle Code as a vehicle with a vertical body or load clearance of less than ½-inch-per-foot of the distance between any two axles or less than 9 inches, measured above the level surface of the roadway. 28 Some States require notification of the railroad for permitted loads under certain conditions, such as low clearance. The Safety Board will discuss this issue at length in its forthcoming report on the November 17, 2000, Intercession City, Florida, highway-railroad accident investigation.

Factual Information 21 Highway Accident Report Motor Carrier Information Mercury was a for-hire interstate carrier specializing in hauling oversized equipment. The Houston company began operations in 1971 hauling oil field pipes and equipment. In 1982, it expanded to the carrying of oversized loads requiring specialized moving permits. It also hauls small amounts of class 3 (flammable) and class 8 (corrosive) hazardous materials. The owner estimated that about 60 percent of the company business is interstate and 40 percent intrastate commerce. The company operates 35 tractors, of which 10 are owned by the company and 25 are leased from owner-operators. Truckdrivers are assigned the same tractor daily. The company operates 36 semitrailers of different makes and models: 20 flatbed semitrailers, ranging in length from 42 to 53 feet; 5 double-drop semitrailers; 7 single trailers; and 4 heavy-haul trailers. All Mercury vehicles are subject to the Federal and State of Texas annual vehicle inspection requirements. Olympic International, Inc., in Houston conducts the annual inspection on the vehicles. This company employs one full-time mechanic, who has 12 years of truck mechanic experience and holds a CDL. All Mercury vehicles are serviced every 10,000 miles, which includes changing the oil and filters and inspecting the brakes and lights. Before the accident, the motor carrier’s most recent safety review by the Federal Motor Carrier Safety Administration took place on April 6, 1982, when the carrier received a satisfactory rating. Mercury employed 35 full-time truckdrivers, 10 contracted from National Personnel, Inc., of Dallas, Texas, and 25 long-term lease owner-operators. Due to the high cost of purchasing insurance and workman’s compensation and operating a full-time personnel office, according to the Mercury owner, the company contracts the truckdrivers. Mercury pays National Personnel, Inc., a fee-for-services company, which, in turn, pays the truckdrivers. Truckdrivers are interviewed and approved for hiring by Mercury. The Mercury driver’s manual includes the following hiring criteria: (1) be 25 years of age or older, (2) have at least 2 years of truck driving experience, (3) have personal transportation, (4) be physically able to handle pipe and other physically demanding loads, (5) live in the greater Houston area, and (6) be able to pass a U.S. Department of Transportation physical examination and drug screen. The hiring criteria do not include having had training in moving oversize/overweight loads. Mercury has no formal training program; the company provides truckdrivers with an employee safety handbook that was prepared by National Personnel, Inc. Mercury also provides truckdrivers with its driver’s manual detailing various driver responsibilities such as customer service, loading vehicles, measuring load and vehicle combinations, required trip and vehicle documentation, and other company policies. Truckdrivers are required to

Factual Information 22 Highway Accident Report attend safety training meetings and may receive with their paychecks safety memos that relate the experiences of Mercury truckdrivers and other company issues. The Mercury owner said that new truckdrivers are assigned to local deliveries with a driver-trainer for evaluation purposes. After completing an unspecified evaluation period, truckdrivers are placed on regular pickup and delivery routes. They are assigned to larger and heavier vehicles as their skill and experience increases. Currently, only two or three truckdrivers are permitted to operate the super loads, which the owner defined as those loads requiring pilot cars per the issuing agency’s specialized moving permit. Train Crew Information The engineer worked as a clerk for a freight railroad from 1979 to 1986, when she went to work for Amtrak in the clerical department. She transferred to the operating department as an assistant conductor in 1988, was promoted to conductor between 1988 and 1990, and transferred to engine service in 1990. For 2 years, she worked as a fireman/engineer trainee and since 1992 has operated trains as a locomotive engineer. The conductor worked as a brakeman/conductor for a freight railroad between 1973 and 1990. He has been employed by Amtrak as a conductor since 1991. Railroad Information The Southern California Regional Rail Authority is a rail commuter agency established by five counties in the Los Angeles basin: Los Angeles, Ventura, San Bernardino, Riverside, and Orange. It is controlled by a board composed of representatives from each county. The single agency was created to design, develop, and operate a commuter railroad that would service these counties. The Southern California Regional Rail Authority subcontracted railroad functions with Amtrak to provide qualified operating crews to operate the Metrolink commuter trains. This contract contains requirements to supervise these employees, as well as to maintain compliance with Federal regulations.29 The Metrolink train dispatching center in Glendale monitored the train movements. The train dispatcher controlled the territory through signal indications and switch positions known as centralized traffic control. Additional instructions were contained within the timetable, operating rules, general orders, track warrants, and special instructions. 29 Including Engineer Licensing, 49 CFR Part 240; Drug and Alcohol, 49 CFR Part 219; and Accident Reporting, 49 CFR Part 225.

Factual Information 23 Highway Accident Report The third edition of the General Code of Operating Rules, dated April 10, 1994, comprised the operating rules. Rule modifications or revisions to the General Code of Operating Rules were included in the Metrolink timetable, which had two applicable parts: the “System Special Instructions” provided general revisions, and the “Valley Subdivision” contained information specific to trains operating through the territory in which this accident occurred. Permanent track speeds for the trains were designated in the timetable, and temporary speed restrictions were issued in track bulletins30 by the train dispatcher. Accident Site Information Roadway Grandview Avenue is a five-lane, divided urban roadway. A 4-foot-wide concrete median island divides the northbound and southbound traffic lanes. The roadway surface is asphalt concrete. Postaccident inspection of the pavement markings revealed no irregularities, and the markings were in conformance with the Manual on Uniform Traffic Control Devices.31 The posted speed limit on Grandview Avenue is 25 mph. Glendale Police Department records indicate that from 1993 through 2000, 12 accidents occurred in the area bounded by Grandview Avenue and San Fernando Road and Grandview Avenue and Airway Street. These accidents resulted in 1 fatality and 10 injuries. The fatality occurred at the grade crossing on Grandview Avenue in 1998 and involved a pedestrian struck by a Metrolink train. Grade Crossing The grade crossing is designated as U.S. Department of Transportation 746796L. It consists of two parallel tracks 20 feet apart. The pavement at the grade crossing is concrete. The profile grade from the centerline of the grade crossing to the south edge of San Fernando Road and to the north edge of Airway Street is 3.26 percent and 3.02 percent, respectively. The last Federal Railroad Administration statistical report on the crossing before the accident was dated February 20, 1997, and indicated the average daily traffic count on Grandview Avenue was 5,900 vehicles, of which 15 percent were trucks. The daily train frequency was approximately 34 trains in both directions on both tracks. The area surrounding the crossing is light industrial. 30 Track bulletins are addressed to trains that operate through the dispatcher’s assigned territories. The track bulletins contain temporary speed restrictions, locations of men and equipment working, and safety hazards that may exist. 31 The manual is approved by the Federal Highway Administration as the standard for all streets and highways in accordance with 23 U.S. Code sections 109 (b), 109 (d), and 402 (a) and 23 CFR 1204.4.

Factual Information 24 Highway Accident Report The grade crossing was built sometime before 1929, when the city of Glendale acquired it from Los Angeles County, and was widened in 1962. At this time the applicable standards were in the American Association of State Highway Officials 1954 A Policy on Geometric Design of Street and Highways. The guidelines on railroad grade crossing alignments were 3 percent minimum (desirable) to 6 percent maximum. In 1990, the American Railroad Engineering Association guideline and the American Association of State Highway and Transportation Officials (AASHTO) standard for roadway vertical profiles at highway-railroad grade crossings changed to reflect the following: Acceptable geometrics necessary to prevent drivers of low-clearance vehicles from becoming caught on the tracks would provide the crossing surface at the same plane as the top of the rails for a distance of 2 ft. outside the rails. The surface of the highway should also not be more than 3 in. higher nor 6 in. lower than the top of the nearest rail at a point 30 ft. from the rail unless track superelevation dictates otherwise.32 In April 2001, the AASHTO revised its guidelines33 for roadway vertical profiles at railroad grade crossings, which state: In some instances, the roadway alignment may not meet acceptable geometrics for a given design speed because of restrictive topography or limitations of right-of- way. To prevent drivers of low-clearance vehicles from becoming caught on the tracks, the crossing surface should be at the same plane as the top of the rails for a distance of 0.6 meter (2 feet) outside the rails. The surface of the highway should also not be more than 75 millimeters (3 inches) higher or lower than the top of nearest rail at a point 9 meters (30 feet) from the rail unless track superelevation makes a different level appropriate…. Vertical curves should be used to traverse from the highway grade to a level plane at the elevation of the rails. Rails that are superelevated, or a roadway approach section that is not level, will necessitate a site-specific analysis for rail clearances. In addition, section 8B.14 of the 2000 edition of the Manual on Uniform Traffic Control Devices includes a new low-ground clearance warning highway-railroad grade crossing sign (W10-5), shown in figure 14, and provides the following guidance for its use: If the highway profile conditions are sufficiently abrupt to create a hang-up situation for long wheelbase vehicles or for trailers with low ground clearance, the Low-Ground Clearance Highway-Rail Grade Crossing (W10-5) sign should be installed in advance of the highway-rail grade crossing. Signals The grade crossing was equipped with a Safetran Systems Corporation grade crossing predictor model 3000D2 with two warning devices. In October 1997, the system was upgraded with grade crossing predictor 3000 “F” level software. Maintenance records 32 A Policy on Geometric Design of Streets and Highways, AASHTO, 1990, adopted as a Federal Highway Administration standard in April 1993 at 23 CFR 625.4. 33 A Policy on Geometric Design of Highway and Streets, Fourth Edition, AASHTO, 2001.

Factual Information 25 Highway Accident Report indicated that the signal equipment had been inspected once each calendar month as required by regulation.34 The records also indicated that no exceptions were taken to the operation of the crossing warning devices. The event recorder recorded the operation of the devices controlling the gates and lights at the time of the accident and noted no abnormalities. Track Both tracks, with an ascending grade of about 1 percent, were maintained to meet or exceed the standards for a class 5 track as described by the Federal Railroad Administration in 49 CFR Part 213. Although class 5 track allows freight trains to operate at 80 mph and passenger trains at 90 mph, other criteria in the signal regulations limited the maximum speed for passenger trains to 79 mph. The accident train speed was calculated from the time recorded by the recording device at the crossing, as passing at an average speed of 77 mph. Metrolink maintenance records indicate that the tracks were inspected twice weekly with at least 1 calendar day interval between inspections as required under 49 CFR 213. Toxicological Tests After the collision, the truckdriver voluntarily submitted to a drug and alcohol test administered by the Glendale Police Department. His test results were negative for drugs and alcohol. Under 49 CFR 219.201 (B), the train crew was not required to be tested, and they were not. Figure 14. Low-ground clearance warning highway-railroad grade crossing sign. 34 Title 49 CFR Part 234, “Grade Crossing Signal System Safety.” W10-5

Factual Information 26 Highway Accident Report Tests and Research Accident Crossing Warning Devices After the accident, the Safety Board conducted operational tests on the active crossing traffic control devices (signals, bells, lights, and gates) and found no abnormalities.35 The warning devices gave 20 seconds of warning before the train arrived. In addition, the railroad notification telephone number posted on the signal housing in the southwest corner of the crossing was dialed, and the notification party answered immediately. Other Grade Crossings on Permitted Route On June 13, 2001, Safety Board investigators drove the permitted route from the California-Arizona border to the accident site. On this route the convoy had traversed seven grade crossings,36 including the accident crossing. Investigators measured the percent grade for the approach and departure lanes at these crossings. (See table 3.) 35 The operating standards are found at 49 CFR 234.223, “Gate Arm,” and 49 CFR 234.22, “Activation of Warning System.” 36 Six of these grade crossings were active crossings with signals and gates. Table 3. Grade crossing information. Location and direction of travel U.S. Department of Transportation no. Grade percent on approach lane Grade percent on departure lane U.S. 95 northbound near Old Parker Road N/A +1.3 -0.5 State Route 62 westbound 027 031-C +0.33 -0.16 Double-track State Route 62 westbound first track second track 027 050-G +0.58 0.0 0.0 -0.5 San Fernando Road closed crossing (formerly an active crossing with gates) 746 033-A +0.17 -0.75 Polk Street from San Fernando Road, 12 miles from Grandview Avenue crossing VY 22.64 903 132-F +1.04 0.0 Grandview Avenue crossing (accident site), first time across 746 796-L +3.26 -3.02

Factual Information 27 Highway Accident Report Other Information Heavy Hauling Industry In the United States, heavy hauling vehicles, defined as having a gross vehicle weight greater than 80,000 pounds, represent less than 1 percent of the truck fleet.37 According to the U.S. Department of Commerce 1997 Vehicle Inventory and Use Survey, the heavy hauling fleet comprises more than 70,100 vehicles (45,200 tractor single-trailer combinations) that operate over 3.8 billion miles each year. Since 1992, the number of vehicles and miles traveled has increased by 40 and 52 percent, respectively. According to the Specialized Carriers and Rigging Association, 600 of its 1,100 members are in the business of heavy hauling. Permit Information Accident Trip. Mercury was required to obtain permits from four States to transport the load from the Toromont Process Systems plant in Houston to the Chevron refinery in El Segundo because the dimensions of the truck exceeded State size and weight limitations. Mercury arranged for the moving permits in Texas and New Mexico and hired Central Arizona Escort Service of Phoenix, Arizona, to obtain the permits in Arizona and West Coast Services of Monrovia, California, to obtain the permits in California. The issuing State agency and special requirements of the obtained permits are shown in table

1. The permits required from the 12 local government entities in California are shown in

table 5.

37 Economic Benefits of Uniformity in Oversize/Overweight Permitting. A study conducted for the Specialized Carriers and Rigging Association Foundation by Cambridge Systematics, Inc., Cambridge, Massachusetts, January 2000. Table 4. Accident trip State permits. State Issuing agency Special requirements Fee Texas Permit No. 10649002P Department of Transportation, Motor Carrier Division in Austin. Required two pilot cars and a route survey. Mercury had to certify, in writing, that the route was safe. Daylight only. $190 New Mexico Permit No. PSFO-3143 Department of Public Safety, Permit Office. Daylight only. $ 15 Arizona Permit No. 001-000126455 Department of Transportation, Maintenance Permits Service in Phoenix and Motor Vehicle Division in Goodyear. Required Arizona Highway Patrol escort in the Sierra Vista area. Daylight only. $100 California Permit No. 665503 Department of Transportation. Required two pilot cars and a route survey. Required CHP escort on all routes in California. $ 16

Factual Information 28 Highway Accident Report General Permit Requirements. More than 3 million permits per year, on average, are issued for oversize/overweight loads in the United States.38 California issued 181,000 permits for oversize/overweight loads in 2000.39 The Federal Highway Administration (FHWA) estimated annual super load40 movements to be 300 coast-to- coast and 700 to 1,100 regionally. A permit is a variance, granted by a State, county, or city agency having jurisdiction over a roadway, to a company that transports loads on those highways and Table 5. Accident trip local government permits in California. Local government Permit no. Restriction Fee San Bernardino County M19651 2:00 a.m. to 5:00 a.m. $ 16 Victorville 00-0032 $ 25 Adelanto TP 235 $ 30 Los Angeles County 6107202 Sunrise to sunset.a $316 Santa Clarita 064676 $200 Los Angeles OP.000656 12:00 a.m. to 6:00 a.m. $303 Burbank 3404 2:00 a.m. to 6:00 a.m. $ 16 Glendale No permit issued.b Huntington Park 4430 $ 15 Compton 00-23 $ 15 Hawthorne No permit issued.c El Segundo 7482 $ 15 a Sunset on January 27, 2000, was 5:19 p.m.; sunrise on January 28, 2000, was 6:54 a.m. Source: U.S. Naval Observatory Astronomical Applications Department Web site http://aa.usno.navy.mil/data/docs/rs-oneday.html. b Glendale requires that proof of insurance be on file with the city before issuing a moving permit. In addition, the city requires that a company representative come to the permit section and process the application. According to West Coast Services, proof of insurance was never sent by Mercury to the city, despite several notifications by West Coast Services to Mercury that one was needed. Glendale permit officials stated that proof of insurance was never received from Mercury. c Mercury had previously obtained an annual permit for other loads transported in Hawthorne; however, the size limits for the accident load exceeded those recorded on the annual permit. Therefore, the annual permit could not be used for the accident load. As a result, Mercury was required to apply for another permit. West Coast Services submitted a request for a permit; but, Hawthorne does not issue moving permits for loads in excess of 18 feet high and, therefore, did not issue a permit for the accident load. 38 Source: FHWA Web site http://www.ops.fhwa.dot.gov/freight/, February 12, 2001. 39 Source: telephone conversation with the Chief, Office of Truck Services, Division of Traffic Operations, California Department of Transportation, June 27, 2001. 40 Definition of super load varies among the States; in California, a vehicle with dimensions greater than 15 feet wide, 17 feet high, and 135 feet long is considered a super load.

Factual Information 29 Highway Accident Report roadways where the load or the vehicle exceeds State size or weight limitations or both. National guidance is found in the 1991 AASHTO Subcommittee on Highway Transport’s Guide for Maximum Dimensions and Weights of Motor Vehicles and for the Operation of Nondivisible Load Oversize and Overweight Vehicles. This document discusses the issuance of truck permits and restrictions and national defense. Permits can be issued either annually or for multiple or single trips. An annual permit is issued when the vehicle, load dimensions, or weight remain constant, as in the case of a mobile crane or vehicles and transported loads that do not exceed certain limitations. Vehicles or loads in this category receive permits without specified routes but are limited to those roadways designated as truck routes. Multiple- and single-trip permits are issued when a single load or a number of loads require permitting but are only in use for a limited time. A fee is commonly charged to issue the permit.41 The fee structure is different in each State, and the cost of a permit varies among jurisdictions. Mercury paid $15 to $316 for the permits involved in this accident load. (See tables 4 and 5.) Part of the permitting process is route selection. Either the company transporting the load or a private permit company selects the route(s) for permitted loads. Routes are selected by determining the size and weight of the vehicle or load, then reviewing highway maps, and finally calling on the company’s corporate knowledge of an area. Some State departments of transportation publish maps with bridge weight and clearance limitations; if they do not, the company consults with the State departments of transportation and local departments of public works or road departments. A number of Web sites provide routing and other permit information. The Texas Department of Transportation Web site42 has a list of roadway and time restrictions, escort vehicle requirements, and other permit conditions for several Western States.43 In addition, the Western Association of State Highway and Transportation Officials (WASHTO) publishes the Guide for Uniform Laws and Regulations Governing Truck Size and Weight Among the WASHTO States, which provides guidance to companies transporting extralegal44 loads among the Western States. To obtain certain permits, a route survey also may be required to observe potential safety problems along the proposed route, as was the case for the movement of the load involved in this accident. Route surveys, often required for super loads, are conducted by pilot car drivers in passenger vehicles (usually specially equipped pickup trucks) to determine the compatibility of the route with the size or weight of the vehicle and load and to identify potential hazards that should be avoided.45 Flexible poles projecting from the 41 The usual practice is to charge a flat fee for services regardless of the size or weight of the vehicle or load. 42 http://www.dot.state.tx.us/insdtdot/orgchart/mcd/permit/AppenC.htm. 43 Arizona, Colorado, Idaho, Montana, New Mexico, Oklahoma, Utah, Texas, and Washington. 44 Vehicle or load that is larger or heavier than State size and weight regulations.

Factual Information 30 Highway Accident Report top and sides of the survey vehicle are used to determine height and width limitations along the proposed routes. Once selected, a route is submitted to the jurisdiction in which the load will be traveling for review, approval, and permit issuance. Some jurisdictions require a signed certification that the selected route is suited and safe for the vehicle and load. Each governmental agency is to review the selected route that traverses its jurisdiction for compatibility with roadway geometry, bridge weight tolerances, and construction zones. Agency reviews vary: a smaller jurisdiction may have only one approved route, calling for minimal review; another jurisdiction may conduct a manual review, using printed maps and determining where current roadway work projects are being conducted; and a larger jurisdiction may have a computer database with designated oversize/overweight routes and roadway environment information. Load heights in excess of 15 feet generally require an agency to contact public utility and TV cable companies to ensure the load can clear lights, electrical wires, and phone lines and to determine the presence of work projects. The permit process requires sufficient lead time for an agency to complete its review, which may take as long as several weeks prior to the move. In addition to routing, proof of insurance is sometimes required by the issuing jurisdiction. A vehicle is required to remain on the approved roadway(s) unless it encounters an obstacle that would prohibit further movement, such as a low-clearance bridge. If alternate routes are necessary, approval must be obtained from the issuing agency before further vehicle movement.46 If the movement cannot be accomplished within the permitting dates, the permit expires, the movement must stop, and a new permit or extension must be issued. Violations of the terms and conditions of the permit, including routing violations, can result in fines. In some States, such as California, the department of motor vehicles and the department of transportation track permit violations. Accumulation of violations can result in the State refusing to issue special moving permits to the violating company. California Department of Transportation Permits are processed in the Caltrans Office of Truck Services, which has 56 employees, including managers. In the year 2000, the Office of Truck Services processed 181,000 permits (672 permits daily). In 1999, after two accidents involving permitted loads (see “Other Accidents” section of this report for further information) and State legislative hearings, Caltrans instituted changes to its permitting process. The Office of Truck Services hired additional permit writers and district truck service managers and is in the process of acquiring an automated permitting system, Transportation Permits Management System, which it 45 A general practice is that the person conducting the route survey will be the lead pilot car driver during the movement of the load. 46 Exceptions are made for emergent circumstances such as a traffic accident on the route resulting in law enforcement directing the vehicle to take a temporary alternate route or detour. In such cases, the vehicle must return to the approved route as soon as possible.

Factual Information 31 Highway Accident Report expects to be on line by October 2002. It began the process of verification of vertical clearances in December 1999 and in July 2000 completed measuring 6,500 State highway bridges. By June 2001, it had updated 94 percent of the bridge clearances in the State route-clearing database. (See appendix C for the Office of Truck Services summary of major improvements.) As part of its evaluation of the permitting process, the Caltrans Office of Truck Services studied 45 incidents of oversize/overweight loads striking bridge structures that occurred from January 2000 through May 2001. Caltrans found the primary cause of 15 (33 percent) of these incidents was the hauler being off route, the primary cause of 9 (20 percent) of these incidents was the load being higher than permitted, and the primary cause of 6 (13 percent) of these incidents was permit errors. Permit Companies In this accident, the process of obtaining permits to transport the oversize/overweight loads involved 4 State and 12 local jurisdictions. Permit companies, such as West Coast Services, the company employed by Mercury to obtain the California permits, provide this service. Some companies also provide computerized routing and mapping services for the transportation of oversize/overweight loads. These companies offer detailed maps of the routes best suited for the load transported, including roadway height and width clearance conditions, bridge weight tolerances, axle weight limits, speed limits, and estimated travel times. Pilot Car Information Five pilot car companies were involved in the movement of this oversize load: • Happy’s Pilot Car Service provided one escort vehicle in Texas only. • L. P. Flag Car Company escorted the vehicle from Houston into California and was the trailing pilot car at the time of the collision. • Billy’s Pilot Car Company provided one escort vehicle with two drivers from the New Mexico-Arizona border to the Arizona-California border. One driver traveled part of the route and was relieved by another driver, who escorted the load to the California border. • Doug’s Pilot Car Service (hired by West Coast Services) conducted the route survey for the California permits but did not escort the load en route. • Dick’s Pilot Car Service (hired by West Coast Services) escorted the vehicle from the Arizona-California border to the accident site. Pilot Car Industry According to the Specialized Carriers and Rigging Association’s Oversize/Overweight Permit Manual, all States require pilot cars for loads of a certain size and have equipment requirements for pilot cars, such as the type of lights, size and color of signs and flags, type of two-way communication between pilot car and transport

Factual Information 32 Highway Accident Report vehicle, and height and type of pole.47 The requirement parameters vary from State to State. The pilot car industry estimates that there are between 2,000 and 3,000 pilot car (escort vehicle) operators in the United States.48 Three regional professional organizations represent the pilot car industry: the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association (includes Washington, Oregon, and Idaho). These three associations represent about 200 independent pilot car owner/operators. WASHTO publishes a model policy for pilot car drivers and equipment in its Guide for Uniform Laws and Regulations Governing Truck Size and Weight Among the WASHTO States. No national standards, policies, or professional organizations exist that cover pilot car driver training, qualification, or equipment issues. State equipment requirements are not consistent among States, for example: • One State permits the use of a flashing yellow strobe light; another State has made the use of this type of light illegal. • One State requires the presence of a single 10-pound BC fire extinguisher; another State requires two 5-pound BC fire extinguishers.49 • One State requires that an OVERSIZE sign be on the vehicle bumper; another State has made the use of such a sign illegal because it covers the vehicle license plate. • Some States require that a pilot car driver possess a handheld STOP and SLOW sign, but prohibit its use for traffic control. Pilot Car Driver Certification Programs Nine States (Arizona, Colorado, Florida, Kansas, New Mexico, New York, Oklahoma, Utah, Virginia, and Washington) require pilot car certification.50 Arizona and New Mexico do not have certification programs. Pilot car operators domiciled in New Mexico must register with the Public Regulatory Commission. Indiana and North Carolina are considering establishing pilot car driver certification programs. 47 Oversize/Overweight Permit Manual, Specialized Carriers and Rigging Association, Fairfax, Virginia, September 2000. 48 Safety Board investigators interviewed representatives of the pilot car industry at the WASHTO 13th Annual Oversize/Overweight Transportation Symposium, San Antonio, Texas, March 10 and 11, 2000. 49 The A, B, and C ratings were established by the Underwriters Laboratories and the National Fire Protection Agency. The letters refer to the type of fire the extinguisher is designed to extinguish: A = trash, paper, and wood; B = liquids and grease (petroleum products such as gasoline); and C = electrical. 50 Certification in this context means completion of a course or passing a test or both. Certification programs include courses and test administration.

Factual Information 33 Highway Accident Report Drivers who meet the certification requirements are issued a certification card and entered into a registry. (See table 6 for the certification requirements of the existing eight programs.) In those States that have a certification program, no one may operate a pilot car without having first been certified, including pilot car drivers from other States. The States that have a certification program usually grant reciprocity to other State certifications. The Colorado, New York, Virginia, and Utah pilot car certification manuals 51 and the WASHTO policy manual52 include material on the following topics: vehicle and Table 6. Requirements of States with pilot car driver certification programs. State Requirements Test administration Colorado Test and evidence of completing defensive driving course or valid CDL, certificate of commercial insurance, and 5-year driving record. Colorado honors Virginia, Florida, and Utah certification. Test administered by Colorado Department of Transportation Transport Permit Office for $5 fee; certification good for 5 years. Florida Completion of 8-hour defensive driving class and 8-hour pilot/escort driving class. Test administered by University of Florida Transportation Safety Transfer Center. Kansas Evidence of completing a National Safety Council-approved defensive driving course or valid CDL. Not available. New York Test of State manual. Test administered by Department of Motor Vehicles for $40 fee. Oklahoma Completion of 8-hour course on State manual. Test administered by Oklahoma State University; cost to applicant $90. State currently in final negotiations with university for record maintenance and access. Utah Completion of 8-hour course on escort driver manual and test. Test administered by Utah Valley Community College; cost to applicant $120. College maintains records and issues certification cards. Virginia Test of State escort driver manual. Test administered by Virginia Commonwealth University. No cost to in-State applicant; cost to out-of-State applicant $30. Renewals free. Washington Completion of 8-hour course and test based on WASHTO guidelines. Test administered by Evergreen Safety Council for $145 fee. 51 Rules and Regulations of the State of Colorado Department of Transportation Pertaining to Transport Permits for the Movement of Extra-Legal Loads, amended July 30, 1999; New York State Certified Escort Manual; Virginia Escort Driver’s Manual, “Hauling Permit” section, Department of Transportation, Commonwealth of Virginia; and Pilot/Escort Driver Training Manual, Utah Valley State College, Orem, Utah, 1996. 52 Guide for Uniform Laws and Regulations Governing Truck Size & Weight Among the WASHTO States, adopted by WASHTO Policy Committee July 30, 1997.

Factual Information 34 Highway Accident Report personal equipment requirements; pretrip preparation, including route reviews and testing of car-to-car communications; proper use of lights; flagging procedures; traffic flow and control; reducing traffic buildup behind the load; driving on narrow roadways and bridges; passing other vehicles; driving maneuvering and techniques; railroad crossings; legal limitations and responsibilities; reporting traffic accidents; escort vehicle placement; and evaluation of roadway hazards. The training curriculums do not include procedures for conducting a route survey or for notifying railroads of low-clearance vehicle crossings. The Utah manual cites several advantages of a certification program: uniformity among pilot car vehicles and drivers, safer pilot vehicle operations, consistency in enforcement, accountability, permanent records of pilot car services, trained pilot car drivers for traffic control, reciprocity with other certifying States, better communication between pilot vehicles and transport vehicles, licensing standards for pilot vehicle operators, and reduction of traffic accidents. Virginia started its certification program in the late 1970s and has certified approximately 6,000 pilot car drivers, of which about 80 percent have been out-of-State. The program began after the Virginia Highway and Transportation Research Council conducted a study on the movement of 14-foot-wide manufactured housing units. The study found that “substandard escort vehicle operations were commonplace . . . especially on two-lane highways.” It also noted: A wide variation in their [escort] operations was observed. Some of the escorts stayed in constant communications with the load, warning the driver of the load of oncoming traffic and obstructions, and working effectively to enhance safety during lane changes and turns made by the load. These escorts were in the minority, as most of the escorts performed no function other than to display a warning sign. At the other extreme, the driver of an escort vehicle was observed to be so intent on protecting the load that often he would encroach into the opposing traffic lane and force vehicles off the road to ensure the safety of the load. Pilot Car and Police Escort Responsibilities In Safety Board interviews with pilot car organization representatives,53 a concern was raised about truckdriver and police reliance on the pilot car driver to ensure that the correct route is followed. In the Glendale accident, the CHP officers escorting the vehicle/load indicated they were not familiar with the routing in the Los Angeles metropolitan area and relied on the lead pilot car driver for directions. The organization representatives stated that the primary purpose of the pilot car operator is not to ensure that the vehicle/load is on the correct route, although being on the correct route is factored into the operation, but to provide advance warning whenever route hazards, such as a bridge with inadequate clearance or a raised grade crossing that the load cannot traverse, are present. This concept is stated in the training material provided by States that have pilot car driver certification programs. 53 WASHTO 13th Annual Oversize/Overweight Transportation Symposium, San Antonio, Texas, March 10 and 11, 2000.

Factual Information 35 Highway Accident Report California Highway Patrol Due to the size of the condenser unit, especially its height, the Caltrans permit office contacted CHP team leader 1 to arrange a CHP escort. CHP team leader 1 contacted Mercury directly and negotiated a contract, dated January 21, 2000, for CHP services. The contract called for two CHP officers from the Blythe office, working overtime on their scheduled days off, to escort the vehicle from the California-Arizona border to Adelanto and for three CHP officers, including CHP team leader 2, from the Inland Division, to escort the vehicle from Adelanto to El Segundo. CHP team leader 1 coordinated his efforts with CHP team leader 2. Team leader 1 said that he arranged between 35 and 40 escort contracts per year in the Blythe area. Team leader 2 indicated that he arranged between 120 and 150 escort contracts per year in the Inland Division area. According to the team leaders, the number of escorts per vehicle is determined on a case-by-case basis, depending on the size of the load, designated route, anticipated traffic conditions, estimated average speed, and permitted times for movement. Escort officers are drawn from a pool of officers who have signed up for the overtime work. (See appendix D for CHP teams 1 and 2 escort officers’ on-duty time for the 3 days before the accident.) The officers involved with the Glendale accident load had previous experience in escorting permit loads. At the time of the Glendale accident, the CHP had no specific policies or training for escorting oversized and super loads. According to the CHP, the traffic control activities involved in escorting these types of loads are covered in the officer’s basic and on-the-job training. CHP officers told Safety Board investigators54 that the general procedure was for the two leading CHP units to go before the load into intersections and other places where traffic control was required and ensure that the vehicle could continue safely, by stopping traffic if necessary. The placement of vehicles in the convoy for the California segment of the trip was (1) the lead pilot car (Dick’s Pilot Car Service), (2) two CHP units, (3) the truck with the load, (4) one CHP unit, and (5) the trailing pilot car (L.P. Pilot Car Service). In its Management Memorandum (96-145), dated September 3, 1996, the CHP published a chart of size, weight, and speeds for vehicles and loads that require Caltrans to notify the CHP. The CHP has guidelines for the movement of oversize loads and vehicles and for determining when and how many CHP escorts are required. The appropriate CHP area permit coordinator is responsible for contracting with the transporting company for any CHP escorts that may be necessary. Included in the Management Memorandum are requirements for the CHP to inspect the vehicle and load before its movement in California. The policy reads as follows: As a general rule, a NAS [North American Standard] Level 1 inspection 55 will be required on the transporting vehicle(s) of each load escorted by CHP personnel. An exception to this policy should be vehicle(s) displaying a current Commercial Vehicle Safety Alliance sticker(s). However, all unstickered vehicles within the 54 Interviews conducted on February 29, 2000.

Factual Information 36 Highway Accident Report combination and any stickered vehicles displaying obvious violations shall be inspected. Inspected vehicle(s) that qualify shall be issued a sticker(s). The CHP officers in team 1 did not conduct a level 1 inspection of the vehicle or measure the vehicle and load for compliance with the terms and conditions of the permit at the California-Arizona border. The CHP officers in team 2 escorting the load from Adelanto did not review the truckdriver’s logbook for hours of service or measure the vehicle and load for compliance. The CHP Commercial Enforcement Manual 82.6 provides the department’s policies and guidelines “to personnel involved in the commercial enforcement program and to serve as a repository for Department interpretations relating to commercial vehicle enforcement.”56 Chapter 8 of the manual covers size and weight and, under the “Transportation Permits” section, states: Operation of a vehicle on city or county roadways without a required permit is a violation of size and weight statute limitations. A vehicle shall not be permitted to proceed if it is in violation of the conditions of the permit, is not on the route specified in the permit, and/or the size or weight of the vehicle and/or load exceeds the limitations prescribed on the permit by the amounts indicated below. The manual also covers the following topics: procedures for contracting for CHP escort services, equipment and placement of pilot cars, and permit documentation. One provision of the manual is that a commercial vehicle enforcement officer may be included in the escort team. The CHP officers involved in the accident indicated that this provision was normal practice and that most of the CHP officers escorting the accident load were in commercial vehicle enforcement. CHP officers are authorized to direct the vehicle and load to alter the permitted route if the officers have knowledge that the route, or a structure on the route, will not accommodate the vehicle and load. When such circumstances occur, CHP officers are required to notify Caltrans by department report form. CHP team leaders 1 and 2 told Safety Board investigators that “when they are escorting a permit vehicle and load, they are the person-in-charge of the overall safety of the movement.” In March 2001, chapter 8 of the manual was revised, changing the policy concerning escorting variance (oversize/overweight) loads. The policy now obliges the variance load57 coordinator to “obtain a copy of the proposed route survey and compare it 55 An inspection that includes the examination of the driver’s license and medical examiner’s certificate and waiver, if applicable; alcohol and drugs; the driver’s record-of-duty status, as required, and hours of service; the seat belt; the vehicle inspection report; the brake system; the coupling devices; the exhaust system; the frame fuel system; the turn signals; the brake, tail, and head lamps; the lamps on projecting loads; safe loading; the steering mechanism; the suspension; the tires; the van and open-top trailer bodies; the wheels and rims; the windshield wipers; the emergency exits for buses; and hazardous materials requirements, as applicable. Hazardous materials-required inspection items will be inspected by certified hazardous materials inspectors. 56 Forward to the California Highway Patrol Commercial Enforcement Manual 82.6. 57 Another term for super load.

Factual Information 37 Highway Accident Report with the permits and review all permits for accuracy.” The policy also requires that a safety briefing be conducted with all escort drivers, in which “all parties shall be informed that the CHP is in charge of the escort.” In addition, the policy states: If a route listed on a permit cannot be traversed or the escort gets off route for any reason, the OIC [officer-in-charge] shall stop the variance load escort at a safe location to park the variance load. The load shall not proceed until an alternate route can be obtained from the appropriate permitting agency. Other Accidents Involving Permitted Loads The Safety Board has investigated 6 accidents and is aware of 12 others since March 1999 involving oversize/overweight loads.58 (See table 7.) In addition, the Safety Board has investigated four accidents involving a low-clearance vehicle lodged on a railroad crossing, in which the truckdriver was trying to raise the semitrailer with hydraulic lifts, when the vehicle was struck by a train. (See table 8.)

58 Pilot cars were escorting the loads in five accidents, two of which had police escorts. Table 7. Oversize/overweight load accidents. Date Location Description Injuries and damages March 16, 1999 Ellisville, Florida Excavator hit overpass. $70,000 to overpass. June 8, 1999a Arbutus, Maryland Improperly loaded excavator hit pedestrian bridge. One fatality and three serious injuries. Bridge collapse. June 1999 Philadelphia, Pennsylvania Oversize rock screener hit railroad bridge. One fatality. September 1999b Virginia On two-lane road, cement truck met two mobile homes escorted by three pilot cars in 1,500-foot-long convoy. Truck lost control and hit passenger car that was following convoy. Rear pilot car of three-vehicle convoy was stopped in right travel lane watching an overheight load travel under bridge when pilot car was struck by another vehicle traveling in right lane. One fatality. One fatality. September 28, 1999 Wissahickon, Pennsylvania Unknown overheight load hit overpass. Overpass structural damage. July 16, 1999c Los Angeles, California Overheight vehicle hit freeway bridge. Permit was for 15 feet; permitted route under 14-foot 10-inch bridge. One fatality. November 11, 1999 Philadelphia, Pennsylvania Oversize container hit overpass. $1 million to overpass. December 14, 1999 Cherry Hill, New Jersey Raised dump truck body hit pedestrian overpass. Bridge collapse.

Factual Information 38 Highway Accident Report February 1, 2000d San Diego, California First of two overheight loads escorted by four pilot cars and four CHP units hit bridge. Convoy was off route; truckdriver did not hear warning from pilot car with height pole. Concrete support beam damage on overpass substructure. April 10, 2000 Iowa Two separate collisions with railroad bridge. $100,000 to bridge. June 8, 2000e Lexington, North Carolina Oversized 14-foot 4-inch combuster on permitted route hit 14-foot 2-inch clearance bridge. $75,000 to bridge. July 17, 2000 Newport, Delaware Overheight super load hit overpass. $229,339 to bridge. September 28, 2000 Miami, Oklahoma Steel boat mold hit railroad bridge, was knocked off semitrailer, and landed on passenger car. One fatality. November 17, 2000f Intercession City, Florida Truck and semitrailer, carrying 82-ton condenser tube slowly crossing private railroad grade crossing, was struck by Amtrak train. Florida requires permit from railroad before traversing grade crossing. No permit was obtained. Load escorted by three pilot cars. The Florida-certified pilot car driver did not know that railroad was required to be notified before crossing. $150,000 to truck and train. December 23, 2000g Sumner, Washington Truck towing house stopped on tracks to adjust tow dollies when struck by Amtrak train. Washington requires that permit be obtained from railroad to cross tracks. No permit was obtained. (Driver blood alcohol was 0.04 percent.) Load escorted by pilot car and three uniformed, off-duty county police officers. House destroyed. July 11, 2001h Farmington, Maine Oversized 14-foot 17-inch load hit 14- foot 2-inch clearance bridge. Truck had no permit required for loads over 13 feet 6 inches. $50,000 to overpass. October 15, 2001i Durham, North Carolina Tractor-semitrailer transporting crane struck overpass and caused leak in gas pipeline. $100,000 to overpass. $100,000 to pipeline. $200,000 to truck and crane. a NTSB Docket No. HWY-99-FH022. b Two oversize load crash case studies, Virginia Crash Investigation Team, Virginia Commonwealth University, Report No. 186, September 1999. c California Highway Patrol Collision Report No. 9907-302. d California Highway Patrol Collision Report No. unknown. e NTSB Docket No. HWY-00-IH040. f NTSB Docket No. HWY-01-FH007. g NTSB Docket No. HWY-01-IH013. h NTSB Docket No. HWY-01-IH031. i NTSB Docket No. HWY-02-IH005. Table 7. Oversize/overweight load accidents. (Continued)

Factual Information 39 Highway Accident Report Accident Statistics Because most State accident reporting systems do not require permitting information, the frequency of accidents nationwide involving permitted loads cannot be determined. The Maine Department of Transportation (Maine is one of the few States that has a permitted oversize load accident database59) reports that from 1995 through 2000, 232 accidents involved permitted vehicles. During that period, 8,257 accidents occurred that involved commercial vehicles. The Safety Board also examined data from the Trucks Involved in Fatal Accidents Database.60 From 1991 to 1997, an estimated 32,593 trucks were involved in fatal accidents. Of those trucks, 2.86 percent weighed between 80,001 and 120,000 pounds and less than 1 percent weighed more than 120,000 pounds; 13 percent and less than 1 percent of the trucks, respectively, were more than 65 feet long and 14 feet wide. In addition, the Safety Board examined the Federal Railroad Administration Highway-Rail Grade Crossing Accident/Incident Database. In the year 2000, 3,502 highway-rail grade crossing incidents occurred, resulting in 425 fatalities and 1,219 injuries to highway vehicle occupants and railroad employees and passengers.61 Approximately 24 percent of the highway-railroad grade crossing incidents involved trucks or truck tractors. About 73 percent of the trucks and truck tractors were moving over the crossing at the time of the accident; the other trucks and truck tractors were stalled, stopped, or trapped on the tracks. Table 8. Safety Board investigations involving low-clearance vehicles lodged on railroad tracks. Date and location Description August 25, 1983 Rowland, North Carolina Lowboy with 7-inch clearance. Driver tried to raise semitrailer for 5 to 10 minutes before arrival of train. November 30, 1983 Citra, Florida Lowboy with 9 1/2-inch clearance. Driver tried to raise semitrailer for 15 minutes before arrival of train. November 30, 1993 Intercession City, Florida Cargo bed with 6- to 8-inch clearance; 184-foot long transport vehicle. Driver trying to raise semitrailer when train arrived. October 3, 1995 Milford, Connecticut Vehicle clearance not available. Driver tried to raise semitrailer for 3 to 4 minutes before train arrived. 59 Maine Department of Transportation, Bureau of Planning, Safety Management. 60 Maintained by the University of Michigan Transportation Research Institute. 61 Any impact between a railroad and highway user (both motor vehicles and other users of the crossing as a designated crossing site, including walkways and sidewalks associated with the crossing). Reported on form FRA F 6180.57.

Factual Information 40 Highway Accident Report The Highway-Rail Grade Crossing Accident/Incident Database does not contain information on the weight, length, or width of the truck involved in the Glendale accident. The Safety Board examined the 1991 through 1997 data in the Trucks Involved in Fatal Accidents Database to identify the number of oversized trucks involved in fatal highway- railroad grade crossing accidents. Of the trucks involved in accidents at railroad crossings, 5 percent had a gross combination weight of more than 80,000 pounds, about 6 percent were longer than 65 feet, and none were wider than 14 feet.

41 Highway Accident Report Analysis General Although the oversize/overweight or heavy-haul trucking fleet is growing, it is a small segment of the trucking industry. Vehicles that haul oversize/overweight or permitted loads constitute less than 1 percent of the Nation’s trucking fleet. The limited accident data indicate that vehicles hauling permitted loads are not over represented in accident statistics. However, even though accidents involving oversize/overweight vehicles and loads are infrequent, this accident and others investigated by the Safety Board demonstrate that when they occur, such accidents can cause extensive damage to the infrastructure and, particularly at railroad-highway grade crossings, have the potential for catastrophic consequences. In the following analysis, the Safety Board will exclude those factors that did not cause or contribute to the accident, identify those factors that led to the accident scenario, and determine which factors were contributory. Discussion will focus specifically on the actions of the truckdriver, pilot car drivers, and police escorts and on weaknesses in the planning, coordination, and execution of this oversize/overweight movement. Finally, the analysis will consider measures that can be taken to prevent similar accidents in the future. Exclusions The highway-railroad grade crossing pavement markings, signs, signals, and gates operated as they were intended. Postaccident mechanical inspections of the train revealed no defects or deficiencies. The truckdriver’s postaccident toxicological tests were negative for alcohol and drugs. The Glendale police witnessed the accident and radioed the dispatcher, and the fire department responded within 5 minutes of notification. Although the initial radio dispatch location was 1/4 mile north of the actual accident site and the initial responders had difficulty gaining access to the accident site, these problems did not significantly impact the timeliness or effectiveness of the emergency response. The Safety Board concludes that neither the design nor the operation of the active railroad grade crossing warning devices nor the mechanical condition of the train contributed to the cause of the accident; the emergency response was adequate and timely. The Metrolink commuter train 901 engineer applied the brakes when she determined the truck was not moving. Following the collision, the engineer realized that

Analysis 42 Highway Accident Report the truck’s trailer was obstructing the adjacent southbound track and radioed an emergency message for the approaching southbound commuter train 100 to stop. The other engineer received the instruction and stopped his train 50 feet from the obstruction. The Safety Board concludes that the alert actions of the train engineer in warning the southbound commuter train engineer of the track obstruction prevented a second collision. The Accident Preparation and Planning The accident scenario began when the oversize/overweight permitted load, escorted by two pilot cars and three CHP escorts, missed a turn from Grandview Avenue onto San Fernando Road. As a result of this mistake, the convoy continued straight on Grandview Avenue and across the grade crossing. The mistake occurred because the lead pilot car driver failed to include the San Fernando Road turn when transcribing route directions onto a notepad. The convoy drivers did not discover the error until they realized that Grandview Avenue ended beyond the crossing. The lead pilot car driver was contracted to escort the accident load and received the permits 1 day before he met the convoy at the California-Arizona border. He did not have a copy of the route survey, had not previously driven the intended route, and had not met with the CHP, the truckdriver, or the rear pilot car driver prior to the morning of the movement. The lead pilot car driver had been given 1 State and 12 different local California permits, but not their attachments, which contained some rules and regulations relating to the load. From these permits, he had to transcribe route directions to create a master route plan for the move, which he did on his notepad. Although he discussed the route with the truckdriver, CHP escorts, and rear pilot car driver, he did not provide them with a copy of the master route plan. Because a master route plan had not been prepared in advance, because the driver had not driven the intended route prior to the movement, and because a master route plan had not been provided to the others in the convoy, they missed the opportunity both to identify the transcription error at the onset of the movement and to recognize the error once on Grandview Avenue. The Safety Board concludes that poor preparation and planning for the movement of the oversize/overweight load resulted in the convoy crossing the Grandview Avenue highway-railroad grade crossing instead of turning onto San Fernando Road. Grade Crossing Hazard Awareness After the convoy had failed to make the correct turn onto San Fernando Road and the truck had traversed the railroad tracks at the accident site, both the CHP officer-in- charge and the trailing pilot car driver heard the truck bottom out but did not tell the truckdriver. When the convoy drivers realized they were off route after crossing the tracks, they consulted a map to determine how to get back on route, but did not discuss the safety

Analysis 43 Highway Accident Report of going back across the tracks. When attempting to cross the tracks the second time, the convoy had to wait for an eastbound Metrolink train to pass before it could proceed, but no one thought, or apparently knew, to call the railroad to determine the train schedule or to notify the railroad that the load was crossing the tracks. The truckdriver attempted to raise the semitrailer only after it became lodged on the tracks. Even without becoming “hung up” on the tracks, the truck posed a significant risk at any highway-railroad grade crossing. Regulations at 49 CFR 234.225 require that warning systems at active crossings provide a minimum of 20 seconds’ warning. However, according to Safety Board calculations, after the eastbound Metrolink train passed, the accident truck, because of its size, would have needed more than 26 seconds to completely clear the tracks. Following the accident, the convoy participants did not indicate that they considered the potential hazards of crossing the tracks with the oversize/overweight accident vehicle, even though it was during the morning commuter train rush. Nor did they consider that the accident vehicle might become stuck on the crossing. Yet the convoy was given two cues about the potential hazard before the accident—the scraping of the truck the first time over the tracks and the passing eastbound Metrolink train. Therefore, the Safety Board concludes that had the truckdriver, pilot car drivers, or police escorts recognized the potential hazard created by the oversize/overweight vehicle crossing the tracks, they could have taken appropriate action and avoided this accident. Low-Clearance Warning Grade Crossing Sign According to the 2001 AASHTO guidelines, the roadway surface should not be more than 3 inches higher or lower than the top of the nearest rail at a point 30 feet from the rail. Three inches higher or lower at a point 30 feet from the rail translates to a positive or negative 0.83 percent grade. The approach and departure grades at the Grandview Avenue crossing were 3.26 and -3.02 percent, respectively. (See figure 15.) Therefore, in accordance with the current American Railroad Engineering Association guidelines and the AASHTO guidelines for roadway vertical profiles at highway-railroad grade crossings, the Grandview Avenue grade crossing was a high-profile or humped crossing. The Safety Board identified the hazards created by the combination of high-profile grade crossing and low-ground clearance vehicles during its investigation of the highway- railroad grade crossing collision near Sycamore, South Carolina, on May 2, 1995.62 As a result of its investigation, the Safety Board recommended that the Federal Highway Administration: H-96-05 Adopt the proposed changes that are published in the notice of proposed amendments to the Manual on Uniform Traffic Control Devices regarding warning signs for substandard vertical profiles at railroad grade crossings. 62 National Transportation Safety Board, Highway/Rail Grade Crossing Collision Near Sycamore, South Carolina, May 2, 1995, Highway Accident Report NTSB/HAR-96/01 (Washington, DC: NTSB, 1996).

Analysis 44 Highway Accident Report On September 5, 1997, the FHWA advised the Safety Board that it had adopted the low-ground clearance warning highway-railroad grade crossing sign (W10-5). This sign, which has been incorporated into the Manual on Uniform Traffic Control Devices, is specifically designed to warn drivers of highway profile conditions sufficiently abrupt to create a “hang-up” situation for long wheelbase vehicles or low-ground clearance trailers. Subsequently, on January 2, 1998, the Board classified Safety Recommendation H-96-05 “Closed—Acceptable Action.” The evidence does not indicate that before the Glendale accident, the truckdriver, pilot car drivers, or police escorts considered or were aware of the potential hazard created by the combination of the accident truck and the crossing profile. Not until after the accident truck was stuck did the truckdriver make any effort to raise the ground clearance of the vehicle, and by then it was too late. The situation that occurred in this accident is exactly what the low-ground clearance warning sign is intended to prevent. Therefore, the Safety Board concludes that had low-ground clearance warning signs been present at the Glendale crossing, the information conveyed by the signs may have alerted the truckdriver, pilot car drivers, or police escorts to the low-clearance hazard and may have prevented the accident. Although overall traffic volume on Grandview Avenue is comparatively low (5,900 vehicles), a high proportion of that volume (15 percent) is truck traffic.63 The area surrounding the crossing is light industrial, and, therefore, the potential for other low- ground clearance trucks to travel over the Grandview Avenue crossing remains. The Figure 15. Diagram of Grandview Avenue grade crossing alignment. 63 Federal Railroad Administration statistical report of February 1997. Airway Street San Fernando Road 20 feet 30 feet 30 feet Existing Alignment 3.26% AASHTO 0.83% AASHTO 0.83% Tracks 2 2 3.02%

Analysis 45 Highway Accident Report Safety Board believes that the city of Glendale should install low-clearance highway- railroad grade crossing signs (W10-5s) at the Grandview Avenue crossing and evaluate other crossings to determine whether the signs are warranted and, if so, install them. Fatigue The errors by the pilot car drivers and truckdriver discussed above may have been errors of judgment or flawed decision-making that were possibly caused or aggravated by fatigue. The lead pilot car driver had been driving and on duty for 24, and awake for 27, consecutive hours; the truckdriver and second pilot car driver had been driving and on duty for 19, and awake for 22, consecutive hours. Research has shown that performance becomes impaired with extended periods of sleep loss and can result in slowed reaction times, reduced vigilance, cognitive slowing, and memory problems, among other performance effects. As little as 2 hours of sleep loss on just one night can impair performance and levels of alertness.64 Furthermore, this accident occurred at 5:56 a.m. Performance impairments are greatest during the “trough” or low point, generally from 3:00 a.m. to 5:00 a.m., of the circadian rhythm,65 and some functions decrease from 12:00 a.m. to 6:00 a.m. Therefore, the Safety Board concludes that the judgment and vigilance of the pilot car drivers and the truckdriver may have been affected by a lack of sleep. Oversize/Overweight Vehicle Movements To determine how and why this accident happened, the Safety Board also examined the events preceding the accident. This examination revealed that the same types of problems that culminated in the Glendale collision were prevalent throughout the movement preceding it. Among them were numerous errors, planning and coordination difficulties, and subsequent delays due to actions by various participants in the transportation of this oversized load. The following sections will discuss issues pertaining to the training and guidance provided to the truckdriver, pilot car drivers, and police escorts; the permitting process; and the coordination among these individuals and activities. The 22-day move over 2,100 miles involved 5 pilot car companies, 2 permit companies, the permit issuing offices of 4 States, and, in California, 12 local jurisdictions. Many of the permit routing errors were detected and corrected without mishap, but they resulted in delays. Delays put the convoy behind schedule and on the last day of the movement, used up the truckdriver’s available on-duty time. Other oversights, which also resulted in delays, could have been foreseen and avoided, starting with the removal of the tree at the Toromont Process Systems yard on the 1st day of the trip. 64 D.F. Dinges and N.B. Kribbs, “Performing While Sleepy: Effects of Experimentally Induced Sleepiness,” Sleep, Sleepiness and Performance (Chichester: Wiley, 1991). 65 Physiological phenomena and consequently individuals’ performance fluctuate in a rhythmic pattern over a 24- to 25-hour period. This early morning period is typically associated with the most seriously impaired performance of most individuals, particularly those who are accustomed to a normal day- awake/night-asleep schedule.

Analysis 46 Highway Accident Report The Texas permit required a route survey, yet the permitted route included a railroad grade crossing that the truck could not go over, a bridge and power lines that it could not go under, and an intersection that it could not negotiate. By the time the truck arrived at the Texas-New Mexico border, the New Mexico permit had expired. No one associated with the movement of this load checked the date on the permit and called ahead to renew it after the various delays in Texas, so the convoy was delayed further. In California, the first team of CHP officers did not check the permits, the vehicle, or the truckdriver’s logbook. In Adelanto, had the second team of CHP officers checked the truckdriver’s logbook, they could have determined that he was near the end of his hours of service. The name of a road along the route had been changed, but neither the original route survey nor the Caltrans permit reflected the change. The permit’s route had a turn that the truck could not make and had it pass under a railroad bridge without adequate clearance. The lead pilot car driver made an error transcribing the routes from the permits to a handwritten list. He missed four turns in addition to the one that lead the convoy off route and over the railroad grade crossing where the accident occurred. Truckdriver Training At the time of the accident, the truckdriver had a double/triple trailers CDL endorsement and may have attended some company safety training meetings. But the evidence does not indicate that he had received any specialized training in transporting oversize/overweight loads, particularly over railroad grade crossings. During the California segment of this trip, the convoy encountered five active grade crossings that were on the permitted route. The first four were in the desert, had relativity flat profiles, and were traversed in the daylight. The fifth crossing, at Polk Street over the Metrolink tracks, was similar in appearance to the grade crossing where the accident occurred and was traversed at night successfully. Although similar in appearance to the accident crossing, the Polk Street crossing had a relatively flat profile. When the truckdriver realized he was stuck on the grade crossing at the accident site, he exited the vehicle and attempted to raise the semitrailer but could not do so before the collision. The Safety Board has investigated four other accidents involving low- clearance vehicles hung up on crossings that were impacted by trains as the drivers were trying to raise the semitrailers equipped with hydraulic lifts (see table 8). At least one trailer manufacturer has indicated that there are no mechanical reasons why, when approaching a grade crossing, a trailer could not be lifted and then lowered after traversing the crossing. Investigators found no indication that the truckdriver evaluated the potential hazards of crossing the tracks at the accident site or over any of the other crossings encountered during the move. Nor did he or anyone else in the convoy notify the railroads of each crossing that they traversed. Furthermore, although the driver believed that he could raise the load sufficiently to clear the Grandview Avenue tracks, he did not consider this strategy until his vehicle became stuck. This situation was also apparent in similar accidents investigated by the Safety Board. Training drivers of low-clearance or

Analysis 47 Highway Accident Report oversize/overweight vehicles should make them aware of the hazards of grade crossings. The Safety Board concludes that had the truckdriver received training that emphasized the hazards of railroad grade crossings for oversize/overweight vehicles, he might have recognized the potential hazard and notified the railroad that he was about to traverse the tracks and may have raised the height of the semitrailer before crossing the tracks. The Safety Board has previously addressed the issue of training truckdrivers on the hazards of low-clearance vehicles on hump crossings. As a result of the May 2, 1995, Amtrak train collision with a tractor-low-bed semitrailer combination on a high-vertical- profile (hump) crossing in Sycamore, South Carolina, the Safety Board recommended that the American Trucking Associations, Inc.: H-96-08 Advise your membership of the circumstances of this accident and during in- service training for all drivers, highlight the potential hazards associated with moving low-bed trailers over hump grade crossings. Include specific instructions for notifying authorities when emergencies or hazardous conditions exist at grade crossings. The American Trucking Associations, Inc., indicated in its response that information regarding the accident has been published in its weekly newspaper Transport Topics and that it developed the video Physics 101, which highlights general training on grade crossing safety and specifically training on the hazards of low-bed vehicles over grade crossings. The Safety Board classified Safety Recommendation H-96-08 “Closed– Acceptable Action” on September 6, 1996. Also as a result of the Sycamore accident, the Safety Board recommended that the American Association of Motor Vehicle Administrators: H-96-06 Revise the Commercial Driver’s License Manual to include specific information on hump crossings and ensure that truckdrivers are tested on their knowledge of grade crossing safety, with special emphasis on hump crossings. In March 1996, the American Association of Motor Vehicle Administrators indicated that the recommendation had been referred to its Test Maintenance Subcommittee and would be placed on the agenda for the next meeting. In May 1996, the Safety Board asked for progress reports on the subcommittee’s efforts to meet the intent of the recommendation. In February 1998, the Safety Board inquired about the status of the subcommittee’s actions and, having received no response from the American Association of Motor Vehicle Administrators, in July 1998, classified Safety Recommendation H-96-06 “Closed–Unacceptable Action–No Response Received.”

Analysis 48 Highway Accident Report In addition, the Safety Board has addressed the issue of operators of low-clearance vehicles notifying the railroad before crossing the grade crossing. On November 30, 1993, a 184-foot-long vehicle loaded with an 82-ton turbine was stopped on a private crossing near Intercession City, Florida, while the crew was raising the height of the cargo deck, when an Amtrak train carrying 89 passengers struck the side of the cargo deck and the turbine.66 Six people sustained serious injuries and 53 people suffered minor injuries. As a result of the investigation of this accident, the Safety Board recommended that AASHTO: H-95-07 Inform your members of the facts and circumstances of the Intercession City, Florida, accident and urge that they require operators of low-clearance, overdimension/overweight vehicles to provide railroads with advance notification of travel over grade crossings. Further, recommend that these members revise their permit document to state that compliance with this notification requirement is a condition of permitting. On April 30, 1996, after learning that AASHTO distributed copies of the accident report to its members urging them to review their permit procedures and take corrective action, as necessary, the Safety Board classified Safety Recommendation H-95-07 “Closed—Acceptable Action.” Also, as a result of the November 30, 1993, Intercession City accident investigation, the Safety Board recommended that the Association of American Railroads: R-95-24 Inform your members of the facts and circumstances of the Intercession City, Florida, accident and recommend that they review their procedures for coordinating the transit of over-dimensional, low-clearance highway vehicles across their right-of-way. On October 2, 1995, the Association of American Railroads informed the Safety Board that it had informed its membership of the accident and asked that they review their procedures for coordinating the transit of over-dimensional, low-clearance vehicles across their right-of-way. On January 23, 1996, the Safety Board classified Safety Recommendation R-95-24 “Closed–Acceptable Action.” Although the Safety Board has previously addressed the issue of low-clearance vehicles at high-profile grade crossings, the movement of oversize/overweight vehicles over grade crossings presents a unique problem within the trucking industry. Because of the sheer size of these vehicles, they pose a hazard at any grade crossing, and this accident, as well as others investigated by the Safety Board, demonstrates that truckdrivers operating oversize/overweight vehicles may be unaware of the hazard. Therefore, the 66 National Transportation Safety Board, Collision of Amtrak Train No. 88 with Roundtree Transport and Rigging, Inc., Vehicle on CSX Transportation, Inc., Railroad Near Intercession City, Florida, November 30, 1993, Highway Accident Report NTSB/HAR-95/01 (Washington, DC: NTSB, 1995).

Analysis 49 Highway Accident Report Safety Board believes that the Specialized Carriers and Rigging Association should notify its members of the circumstances of the Glendale, California, accident and during in- service training for heavy-haul drivers, (1) highlight the potential hazards associated with moving low-clearance trailers over grade crossings and (2) emphasize the need to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. Pilot Car Driver Training At the time of the accident, the lead pilot car driver had 8 years of experience and was certified in Utah. However, the Utah pilot car certification curriculum does not include railroad notification for crossing tracks. In this accident, the truckdriver and the CHP officers depended on the lead pilot car driver for guidance through California, particularly metropolitan Los Angeles. Knowledge of the problems of low-clearance vehicles at railroad grade crossings and how to evaluate the safety of each crossing would be valuable for pilot car drivers, as well as for truckdrivers. The Safety Board concludes that had the pilot car drivers received training that emphasized the hazards of railroad grade crossings for oversize/overweight vehicles, the pilot car drivers might have recognized the potential hazard and notified the railroad that the accident vehicle was about to traverse the tracks. In the November 17, 2000, Intercession City, Florida, accident, the Florida- certified pilot car driver who was involved did not know of the Florida requirement for railroad notification; the Florida pilot car driver certification curriculum did not include course information for railroad notification. Pilot car drivers are not subject to hours-of-service rules. In the Glendale accident, the lead pilot car driver’s day started 5 hours before the trip began. He had driven from San Bernardino to meet the load and waited with the CHP officers in Adelanto for the load to arrive. Most often a pilot car driver adheres to the schedule of the truckdriver, who is subject to hours-of-service rules. However, since pilot car drivers are not subject to the hours-of-service rules, truckdrivers will often park the truck, and then the pilot car will take them to eat or on short errands, as the rear pilot car driver did at several stops on the accident trip. As this accident demonstrates, pilot car drivers can also be subject to the effects of lack of sleep and need to be aware of the deleterious effects of fatigue. All States require pilot cars for certain size loads; the Safety Board is aware of only eight States that provide oversight in the form of certification of the pilot car drivers (see table 6). Currently, the certification process ranges from reading a manual to classroom instruction, and then passing a test. The existing manuals indicate that pilot car driver responsibilities include ensuring that oversized/overweight loads are transported safely through designated routes. This responsibility requires skill and knowledge. However, in 42 States, pilot car drivers are not required to have any specific training, pass any skills tests, or demonstrate their knowledge regarding the movement of oversize/overweight vehicles. Furthermore, pilot car drivers are not required to have CDLs.

Analysis 50 Highway Accident Report Pilot cars and escort vehicles help protect the traveling public, the infrastructure, and the oversized load itself. Pilot car drivers perform a safety-sensitive function and are an integral component of many oversize/overweight vehicle movements; consequently, it is important that they be trained and qualified. Yet, only eight States have methods or oversight procedures in place to ensure that pilot car drivers are trained or qualified. As this accident demonstrates, an untrained, inexperienced, or fatigued pilot car driver can create hazardous situations during the movement of an oversized load. The Safety Board considers pilot car driver training critical to ensuring that oversize/overweight loads are transported safely. Such training should include instruction in the effects of fatigue on performance, the need to assess the dangers of railroad crossings, the requirement in some States to notify the railroads, route surveys, and the maneuvering limitations of heavy-haul vehicles. The Office of Freight Management and Operations in the FHWA provides limited Federal oversight on the transportation of oversize/overweight loads. Three pilot car associations represent the pilot car industry. The heavy hauling, or oversize/overweight load, industry is represented by the Specialized Carriers and Rigging Association. The licensing organizations within the States are represented by the American Association of Motor Vehicle Administrators, which currently administers the CDL program. The American Association of Motor Vehicle Administrators, through its committees, has the structure in place to administer uniform testing processes. Therefore, the Safety Board believes that the FHWA should develop a model pilot car driver training program in cooperation and consultation with the Federal Motor Carrier Safety Administration, AASHTO, American Association of Motor Vehicle Administrators, Commercial Vehicle Safety Alliance, Specialized Carriers and Rigging Association, California Professional Escort Car Association, Texas Pilot Car Association, and United Safety Car Association. The training program should address, at a minimum, issues such as (1) how to conduct route surveys; (2) the maneuvering limitations of heavy-haul vehicles; (3) the effects of fatigue on performance; (4) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (5) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. Police Escort Training At the time of the accident, the CHP had policies in place governing the movement of oversize/overweight vehicles but did not provide specific training for officers escorting these vehicles. The policies addressed topics such as the condition of the oversize/overweight vehicle, the truckdriver’s duty status, placement of pilot cars, and permit documentation. Although the CHP policy was to do so, neither of the CHP teams involved in this accident examined the truckdriver’s logbooks. The first team said they assumed the truckdriver had gotten enough rest during the previous night near the Arizona border before the California segment of the convoy movement began. Although the truckdriver said that he told the second CHP team in Adelanto “he was near the end of his available hours of service,” they deny that hours of service were discussed. If the second CHP team had examined the truckdriver’s logbooks, they could have known his duty

Analysis 51 Highway Accident Report status and could have stopped the move at a safe place before the truckdriver was out of available hours and fatigued due to lack of sleep. In addition, at the beginning of both segments of the move in California, the CHP officers performed a cursory examination of the permits to check the routes. However, the CHP officers did not examine all permits, including the local permits, to determine their validity, the special conditions including the department of public works escorts and local curfews, and the routes. Had they examined the local permits, they would have realized that the truck should not have entered the city of Los Angeles without the department of public works escort and that the convoy only had permit applications for Glendale and Hawthorne. Therefore, the Safety Board concludes that the CHP officers missed the opportunity to identify and prevent the subsequent fatigued condition of the truckdriver and the two pilot car drivers and the opportunity to identify inconsistencies between the proposed movement and the permits. After the accident, the CHP made changes to its policy involving the movement of oversize/overweight loads (variance or superloads). The CHP now requires its officers to: (1) compare the route survey and permitted routes, (2) hold safety briefings to discuss routing and special conditions of the permits before the move begins, and (3) park the load if it becomes off route. The Safety Board supports these actions. Nonetheless, as in the case of the truckdriver and pilot car drivers, the Safety Board concludes that had the CHP officers received training that emphasized the hazards of railroad grade crossings for oversize/overweight vehicles, the officers may have recognized the potential hazard and notified the railroad that the accident vehicle was about to traverse the tracks. The Safety Board believes that the Commercial Vehicle Safety Alliance, the International Association of Chiefs of Police, and the National Sheriffs’ Association should notify their members of the circumstances of the Glendale, California, accident and encourage them to train their officers to make sure (1) that documentation regarding permits is reviewed and verified; (2) that safety briefings to discuss routings and special conditions, including the hazards associated with moving oversize/overweight vehicles over grade crossings, are conducted; (3) that provisions for handling off-route loads are in place; and (4) that necessary notification to the railroads is made before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. Permitting Process The movement of this load from Houston to El Segundo required 4 State and 12 local government permits. Obtaining a permit to move an oversize/overweight load through the various State and local jurisdictions in the United States can be a very complex operation. The permit errors made in the Glendale accident illustrate several weaknesses in the process that led to difficulties during the movement. The Texas permit required a route survey, yet the permitted route included a railroad grade crossing that the truck could not traverse, a bridge and power lines that it could not go under, and an intersection that it could not negotiate. A permitting process grounded in safety should preclude such occurrences.

Analysis 52 Highway Accident Report Doug’s Pilot Car Service conducted a route survey for West Coast Services that was submitted to Caltrans with the permit application. Caltrans issued the permit, entirely within its prerogative, with a route that deviated from the route survey. The Caltrans permit route had a turn that the truck could not make and took the convoy under a railroad bridge the load could not clear. Detouring around the bridge resulted in a delay of several hours. Coordination As discussed previously, the movement of this oversize/overweight vehicle from Houston to Los Angeles was plagued by errors, delays, and a general lack of coordination among the participants. The permits obtained did not correspond to the actual route taken, and the discrepancies caused delays. Moreover, the truckdriver, pilot car drivers, and police escorts did not share information among themselves and also exhibited a lack of safety awareness regarding the movement of oversize/overweight vehicles over grade crossings. Planning for this movement appeared to be haphazard and uncoordinated as well. For example, the convoy had not even left the plant in Houston before it encountered its first predictable obstacle, a tree that had to be cut down. During the movement of an oversize/overweight load, the truckdriver, pilot car drivers, motor carrier, permitting officials, and police escorts must communicate effectively to coordinate their efforts. In this accident, several missed opportunities for communication occurred, as well as several occasions of miscommunication:

• In Adelanto, when the Inland Division CHP officers met with the truckdriver, a

discussion of hours of service should have taken place. The truckdriver said he informed the CHP officers that he was almost out of available hours (he had driven 8 ½ hours). The CHP officers said that the conversation did not occur.

• When the truckdriver reached the 10th hour, he should have informed the CHP

officers that he was beyond his available hours to drive.

• When the Los Angeles County Department of Public Works employee said,

“you’re clear now,” the CHP officer-in-charge thought that the convoy was clear all the way to El Segundo, when in fact the county department of public works employee had meant the convoy was clear of the county and his jurisdiction.

• The Los Angeles City Department of Public Works escort was not informed

that the convoy was 4 to 5 hours late, and it left after waiting from 12:00 a.m. until 4:00 a.m.

• When the convoy participants realized that they were off the permitted route

and stopped to determine how to get back on route, the lead pilot car driver and the CHP officer-in-charge did not tell the truckdriver that his load had bottomed out. Analysis 53 Highway Accident Report The poor communication may have resulted for several reasons. One such reason is the interaction of private citizens and uniformed police. Private citizens tend to defer to the authority of police. The truckdriver’s reticence in making sure the CHP officers were aware of his duty status is an example. The truckdriver evidently deferred to the authority of the CHP officers and failed to effectively communicate his hours-of-service status before abdicating responsibility to the CHP officers. The perceived authority of the CHP officers and the associated “power imbalance” appears to have led the truckdriver to proceed in violation of his hours of service, erroneously believing that was the CHP officers’ intention. This accident and the movement that preceded the accident demonstrate how fragmented the permitting and route planning process can be and how poor communication among the participants can lead to catastrophe. Although the States, through their permitting process, have some requirements for oversize/overweight vehicle movements, and permitting guidance is available through AASHTO, no overall guidance is available concerning how this type of movement should be made. The Safety Board concludes that had the movement of the accident vehicle been coordinated more effectively, many of the errors, delays, and failures of communication that led to the accident could have been avoided. Therefore, the Safety Board believes that the FHWA should develop model oversize/overweight vehicle movement guidelines in cooperation and consultation with the Federal Motor Carrier Safety Administration, AASHTO, the American Association of Motor Vehicle Administrators, the Commercial Vehicle Safety Alliance, the Specialized Carriers and Rigging Association, the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association. The guidelines should address, at a minimum, issues such as (1) when pilot cars and police escorts are required; (2) the training, testing, and certification of pilot car operators, police officers, and truckdrivers in the movement of oversize/overweight loads; (3) the use of height poles and traffic controls; (4) how to conduct route surveys; (5) the maneuvering limitations of heavy-haul vehicles; (6) the effects of fatigue on performance; (7) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (8) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. The Safety Board considers that the States should adopt the model oversize/overweight vehicle movement guidelines, once developed, and require that oversize/overweight vehicle movements conform to the guidelines. Therefore, the Safety Board believes that the FHWA and AASHTO should encourage the States to adopt the model oversize/overweight vehicle movement guidelines, once developed, and to require that oversize/overweight vehicle movements conform to the guidelines.

54 Highway Accident Report Conclusions Findings 1. Neither the design nor the operation of the active railroad grade crossing warning devices nor the mechanical condition of the train contributed to the cause of the accident; the emergency response was adequate and timely. 2. The alert actions of the train engineer in warning the southbound commuter train engineer of the track obstruction prevented a second collision. 3. Poor preparation and planning for the movement of the oversize/overweight load resulted in the convoy crossing the Grandview Avenue highway-railroad grade crossing instead of turning onto San Fernando Road. 4. Had the truckdriver, pilot car drivers, or police escorts recognized the potential hazard created by the oversize/overweight vehicle crossing the tracks, they could have taken appropriate action and avoided this accident. 5. Had low-ground clearance warning signs been present at the Glendale crossing, the information conveyed by the signs may have alerted the truckdriver, pilot car drivers, or police escorts to the low-clearance hazard and may have prevented the accident. 6. The judgment and vigilance of the pilot car drivers and the truckdriver may have been affected by a lack of sleep. 7. Had the truckdriver received training that emphasized the hazards of railroad grade crossings for oversize/overweight vehicles, he might have recognized the potential hazard and notified the railroad that he was about to traverse the tracks and may have raised the height of the semitrailer before crossing the tracks. 8. Had the pilot car drivers received training that emphasized the hazards of railroad grade crossings for oversize/overweight vehicles, the pilot car drivers might have recognized the potential hazard and notified the railroad that the accident vehicle was about to traverse the tracks. 9. The California Highway Patrol officers missed the opportunity to identify and prevent the subsequent fatigued condition of the truckdriver and the two pilot car drivers and the opportunity to identify inconsistencies between the proposed movement and the permits.

Conclusions 55 Highway Accident Report

1. Had the California Highway Patrol officers received training that emphasized the

hazards of railroad grade crossings for oversize/overweight vehicles, the officers may have recognized the potential hazard and notified the railroad that the accident vehicle was about to traverse the tracks.

1. Had the movement of the accident vehicle been coordinated more effectively, many

of the errors, delays, and failures of communication that led to the accident could have been avoided. Probable Cause The National Transportation Safety Board determines that the probable cause of the collision of the Metrolink passenger train with the tractor-combination vehicle was (1) inadequate preparation and route planning for the movement; (2) poor coordination of the movement among the truckdriver, pilot car drivers, police escort, and permitting authorities; and (3) a lack of recognition of the potential hazard caused by the accident vehicle at the grade crossing. Contributing to the accident was the fatigue of the pilot car drivers and the truckdriver.

56 Highway Accident Report Recommendations As a result of this accident, the National Transportation Safety Board makes the following safety recommendations: To the Federal Highway Administration, in cooperation and consultation with the Federal Motor Carrier Safety Administration, the American Association of State Highway and Transportation Officials, the American Association of Motor Vehicle Administrators, the Commercial Vehicle Safety Alliance, the Specialized Carriers and Rigging Association, the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association: Develop a model pilot car driver training program. The training program should address, at a minimum, issues such as (1) how to conduct route surveys; (2) the maneuvering limitations of heavy-haul vehicles; (3) the effects of fatigue on performance; (4) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (5) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. (H-01-30) Develop model oversize/overweight vehicle movement guidelines. The guidelines should address, at a minimum, issues such as (1) when pilot cars and police escorts are required; (2) the training, testing, and certification of pilot car operators, police officers, and truckdrivers in the movement of oversize/overweight loads; (3) the use of height poles and traffic controls; (4) how to conduct route surveys; (5) the maneuvering limitations of heavy-haul vehicles; (6) the effects of fatigue on performance; (7) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (8) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. (H-01-31) To the Federal Motor Carrier Safety Administration, the American Association of State Highway and Transportation Officials, the American Association of Motor Vehicle Administrators, the Commercial Vehicle Safety Alliance, the Specialized Carriers and Rigging Association, the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association: Work with the Federal Highway Administration to develop a model pilot car driver training program. The training program should address, at a minimum, issues such as (1) how to conduct route surveys; (2) the maneuvering limitations of heavy-haul vehicles; (3) the effects of fatigue on performance; (4) the need to assess the dangers at railroad crossings,

Recommendations 57 Highway Accident Report particularly for low-clearance vehicles; and (5) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. (H-01-32) Work with the Federal Highway Administration to develop model oversize/overweight vehicle movement guidelines. The guidelines should address, at a minimum, issues such as (1) when pilot cars and police escorts are required; (2) the training, testing, and certification of pilot car operators, police officers, and truckdrivers in the movement of oversize/overweight loads; (3) the use of height poles and traffic controls; (4) how to conduct route surveys; (5) the maneuvering limitations of heavy-haul vehicles; (6) the effects of fatigue on performance; (7) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (8) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. (H-01-33) To the Federal Highway Administration and the American Association of State Highway and Transportation Officials: Encourage the States to adopt the model oversize/overweight vehicle movement guidelines, as addressed in Safety Recommendations H-01-31 and -33, and once developed, to require that oversize/overweight vehicle movements conform to the guidelines. (H-01-34) To the City of Glendale, California: Install low-clearance highway-railroad grade crossing signs (W10-5s) at the Grandview Avenue crossing and evaluate other crossings to determine whether the signs are warranted and, if so, install them. (H-01-35) To the Commercial Vehicle Safety Alliance, the International Association of Chiefs of Police, and the National Sheriffs’ Association: Notify your members of the circumstances of the Glendale, California, accident and encourage them to train their officers to make sure (1) that documentation regarding permits is reviewed and verified; (2) that safety briefings to discuss routings and special conditions, including the hazards associated with moving oversize/overweight vehicles over grade crossings, are conducted; (3) that provisions for handling off-route loads are in place; and (4) that necessary notification to the railroads is made before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. (H-01-36)

Recommendations 58 Highway Accident Report To the Specialized Carriers and Rigging Association: Notify your members of the circumstances of the Glendale, California, accident and during in-service training for heavy-haul drivers, (1) highlight the potential hazards associated with moving low-clearance trailers over grade crossings and (2) emphasize the need to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. (H-01-37) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: November 27, 2001

59 Highway Accident Report Appendix A Investigation The National Transportation Safety Board was notified of the Glendale, California, accident about 11:00 a.m. on January 29, 2000. An investigative team was dispatched with members from the Gardena, California, office. Groups were established to investigate the highway and railroad factors and the motor carrier operations. No parties were designated; no public hearing was held; no depositions were taken.

60 Highway Accident Report Appendix B Terms Relating to Oversize/Overweight Loads Tractor-semitrailer Typically made up of tractor (18 to 20 feet long) and semitrailer (40 to 53 feet long), both 8 feet wide, and together weighing not more than 80,000 pounds. Heavy haul Has gross vehicle weight greater than 80,000 pounds. Extralegal Vehicle or load that is larger or heavier than State size or weight regulations. Super load Definition varies among the States; in California, vehicle with dimensions greater than 15 feet wide, 17 feet high, and 135 feet long. Variance load Another term for super load. Low clearance Vehicle with vertical body or load clearance of less than ½-inch- per-foot of distance between any two axles or less than 9 inches, measured above level surface of roadway.a a. Source: Uniform Vehicle Code. Permit Variance from oversize/overweight load restrictions issued by State and local authorities.

61 Highway Accident Report Appendix C California Department of Transportation Office of Truck Services Summary of Major Improvements Staffing • September 1999 - January 2000 — Hired 15 additional permit writers to double check all overheight (>14 feet) permits. • September 1999 — Began formal training of new and current staff. • October 1999 — Hired consultants to document, modify, enhance, and maintain Transportation Permits Routing Database and provide computer and network support. • October 1999 — Established Transportation Permits Steering Committee made up of Caltrans’ upper management to direct efforts on improvements. • December 1999 - January 2000 — Hired two additional managers for regional Transportation Permits Offices. • July 2000 — Procured services of consultant for oversight/quality assurance of automated permitting system (Transportation Permits Management System). • December 2000 — Hired full-time project manager to lead procurement and implementation of automated transportation permits system. • March 2001 — Developed plans to explore options for recruitment, retention, and upward mobility of transportation permits staff. • May 2001 — Completed hiring of 10 District Truck Services managers for 12 Caltrans districts, who are main link between various functional units in Caltrans, CHP, trucking industry, and regional Transportation Permits Offices (two of which are in Sacramento and San Bernardino). • Ongoing — Employing formal and on-job training with specific emphasis on safety. Processes • November - December 1999 — Began process of verification of vertical clearances. • July 2000 — Completed measurements of 6,500 State highway bridges; updated Caltrans Route-Clearing Database with this information.

Appendix C 62 Highway Accident Report • February - May 2000 — Joint Legislative Audit Committee approved audit of transportation permits program. Published final report on May 31, 2000. Caltrans adopted recommendations. • June 2000 — Issued policies on communication between various functions within Caltrans and transportation permits program. Established within these policies new and revised procedures on reporting of temporary and permanent changes to highway system impacting routing of extralegal loads/vehicles. • June 2001 — Input 94 percent of bridge measurements into Caltrans Route- Clearing Database. • Ongoing — Issuing weekly notification of State highway changes to permit holders/customers. Tools • July - August 2000 — Procured fax services to notify permit holders of changes to State highway system affecting routing of extralegal loads. • August - September 1999 — Made several safety enhancements to current routing system database. • September 1999 — Transferred responsibilities of modifications and improvements to and maintenance of routing database from regional Transportation Permits Offices to Caltrans IT [information technology] function, including preparation of user guide and software documentation of all transportation permit databases and reference systems. • September 2001 — Began work on Transportation Permits Management System. • October 2002 — Transportation Permits Management System in production.

63 Highway Accident Report Appendix D California Highway Patrol Teams 1 and 2 Escort Officers’ On-Duty Time for the 3 Days Prior to the Accident Source: California Highway Patrol on October 19, 2001. Officer Commercial training January 25 January 26 January 27/28 #1 -- Team 1 Basic academy, commercial level 1 0500 - 1430 0500 - 1430 0530 - 2100* #2 -- Team 1 Basic academy 2130 - 0600 2130 - 0600 0530 – 2100* #3 -- Team 2 officer-in-charge Basic academy, commercial level 1 0700 - 1530 0700 - 1530 0700 - 1530 2000 - 0600* #4 -- Team 2 Basic academy, commercial level 1 2200 - 0630 2200 - 0630 2000 - 0600* #5 -- Team 2 Basic academy 0700 - 1530 0700 - 1530 0700 - 1530 2030 - 0600* *Overtime hours worked escorting load

this page intentionally left blank

FD07235 ｜ 2001_美国_HAR0103.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 HIGHWAY ACCIDENT REPORT PB2001-916203 NTSB/HAR-01/03 COLLISION OF CSXT FREIGHT TRAIN AND MURRAY COUNTY SCHOOL DISTRICT SCHOOL BUS AT RAILROAD/HIGHWAY GRADE CROSSING CONASAUGA, TENNESSEE MARCH 28, 2000 7415

Highway Accident Report Collision of CSXT Freight Train and Murray County School District School Bus at Railroad/Highway Grade Crossing Conasauga, Tennessee March 28, 2000 NTSB/HAR-01/03 PB2001-916203 National Transportation Safety Board Notation 7415 490 L’Enfant Plaza, S.W. Adopted December 11, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Collision of CSXT Freight Train and Murray County School District School Bus at Railroad/Highway Grade Crossing in Conasauga, Tennessee, on March 28, 2000. Highway Accident Report NTSB/HAR-01/03. Washington, DC. Abstract: On March 28, 2000, about 6:40 a.m. (sunrise was at 6:33 a.m.), a CSXT Transportation, Inc., freight train traveling 51 mph struck the passenger side of a Murray County, Georgia, School District school bus at a railroad/highway grade crossing near Conasauga, Tennessee. The accident occurred as the school bus was crossing the tracks at a speed of approximately 15 mph. During the accident sequence, the driver and three children were ejected. Two ejected passengers received serious injuries and one was fatally injured. The driver, who had been wearing a lap/shoulder belt that broke during the crash sequence, received minor injuries. Of the four passengers who remained inside the bus, two were fatally injured, one sustained serious injuries, and one, who was restrained by a lap belt, received minor injuries. The two train crewmembers were not injured. The following major safety issues were identified in this accident: • The busdriver’s performance. • School district oversight, including busdriver monitoring and evaluation procedures and bus routing. • Passive grade crossing safety, including previous initiatives related to passive grade crossing and school bus safety. • Occupant kinematics and survival factors. As a result of this accident investigation, the National Transportation Safety Board makes recommendations to the States, the National Highway Traffic Safety Administration, the Federal Highway Administration, the Georgia Department of Education, the National Association of State Directors of Pupil Transportation Services, and the school bus manufacturers. The Safety Board also reiterates a recommendation to the U.S. Department of Transportation. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2001-916203 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 School Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Train . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Collision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Toxicological Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Survivability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 School Bus Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Train Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 School Bus and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 School Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 School Bus Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Train and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Train . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Train Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Crossing Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Highway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Railroad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 School Bus Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Railroad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Murray County Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 State Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 School Transportation Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Lap and Lap/Shoulder Belts and Seat Coverings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Locomotive Event Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Bus Video Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Vehicle Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Audibility Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Auditory Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Contents iv Highway Accident Report Sight Distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Accident Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 School Bus Transportation Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Reporting Near Misses at Grade Crossings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Railroad/Highway Grade Crossing Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 In-Vehicle Warning Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Automatic Crash Notification Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Accident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Grade Crossings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Auditory Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 In-Vehicle Warning Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Grade Crossing Inventory and Hazard Prediction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 School Bus Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Safety Initiatives for Passive Grade Crossings and School Buses . . . . . . . . . . . . . . . . . . . . . . 47 Survival Factors and Occupant Kinematics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Appendixes A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 B: October 2000 Letter to the Governor of Tennessee From the Chairman, National Transportation Safety Board . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65

v Highway Accident Report Acronyms and Abbreviations AASHTO American Association of State and Highway Transportation Officials ACN automatic crash notification CDL commercial driver’s license CFR Code of Federal Regulations CSC customer service center CSXT CSX Transportation, Inc. DOE Georgia Department of Education DOT U.S. Department of Transportation EMS emergency medical services FHWA Federal Highway Administration FMVSS Federal Motor Vehicle Safety Standard FRA Federal Railroad Administration GPS global positioning system MADYMO Mathematical Dynamical Models NASDPTS National Association of State Directors of Pupil Transportation Services NCST National Conference on School Transportation NHTSA National Highway Traffic Safety Administration VCR videocassette recorder WBPAS Web-based Accident Prediction System

vi Highway Accident Report Executive Summary On March 28, 2000, about 6:40 a.m. (sunrise was at 6:33 a.m.), a CSX Transportation, Inc., freight train traveling 51 mph struck the passenger side of a Murray County, Georgia, School District school bus at a railroad/highway grade crossing near Conasauga, Tennessee. The accident occurred as the school bus was crossing the tracks at a speed of approximately 15 mph. During the accident sequence, the driver and three children were ejected. Two ejected passengers received serious injuries and one was fatally injured. The driver, who had been wearing a lap/shoulder belt that broke during the crash sequence, received minor injuries. Of the four passengers who remained inside the bus, two were fatally injured, one sustained serious injuries, and one, who was restrained by a lap belt, received minor injuries. The two train crewmembers were not injured. The National Transportation Safety Board determines that the probable cause of the collision was the school bus driver’s failure to stop before traversing the railroad/highway grade crossing. Contributing to the accident was the Murray County, Georgia, School District’s failure to monitor busdriver performance and its lack of school bus route planning to identify hazards on school bus routes and to eliminate the necessity of crossing railroad tracks. Contributing to the injuries of the school bus passengers were incomplete compartmentalization and a lack of energy-absorbing material on interior surfaces. The major safety issues discussed in this report are the busdriver’s performance; school district oversight, including busdriver monitoring and evaluation procedures and bus routing; passive grade crossing safety, including previous initiatives related to passive grade crossing and school bus safety; and occupant kinematics and survival factors. As a result of its investigation of this accident, the Safety Board makes recommendations to the States, the National Highway Traffic Safety Administration, the Federal Highway Administration, the Georgia Department of Education, the National Association of State Directors of Pupil Transportation Services, and the school bus manufacturers. The Safety Board also reiterates a recommendation to the U.S. Department of Transportation.

1 Highway Accident Report Factual Information Accident Narrative On March 28, 2000, about 6:40 a.m. (sunrise was at 6:33 a.m.), a southbound CSX Transportation, Inc., (CSXT) 33-car freight train, en route to Atlanta, Georgia, collided with the passenger side of a westbound Murray County, Georgia, School District school bus at a railroad/highway grade crossing near Conasauga, Tennessee. The accident occurred on Liberty Church Road in Polk County, Tennessee. The school bus was on its morning route to pick up children and had entered Liberty Church Road from U.S. Route 411 and was making a loop to return to Route 411. As the school bus traversed the passive grade crossing, it was struck. The school bus was equipped with video recording equipment to monitor passenger behavior on the bus. An examination of the videotapes found on the bus showed that the school bus did not stop, as required, before attempting to cross the railroad tracks on the day of the accident, nor had it stopped at this crossing on eight previous occasions. During the accident sequence, the driver and three children were ejected. Two ejected passengers received serious injuries and one was fatally injured. The driver, who had been wearing a lap/shoulder belt that broke, received minor injuries. Of the four passengers who remained inside the bus, two were fatally injured, one sustained serious injuries, and one, who was restrained by a lap belt, received minor injuries. The two train crewmembers were not injured. School Bus On the day of the accident, the driver made her regularly scheduled first pickup about 6:35 a.m. The school bus was northbound on Route 411 when it turned right (east) onto Liberty Church Road in Georgia (see figure 1). The busdriver usually picked up passengers on Liberty Church Road, crossed the railroad tracks, and exited back onto Route 411 southbound in Tennessee, approximately 0.2 mile from the Georgia State line.

Factual Information 2 Highway Accident Report On its approach to the crossing, the school bus encountered two advisory signs. The first was a round railroad advance warning sign1 with a placard that stated “ONE LANE.” The second was a diamond-shaped warning sign2 that stated “LIMITED SIGHT DISTANCE.” Beneath the second sign was a speed advisory sign3 that stated “10 MPH.” Also at the crossing was a railroad crossing sign (crossbucks)4 on the right side of the approach (see figure 2). In a postaccident interview with the Tennessee State District Attorney’s Office on March 28, 2000, the busdriver stated that she was “coming down the hill, came to a complete stop”; looked left then right, left then right; pulled open the door and closed it. She said that she looked in the rearview mirror to make sure all the children were sitting down, then looked to the left and right again, and the train came out of nowhere. She stated, “It was like it fell from the sky.” The busdriver refused any further interviews. Figure 1. Map of Liberty Church Road area. 1 Sign W10-1 in the Manual of Uniform Traffic Control Devices. 2 This sign is no longer included in the Manual of Uniform Traffic Control Devices. 3 W13-1. 4 R15-1. 411 411 411 RAILROAD ACCIDENT LOCATION LIBERTY CHURCH RD BUS PATH X LIBERTY CH. RD LIBERTY CH. RD GA TN N

Factual Information 3 Highway Accident Report In an interview after the accident, one of the passengers on the bus indicated that the day of the accident was her second day riding the bus. She told the Tennessee State District Attorney’s Office that she got on the bus, sat in the second row, and buckled her lap belt.5 She could not remember whether the driver’s window was open or closed. The passenger stated, “The bus went down the hill and across the track without stopping, just the same way the driver did the day before, without stopping.” She said she did not hear the train horn. 5 The first two rows of seats on the bus were equipped with lap belts at each of the three seating positions so that child restraint systems could be used for small children requiring them. Figure 2. Scene diagram. 10 MPH 15' 30' 60' 0 Liberty Church Road N Conasauga, Tennessee Source: National Transportation Safety Board Rail road crossing sign (MUTCD R15-1) Rail road crossing sign (MUTCD R15-1) Approach path of school bus Approach path of train LIMITED SIGHT DISTANCE

Factual Information 4 Highway Accident Report Train Train S-213-25 was holding at the Ocoee siding,6 approximately 9.5 miles north of Liberty Church Road, when the conductor and engineer were called on duty at 2:20 a.m.; they arrived at the siding about 4:00 a.m. Upon arrival, the conductor released several handbrakes on the cars as the engineer inspected the single locomotive. The engineer conducted a set-and-release test of the airbrakes,7 then pulled the train to the south end of the siding and, using the train brakes, stopped it as a way of measuring the effectiveness of the brakes. The train continued to hold at the siding until approximately 6:18 a.m., when the crew received a “medium clear”8 signal from the dispatcher-controlled signal at the south end of the siding. The locomotive event recorder data indicated that the train moved out of the siding and accelerated after the last car was on the main track. The crew encountered a “clear”9 signal at each subsequent signal location prior to the accident site. After passing a wayside defect detector,10 the crew received an automated voice radio transmission from the detector indicating the train had no defects. The detector- recorded time was 6:25 a.m. and the train speed was 35 mph. The train increased speed to 56 mph while traveling on a descending grade. Thereafter, as it ascended a 3,173-foot grade, its speed decreased gradually to about 51 mph. The locomotive horn and bell were sounded at several grade crossings prior to reaching Liberty Church Road, according to the locomotive event recorder. As the train approached Liberty Church Road, the engineer stated that he saw the bus approaching the crossing and yelled, “Hey! Hey!” The conductor jumped up and both crewmembers were concerned about the action of the bus. The conductor said that the yellow bus was illuminated by the sunlight and he noted road dust swirling behind it. The engineer said that he held the horn valve down continuously in an effort “to blow her down,”11 but the bus did not stop. The engineer stated that when the bus continued to move toward the crossing, he placed the train in emergency braking using the automatic brake valve. According to the conductor, who was on the left side of the train and saw the bus before it crossed the tracks, the driver was looking straight ahead when she crossed the tracks. When the bus was on the crossing, the engineer said the driver turned to look at the train, just prior to collision. Both the conductor and engineer stated that before the collision they noticed that the door of the bus was closed. 6 The dispatcher held the train at the siding to allow several northbound trains to pass. 7 Reported by the conductor and confirmed by the locomotive event recorder. 8 A “medium clear” signal indication permits a train to proceed at 30 mph, per CSXT operating rule 283. 9 A “clear” signal indication permits a train to proceed at the maximum timetable speed, per CSXT operating rule 281, which was 60 mph on this track. 10 Wayside detectors monitor passing trains for mechanical defects, such as dragging equipment, and typically record train speed, time, axle count, ambient temperature, and other data. 11 Alert the busdriver.

Factual Information 5 Highway Accident Report Collision The train struck the school bus on the passenger side between the axles. During the accident sequence, the bus body and its chassis struck the crossbucks and separated, and the chassis came to rest 64 feet west-southwest of the center of the grade crossing; the chassis was facing east. The front of the bus body, including the section to which the driver’s seat was attached, separated from the rest of the body and remained with the chassis, which rolled on its passenger side and later rolled back upright. The body, pushed down the tracks by the locomotive before pivoting off and rotating clockwise about 180 degrees, came to rest 192 feet west-southwest of the center of the crossing (see figure 3). That part of the bus body immediately behind the separation point was flush with the train body (see figure 4). Broken branches and scrape marks were found on rows of trees approximately 112 feet and 157 feet from the grade crossing. The train did not derail, and the locomotive came to rest about 1,990 feet from the crossing. During the accident sequence, the bus body scraped several branches and struck a tree near the area where the bus came to rest. Bus tire rub marks were found on the inside of the rail. Figure 3. Postaccident scene diagram. 10 MPH B 15' 30' 60' 0 Liberty Church Road School bus body at-rest position School bus chassis at-rest position Post-collision path of school bus body Bus driver Post-collision evidence from school bus N Passenger 1A Passenger 1F Passenger 12A Conasauga, Tennessee Source: National Transportation Safety Board Trees and shrubs LIMITED SIGHT DISTANCE

Factual Information 6 Highway Accident Report Injuries The following table is based on the International Civil Aviation Organization’s injury criteria,12 which the National Transportation Safety Board uses in accident reports for all transportation modes. Table 1. Injuries. Figure 4. Accident bus. 12 Title 49 Code of Federal Regulations 830.2 defines a fatal injury as any injury that results in death within 30 days of the accident. It defines a serious injury as one that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of the fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns or any burns affecting more than 5 percent of the body surface. Injuries Driver Train crew Bus passengers Total Fatal 0 0 3 3 Serious 0 0 3 3 Minor 1 0 1 2 None 0 2 0 2 Total 1 2 7 10

Factual Information 7 Highway Accident Report Medical and Pathological Information The busdriver was wearing a lap/shoulder belt, which broke during the accident sequence, resulting in her ejection from the bus. Her minor injuries included a fractured nose, contusions, abrasions, and lacerations. The passenger seated in the second row (seat 2A) (see figure 5) also sustained minor injuries, including blunt abdominal trauma with abrasions and contusions. This passenger was reportedly wearing a lap belt. One of the ejected passengers (seat 1A), who was ejected through the front opening of the bus body after its separation from the chassis and was severely injured, sustained a closed head injury, multiple scalp lacerations, left arm and leg fractures, and wedging of several thoracic vertebrae. The seriously injured passenger who was ejected and found pinned under the front passenger-side corner of the bus (seat 1F) sustained a closed head injury, liver contusions, multiple facial lacerations, abrasions, and contusions. The seriously injured passenger who was seated across from the area of intrusion (seat 6A) sustained a closed head injury with intraventricular hemorrhage, a right frontal lobe contusion, right first rib fracture, and multiple facial lacerations. Figure 5. Seating chart. M - 09 : F DRIVER F - 34 : M F - 09 : F ICAO INJURY LEGEND SAMPLE F = FEMALE M = MALE # = AGE *International Civil Aviation Organization AOI = Area of Impact CONASAUGA, TENNESSEE INJURY LEVEL AGE GENDER * F - 14 : M A B C D E F 1 2 3 4 5 6 7 8 9 10 11 12 F - 08 : M F - 05 : S M - 08 : S F - 07 : F M - 06 : S Source: NTSB N M S

F

=

= None Minor Serious Fatal AOI (EJECTED) (EJECTED) (EJECTED) (EJECTED)

Factual Information 8 Highway Accident Report Two fatally injured passengers (seats 6F and 8F) were seated in the area of impact, and each sustained a linear skull fracture, left subdural hemorrhage, cerebral cortical contusions, lacerations, and contusions. In addition, the passenger in seat 6F received a posterior right rib fracture with right hemothorax, hemoperitoneum, and spleen laceration. The passenger in seat 8F also received a severe facial fracture, subarachnoid hemorrhage, and left femur fracture. The fatally injured passenger seated in the last row (seat 12A), who was ejected, sustained a transected aorta; lacerations of the right atrium, liver, and spleen; bilateral hemothorax; left lateral pericardial sac hemopericardium; fractures to the left ribs, right clavicle, and right tibia-fibula; and multiple contusions, lacerations, and abrasions. This passenger also had abrasions and linear contusions from the chest midline extending laterally to the right and left of the chest midline. Toxicological Tests The Federal Motor Carrier Safety Regulation at 49 Code of Federal Regulations (CFR) 382.303 requires that in accidents such as the Conasauga collision, postaccident alcohol and drug testing be performed on the busdriver; 49 CFR 40.21 specifies that the drug testing be done for marijuana, cocaine, opiates, amphetamines, and phencyclidine. Erlanger Medical Center in Chattanooga, Tennessee, conducted the postaccident toxicological testing on the accident driver, and the results were negative. According to the Federal Motor Carrier Safety Regulations, the test was invalid because it did not test for phencyclidine. Safety Board investigators sent samples of the busdriver’s blood and urine to the Civil Aerospace Medical Institute for further testing. Results revealed the presence of pseudoephedrine and ephedrine in the blood and urine. Phenylpropanolamine was present in the urine but not in the blood. All of these substances are common ingredients in over- the-counter cold medications and weight-loss products. No evidence of alcohol or illicit drugs was found in either sample. Neither Federal regulations nor CSXT policy require toxicological testing for a train crew after a grade crossing collision. The engineer and the conductor volunteered to be tested, and the results were negative for drugs and alcohol for both employees. Survival Aspects Emergency Response Dispatch Center. When a driver who had turned onto Liberty Church Road from Route 411 came upon the accident scene, she placed a 911 call to the Murray County 911 Center from her cellular telephone at 6:41 a.m. She stated that a school bus and train had collided at a railroad crossing, but she did not know the precise location because there was no signage (this was not her usual route). She believed the accident occurred 1/2 mile

Factual Information 9 Highway Accident Report north of St. Claire’s gas station. At 6:45 a.m. she called the 911 center again, this time from St. Claire’s gas station on Route 411, where she had learned that the road at the accident scene was Liberty Church Road. This information was then relayed to the fire, rescue, and emergency medical services (EMS) units, which had been dispatched at 6:44 a.m., and were already en route to the scene. The Polk County Sheriff’s Department did not receive any calls reporting the accident. At 6:56 a.m. the Polk County Sheriff’s Department received a call from the Murray County 911 Center requesting two EMS ambulances to assist in the response. CSXT. Earlier, while the train was coming to a stop, the conductor had called “Tone 9,”13 and according to train dispatcher radio transcripts, the dispatcher answered the emergency call from train S-213-25 at 6:43 a.m. After confirming the location and identity of the train, the dispatcher called the CSXT Police Communications Center at 6:44 a.m. and informed the police communications specialist of the emergency. At 6:47 a.m., the Murray County Sheriff’s Office received a phone call from the CSXT Police Communications Center in Jacksonville, Florida, reporting the nature and location of the accident. About 2 minutes later, the Murray County Sheriff’s Office 911 operator called the CSXT Police Communications Center and confirmed information about the location of the accident. On-Scene Activities. At 6:50 a.m. the first fire command officer and engine arrived at the scene and requested additional assistance, as well as a medical evacuation helicopter. The first helicopter departed Erlanger Medical Center in Chattanooga, Tennessee, at 6:59 a.m. and arrived at the Rostex airstrip landing zone established near the accident scene at 7:17 a.m. Another helicopter departed Knoxville, Tennessee, at 7:08 a.m. and arrived at the landing zone at 8:03 a.m. By 7:06 a.m., all passengers had been extricated from the vehicle. At 7:17 a.m., the 911 center was advised that no additional EMS units were needed. In all, 17 firefighters from Murray County responded, and 5 ambulances were sent to the scene (3 from Murray County and 2 from Polk County). The ambulances transported four passengers to the Rostex airstrip to be airlifted to Erlanger Medical Center. Two passengers were taken by ground transportation to Murray County Hospital and stabilized until they could be airlifted to Erlanger Medical Center. A formal disaster plan was not initiated. The Murray County Fire Services Director reported to investigators that no problems occurred during the response. Survivability The school bus driver, who sustained minor injuries, was wearing the three-point lap/shoulder belt available at the driver’s seat. The belt webbing failed during the accident sequence and the driver was ejected. The passenger14 seated in the second row on the driver side was wearing the available lap belt and sustained minor injuries. 13 “Tone 9” is a radio tone specified as the method for contacting the train dispatcher in an emergency. 14 This passenger was 4 feet 5 inches tall and weighed 117 pounds.

Factual Information 10 Highway Accident Report Two of the fatally injured passengers were seated in the impact area. The third fatally injured passenger was seated in the last row of the school bus and was ejected. Two of the seriously injured passengers were seated in the first row of the bus and were not using the available lap belts. Both of these passengers were ejected and one was found under the front right corner of the bus body. The third seriously injured passenger was seated on the driver side, across from the impact area. Personnel Information School Bus Driver The Murray County School District hired the 34-year-old school bus driver as a full-time substitute busdriver15 on May 11, 1999. She became a full-time busdriver at the beginning of the 1999-2000 school year. Between September 16, 1997, and September 16, 1998, she was a school bus driver at Olympic Truck Lease, which had a contract with the Dalton City, Georgia, schools for pupil transportation. The busdriver had a valid Georgia commercial driver’s license (CDL) with a passenger endorsement, which expired on May 3, 2001. A corrective lens restriction was noted on the license, but it could not be determined whether the busdriver was wearing glasses or contact lenses at the time of the accident. Her driving record included a single conviction for speeding (61 mph in a 45 mph zone) while driving her personal vehicle on September 21, 1991. Pupil transportation officials with the Dalton City Public Schools stated that the busdriver attended a 4-hour training class on January 20, 1998, which covered operational and driving procedures, including procedures at railroad/highway grade crossings. According to the officials, the busdriver was verbally reprimanded during the session for talking during class, and her response to the reprimand was that she did not understand why she had to attend the training because she already knew the material. All drivers in Murray County are required to attend an 8-hour mandatory training session annually with a State Department of Education consultant and a State patrol officer for recertification as school bus drivers. The training includes information on the proper procedures to follow at grade crossings. The accident busdriver had received her training and annual recertification on August 12, 1999. The principal stated that he had not received any complaints about the busdriver and noted that teachers, parents, and students liked her. Except during summer vacation, the driver had been driving the same route since May 1999. The busdriver tested negative for drugs and alcohol in a preemployment drug screen on May 9, 1999; no random drug tests had been performed on the driver since that time. She received her annual physical examination on July 14, 1999, and was found medically qualified to drive a school bus. Medical records obtained from the driver’s 15 Full-time substitute busdrivers drive every day but not necessarily the same route.

Factual Information 11 Highway Accident Report personal physician revealed that she was diagnosed with diabetes mellitus type II16 on November 5, 1999, but insulin was not required for treatment. She had episodes of high blood pressure in October and December 1999; no repeated levels of high blood pressure were indicated thereafter and her blood pressure was normal in January, February, and March 2000. Neither of these conditions disqualified her from holding a CDL. The busdriver took her bus home nightly because of the convenient location of her residence to the bus route. She usually departed her home in Chatsworth, Georgia, about 6:10 a.m.; drove to the Liberty Church Road area and picked up the first passengers about 6:35 a.m.; and arrived at Northwest Elementary School in Chatsworth, Georgia, between 7:30 and 7:40 a.m. She departed Northwest Elementary School about 2:00 p.m. on her afternoon route. Train Crew The conductor and engineer had been called on duty at Etowah, Tennessee, at 2:20 a.m. on the day of the accident. The engineer had been off duty for the required 10-hour period, and the conductor had been off longer than 10 hours. Both men indicated that they had slept well the evening before the accident. The engineer and conductor reported to the yard office, received documentation, and departed by taxi at 3:45 a.m. to the Ocoee siding, where the train was located, 19 miles south of Etowah. The 50-year-old engineer had been a railroad employee on the Etowah subdivision since 1972 and became a conductor in 1975. He entered the CSXT engineer training program in 1995 and was promoted to engineer in 1996. CSXT employee records listed the engineer as medically qualified without restrictions. The engineer last took the CSXT operating rules class17 on January 6, 2000, and had last passed an engineer certification class18 on December 31, 1998. The 51-year-old conductor had been a railroad employee since 1977 and was promoted to conductor in 1984. The conductor said he had worked most of his career on the Etowah subdivision and that he was familiar with the territory. CSXT employee records listed the conductor as medically qualified without restrictions. The conductor had last attended a CSXT operating rules class on January 23, 2000. School Bus and Wreckage Information School Bus The 1999 Blue Bird Corporation 72-passenger school bus had an International Truck and Engine Corporation chassis, diesel engine, power steering, automatic 16 Generally, type II diabetes can be controlled through oral medication, weight loss, and diet. 17 Periodic rules instruction is required by 49 CFR Part 217.11. 18 Title 49 CFR Part 240.

Factual Information 12 Highway Accident Report transmission, and antilock brakes. The electronic control module was not capable of recording vehicle operational data but did provide system fault and diagnostic information. The data indicated no fault codes or abnormalities upon inspection after the accident. The odometer reading was 24,219 miles. The school bus was approximately 452 inches long and had a gross vehicle weight rating of 26,384 pounds. The school bus had 12 rows of three-passenger bench seats on both sides of the bus and modesty panels in front of the first row. The first two rows were equipped with lap belts19 in all designated seating positions. The bus was equipped with seven emergency exits: two roof vent hatches, four side window exits (two on each side), and one rear emergency door. The driver’s seat was equipped with a lap/shoulder belt. The latch plate receiver was mounted to the seatframe on the passenger side and tethered to floor anchorages below the driver’s seat. The continuous loop strap with free-sliding latch plate was seat- mounted and floor-tethered on the left side of the driver’s seat in the same manner as the receiver. The continuous loop passed through the D-ring and terminated at an emergency locking retractor, which was mounted to the bus body sidewall panel at the roofline to the rear and above the driver’s left shoulder position, 16 inches behind the seat. The driver’s seat and lap belt anchorages were mounted to the school bus body. The bus body was secured to the chassis using bolts and body-to-chassis mounting clips, in accordance with design specifications of the National School Transportation Specifications and Procedures20 manual and current industry practices. The front section of the bus body (below the driver’s seat) was attached to the chassis with tie down brackets secured by four grade 8 bolts (higher grade than the rest of the bolts).21 The body cowl panels were secured to the chassis by 25 bolts and locknuts. The school bus was equipped with an AM/FM cassette radio with an integrated public address system and four overhead speakers. One speaker was located above and just to the rear of the driver’s seat, and the remaining speakers were in roof panels above rows 4, 7, and 11. After the accident, investigators found the toggle switch for the speakers in the “INT” position, indicating that all four speakers were active. The two interior roof panels located above the driver were lined with sound attenuation materials. The bus was equipped with a “Silent Witness” in-vehicle video camera, mounted midline approximately 71 inches above the floor at the front of the bus. The video recorder was on at the time of the accident (see Bus Video Recorder section). The bus was equipped with two 291-inch-long open-style overhead storage racks mounted above the windows on both sides of the body (see figure 6). Angled padding 19 Lap-only belt. 20 National School Transportation Specifications and Procedures, 2000 Revised Edition (Warrensburg, MO : Missouri Safety Center, 2000). 21 Society of Automotive Engineers standard; grade 8 bolts have the highest tensile strength of commercially available bolts.

Factual Information 13 Highway Accident Report protected the aisle side of the rack. Five metal bars formed the rack along the length of the bus. According to Blue Bird Corporation, the racks were 61.13 inches above the floor. They were located outside the head protection zone, as defined by Federal Motor Vehicle Safety Standard (FMVSS) 222 (49 CFR 571.222.5.3.1.1),22 and thus were not required to comply with head protection requirements. Maintenance records indicated no recurring maintenance problems or recent repairs to the vehicle. Safety Board investigators conducted a postaccident inspection of the vehicle and found no mechanical defects. School Bus Damage The school bus body separated from the chassis at the engine compartment cowling23 and the forward roof panel above the windshield. The driver’s seat, windshield, engine cowling, entrance stairwell, firewall, and dash controls remained attached to the part of the bus body still attached to the chassis. The chassis’ main frame rails were deformed rightward from the drive axle rearward; maximum deformation was 44.63 inches. The drive axle was displaced leftward 7.8 inches. Frame rail cross members and rear bumper supports were also damaged (see figure 7). 22 The upper limit of the head protection zone is 40 inches above the seating reference point. This is about 58.62 inches above the floor in this bus, according to Blue Bird Corporation. Figure 6. Roof rack. 23 Metal cover for the engine.

Factual Information 14 Highway Accident Report Damage to the bus body was extensive in the immediate area of impact; maximum intrusion was 44.85 inches (figure 8). In addition, induced damage, in the form of bowing of the body structure, was substantial. The right rear corner of the bus was skewed rightward 42.67 inches and forward 40.85 inches (see figures 9 and 10). Figure 7. Bus chassis. Figure 8. Bus body deformation. 36.44" 42.08" 44.85" 40.56" 40.85" 42.67" 45.47" 8.82" 13.70"

Factual Information 15 Highway Accident Report Postaccident inspection showed the driver’s seat tilted toward the passenger side of the bus (see figure 11). The left lap belt segment extended from the edge of the seat cushion to the floor of the bus and was taut, while the right lap belt segment extended from the edge of the seat cushion to the floor of the bus and was slack. The driver’s seat and the floor anchorages remained attached to the body flooring, which was in turn attached to the chassis. The shoulder belt passed through the D-ring, and the D-ring and the emergency retractor were located on the sidewall of the bus body (see figure 12). The shoulder belt webbing was torn, some of it remained with the driver’s seat, and the rest remained with the sidewall-mounted retractor. Figure 9. School bus exterior body damage. Figure 10. School bus interior body damage.

Factual Information 16 Highway Accident Report Figure 11. Driver’s seat. Figure 12. Portion of driver’s shoulder belt attached to bus body.

Factual Information 17 Highway Accident Report Except in the area of maximum intrusion, the seat cushions remained fixed to the seatframes. Damage was noted to the seatframe attachments in the area of maximum intrusion; the seatframes were not dislocated from the floor. The modesty panels remained intact. Severe damage to the roof rack was noted on the passenger side of the bus. Damage to the sidewall and roof of the bus caused the rack to rotate approximately 90 degrees, with the opening into the rack facing the top of the roof. Although twisted and bent after the accident, the racks remained securely attached to the bus body. The rack on the driver side of the bus was almost completely intact, except near seats 6 and 7, where induced deformation was present. This deformation was near the area of maximum intrusion. Train and Wreckage Information Train Train S-213-25 consisted of 1 locomotive and 33 loaded auto-rack cars. The train was 3,173 feet long and had a gross weight of 2,465 tons. The locomotive was a six-axle General Electric C40-8 powered by a 16-cylinder engine rated at 4,000 horsepower. The locomotive weighed 395,000 pounds. The locomotive had received its required annual brake servicing on March 26, 2000. Locomotive warning devices included an air-operated bell, a five-chime Nathan “Airchime” horn mounted on the top of the locomotive body, a standard two-bulb headlight, and two ditch lights on the leading edge of the front walkway. When the horn was sounded, the ditch lights oscillated in an alternating on-off pattern. Audiometer testing revealed that the horn exceeded the Federal requirement in 49 CFR 229.129 of 96 decibels when measured 100 feet ahead of the locomotive. Train Damage The steps on the front left side of the locomotive, CSX 7580, were displaced rearward about 4 inches. There was yellow paint transfer on the snowplow and coupler. Both ditch lights were broken and the light brackets were bent back about 2 inches. The hand railings on the front walkway were bent back toward the body. CSXT estimated damage to the locomotive at $1,500. The first car behind the locomotive was an 89-foot flatcar equipped with a trilevel auto rack. The side panel of this car was damaged; CSXT estimated repair costs at $200. The track was not damaged.

Factual Information 18 Highway Accident Report Crossing Information Highway Liberty Church Road is an 18-foot wide, two-lane road without a centerline that winds about 1.8 miles in a “U” shape from Route 411 in Georgia back to Route 411 in Tennessee. No street name signs identify it as Liberty Church Road, nor do street signs mark any other roads in Polk County, Tennessee. At the time of the accident, two advisory signs were present as vehicles approached the crossing. One was a round railroad advance warning sign24 314 feet east of the nearest rail, and the other was a diamond-shaped warning sign25 200 feet east of the nearest rail that stated “LIMITED SIGHT DISTANCE,” below which was a supplemental advisory speed sign26 that stated “10 MPH.” At the crossing was a railroad crossing sign (crossbucks) on the right side of the roadway (see figure 13). According to the Polk County Superintendent of Highways, an engineering study regarding the selection and placement of the advance warning signs and placards for the Liberty Church Road grade crossing had not been conducted. 24 W10-1. 25 W11. 26 W13-1. Figure 13. Driver’s view of Liberty Church Road approaching the crossing.

Factual Information 19 Highway Accident Report The road approaching the tracks from the west was 18.1 feet wide and narrowed to 15 feet wide just before the crossing. At the center of the crossing, the road was 14.5 feet wide. It had a downhill grade of 12.9 percent prior to and 10 percent at the railroad advance warning sign. Adjacent to the “limited sight distance” sign the grade was 5 percent. Just before the crossing, the roadway had a 2-percent downgrade that transitioned to a flat surface across the rails. The roadway surface was asphalt on the approach and between the rails; rubber transition treatments were on each side of the rails. The roadway had been resurfaced in fall 1999. Records showed no previous accidents at the grade crossing. After this accident and the subsequent upgrade of the crossing to active devices consisting of lights and gates, all signs were removed. New round railroad warning signs (W10-1) were installed in advance of the crossing, and two signs (W10-3s, one in each direction) were placed on Route 411, indicating a grade crossing on Liberty Church Road. Railroad The accident occurred at milepost 362.82 on the north-south track of the Etowah subdivision at crossing 347 942 N. A toll-free number is posted on the crossbuck posts at the crossing for reporting stalled vehicles or an emergency to CSXT. Daily track inspection reports for the 6 months before the collision indicated no track problems near the grade crossing. Operations Information School Bus Operations The Murray County School District owned and operated the accident bus. The school district comprises five elementary schools, two middle schools, one high school, and one alternative school in a 344-square mile area. In the 1999-2000 school year, the student population was 6,559, of whom 3,930 were transported daily on school buses. The school district had a fleet of 74 buses and employed 54 full-time busdrivers and 7 substitute drivers. Vehicles were maintained by a shop foreman, three full-time mechanics and one part-time mechanic, who was also a busdriver. Training. Murray County provides annual mandatory training, as required by the State, to its busdrivers for recertification. During this training, information on railroad/highway grade crossings is provided. On February 3, 2000, Operation Lifesaver27 presented a training class in Murray County attended by eight busdrivers. School officials reported that because of a lack of funding, busdrivers could not be paid to attend and were not required to be present. The accident busdriver did not attend the session. Since this 27 Operation Lifesaver is a nonprofit nationwide effort to educate the public and increase public awareness of the hazards at railroad-highway grade crossings and to develop proper driver behavior patterns at grade crossings. Operation Lifesaver participants include State and local officials, civic groups, safety organizations, transportation industry groups, labor groups, public information media, and private citizens.

Factual Information 20 Highway Accident Report accident, Murray County School District has been working with Operation Lifesaver to provide mandatory, in-depth driver training for railroad/highway grade crossings. Drivers are now paid to attend this training. Routing. According to Murray County School District officials, the school district has 18 railroad crossings, 15 of which were crossed by school buses at the time of the accident. These figures do not include the Liberty Church Road crossing, which is not in Murray County. School bus routes were established several years ago and change periodically depending on population and location of the students. The school district’s transportation director stated that grade crossings are considered in routing and that some routes have been changed to utilize active rather than passive crossings. In rural areas, roadways sometimes only enter and exit an area one way and must cross the tracks. According to the transportation director, the Liberty Church Road school bus route crosses the railroad tracks because the intersection of Liberty Church Road and Route 411 in Georgia is such that, if the bus turned around and exited in Georgia (eliminating the need to cross the tracks), the bus would have to go into the opposing lane of traffic to turn onto Route 411. The accident vehicle was the only Murray County school bus that traversed the Liberty Church Road crossing. A Polk County school bus also crossed the tracks. Safety Board investigators reviewed several Murray County school district route maps during the investigation and noted that none documented any road hazards. Following this accident, the school district revised some routes, so that currently, only one route crosses a passive crossing because that neighborhood has no other way out. The intersection of Liberty Church Road and Route 411 was redesigned so that a school bus can now turn around on Liberty Church Road and enter Route 411 without encroaching on the opposing lane. Busdriver Procedures. Title 40-6-142 of Georgia State law, which governs the procedures of school bus drivers at railroad/highway grade crossings, states: The driver of any motor vehicle carrying passengers for hire or of any school bus, whether carrying school children or empty before crossing any railroad tracks shall stop such vehicle within 50 feet but not less than 15 feet from the nearest rail, look and listen for a train and not proceed until safe to do so. Tennessee law is the same, except that drivers are not required to stop if there are no children on the bus. In the district’s Bus Drivers Manual: Procedures and Rules, under the section entitled “State Law and Policy,” the Murray County schools list seven steps to be followed at railroad crossings:28 a. Always come to a complete stop. b. Stop not closer than 15 feet, but not farther than 50 feet, from the nearest rail. 28 These steps are adapted from the National School Transportation Specifications and Procedures.

Factual Information 21 Highway Accident Report c. Open service door and left front window. Cut off radio, fans and heaters. d. Look both ways – Listen!! e. A school bus driver does not activate warning lights while approaching or stopped for a railroad crossing. f. When tracks are clear and safe, proceed forward. Do not shift gears while crossing. g. Close door and continue route. One question on the Georgia CDL test, which a school bus driver must pass, addressed the effect of minimum and maximum stopping distances to the nearest rail on a driver’s ability to see down the track. Railroad Each day, 30 to 35 trains travel on the Etowah subdivision, which runs from Etowah, Tennessee, to Junta, Georgia, a distance of 87.6 miles. No revenue passenger trains operate in the subdivision. According to CSXT, the Etowah subdivision is often congested due to bottlenecks in the Atlanta area and scheduled track maintenance. Rail freight volume for the subdivision increased from 48.6 million annual gross tons in 1998 to almost 49.9 million tons in 1999. The subdivision is a single-track main line with numerous passing sidings. In the area in which the accident occurred, CSXT Atlanta division timetable No. 1, dated October 1, 1999, indicates that the maximum track speed is 60 mph for intermodal trains and for trains comprising solid blocks of auto racks, such as the accident train; all other trains are limited to 50 mph. Train times and directions of travel do not follow a fixed schedule; wayside signal indicators govern train movement. Before the accident, the most recent train to pass the Liberty Church Road crossing was headed northbound about 6:10 a.m. Signal records indicate that 26 trains had passed over the accident site between 6:00 a.m. and 7:00 a.m. in the 25 days preceding the accident. Management Information Murray County Oversight Under “Performance Appraisal/Evaluation,” the Murray County School District’s Bus Drivers Manual: Procedures and Rules states: “Each employee is appraised on common factors according to the contents of the job description. An employee is rated on unique factors if contained in the job description.” Neither the accident busdriver’s personnel file nor those of other busdrivers contained documentation indicating that their performance behind the wheel had been evaluated or rated.

Factual Information 22 Highway Accident Report State Oversight The Georgia Department of Education’s (DOE’s) Office of Learning and Achievement, Student Transportation Services, includes five full-time consultants, located throughout the State, who assist the school districts. All consultants are State-certified school transportation trainers who have advanced degrees in education. The consultants, coordinating through the DOE, conduct the annual recertification training for school bus drivers. According to the director of pupil transportation, the agency’s mission is to provide service rather than serve a regulatory function; its area of expertise is pupil transportation systems. The DOE allocates funds for pupil transportation operations; about 40 percent of the funds cover the purchase of new buses. Georgia’s director of pupil transportation is a member of the National Association of State Directors of Pupil Transportation Services (NASDPTS). Local school district transportation directors in Georgia primarily receive information provided by the NASDPTS through mandatory annual in-service training. According to the State pupil transportation director’s office, busdriver evaluation programs are not mandatory and depend upon the size of the school district; smaller school districts often lack the manpower to conduct them. School Transportation Standards National. The National Highway Traffic Safety Administration (NHTSA) has published National Highway Safety Program Guideline No. 17, which establishes minimum recommendations for pupil transportation safety; it includes recommendations on the identification, operation, and maintenance of buses used to transport students. Georgia is among the States that have adopted guideline No. 17. Section C-2b of the guideline, which sets forth recommended practices for the routing of school buses, states: Each State should develop plans for minimizing highway use hazards to school bus and school-chartered bus passengers, other highway users, pedestrians, bicycle riders, and property. They should include, but not be limited to: (1) Careful planning and annual review of routes for safety hazards; (2) Planning routes to ensure maximum use of school buses and school-chartered buses, and to ensure that passengers are not standing while these vehicles are in operation. Association. The National Conference on School Transportation (NCST) takes place every 5 years for the purpose of developing the publication National School Transportation Specifications and Procedures. The May 2000 conference attendees included NASDPTS members from 48 States, as well as industry representatives.29 They met to address and make recommendations concerning issues that had arisen since the previous conference in 1995. 29 Hawaii and North Dakota were not represented.

Factual Information 23 Highway Accident Report The resulting document was the 2000 National School Transportation Specifications and Procedures published by the NASDPTS. The publication contains guidelines, not requirements, and includes recommendations on public address systems in school buses. It states that buses may be equipped with interior and exterior speakers, but interior speakers should not be installed within 4 feet of the driver’s seatback in its rearmost upright position. No States opposed this specification. Georgia adopted the guidelines for school bus construction contained in the 2000 National School Transportation Specifications and Procedures but has not provided guidance on radio speaker placement and operation to local school districts, which have the option of developing specifications on this issue. The NASDPTS, through a grant from NHTSA,30 recently developed a document for the “Identification and Evaluation of School Bus Route and Hazard Marking Systems,” which was incorporated in the 2000 National School Transportation Specifications and Procedures. NHTSA made the grant as a result of the Safety Board’s investigation of the 1995 Fox River Grove, Illinois, school bus accident31 and resulting recommendations32 to the NASDPTS to: H-96-52 Encourage your members to develop and implement a program for the identification of school bus route hazards and to routinely monitor and evaluate all regular and substitute school busdrivers. H-96-53 Advise your members to consider railroad/highway grade crossing accident histories or unusual roadway characteristics when establishing school bus routes. The purpose of the grant was to research the issue of school bus route hazards and marking systems, develop guidelines to identify the hazards, suggest ways to inform school bus drivers of the hazards and how to deal with the hazards, and propose methods to disseminate information to the community. Among the hazards identified were railroad/highway grade crossings. The 2000 National School Transportation Specifications and Procedures also recommends a regular review of busdrivers for compliance with regulations and of bus routes for accuracy and the presence of hazardous road conditions. At the most recent 30 NHTSA grant DTNH22-97-G-05155. 31 National Transportation Safety Board, Collision of Northeast Illinois Regional Commuter Railroad Corporation (METRA) Train and Transportation Joint Agreement School District 47/155 School Bus at Railroad/Highway Grade Crossing in Fox River Grove, Illinois, on October 25, 1995, Highway/Railroad Accident Report NTSB/HAR-96/02 (Washington, DC: NTSB, 1996). 32 Safety Recommendations H-96-52 and -53 were classified “Closed—Acceptable Action” (November 11, 1997) because the NASDPTS had provided the information requested by the Safety Board to its members.

Factual Information 24 Highway Accident Report NCST to update the practices, the committee recommended mandatory reviews but did not specify the intervals. Meteorological Information At Lovell Field Airport in Chattanooga, Tennessee, approximately 30 miles from the accident site, between 6:00 a.m. and 7:00 a.m. on March 28, 2000, the weather was clear with light winds out of the south-southeast. The temperature was 46 degrees, dew point was 39 degrees, and sunrise was at 6:33 a.m. The bus was traveling west and the train, south; therefore, the sun did not obstruct the driver’s view. Tests and Research Lap and Lap/Shoulder Belts and Seat Coverings The driver’s lap/shoulder belt webbing was severed near where it passed through the free-sliding latch plate, which remained secured in the latch plate receiver on the chassis. Loading marks33 were noted on the latch plate of the lap/shoulder belt and were visible on the D-ring. Striations in the plastic cover where the webbing passed through the latch were present along the length of the plastic. The center lap belt34 in row two on the driver side of the bus had visible indentation marks on the latch side of the webbing. No other belts showed marks. This location corresponds to the seating position of the passenger who reported she was wearing her lap belt. The seatback of row 11 on the passenger side had blue fiber scuff marks, most likely transferred to the seat cover from the passenger’s (12A) clothing. More pronounced fiber transfer occurred over creases created by the folded-over seat cover material. The curvature of the creases and the severity of heat damage indicate that at impact the passenger’s (12A) body was moving toward the right and upward. Locomotive Event Recorder The event recorder35 on the CSXT locomotive was downloaded after the accident and the data were taken to Safety Board headquarters for examination. The data showed that the locomotive was in maximum throttle position prior to the collision and that the 33 Marks indicating that a force was exerted on the belt when it was in use. 34 The latch plate of the center lap belt overlapped with the left lap belts and could be latched to the left seat buckle without the passenger being out of position. 35 The event recorder records data related to speed, time, and distance and to systems such as the horn, throttle, and bell at 1-second intervals. The times and distances stated here are estimates based on the 1- second intervals recorded.

Factual Information 25 Highway Accident Report speed immediately before brake application and collision was 51 mph. The locomotive bell had been activated after passing the last crossing, about 1.8 miles before Liberty Church Road. The locomotive passed the whistle post about 14 seconds before impact and at least 7 seconds before the horn was sounded. The horn was sounded for 3 seconds (about 952 feet from the crossing), released for 2 seconds, and then sounded for about 9 seconds before impact (beginning about 574 feet from the crossing). The locomotive was placed in emergency braking less than 2 seconds (about 122 feet) before the crossing. The train came to a stop 50 seconds after the emergency brake application (about 1,990 feet beyond the crossing). Bus Video Recorder All Murray County School District buses are equipped with a video monitoring system consisting of a videocassette recorder (VCR) and color video camera. The system on the accident bus was a Silent Witness brand (model SW210). The camera was mounted at the front and center of the bus and pointed down the length of the passenger compartment. The driver and the first two rows of seats were not within the camera’s line of sight. The camera’s field of view included the remaining seats and windows at the rear and on the driver and passenger sides of the bus. School district policy is that each bus have a separate videocassette for each day of the week stored on the bus. Each morning the driver is to remove the previous day’s videocassette from the VCR and insert the current day’s videocassette. Once a videocassette is inserted, the VCR automatically begins recording about 6 seconds after electric power is supplied (by turning on bus’s the ignition switch). When the bus is turned off, the VCR stops recording. According to school district officials, the VCR and camera are used to record passenger behavior and are reviewed only if problems are reported. The VCR from the accident bus and the videocassette in it were recovered at the accident scene. Police also removed 1 other intact videocassette, 14 videocassette reels that had separated from their cassette housings during the accident sequence, and 7 segments of loose magnetic videotape. Safety Board personnel examined the videocassette removed from the VCR, as well as the reassembled videocassettes (made from the reels found on scene). Investigators were able to identify passengers and landmarks on the videotapes, confirming that most of the videotapes had been recorded on the accident bus route. Using sound recordings, they were also able to identify the driver on the videotapes. Staff determined that the bus had crossed the railroad tracks 12 times in the videotapes, and in each instance the accident driver was driving. The bus did not stop before crossing the railroad tracks on nine occasions, including the accident, eight of which were in the 2 weeks preceding the accident; stopped twice (both times when another vehicle was present behind the bus); and in one instance too much glare was present to make a determination. Safety Board personnel identified 11 crossings on the videotape as the one on Liberty Church Road and were unable to identify the 12th crossing.

Factual Information 26 Highway Accident Report The videotape on the day of the accident revealed that the bus did not stop, that the radio was playing, and that the train horn was not audible on the video recording. Vehicle Speed Using landmarks identified on the video, Safety Board personnel were able to determine the speed of the bus as it approached the grade crossing on the day of the accident. The calculated speed, as the bus traveled downhill toward the crossing, was 25 to 30 mph. The bus slowed as it approached the crossing to a calculated speed of 15 mph at the driveway about 71 feet before the grade crossing. On the videotape, the train’s light can be seen moving across the side window bars immediately prior to impact, which helped staff calculate the bus’s speed. An exemplar bus was used to determine a likely speed for the accident bus as it traveled over the crossing. A volunteer busdriver, who was instructed to drive at a constant speed over the crossing, reported that he was most comfortable driving between 10 and 15 mph, which corresponds to the speed calculated from the video. Audibility Tests Audibility tests36 were conducted inside an exemplar bus to determine whether the driver should have been able to hear the train horn when stopped at the crossing.37 A baseline reading, established using a sound level meter located near the driver’s head, indicated an ambient sound level within the bus of 68.2 decibels38 with the engine idling, radio off, and door closed. With the radio on,39 the sound level inside the bus increased to the 71.5- to 72.4-decibel range. When traveling downhill on Liberty Church Road approaching the crossing, the interior sound level was 73 to 74 decibels with the radio off and 76.2 decibels with the radio on. When the train was stopped 1,268 feet from the crossing (at which point the test busdriver first could see the train) and the bus was stopped at 15 feet, with the radio on and door closed, the train horn was sounded and the sound level increased to 77 decibels; the volunteer driver inside the bus said he could barely hear the horn. With the radio on and the door open, the train horn was sounded and the sound level inside the bus increased to 81 decibels, and the driver stated that the train horn was discernible over the ambient noise of the bus. With the radio off and the door open, the sound level from the horn increased to 98 decibels. 36 A Bruel and Kjaer precision sound level meter, type 2232, serial number 1129820, with a wind boot was used. The sound level meter was calibrated using a Bruel and Kjaer sound level calibrator type 4230, serial number 1140357. 37 In performing these tests, the Safety Board coordinated with CSXT to ensure that no trains were approaching the crossing. 38 Decibel is the degree of loudness on a scale of 0 (least perceptible sound) to 130 (average pain level). It is a logarithmic scale, that is, an increase of 3 decibels is equivalent to doubling the sound pressure. 39 The radio volume was set at the same approximate knob location that was found on the accident bus during postaccident inspection.

Factual Information 27 Highway Accident Report Auditory Warnings Research has shown that detecting the presence of a sound will not lead to appropriate action unless the sound is identified40 or has reached the alerting level.41 If a sound is to be identified, the warning signal must be 3 to 8 decibels above the threshold of detection;42 if a sound is to reach the alerting level, the warning signal must be approximately 10 decibels above the ambient noise.43 Safety Board testing during the Fox River Grove accident investigation44 showed that at 100 feet from impact, the train horn was only 3 to 5 decibels above the ambient noise level within the school bus. Investigators also found that the crossing bell was not audible above either the ambient noise level of the school bus or that of passing traffic. Sight Distance Safety Board investigators conducted visibility testing at the accident scene. When the bus was stopped 15 feet from the nearest rail, the train crew would have been able to observe the bus when the train was 1,349 feet from the crossing. The school bus driver could see the train when it was 1,268 feet from the crossing. Geometric Design of Highways and Streets, published by the American Association of State Highway and Transportation Officials (AASHTO), states that sight distance is a primary consideration at crossings without train-activated warning devices, such as the accident crossing. AASHTO recommends that the required design sight distance along the railroad track from a crossing, for a combination of highway and train speeds, be based on a 65-foot truck crossing a single set of tracks at 90 degrees. Given a train speed of 60 mph and a vehicle departing from a stop, AASHTO recommends that the sight distance along the track from the crossing be 1,439 feet so that the truck can safely cross the tracks if a train is not seen. Using the same methodology and incorporating the accident bus length and acceleration, the school bus would have required approximately 960 feet of sight distance along the tracks when stopped 15 feet from the nearest rail to safely cross the tracks from a stop. According to CSXT officials, the railroad right of way at the Liberty Church Road grade crossing is 100 feet wide, 50 feet on each side of the track centerline. The officials stated that CSXT brush-clearing activities call for a sight distance quadrant to be clear of brush at highway grade crossings. This quadrant at the accident site is 60 feet wide—30 feet on each side of the track centerline—and extends for 200 feet on either side of the roadway. Each year, CSXT sprays this 400- by 60-foot quadrant to a distance of 12 feet on each side of the track for weed control. Every 3 years, the brush is cut 30 feet from the 40 David M. Lipscomb, “Audibility and the Law,” Forensic Audiology. 41 The “alerting level” is the sound level at which a person is aware of a sound and recognizes the source. 42 The “threshold of detection” is the sound level at which a person is aware of a sound. 43 Skeiber, Mason, and Potter, “Effectiveness of Audible Warning Devices on Emergency Vehicles,” Sound and Vibration, 1978. 44 NTSB/HAR-96/02.

Factual Information 28 Highway Accident Report centerline, which is the distance the brush-cutting machine can reach while positioned on the track. The brush at Liberty Church Road had last been cut in July or August 1998. The 400- by 60-foot quadrant contained no obstructions at the time of the accident. Accident Simulation Using a human vehicle environment system developed by Engineering Dynamics Corporation45 and Mathematical Dynamical Models (MADYMO),46 Safety Board staff conducted vehicle dynamics and occupant kinematics simulations for this investigation. Although a simulation does not replicate the actual accident, it is designed to evaluate specific mechanical and biomechanical issues for similar types of accident scenarios. Results of the vehicle dynamics simulation verified that the train was traveling about 51 mph and the bus was traveling about 15 mph at impact. The resultant peak accelerations experienced by the bus during the initial lateral impact between the train and the bus were 30 Gs47 at the center of gravity, 39 Gs at the last row of seats, and 31 Gs at the first row of seats. The peak angular acceleration at the center of gravity was approximately 2,500 deg/sec/sec. The angular accelerations were higher at the last row due to the school bus’s clockwise rotation away from the impact point, the pivoting of the bus about the front axle, and the distance of the last row of seats from the impact location. During the initial lateral impact, the velocity of the train changed by 1 to 2 mph due to emergency braking, while the lateral velocity of the bus increased to the velocity of the striking train. Because the train was much larger and heavier than the school bus, the severity of the collision was more extreme for the bus. Other Information School Bus Transportation Safety According to NHTSA, approximately 450,000 school buses are used to transport 23.5 million students to and from school over 4.2 billion miles annually throughout the United States.48 About 54 percent of the student population, kindergarten through 12th grade, ride a school bus daily to and from school. Between 1989 and 1999, NHTSA’s statistics indicate that 96 crashes occurred in which at least one passenger of a school bus 45 Staff used the Engineering Dynamics Vehicle Simulation model to determine the speed and approach direction of the bus and the Engineering Dynamics Corporation Simulation Model of Automobile Collisions to examine the lateral impact between the train and the bus, as well as the movement of the train and the bus body and chassis separately after collision. 46 For further information on MADYMO, see MADYMO User’s Manual 3D Version 5.3, TNO Road- Vehicles Research Institute, November 1997. The MADYMO simulation for this investigation was conducted in conjunction with NHTSA and Information Systems and Services, Inc., a NHTSA contractor. 47 Acceleration of gravity. 48 U.S. Department of Transportation, National Highway Traffic Safety Administration, Traffic Safety Facts 1999: School Buses, DOT HS 809 095 (Washington, DC: NHTSA, 1999).

Factual Information 29 Highway Accident Report died. Three of those crashes were railroad/highway grade crossing accidents involving school buses and resulted in 11 fatalities.49 In Georgia, about 12,600 school buses are used to transport over one million passengers annually.50 For the 1998-1999 school year, Georgia reported 790 school bus- related accidents. In those accidents, 12 busdrivers, 162 passengers, and 60 passengers of other vehicles were injured.51 No fatal injuries to busdrivers or passengers were recorded; one driver of another vehicle died as a result of fatal injuries. The last fatal accident in Georgia that involved a school bus and train occurred on October 23, 1974; it resulted in 7 fatalities and 71 injuries.52 Reporting Near Misses at Grade Crossings After the accident in Conasauga, another locomotive engineer reported to investigators that 11 days earlier, he had seen a school bus cross the tracks at Liberty Church Road without stopping. This engineer stated that on March 17, 2000, between 3:00 p.m. and 3:30 p.m., “The school bus never attempted to stop, just like there were no railroad tracks there. It never slowed down.” The school bus passed over the crossing about 500 feet ahead of the train. The engineer said he noticed the driver was a woman but that he did not look for any numbers on the bus until after it was over the crossing and going up the hill. He reported that he was unable to see any numbers on the back of the bus and was more concerned about what he had to do for the upcoming crossing. The engineer told investigators that he did not report the occurrence because he could not see the numbers on the bus. He stated that if he had been able to properly identify the bus, he would have reported the incident. According to company officials, CSXT locomotives commonly contain a placard that depicts a school bus stopped at a grade crossing while a train is approaching and instructs crews to report near misses. CSXT operation rule 100-F instructs crews to report the occurrence of a near miss, including the failure of school bus drivers to stop at crossings or to observe reasonable precautions at crossings when trains are approaching. The crew is to make such reports, detailing full information, to the CSXT Police Communications Center. If mobile access is not available, the train dispatcher may relay the information. Railroad/Highway Grade Crossing Safety The Safety Board investigated 60 accidents at passive grade crossings that occurred between December 1995 and August 1996 and, based on analysis of the findings, 49 These crashes occurred in Miltona, Minnesota, on November 16, 1989; Fox River Grove, Illinois, on October 25, 1995; and Buffalo, Montana on March 10, 1998. 50 . 51 Data provided by Georgia Department of Education, School Transportation Services. 52 Aragon, Georgia, NTSB/RHR-75/01.

Factual Information 30 Highway Accident Report issued a study53 on safety at passive grade crossings. Driver error was cited as the primary accident cause in 49 of the 60 cases. The study also noted that drivers at a passive grade crossing are not provided warnings from train-activated devices; consequently, they must rely on a system of grade crossing signs and pavement markings and on passive devices, such as crossbucks, that are designed to warn drivers only of the presence of a crossing. No element of this passive system changes to alert drivers to the presence of an oncoming train. Some conclusions reached by the safety study are: Consolidation (the separation and closure) of passive crossings is the most effective means to eliminate accidents between highway vehicles and trains. The next most desirable method to improve safety at passive crossings is to equip these crossings with active devices that warn the motorist of an oncoming train. Installation and enforcement of stop signs at passive crossings would provide for consistent information, instruction, and regulation to the motoring public and would improve the safety of the Nation’s passive grade crossings. Stop Signs At Passive Grade Crossings. The 1998 Safety Board study54 made 19 recommendations to improve safety at passive grade crossings, including one to the U.S. Department of Transportation (DOT) to: H-98-28 Provide full funding within 3 years for the installation of stop and stop ahead signs at passive grade crossings. The DOT responded on December 23, 1998, that funding is provided through 23 United States Code 13055 and 13356 and that the DOT would inform the States of the availability of such funding. The Safety Board replied on March 29, 2001, that it did not believe this action alone would meet the intent of the recommendation because it did not provide full funding. The Safety Board is awaiting further response from the DOT. 53 National Transportation Safety Board, Safety at Passive Grade Crossings, Volume 1: Analysis, Safety Study NTSB/SS-98/02 (Washington, DC: NTSB, 1998). 54 NTSB/SS-98/02. 55 Railroad-Highway Crossings Program. 56 Surface Transportation Program.

Factual Information 31 Highway Accident Report The 1998 safety study also made several recommendations to the States, including: H-98-34 Install, within 2 years of receiving Federal funding, stop signs at all passive grade crossings unless a traffic engineering analysis determines that installation of stop signs would reduce the level of safety at a crossing. Crossings where conditions are such that the installation of stop signs would reduce the level of safety should be upgraded with active warning devices or should be eliminated. Of the 11 passive crossings in Polk County and the 8 passive crossings in Murray County that were examined by Safety Board investigators, only 3 in Murray County were equipped with stop signs. No stop signs were installed at any crossings in Polk County. In discussions with the Chairman of the Safety Board on October 25, 2000, Tennessee officials indicated that they intended to install stop signs at all passive crossings but were awaiting funding; consequently, in a January 5, 2001, letter, the Safety Board classified Safety Recommendation H-98-34 “Open—Acceptable Response” for Tennessee. The Safety Board has not received a response to this recommendation from Georgia, nor from 19 other States. Of the remaining States, the recommendation has been classified “Open—Acceptable Response” for 16 States, “Open—Unacceptable Response” for 7 States, “Closed—Unacceptable Action” for 4 States, and “Closed—Acceptable Action” for 2 States (Idaho and Hawaii). The Safety Board closed the recommendation for Idaho and Hawaii because Idaho already requires installation of stop signs at passive grade crossings unless an engineering study dictates otherwise (the only State with this requirement) and because Hawaii only has two passive grade crossings, for which stop signs have already been installed. The Manual on Uniform Traffic Control Devices, published by the Federal Highway Administration (FHWA), establishes national standards for traffic control devices and all States are required to be in substantial conformance with the manual.57 Concerning the use of stop signs at grade crossings, it states: At the discretion of the responsible State or local highway authority, STOP (R1-1) or YIELD (R1-2) signs may be used at highway-rail grade crossings that have two or more trains per day and are without automatic traffic control devices.58 Installation of Active Warning Devices. According to the FRA’s grade crossing inventory, Tennessee has about 2,145 passive grade crossings. The State receives Federal funds for the installation of active warning devices at railroad/highway grade crossings and installs 35 to 45 such devices each year.59 Tennessee uses the Federal Railroad Administration’s (FRA’s) hazard index to help determine which grade crossings should 57 U.S. Department of Transportation, Federal Highway Administration, MUTCD 2000: Manual on Uniform Traffic Control Devices, Millennium Edition (Washington, DC: FHWA, 2000). 58 Page 8B-7. 59 In 1999, the State installed 15 active warning devices.

Factual Information 32 Highway Accident Report receive an active warning device or an upgrade of an existing device. The index includes data such as the amount of railroad traffic, the amount of highway traffic, the speeds involved, and grade crossing accident history. Because of the widely varying conditions and circumstances at grade crossings (for example, types of vehicles using the crossing, sight distance, and location), Tennessee uses a diagnostic team comprising employees of the State department of transportation and the railroads to make the final selections. Tennessee law requires that a railroad install an active warning device at a grade crossing where a collision between a motor vehicle or pedestrian and a train results in a fatality. Installation of the warning device is funded by the railroad, the State, and the county or local municipality at a cost of about $150,000 for lights and gates.60 Before this collision, the Liberty Church Road crossing had not been designated for improvement. Following the accident, on September 9, 2000, it was upgraded to an active crossing with gates and lights. DOT Highway Rail Crossing Inventory and Hazard Index. The FRA compiles and maintains the DOT’s Highway Rail Crossing Inventory61 to assist the States in conducting their own grade crossing safety programs. In examining the database, the Safety Board found discrepancies between information contained in the database and existing conditions at the accident crossing and other crossings in the area. Investigators looked at 10 crossings in the Liberty Church Road vicinity and found that the inventory listed the track speed as 10 mph less than the actual speed in seven instances and did not list the track speed at all in one instance. The inventory listed 13 trains per day for five crossings, 16 trains per day for four crossings, and did not list the number of trains for one crossing. CSXT reported 30 to 35 trains traveling over each crossing daily. States often use information from the inventory to develop a hazard index for railroad/highway grade crossings. The FRA itself developed a Web-based Accident Prediction System (WBAPS) that is based, in part, on information from the inventory, and on data such as the type of warning device at the grade crossing, the exposure index,62 and the number of accidents at the location in the past 5 years. A private company, under contract to the FRA, completed an analysis of the WBAPS in June 1999, comparing the performance of the FRA model to other models used to predict accidents. The study found that differences were minimal and that no model retained a substantial edge over another.63 The public can use the WBAPS to help determine where best to direct highway grade crossing resources.64 Law enforcement personnel can use the system to target unsafe crossings for monitoring. 60 NTSB/SS-98/02. 61 Database intended to document every grade crossing in the United States http://safetydata.fra.dot.gov/officeofsafety/Crossing/Default.asp. 62 The exposure index includes the number of trains per day, the number of cars traversing the grade crossing, and the fastest train speed on the track. 63 May 8, 2000, letter from the Secretary of Transportation to the Chairman of the National Transportation Safety Board. 64 U.S. Department of Transportation, Federal Railroad Administration, “Using Data Produced by WBAPS Disclaimer.”

Factual Information 33 Highway Accident Report According to an FRA official, about half the States have devised their own hazard indexes for evaluating grade crossings. Tennessee uses the DOT’s Rail Highway Crossing Resource Allocation Procedure User’s Guide65 to prioritize crossings for upgrade. To determine the hazard index of crossings, the guide applies the FRA accident prediction formula, which is similar to the WBAPS. Under 23 CFR 924, States are required to incorporate the relative hazard of railroad/highway grade crossings into their highway safety improvement program based on a hazard index formula. Initiatives Related to Passive Grade Crossings and School Buses. On October 16, 2000, as a result of this accident, the Chairman suggested four safety initiatives in a letter66 to the Governor of Tennessee that could be implemented to enhance the safety of citizens at passive grade crossings. These four initiatives were: Install warning devices at passive grade crossings The Safety Board has recommended (Safety Recommendation H-98-34) that stop signs be installed at all grade crossings that do not have active devices such as gates and lights. The Chairman urged the Governor of Tennessee to consider immediately installing warning devices at all passive crossings traversed daily by school buses. Strengthen criteria for the installation of active warning devices The Chairman encouraged the Governor to include the number and frequency with which school buses cross passive grade crossings as a factor in determining whether to install stop signs or active warning devices at those crossings. Strengthen Tennessee’s CDL manual and exam to include questions related to passive grade crossings The Safety Board has recommended (Safety Recommendation H-98-37)67 that the States include questions on safety at passive grade crossings in every version of the States’ written commercial driver license examinations to reinforce the actions that commercial drivers, including school bus drivers, should take when encountering grade crossings. Install noise reducing switches In order to better hear the train horn at grade crossings, Florida and Kentucky are in the process of installing manual “option kill switches” in their school buses so that 65 DOT/FRA/OS-87/10. 66 See appendix B for the letter in its entirety. 67 Safety Recommendation H-98-37 requests that the States “ensure that questions on safety at passive grade crossings are included in every version of the State’s written drivers examination.” This recommendation has been classified “Closed—Acceptable Action” for 3 States, “Closed—Acceptable Alternate Action” for 10 States, “Open—Acceptable Response” for 12 States, and “Open—Unacceptable Response” for 1 State. The Safety Board has yet to receive a response from 24 States, including Georgia and Tennessee.

Factual Information 34 Highway Accident Report drivers can turn off noise-producing devices, including fans and radios, when they come to a grade crossing. In-Vehicle Warning Systems In-vehicle warning and advisory systems transmit alerts to highway vehicles to warn of the presence of approaching trains. A two-point system consists of train-to- vehicle communication, that is, a signal is broadcast by a transmitter on the locomotive to a receiver on the approaching highway vehicle. A three-point system uses a roadside device to detect a train and transmit the information to a vehicle-based receiver.68 The addition of global positioning system (GPS) technology to either the two- or three-point system can improve accuracy by providing the train’s estimated arrival time. Current systems are designed to alert drivers no more than 20 seconds before a train’s arrival, the same amount of time as drivers are alerted at active grade crossings. In 1997, the Minnesota Department of Transportation tested a three-point system in a school district in which 30 system-equipped buses each crossed two to five grade crossings per day.69 School bus drivers were surveyed to determine their perception of the system, and 80 percent of them thought that the system provided valuable warning information; 15 percent reported that the system affected their driving behavior. One survey respondent stated that the system helped her avoid a crash.70 In 2000, the Intelligent Transportation Systems Program Office of the Illinois Department of Transportation conducted a pilot study of a three-point system at grade crossings near Chicago. The 300 test vehicles included school buses, emergency service vehicles, and commercial vehicles that regularly traversed five active grade crossings where train detection devices were already in place. This study used off-the-shelf technology and evaluated driver perceptions of on-board warning system effectiveness, including the in-vehicle receiver position, warning display methods, and overall system reliability.71 Final results from the Illinois study are due in spring 2002. According to the system evaluator, preliminary results indicate that drivers liked getting the additional warnings, although they would have preferred an earlier warning, before the lights and gates were activated.72 One school bus driver said she liked the reassurance that the systems gave her when she approached a grade crossing. Overall, the drivers’ impressions 68 Hoy A. Richards and Richard T. Bartoskewitz, The Intelligent Highway-Rail Intersection Integrating ITS and ATCS for Improved Grade Crossing Operation and Safety (College Station, TX: Richards & Associates and Texas Transportation Institute, April 1995). 69 Amy Polk, An In-Vehicle Signing System for School Buses at Rail-Highway Grade Crossings, Minnesota Department of Transportation, 1996. 70 Amy Ellen Polk, “The Use of ITS to Improve Safety and Mobility at Highway-Rail Grade Crossings,” http://www.nawgits.com/icdn/its_hri.html. 71 Pilot Study of Advisory On-Board Vehicle Warning Systems at Railroad Grade Crossings, Executive Summary, Illinois Department of Transportation, 1997. 72 Dr. Ray Benekohol, Associate Professor of Civil Engineering, University of Illinois, July 18, 2001, telephone conversation.

Factual Information 35 Highway Accident Report were positive and they believed the device would be effective at passive grade crossings. The in-vehicle device is projected to cost about $100. The transmitters used in the test cost about $20,000 to $30,000, but the system evaluator believes the cost is likely to drop if more are produced. Automatic Crash Notification Systems Automatic crash notification (ACN) systems are vehicle-based systems that detect when a crash has occurred and then automatically notify the local 911 center. They can reduce the time that elapses between the accident and the arrival of emergency response personnel on scene.73 Some research indicates that reducing notification time from the current average of 9 minutes after a crash to 1 minute would save an estimated 3,000 lives per year.74 ACN systems can differ in both the way in which a crash is detected and the way in which information is transmitted to an emergency response center. Some ACN systems activate when the driver’s airbag deploys (the driver’s airbag does not deploy in certain types of crashes, such as side impacts and rollovers). Other ACN systems use orthogonal accelerometers, which activate the system when a certain deceleration threshold is reached and can also provide an estimate of crash severity (such systems would detect accidents in all types of crashes). Information can be transmitted either directly to local police or to a customer service center (CSC), which functions as an intermediary between the vehicle and a 911 center. If transmittal is through a CSC, the center can help determine the severity of the crash and relay that information to the emergency responders. Direct transmittal to the emergency responders can decrease response time. Publicly sponsored tests using ACN systems have been conducted in Colorado, Washington, Minnesota, and New York.75 Based on test results, researchers have identified several areas that need improvement. First, ACN systems are heavily reliant on cellular telephone coverage to open a communication line and to transmit data. In rural areas, where ACN can have great impact, cellular coverage may be sparse, although even in rural areas coverage is growing rapidly. Second, the interface between CSCs and 911 centers can pose a challenge. If a call goes to a CSC, the CSC must determine the closest 911 center to the accident and then place a 10-digit telephone call to that center. The CSC itself cannot dial 911 because the call would go to the 911 center closest to the CSC, not necessarily the one closest to the crash. Third, GPS accuracy has been an issue. When the tests were conducted, nonmilitary GPS receivers could only provide geolocation information within about 120 meters because of deliberate errors embedded in the signal. These errors have since been removed, thereby increasing the accuracy of the systems. 73 http://www.nhtsa.dot.gov/cars/problems/studies/acns/champion.htm. 74 W. Evanco, “Reducing Accident Fatalities with Rural Mayday Systems,” Mitretek Systems, Inc., WN96W0000048, in U.S. Department of Transportation, Federal Highway Administration, Review of ITS Benefits: Emerging Successes, FHWA-JPO-97-001, HVH 1/10-96(1M0) E (Washington, DC: FHWA, 1996) 19. 75 A. Blatt, E. Bellis, B. Donnelly, D. Funke, R. McClellan, and G. Wilson, Automated Collision Notification, Final Report (Washington, DC: NHTSA, October 31, 2000).

Factual Information 36 Highway Accident Report Cellular providers were required to provide geolocation ability for all calls by October 2001.76 The Federal Communications Commission extended this date (the new deadline varies by carrier)77 when none of the carriers met the October 2001 deadline. In March 1997, as part of the ACN system used in the New York operational test, a software program, URGENCY,78 was developed to improve computer-assisted dispatch of rescue resources. With the input of several parameters from crash data recorders, such as crash force, type of crash, and passenger data, the software determines the likelihood of a serious injury. This feature can help emergency responders determine the appropriate level of response prior to arrival on scene. The costs of ACN systems vary from $200 to $1,000 per vehicle, depending on available options, including nonemergency services such as directions. ACN systems are already available on some passenger cars and open a communication line with a CSC if the airbag is deployed or the driver presses an emergency button. These systems incorporate the vehicle-equipped GPS locating function. 76 . 77 http://www.fcc.gov/bureaus/wireless/news_releases/2001/nw10127a.txt. 78 http://www.nhtsa.dot.gov/cars/problesm/studies/acns/champion.htm.

37 Highway Accident Report Analysis General During the past 30 years, Safety Board recommendations have led to significant improvements in the transportation of school bus passengers. Statistically, school buses are among the Nation’s safest modes of transportation. Yet, as this accident demonstrates, certain issues pertaining to school bus safety, although previously addressed by the Board, continue to require attention. In the following analysis, the Safety Board will first exclude factors that neither caused nor contributed to the accident and then examine those factors that led to or had a role in the accident. The discussion will focus on the school bus driver’s performance; school district oversight, including busdriver monitoring and evaluation procedures and bus routing; passive grade crossing safety, including previous initiatives related to passive grade crossing and school bus safety; school bus crashworthiness and survival factors, including occupant kinematics; and emergency response. Exclusions The weather was clear and dry at the time of the accident and, although the sun had just risen, neither the school bus driver nor the locomotive engineer identified the sun as an impairment to visibility. Neither maintenance records for the 1-year-old school bus, nor postaccident inspection of the vehicle, indicated any mechanical problems that may have hampered operation of the vehicle. A review of daily track inspection records in the 6 months prior to the collision showed no anomalies, and postaccident inspection of the track did not reveal any problems. A review of maintenance records and inspections both before and after the accident disclosed no mechanical problems with either the locomotive or the train. The locomotive engineer and conductor were experienced in operating trains over the territory in which this accident occurred. They tested the brakes, as required, and complied with wayside signal indications and specified track speeds. Both the engineer and conductor had passed numerous efficiency tests in the previous year, exceeding Federal testing requirements. Data from the event recorder corroborated the engineer’s and conductor’s statements about what they did prior to impact.

Analysis 38 Highway Accident Report A survey of the accident site did not reveal sight restrictions. Investigators calculated that the school bus driver had adequate distance to see the train had she stopped as required. Toxicological tests performed on the blood and urine specimens taken from the train conductor, the engineer, and the busdriver were negative for alcohol and illicit drugs. Toxicological tests of the busdriver’s blood and urine specimens did reveal the presence of phenylpropanolamine in the urine and the presence of pseudoephedrine and ephedrine in both specimens. Pseudoephedrine, a common decongestant with the trade name Sudafed, is found in many over-the-counter cold and allergy preparations. It does not usually result in impairment and has been shown to have stimulant effects. Ephedrine is sold as an over- the-counter asthma medication (trade name Primatene). It too does not usually result in impairment and is a stimulant. Ephedrine and pseudoephedrine are often found together in the herbal supplement Ma Huang, also known as “ephedra,” which is used as an “energy booster,” stimulant, weight loss product, or decongestant in many nutritional supplements. Phenylpropanolamine, an over-the-counter decongestant, is also marketed as a weight loss product and is a metabolite of ephedrine and pseudoephedrine. The Food and Drug Administration requested that manufacturers withdraw it from the market in November 2000 due to a very small, but measurable, increased risk for stroke associated with its use, primarily in women taking it for weight loss. Nonetheless, phenylpropanolamine usually does not result in impairment and has stimulant effects. Therefore, the Safety Board concludes that the weather, the mechanical condition of the school bus and train, and the condition of the track did not cause or contribute to the accident; the locomotive engineer and conductor were qualified and complied with Federal regulations; the sight distance along the tracks was adequate for the school bus driver to see an oncoming train; and neither alcohol nor drugs was a factor in the accident. Accident Analysis Georgia and Tennessee law require that school bus drivers stop the bus before crossing railroad tracks, open the door and window, turn off the radio, look both ways, and proceed when clear. An analysis of the videotape found on the bus showed that the school bus was traveling about 25 mph to 30 mph down Liberty Church Road and had reduced its speed to about 15 mph prior to the crossing. The videotape also recorded the driver’s failure to stop. The window and door were not visible on the videotape, but no sounds associated with opening either one were audible. Had the busdriver stopped 15 feet from the crossing, as required, she would have been able to see 1,268 feet down the tracks and to observe the approaching train. Had the busdriver turned off the radio and opened the door and window, as required, she probably would have heard the train horn. The Safety Board therefore concludes that if the busdriver had followed the required procedures at the grade crossing, that is, if she had stopped at least 15 feet from the nearest rail, turned off

Analysis 39 Highway Accident Report her radio, and opened the door and window, she would have seen and heard the train and avoided the accident. In a postaccident interview, the busdriver stated that she stopped, looked both ways, opened the door, looked in her rear view mirror to make sure the passengers were seated, then looked both ways down the track and proceeded. However, the school bus videotape contradicts this statement. Nor was the busdriver’s behavior on this occasion an isolated incident; her actions were indicative of complacency at grade crossings. As recorded on the accident bus videotapes, the driver drove over the same railroad crossing, without stopping, eight other times. Another train engineer reported seeing a female school bus driver cross the railroad tracks in front of his train at the same location on a previous occasion, although he did not report the incident at the time that he witnessed it. The accident driver was the only female school bus driver to regularly traverse the Liberty Church Road crossing. The Murray County School District provides annual recertification training for all busdrivers. This training, which the accident driver had received on August 12, 1999, includes information on what drivers are required to do at railroad/highway grade crossings. The driver also received training on the same subject from her previous employer and was reprimanded for talking during the lesson. The fact that the driver told police investigators that she stopped and opened the door shows that she knew the regulations for school buses crossing railroad tracks. The Safety Board concludes that although the driver had been educated on and knew the mandatory safety precautions at railroad/highway grade crossings, she disregarded the required procedures and crossed the railroad tracks without stopping on the day of the accident and at least eight other times before the accident. The accident driver crossed the Liberty Church Road railroad tracks daily when operating over her regular route. In its 1998 study on safety at passive grade crossings,79 the Safety Board concluded: A driver’s decision to look for a train may be adversely affected by the driver’s familiarity with and expectations at a specific passive grade crossing and the driver’s experience with passive crossings in general. The accident busdriver may have become complacent; she had not stopped at the crossing on at least eight other occasions and, therefore, even though trains passed this crossing daily between 6:00 a.m. and 7:00 a.m., may not have perceived the danger associated with railroad/highway grade crossings. The annual training she had received apparently was insufficient to reinforce to the driver the hazards associated with grade crossings. 79 NTSB/SS-98/02, p. 61.

Analysis 40 Highway Accident Report On January 25, 1985, the Safety Board issued a recommendation on monitoring school bus driver compliance at grade crossings to the state directors of pupil transportation of the 50 States and the District of Columbia: H-85-4 Encourage local school jurisdictions to establish and enforce procedures to systematically monitor schoolbus driver compliance with railroad crossing stop requirements and routing requirements which include on-scene observations of driver performance. Georgia responded that the superintendent or staff monitored each school bus route annually and that drivers were encouraged to report any unsafe crossings. The recommendation was classified “Closed—Acceptable Action” for Georgia on November 18, 1993.80 The NASDPT’s National School Transportation Specifications and Procedures recommends that pupil transportation directors monitor and evaluate school bus drivers in the performance of their duties.81 Based on a review of the Murray County School District files, neither the accident driver nor any other driver had been monitored or received a performance evaluation. Observing and evaluating drivers allows problems to be detected and addressed before an accident occurs. In this case, in which the driver had frequently ignored proper procedures at passive grade crossings by crossing the tracks without stopping, ample opportunity existed for the transportation director (or a representative) to have observed the driver’s behavior, reviewed the videotapes, or both, and taken corrective action. While the videotapes are intended to monitor passenger behavior, they can also be used to observe driver behavior and to educate drivers on proper actions, as necessary. Without an evaluation program in place, the school district had no proactive means of identifying drivers who were operating their buses in an unsafe manner. The Safety Board concludes that the Murray County School District did not monitor drivers nor identify and correct improper behavior, thus missing the opportunity to observe this driver’s behavior at railroad/highway grade crossings. Since the accident, Murray County has implemented a program under which supervisors follow drivers who are operating school buses to evaluate their performance. The county has also been working more closely with Operation Lifesaver to provide mandatory driver training about grade crossing safety. Grade Crossings In its 1998 study on safety at passive grade crossings, the Safety Board recommended that all passive grade crossings be equipped with highway stop signs, at a 80 Safety Recommendation H-85-4 is classified “Closed—Acceptable Action” for 48 States and the District of Columbia and “Closed—No Longer Applicable” for 2 States. 81 The NASDPTS recommendation was in response to Safety Recommendations H-96-52 and -53.

Analysis 41 Highway Accident Report minimum. Only Idaho and Hawaii have taken the initiative to install stop signs at all passive grade crossings. In its September 8, 2000, response, the Tennessee Department of Transportation reported that the Tennessee Highway/Railroad Grade Crossing Task Force was studying the issue of placing stop signs at grade crossings and had already gathered considerable data, particularly for school bus routes. Tennessee has enhanced safety at the accident crossing by installing an active crossing warning device there; State law requires that Tennessee install active warning devices where a fatality has occurred. While eliminating railroad/highway grade crossings or activating them with lights and gates is ideal, the Safety Board understands that activating crossings can be expensive; installing stop signs is a less costly solution. Had the accident driver stopped the school bus at the crossing and looked for the train, she would have been able to see it and probably would not have crossed in front of it. The sight distance along the tracks for a vehicle 15 feet from the crossing was sufficient to allow a stopped driver to see a train approaching. While State laws already require that school bus drivers stop at all grade crossings, drivers can benefit from being reminded about this requirement, and a stop sign provides that reinforcement. Moreover, passengers riding the bus are unlikely to know that all school buses are supposed to stop at grade crossings. If a stop sign is present, it is possible that passengers may question a driver if he or she does not stop or may tell their parents or teachers that the busdriver failed to stop, providing another means of oversight. The Safety Board therefore concludes that had a stop sign been present at the crossing, it would have reinforced to the driver the need to stop before crossing the tracks, likely prompting her to stop and not attempt to cross in front of the train. Auditory Alerts Locomotive event recorder data indicate that the train horn was activated for about 3 seconds when the train was 952 feet from the crossing and then continuously for 9 seconds (a minimum of 574 feet) before the collision. The busdriver had the radio and overhead speaker on. Additionally, the two panels above the driver’s head were covered with sound attenuation material. To be identified, a sound must be 3 to 9 decibels above the threshold of detection;82 to reach the alerting level, it must be at least 10 decibels above the ambient noise level.83 With the door closed and the radio on (the conditions at the time of the accident), audibility testing revealed that the sound of the horn was only 5 decibels greater than the ambient noise when the train was 1,268 feet from the crossing and was barely detectable to the volunteer busdriver. Since the sound level increases by about 6 decibels when the distance is halved, at 574 feet, the sound of the horn would have been about 11 decibels above the threshold of detection. During the accident, with the radio on and the door and window closed, the audio portion of the videotape did not pick up the sound of the horn over the ambient noise. During testing, with the radio off and the door open, even at 1,268 feet, the sound level of the horn was 26 decibels above that of the 82 The “threshold of detection” is the level at which a person is aware of a sound. 83 Stanley C. Skeiber, Robert L. Mason, and R. C. Potter “Effectiveness of Audible Warning Devices on Emergency Vehicles, Sound and Vibration,” February 1978, pp. 14-22.

Analysis 42 Highway Accident Report ambient noise, and a driver would probably be able to detect the sound and be alerted to the approaching train. Therefore, the Safety Board concludes that the driver did not stop, had the radio on, and the door closed; thus she had difficulty detecting the train horn and was probably unaware of the presence of the train. The Safety Board made two recommendations concerning bus speakers to the NASDPTS in the 1996 Fox River Grove highway accident report: H-96-50 Develop guidelines for the appropriate placement of radio speakers and use of radios on school buses and disseminate these guidelines to your members. H-96-51 Advise your members to check their school district buses and disable any radio speakers located immediately adjacent to the school bus drivers’ heads. The NASDPTS informed the Safety Board that it had surveyed the States and found that a majority of the States had prohibited, or had legislation pending that prohibited, radio speakers in the driver’s compartment. The remaining States reviewed their policies on use of radios and radio speakers in school buses and stated that the policies were adequate to ensure that drivers can hear critical auditory information. Georgia informed its local school districts of the need to follow proper procedures, including turning off speakers, when crossing railroad tracks. The State did not require school districts to disconnect the speakers adjacent to the driver’s head; Georgia left that decision to the local school districts. In October 1998, the National Safety Council revised its “Recommended Procedures for School Bus Drivers at Railroad Grade Crossings” to remind drivers of the importance of turning off radios at railroad/highway grade crossings; the revision was incorporated in the 2000 National School Transportation Specifications and Procedures. Based on the NASDPTS survey and the association’s efforts to inform its members of the hazards of not turning off the radio at grade crossings, Safety Recommendations H-96-50 and -51 were classified “Closed—Acceptable Alternate Action”84 on February 19, 1999. Despite the NASDPTS’s efforts, the 1-year-old school bus involved in this accident was equipped with a radio speaker adjacent to the driver’s head. In addition, the driver did not follow prescribed policy to turn down the volume at railroad/highway grade crossings. Consequently, the Safety Board believes that the Georgia Department of Education should require all school districts to disconnect radio speakers used for music or entertainment that are adjacent to school bus drivers’ heads. The Safety Board understands from the NASDPTS’s response to Safety Recommendations H-96-50 and -51 that the speakers are also used to transmit important information to the driver via two-way 84 The recommendations received this classification because the actions taken met the intent of the recommendations, even though formal guidelines were not developed and school districts were reminded of the hazards of speaker use when approaching railroad tracks, but were not specifically told to disable the speakers.

Analysis 43 Highway Accident Report radio from the school district dispatcher. While the Safety Board agrees that information from the dispatcher is important, use of the speakers for music or entertainment broadcasts is not critical and can hamper the driver’s ability to hear external auditory alerts. Because of the urgent need that drivers receive auditory alerts while operating a school bus, the Safety Board believes that school bus manufacturers should discontinue the installation in school buses of radio speakers used for music or entertainment that are adjacent to the driver’s head. The Safety Board further believes that NHTSA should implement rulemaking to prohibit radio speakers used for music or entertainment from being placed adjacent to drivers’ heads in school buses. Speakers adjacent to a school bus driver’s head probably contribute the most to masking exterior sounds, such as train horns, but air conditioning, heaters, defrosters, wiper motors, and other sounds also help mask exterior sounds. Therefore, Florida and Kentucky have begun to install noise-canceling switches in school buses. The interrupt- type switches are spring-loaded to prevent drivers from permanently overriding normal operation of noise-producing equipment. When pressed, noise in the driver’s area is reduced, improving the driver’s ability to listen for audible warnings. The Safety Board concludes that if activated prior to a grade crossing, a switch that turns off all nonessential noise-making components, including, but not limited to, the radio, can help drivers hear train horns and stop as necessary. In its Fox River Grove accident investigation report, the Safety Board recommended that NHTSA: H-96-43 Determine what effect school bus sound attenuation materials have on the ability of a busdriver to discern both interior and exterior audible warnings. NHTSA responded on April 22, 1997, that it would survey bus manufacturers on the effect of sound attenuation materials, evaluate the data, and conduct testing, if necessary. The agency also discussed in-vehicle warning systems that were undergoing testing. Therefore, the Safety Board classified the recommendation “Open—Acceptable Response” on August 11, 1997. Subsequently, on October 27, 2000, NHTSA wrote: The agency does not believe that the use of specifications for sound attenuation materials is the most effective approach for warning school bus drivers at railroad crossings. Another means of preventing these types of tragic train-motor vehicle collisions is by the use of in-vehicle warning systems. NHTSA believes that an alternate solution to warn drivers at railroad grade crossings that a train is approaching can be obtained by using intelligent transportation systems technology. We plan to determine the applicability of this technology to warn school bus drivers at railroad grade crossings that a train is approaching instead of testing sound attenuation materials.

Analysis 44 Highway Accident Report The Safety Board responded that while the installation of vehicle warning systems is desirable for the future, the technology is still years away from implementation, and a more active approach is needed to protect passengers being transported in school buses over railroad crossings. Because of NHTSA’s inaction in determining the effect of sound attenuation materials, and the 4 years that had elapsed in the interim, the Safety Board classified Safety Recommendation H-96-43 “Closed—Unacceptable Action” on April 18, 2001. The accident school bus was equipped with sound attenuation material above the driver’s head. While it is unclear how much this material contributed to the driver’s inability to hear the train horn, it may have absorbed some of the horn sound. The Safety Board remains concerned about the effects of sound attenuation material on a driver’s ability to hear an alerting signal. As explained in the Fox River Grove report,85 sound attenuation material reduced the volume of both the train horn and the warnings shouted by bus passengers in that accident. In-Vehicle Warning Systems An in-vehicle warning system receives information about an approaching train either from the train itself or through the infrastructure and provides an auditory and visual warning inside the vehicle to the driver. In its response to Safety Recommendation H-96- 43, NHTSA cited in-vehicle warning systems as a solution to the audibility problem that drivers encounter when a vehicle is equipped with sound attenuation materials. NHTSA stated that it would determine the applicability of such systems, which alert drivers to oncoming trains, to school buses. Yet to date, no further testing of in-vehicle warning systems for school buses has taken place, beyond the test completed in 2000 by the Minnesota Department of Transportation and one that will be completed in 2002 by the Illinois Department of Transportation that was not specific to school buses. This is the only progress that has been made in this area to date. The Safety Board is pleased that the DOT recognizes the importance of installing in-vehicle warning systems, but is concerned about the pace at which such systems are being tested and installed in school buses. Had the accident school bus been equipped with an in-vehicle warning system, the driver may have realized that a train was approaching and may have stopped prior to the crossing. An alert would have been activated as the bus approached the crossing (the distance at which activation is triggered depends on the train’s speed but allows enough time for a bus to stop prior to the crossing). The Safety Board concludes that an in-vehicle warning system to alert drivers of the presence of an oncoming train would have provided the busdriver with additional information, likely prompting her to stop before crossing the tracks. In its 1998 study on safety at passive grade crossings, the Safety Board recommended that the DOT: 85 NTSB/HAR-96/02, p. 47.

Analysis 45 Highway Accident Report I-98-1 Develop and implement a field test program for in-vehicle safety and advisory warning systems, variable message signs, and other active devices; then ensure that the private entities who are developing advanced technology applications modify those applications as appropriate for use at passive grade crossings. Following the modifications, take action to implement use of the advanced technology applications. On February 10, 1999, the Safety Board classified Safety Recommendation I-98-1 “Open—Acceptable Response,” based on the DOT’s response that it is supporting railroad/highway grade crossing projects in several locations. However, the DOT did not specify how it planned to guide the implementation of such systems at passive grade crossings and has provided no further response concerning this recommendation. In the Safety Board’s opinion, the technologies described in the recommendation, particularly in-vehicle warning systems, can help enhance school bus safety at passive grade crossings. Therefore, the Safety Board is reiterating recommendation I-98-1 to the DOT. Grade Crossing Inventory and Hazard Prediction The FRA maintains the nationwide grade crossing inventory. As part of the 1998 passive grade crossing study, the Safety Board made the following recommendation concerning this system: R-98-41 Modify the grade crossing inventory system to include information on (1) the sight distances available to a motorist, and (2) the presence of curves on the roadway and on the tracks. Direct the States to include these data as a part of the regularly scheduled updates of the database. Because the FRA updated the grade crossing inventory database to include recommended elements, on January 4, 2000, the Safety Board classified Safety Recommendation R-98-41 “Closed—Acceptable Action.” However, as investigators discovered, some information in the inventory is still outdated and incorrect. Of 10 sites in the area of the accident crossing surveyed by Safety Board investigators, the inventory listed incorrect maximum train speeds for 8 and incorrect number of trains per day for all 10. In its April 6, 1999, response to Safety Recommendation R-98-41, the FRA stated that such discrepancies occur because updating the information is voluntary and the FRA lacks the authority to require States or railroads to upgrade information in the inventory. The FRA has encouraged the States to provide up-to-date information for the inventory, but the States have not done so. The FHWA gives funds to the States annually for highway

Analysis 46 Highway Accident Report safety, including grade crossing safety and maintaining a survey of all grade crossings, and provision of these funds could be contingent on updating the inventory regularly. Because the States and others rely on this inventory for determining hazards and predicting accidents at grade crossings, inaccurate information can lead to invalid assessments. For example, the inventory lists the Liberty Church Road crossing as having 13 trains per day at a speed of 50 mph, which underestimates the 30 to 35 trains per day passing through at a maximum of 60 mph. When these underestimates are factored into equations that help users determine relative hazards, the resulting hazard index is similarly understated and hazardous grade crossings may not be recognized as such. Therefore, the Safety Board concludes that though critical to assessing grade crossing hazards, the data in the Highway-Rail Grade Crossing Inventory are not always accurate and complete. The Safety Board believes that the FHWA should require States to update the Highway-Rail Crossing Inventory to accurately reflect current railroad operations. About half the States use their own hazard index to determine priorities for upgrading passive grade crossings to active crossings. Some, such as North Carolina, plan to factor school buses into their formula. North Carolina has indicated that it will not only consider whether school buses use a crossing but will also rank passive crossings according to number of school bus trips over them and load data. Including such factors assigns higher priority to school bus crossings and results in upgrading the safety of these crossings more quickly than if the standard hazard index is used. At the time of the accident, two school buses used the Liberty Church Road crossing daily. The Safety Board concludes that had Tennessee factored school bus use into its grade crossing hazard index, the accident crossing may have had a higher priority for receiving funds to install active warning devices. Although the WBAPS, the FRA’s Web-based accident prediction system, is primarily a tool for States to use in determining funding authority, law enforcement agencies also use it to identify and monitor unsafe grade crossings. If the crossing inventory in the WBAPS were accurate, school districts could also find the WBAPS helpful in establishing school bus routes and identifying hazardous crossings. While the inventory is not up-to-date, it represents the most comprehensive source of data available and does permit hazard identification. Ideally, school bus routes should exclude passive grade crossings; when that is not possible, the WBAPS or the State’s own grade crossing index could help school districts determine the least hazardous crossing. Such use further emphasizes the need for maximum accuracy in these inventories. The Safety Board concludes that the FRA’s WBAPS or a State’s grade crossing hazard index, as part of the school bus routing hazard identification program, could help school districts select the safest school bus routes. The Safety Board believes that the NASDPTS should encourage its members to use the FRA’s Web-based accident prediction system or the States’ hazard indexes for grade crossings when developing school bus routes.

Analysis 47 Highway Accident Report School Bus Routing In reviewing documents pertaining to Murray County school bus routes, investigators determined that route hazards, including grade crossings, apparently were not identified, nor were busdrivers told (other than through annual training) what actions to take in the area of potential hazards. In 1996, the Safety Board recommended to the NASDPTS: H-96-52 Encourage your members to develop and implement a program for the identification of school bus route hazards and to routinely monitor and evaluate all regular and substitute school bus drivers. In its response to the Safety Board, the NASDPTS stated: Where it is possible to re-route the school bus to avoid a potential hazard, that is the preferred action. Where it is not possible or feasible to change the school bus route to avoid a potential hazard, then those hazards should be clearly and prominently highlighted on the school bus route document that is provided to the operator of the school bus. Additionally, a full description of what action(s) the school bus driver should take in the area of the potential hazard should be provided to the driver…. Drivers should be evaluated on a routine basis to ensure that they remain knowledgeable on route hazard identification and action plans. In June 1998, the NASDPTS, in cooperation with NHTSA, published guidance on school bus routing that reflects its position as stated above and distributed the guidance to States and localities. The Safety Board classified Safety Recommendation H-96-52 “Closed—Acceptable Action” on November 7, 1997. The guidance is also now part of the National School Transportation Specifications and Procedures. The Murray County transportation director has stated that all routes have been reviewed since the accident and, as necessary, rerouted to use gated railroad crossings. The routes were also reviewed and, as appropriate, adjusted for other hazards, such as unsafe turns, curves, and pick-up and drop-off locations. Safety Initiatives for Passive Grade Crossings and School Buses Although the Safety Board has issued numerous recommendations, as previously cited, to improve school bus and grade crossing safety, needless accidents, such as this one at Conasauga, continue to occur. Following the accident, the Safety Board developed four initiatives, based on previous safety recommendations that, if implemented by the States, could reduce the number of grade crossing accidents involving school buses. Such a program would include upgrading passive crossings, improving school bus routing, monitoring driver performance, enhancing driver training and testing, and reducing the noise inside the bus.

Analysis 48 Highway Accident Report The Safety Board believes that the States, in cooperation with the NASDPTS, should develop and implement a program of initiatives for passive grade crossings and school buses that includes (1) installation of stop signs at passive crossings that are traversed by school buses except where an engineering study shows their installation would create a greater hazard; (2) use of information about whether school buses routinely cross passive grade crossings as a factor in selecting crossings to upgrade with active warning devices; (3) a requirement that all newly purchased and in-service school buses be equipped with noise-reducing switches; (4) enhanced school bus driver training and evaluation, including periodic reviews of on-board videotapes where available, especially with regard to driver performance at grade crossings; and (5) incorporation of questions on passive grade crossings in the CDL manual and examination. Survival Factors and Occupant Kinematics The school bus was extensively damaged during the collision, and the bus body separated from the chassis behind the driver’s seat. Within the passenger compartment, the rows of seats in the impact area sustained massive crush damage, which decreased longitudinally away from the impact area. The driver’s seat separated from the body of the bus and remained with the chassis, while the passenger seats remained within the body. All window glazing on the passenger (impact) side of the bus was broken, while on the driver side the window glazing remained intact, except for the first window. Despite severe damage in the impact area of the bus, which is not unusual in a side impact collision with a train locomotive at 51 mph, the bus body otherwise remained intact. The MADYMO simulation generally showed that during the impact, the simulated passengers rapidly traveled laterally and slightly forward toward the passenger side of the bus. Those already seated on the passenger side quickly struck the sidewall and windows of the bus, while those on the driver side typically struck the side of the adjacent seatback and then continued across the width of the bus. The remainder of this section will discuss both the evidence found on scene and the results of the occupant kinematics simulation. During the accident, the lap-belted passenger received minor injuries, three passengers (two of whom were ejected) received serious injuries, and three passengers sustained fatal injuries (one of whom was ejected). The passenger seated behind the driver in row two (seat 2A) was restrained by a lap belt and remained within the bus body. This passenger sustained minor abdominal blunt force injuries along the line of the lap belt. In the simulation, this passenger’s upper body pivoted laterally toward the right and slightly forward about the belt. Predicted injuries were low for this passenger when restrained by the lap belt. Bruising is the most common injury from a lap belt and results from force applied by either the diagonal or transverse lap strap.86 The lap belt acts as a fulcrum for flailing of the upper body and lower extremities.87 86 Bernard Knight, Forensic Pathology (New York: Oxford University Press, 1991) 260. 87 J.K. Mason, The Pathology of Violent Injury (London: Edward Arnold, 1978) 28.

Analysis 49 Highway Accident Report The availability of a lap belt restraint system and the size of this passenger (4 feet 5 inches tall and 117 pounds) enabled a properly fitted restraint system88 and permitted ride- down89 within the vehicle during this accident. In addition, this passenger remained within the seating compartment90 and, unlike the two unbelted and ejected front-row passengers, was not exposed to injury-causing objects and surfaces inside and outside the vehicle. The Safety Board concludes that the lap belt-restrained passenger sustained minor abdominal injuries as a result of the severity of the accident and the pivoting of her body about the lap belt. Further, she was not ejected due to the use and proper fitting of the available restraint. The two passengers ejected from the front row (seats 1A and 1F) sustained serious injuries, including closed head injuries, and were seated in the area that was exposed following separation of the bus body from the chassis. (The modesty panel in front of this row remained intact). They were not wearing the available lap belts, did not remain within the seating compartment, and, therefore, were ejected through the front opening of the bus body during its rotation and deceleration. In addition, one of the two passengers (in seat 1F) was pinned underneath the front right corner of the bus body after it came to rest. The simulation showed that during the initial collision, these passengers struck interior, non- energy absorbing surfaces, including the side of the modesty panel91 (passenger in seat 1A) and the sidewall (passenger in seat 1F). The seats and the modesty panel conformed to FMVSS 222 criteria for absorbing impact and dissipating collision energy from a passenger striking the seat during a frontal impact. These standards were not developed for a passenger striking the side of the seat in a lateral impact. The passengers in seats 1A and 1F were then ejected and struck the exterior surfaces at the same speed at which they were ejected from the vehicle. The full ride-down effect was not afforded to these unbelted front-row passengers, particularly the passenger in 1A, who was ejected shortly after separation. Although physical evidence was not found that would have permitted investigators to determine what objects the passengers struck to obtain their injuries, both passengers probably sustained serious injuries as a result of having struck interior and exterior surfaces. The simulations predicted injuries to these unrestrained front-row passengers as they contacted the side of the modesty panel (passenger in seat 1A) and the sidewall of the bus (passenger in seat 1F). When restrained 88 Incorrectly adjusted or positioned straps can increase the danger of injury. Loose straps allow movement of the body prior to the point at which restraint occurs. If a person, such as a child, is too small for the lap belt, the body may slide from under the strap and sustain injury. See Bernard Knight, Forensic Pathology (New York: Oxford University Press, 1991) 260. 89 Ride-down is the gradual deceleration experienced by passengers who remain within the compartment of a vehicle and attached to the vehicle during its movement before coming to rest. If a passenger is attached to the vehicle, he or she can take advantage of all the energy absorbed by the vehicle later in the crash. 90 In school buses, compartmentalization protects passengers during frontal impacts. It affords this protection through closely spaced seats, covering of the seat cushions and high seatbacks with an energy- absorbing material, and deformation of the seatback when impacted. The entire seat structure is designed to absorb energy and to dissipate the energy of the crash away from the passenger and into the surrounding compartment. 91 The modesty panels and seatbacks are designed to absorb energy in a frontal or rear collision. Although the sides of the modesty panel and seatbacks are padded, there are no specifications for these to absorb energy when struck during the lateral motion of an passenger.

Analysis 50 Highway Accident Report by a lap belt only or a lap/shoulder belt, the passengers were retained within the seating compartment, and the level of predicted injury was reduced for both passengers. The Safety Board concludes that had the available restraints in the first row been worn in this accident and had they fit properly, the two front-row passengers probably would not have been ejected during the accident sequence and the level of injury may have been reduced. The Safety Board also concludes that components within the passenger compartment that are not fitted with energy-absorbing materials can contribute to serious injuries when passengers strike them during an accident sequence. Although the three passengers seated in the middle section of the bus remained within the bus body during the accident, they sustained serious and fatal injuries. The locomotive struck this section of the vehicle, resulting in major intrusion damage and interior compartment deformation, thereby reducing the amount of survivable space. The passenger seated on the driver side across from the impact area (seat 6A) was propelled out of his seating compartment toward the intruding locomotive. He sustained a closed head injury, right first rib fracture,92 and facial lacerations. The two passengers seated on the passenger side of the bus (seats 6F and 8F) remained within their compartments; they sustained blunt force trauma injuries to the head, thorax, and upper abdominal regions. Although injuries were still predicted for the passenger across from the impact area (seat 6A), the simulation results indicated that the level of injury was reduced when a lap/shoulder belt restrained this passenger. Furthermore, this passenger was retained within the seating compartment and therefore not exposed to the interior deformation when restrained by both the lap only belt and the lap/shoulder belt. The Safety Board concludes that the seriously injured passenger across from the impact area (seat 6A) sustained his injuries due to incomplete lateral compartmentalization and that all three passengers (seats 6A, 6F, and 8F) in the impact area sustained injuries as a result of locomotive intrusion and exposure to high impact forces. Fiber evidence indicated that the rearmost-seated passenger on the driver side of the bus (seat 12A) struck the side of the adjacent seatback and traveled laterally and upward to the right. Blood evidence in the vehicle indicated that he then struck the right sidewall and surface of the overhead storage rack support and frame. Postaccident examination of this passenger, who was fatally injured, revealed chest abrasions and linear contusions indicative of a contact injury; the pattern of these contusions matched the size and shape of the window frame screw housing. Internal examination showed a transected aorta93 and lacerated right atrium, in addition to multiple fractures and internal lacerations. Although subsequently ejected from the bus, this passenger probably sustained his fatal lacerated aortic injury within the vehicle during the first moments of the accident sequence. 92 First rib fractures are rare unless extreme force is applied to the upper torso. See David Viano, Chest: Anatomy, Types and Mechanisms of Injury, Tolerance Criteria and Limits, and Injury Factors, AAAM and IRCOBI Biomechanics of Trauma Course Book, October 1997, p. 9. 93 The aorta is fixed and unyielding at the aortic ligament level, and this type of fatal injury is usually seen in intersection-type crashes in which the jarring effect on the chest organs shears the aorta. From: Werner U. Spitz, ed., Spitz and Fisher’s Medicolegal Investigation of Death: Guidelines for the Application of Pathology to Crime Investigation, Third Edition (Springfield, IL: Charles C. Thomas, 1993) 549.

Analysis 51 Highway Accident Report The simulation showed that this passenger moved out of the driver side seating compartment, struck the adjacent seatback, and continued laterally until the point of impact with the window structure and sidewall, resulting in a predicted injury that corresponded to the on-scene evidence. Simulation results indicated that the forces applied to this passenger upon impact with the sidewall components were greater than those applied to any other passenger away from the impact area in the bus, possibly due to the high lateral and rotational accelerations at this seating location. Although this passenger principally sustained blunt force trauma to the chest, the forces were sufficiently high that the simulation predicted head, neck, and chest injuries when the passenger struck the sidewall and window screw frame housing. A likely source of his fatal injury was the passenger’s deceleration into the non-energy absorbing interior surfaces, including the interior right sidewall and the window frame screw housing, during the initial severe lateral impact from the locomotive. The passenger struck these surfaces due to incomplete compartmentalization in a lateral impact. Therefore, the Safety Board concludes that the rearmost-seated passenger sustained fatal injuries due to movement out of the seating compartment and subsequent impact with non-energy absorbing interior components. Unlike the results from the passengers seated away from the impact area in the front and center of the bus, the simulation predicted high levels of injury for the passenger in seat 12A when restrained by a lap belt only and a lap/shoulder belt. The combination of large lateral and rotational accelerations in this region of the bus caused this passenger to decelerate rapidly, even when restrained, resulting in predicted injuries in all restraint conditions. The following table (table 2) details the actual injuries sustained by the bus passengers and the injuries predicted by the simulation. Although the injuries are not identical, the trends are evident, especially for the passenger in seat 2A. This passenger sustained only minor injuries during the accident sequence. The simulation indicated that had this passenger not worn the available lap belt, the passenger would have been exposed to a similar level of injury as the two front-row passengers.

Analysis 52 Highway Accident Report Table 2. Summary of predicted injuries to the simulated occupants based on the bus simulation. On September 21, 1999, the Safety Board adopted a special investigation report on bus crashworthiness issues94 in which the Board found that some passengers not seated in the intrusion area were seriously or fatally injured in school buses involved in lateral impacts with large vehicles. The Safety Board concluded: Current compartmentalization is incomplete in that it does not protect school bus passengers during lateral impacts with vehicles of large mass and in rollovers, because in such accidents, passengers do not always remain completely within the seating compartment. Seating location Segment Actual injuries Unrestrained Lap belt only Lap/shoulder belt 1A (E) Head Thorax Neck √ √ √ √ √ 1F (E) Head Thorax Neck √ √ √ √ √ √ √ 2A (+) Head Thorax Neck √ √ √ 6A Head Thorax Neck √ √ √ √ √ √ √ √ √ 6F () Head Thorax Neck √ √ √ √ √ √ √ √ √ 8F () Head Thorax Neck √ √ √ √ √ √ √ √ √ √ 12A (*E) Head Thorax Neck √ √ √ √ √ √ √ √ √ √ √ = predicted injury

• = fatally injured passenger

E = ejected passenger

• = passenger wearing available restraint device

94 National Transportation Safety Board, Bus Crashworthiness Issues. Highway Special Investigation Report NTHSB/SIR-99/04 (Washington, DC: NTSB, 1999).

Analysis 53 Highway Accident Report The Safety Board recommended that NHTSA: H-99-45 In 2 years, develop performance standards for school bus occupant protection systems that account for frontal impact collisions, side impact collisions, rear impact collisions, and rollovers. NHTSA is conducting a study to develop ways to enhance the safety of the interior environment for school bus passengers. The agency completed front and side impact full- scale crash testing in 2000 and is publishing the results. NHTSA expects to release its research on frontal impact testing this winter. The side impact testing and research report will not be completed until fall 2002. Safety Recommendation H-99-45 was classified “Open—Acceptable Response” on April 18, 2001. Preliminary results from the frontal impact test showed that three available options—no restraint, lap belt only, and lap/shoulder belts—offer varying degrees of benefit to the passenger and that passenger size, seat spacing, and proper usage affect the protection capabilities of the restraint system. Preliminary results from NHTSA’s side impact crash test showed that crash test dummies away from the impact area do not travel across the width of the bus and strike the sidewall or other non-energy absorbing surfaces. Injury values were low for dummies away from the impact area. In this accident, as well as other school bus accidents the Safety Board has investigated, passengers sustained serious or fatal injuries due to impact with sidewall components (differing from NHTSA’s results). The unrestrained passengers on the driver side of the bus in this accident were propelled out of their seating compartment and received serious or fatal injuries as a result of such impacts. In several accidents discussed in the Safety Board’s Bus Crashworthiness Issues report (Holmdel, New Jersey; Monticello, Minnesota; and Easton, Maryland), passengers away from the impact area were also propelled laterally out of their seating compartment and sustained serious and fatal injuries due to contacting non-energy absorbing surfaces. Even passengers seated on the same side as, but not in, the area of impact (such as the passenger in seat 1F in this accident), have struck non-energy absorbing sidewalls and components during a collision. In the Fox River Grove accident, a passenger seated away from the impact area but on the same side of the bus as the impact sustained a fatal head injury and an abrasion across the forehead that matched the perforated sound attenuation panel pattern on the upper left side of the bus interior. The Safety Board concludes that even those passengers who are outside the area of impact and remain within their compartment can receive serious or fatal injuries due to impact with non-energy absorbing components within a school bus. Sidewall components, such as window frames, screws and joints, and overhead storage rack supports are located throughout the interior of the passenger compartment, as are the sides of the seatframes,95 yet are exempt from the Federal Motor Vehicle Safety 95 Or in the case of the first row in this accident, the modesty panels.

Analysis 54 Highway Accident Report Standards for passenger protection in school buses. Although energy-absorbing materials on the window frames, sidewall panels, roof racks, sides of seatframes and modesty panels might benefit passengers who impact these locations, school bus passengers are not afforded the benefit of energy-absorbing surfaces on these structures and components. If these components were included in the passenger protection requirements of FMVSS 222, “School Bus Passenger Seating and Crash Protection,” passenger injuries would probably be mitigated. The Safety Board concludes that FMVSS 222 exempts sidewall components and sides of seatframes within the passenger compartment of school buses, thereby exposing passengers to these injury-producing components in lateral impact collisions. The Safety Board believes that NHTSA should develop and incorporate into the Federal Motor Vehicle Safety Standards performance standards for school buses that address passenger protection for sidewalls, sidewall components, and seatframes. In this accident, the school bus body separated from the chassis. The separation and subsequent distance traveled by the bus body are likely to have provided further ride- down for passengers after the collision, although the separation resulted in an opening at the front of the body through which the two passengers and driver were ejected. In other accidents96 the Safety Board has investigated, the body and chassis have also separated, providing similar ride-down benefits to passengers remaining within the bus body. What the Safety Board observed in this accident, but not in others, is the unique location in which the body and chassis separated. In the Conasauga accident vehicle, the school bus body separated behind the driver’s seat; the engine cowling, front floor, and driver’s seat remained attached to the chassis. In other school bus accidents, the complete body (including the driver’s seat and flooring) and chassis have separated from one another. The location of the body separation in this accident probably occurred because of the bus’s movement immediately following the collision. Tire marks on the inside of the rail indicated that the school bus wheels were temporarily hung up on the track as the bus rotated away from the striking train. The tire catching on the rails may have initially induced the separation between the body and chassis. The location of the separation, behind the driver’s seat, may have resulted from the impact with the railroad cross buck near that location and from the fact that the body is attached to the chassis by more rigid bolts under the driver’s seat than at other locations. The Safety Board has investigated two other accidents97 involving bus body- chassis separation in which the driver’s seat was equipped with a lap/shoulder belt. In both, the body and chassis separated completely and the driver’s seat and belt system remained with the bus body. In neither accident did the lap/shoulder belt become separated between the anchor points. Both the lap and shoulder belts remained intact and attached to the body of the bus. 96 Rehobeth, Massachusetts, January 10, 1984 (DCA-84-FH-005); Carrsville, Virginia, April 12, 1984 (DCA-84-AH-008); Palm Springs, California, July 31, 1991 (DCA-91-MH-005); Fox River Grove, Illinois, October 25, 1995 (CRH-96-MH-002); and Buffalo, Montana, March 10, 1998 (HWY-98-MH-022). 97 Fox River Grove, Illinois (CRH-96-MH-002), and Buffalo, Montana (HWY-98-MH-022). Both involved AmTran school buses.

Analysis 55 Highway Accident Report In this accident, the upper anchorage (D-ring) and emergency retractor of the driver’s continuous lap/shoulder belt was mounted to the bus body side panel approximately 16 inches behind the driver’s seat. The lower anchorages were mounted to the seat and attached to the floor with tethers directly under the driver’s seat. When the body separated, the driver’s seat, the seat-mounted lap belt components, and part of the lap/shoulder belt remained with the chassis, while the D-ring mounted on the sidewall and part of the shoulder belt remained with the bus body. The body separation resulted in high forces exerted on the belt webbing system, which tore, and the driver was ejected from the separating vehicle components. The driver sustained minor injuries. Because the driver’s lap/shoulder belt was attached to both the bus body floor and the sidewall, with one anchor point remaining with the body and the others with the chassis, great forces were exerted on the belt. When the distance between anchor points is broad and the body separates anywhere between these points, the webbing may cause injury to the driver because of forces exerted on the webbing as the two components separate. In this accident, the webbing failed, and the driver was ejected before the belt exerted serious or fatal forces on her. While the Safety Board has not seen body separations in this location before, it is concerned that drivers can sustain serious or fatal injuries if the lap/shoulder belt anchor points are sufficiently far apart that a vehicle separation between the points results in extreme forces exerted on the driver by the webbing during an accident. The Safety Board concludes that the driver’s lap/shoulder belt webbing failed due to the high forces applied to the webbing as the two parts of the school bus separated and due to the large distance between the lap/shoulder belt anchor points. Manufacturers should be aware of the potential consequences associated with lap/shoulder belt anchor points that are far apart. If the anchor points are closer together, the likelihood of a body separation occurring between them can be reduced, thereby lessening the risk of injury. The NASDPTS’s School Bus Manufacturers Technical Council functions as an industry advisor to school bus manufacturers and the Safety Board believes that it should notify its members of how and why the driver’s lap/shoulder belt tore in this accident and of the potential consequences of large longitudinal distances between lap/shoulder belt anchor points. Emergency Response Almost immediately after the accident, a passerby placed a 911 cellular telephone call and reported the accident. Even though the accident occurred in Polk County, Tennessee, the call was routed to the Murray County, Georgia, 911 Center because the cellular tower automatically relayed the cellular call to the closest 911 center. EMS units, located within 2 miles of the scene, were immediately dispatched and arrived on scene within minutes. The caller did not know the exact location of the accident because Polk County does not have street signs. Emergency response was not hindered because the caller was familiar with the area and described it in sufficient detail that emergency responders immediately identified where the accident occurred. The caller also called

Analysis 56 Highway Accident Report back 4 minutes later, after she went to St. Claire’s gas station and learned the name of the street. The CSXT Police Communications Center placed its emergency call to local police about 7 minutes after the accident. No other calls reporting the accident were recorded. The accident occurred in a rural area where traffic is not heavy. An ACN system on the school bus would have detected the crash immediately and transmitted the crash information, as well as the precise location, obtained via GPS, to the local 911 center. Had such a system been in place, the school bus passengers would not have had to rely on a passerby to place the call or on the driver, who was incapacitated, to call 911. In this accident, the locomotive conductor notified CSXT of the accident, and CSXT then notified the 911 center; but not all accidents involve vehicles in which the driver (or in this case the train crew) is able to place an emergency call. Because school buses often carry many children, quick and adequate emergency response is important if all children are to be treated expeditiously, particularly those with serious injuries. The more information provided to an emergency dispatch center, the better the response is likely to be. An ACN system can transmit information on the severity of the crash, the vehicle dynamics, and the location. Some systems include a voice communication line that automatically opens so that the emergency response center can communicate directly with the driver, if the driver is capable. If the school bus in this accident had been equipped with an ACN system, a call would have immediately been forwarded to the 911 center, either directly or through a relay center, and the 911 dispatcher would have known the exact location of the accident. A more advanced ACN system would have relayed information about the severity of the crash, indicating to the dispatcher a need to send multiple responders. The time lag would most likely have been less than 2 minutes from the time of the collision to the time when emergency response was dispatched. Currently available ACN systems have helped reduce emergency response time, thereby leading to more lives saved.98 In the operational test in New York, an emergency notification was sent to the sheriff’s office within 2 minutes of the accidents that occurred.99 Cellular telephone system coverage has expanded and geolocation systems have become more accurate; as a result, ACN system accuracy has improved. While the school bus passengers in this accident were fortunate in the actions of a quick-thinking passerby and a train crew that was able to place an emergency call, severe accidents, particularly in rural areas, do not always occur in such circumstances. 98 W. Evanco “Reducing Accident Fatalities with Rural Mayday Systems,” Mitretek Systems, Inc. WN96W0000048, April 1996, in U.S. Department of Transportation, Federal Highway Administration, Review of ITS Benefits: Emerging Successes, FHWA-JPO-97-001, HVH 1/10-96(1M0) E (Washington, DC: FHWA) 19. 99 B. Donnelly, D. Schabel, A.J. Blatt, and A. Carter, “The Automated Collision Notification System.” International Symposium on Transportation Recorders, May 3-5, 1999 (Washington, DC: NTSB and International Transportation Safety Association, 1999).

Analysis 57 Highway Accident Report The Safety Board concludes that, in spite of a lack of street signs or a street address, emergency responders to this accident were able to efficiently coordinate their response operations and provided timely, appropriate medical services and rescue operations, in part because of the 911 caller’s prompt action and familiarity with the accident area. However, in other accidents, passersby may not be present or callers contacting a 911 center may not be familiar with the local area. In such situations, ACN systems can help emergency call centers dispatch emergency responders to locations more expeditiously, particularly in rural areas or when drivers are incapacitated. The Safety Board concludes that, given the limited amount of traffic traversing Liberty Church Road, emergency response might have been delayed if the passerby had not noticed the accident or if the train crew had been incapacitated. While ACN systems are already available on cars, testing of such systems on school buses has yet to be done. While the cellular and GPS technology would be compatible with any vehicle, testing of ACN systems on school buses is needed to evaluate factors such as vehicle dynamics and crash severity. The Safety Board believes that NHTSA should evaluate the feasibility of incorporating ACN systems on school buses and, if feasible, proceed with system development.

58 Highway Accident Report Conclusions Findings 1. The weather, the mechanical condition of the school bus and train, and the condition of the track did not cause or contribute to the accident; the locomotive engineer and conductor were qualified and complied with Federal regulations; the sight distance along the tracks was adequate for the school bus driver to see an oncoming train; and neither alcohol nor drugs was a factor in the accident. 2. If the busdriver had followed the required procedures at the grade crossing, that is, if she had stopped at least 15 feet from the nearest rail, turned off her radio, and opened the door and window, she would have seen and heard the train and avoided the accident. 3. The driver did not stop, had the radio on, and the door closed; thus she had difficulty detecting the train horn and was probably unaware of the presence of the train. 4. Although the driver had been educated on and knew the mandatory safety precautions at railroad/highway grade crossings, she disregarded the required procedures and crossed the railroad tracks without stopping on the day of the accident and at least eight other times before the accident. 5. The Murray County School District did not monitor drivers nor identify and correct improper behavior, thus missing the opportunity to observe this driver’s behavior at railroad/highway grade crossings. 6. Had a stop sign been present at the crossing, it would have reinforced to the driver the need to stop before crossing the tracks, likely prompting her to stop and not attempt to cross in front of the train. 7. If activated prior to a grade crossing, a switch that turns off all nonessential noise- making components, including, but not limited to, the radio, can help drivers hear train horns and stop as necessary. 8. An in-vehicle warning system to alert drivers of the presence of an oncoming train would have provided the busdriver with additional information, likely prompting her to stop before crossing the tracks. 9. Though critical to assessing grade crossing hazards, the data in the Highway-Rail Grade Crossing Inventory are not always accurate and complete.

Conclusions 59 Highway Accident Report

1. Had Tennessee factored school bus use into its grade crossing hazard index, the

accident crossing may have had a higher priority for receiving funds to install active warning devices.

1. The Federal Railroad Administration’s Web-based Accident Prediction System or a

State’s grade crossing hazard index, as part of the school bus routing hazard identification program, could help school districts select the safest school bus routes.

1. The lap belt-restrained passenger sustained minor abdominal injuries as a result of the

severity of the accident and the pivoting of her body about the lap belt; she was not ejected due to the use and proper fitting of the available restraint.

1. Had the available restraints in the first row been appropriately worn in this accident

and had they fit properly, the two front-row passengers probably would not have been ejected during the accident sequence and the level of injury may have been reduced.

1. Components within the passenger compartment that are not fitted with energy-

absorbing materials can contribute to serious injuries when passengers strike them during an accident sequence.

1. The seriously injured passenger across from the impact area (seat 6A) sustained his

injuries due to incomplete lateral compartmentalization, and all three passengers (seats 6A, 6F, and 8F) in the impact area sustained injuries as a result of locomotive intrusion and exposure to high impact forces.

1. The rearmost-seated passenger sustained fatal injuries due to movement out of the

seating compartment and subsequent impact with non-energy absorbing interior components.

1. Even those passengers who are outside the area of impact and remain within their

compartment can receive serious or fatal injuries due to impact with non-energy absorbing components within a school bus.

1. Federal Motor Vehicle Safety Standard 222 exempts sidewall components and sides

of seatframes within the passenger compartment of school buses, thereby exposing passengers to these injury-producing components in lateral impact collisions.

1. The driver’s lap/shoulder belt webbing failed due to the high forces applied to the

webbing as the two parts of the school bus separated and due to the large distance between the lap/shoulder belt anchor points.

1. In spite of a lack of street name signs or a street address, emergency responders to this

accident were able to efficiently coordinate their response operations and provided timely, appropriate medical services and rescue operations, in part because of the 911 caller’s prompt action and familiarity with the accident area.

Conclusions 60 Highway Accident Report

1. Given the limited amount of traffic traversing Liberty Church Road, emergency

response might have been delayed if the passerby had not noticed the accident or if the train crew had been incapacitated. Probable Cause The National Transportation Safety Board determines that the probable cause of the collision was the school bus driver’s failure to stop before traversing the railroad/highway grade crossing. Contributing to the accident was the Murray County, Georgia, School District’s failure to monitor busdriver performance and its lack of school bus route planning to identify hazards on school bus routes and to eliminate the necessity of crossing railroad tracks. Contributing to the injuries of the school bus passengers outside of the area of intrusion were incomplete compartmentalization and a lack of energy-absorbing material on interior surfaces.

61 Highway Accident Report Recommendations To the States: In cooperation with the National Association of State Directors of Pupil Transportation Services, develop and implement a program of initiatives for passive grade crossings and school buses that includes (1) installation of stop signs at passive crossings that are traversed by school buses except where an engineering study shows their installation would create a greater hazard; (2) use of information about whether school buses routinely cross passive grade crossings as a factor in selecting crossings to upgrade with active warning devices; (3) a requirement that all newly purchased and in- service school buses be equipped with noise-reducing switches; (4) enhanced school bus driver training and evaluation, including periodic reviews of on-board videotapes where available, especially with regard to driver performance at grade crossings; and (5) incorporation of questions on passive grade crossings in the commercial driver’s license manual and examination. (H-01-38) To the National Highway Traffic Safety Administration: Implement rulemaking to prohibit radio speakers used for music or entertainment from being placed adjacent to drivers’ heads in school buses. (H-01-39) Develop and incorporate into the Federal Motor Vehicle Safety Standards performance standards for school buses that address passenger protection for sidewalls, sidewall components, and seatframes. (H-01-40) Evaluate the feasibility of incorporating automatic crash notification systems on school buses and, if feasible, proceed with system development. (H-01-41) To the Federal Highway Administration: Require States to update the Highway-Rail Crossing Inventory to accurately reflect current railroad operations. (H-01-42) To the Georgia Department of Education: Require all school districts to disconnect radio speakers used for music or entertainment that are adjacent to school bus drivers’ heads. (H-01-43)

Recommendations 62 Highway Accident Report To the National Association of State Directors of Pupil Transportation Services: Encourage your members to use the Federal Railroad Administration’s Web-based accident prediction system or the States’ hazard indexes for grade crossings when developing school bus routes. (H-01-44) In cooperation with the States, develop and implement a program of initiatives for passive grade crossings and school buses that includes (1) installation of stop signs at passive crossings that are traversed by school buses except where an engineering study shows their installation would create a greater hazard; (2) use of information about whether school buses routinely cross passive grade crossings as a factor in selecting crossings to upgrade with active warning devices; (3) a requirement that all newly purchased school buses and in-service school buses be equipped with noise-reducing switches; (4) enhanced school bus driver training and evaluation, including periodic reviews of on-board videotapes where available, especially with regard to driver performance at grade crossings; and (5) incorporation of questions on passive grade crossings in the commercial driver’s license manual and examination. (H-01-45) Notify your members of how and why the driver’s lap/shoulder belt tore in this accident and of the potential consequences of large longitudinal distances between lap/shoulder belt anchor points. (H-01-46) To the School Bus Manufacturers: Discontinue the installation in school buses of radio speakers used for music or entertainment that are adjacent to the driver’s head. (H-01-47) The National Transportation Safety Board also reiterates the following recommendation: To the U.S. Department of Transportation: Develop and implement a field test program for in-vehicle safety and advisory warning systems, variable message signs, and other active devices; then ensure that the private entities who are developing advance technology applications modify those applications as appropriate for use at passive grade crossings. Following the modifications, take action to implement use of the advanced technology applications. (I-98-01)

Recommendations 63 Highway Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: December 11, 2001

64 Highway Accident Report Appendix A Investigation and Public Hearing The National Transportation Safety Board was notified of the Conasauga, Tennessee, accident about 8:00 a.m. on March 28, 2000. An investigative team was dispatched with members from the Washington, D.C.; Atlanta, Georgia; Parsippany, New Jersey; and Fort Worth, Texas, offices. Groups were established to investigate human performance; motor carrier operations; highway, vehicle, and survival factors; and recorders and to document the scene. Participating in the investigation were representatives of the National Highway Traffic Safety Administration; the Federal Motor Carrier Safety Administration; the Federal Railroad Administration; the Tennessee Highway Patrol; the Polk County, Tennessee, District Attorney; CSX Transportation, Inc.; and the Murray County, Georgia, School District. No public hearing was held; no depositions were taken.

65 Highway Accident Report Appendix B October 2000 Letter to the Governor of Tennessee From the Chairman, National Transportation Safety Board

Appendix B 66 Highway Accident Report

Appendix B 67 Highway Accident Report

FD07236 ｜ 2001_美国_HAR2001.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator Mountain View, California March 23, 2018

Accident Report NTSB/HAR-20/01 PB2020-100112

National Transportation Safety Board

NTSB/HAR-20/01 PB2020-100112 Notation 59775 Adopted February 25, 2020

Highway Accident Report Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator Mountain View, California March 23, 2018

National Transportation Safety Board

490 L’Enfant Plaza SW Washington, DC 20594

National Transportation Safety Board. 2020. Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator, Mountain View, California, March 23, 2018. Highway Accident Report NTSB/HAR-20/01. Washington, DC. Abstract: On Friday, March 23, 2018, at 9:27 a.m., a 2017 Tesla Model X P100D electric-powered sport utility vehicle (SUV), occupied by a 38-year-old male driver, was traveling south on US Highway 101 (US-101) in Mountain View, Santa Clara County, California. As the Tesla approached a paved gore area dividing the main travel lanes of US-101 from the left exit ramp to State Route 85 (SR-85), the vehicle moved to the left and entered the gore. It continued traveling through the gore and struck a previously damaged and nonoperational crash attenuator at a speed of about 71 mph. The impact rotated the SUV counterclockwise and caused the front body structure to separate from the rear of the vehicle. The Tesla was involved in subsequent collisions with two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4. The Tesla’s high-voltage battery was breached in the collision and a postcrash fire ensued. The driver was transported to a local hospital, where he died from blunt-force trauma injuries. The driver of the Mazda sustained minor injuries, and the driver of the Audi was uninjured. From its investigation of this crash, the National Transportation Safety Board (NTSB) identified the following safety issues: • Driver distraction • Risk mitigation pertaining to monitoring driver engagement • Risk assessment pertaining to operational design domain • Limitations of collision avoidance systems • Insufficient federal oversight of partial driving automation systems • Need for event data recording requirements for driving automation systems, and • Highway infrastructure issues On the basis of its findings, the NTSB makes safety recommendations to the US Department of Transportation, the National Highway Traffic Safety Administration, the Occupational Safety and Health Administration, SAE International, Tesla, Apple, and manufacturers of portable electronic devices. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, section 1154(b). For more detailed background information on this report, visit www.ntsb.gov and search for NTSB accident ID HWY18FH011. Recent publications are also available in their entirety on this website. Other information about available publications also may be obtained from the website or by contacting: National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551 Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service’s National Technical Reports Library at https://ntrl.ntis.gov/NTRL/. This product may be accessed using product number PB2020-100112. For additional assistance, contact: National Technical Information Service (www.ntis.gov) 5301 Shawnee Rd., Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 NOTE: This report was reissued on March 20, 2020, with a correction to page 65, clarifying that Member Jennifer Homendy was joined in her concurring statement by all Board Members (Chairman Robert L. Sumwalt, III; Vice Chairman Bruce Landsberg; and Members Thomas B. Chapman and Michael E. Graham).

NTSB

Highway Accident Report i Contents Figures ......................................................................................................................................... iii Acronyms and Abbreviations .................................................................................................... iv Terminology Related to Driving Automation Systems .......................................................... vii Executive Summary.................................................................................................................... ix 1 Factual Information ................................................................................................................. 1 1.1 Crash Summary ....................................................................................................................... 1 1.2 Operational Performance Data ................................................................................................ 4 1.3 Emergency Response............................................................................................................... 6 1.4 Occupant Restraints ................................................................................................................. 7 1.5 Vehicle Factors ........................................................................................................................ 9 1.5.1 Tesla SUV ..................................................................................................................... 9 1.5.2 Mazda 3 Car ................................................................................................................ 11 1.5.3 Audi A4 Car ................................................................................................................ 12 1.6 Tesla Autopilot ...................................................................................................................... 12 1.6.1 Autopilot Description .................................................................................................. 12 1.6.2 Autopilot Limitations .................................................................................................. 14 1.6.3 Autopilot Constraints .................................................................................................. 14 1.6.4 Postcrash Changes to Autopilot .................................................................................. 16 1.7 Tesla Collision Avoidance Systems ...................................................................................... 16 1.8 Tesla Driver Factors .............................................................................................................. 17 1.8.1 Background ................................................................................................................. 17 1.8.2 Cell Phone Usage ........................................................................................................ 18 1.8.3 Warnings for Hands Off Wheel .................................................................................. 20 1.8.4 Vehicle Familiarity and Handling ............................................................................... 20 1.9 Highway Factors .................................................................................................................... 21 1.9.1 Description and General Characteristics ..................................................................... 21 1.9.2 Gore Area .................................................................................................................... 21 1.9.3 Crash Attenuator ......................................................................................................... 23 1.10 Weather and Illumination .................................................................................................... 26 1.11 Other NTSB Investigations of Tesla Crashes with Autopilot Activated ............................. 26 1.11.1 Williston, Florida (May 7, 2016) .............................................................................. 26 1.11.2 Culver City, California (January 22, 2018) ............................................................... 27 1.11.3 Delray Beach, Florida (March 1, 2019) .................................................................... 28

NTSB

Highway Accident Report ii 2 Analysis .................................................................................................................................... 30 2.1 Introduction ........................................................................................................................... 30 2.2 Mountain View Crash Discussion ......................................................................................... 31 2.2.1 Crash Sequence ........................................................................................................... 31 2.2.2 Autopilot Performance ................................................................................................ 31 2.2.3 Collision Avoidance System Performance .................................................................. 32 2.2.4 Driver Distraction ........................................................................................................ 33 2.2.5 Highway Infrastructure Issues ..................................................................................... 41 2.3 Safety Issues Found in Partial Driving Automation Crashes ................................................ 43 2.3.1 Risk Mitigation Pertaining to Monitoring Driver Engagement .................................. 43 2.3.2 Risk Assessment Pertaining to Operational Design Domain ...................................... 46 2.3.3 Limitations of Collision Avoidance Systems .............................................................. 49 2.3.4 Insufficient Federal Oversight of Partial Driving Automation Systems ..................... 50 2.4 Need for Event Data Recorders for Driving Automation Systems ....................................... 52 3 Conclusions ............................................................................................................................. 55 3.1 Findings ................................................................................................................................. 55 3.2 Probable Cause ...................................................................................................................... 58 4 Recommendations................................................................................................................... 59 4.1 New Recommendations ......................................................................................................... 59 4.2 Previously Issued Recommendations Reiterated in This Report .......................................... 60 4.3 Previously Issued Recommendations Reiterated and Reclassified in This Report ............... 60 4.4 Previously Issued Recommendations Reclassified in This Report ....................................... 61 Board Member Statement ........................................................................................................ 64 Appendixes ................................................................................................................................. 66 References .................................................................................................................................. 74

NTSB

Highway Accident Report iii Figures Figure 1. Map showing crash location and Tesla driver’s route of travel .................................... 1 Figure 2. Depiction of travel lanes and gore area ......................................................................... 2 Figure 3. Crash vehicles at final rest ............................................................................................ 3 Figure 4. Tesla postcrash fire ....................................................................................................... 4 Figure 5. Tesla movement leading up to the crash ....................................................................... 5 Figure 6. Positions of Tesla airbags.............................................................................................. 8 Figure 7. Tesla before being engulfed in flames .......................................................................... 9 Figure 8. Tesla interior rear section, with exposed battery cells ................................................ 10 Figure 9. Damage to Mazda 3 .................................................................................................... 11 Figure 10. Damage to Audi A4 .................................................................................................. 12 Figure 11. Tesla Autopilot components ....................................................................................... 13 Figure 12. Last Autopilot segment before crash, including warnings ........................................ 20 Figure 13. Postcrash drive-through, showing faded lane marking ............................................. 22 Figure 14. Added postcrash gore cross-hatching/chevrons ........................................................ 23 Figure 15. Precrash damaged condition of the crash attentuator ................................................ 24 Figure 16. 2015 Tesla after striking semitrailer, Williston, Florida ........................................... 27 Figure 17. 2014 Tesla and fire truck postcrash, Culver City, California ................................... 28 Figure 18. 2018 Tesla after striking semitrailer, Delray Beach, Florida .................................... 29 Figure 19. UNECE escalating timing of alerts for hands off wheel ........................................... 45 Figure D-1. Autosteer hands-on alert timing .............................................................................. 72

NTSB

Highway Accident Report iv Acronyms and Abbreviations AAA American Automobile Association ADAS advanced driver assistance systems ADS automated driving systems AEB automatic emergency braking CalSTA California State Transportation Agency Caltrans California Department of Transportation CEA Consumer Electronics Association (renamed Consumer Technology Association [CTA] in November 2015) CFR

Code of Federal Regulations CHP California Highway Patrol CTA Consumer Technology Association (formerly Consumer Electronics Association [CEA]) CTIA Cellular Telecommunications Industry Association DDT dynamic driving task DOT US Department of Transportation EDR event data recorder FCW forward collision warning FHWA Federal Highway Administration GPS

global positioning system HAZMAT hazardous materials HOV high-occupancy vehicle I-405 Interstate 405 KB

kilobyte MAIT Multidisciplinary Accident Investigation Team

NTSB

Highway Accident Report v MASH Manual for Assessing Safety Hardware MB

megabyte MCU media control unit mph

miles per hour MVFD Mountain View Fire Department NCAP New Car Assessment Program NCHRP National Cooperative Highway Research Program NETS Network of Employers for Traffic Safety NHTSA National Highway Traffic Safety Administration NSC National Safety Council NTSB National Transportation Safety Board ODD operational design domain ODI

Office of Defects Investigation (NHTSA) OEDR object and event detection and response OTA over-the-air OTS

California Office of Traffic Safety PED

portable electronic device RCM restraint control module SAE

SAE International (formerly Society of Automobile Engineers) SD

secure digital (card) SMFD San Mateo Fire Department SR-85 State Route 85 SUV sport utility vehicle TACC Traffic-Aware Cruise Control UNECE United Nations Economic Commission for Europe US-27A US Highway 27A

NTSB

Highway Accident Report vi US-101 US Highway 101 US-441 US Highway 441

NTSB

Highway Accident Report vii Terminology Related to Driving Automation Systems

In June 2018, SAE International (SAE) issued an updated Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles (SAE 2018).1 The taxonomy includes functional definitions for levels of driving automation. As shown in Table 1 on the next page, SAE lists six levels of automation ranging from Level 0 (no driving automation) to Level 5 (full driving automation). The generic term “driving automation system” refers to any 1–5 level system. Individually, Tesla Autopilot subsystems―such as Traffic-Aware Cruise Control (TACC), which provides longitudinal vehicle motion control; and Autosteer, which provides lateral vehicle directional control―are considered Level 1 systems. When Autopilot is active and multiple subsystems like TACC and Autosteer are combined to provide both lateral and longitudinal vehicle motion control, the system is considered Level 2 driving automation. SAE classifies a Level 2 system like Autopilot as “partial driving automation.” In a Level 2 system, it is the driver’s responsibility to monitor the automation, maintain situational awareness of traffic conditions, understand the limitations of the automation, and be available to intervene and take full control of the vehicle at all times. Throughout this report, the terms advanced driver assistance systems (ADAS), driving automation systems, and partial driving automation will be used to describe the capabilities of Tesla Autopilot. In the SAE taxonomy table (next page), the operational design domain (ODD) means the operating conditions under which the driving automation system is designed to function. Object and event detection and response (OEDR) includes detecting, recognizing, and classifying events and preparing to respond as needed. The dynamic driving task (DDT) involves all real-time operational and tactical functions required to operate a vehicle. Automated driving systems (ADS) apply to the higher, more fully automated Levels 3–5.

1 SAE International, initially established as the Society of Automotive Engineers, is a professional association and standards-developing organization. Refer to www.sae.org for additional information about technical standards developed by the association.

NTSB

Highway Accident Report viii Table 1. Summary of SAE taxonomy and definitions of terms related to driving automation systems for on-road motor vehicles. (Source: SAE International J3016, June 2018)

NTSB

Highway Accident Report ix Executive Summary Crash Summary On March 23, 2018, at 9:27 a.m., a 2017 Tesla Model X P100D electric-powered sport utility vehicle (SUV), occupied by a 38-year-old male driver, was traveling south on US Highway 101 (US-101) in Mountain View, Santa Clara County, California. At this location, US-101 has six southbound traffic lanes, including a high-occupancy vehicle (HOV) exit lane to State Route 85 (SR-85) southbound on the far left. As the SUV approached the US-101−SR-85 interchange, it was traveling in the lane second from the left, which was an HOV lane for continued travel on US-101.2 While approaching a paved gore area dividing the main travel lanes of US-101 from the SR-85 left-exit ramp, the SUV moved to the left and entered the gore. The vehicle continued traveling through the gore and struck a damaged and nonoperational crash attenuator at a speed of about 71 mph. The crash attenuator was positioned at the end of a concrete median barrier. As a result of the collision, the SUV rotated counterclockwise and the front body structure separated from the rear of the vehicle. The Tesla was involved in subsequent collisions with two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4. The Tesla’s high-voltage battery was breached in the collision and a postcrash fire ensued. On-scene witnesses found the Tesla driver in his seat with his lap/shoulder belt buckled. They removed him from the vehicle before it was engulfed in flames. The driver was transported to a local hospital, where he died from blunt-force trauma injuries. The driver of the Mazda sustained minor injuries, and the driver of the Audi was uninjured. System performance data downloaded from the Tesla indicated that the driver was operating the SUV using the Traffic-Aware Cruise Control (an adaptive cruise control system) and Autosteer system (a lane-keeping assist system), which are advanced driver assistance systems in Tesla’s “Autopilot” suite. As part of this investigation, the National Transportation Safety Board (NTSB) reviewed previous NTSB investigations involving the Tesla Autopilot system in Williston, Florida; Culver City, California; and Delray Beach, Florida, to examine common issues regarding the safety of advanced driver assistance systems that provide partial driving automation (both lateral and longitudinal control). Probable Cause The National Transportation Safety Board determines that the probable cause of the Mountain View, California, crash was the Tesla Autopilot system steering the sport utility vehicle into a highway gore area due to system limitations, and the driver’s lack of response due to distraction likely from a cell phone game application and overreliance on the Autopilot partial driving automation system. Contributing to the crash was the Tesla vehicle’s ineffective monitoring of driver engagement, which facilitated the driver’s complacency and inattentiveness. Contributing to the severity of the driver’s injuries was the vehicle’s impact with a crash

2 Additional information about this investigation can be found in the public docket for this crash (NTSB case number HWY18FH011) by accessing the Docket Management System at www.ntsb.gov.

NTSB

Highway Accident Report x attenuator barrier that was damaged and nonoperational at the time of the collision due to the California Highway Patrol’s failure to report the damage following a previous crash, and systemic problems with the California Department of Transportation’s maintenance division in repairing traffic safety hardware in a timely manner. Safety Issues The safety issues identified in this crash and in previous crashes involving partial driving automation include the following: • Driver Distraction. The Tesla driver was likely distracted by a gaming application on his cell phone before the crash, which prevented him from recognizing that Autopilot had steered the SUV into a gore area of the highway not intended for vehicle travel. The driver was using a company-supplied phone, but his employer, Apple Inc., did not have a policy preventing cell phone use while driving. Strong company policy, with strict consequences for using portable electronic devices while driving, is an effective strategy in helping to prevent the deadly consequences of distracted driving. Additionally, an engineering solution to the distracted driving problem is needed. Electronic device manufacturers have the capability to lock out highly distracting functions of portable electronic devices when being used by an operator while driving, and such a feature should be installed as a default setting on all devices. • Risk Mitigation Pertaining to Monitoring Driver Engagement. The Tesla Autopilot system did not provide an effective means of monitoring the driver’s level of engagement with the driving task, and the timing of alerts and warnings was insufficient to elicit the driver’s response to prevent the crash or mitigate its severity. Requirements are needed for driver monitoring systems for advanced driver assistance systems that provide partial driving automation (SAE Level 2 systems), and Tesla needs to develop applications that more effectively sense the driver’s level of engagement and that alert drivers who are not engaged. • Risk Assessment Pertaining to Operational Design Domain. Crashes investigated by the NTSB continue to show that the Tesla Autopilot system is being used by drivers outside the vehicle’s operational design domain (the conditions in which the system is intended to operate). Despite the system’s known limitations, Tesla does not restrict where Autopilot can be used. Tesla should incorporate system safeguards that limit the use of partial driving automation systems (Autopilot) to those conditions for which they were designed. Additionally, the National Highway Traffic Safety Administration (NHTSA) has failed to develop a method for verifying that manufacturers of partial driving automation systems are incorporating system safeguards that are critical to ensuring the safety of the motoring public. • Limitations of Collision Avoidance Systems. The Tesla’s collision avoidance systems were not designed to, and did not, detect the crash attenuator. Because this object was not detected, (a) Autopilot accelerated the SUV to a higher speed, which the driver had previously set by using adaptive cruise control, (b) the forward collision warning did not provide an alert, and (c) the automatic emergency braking did not activate. For partial driving automation systems to be safely deployed in a high-speed

NTSB

Highway Accident Report xi operating environment, collision avoidance systems must be able to effectively detect potential hazards and warn of potential hazards to drivers. • Insufficient Federal Oversight of Partial Driving Automation Systems. The US Department of Transportation and NHTSA have taken a nonregulatory approach to automated vehicle safety. NHTSA plans to address the safety of partial driving automation systems through enforcement and a surveillance program that identifies safety-related defect trends in design or performance. This strategy must address the risk of foreseeable misuse of automation and include a forward-looking risk analysis. Additionally, NHTSA should complete a further evaluation of the Tesla Autopilot system to ensure the deployed technology does not pose an unreasonable safety risk. • Need for Event Data Recording Requirements for Driving Automation Systems. Advanced driver assistance systems that provide partial automation collect significant safety-relevant data that can be used for crash analysis and risk assessment. Currently, manufacturers provide limited access to this data and there is no standardization of retrievable data parameters. This report describes the NTSB’s previous safety recommendations and the inaction of federal regulators to address this important issue area that is needed to foster system safety improvements. • Highway Infrastructure Issues. As part of this crash investigation, the NTSB issued a safety recommendation report addressing systemic problems related to the timely repair of traffic safety hardware in California. Investigators found that on the day of the collision, the crash attenuator at the US-101–SR-85 interchange was in a nonoperational damaged condition because of a previous crash, which had occurred 11 days earlier, on March 12, 2018. The Mountain View report briefly summarizes the findings of the safety recommendation report and the actions taken by the state of California to address this safety issue. Findings

1. None of the following were factors in the Tesla driver’s actions in this crash: (1) driver

licensing or qualification; (2) familiarization with the vehicle and roadway; (3) medical conditions, fatigue, or impairment by alcohol or other drugs; or (4) weather conditions.

1. The emergency response to the crash was timely and adequate.
2. The Tesla electric vehicle postcrash fire and related damage to the lithium-ion battery

presented unusual fire and electrical hazards to first responders.

1. The Tesla’s Autopilot lane-keeping assist system steered the sport utility vehicle to the

left into the neutral area of the gore, without providing an alert to the driver, due to limitations of the Tesla Autopilot vision system’s processing software to accurately maintain the appropriate lane of travel.

1. The Tesla’s collision avoidance systems were not designed to, and did not, detect the

crash attenuator at the end of the gore, nor did the National Highway Traffic Safety

NTSB

Highway Accident Report xii Administration require such capability; consequently, the forward collision warning system did not provide an alert and the automatic emergency braking did not activate.

1. The driver did not take corrective action when the Tesla’s Autopilot lane-keeping assist

system steered the vehicle into the gore area, nor did he take evasive action to avoid the collision with the crash attenuator, most likely due to distraction caused by a cell phone game application.

1. Distracted driving due to portable electronic device use remains persistently high, and

additional countermeasures are needed.

1. A technological solution, such as a lock-out function or application that automatically

disables highly distracting features of a portable electronic device while driving, is an effective countermeasure for eliminating portable electronic device distraction while driving.

1. Strong company policy, with strict consequences for using portable electronic devices

while driving, is an effective strategy in helping to prevent distracted driving crashes, injuries, and fatalities.

1. Although the Occupational Safety and Health Administration has guidelines for

companies to reduce motor vehicle crashes by prohibiting the use of portable electronic devices while driving, the guidelines lack specificity, are not widely adopted by companies, and are seldom enforced―limiting their impact in addressing the hazards of distracted driving.

1. The Tesla Autopilot system did not provide an effective means of monitoring the

driver’s level of engagement with the driving task.

1. Although the lack of gore area roadway striping at the Mountain View crash location

likely did not contribute to the crash, ongoing research led by the Federal Highway Administration can help identify what highway infrastructure changes may be needed in the future to accommodate automated vehicles.

1. The crash attenuator was in a damaged and nonoperational condition at the time of the

collision due to the California Highway Patrol’s failure to report the damage following a previous crash and systemic problems with the California Department of Transportation’s maintenance division in repairing traffic safety hardware in a timely manner.

1. If the crash attenuator at the US Highway 101−State Route 85 interchange had been

repaired in a timely manner and in a functional condition before the March 23, 2018, crash, the Tesla driver most likely would have survived the collision.

1. Because monitoring of driver-applied steering wheel torque is an ineffective surrogate

measure of driver engagement, performance standards should be developed pertaining to an effective method of ensuring driver engagement in SAE Level 2 partial driving automation systems.

NTSB

Highway Accident Report xiii

1. If Tesla Inc. does not incorporate system safeguards that limit the use of the Autopilot

system to those conditions for which it was designed, continued use of the system beyond its operational design domain is foreseeable and the risk for future crashes will remain.

1. The National Highway Traffic Safety Administration’s failure to ensure that vehicle

manufacturers of SAE Level 2 driving automation systems are incorporating appropriate system safeguards to limit operation of these systems to the operational design domain compromises safety.

1. In order for driving automation systems to be safely deployed in a high-speed operating

environment, collision avoidance systems must be able to effectively detect and respond to potential hazards, including roadside traffic safety hardware, and be able to execute forward collision avoidance at high speeds.

1. The National Highway Traffic Safety Administration’s approach to the oversight of

automated vehicles is misguided, because it essentially relies on waiting for problems to occur rather than addressing safety issues proactively.

1. It is essential that the National Highway Traffic Safety Administration’s surveillance

and defect investigation program closely examine issues related to foreseeable misuse of automation and perform a forward-looking risk analysis to identify partial driving automation system defects that pose an unreasonable risk to safety.

1. The National Highway Traffic Safety Administration’s Office of Defects Investigation

has failed to thoroughly investigate the Tesla Autopilot design regarding the degree to which drivers are currently misusing the system, the foreseeable consequences of continued use by drivers beyond the system’s operational design domain, and the effectiveness of the driver monitoring system in ensuring driver engagement.

1. Vehicle performance data associated with activation and engagement of partial driving

automation systems on vehicles involved in crashes are not required nor available on most event data recorders.

1. A standardized set of retrievable data is needed to enable independent assessment of

automated vehicle safety and to foster automation safety improvements.

NTSB

Highway Accident Report xiv Recommendations New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following nine new safety recommendations: To the National Highway Traffic Safety Administration: Expand New Car Assessment Program testing of forward collision avoidance system performance to include common obstacles, such as traffic safety hardware, cross-traffic vehicle profiles, and other applicable vehicle shapes or objects found in the highway operating environment. (H-20-1) Evaluate Tesla Autopilot-equipped vehicles to determine if the system’s operating limitations, the foreseeability of driver misuse, and the ability to operate the vehicles outside the intended operational design domain pose an unreasonable risk to safety; if safety defects are identified, use applicable enforcement authority to ensure that Tesla Inc. takes corrective action. (H-20-2) For vehicles equipped with Level 2 automation, work with SAE International to develop performance standards for driver monitoring systems that will minimize driver disengagement, prevent automation complacency, and account for foreseeable misuse of the automation. (H-20-3) After developing the performance standards for driver monitoring systems recommended in Safety Recommendation H-20-3, require that all new passenger vehicles with Level 2 automation be equipped with a driver monitoring system that meets these standards. (H-20-4) To the Occupational Safety and Health Administration: Review and revise your distracted driving initiatives to increase employers’ awareness of the need to develop strong cell phone policy prohibiting the use of portable electronic devices while driving. (H-20-5) Modify your enforcement strategies to increase the use of the general duty clause cited in 29 United States Code section 654 against those employers who fail to address the hazards of distracted driving. (H-20-6) To SAE International: For vehicles equipped with Level 2 automation, work with the National Highway Traffic Safety Administration to develop performance standards for driver monitoring systems that will minimize driver disengagement, prevent automation complacency, and account for foreseeable misuse of the automation. (H-20-7)

NTSB

Highway Accident Report xv To Manufacturers of Portable Electronic Devices (Apple, Google, HTC, Lenovo, LG, Motorola, Nokia, Samsung, and Sony): Develop a distracted driving lock-out mechanism or application for portable electronic devices that will automatically disable any driver-distracting functions when a vehicle is in motion, but that allows the device to be used in an emergency; install the mechanism as a default setting on all new devices and apply it to existing commercially available devices during major software updates. (H-20-8) To Apple Inc.: Develop and implement a company policy that bans the nonemergency use of portable electronic devices while driving by all employees and contractors driving company vehicles, operating company-issued portable electronic devices, or using a portable electronic device to engage in work-related communications. (H-20-9) Previously Issued Recommendations Reiterated in This Report As a result of its investigation, the National Transportation Safety Board reiterates the following two safety recommendations (already classified “Open―Unacceptable Response”) in sections 2.3.3 and 2.3.2, respectively, in this report: To the National Highway Traffic Safety Administration: Develop and apply testing protocols to assess the performance of forward collision avoidance systems in passenger vehicles at various velocities, including high speed and high velocity-differential. (H-15-4) Develop a method to verify that manufacturers of vehicles equipped with Level 2 vehicle automation systems incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. (H-17-38) Previously Issued Recommendations Reiterated and Reclassified in This Report As a result of its investigation, the National Transportation Safety Board reiterates and reclassifies the following five safety recommendations: To the US Department of Transportation: Define the data parameters needed to understand the automated vehicle control systems involved in a crash. The parameters must reflect the vehicle’s control status and the frequency and duration of control actions to adequately characterize driver and vehicle performance before and during a crash. (H-17-37) Safety Recommendation H-17-37 is reclassified from “Open―Await Response” to “Open―Unacceptable Response” in section 2.4 of this report.

NTSB

Highway Accident Report xvi To the National Highway Traffic Safety Administration: Use the data parameters defined by the U.S. Department of Transportation in response to Safety Recommendation H-17-37 as a benchmark for new vehicles equipped with automated vehicle control systems so that they capture data that reflect the vehicle’s control status and the frequency and duration of control actions needed to adequately characterize driver and vehicle performance before and during a crash; the captured data should be readily available to, at a minimum, National Transportation Safety Board investigators and National Highway Traffic Safety Administration regulators. (H-17-39) Safety Recommendation H-17-39 is reclassified from “Open―Acceptable Response” to “Open―Unacceptable Response” in section 2.4 of this report. Define a standard format for reporting automated vehicle control systems data and require manufacturers of vehicles equipped with automated vehicle control systems to report incidents, crashes, and vehicle miles operated with such systems enabled. (H-17-40) Safety Recommendation H-17-40 is reclassified from “Open―Acceptable Response” to “Open―Unacceptable Response” in section 2.4 of this report. To Tesla Inc.: Incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. (H-17-41) Safety Recommendation H-17-41 is reclassified from “Open―Await Response” to “Open―Unacceptable Response” in section 2.3.2 of this report. Develop applications to more effectively sense the driver’s level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use. (H-17-42) Safety Recommendation H-17-42 is reclassified from “Open―Await Response” to “Open―Unacceptable Response” in section 2.3.1 of this report.

NTSB

Highway Accident Report xvii Previously Issued Recommendations Reclassified in This Report As a result of its investigation, the National Transportation Safety Board reclassifies the following two safety recommendations: To the Consumer Electronics Association (now the Consumer Technology Association): Encourage the development of technology features that disable the functions of portable electronic devices within reach of the driver when a vehicle is in motion; these technology features should include the ability to permit emergency use of the device while the vehicle is in motion and have the capability of identifying occupant seating position so as not to interfere with use of the device by passengers. (H-11-47) Safety Recommendation H-11-47 is reclassified from “Open―Await Response” to “Closed―No Longer Applicable” in section 2.2.4.3 of this report. To the California State Transportation Agency: Develop and implement a corrective action plan that guarantees timely repair of traffic safety hardware and includes performance measures to track state agency compliance with repair timelines. (H-19-13) Safety Recommendation H-19-13 is reclassified from “Open―Initial Response Received” to “Open―Acceptable Response” in section 2.2.5.2 of this report.

NTSB

Highway Accident Report 1 1 Factual Information 1.1 Crash Summary On Friday, March 23, 2018, at 9:27 a.m., a 2017 Tesla Model X P100D electric-powered sport utility vehicle (SUV), operated by a 38-year-old driver, was traveling south on US Highway 101 (US-101) in Mountain View, Santa Clara County, California. The driver had departed his home in Foster City, California, at 8:59 a.m. to drive to his work location in Sunnyvale, California (see figure 1).

Figure 1. Map showing crash location and Tesla driver’s route of travel on southbound US-101. Continuing south on US-101, the driver approached the interchange with State Route 85 (SR-85). As shown in figure 2, US-101 southbound at the SR-85 interchange consisted of: • A single left-exit high-occupancy vehicle (HOV) lane for SR-85 (yellow arrow), • A single US-101 HOV lane (green arrow; Tesla driver’s intended route), • Three mainline US-101 lanes (red arrows), and • Two right-exit conventional lanes for SR-85 (blue arrows).

NTSB

Highway Accident Report 2 A 630-foot-long paved gore with an unmarked neutral (inside) area separated the left-exit HOV lane for SR-85 from the US-101 HOV lane.1 The gore widened to about 17.5 feet at the point where a previously damaged and nonoperational crash attenuator was in place ahead of a 3-foot-high concrete barrier (see inset image in figure 2). The barrier separated the left-exit HOV lane for SR-85 from the US-101 HOV lane. At this location, the speed limit was 65 mph.

Figure 2. Depiction of travel lanes and gore area at the US-101−SR-85 southbound interchange. Inset photo depicts precrash damaged condition of the crash attenuator. (Source: Google Earth, image date March 2018. Inset photo provided by California Department of Transportation [Caltrans]; image date March 20, 2018). As the SUV approached the US-101−SR-85 interchange, it was traveling in the second lane from the left with the Tesla’s Autopilot system activated (for more detail on the operational performance data, see section 1.2).2 When the SUV reached the gore dividing the main travel lanes of US-101 from the left exit ramp to SR-85, the vehicle moved to the left. It entered the gore, through which it continued traveling until the front left of the SUV struck the crash

1 A gore area is a triangular-shaped boundary created by white lines marking an area of pavement formed by the convergence or divergence of a mainline travel lane and an exit/entrance lane. It is not intended for vehicle travel. 2 In accordance with California Vehicle Code section 21655.5, the California Air Resources Board designated the Tesla Model X as an approved vehicle for single-occupant use in HOV lanes.

NTSB

Highway Accident Report 3 attenuator at a speed of 70.8 mph. The impact rotated the SUV counterclockwise and caused the front body structure to separate from the rear of the vehicle. The SUV was subsequently struck by two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4, when it rotated into the lane to the right of the gore (see figure 3).3

Figure 3. Southbound view of US-101, depicting the Tesla, Audi, and Mazda vehicles at final rest. (Source: witness S. Engleman) The Tesla’s high-voltage battery was breached in the collision and a postcrash fire ensued (see figure 4). After the crash, on-scene witnesses found the driver in his seat with his lap/shoulder belt buckled. They removed him from the vehicle before it was engulfed in flames, and he was transported by ambulance to the hospital for treatment. The 51-year-old female driver of the Audi was uninjured, and the 25-year-old male driver of the Mazda sustained minor injuries. The Tesla driver died at Stanford Health Care Hospital at 1:02 p.m., 4 hours 35 minutes after the crash. The cause of death was multiple blunt-force injuries that included a fractured pelvis and significant internal injuries.

3 This investigation focused on the primary collision between the SUV and the crash attenuator. More detailed information related to the precrash motion of the Mazda and the Audi can be found in the public docket for this crash (NTSB case number HWY18FH011).

NTSB

Highway Accident Report 4

Figure 4. Northbound view of US-101 depicting Tesla postcrash fire. (Source: witness S. Engleman) 1.2 Operational Performance Data Autopilot is a combination of Tesla advanced driver assistance systems (ADAS) that control vehicle speed and lane positioning by automating braking, steering, and torque to the drive motors. The major subsystems associated with the operation of Autopilot are Traffic-Aware Cruise Control (TACC) and Autosteer. TACC is an adaptive cruise control system that provides longitudinal control (acceleration and deceleration) and Autosteer is a lane-keeping assist system that provides lateral control (steering) of the vehicle inside the lane. The SUV stored operational data in its event data recorder (EDR) and in non-volatile memory in its media control unit (MCU).4 The MCU data were continually recorded onto a secure digital (SD) card in the vehicle’s Carlog.5 After examining the Carlog data, National Transportation Safety Board (NTSB) investigators developed a time-position diagram (figure 5) depicting the

4 The EDR captured the vehicle’s dynamic time-series data for the period just before and during the crash event. The EDR was located in the restraint control module (RCM) designed to control the car’s airbag system and other supplemental restraints. 5 Detailed information regarding the recovery of data from the SUV can be found in the Automation and Data Summary factual report in the public docket for this crash (NTSB case number HWY18FH011). Tesla refers to the data stored on the non-volatile memory SD card in the MCU as “Carlog” data. Parameters of data recorded included vehicle speed, steering angle, lateral and longitudinal acceleration, accelerator position, driver-applied brake pedal application, lead vehicle distance, and Autopilot technology features.

NTSB

Highway Accident Report 5 motion of the SUV during the 10 seconds leading up to the crash.6 The time-position diagram is divided into two images. The left image shows the position of the SUV 9.9 to 4.9 seconds precrash and the right image depicts the final 4.9 seconds leading to the crash with the attenuator.

Figure 5. Movement of the Tesla SUV (blue vehicle) during the 10 seconds leading up to the crash with the attenuator. (The gore is highlighted yellow in this graphic for better clarity.) The Carlog data also showed that during the last 10 seconds before impact: • Autopilot was active and the TACC was set to a cruise speed of 75 mph. • Between 10 and 6 seconds prior to the crash, the SUV was traveling between 64 and 66 mph and following another vehicle at a distance of about 83 feet. The Tesla driver had set the TACC to position 1, which maintained the closest possible following

6 Appendix A gives details of the NTSB investigation. Appendix B contains the tabulated data extracted from the Carlog used to create figure 5.

NTSB

Highway Accident Report 6 distance behind the lead vehicle immediately ahead (time-based following distance of about 0.9 seconds).7 • When the Tesla was about 5.9 seconds and about 560 feet from the crash attenuator, Autosteer initiated a left steering input (5.6 degrees at the steering wheel) toward the neutral area of the gore. At the time of the steering movement, no driver-applied steering wheel torque was detected by Autosteer.8 It is possible that hands can be resting on the steering wheel and no torque is registered. However, a lack of steering wheel torque indicates to the vehicle system that the driver’s hands are not on the steering wheel. This hands-off steering indication continued up to the point of impact with the crash attenuator. • When the SUV was about 3.9 seconds and 375 feet from the crash attenuator and fully inside the neutral area of the gore, the TACC no longer detected a lead vehicle ahead and the SUV began accelerating from a speed of 61.9 mph to the preset cruise speed of 75 mph.9 • The forward collision warning (FCW) system did not provide an alert and the automatic emergency braking (AEB) did not activate as the Tesla approached the crash attenuator. • The data indicated that the SUV driver did not apply the brakes and did not initiate any steering movement to avoid the crash. 1.3 Emergency Response A multiagency response consisted of the California Highway Patrol (CHP) and the Mountain View Fire Department (MVFD). The first emergency 911 call was received at 9:28 a.m. and the MVFD was dispatched at 9:31 a.m., arriving at the crash location at 9:36 a.m. The MVFD responded with three engine units, one rescue unit, and a truck for patient care, fire suppression, and equipment/personnel recovery. After emergency personnel extinguished the flames by using water and foam, they noted intermittent popping noises accompanied by smoke, at which time they applied additional water. Because of concerns regarding high voltage and energy issues associated with the Tesla’s lithium-ion battery, the MVFD incident commander contacted Tesla Inc. regarding additional actions needed to make the SUV safe. A Tesla battery engineer advised that the vehicle was not safe because of the extent of the damage and that all personnel should stay away from the SUV until Tesla representatives could evaluate it.

7 Drivers using TACC can adjust following distance by choosing a setting from 1 (the closest following distance) to 7 (the longest following distance). Each setting corresponds to a time-based distance that represents how long it takes for the Tesla, from its current location, to reach the location of the rear bumper of the vehicle ahead. 8 Torque is force applied to an object to make it rotate about an axis (in this case, the steering wheel to rotate about the steering column). 9 A dashcam mounted in a vehicle traveling north on US-101 captured the Tesla before the crash. The video showed a sedan in front of the Tesla―a lead vehicle―continuing south in the second lane from the left (the US-101 HOV lane) as the SUV traveled south in the gore area not intended for vehicle travel.

NTSB

Highway Accident Report 7 When the Tesla engineers arrived at the crash site, they immediately began removing damaged cells from the battery. Shortly thereafter, they heard three consecutive popping sounds and saw a shift in the vehicle’s floorboard. The Tesla engineers determined that further attempts to remove damaged battery parts would be unsafe. Because the SUV could not be made completely stable on scene, it was loaded onto a flatbed tow truck and escorted by the CHP and the MVFD to an impound facility in San Mateo, California. About 20 minutes after the SUV arrived, the San Mateo Fire Department (SMFD) was dispatched to the impound facility because of venting sounds emanating from the Tesla wreckage.10 The SMFD crew monitored the vehicle with thermal cameras but made no further attempts at fire suppression. At 7:01 p.m. on March 28 (5 days after the crash), the SMFD was dispatched to the impound facility because of a report of a fire. On arrival, the SMFD crew observed flames about 8–12 inches high emanating from the Tesla’s front passenger side. Approximately 300 gallons of water were applied intermittently during a 40-minute period, but because the fire continued to burn, Tesla engineers advised the SMFD to apply foam. At 8:50 p.m., after about 5 minutes of foam application, the fire was extinguished. A hazardous materials (HAZMAT) unit of the SMFD responded to test the run-off water and determined it to be toxic. The HAZMAT unit ordered public works to vacuum water, foam, and vehicle fluids from the storm drain. About 9:50 p.m., the HAZMAT unit declared the scene safe. Lessons learned from the emergency response to the Tesla fire will be incorporated into a separate NTSB report on electric vehicle battery fires. 1.4 Occupant Restraints The Tesla driver was restrained with a lap/shoulder belt equipped with a pretensioner that worked in conjunction with airbag systems in a severe frontal collision (figure 6 shows the airbag positions). The pretensioner automatically retracted both the seat belt anchor and the seat belt webbing, reducing slack in both the lap and shoulder portions of the belt.

10 A damaged lithium-ion battery can cause battery cells to enter “thermal runaway,” which is a loss of electrical isolation between the cathode and anode, making the cell overheat and combust. Thermal runaway events are often accompanied by a combination of flames, venting of gases, and popping or other noises resulting from the venting. This reaction may stop at one cell or propagate to adjacent cells.

NTSB

Highway Accident Report 8

Figure 6. Diagram showing the positions of the SUV’s airbags. (Source: Tesla Model X Owner’s Manual) Data downloaded from the RCM showed that the following restraint systems deployed during the crash: • Driver seat belt pretensioners, • Driver front, knee, and side seat airbags, • Inflatable curtain airbags on the left and right side, • Passenger-side seat airbag, and • Second row left and right curtain and side seat airbags.

NTSB

Highway Accident Report 9 The Mazda driver was wearing his lap/shoulder belt at the time of the crash and the Mazda’s front airbag deployed. The Audi driver was also restrained with a lap/shoulder belt; the Audi’s front airbag did not deploy.11 1.5 Vehicle Factors 1.5.1 Tesla SUV 1.5.1.1 Damage. The SUV was extensively damaged in the crash (see figure 7). The front section (everything forward of the leading edges of the front doors) was destroyed and broken into fragments that spread across several traffic lanes at the US-101−SR-85 interchange. Separated components included the front drive motor, front suspension, fenders, and hood. The rear section, including the passenger compartment, sustained thermal damage from the postcrash fire.

Figure 7. Northbound view of the crash scene before the Tesla was engulfed in flames. (Source: witness S. Engleman) 1.5.1.2 Battery Damage. The Tesla electric vehicle was powered by a 400-volt lithium-ion battery. The battery comprised about 8,500 vertically mounted and tightly packed battery cells, divided into 16 modules contained within an aluminum battery pack assembly, extending along the floor of the SUV. The battery pack was breached in the collision and a postcrash fire ensued. Examination of the battery pack found the front edge crushed rearward with the top surface twisted aft and upward, exposing individual battery cells (see figure 8).12

11 A near-deployment airbag event was recorded in the Audi’s EDR. The data showed the Audi driver braked about 3 seconds before impacting the Tesla and slowed from a speed of about 63 mph to an impact speed of 16 mph. The impact was not severe enough to trigger an airbag deployment. No data could be imaged from the Mazda because the 2010 model was not supported by crash data retrieval tools. 12 A detailed discussion of the damaged battery and fire is available in the public docket for this investigation.

NTSB

Highway Accident Report 10

Figure 8. Interior view of the Tesla’s rear section, with exposed battery cells from the lithium-ion battery (circled in red) in the floorboard. (Source: CHP) 1.5.1.3 Mechanical and Service History. A full examination of the Tesla’s mechanical components was not possible due to the fire damage and the extensive damage of the detached components. The condition prohibited an accurate evaluation of the functionality of the throttle, steering, and brake system.13 Maintenance service records were examined and service personnel at the Tesla Service Center in Sunnyvale were interviewed regarding repairs made to the Tesla SUV between March 6 and March 12, 2018 (11 days before the crash). The March 6 service visit was to diagnose and repair damage to a rear passenger door and to address a complaint about the global positioning system (GPS)/navigation system that caused the cruise control not to function, with an associated alert that read “maps not loaded.” The service personnel could not remember the interaction with the driver about the cruise control complaint and wrote on the service records “unable to duplicate concern at this time.” A review of the Tesla’s Carlog records from the time of the crash showed that the cruise control was functioning, with no alerts about the maps not loading.

13 A check of the National Highway Traffic Safety Administration (NHTSA) database revealed no relevant recalls or ongoing defect investigations related to the circumstances of the Mountain View crash.

NTSB

Highway Accident Report 11 1.5.1.4 Tesla Software Updates. Tesla updates its software (firmware) wirelessly, providing new features as they are developed.14 Firmware version 2018.10-4460-998269610au was installed on the SUV on March 12, 2018, during the service visit. Two days later, Tesla released a new firmware update to vehicle owners. Between March 14 and the crash on March 23, Tesla made 13 attempts to send firmware version 2018.10.4 to the SUV via over-the-air (OTA) wireless connection. Each attempt failed because of poor connectivity with the vehicle.15 Since the Mountain View crash, Tesla has enhanced the OTA updating process by adding a firmware update window in the Tesla mobile phone application. The application provides push notifications so that owners are informed and aware of the availability of updates even when not in the vehicle.16 1.5.2 Mazda 3 Car 1.5.2.1 Damage. The 2010 Mazda 3 sustained damage concentrated in the area of the left fender, left front tire and wheel assembly, and driver’s door (see figure 9).

Figure 9. Damage to left front, hood, and left side of the Mazda 3.

14 Firmware updates occur about every 6 to 8 weeks, but it is not uncommon for there to be 10 weeks between updates. Firmware version numbers reflect the year and week of the release. Any number after the week number is typically a sub-version number, which usually indicates minor fixes to the software. 15 Firmware 2018.10.4 did not provide additional cameras or sensor usage. The firmware change updated the processing software for the vision system to improve overall performance. 16 Tesla advised the NTSB that OTA firmware installation is “extremely successful.” As of March 27, 2019, firmware 2018.10.4 had been installed on 99.8 percent of the US Tesla fleet.

NTSB

Highway Accident Report 12 1.5.2.2 Mechanical Inspection. The CHP Multidisciplinary Accident Investigation Team (MAIT) inspected the Mazda on March 29, 2018, and found no evidence of any mechanical conditions that would have affected the vehicle’s safe operation. 1.5.3 Audi A4 Car 1.5.3.1 Damage. The 2017 Audi A4 sustained damage concentrated in the area of the right front bumper, headlamp, and hood (see figure 10).

Figure 10. Damage to right front of the Audi A4. 1.5.3.2 Mechanical Inspection. The CHP MAIT inspected the Audi A4 on March 29, 2018, and found no evidence of any mechanical conditions that would have affected the vehicle’s safe operation. 1.6 Tesla Autopilot 1.6.1 Autopilot Description

Tesla refers to its suite of ADAS that controls vehicle movement as Autopilot. When Autopilot is active, the system (1) monitors the travel path, (2) maintains the set cruise speed, (3) maintains the vehicle’s position in the travel lane, (4) brakes when it detects slower-moving vehicles ahead of the Tesla, and (5) decelerates and follows a slower-moving vehicle in front of the Tesla at a preset following interval.

NTSB

Highway Accident Report 13

Autopilot consists of three main subsystems: (1) a sensor and imaging suite (cameras, radar, and ultrasonic sensors) designed to assess the nearby environment (see figure 11), (2) a data-processing suite designed to collect input data from the sensors and compute instructions, and (3) a servo suite designed to send control inputs to the vehicle. Information travels between subsystems using multiple controller area network busses. The performance data associated with Autopilot control systems are stored in non-volatile memory and can be communicated through an OTA network to the Tesla’s central computer network. Autopilot is considered an SAE International (SAE) Level 2 partial driving automation system.17 In a Level 2 system, it is the driver’s responsibility to monitor the automation, maintain situational awareness of traffic conditions, understand the limitations of the automation, and be available to intervene and take full control of the vehicle at all times.

Figure 11. Diagram showing the positions of Autopilot components (cameras, ultrasonic sensors, and radar) for monitoring roadway environment. (Source: Tesla Model X Owner’s Manual) The major Autopilot features that the driver used in the moments leading up to the crash were TACC and Autosteer. TACC uses information from the forward-looking camera and radar sensor to determine whether a vehicle is in front of the Tesla in the same lane. If no vehicle is ahead of the Tesla, TACC maintains a set cruise speed selected by the driver. When a lead vehicle travels slower than the Tesla’s set cruise speed, TACC will maintain a selected time interval behind the lead vehicle. The Autosteer lane-keeping assist system uses information from the forward-looking camera, radar sensor, and ultrasonic sensors to detect lane markings and the presence of vehicles and objects. This information provides automated lane-keeping steering control based on the lane markings and the vehicle directly in front of the Tesla, if present. In most cases, Autosteer attempts to center the Tesla in the travel lane. However, if the ultrasonic sensors detect the presence of an adjacent object or large vehicle (for example, a guardrail or a truck), Autosteer may steer the vehicle in a driving path offset from the center of the lane. If Autosteer does not

17 SAE International, initially established as the Society of Automotive Engineers, is a professional association and standards-developing organization. Refer to www.sae.org for additional information about technical standards developed by the association.

NTSB

Highway Accident Report 14 receive adequate data from the camera or sensors, a message displays on the instrument panel indicating that Autosteer is temporarily unavailable.18 1.6.2 Autopilot Limitations Autopilot features are described to Tesla customers as “Beta.”19 The Tesla Model X Owner’s Manual (Tesla 2017) includes more than 50 warnings about the limitations of Autopilot features.20 In addition, before driving with the Autopilot system, the driver must acknowledge several factors. On the display screen inside a Tesla vehicle, the system prompts specifically about Autosteer, although Autosteer requires activating TACC first. The Tesla-provided information states (verbatim): • Autosteer feature is currently in Beta. • Autosteer is a driver assistance feature and does not make your vehicle autonomous. • Please use it only if you will pay attention to the road, keep your hands on the steering wheel, and be prepared to take over at any time. Autosteer is designed for use on highways that have a center divider, clear lane markings, and no cross-traffic. It should not be used on highways that have very sharp turns or lane markings that are absent, faded, or ambiguous. • Autosteer is currently in Beta, which we say to encourage a higher level of vigilance. If this were a computer or mobile phone, we would not refer to it as Beta, but we believe the standards are considerably higher for vehicle control and want to be clear about the proper use of Autosteer. • Before using Autosteer, please read the Owner’s Manual for instructions and more safety information. • Do you want to enable Autosteer while it is in Beta? Drivers also receive an alert every time Autopilot is activated to “Always Keep Your Hands on the Wheel,” and “Be Prepared to Take Over at Any Time.” 1.6.3 Autopilot Constraints 1.6.3.1 Autopilot Activation. Autopilot (TACC and Autosteer) can be activated on any road on which the system can detect lane markings. To activate Autopilot, a Tesla must be traveling at a speed of at least 18 mph if no lead vehicle is detected. If a vehicle is detected ahead of the Tesla,

18 If the driver does not respond to visual and audible alerts regarding the unavailability of Autopilot, the vehicle will decelerate in the current travel lane and activate the hazard flashers. (This situation would likely occur only in the event of an incapacitated or completely unresponsive driver.) 19 In general, Beta means that an application or system is still in the development stages and is not the final version. 20 Appendix C contains a list of warnings and limitations associated with the use of Autopilot features TACC and Autosteer.

NTSB

Highway Accident Report 15 Autopilot can be activated at any speed under 90 mph, even when stationary (if at least 5 feet away from the other vehicle). 1.6.3.2 Restricted Speeds. When Autopilot is active, the system limits the maximum speed at which the vehicle travels. When used on roads without a center divider, Autopilot limits the driving speed to a maximum of 5 mph above the detected speed limit (by reading the speed limit signs). On a road with a center divider, Autopilot allows a maximum travel speed of 90 mph, regardless of the roadway’s speed limit. In situations where the Autopilot vision system has not detected a roadway speed limit, Autopilot limits the speed to 45 mph. A driver can manually accelerate above the TACC-limited speed, but when the accelerator pedal is released, Autopilot will slow the Tesla to the limited speed.

If a driver tries to activate Autopilot at a speed that is outside the system’s speed restrictions, the instrument panel displays a message indicating that Autopilot is temporarily unavailable. 1.6.3.3 Hands-On Steering Wheel Requirement. When active, Autosteer requires a driver to intermittently hold the steering wheel. The system detects hands on the wheel by recognizing torque on the steering wheel from the driver’s manually turning the wheel very lightly (that is, without enough force to retake control).21 If Autosteer does not detect the driver’s hands on the steering wheel for a period of time, a visual warning (flashing white light) appears along the top of the instrument panel and the following message displays: “Apply light force to steering wheel.”

If Autosteer does not detect the driver’s hands on the steering wheel after the visual warning, the system gives two auditory warnings, the first of which is sounded 15 seconds after the visual warning. If the driver’s hands are still not detected on the steering wheel, Autosteer gives a second auditory warning 10 seconds after the first one.

If a driver ignores the second auditory warning and does not apply steering-wheel torque within the next 5 seconds, Autosteer sounds a continuous chime, turns on hazard warning flashers, and slows the vehicle to a complete stop in the current lane of travel. Additionally, if a driver receives any combination of three separate auditory alerts within an hour, Autosteer disengages and remains unavailable until the vehicle has been turned off and then back on.

The time between the detection of hands-off operation and the visual warning depends on (1) vehicle speed, (2) presence of a vehicle ahead, (3) lateral acceleration, (4) type of roadway, (5) detection of system errors (which would prompt an immediate warning), (6) driver application of pedals, and (7) miscellaneous factors, such as the presence of a construction zone. Because the crash Tesla was traveling on a divided highway at a speed greater than 45 mph and following another vehicle, Autosteer would give the first visual alert to the driver 3 minutes after not detecting driver-applied torque on the steering wheel.

21 Activating a turn signal, using the cruise control lever to adjust the cruise speed or following distance, or using any steering wheel button or scroll wheel is viewed by Autosteer as driver engagement with the system and resets the counting of the hands-off-wheel timing.

NTSB

Highway Accident Report 16 1.6.4 Postcrash Changes to Autopilot After the Mountain View crash, Tesla made design changes to the Autopilot software. The changes included updates to the vision system, more immediate warnings in Autosteer’s hands-off-wheel alert timing, and an Autopilot “Drivable Space” forward collision warning and avoidance system. The changes are summarized in appendix D. 1.7 Tesla Collision Avoidance Systems

The SUV was also equipped with collision avoidance assistance features including those for prevention and mitigation of forward collisions. The FCW system provides visual and audible warnings in situations when the Tesla detects high risk of a frontal collision. The AEB is typically engaged after FCW if a driver does not respond, and automatically applies braking to prevent a frontal collision or reduce its impact. The FCW/AEB system is a radar/camera fusion system designed to detect slow, stopped, and decelerating vehicles ahead of the Tesla in the same lane.22

During the 5 seconds leading up to the crash, the Tesla SUV accelerated from about 63 mph to nearly 71 mph at impact. During the approach to the crash attenuator, the FCW system did not provide an alert and the AEB did not activate. FCW and AEB are designed and tested to recognize particular types of objects (vehicles) and warn or brake within a particular speed range. NHTSA has established test protocols and performance specifications for FCW and AEB as part of the agency’s New Car Assessment Program (NCAP).23 Collision avoidance systems that meet the minimum performance specifications are listed as “Recommended Safety Technologies” on NHTSA’s NCAP website, but the agency does not rate the overall effectiveness of these systems. Collision avoidance technologies are not currently part of NCAP’s 5-Star Safety Ratings program; only vehicle crashworthiness and rollover safety are. Testing of various collision avoidance systems is also conducted in other parts of the world. Euro NCAP in Europe uses similar testing scenarios to those of NHTSA’s NCAP, but there are critical differences. For example, in addition to vehicle crashworthiness and rollover safety, Euro NCAP’s overall safety rating includes the effectiveness of the vehicle’s collision avoidance technologies.24 Furthermore, Euro NCAP’s testing of FCW and AEB is conducted at speeds up to 50 mph and includes targets representing not only motor vehicles but also pedestrians and bicyclists. On the other hand, NHTSA’s NCAP testing of FCW and AEB is conducted at speeds up to 45 mph and uses only motor vehicle targets.

22 The FCW and the AEB remain available at all times and in all domains. Although these systems use some of the same sensors as Autopilot, they are not part of the partial driving automation system, which consists of TACC and Autosteer. 23 See NHTSA’s NCAP website (accessed February 4, 2020). The FCW and AEB systems on the 2017 Tesla Model X met NHTSA’s performance criteria, and the vehicle model is listed as having these recommended safety technologies. 24 See Euro NCAP website (accessed February 4, 2020).

NTSB

Highway Accident Report 17 1.8 Tesla Driver Factors 1.8.1 Background

This report focuses only on human performance issues related to the Tesla driver. Interviews with the Mazda and Audi drivers, in addition to other background information, can be found in the public docket. 1.8.1.1 Licensing and Experience. The Tesla driver held a California class C noncommercial driver’s license with no restrictions. His record showed no traffic-related violations or prior crashes, and his license had never been suspended, revoked, or denied. The driver resided in Foster City and worked as a software engineer for Apple at a facility in Sunnyvale. He was very familiar with this travel route on US-101 because he drove through the area where the crash occurred several times a week on his way to work. 1.8.1.2 Health and Toxicology. The driver’s family, friends, and coworkers told investigators that he was good physical condition. He did not smoke, did not take any prescription medications, and did not have any known health issues. He did see a physician in the weeks before the crash for a cough, but the symptoms had subsided by the time of the crash. The driver exercised regularly and had no current major life stressors. He had had laser vision correction surgery about 3 years before the crash, and his vision was 20/20. His hearing was also reportedly good. A postmortem toxicology test did not detect alcohol or other tested-for drugs in his system.25 1.8.1.3 Precrash Activities. The below table lists the Tesla driver’s activities from March 21 to March 23. The information is based on interviews with family and coworkers, Apple building entry/exit data, cell phone records, and the Tesla’s Carlog data. The driver had about 6.5 to 7.5 hours of sleep opportunity per night in the 3 days leading up to the crash. The driver’s wife reported that her husband would usually fall asleep immediately and would not wake up during the night. She said that he snored occasionally but that he had never been diagnosed with a sleep disorder such as obstructive sleep apnea. Table 2. Precrash activities of Tesla driver, March 21–23, 2018. Time Activity Source Wednesday, March 21 7:00 a.m.–7:15 a.m. Awakens Family interview 8:51 a.m. Departs home to transport son to preschool Carlog data 9:01 a.m. Arrives at preschool in Foster City Carlog data 9:07 a.m. Departs preschool to drive to work Carlog data

25 The tested-for drugs included amitriptyline, amobarbital, bupropion, bupropion metabolite, butabarbital, carisoprodol, chlorpheniramine, cocaine, desipramine, dextromethorphan, diazepam, diphenhydramine, doxepin, doxylamine, EDDP (metabolite of methadone), BMDP (benzylone), fluoxetine, glutethimide, ibuprofen, imipramine, ketamine, lidocaine, meperidine, meprobamate, methadone, methaqualone, nordiazepam, norpropoxyphene, nortriptyline, pentazocine, pentobarbital, phencyclidine, phenobarbital, phenytoin, propoxyphene, secobarbital, sertraline, and venlafaxine.

NTSB

Highway Accident Report 18 Time Activity Source 9:44 a.m. Arrives at work in Sunnyvale (Apple facility) Carlog data 11:10 a.m. Departs work to drive home Carlog data 11:37 a.m. Arrives home in Foster City Carlog data 2:30 p.m. Hires ride-share vehicle for transport to San Francisco to attend game developer’s conference Family interview 11:00 p.m.–midnight Work colleague drives him home from conference; goes to bed Family interview Thursday, March 22 7:00 a.m.–7:15 a.m. Awakens Family interview 8:54 a.m. Departs home to transport son to preschool Carlog data 9:04 a.m. Arrives at preschool in Foster City Carlog data 9:09 a.m. Departs preschool to drive to work Carlog data 10:07 a.m. Arrives at work in Sunnyvale Carlog data 10:12 a.m. Enters Apple facility Apple building entry data 5:43 p.m. Departs Apple facility Apple building exit data 5:45 p.m. Departs work to drive home Carlog data 6:12 p.m. Arrives home in Foster City Carlog data 7:07 p.m. Incoming cell phone call from work supervisor Cell phone records 7:22 p.m.– 10:35 p.m. Text message exchange with supervisor Cell phone records 11:30 p.m.– 12:30 a.m. (Friday) Goes to bed Family interview Friday, March 23 7:00 a.m.–7:15 a.m. Awakens Family interview 8:45 a.m. Departs home to transport son to preschool Carlog data 8:53 a.m. Arrives at preschool in Foster City Carlog data 8:59 a.m. Departs preschool to drive to work Carlog data 9:27 a.m. Crash – Mountain View Carlog data 1.8.2 Cell Phone Usage 1.8.2.1 Cell Phone General Information. The CHP recovered two cell phones at the crash scene. One of them, an Apple iPhone 8 Plus, was found among the debris on the highway and sustained major structural damage. The second phone, an Apple iPhone 10, was undamaged and found among the driver’s personal belongings. The CHP inspected the phones and returned them both to the driver’s family, who in turn forwarded the phones to Apple Inc. Apple advised that the

NTSB

Highway Accident Report 19 iPhone 8 Plus was a development fused model used primarily for business purposes. The iPhone 10 was provided to the driver for personal use. 1.8.2.2 Cell Phone Inspection and Data Recovery. The NTSB retrieved unencrypted CrashReporter logs from the Tesla driver’s Apple iPhone 8 Plus.26 Each of the three recovered logs showed that a game application was active during the driver’s trip to work and was the frontmost application on his phone when the crash occurred. Although the game (a world-building strategy game with multiplayer capability) appears to require manual manipulation, the log data are not specific enough to ascertain whether the Tesla driver was holding the phone at the time of the crash.

Historical CrashReporter logs recovered from the driver’s device show a pattern of active game play every day from Monday, March 19, 2018, to Friday, March 23, 2018, between 9:00 a.m. and 10:00 a.m. when the driver was en route to work.27 NTSB investigators asked his wife (through the family attorney) whether she was aware that her husband played games on his phone. She responded that her husband loved to do so but that he never did while driving. 1.8.2.3 Cell Phone Records. Cell phone records also showed that the Tesla driver was using the Apple-owned iPhone 8 Plus on the morning of the crash. Although the records showed no incoming or outgoing calls or text messages during his trip to work, they did show evidence of data transmissions while the vehicle was in motion. In the 12 hours preceding the crash, the highest data usage (204 kilobytes [KB] per minute average) was recorded in the 11.5 minutes immediately preceding the crash.28 This level of data usage is consistent with online game activity. When the phone was not in use during the overnight hours when the Tesla driver was asleep, the average data usage was less than 1 KB/minute. 1.8.2.4 Cell Phone Laws and Policy. California state laws prohibit the holding and operating of a cell phone while driving. California Vehicle Code section 23123.5 (a) reads: A person shall not drive a motor vehicle while holding and operating a handheld wireless telephone or an electronic wireless communications device unless the wireless telephone or electronic wireless communications device is specifically designed and configured to allow voice-operated and hands-free operation, and it is used in that manner while driving.

26 See the Cell Phone Records and Data Recovery report in the public docket for this crash. The recovered CrashReporter logs are available to cell phone application developers for diagnostic purposes. When an application on a phone crashes, a crash report is created and stored on the device. Users of Apple iPhones can access CrashReporter logs on their device by going to Settings/Privacy/Analytics/Analytics Data. 27 Logs show that the game application was active on March 19, 2018, at 09:03:21; March 20, 2018, at 09:18:53; March 21, 2018, at 09:37:53; and March 22, 2018, at 09:21:31. Tesla Carlog data show that Autopilot was active during these time periods. 28 Data activity shown in cell phone records can include the network updating software and phone applications, sending and receiving emails, internet usage, upload and download of photos, streaming of videos, and online game playing. Estimated data usage for a specific phone activity includes: one email (no attachments) – 20 KB, one email (with standard attachments) – 300 KB, 1 minute of “surfing” the web – 250 KB, one song download – 4 megabytes (MB), one photo upload to social media – 5 MB, 1 minute of streaming standard-definition video – 11.7 MB, 1 minute of streaming high-definition video – 41 MB, and 1 minute of online game playing – 200 KB.

NTSB

Highway Accident Report 20 Because the Tesla driver was an employee of Apple Inc. and was supplied with Apple cell phones for business and personal use, investigators inquired about company policy regarding cell phone use while driving. Apple advised the NTSB that it did not have any company policy regarding cell phone use while driving. 1.8.3 Warnings for Hands Off Wheel

Tesla Carlog data showed that the crash trip lasted 28 minutes 33 seconds. Autopilot was active more than 75 percent of the time and during the final 18 minutes 55 seconds. According to the data, driver-applied torque to the steering wheel was not detected 34.4 percent of the time that Autopilot was active. Figure 12 depicts the last Autopilot segment, during which the system issued two visual alerts for hands-off driving. Because the system continued not to detect driver-applied torque to the steering wheel, one of these visual alerts progressed to the second alerting stage, with an audible warning.

About 6 seconds before the crash, no driver-applied steering wheel torque was detected by Autosteer.29 This lack of driver input on the steering wheel continued until the impact with the crash attenuator.

Figure 12. Last Autopilot segment of the crash trip, including warnings for hands-off driving operation. 1.8.4 Vehicle Familiarity and Handling 1.8.4.1 Familiarity with Vehicle. The driver purchased the vehicle in October 2017, and received the vehicle at the Fremont, California, Tesla dealership in November 2017. His family did not recall whether he received any training on the use of the Tesla ADAS features, but his wife remembered him being informed that he needed to keep his hands on the steering wheel while using Autopilot. She told investigators that he became very familiar with the use of the system and would watch YouTube videos related to the Autopilot feature in his spare time. She also stated that the SUV would emit an audible signal if the driver did not have his hands on the steering wheel when in Autopilot mode. The driver belonged to a Facebook group called “Tesla Model X Owner’s Club” and would occasionally post about the vehicle’s features. 1.8.4.2 Vehicle Handling. Reports reviewed by the NTSB, originating from the driver’s family and friends, described issues with the vehicle handling erratically when the driver was traveling in the vicinity of the US-101−SR-85 interchange at the gore area. Investigators interviewed the

29 The hands-off-wheel detection occurred about the time the SUV entered the gore area.

NTSB

Highway Accident Report 21 driver’s family and a friend who reported that the driver experienced issues with the Autopilot system steering to the left into the gore area on numerous occasions.30 One month of Tesla Carlog data was reviewed for the time when the driver was making his morning trip to work. Although GPS information was not available in the Carlog data, the NTSB―using information about the driver’s daily patterns and routes―identified two similar incidents that occurred on March 19, 2018, and on February 27, 2018. The data showed that during both incidents, Autosteer induced a steering action to the left, which appeared to be in the vicinity of the gore. The Autosteer action was followed within 2 seconds by a driver-induced steering correction to the right, overriding Autopilot functionality. During these two previous incidents, the driver’s hands were detected on the steering wheel.31 1.9 Highway Factors 1.9.1 Description and General Characteristics The crash occurred in the gore area of the US-101−SR-85 interchange, at milepost 48.38, south of the North Shoreline Boulevard overcrossing. The highway is operated and maintained by the California Department of Transportation (Caltrans). US-101 is designated as a north-south roadway, but at the crash location it is aligned in a northwest-southeast direction. As shown earlier in figure 2, the southbound roadway consists of seven traffic lanes. The width of the traffic lanes varies between 11.5 and 12.9 feet. The speed limit on US-101 in the vicinity of the crash is 65 mph. The average daily traffic for this segment of US-101 is 245,000 vehicles, with a peak hourly total of 17,600 vehicles.32 1.9.2 Gore Area 1.9.2.1 Left-Exit Lane and Gore Delineation. Roadway delineation of the left-exit HOV lane for SR-85 southbound begins about 1,540 feet from the crash attenuator, with 8-inch-wide painted broken white lane drop markings designating the left lane as an exit lane. The lane drop markings transition to an 8-inch-wide solid white line 940 feet from the crash attenuator.33 The apex of the gore area begins about 630 feet from the attenuator where the solid white line bifurcates into two 8-inch-wide white channelizing lines, which form the gore. Before the crash, the gore’s neutral (inside) area was not marked with optional diagonal cross-hatching or chevrons. 1.9.2.2 Condition of Roadway Pavement Markings. The lane markings delineating the gore area from the left-exit HOV lane for SR-85 were worn at the time of the crash. On March 27, 2018 (4 days after the crash), NTSB investigators drove through the crash location at about

30 A friend of the Tesla driver provided the NTSB with a copy of a text message he received on March 19, 2018. The text message(s) from the Tesla driver reported Autopilot “almost led me to hit the median again this morning” at the “85 separation.” (Note: the text message was translated from Mandarin Chinese to English.) 31 The NTSB examined 15 days of Carlog data. Data from March 6 to March 12 were excluded from the review because the vehicle was being serviced at that time. Additionally, investigators looked only at the time period between 9:00 a.m. and 10:00 a.m. on days when the Tesla driver was en route to work. It is possible that other gore area incursions occurred during the month outside the focused review. 32 The traffic volume information is based on Caltrans 2016 data and reflects total traffic for both directions of travel. 33 According to the California Manual on Uniform Traffic Control Devices, the function of a solid white line is to discourage or prohibit crossing.

NTSB

Highway Accident Report 22 9:30 a.m. to approximate the lighting conditions (sun position) that had been present at the time of the collision. As shown in figure 13, the right edge line of the gore was worn and faded in the initial half of the gore. Since the crash, Caltrans has repainted the lane lines at the crash location.

Figure 13. Southbound US-101 view from a video drive-through at 685 feet from crash attenuator. The 8-inch-wide solid white line marking the left side of the gore area (designated with red arrows) was more prominent and visible than the right side of the gore. (Source: NTSB video drive-through, March 27, 2018) In July 2018, 4 months after the crash, Caltrans added chevron-shaped striping to the neutral area of the gore at the Mountain View crash location (see figure 14). The NTSB asked Tesla whether diagonal cross-hatching or chevron striping would have been effective in preventing the Tesla from entering the gore area. Tesla responded as follows: . . . for the firmware installed on the vehicle at the time, gore point striping would not have affected the Autosteer behavior in this crash. In more recent firmware and future firmware, gore point striping may have helped our vision system to discriminate the gore from lanes.

NTSB

Highway Accident Report 23

Figure 14. Aerial view of US-101 at the crash location, depicting chevrons (cross-hatching) added to the gore area in July 2018, 4 months after the crash. (Source: Google Earth, image date of August 8, 2018) 1.9.3 Crash Attenuator 1.9.3.1 Background Information. The end of the concrete barrier that separates the left-exit HOV lane (which leads to SR-85) and the HOV lane on US-101 was shielded by a proprietary crash attenuator.34 The crash attenuator was an SCI Smart Cushion® 100GM crash cushion, manufactured and marketed by Work Area Protection Corporation.35 The crash attenuator uses a hydraulic cylinder and cable assembly to provide a variable stopping force based on vehicle impact speed.36 In a frontal impact, the attenuator telescopes rearward to absorb impact energy. Once the crash attenuator has been crushed by an impact, it must be replaced or repaired in order to regain operational status. The crash attenuator is intended to protect motorists by reducing collision forces as it gradually slows a colliding vehicle and helps to absorb the impact energy. On the day of the crash, the crash attenuator was in a nonoperational, damaged state due to a previous crash that occurred on March 12, 2018. During the March 12 crash, which happened at 10:30 p.m., a 2010 Toyota Prius, operated by a 31-year-old male driver, was southbound on US-101 when it entered the gore area and struck the crash attenuator at a speed in excess of 75 mph. The lap/shoulder-belted Toyota driver survived the crash and was transported to the hospital with injuries.

34 In this report, the terms “crash attenuator” and “crash cushion” should be considered synonymous and are used to describe the traffic safety hardware shielding the concrete median barrier on US-101. 35 See Work Area Protection website (accessed May 28, 2019). 36 The crash attenuator was tested to the requirements of Test Level 3 found in the American Association of State Highway and Transportation Officials’ Manual for Assessing Safety Hardware (MASH).

NTSB

Highway Accident Report 24 The CHP responded to the March 12 crash but did not notify Caltrans of the damage to state property as required by policy and interagency operational agreements.37 On March 20, 2018, two Caltrans maintenance workers patrolling the area discovered that the crash attenuator was damaged. Caltrans inspected the attenuator and determined that it was damaged beyond repair and had to be replaced with a new attenuator. No date was scheduled for the replacement because the Caltrans maintenance supervisor had to locate a replacement attenuator, and maintenance crews were required to be on 12-hour storm patrol shifts due to inclement weather. The maintenance supervisor directed that traffic cones and a Type 1 sawhorse-style plastic barricade be placed in advance of the damaged attenuator until it was replaced. Figure 15 depicts the precrash condition of the attenuator and the location of the displaced barricade and traffic cones.38

Figure 15. Southbound US-101 view depicting the precrash damaged condition of the crash attenuator, orange traffic cones, and a displaced Type 1 sawhorse-style barricade on March 22,

1. (Source: CHP photo provided by passerby)
2. 9.3.2 Crash History. Crash and maintenance records show that the attenuator at the crash

location was damaged or repaired more frequently than any other left-exit crash attenuator in Caltrans District 4―it had more than double the repairs of any other location.39 Traffic collision data show that in the 3 years before the fatal March 23, 2018, crash, the attenuator was struck at

37 For more information, see the CHP/Caltrans Joint Operational Statement and the Caltrans Traffic Incident Management Guidelines in the public docket for this investigation. 38 Several witnesses provided the CHP and the NTSB with dashcam videos showing the precrash condition of the attenuator and the location of traffic control devices. One video was taken on the morning of March 23, 2018, less than 2 hours before the crash. The image shows the plastic sawhorse barricade lying on the ground immediately north of the attenuator and two orange traffic cones near the white line bordering the left side of the gore, with another cone lying on its side near the end of the concrete barricade. 39 Between January 2006 and the fatal March 23, 2018, collision, the crash attenuator was damaged at least 12 times. Caltrans District 4 is headquartered in Oakland, California, and provides services to Sonoma, Napa, Solano, Marin, San Francisco, Contra Costa, Alameda, San Mateo, and Santa Clara counties.

NTSB

Highway Accident Report 25 least five times, including one collision that resulted in fatal injuries.40 The crash attenuator at this location was struck again on May 20, 2018, about 2 months after the crash involving the Tesla. 1.9.3.3 Maintenance of Traffic Safety Devices. The NTSB reviewed Caltrans’ maintenance procedures and identified systemic problems related to the timely repair of traffic safety hardware. Similar problems were identified during the NTSB investigation of a fatal crash in San Jose, California, that occurred on January 19, 2016, and involved a motorcoach colliding with a crash attenuator on US-101 (NTSB 2017a). Similar to the Mountain View case, the San Jose crash attenuator had been damaged in a previous collision (in this case, 44 days earlier). The NTSB determined that an inadequate work order tracking system contributed to Caltrans’ not completing the necessary repairs to the San Jose crash attenuator, and recommended that Caltrans take the following action: H-17-4 Modify your work order tracking system to show completion status and to include a means of providing reminders when work orders, particularly those for proprietary devices, are overdue or incomplete. The status of Safety Recommendation H-17-4 is “Open―Await Response.” In meetings with the NTSB, Caltrans has communicated that the agency will officially respond once ongoing litigation pertaining to the San Jose crash permits. In the meantime, Caltrans has developed a dashboard to track overdue service requests and work orders, which is generated and shared daily with maintenance personnel. In August 2019, the NTSB adopted a safety recommendation report that concluded that the Caltrans maintenance and repair program has been ineffective in ensuring the timely repair of traffic safety hardware (NTSB 2019b). As a result, the NTSB issued the following safety recommendation to the California State Transportation Agency (CalSTA)41: H-19-13 Develop and implement a corrective action plan that guarantees timely repair of traffic safety hardware and includes performance measures to track state agency compliance with repair timelines. On December 10, 2019, the secretary of CalSTA updated the NTSB on actions that CalSTA had taken to implement Safety Recommendation H-19-13. First, CalSTA outlined steps that the CHP had taken to enhance reporting of damage to traffic safety hardware. These steps included a revised statewide traffic crash report to include additional data elements to assist with notification procedures, revised CHP policy directives about the reporting of highway conditions, and development of an additional training module for officers regarding appropriate notification

40 The fatal crash occurred on November 14, 2015, and involved a previously damaged and nonoperational crash attenuator. For additional detail, refer to the Highway Factors factual report in the public docket for this crash investigation. 41 CalSTA is a cabinet-level state agency that focuses on addressing the state’s transportation issues. CalSTA provides oversight of Caltrans, the CHP, the California Transportation Commission, the Office of Traffic Safety, and the Department of Motor Vehicles.

NTSB

Highway Accident Report 26 procedures. Caltrans has also taken substantive action to facilitate timely repair of traffic safety hardware. The department will have emergency on-call contractors in place who, within 48 hours of notification, can repair or replace damaged traffic safety hardware when regular maintenance personnel cannot immediately respond. In addition, Caltrans has developed performance measures to monitor overdue service requests and work orders, which will be shared with the maintenance divisions daily. Finally, as a long-term effort, Caltrans is researching deployment-ready technologies that can alert Caltrans directly through electronic notification about impacts to traffic safety devices. 1.10 Weather and Illumination Data from the weather station at Moffett Federal Airfield in Mountain View, about 1.3 miles north of the crash site, indicate that on March 23, 2018, at 8:56 a.m. (31 minutes before the crash), the weather was clear, the temperature was 49°F, and the wind was from the southeast at 9 mph. According to the US Naval Observatory, at 9:27 a.m. at the crash location, the sun altitude was 26.5 degrees (angle up from the horizon) and the sun azimuth was 110.6 degrees (angle east of true north along the horizon).42

Based on the Tesla’s headway angle (117 degrees east of north), the sun at the time of the crash was about 6 degrees to the left of the driver’s and forward-facing camera’s view and 26.5 degrees above the horizon. NTSB investigators completed a drive-through of the crash location several days after the crash to examine the impact of sun position on a driver’s view. Investigators determined that although the sun position resulted in minor glare, the lane lines and lines delineating the gore were visible. 1.11 Other NTSB Investigations of Tesla Crashes with Autopilot Activated Between May 2016 and March 2019, the NTSB investigated three other crashes involving Tesla vehicles with Autopilot activated. This section of the report summarizes those crashes. 1.11.1 Williston, Florida (May 7, 2016) At 4:36 p.m. on Saturday, May 7, 2016, a 2015 Tesla Model S 70D electric-powered car, traveling east on US Highway 27A (US-27A), west of Williston, Florida, struck a refrigerated semitrailer powered by a 2014 Freightliner Cascadia truck-tractor (NTSB 2017b). At the time of the collision, the truck was making a left turn from westbound US-27A across the two eastbound travel lanes onto NE 140th Court, a local paved road. The car struck the right side of the semitrailer, crossed underneath it, and then went off the right side of the road. The driver, who was the sole occupant of the car, died in the crash; the commercial truck driver was not injured (see figure 16). System performance data downloaded from the car indicated that the driver was operating it using the Autopilot system features TACC and Autosteer.

42 The altitude and azimuth values are for the center of the apparent disk of the sun.

NTSB

Highway Accident Report 27

Figure 16. The 2015 Tesla after striking the side of a semitrailer in Williston, Florida. The NTSB determined that the probable cause of the Williston crash was the truck driver’s failure to yield the right of way to the car, combined with the car driver’s inattention due to overreliance on vehicle automation, which resulted in the car driver’s lack of reaction to the presence of the truck. Contributing to the car driver’s overreliance on the vehicle automation was its operational design, which permitted his prolonged disengagement from the driving task and his use of the automation in ways inconsistent with guidance and warnings from the manufacturer. 1.11.2 Culver City, California (January 22, 2018) At 8:40 a.m. on Monday, January 22, 2018, a 2014 Tesla Model S P85 electric-powered car was traveling behind another vehicle in the HOV lane of southbound Interstate 405 (I-405) in Culver City, California (NTSB 2019a). Because of a collision in the northbound freeway lanes that happened 25 minutes earlier, a CHP vehicle was parked on the left shoulder of southbound I-405, and a Culver City Fire Department truck was parked diagonally across the southbound HOV lane. The emergency lights were active on both the CHP vehicle and the fire truck. The vehicle ahead of the Tesla changed lanes to the right to go around the fire truck, but the Tesla remained in the HOV lane, accelerated, and struck the rear of the unoccupied fire truck at a recorded speed of 31 mph (see figure 17).43 The Tesla driver did not report any injuries. System performance data downloaded from the car indicated that the driver was operating it using the Autopilot system features TACC and Autosteer.

43 About 0.49 seconds before the crash, the FCW system detected a stationary object in the Tesla’s path. A visual and audible warning was provided to the driver; however, the AEB system did not activate.

NTSB

Highway Accident Report 28

Figure 17. Overhead view of the 2014 Tesla and fire truck on I-405 in Culver City, California. (Source: CHP) The NTSB determined that the probable cause of the Culver City crash was the Tesla driver’s lack of response to the stationary fire truck in his travel lane, due to inattention and overreliance on the vehicle’s ADAS; the Tesla’s Autopilot design, which permitted the driver to disengage from the driving task; and the driver’s use of the system in ways inconsistent with guidance and warnings from the manufacturer. 1.11.3 Delray Beach, Florida (March 1, 2019) At 6:17 a.m. on Friday, March 1, 2019, a 2018 Tesla Model 3 electric-powered car was traveling south in the right lane of the 14000 block of US Highway 441 (US-441), also known as State Road 7, in Delray Beach, Palm Beach County, Florida (NTSB 2020). At the same time, a 2019 International truck-tractor in combination with a semitrailer was eastbound in a private driveway belonging to an agricultural facility. The truck driver intended to cross the US-441 southbound lanes and turn left into the northbound lanes. The combination vehicle entered the highway without stopping and was subsequently struck by the southbound Tesla. The car struck the left side of the semitrailer and crossed underneath it, shearing off the roof (see figure 18). The driver, who was the sole occupant of the car, died in the crash; the commercial truck driver was not injured.

NTSB

Highway Accident Report 29

Figure 18. The 2018 Tesla after striking the side of a semitrailer in Delray Beach, Florida. The NTSB determined that the probable cause of the Delray Beach crash was the truck driver’s failure to yield the right of way to the car, combined with the car driver’s inattention due to overreliance on automation, which resulted in his failure to react to the presence of the truck. Contributing to the crash was the operational design of Tesla’s partial automation system, which permitted disengagement by the driver, and the company’s failure to limit the use of the system to the conditions for which it was designed. Further contributing to the crash was the failure of NHTSA to develop a method of verifying manufacturers’ incorporation of acceptable system safeguards for vehicles with Level 2 automation capabilities that limit the use of automated vehicle control systems to the conditions for which they were designed.

NTSB

Highway Accident Report 30 2 Analysis 2.1 Introduction The Mountain View crash involved a 2017 Tesla Model X P100D electric-powered SUV. The 38-year-old driver, traveling south on US-101, was using the Tesla Autopilot system. As the Tesla approached the paved gore area dividing the main travel lanes of US-101 from the SR-85 left-exit ramp, the SUV steered to the left and entered the gore area. The Tesla continued traveling through the gore area and struck a nonoperational crash attenuator at a speed of about 71 mph. The Tesla was subsequently struck by two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4.44 During the collision sequence, the Tesla’s high-voltage battery was breached and a postcrash fire ensued. After the crash, on-scene witnesses found the driver in his seat with his lap/shoulder belt buckled. They removed him from the vehicle before it was engulfed in flames. The driver was transported to a local hospital, where he died from blunt-force trauma injuries. Section 2.2 of the analysis focuses on the safety issues found in the Mountain View crash related to the Tesla Autopilot performance, collision avoidance system performance, driver distraction, and highway infrastructure issues. Section 2.3 expands the analysis to include a review of three other Tesla crashes in which vehicles were operating with Autopilot activated, as well as an evaluation of partial driving automation systems in the following contexts: • Risk Mitigation Pertaining to Monitoring Driver Engagement (section 2.3.1), • Risk Assessment Pertaining to Operational Design Domain (section 2.3.2), • Limitations of Collision Avoidance Systems (section 2.3.3), and • Insufficient Federal Oversight of Partial Driving Automation Systems (section 2.3.4). Section 2.4 discusses the need for event data recorders for driving automation systems. Following a comprehensive review of the circumstances that led to the Mountain View crash, the NTSB established that the following factors did not contribute to the cause of the crash: • Driver licensing, qualification, or familiarization with the vehicle and roadway: The Tesla driver was properly licensed and familiar with the vehicle driving automation systems. He was also very familiar with the roadway and route of travel at the crash location. • Medical conditions, impairment, or fatigue: The Tesla driver had no known health issues and did not take any medications. A postmortem toxicology test did not detect

44 The analysis and findings will only address issues related to the Tesla driver and vehicle.

NTSB

Highway Accident Report 31 alcohol or other tested-for drugs in his system. He routinely slept between 6.5 and 7.5 hours a night, including the night before the crash. • Weather conditions: The weather was clear with no precipitation at or near the time of the crash, and the roadway was dry. The NTSB, therefore, concludes that none of the following were factors in the Tesla driver’s actions in this crash: (1) driver licensing or qualification; (2) familiarization with the vehicle and roadway; (3) medical conditions, fatigue, or impairment by alcohol or other drugs; or (4) weather conditions. Fire department, law enforcement, and emergency medical personnel arrived at the crash location within 10 minutes of the collision. Initial fire suppression efforts were successful in extinguishing the flames. However, occasional popping noises were emitted from the Tesla, accompanied by smoke. Due to concerns regarding the high voltage of the Tesla’s lithium-ion battery, which was breached during the crash, the fire department incident commander requested Tesla Inc. assistance in helping to make the vehicle safe. About 6 hours after the crash, the vehicle was able to be transported to an impound facility, and the highway was reopened for travel. The NTSB concludes that the emergency response to the crash was timely and adequate. Additionally, the NTSB concludes that the Tesla electric vehicle postcrash fire and related damage to the lithium-ion battery presented unusual fire and electrical hazards to first responders. 2.2 Mountain View Crash Discussion 2.2.1 Crash Sequence As the Tesla approached the US-101−SR-85 interchange, it was traveling on US-101 in the second lane from the left with the Autopilot system engaged, at a speed of between 64 and 66 mph, and following a sedan at about 83 feet of distance. When the Tesla was 5.9 seconds and about 560 feet from the crash attenuator, Autosteer initiated a left steering input (5.6 degrees at the steering wheel) toward the neutral area of the gore not intended for vehicle travel. The Autopilot system did not detect driver-applied steering wheel torque at the time when the vehicle steered into the gore and did not provide any type of warning (visual, audible, or haptic) that the vehicle was traveling through the gore. As the SUV closed to within 375 feet of the crash attenuator―3.9 seconds from impact―the Tesla was about centered in the gore area between the left and right 8-inch-wide channelizing lines and the Autopilot system no longer detected a lead vehicle. The TACC began accelerating from a speed of 61.9 mph to the preset cruise speed of 75 mph. The FCW did not provide an alert, the AEB did not activate, and the Tesla struck the nonoperational crash attenuator at a speed of 70.8 mph. The driver did not take evasive action (braking or steering) to prevent the crash or mitigate its severity. 2.2.2 Autopilot Performance Autopilot navigates roadways by detecting lane markings and predicting the path of the vehicle’s travel lane. These predictions are made by the vehicle’s imaging system: the cameras and the computing software. Tesla’s Autopilot technology package is a combination of systems

NTSB

Highway Accident Report 32 that control the vehicle speed and path by automated control of braking, steering, and torque to the drive motors. All actions of predicting the lane and actuating steering are determined by the vehicle’s vision system. NTSB investigators attempted to determine the exact reason Autosteer directed the SUV into the neutral area of the gore, which was not intended for vehicle travel. As acknowledged by Tesla in published information, including the owner’s manual, Autosteer is subject to circumstances that can impair system operation. Autosteer is described as particularly unlikely to operate in situations when unable to accurately determine lane markings, or when bright light is interfering with the cameras’ view, visibility is poor, or the windshield area in the cameras’ view is obstructed. The lane markings delineating the gore area from the left-exit HOV lane for SR-85 were worn at the time of the crash, with the right edge line of the gore being worn and faded in the initial half of the gore where Autosteer directed the SUV left. In correspondence, Tesla engineers surmised that the Autosteer system likely momentarily lost its lane line prediction and/or identified a stronger lane line on the left side of the gore. Also, at the time of the crash, bright sunlight was shining toward the Tesla’s forward-facing camera at an angle of 6 degrees to the left of the vehicle’s center and 26 degrees above the horizon. Although the effect of the bright light on the Tesla vision system cannot be determined with certainty, investigators determined that the sunlight presented no more than discomfort glare to the human eye and the lines delineating the gore were readily visible. Although an exact reason is not known, a steering movement into the gore was associated with the vision system’s processing software not accurately predicting the path of the current lane of travel. Therefore, the NTSB concludes that the Tesla’s Autopilot lane-keeping assist system steered the SUV to the left into the neutral area of the gore, without providing an alert to the driver, due to limitations of the Tesla Autopilot vision system’s processing software to accurately maintain the appropriate lane of travel. Since the crash, Tesla has changed the vision system processing software with firmware updates designed to improve overall performance. According to Tesla, the revised processing software improves the way the system determines lanes and provides better lane prediction on pitched and curvy roads. In June 2018, Tesla also released firmware version 2018.23, which added an immediate alert for no hands on the steering wheel if unusual lane lines are detected or if no valid lane is detected when no lead vehicle is present. It is unknown whether these software changes would have prevented the Mountain View crash or to what extent the new software would have been able to accurately and consistently detect unusual or worn lane markings. 2.2.3 Collision Avoidance System Performance The FCW and AEB features in Tesla’s collision avoidance system use camera and radar information to provide warnings to the driver and to activate braking to prevent or mitigate an imminent crash if the driver does not respond. The system is designed to recognize and detect slow, stopped, and decelerating vehicles when they are traveling ahead of the Tesla in the same lane. The Tesla Carlog data showed that on the approach to the crash attenuator, the FCW system did not provide an alert and AEB did not activate. Tesla’s FCW/AEB, like most manufacturer systems, are designed and tested primarily to detect and provide warnings for some vehicle profiles, not targets such as a crash attenuator. Additionally, current NHTSA testing protocols for FCW and AEB are limited to a maximum speed of 45 mph and use only vehicle profile targets. Therefore, the NTSB concludes that the Tesla’s collision avoidance systems were not designed to, and did not, detect the crash attenuator at the end of the gore, nor did NHTSA require such

NTSB

Highway Accident Report 33 capability; consequently, the FCW system did not provide an alert and the AEB did not activate. Section 2.3.3 further discusses collision avoidance systems in reference to all four Autopilot-related crash investigations. 2.2.4 Driver Distraction The Tesla was more than 500 feet from the crash attenuator when the SUV first entered the gore area of US-101. When the Tesla was 375 feet from the attenuator the vehicle was centered between the two lines delineating the gore with no vehicles ahead to impede the driver’s view of the approaching hazard. Additionally, forward of the attenuator were two orange traffic cones marking the left side of the gore, and a plastic sawhorse-style barricade was lying on the ground directly in front of the Tesla’s path of travel.

During the final 4 seconds of travel prior to impact, the Tesla accelerated toward the crash attenuator and the driver took no evasive braking or steering action to avoid a collision. This level of inaction, given the numerous visual cues of a hazard ahead and unobstructed view, indicates that the driver was inattentive to his forward view and was not appropriately supervising the Autopilot vehicle control system. The driver was an avid gamer and game developer who routinely used gaming applications on his cell phone. A review of cell phone records and data retrieved from his Apple iPhone 8 Plus cell phone showed that a game application was active during his trip to work. It was also determined that the game was the frontmost open cell phone application on his phone when the crash occurred and data rate usage was consistent with gaming activity. Although the data could not be used to ascertain whether the driver was holding the phone during the final seconds before the crash, the Carlog data showed that his hands were not detected on the steering wheel and that he made no evasive steering or braking input before the crash. The driver’s lack of evasive action as the Tesla steered to the left into the gore area and traveled more than 500 feet toward the crash attenuator, combined with data indicating that his hands were not detected on the steering wheel, is consistent with a person distracted by a portable electronic device (PED). Therefore, the NTSB concludes that the driver did not take corrective action when the Tesla’s Autopilot lane-keeping assist system steered the vehicle into the gore area, nor did he take evasive action to avoid the collision with the crash attenuator, most likely due to distraction caused by a cell phone game application. 2.2.4.1 A National Problem. Eliminating distraction in transportation has been an issue on the NTSB Most Wanted List of Transportation Safety Improvements for several years. NHTSA reports that 3,166 people died in crashes involving distracted drivers in 2017; of those, 434 died in crashes where cell phone use was cited as a distraction (NHTSA 2019a). According to a 2018 National Occupant Protection Use Survey, which provides the only nationwide probability-based observed data on driver electronic device use in the United States, an estimated 9.7 percent of drivers were using some type of phone, either handheld or hands-free, at a typical daylight moment in 2018 (NHTSA 2019b).

Interacting with a game application, similar to texting while driving, can be highly distracting because it involves the three major types of distraction: visual distraction―taking your eyes off the road; manual distraction―taking your hands of the wheel and manipulating a PED;

NTSB

Highway Accident Report 34 and cognitive distraction―taking your mind off driving and instead concentrating on game strategy. Research has shown that both the visual–manual distraction of manipulating PEDs (Hickman and others, 2010) and the cognitive distraction of using hands-free PEDs (Strayer and others, 2013) significantly impair driver performance. An analysis of data from a naturalistic study of more than 3,000 drivers showed that the crash risk was more than three times greater when drivers were manipulating a cell phone compared to when they were not distracted (Dingus and others, 2016).45 The NTSB has also found cell phone-related distraction to be a recurring safety issue; for example, distraction was the main factor in a March 18, 2018, fatal crash in Tempe, Arizona. That evening, a modified 2017 Volvo SC90 SUV struck and fatally injured a pedestrian crossing the roadway outside a crosswalk. The Advanced Technologies Group of Uber Technologies, Inc. had installed in the SUV a proprietary developmental ADS, which was active at the time of the collision. During the entire crash trip, the driver was streaming a television show on her cell phone. In addition to cell phone-related distraction, lack of adequate mechanisms for addressing operators’ automation complacency was one of the contributing factors in the Tempe crash (NTSB 2019c).

Additionally, following the investigation of a fatal multivehicle collision in Gray Summit, Missouri, on August 5, 2010, the NTSB recommended that all 50 states and the District of Columbia address distraction due to PED use while driving (NTSB 2011):

H-11-39 (1) Ban the nonemergency use of portable electronic devices (other than those designed to support the driving task) for all drivers; (2) use the National Highway Traffic Safety Administration model of high visibility enforcement to support these bans; and (3) implement targeted communication campaigns to inform motorists of the new law and enforcement, and to warn them of the dangers associated with the nonemergency use of portable electronic devices while driving. The NTSB also concluded that manufacturers and providers of PEDs known to be frequently used while driving should reduce the potential of those devices to distract drivers by developing features that discourage their use or that limit their non-driving- or nonemergency-related functionality while a vehicle is in operation. Accordingly, the NTSB recommended that the Cellular Telecommunications Industry Association (CTIA) and the Consumer Electronics Association (CEA) take the following action: H-11-47 Encourage the development of technology features that disable the functions of portable electronic devices within reach of the driver when a vehicle is in motion; these technology features should include the ability to permit emergency use of the device while the vehicle is in motion and have the capability of identifying occupant seating position so as not to interfere with use of the device by passengers.

45 The naturalistic driving study, completed by researchers at the Virginia Tech Transportation Institute, found that the overall crash risk when interacting with a handheld cell phone was 3.6 times higher.

NTSB

Highway Accident Report 35 Crash statistics for 2013–2017 show that fatal collisions involving cell phone use remain persistently high and have not changed significantly, averaging more than 420 deaths per year (NHTSA 2019a).46 Although many states have enacted legislation that restricts cell phone use by drivers, no state completely bans all forms of cell phone use while driving. Currently, 15 states prohibit drivers from using handheld cell phones while driving and 48 states, the District of Columbia, Puerto Rico, Guam, and the US Virgin Islands ban text messaging for all drivers (NHTSA 2019b).47 California has enacted some of the strongest state laws in the nation banning handheld cell phone use while driving and supports these bans with high-visibility law enforcement campaigns. In April 2019 (the year’s National Distracted Driving Awareness Month), the CHP participated in law enforcement efforts across the state to crack down on drivers distracted by PEDs. During the month, the CHP issued 19,850 citations to drivers who violated laws pertaining to hands-free cell phone use (California Office of Traffic Safety [OTS] 2019). This total represented a 3.6-percent increase over a similar campaign in April 2018. In addition, an observational study showed that distracted driving due to PED use among California drivers increased from 3.58 percent in 2017 to 4.52 percent in 2018 (OTS 2018).48 Efforts to combat distraction have focused primarily on a combination of education, legislation, and enforcement. Based on statistics showing that PED distraction in fatal crashes has not decreased, it is clear that more needs to be done. Therefore, the NTSB concludes that distracted driving due to PED use remains persistently high, and additional countermeasures are needed. 2.2.4.2 Federal Driver Distraction Guidelines. In 2012, NHTSA proposed a long-term, three-phase approach to combat distracted driving by issuing guidelines to address the distraction potential of in-vehicle equipment and PEDs. Phase 1 of the proposal addressed visual–manual interfaces of devices installed in vehicles as original equipment.49 Phase 2 focused on guidelines for PEDs and aftermarket devices.50 The third phase, still in development, will expand the guidelines to include auditory–vocal interfaces. In response to the two sets of guidelines, the NTSB

46 Safety Recommendation H-11-39 remains in an “Open” status for all state recipients. Refer to the NTSB’s safety recommendation database for individual state responses. Safety Recommendation H-11-47 to the CTIA was classified “Closed―Acceptable Action” because the CTIA promotes technological solutions at events and through media campaigns. Safety Recommendation H-11-47 was also issued to the CEA; it responded to the recommendation but did not provide details regarding efforts to develop technologies to mitigate distraction from PEDs. Note: The CEA was renamed the Consumer Technology Association (CTA) in November 2015. 47 See also https://www.ghsa.org/state-laws/issues/distracted%20driving (accessed February 4, 2020). 48 The authors of the study emphasize that the value indicates that at any one time, the number of people distracted by an electronic device was 4.52 percent, but the number of people engaging in this behavior across their time on a given trip is likely much higher. A person may have been on a phone or sending a text message 5 minutes before they were observed, and these cases are not included in the distracted driving figures (OTS 2018). 49 See 77 Federal Register 11200 (February 24, 2012), “Visual–Manual NHTSA Driver Distraction Guidelines for In-Vehicle Electronic Devices.” 50 See 81 Federal Register 87656 (December 5, 2016), “Visual–Manual NHTSA Driver Distraction Guidelines for Portable and Aftermarket Devices.”

NTSB

Highway Accident Report 36 expressed concern that NHTSA’s Driver Distraction Program underemphasized the role of cognitive distraction.51 Phase 1 guidelines permit operating in-vehicle equipment―even for non-safety-related purposes―as long as the driver can complete the tasks with glances away from the roadway of 2 seconds or less and a cumulative time spent glancing away from the roadway of 12 seconds or less.52 In addition, Phase 1 includes lock-out requirements prohibiting certain activities while driving, including displaying video not related to driving; displaying certain graphical or photographic images; displaying automatically scrolling text; manual text entry for the purpose of text-based messaging or internet browsing; and displaying text for reading from books, publications, text-based messages, or other written content. Phase 2 guidelines call for the pairing of PEDs with in-vehicle equipment to use the built-in displays and controls. The NTSB expressed concern about pairing personal smartphones, tablets, or music devices with original equipment interfaces unless the pairing supports the driving task (for example, GPS navigation). Encouraging the use of PEDs while driving―as pairing does―sends the wrong message to the driving public and may mislead drivers to believe that the use of devices for non-driving tasks while driving is safe if paired with in-vehicle systems. For devices that do not pair with in-vehicle equipment, NHTSA Phase 2 proposed guidelines call for PEDs to be equipped with a “Driver Mode” that conforms with the Phase 1 glance and lock-out requirements.53 NHTSA’s preferred option is for automatic (as opposed to manual) activation of a PED’s Driver Mode when a vehicle is in motion.54 In response to NHTSA Phase 2 guidelines, the CTIA called on NHTSA to withdraw the proposed guidelines and re-establish an approach to distracted driving that concentrates on public outreach and educational efforts.55 The CTIA also challenged NHTSA’s authority to issue regulations, or even voluntary guidelines, for PEDs. The CTA (formerly CEA) also questioned NHTSA’s regulatory authority to dictate the design of smartphone applications and other devices used in cars, claiming that NHTSA’s legal jurisdiction begins and ends with motor vehicle equipment. The CTA pointed to a January 20, 2017, White House Chief of Staff memorandum calling for the withdrawal or delay of all pending regulations.56 Since issuing the proposed guidelines in 2017, NHTSA has not taken any substantive action and is still considering whether to issue a final set of visual–manual driver distraction guidelines for PEDs. The NTSB’s response to the federal driver distraction guidelines maintained our firm belief that until PEDs can be designed to have no effect on safe driving―or to improve safe driving―they should be disabled in the driving environment.

51 See NTSB public comments to Phase 1 and Phase 2 guidelines in docket nos. NHTSA-2010-0053 and NHTSA-2013-0137. 52 NHTSA research cited in 77 Federal Register 11200 found that glances away from the forward road scene greater than 2 seconds at a time are associated with increased crash risk. 53 Driver Mode was modeled after the similar feature “Airplane Mode,” which, when activated, disables all voice, text, telephone, and other signal-transmitting technologies such as Wi-Fi and Bluetooth. 54 Driver Mode does not activate when the device is being used by a non-driver (such as a passenger). 55 See CTIA letter dated February 3, 2017, in Docket No. NHTSA-2013-0137. 56 See CTA letter dated February 13, 2017, in Docket No. NHTSA-2013-0137.

NTSB

Highway Accident Report 37 2.2.4.3 Technological Solutions to Combat Distracted Driving. In 2013, CTA initiated a working group focused on addressing portable and aftermarket electronic devices used by drivers in vehicles.57 The group had the goal of developing industry-based guidelines for PED design that would address driver distraction. In mid-2014, the working group abandoned its work to develop guidelines due to liability concerns. In March 2014, NHTSA hosted a public meeting to bring together vehicle manufacturers and suppliers, portable and aftermarket device manufacturers, cellular service providers, industry associations, application developers, and consumer groups to discuss technological solutions. Additionally, in 2014, the NTSB and NHTSA participated in “Over-Connected and Behind the Wheel: A Summit on Technological Solutions to Distracted Driving.”58

Many companies have demonstrated technical solutions for aspects of the distracted driving problem. Cell phone providers have begun offering mobile phone applications that disable texting and block nonemergency calls when a vehicle is in motion, and third-party devices are currently available that allow motorists to voluntarily disable nonemergency calls on their cell phones while driving. The two primary methods of detecting driving to activate the blocking software use either GPS information or information directly from the vehicle’s on-board diagnostic port. A field test of cell phone filter/blocking technology showed that participants answered fewer incoming calls when the vehicle was in motion and placed more calls when a vehicle was stopped during the blocking period (NHTSA 2013). In 2017, Apple Inc. introduced a new feature for iPhones called “Do Not Disturb While Driving.” This feature is designed to prevent cell phone owners from receiving messages and calls when driving and lets contacts know they are occupied with driving. This application does not automatically lock the cell phone from use but instead permits numerous options to receive notifications and receive calls from certain contacts. Additionally, the feature can be disabled at any time. After Apple released the application, the Insurance Institute for Highway Safety conducted a nationally representative survey of iPhone owners and found that only about one in five had the feature set to activate automatically while driving (Reagan and others, 2018). Because voluntary activation of cell phone lock-out applications is likely to have limited implementation by drivers, automatic activation of technology shows the most promise in combating driver distraction.

Technological approaches have also been developed to identify which vehicle occupant is using a PED. Most approaches use a combination of hardware and software installed in the vehicle and on the PED to determine whether the device user is a driver or passenger. Device-only solutions often use an authentication task approach, whereby a device automatically enters a limited-use state at a speed threshold, and a quick, but challenging task is required to re-enable its full functionality. These authentication tasks are designed to be quick and easy for non-drivers, but nearly impossible for drivers to complete successfully within the short time limit. In April 2014, Apple was granted a patent for technology that would disable all distracting functions on a driver’s phone through a lock-out mechanism.59 In summarizing the invention, Apple

57 See 81 Federal Register 87656 (December 5, 2016), “Visual–Manual NHTSA Driver Distraction Guidelines for Portable and Aftermarket Devices.” 58 This daylong summit featuring three roundtable discussions was held on February 6, 2014, and hosted by Senator John D. (Jay) Rockefeller, IV, the chairman of the US Senate Committee on Commerce, Science and Transportation. 59 See US Patent no. 8,706,143 B1 (“Driver Handheld Computing Device Lock-Out”), issued April 22, 2014.

NTSB

Highway Accident Report 38 described the lock-out mechanism as having the ability to lock out certain functions, such as texting, while a person is driving. The device features a motion analyzer that can detect whether the PED is in motion and beyond a predetermined threshold level, a scenery analyzer that can determine whether the holder of the PED is located in a safe operating area of a vehicle, and a lock-out mechanism that can disable the PED or one or more of its functions based on information from the motion and scenery analyzers. Apple’s patent describes the challenges of combating distracted driving, stating that “texting while driving has become so widespread it is doubtful that law enforcement will have any significant effect on stopping the practice.” The NTSB concludes that a technological solution, such as a lock-out function or application that automatically disables highly distracting features of a PED while driving, is an effective countermeasure for eliminating PED distraction while driving. Cell phone manufacturers have the technological capability and hold the key to eliminating PED driver distraction.60 Although it may not be feasible or agreeable by manufacturers to completely lock-out all cell phone features while driving, at a minimum, devices should meet per se lock-out requirements described in NHTSA Phase 1 guidelines, including locking out the display of video; displaying graphical or photographic images; displaying text messages; prohibiting manual text entry for the purpose of text-based messaging or internet browsing; and the displaying of text for reading from books, publications, text-based messages, or other written content. Therefore, the NTSB recommends that manufacturers of PEDs (Apple, Google, HTC, Lenovo, LG, Motorola, Nokia, Samsung, and Sony) develop a distracted driving lock-out mechanism or application for PEDs that will automatically disable any driver-distracting functions when a vehicle is in motion, but that allows the device to be used in an emergency; install the mechanism as a default setting on all new devices and apply it to existing commercially available devices during major software updates. Because this recommendation focuses on action needed by individual cell phone manufacturers, Safety Recommendation H-11-47 to CEA (now CTA) is reclassified from “Open―Await Response” to “Closed―No Longer Applicable.” 2.2.4.4 Employers’ Role in Combating Distracted Driving. The Tesla driver was an Apple employee and was issued two cell phones by the company; one for business and one for personal use. During his trip to work, the driver was most likely interacting with a gaming application on his business-issued cell phone and thereby likely distracted at the time of the crash. Cell phone records and data obtained from the driver’s phone also showed that he was most likely using his Apple-supplied phone to play games while driving in the 4 days prior to the crash. Apple does not have a distracted driving or company policy prohibiting the use of company-supplied phones while driving.

Employers should have a responsibility to protect their employees and others with whom they share the road. The National Safety Council (NSC), the Network of Employers for Traffic Safety (NETS), and others have developed best practices and comprehensive tools. The NSC advocates company cell phone policies that prohibit employees from using handheld and hands-free devices while driving any company vehicle, using any company cell phone device

60 Percentages of US smartphone sales in the third quarter of 2019 were as follows: Apple (42 percent), Samsung (25 percent), LG (12 percent), Lenovo (8 percent), and all others (13 percent). For more information, see www.counterpointresearch.com/us-market-smartphone-share/.

NTSB

Highway Accident Report 39 while driving, or participating in any work-related communications while driving (even if in a personal vehicle or on a personal cell phone; NSC 2015). The NSC has also developed a cell phone policy kit that provides in-depth information for safety-conscious employers on how to successfully implement or strengthen company cell phone policy. NETS conducts studies that analyze the number of crashes per million miles driven and the percentage of fleet vehicles involved in crashes. Regarding distracted driving, NETS data obtained from a 2018 fleet benchmarking study showed that the most effective fleet safety practices are those that include: (1) a strong cell phone policy; (2) procedures to check if and when the policy is violated; and (3) strong enforcement measures in the event of violations.61 First, regarding cell phone use policies, banning cell phone use resulted in measurably fewer crashes and a lower percentage of vehicles involved in those crashes. When technological steps were introduced to disable cell phone use under the cell phone bans, the crashes were further reduced considerably. Second, companies that checked cell phone use records after every crash, not just after serious ones, experienced even fewer crashes and lower percentages than those that checked selectively or not at all. With regard to the third practice concerning enforcement, companies that enforced strong actions following violations―including the possibility of termination―had considerably fewer and lower percentages of crashes than those that just provided warnings, and much lower than those that took no special action. Although the Tesla driver was operating his personal vehicle on his way to work, the use of his company-supplied PED may have been prevented if a company policy was in place restricting cell phone use while driving with strict consequences for violating the policy. The NTSB concludes that strong company policy, with strict consequences for using PEDs while driving, is an effective strategy in helping to prevent distracted driving crashes, injuries, and fatalities. Therefore, the NTSB recommends that Apple Inc. develop and implement a company policy that bans the nonemergency use of PEDs while driving by all employees and contractors driving company vehicles, operating company-issued PEDs, or using a PED to engage in work- related communications. Although many companies across the United States have strong programs in place regarding distracted driving―including prohibition against using PEDs while driving―a large majority still have not implemented this safety measure. The Occupational Safety and Health Administration (OSHA) is the federal agency that sets and enforces standards for employees’ health and safety. As part of this mission, OSHA provides training, outreach, education, and assistance to private sector employers and employees. Working with NETS and NHTSA, OSHA published guidelines for employers to reduce motor vehicle crashes.62 The OSHA guidelines, however, are very broad and do not provide employers with specific guidance regarding how to develop a clear and enforceable policy prohibiting the use of PEDs while driving.

61 Refer to NETS correspondence in public docket for this investigation. 62 https://www.osha.gov/Publications/motor_vehicle_guide.html (accessed 10/1/2019).

NTSB

Highway Accident Report 40 From an enforcement standpoint, in the absence of federal distracted driving laws for noncommercial drivers, OSHA has authority to issue citations against employers under its general duty clause for failure to address distracted driving hazards.63 However, a review of statistics pertaining to OSHA’s enforcement of the general duty clause identified only a few cases where the agency used this authority against employers for failing to develop and enforce effective distracted driving policies. The NTSB concludes that although OSHA has guidelines for companies to reduce motor vehicle crashes by prohibiting the use of PEDs while driving, the guidelines lack specificity, are not widely adopted by companies, and are seldom enforced―limiting their impact in addressing the hazards of distracted driving. Therefore, the NTSB recommends that OSHA review and revise its distracted driving initiatives to increase employers’ awareness of the need to develop strong cell phone policy prohibiting the use of PEDs while driving. The NTSB further recommends that OSHA modify its enforcement strategies to increase the use of the general duty clause cited in 29 United States Code section 654 against those employers who fail to address the hazards of distracted driving. 2.2.4.5 Monitoring Driver Engagement. The Tesla driver was likely distracted for at least 5 seconds, as shown by his lack of evasive action as he traveled through the neutral area of the gore and the vehicle accelerated toward the crash attenuator. Tesla Autopilot assesses the driver’s level of engagement by monitoring driver interaction with the steering wheel through changes in steering wheel torque.64 The system uses the driver’s interactions with the steering wheel to determine the driver’s degree of engagement with the tasks of monitoring the road environment and supervising the Autopilot system’s performance. If the system does not detect signs of driver engagement for relatively long periods of time, an escalating series of visual and audible warnings is presented to the driver.

In examining the Tesla Carlog performance data for this crash, investigators noted that the Autopilot system provided two visual alerts and one auditory warning to the driver to put his hands on the steering wheel earlier in the trip. However, during the final 15 minutes before the crash, the system did not provide any visual or audible alerts warning the driver to put his hands on the steering wheel even though his hands came off the steering wheel on multiple occasions for time periods exceeding 10 seconds. At the time of the crash, the system allowed drivers to have their hands off the steering wheel for up to 3 minutes under certain highway driving conditions.

During the last 60 seconds before the crash, the system did not detect driver-applied steering wheel torque 43 percent of the time and provided no warnings to the driver. The system did not provide a hands-off alert to the driver when the system momentarily lost lane line prediction as the vehicle steered to the left into the gore area.65 The NTSB concludes that the Tesla

63 The Occupational Safety and Health Act of 1970 general duty clause (29 United States Code section 654 [a][1]) states that “each employer shall furnish each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees.” Penalties for willful violations of the general duty clause can range up to $132,598 per occurrence. 64 According to Tesla, although the weight of the hands on the steering wheel is often enough to register as driver interaction, on some occasions the system will not register torque if the driver is only lightly touching the steering wheel. 65 Recommendations to address driver monitoring deficiencies are included in section 2.3.1 of this report.

NTSB

Highway Accident Report 41 Autopilot system did not provide an effective means of monitoring the driver’s level of engagement with the driving task. For further discussion, see section 2.3.1 of this report. 2.2.5 Highway Infrastructure Issues 2.2.5.1 Roadway Markings. A review of the highway environment in the Mountain View crash investigation revealed faded roadway lane markings in the vicinity of where the Tesla Autopilot lane-keeping assist system steered the SUV to the left into the gore. Additionally, the gore was not marked with optional chevrons to designate the area as an off-limits zone for vehicular travel. Although Tesla Inc. indicated that optional gore point striping would not have improved the Autopilot behavior or prevented the crash, the manufacturer stated that in future firmware updates, gore point and roadway striping may help the vision system discriminate the gore from the travel lanes. The design of highways―from the type and color of pavement used, to the signage, to the lighting, and the speed limit―is based on extensive human performance research. Automated vehicles, starting at even SAE Level 2 driving automation systems, may require that many of these guidelines be revised in the future. In June 2018, the Federal Highway Administration (FHWA) began a National Dialogue on Highway Automation to receive input from stakeholders to prepare FHWA programs and policies to incorporate automation considerations. Additionally, the National Cooperative Highway Research Program (NCHRP), funded by state DOTs, began a major research project titled “Impacts of Connected Vehicles and Automated Vehicles on State and Local Transportation Agencies” (NCHRP 20-102). The project looks specifically at infrastructure design and operations, such as: • Road Markings for Machine Vision (NCHRP 20-102[06]), • Implications of Connected and Automated Vehicles (NCHRP 14-42), and • Infrastructure Modifications to Improve the Operational Domain of Automated Vehicles (NCHRP 20-102[21]). The NTSB concludes that although the lack of gore area roadway striping at the Mountain View crash location likely did not contribute to the crash, ongoing research led by the FHWA can help identify what highway infrastructure changes may be needed in the future to accommodate automated vehicles. 2.2.5.2 Traffic Safety Hardware. As part of the Mountain View crash investigation, the NTSB issued a safety recommendation report on August 12, 2019, addressing systemic problems related to the timely repair of traffic safety hardware in California (NTSB 2019b). Investigators found that on the day of the crash, the crash attenuator at the US-101−SR-85 interchange was in a nonoperational damaged condition due to a previous crash, which occurred 11 days earlier on March 12, 2018. The CHP had responded to the March 12 crash but did not notify Caltrans of the damage to state property. The damaged condition of the crash attenuator went unnoticed by Caltrans―the entity responsible for replacing it―for 8 days until two Caltrans maintenance workers discovered it. Because of prior scheduled work, required storm patrol shifts due to inclement weather, and the need to locate a replacement, the attenuator was not repaired until March 26, 2018, 3 days after the crash that resulted in the death of the Tesla driver.

NTSB

Highway Accident Report 42

In the August 2019 safety recommendation report, the NTSB determined that Caltrans did not have a proactive surveillance and inspection program to identify damaged traffic safety hardware, did not have a risk-based maintenance system that prioritizes repairs based on risk factors, was lacking an accurate work order tracking system that provides feedback to maintenance personnel concerning overdue or incomplete work, and did not have an active on-call contract program that augments maintenance forces when necessary repairs cannot be completed in a timely manner. The NTSB concludes that the crash attenuator was in a damaged and nonoperational condition at the time of the collision due to the CHP’s failure to report the damage following a previous crash and systemic problems with Caltrans’s maintenance division in repairing traffic safety hardware in a timely manner.

Between August and December 2019, CalSTA coordinated substantive actions in response to Safety Recommendation H-19-13, which are described in section 1.9.3.3 of this report. Because of CalSTA’s efforts, the NTSB reclassifies the recommendation from “Open―Initial Response Received” to “Open―Acceptable Response.” 2.2.5.3 Crash Survivability. The NTSB evaluated the potential survivability of the crash if the Tesla had collided with an operational crash attenuator rather than the fully compressed damaged attenuator. As part of the analysis, investigators reviewed data from crash testing of an operational SCI Smart Cushion® 100GM crash cushion. Several crash tests were completed at an FHWA-approved test site, using a range of light trucks and cars tested at a nominal impact velocity of 60 mph.66 The purpose of a crash attenuator is to decelerate a vehicle more gradually, over a longer distance and greater duration of time, thus reducing the crash forces on the occupant. The SCI Smart Cushion® crash tests measured what the manufacturer calls the “ride-down acceleration” of the occupant, which represents the average acceleration of the crash test dummy relative to the deceleration of the vehicle in a collision.67 The tests, with roughly similar conditions as the Mountain View crash, demonstrated that a functional attenuator increases stopping distance and greatly reduces crash forces. The tests showed no penetration of the occupant compartment or deformation of the vehicle, and the occupant risk values were within survivable limits. The NTSB also examined the circumstances of the March 12, 2018, crash responsible for damaging the crash attenuator before the Tesla collision. NTSB investigators inspected the crash-involved Toyota Prius and downloaded the airbag control module, which had EDR capability. Data obtained from the EDR showed that the Toyota was traveling in excess of 75 mph when it collided with the crash attenuator. Although the data showed that the driver experienced a longitudinal speed change greater than the Tesla driver experienced, the ride-down time was much longer, resulting in lower collision forces and thus greater survivability. Based on the NTSB analysis of crash test data and a comparison of the crash data from the Toyota Prius and Tesla collisions, the NTSB concludes that if the crash attenuator at the

66 Refer to the Crash Attenuator MASH Eligibility and Crash Test Data report available in the public docket for this crash investigation. The vehicle types ranged from sedans lighter than the Tesla to pickup trucks of about the same mass as the Tesla, and with impact orientations similar to the crash. 67 Note that as the car is being decelerated in a crash, the occupant is being accelerated in his or her seat and then decelerated by the restraint system. The forces acting on the occupant can be somewhat higher than the forces acting on the vehicle, depending on the effectiveness of the restraint system.

NTSB

Highway Accident Report 43 US-101−SR-85 interchange had been repaired in a timely manner and in a functional condition before the March 23, 2018, crash, the Tesla driver most likely would have survived the collision. 2.3 Safety Issues Found in Partial Driving Automation Crashes

This section of the report incorporates lessons learned from multiple NTSB crash investigations involving vehicles operating with SAE Level 2 partial driving automation systems. Between May 2016 and March 2019, the NTSB investigated four crashes involving Tesla vehicles operating with Autopilot activated and identified several areas of concern, including: (1) ineffective driver monitoring to ensure driver engagement; (2) use of Autopilot outside the conditions the system was designed for and intended to be operated in, and (3) limitations of the collision avoidance systems to avoid certain crash scenarios. These areas of concern will be discussed in detail in the following report subsections, which include safety recommendations aimed at reducing crashes involving partial driving automation systems. 2.3.1 Risk Mitigation Pertaining to Monitoring Driver Engagement 2.3.1.1 Tesla Driver Monitoring System. Based on system design, in an SAE-defined Level 2 partial driving automation system, it is the driver’s responsibility to monitor the automation, maintain situational awareness of traffic conditions, understand the limitations of the automation, and be available to intervene and take over for the driving automation system at all times. In practice, however, drivers are poor at monitoring automation and do not perform well on tasks requiring passive vigilance (Parasuraman and Riley 1997; Moray and Inagaki 2000; and Parasuraman and Manzey 2010). Research shows that drivers often become disengaged from the driving task for both momentary and prolonged periods during automated phases of driving (Banks and others, 2018). Driver disengagement from supervising Autopilot’s partial automation was a critical factor in the four Tesla crashes the NTSB investigated.68 In the Mountain View and Culver City crashes, the drivers were found to be distracted and not supervising Autopilot’s performance or monitoring the driving environment (detecting and recognizing roadway hazards) leading up to the crash. Likewise, in the Williston and Delray Beach crashes, the drivers were inattentive and did not take any evasive action in response to semitrailer vehicles crossing the paths of their cars. Autopilot assesses a driver’s level of engagement by monitoring his or her interaction with the steering wheel through changes in steering wheel torque. However, because driving is a highly visual task, a driver’s touch or torque on the steering wheel is an ineffective method to determine whether he or she is fully engaged with the driving task. Simply checking whether the driver has placed a hand on the steering wheel gives little indication of where the driver is focusing his or her attention. Following the investigation of the Williston crash, the NTSB concluded that the way the Tesla Autopilot system monitored and responded to the driver’s interaction with the steering wheel was not an effective method of ensuring driver engagement. As a result, the NTSB

68 SAE Level 2 features are capable of performing only part of the dynamic driving task (DDT) and thus require a driver to perform the remainder of the DDT, as well as supervise the feature’s performance when the system is activated. A driver may disengage from the responsibility of supervising the performance of the automation for a variety of reasons such as inattention, driver distraction, fatigue, alcohol or drug impairment, medical incapacitation, and so on.

NTSB

Highway Accident Report 44 recommended that six manufacturers of vehicles equipped with Level 2 driving automation systems take the following action: H-17-42 Develop applications to more effectively sense the driver’s level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use. Of the six automakers, Tesla was the only company that has not officially responded to Safety Recommendation H-17-42.69 The NTSB continues to maintain that the operational design of Tesla’s automated vehicle control systems requires an attentive driver as an integral system element. Therefore, the NTSB reiterates Safety Recommendation H-17-42 to Tesla and reclassifies the recommendation from “Open―Await Response” to “Open―Unacceptable Response.” 2.3.1.2 Development of Standards for Driver Monitoring Systems. SAE Level 2 partial automation systems require that the driver monitor the highway and remain able to take control of the vehicle at any time. The success of a Level 2 system depends on a driver completing a monitoring task that requires sustained attention; however, humans generally perform poorly in the role of monitors. Additionally, if a system behaves in a consistent and reliable manner for prolonged periods, the user of that system can become complacent in its operation and may not respond appropriately when required (Parasuraman, Molloy, and Singh, 1993; Lee and See, 2004; Hollnagel and Woods, 2005). Because driver attention is an integral component of partial automation systems, a driver monitoring system must be able to assess whether and to what degree the driver is performing the role of supervisor of the automation. As seen in the four recent NTSB Tesla Autopilot crash investigations, drivers were able to disengage for prolonged periods of time. The type and timing of alerts are vital components of an effective monitoring system (NHTSA 2018). Studies have been performed to examine the most effective alerting approaches to maintain a driver’s attention. A NHTSA study found that a 2-second prompt of disengagement compared to a 7-second prompt increased the driver’s level of attentiveness. Additionally, it was found that bi-modal alerts (that is, visual and auditory, visual and haptic) were more effective than unimodal alerts at getting drivers to regain control of the vehicle when an unexpected lane change occurred (NHTSA 2015). In the United States, no standards or regulations for driver monitoring system design are currently in place, and the type and timing of alerts varies widely among manufacturers. Most manufacturers’ owner’s manuals state that the automated systems “require” hands-on-wheel operation. At the same time, active warnings provided by manufacturers, like Tesla, may not occur until more than 3 minutes of hands off the wheel have passed. Following the Williston and Mountain View crashes, Tesla released firmware updates that changed the alert timing to include more immediate alerts when driver-applied steering wheel torque is not detected. As of the publication of this report, the timing of visual alerts varies based on vehicle speed of travel (see figure D-1 in appendix D). For example, at a speed of 25 mph, if the system does not detect

69 The recipients of Safety Recommendation H-17-42 were BMW of North America, Mercedes-Benz USA, Nissan Group of North America, Tesla Inc., Volkswagen Group of America, and Volvo Car USA. During current investigations, Tesla provided information on its alert timings and other Autopilot system changes that the automaker reported were associated with improving driver engagement. These changes are documented in this report.

NTSB

Highway Accident Report 45 driver-applied steering wheel torque for 60 seconds, a visual alert will be provided. Even at 90 mph, it would take 10 seconds for the system to provide an alert, during which time the vehicle would have traveled a quarter of a mile. Although the alert timing is more immediate than previous Autopilot firmware versions, it is still likely inadequate to prevent most crashes, which occur in a matter of seconds (as seen in the Mountain View, Culver City, and Delray Beach collisions).70 For example, during NHTSA’s evaluation of crash events, the agency’s Office of Defects Investigation (ODI) found that most crash events develop in a short time frame and usually provide less than 3 seconds for a driver to detect, observe, and react to a pending collision (NHTSA 2017). Any amount of hands-off-wheel steering time (which is currently the surrogate measure of driver engagement that many manufacturers use) is a safety risk because just a few seconds of inattention has been shown to cause most crashes. The timing of hands-off-wheel warning intervals has been addressed in Europe by the United Nations Economic Commission for Europe (UNECE) (Mousel 2018). UNECE regulations require that drivers who misuse lane-keeping assist systems by going “hands off” must be warned by an optical signal (visual warning) after 15 seconds at the latest (see figure 19). Then, after 30 seconds, parts of the optical signal must turn red and an acoustic alert must be triggered. After 30 seconds of acoustic warning, an emergency signal of at least 5 seconds must sound a final warning.71

Figure 19. UNECE escalating timing of alerts for hands off wheel. (“LKAS” in the image means “lane-keeping assist system.”) (Source: Mousel 2018) A monitoring system needs to assess whether and to what degree drivers are performing their specified role. SAE J3016 states that monitoring is most frequently deployed as a countermeasure for misuse or abuse, including overreliance due to complacency; however, SAE J3016 is silent on what constitutes effective driver monitoring. Currently, no performance standards exist for the appropriate timing of alerts, the type of alert (visual, auditory, haptic), or

70 The critical events leading to these four crashes developed in less than 10 seconds. In the Mountain View crash, the Tesla Autopilot lane-keeping assist system steered the SUV to the left into the gore area less than 6 seconds before the collision with the crash attenuator. 71 Tesla advised the NTSB that Tesla vehicles operating in Europe are designed to meet the timing of alerts criteria set in UNECE regulations.

NTSB

Highway Accident Report 46 the use of redundant monitoring sensors to ensure driver engagement.72 Therefore, the NTSB concludes that because monitoring of driver-applied steering wheel torque is an ineffective surrogate measure of driver engagement, performance standards should be developed pertaining to an effective method of ensuring driver engagement in SAE Level 2 partial driving automation systems. Therefore, the NTSB recommends that NHTSA, for vehicles equipped with Level 2 automation, work with SAE International to develop performance standards for driver monitoring systems that will minimize driver disengagement, prevent automation complacency, and account for foreseeable misuse of the automation. The NTSB issues a corresponding recommendation to SAE International to work with NHTSA. The NTSB further recommends that NHTSA, after developing the performance standards for driver monitoring systems recommended in Safety Recommendation H-20-3 (above), require that all new passenger vehicles with Level 2 automation be equipped with a driver monitoring system that meets these standards. 2.3.2 Risk Assessment Pertaining to Operational Design Domain SAE J3016 discusses the need for manufacturers to accurately describe ADAS features and clearly define the level of driving automation and its capabilities, but also its operational design domain (ODD)―the conditions in which the driving automation system is intended to operate.73 Examples of such conditions include roadway type, geographic location, clear roadway markings, weather conditions, speed range, lighting conditions, and other manufacturer-defined system performance criteria or constraints. As shown in appendix C and summarized below, Tesla has outlined many operating conditions and limitations based on the Autopilot system design: • Designed for use on highways with a center divider, • Designed for areas with no cross-traffic and clear lane markings, • Not for use on city streets or where traffic conditions are constantly changing, • Not for use on winding roads with sharp curves, and • Not for use in inclement weather conditions with poor visibility. Despite communicating these operating conditions and limitations to owners and drivers, Tesla Autopilot firmware does not restrict the system’s use based on functional road classification. The system can essentially be used on any roads where it can detect lane markings, which allows drivers to activate driving automation systems at locations and under circumstances for which their use is not appropriate or safe, such as on roadways with cross traffic or in areas that do not consistently meet the ODD, such as roadways with inconsistent lane markings. The Mountain View crash occurred in a challenging multi-lane operational environment with exit ramps on both sides of the highway and faded roadway lane markings. To characterize and evaluate the

72 Some manufacturers have developed different approaches to monitor system performance, such as the use of eye-tracking cameras. The Driver Attention System in the 2018 Cadillac CT6 Super Cruise partial driving automation system uses a small camera located at the top of the steering column; the camera focuses exclusively on the driver and uses infrared light to track the driver’s head position. 73 The ODD discussion applies to the Autopilot partial driving automation system. Although the collision avoidance systems FCW and AEB use some of the same sensors (cameras and radar) as Autopilot, FCW and AEB are designed for, and meant to work in, all domains.

NTSB

Highway Accident Report 47 performance of Level 2 systems on public highways and in naturalistic environments, the American Automobile Association (AAA) conducted testing, which found that Level 2 systems performed best on open freeways but were challenged on freeways with moderate traffic and in areas of transitions (AAA 2018).74 Most Level 2 systems were incapable of staying in their lane on curved portions of freeways, including in freeway transition areas. SAE J3016 considers the ODD for Level 2 systems to be limited (see table 1). Today’s Level 2 systems can assess a vehicle’s location and the current roadway type/classification and determine whether the roadway is appropriate for the system’s ODD. Despite this capability, Tesla has chosen to permit operation of Autopilot under conditions that do not meet its ODD. Tesla has informed the NTSB that its “operational design domain limits are not applicable for Level 2 driver assist systems, such as Autopilot, because the driver determines the acceptable operating environment.” Moreover, Tesla has advised the NTSB that “Autopilot can be safely used on divided and undivided roads as long as the driver remains attentive and ready to take control.” The Williston, Florida, crash involved a 2015 Tesla Model S that collided with a tractor trailer combination crossing an uncontrolled intersection on a nonlimited-access highway.75 Partial automated vehicle operation on nonlimited-access highways presents challenges in detecting cross-path intrusions, pedestrian and bicycle traffic, and signage at intersections. Additionally, cross-path collisions are challenging for collision avoidance systems. The NTSB concluded in the investigation of the Williston crash that if automated vehicle control systems do not automatically restrict their own operation to those conditions for which they were designed and are appropriate, the risk of driver misuse remains. The NTSB recommended that Tesla and other manufacturers of Level 2 automation take the following action: H-17-41 Incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. Five automobile manufacturers responded to this recommendation with steps they were taking to address the issue. Tesla, however, has not responded. As mentioned previously, Tesla has stated that it does not believe ODD limits are applicable to the Autopilot system as long as the driver remains attentive. During the Mountain View investigation, Tesla was queried regarding plans to implement ODD restrictions and indicated that the driver was solely responsible for choosing when to use the SAE Level 2 system. However, Tesla vehicles continue to be involved in crashes where Autopilot is activated and operating outside the intended geographic ODD. In March 2019, in Delray Beach, Florida, a fatal crash involving a 2018 Tesla Model 3 occurred under circumstances very similar to the Williston crash. In the Delray Beach crash, a truck-tractor in combination with a semitrailer was traveling eastbound in a private driveway belonging to an agricultural facility on the west side of US-441. The combination vehicle entered the highway without stopping and was subsequently struck by the southbound Tesla. At the time of the crash,

74 Vehicles tested included the 2018 Mercedes-Benz S-Class with Active Distance and Steering Assist, the 2018 Nissan Rogue with ProPILOT Assist, the 2017 Tesla Model S with Autopilot, and the 2019 Volvo XC40 with Pilot Assist. 75 Access control is a key factor in the functional classification of roads. All interstates are “limited-access” roadways, providing no access to abutting land users. Travelers use high-speed entrance and exit ramps to access limited-access roadways (Federal Highway Administration 2013, p. 14).

NTSB

Highway Accident Report 48 the Autopilot system was active, and the Tesla was traveling at 68 mph in a 55-mph posted speed limit area. The Autopilot system and collision avoidance systems did not classify the crossing truck as a hazard, did not attempt to slow the vehicle, and did not provide a warning to the driver of the approaching crossing truck. Further, the driver did not take evasive action in response to the crossing truck. At the crash location, the highway was not limited-access and had more than 34 roadways and private driveways intersecting US-441 within the immediate 5-mile area. The Delray Beach highway operating environment, like the cross-traffic conditions in Williston, was clearly outside the Tesla Autopilot system’s ODD. Tesla, however, fails to provide system safeguards to limit the use of Autopilot for the operating conditions for which it was designed. By placing full reliance on the success of its partial automation system on the premise that drivers will be attentive at all times and will be sufficiently knowledgeable to make proper decisions regarding where to operate the system, Tesla has created a system designed to fail because of the foreseeable misuse of the system. The NTSB concludes that if Tesla Inc. does not incorporate system safeguards that limit the use of the Autopilot system to those conditions for which it was designed, continued use of the system beyond its ODD is foreseeable and the risk for future crashes will remain. Therefore, the NTSB reiterates Safety Recommendation H-17-41 to Tesla and reclassifies the recommendation from “Open―Await Response” to “Open―Unacceptable Response.” Without more rigorous standards or guidelines to manufacturers regarding Level 2 emerging automation technology, safeguards will be insufficient to prevent use of Level 2 systems in nondesigned ways. After the Williston crash, the NTSB recommended that NHTSA address this vital safety concern, as follows: H-17-38 Develop a method to verify that manufacturers of vehicles equipped with Level 2 vehicle automation systems incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. In response to Safety Recommendation H-17-38, NHTSA stated the following: The agency has no current plans to develop a specific method to verify manufacturers of vehicles equipped with Level 2 systems incorporate safeguards limiting the use of automated vehicle control systems to those conditions for which they were designed. Instead, if NHTSA identifies a safety-related defect trend in design or performance of a system, or identifies through its research or otherwise, any incidents in which a system did not perform as designed, it would exercise its authority as appropriate. In August 2018, the NTSB reclassified Safety Recommendation H-17-38 “Open―Unacceptable Response.” If NHTSA had been proactive in response to the recommendation after the Williston crash and verified that manufacturers such as Tesla incorporate ODD safeguards into their systems, the fatal Delray Beach crash might have been prevented. Therefore, the NTSB concludes that NHTSA’s failure to ensure that vehicle manufacturers of SAE Level 2 driving automation systems are incorporating appropriate system safeguards to limit

NTSB

Highway Accident Report 49 operation of these systems to the ODD compromises safety. The NTSB believes NHTSA should reevaluate its position on the importance of verifying that manufacturers incorporate ODD safeguards into their systems, and therefore reiterates Safety Recommendation H-17-38. 2.3.3 Limitations of Collision Avoidance Systems The four Tesla crashes that the NTSB investigated highlight the limitations of the collision avoidance systems FCW and AEB when vehicles equipped with the technology are traveling at high speed or are faced with vehicle shapes or objects that the system has not been designed to detect. In the Williston, Delray Beach, and Mountain View crashes, the involved vehicles were traveling at speeds in excess of 65 mph. In each crash, the FCW and AEB did not provide a warning and the AEB system did not activate the brakes because the systems are not designed or tested to operate consistently at speeds over 50 mph. Additionally, in each of the four crashes, the Tesla was faced with an object (fire truck, crash attenuator, or side of semitrailer) different from the type of vehicle targets that the system was designed to detect during testing. Yet, these types of objects are common on our roadways. The NTSB previously addressed FCW and AEB testing and assessment protocols in a special investigation report (NTSB 2015). The report concluded that NHTSA’s existing testing scenarios and protocols for the assessment of collision avoidance systems in passenger vehicles do not adequately represent the wide range of velocity conditions seen in crashes, particularly high-speed crashes. Because of this deficiency, the NTSB recommended that NHTSA take the following action: H-15-4 Develop and apply testing protocols to assess the performance of forward collision avoidance systems in passenger vehicles at various velocities, including high speed and high velocity-differential. Since receiving the recommendation, NHTSA has taken no action toward gaining a better understanding of how these lifesaving technologies perform in real-world high-speed crash scenarios. Therefore, in June 2016, the NTSB classified the recommendation “Open―Unacceptable Response.” In this report of the Mountain View crash, the NTSB reiterates Safety Recommendation H-15-4 to NHTSA. Because most manufacturers have designed SAE Level 2 driving automation systems to operate on high-speed, limited-access, divided highways such as interstate freeways, it is important that when the automation or the driver makes an error, that collision avoidance systems act as an additional layer of safety. The NTSB concludes that in order for driving automation systems to be safely deployed in a high-speed operating environment, collision avoidance systems must be able to effectively detect and respond to potential hazards, including roadside traffic safety hardware, and be able to execute forward collision avoidance at high speeds. Therefore, the NTSB recommends that NHTSA expand NCAP testing of forward collision avoidance system performance to include common obstacles, such as traffic safety hardware, cross-traffic vehicle profiles, and other applicable vehicle shapes or objects found in the highway operating environment.

NTSB

Highway Accident Report 50 2.3.4 Insufficient Federal Oversight of Partial Driving Automation Systems 2.3.4.1 Nonregulatory Approach. The US Department of Transportation (DOT) and NHTSA have taken a nonregulatory approach to automated vehicle safety as described in policy and in response to NTSB recommendations. The DOT has emphasized that “the right approach to achieving safety improvement begins with a focus on removing unnecessary barriers and issuing voluntary guidance, rather than regulations that could stifle innovation” (DOT 2018). Although the DOT has described how it will address increasing levels of automation (Levels 3–5), few if any vehicle performance regulations or guidelines have been explicitly provided for Level 2 systems in the United States. NHTSA has informed the NTSB that it plans to ensure the safety of Level 2 systems through its enforcement authority and surveillance program aimed at identifying safety-related defect trends in design or performance. The NTSB concludes that NHTSA’s approach to the oversight of automated vehicles is misguided, because it essentially relies on waiting for problems to occur rather than addressing safety issues proactively.76 Additionally, for an acceptable level of safety to be achieved, a robust surveillance program must be present so that vehicle safety-related defects can be identified in a timely manner. 2.3.4.2 NHTSA Enforcement of Automated Vehicle Safety-Related Defects. The National Traffic and Motor Vehicle Safety Act provides the basis and framework for NHTSA’s enforcement authority over motor vehicle equipment defects. NHTSA is charged with reducing deaths, injuries, and economic losses from motor vehicle crashes.77 Part of that mandate includes ensuring that motor vehicles and motor vehicle equipment, including automated vehicle safety technologies, perform in ways that “protect the public against unreasonable risk of accidents occurring because of design, construction, or performance of a motor vehicle, and against unreasonable risk of death or injury in an accident.”78

The NHTSA enforcement guidance states that when an automated safety technology causes crashes or injuries, or poses other safety risks, the agency will evaluate such technology through its investigative authority to determine whether the technology presents an unreasonable risk to safety.79 The guidance also states that manufacturers should take steps necessary to ensure that technology introduced on US roadways accounts for any foreseeable misuse that may occur, particularly in circumstances that require driver interaction while a vehicle is in operation.80 Included in the enforcement guidance is information directly relevant to the Mountain View crash and other recent Tesla crashes investigated by the NTSB. NHTSA states that “a semi-autonomous driving system that allows a driver to relinquish control of the vehicle while it is in operation but fails to adequately account for reasonably foreseeable situations where a

76 Refer to the testimony of NTSB Chairman Robert L. Sumwalt, III, before the US Senate Committee on Commerce, Science and Transportation on November 20, 2019, titled “Highly Automated Vehicles: Federal Perspectives on the Deployment of Safety Technology.” 77 See 49 United States Code section 30101. 78 See 49 United States Code 30102(a)(8). 79 NHTSA Enforcement Guidance Bulletin 2016-02; “Safety-Related Defects and Automated Safety Technologies,” 81 Federal Register 65705. 80 NHTSA has defined misuse as an operator, when having knowledge and understanding of the system’s limitations and operational use instructions, deliberately chooses not to act according to the intent and design of the automated component. When a driver, having full knowledge of the responsibility to supervise and monitor the roadway, engages in a secondary task that may disrupt or eliminate the capability to effectively perform monitoring duties, such disengagement can qualify as misuse.

NTSB

Highway Accident Report 51 distracted or inattentive driver must retake control of the vehicle at any point may also be an unreasonable risk to safety.”

In determining whether a vehicle design poses an “unreasonable risk” to safety, NHTSA is charged with answering the question through a forward-looking risk analysis. According to the enforcement guidance, the forward-looking risk analysis “is not to protect individuals from the risks associated with defective vehicles only after serious injuries have already occurred; it is to prevent serious injuries stemming from established defects before they occur.”

Because NHTSA has determined that oversight of Level 2 driving automation systems will be based primarily on tracking safety-related trends and enforcement authority, the NTSB concludes that it is essential that NHTSA’s surveillance and defect investigation program closely examine issues related to foreseeable misuse of automation and perform a forward-looking risk analysis to identify partial driving automation system defects that pose an unreasonable risk to safety.

On June 28, 2016, NHTSA’s ODI opened a preliminary investigation to examine the design and performance of Tesla’s driving automation systems in use at the time of the Williston crash.81 The investigation did not identify any defects but added that NHTSA intended to monitor the issues and reserved the right to take further action if circumstances warranted. An NTSB review of the ODI investigation report identified shortfalls in the agency’s evaluation of the Tesla Autopilot design. Deficiencies in the investigation include the following: • ODI described the Tesla hands-on steering wheel system for monitoring driver engagement but did not evaluate the effectiveness of the user monitoring system (type and timing of alerts) in maintaining driver engagement.82 • ODI examined steps taken by Tesla in the design process to safeguard against driver misuse but did not evaluate the degree to which drivers are currently misusing the Autopilot system.83 • ODI described the Autopilot ODD as highways with a center divider and clear lane markings but did not complete a forward-looking risk analysis to assess the ramifications of continued operation outside the ODD.84 Additionally, NHTSA identified numerous limitations of the Tesla Autopilot system but did not evaluate foreseeable consequences of drivers’ continued use beyond the system’s ODD. Therefore, the NTSB concludes that NHTSA’s ODI has failed to thoroughly investigate the Tesla Autopilot design regarding the degree to which drivers are currently misusing the system, the

81 NHTSA ODI investigation PE 16-007 (Automated vehicle control systems) closed January 19, 2017. 82 The ODI investigation stated that “driver misuse in the context of semi-autonomous vehicles is an emerging issue and the agency intends to continue its evaluation and monitoring of this topic, including best practices for handling driver misuse as well as driver education.” 83 A review of Tesla historical Carlog data could inform NHTSA of the prevalence of driver misuse of the Autopilot system and address the foreseeability of future misuse needed by investigators to make a defect determination. 84 ODI reported that the Autopilot system does not prevent operation on any road types. ODI also described that the crash avoidance systems (FCW/AEB) were not designed to detect and brake for cross-traffic and that certain vehicle shapes or objects, may delay or prevent the system from classifying various threats. ODI did not complete a review of historical Tesla Carlog data to determine the propensity of drivers to operate outside the ODD.

NTSB

Highway Accident Report 52 foreseeable consequences of continued use by drivers beyond the system’s ODD, and the effectiveness of the driver monitoring system in ensuring driver engagement. Following the closure of NHTSA’s ODI investigation PE-16-007 in January 2017, the agency stated that it would monitor Autopilot’s functionality and reserved the right to take further action if circumstances warranted it. During the past 3 years, numerous crashes, injuries, and fatalities have occurred involving Tesla vehicles operating with Autopilot activated.85 In addition, Tesla has collected a large data set that can be accessed to answer important questions related to how and where Autopilot is being used and the foreseeability of driver misuse.86 Therefore, the NTSB recommends that NHTSA evaluate Tesla Autopilot-equipped vehicles to determine if the system’s operating limitations, the foreseeability of driver misuse, and the ability to operate the vehicles outside the intended ODD pose an unreasonable risk to safety; if safety defects are identified, use applicable enforcement authority to ensure that Tesla Inc. takes corrective action. 2.4 Need for Event Data Recorders for Driving Automation Systems

Title 49 Code of Federal Regulations (CFR) Part 563 sets forth requirements for data elements, data capture and format, data retrieval, and data crash survivability for EDRs installed in light vehicles manufactured on or after September 1, 2012.87 The regulation did not mandate installation of EDRs in light vehicles; rather, if the vehicle manufacturer chooses to install an EDR, the regulation defines the format and specifies the requirements for providing commercially available tools and/or the methods for retrieving EDR data in the event of a crash. On December 13, 2012, NHTSA issued a notice of proposed rulemaking (NPRM) that proposed a new federal motor vehicle safety standard mandating that EDRs meeting 49 CFR Part 563 requirements be installed on most light vehicles. On February 8, 2019, NHTSA withdrew the proposed rulemaking because the agency determined that a mandate was not necessary. NHTSA’s internal analysis showed that for model year 2017, 99.6 percent of new light vehicles sold were equipped with EDRs that met Part 563 requirements. NHTSA added that given the near-universal installation of EDRs in light vehicles, NHTSA no longer believed that the safety benefits of mandating EDRs justified the expenditure of limited agency resources.

In the withdrawal of the final rule, NHTSA advised that it would continue its efforts to modernize and improve EDR regulations, including fulfilling the agency’s statutory mandate to promulgate regulations establishing an appropriate recording duration for EDR data to “provide accident investigators with vehicle-related information pertinent to crashes involving such motor vehicles.”88 Because the data recording requirements codified in 49 CFR Part 563 more than a decade ago are very limited, requiring the reporting of only 15 data elements, NHTSA advised

85 For example, NHTSA’s Special Crash Investigations program has initiated 14 investigations into Tesla crashes with Autopilot activated. 86 The NTSB requested that Tesla provide any studies, analyses, or reviews that examine driver habits when Autopilot was active. Tesla’s legal counsel replied, “we don’t have any data analysis on user habits. We form our viewpoints based on review of engineering experience, customer complaints, feedback, social media, service visits, and incident review, but this is subjective and anecdotal and not analytical as you describe.” 87 The EDR requirements apply to “light vehicles” required to have frontal airbags – those with a gross vehicle weight rating of 3,855 kilograms (8,500 pounds) or less and an unloaded vehicle weight of 2,495 kilograms (5,500 pounds) or less. 88 See the Fixing America’s Surface Transportation Act, Public Law 114-94 (December 4, 2015) section 24303.

NTSB

Highway Accident Report 53 that it is actively investigating whether the agency should revise the data elements to account for advanced safety features.

In the Mountain View, Culver City, and Delray Beach Tesla crashes, NTSB investigators were able to retrieve data from the RCM EDR, but the data did not address ADAS activation or engagement. As a result, the NTSB used Carlog data to interpret ADAS functionality, but this type of data is not available on many vehicles currently operating with these systems. Further, no commercially available tools are currently able to retrieve and review any non-EDR vehicle recorded data, and other manufacturers of vehicles with driving automation systems similarly control access to the postcrash proprietary information associated with their vehicles. The NTSB concludes that vehicle performance data associated with activation and engagement of SAE Level 2 partial driving automation systems on vehicles involved in crashes are not required nor available on most EDRs.

As more manufacturers deploy driving automation systems on their vehicles, to improve system safety, it will be necessary to develop detailed information about how the active safety systems performed during, and how drivers responded to, a crash sequence. Manufacturers, regulators, and crash investigators all need specific data in the event of a system malfunction or crash. Recorded data can be used to improve the automated systems and to understand situations that may not have been considered in the original designs. Investigators need event data to conduct effective and productive investigations involving vehicles using automated vehicle control systems. Further, data are needed to distinguish between automated control actions and driver control actions. Therefore, the NTSB concludes that a standardized set of retrievable data is needed to enable independent assessment of automated vehicle safety and to foster automation safety improvements.

Following the Williston fatal crash, on September 28, 2017, the NTSB made a recommendation to the US DOT regarding the need to define data parameters necessary to understand automated vehicle control systems, and made two recommendations to NHTSA to define a standard reporting format and to require manufacturers of vehicles equipped with driving automation systems to report incidents, crashes, and vehicle miles operated with the systems enabled: To the US DOT: H-17-37 Define the data parameters needed to understand the automated vehicle control systems involved in a crash. The parameters must reflect the vehicle’s control status and the frequency and duration of control actions to adequately characterize driver and vehicle performance before and during a crash. To NHTSA: H-17-39 Use the data parameters defined by the U.S. Department of Transportation in response to Safety Recommendation H-17-37 as a benchmark for new vehicles equipped with automated vehicle control systems so that they capture data that

NTSB

Highway Accident Report 54 reflect the vehicle’s control status and the frequency and duration of control actions needed to adequately characterize driver and vehicle performance before and during a crash; the captured data should be readily available to, at a minimum, National Transportation Safety Board investigators and National Highway Traffic Safety Administration regulators. H-17-40 Define a standard format for reporting automated vehicle control systems data and require manufacturers of vehicles equipped with automated vehicle control systems to report incidents, crashes, and vehicle miles operated with such systems enabled. In response to these recommendations, NHTSA advised that it had communicated with SAE International about developing industry standards but explained that “manufacturers are not currently required to enable vehicles to record data from usage of driving automation systems (SAE levels 1–2) or operation of such systems during crash triggered events. The ability for traditional vehicle manufacturers and other stakeholders to report on automated technology system use and its operation during incidents and crashes is highly dependent on each vehicle’s specific recording and downloading technology.” Additionally, NHTSA advised that it believes development of recording requirements is best accomplished through voluntary compliance until industry consensus on standard data elements can be established. NTSB experience with crashes involving different levels of driving automation shows that the amount and availability of recorded data varies widely amongst manufacturers. In the more than 2 years since these important safety recommendations were issued, neither the DOT nor NHTSA has taken any substantive action to address them. Although NHTSA replied on February 7, 2018, the DOT has not responded to Safety Recommendation H-17-37 since issuance. Because it is unlikely that crash investigators and regulators will fully understand the causal factors in a crash without easily accessible data from driving automation systems, the NTSB reiterates Safety Recommendation H-17-37 to the DOT and reclassifies it from “Open―Await Response” to “Open―Unacceptable Response.” In addition, the NTSB reiterates Safety Recommendations H-17-39 and -40 to NHTSA and reclassifies them from “Open―Acceptable Response” to “Open―Unacceptable Response.”

NTSB

Highway Accident Report 55 3 Conclusions 3.1 Findings

1. None of the following were factors in the Tesla driver’s actions in this crash: (1) driver

licensing or qualification; (2) familiarization with the vehicle and roadway; (3) medical conditions, fatigue, or impairment by alcohol or other drugs; or (4) weather conditions.

1. The emergency response to the crash was timely and adequate.
2. The Tesla electric vehicle postcrash fire and related damage to the lithium-ion battery

presented unusual fire and electrical hazards to first responders.

1. The Tesla’s Autopilot lane-keeping assist system steered the sport utility vehicle to the

left into the neutral area of the gore, without providing an alert to the driver, due to limitations of the Tesla Autopilot vision system’s processing software to accurately maintain the appropriate lane of travel.

1. The Tesla’s collision avoidance systems were not designed to, and did not, detect the

crash attenuator at the end of the gore, nor did the National Highway Traffic Safety Administration require such capability; consequently, the forward collision warning system did not provide an alert and the automatic emergency braking did not activate.

1. The driver did not take corrective action when the Tesla’s Autopilot lane-keeping assist

system steered the vehicle into the gore area, nor did he take evasive action to avoid the collision with the crash attenuator, most likely due to distraction caused by a cell phone game application.

1. Distracted driving due to portable electronic device use remains persistently high, and

additional countermeasures are needed.

1. A technological solution, such as a lock-out function or application that automatically

disables highly distracting features of a portable electronic device while driving, is an effective countermeasure for eliminating portable electronic device distraction while driving.

1. Strong company policy, with strict consequences for using portable electronic devices

while driving, is an effective strategy in helping to prevent distracted driving crashes, injuries, and fatalities.

1. Although the Occupational Safety and Health Administration has guidelines for

companies to reduce motor vehicle crashes by prohibiting the use of portable electronic devices while driving, the guidelines lack specificity, are not widely adopted by companies, and are seldom enforced―limiting their impact in addressing the hazards of distracted driving.

1. The Tesla Autopilot system did not provide an effective means of monitoring the

driver’s level of engagement with the driving task.

NTSB

Highway Accident Report 56

1. Although the lack of gore area roadway striping at the Mountain View crash location

likely did not contribute to the crash, ongoing research led by the Federal Highway Administration can help identify what highway infrastructure changes may be needed in the future to accommodate automated vehicles.

1. The crash attenuator was in a damaged and nonoperational condition at the time of the

collision due to the California Highway Patrol’s failure to report the damage following a previous crash and systemic problems with the California Department of Transportation’s maintenance division in repairing traffic safety hardware in a timely manner.

1. If the crash attenuator at the US Highway 101−State Route 85 interchange had been

repaired in a timely manner and in a functional condition before the March 23, 2018, crash, the Tesla driver most likely would have survived the collision.

1. Because monitoring of driver-applied steering wheel torque is an ineffective surrogate

measure of driver engagement, performance standards should be developed pertaining to an effective method of ensuring driver engagement in SAE Level 2 partial driving automation systems.

1. If Tesla Inc. does not incorporate system safeguards that limit the use of the Autopilot

system to those conditions for which it was designed, continued use of the system beyond its operational design domain is foreseeable and the risk for future crashes will remain.

1. The National Highway Traffic Safety Administration’s failure to ensure that vehicle

manufacturers of SAE Level 2 driving automation systems are incorporating appropriate system safeguards to limit operation of these systems to the operational design domain compromises safety.

1. In order for driving automation systems to be safely deployed in a high-speed operating

environment, collision avoidance systems must be able to effectively detect and respond to potential hazards, including roadside traffic safety hardware, and be able to execute forward collision avoidance at high speeds.

1. The National Highway Traffic Safety Administration’s approach to the oversight of

automated vehicles is misguided, because it essentially relies on waiting for problems to occur rather than addressing safety issues proactively.

1. It is essential that the National Highway Traffic Safety Administration’s surveillance

and defect investigation program closely examine issues related to foreseeable misuse of automation and perform a forward-looking risk analysis to identify partial driving automation system defects that pose an unreasonable risk to safety.

1. The National Highway Traffic Safety Administration’s Office of Defects Investigation

has failed to thoroughly investigate the Tesla Autopilot design regarding the degree to which drivers are currently misusing the system, the foreseeable consequences of continued use by drivers beyond the system’s operational design domain, and the effectiveness of the driver monitoring system in ensuring driver engagement.

NTSB

Highway Accident Report 57

1. Vehicle performance data associated with activation and engagement of partial driving

automation systems on vehicles involved in crashes are not required nor available on most event data recorders.

1. A standardized set of retrievable data is needed to enable independent assessment of

automated vehicle safety and to foster automation safety improvements.

NTSB

Highway Accident Report 58 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Mountain View, California, crash was the Tesla Autopilot system steering the sport utility vehicle into a highway gore area due to system limitations, and the driver’s lack of response due to distraction likely from a cell phone game application and overreliance on the Autopilot partial driving automation system. Contributing to the crash was the Tesla vehicle’s ineffective monitoring of driver engagement, which facilitated the driver’s complacency and inattentiveness. Contributing to the severity of the driver’s injuries was the vehicle’s impact with a crash attenuator barrier that was damaged and nonoperational at the time of the collision due to the California Highway Patrol’s failure to report the damage following a previous crash, and systemic problems with the California Department of Transportation’s maintenance division in repairing traffic safety hardware in a timely manner.

NTSB

Highway Accident Report 59 4 Recommendations 4.1 New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following nine new safety recommendations: To the National Highway Traffic Safety Administration: Expand New Car Assessment Program testing of forward collision avoidance system performance to include common obstacles, such as traffic safety hardware, cross-traffic vehicle profiles, and other applicable vehicle shapes or objects found in the highway operating environment. (H-20-1) Evaluate Tesla Autopilot-equipped vehicles to determine if the system’s operating limitations, the foreseeability of driver misuse, and the ability to operate the vehicles outside the intended operational design domain pose an unreasonable risk to safety; if safety defects are identified, use applicable enforcement authority to ensure that Tesla Inc. takes corrective action. (H-20-2) For vehicles equipped with Level 2 automation, work with SAE International to develop performance standards for driver monitoring systems that will minimize driver disengagement, prevent automation complacency, and account for foreseeable misuse of the automation. (H-20-3) After developing the performance standards for driver monitoring systems recommended in Safety Recommendation H-20-3, require that all new passenger vehicles with Level 2 automation be equipped with a driver monitoring system that meets these standards. (H-20-4) To the Occupational Safety and Health Administration: Review and revise your distracted driving initiatives to increase employers’ awareness of the need to develop strong cell phone policy prohibiting the use of portable electronic devices while driving. (H-20-5) Modify your enforcement strategies to increase the use of the general duty clause cited in 29 United States Code section 654 against those employers who fail to address the hazards of distracted driving. (H-20-6) To SAE International: For vehicles equipped with Level 2 automation, work with the National Highway Traffic Safety Administration to develop performance standards for driver monitoring systems that will minimize driver disengagement, prevent automation complacency, and account for foreseeable misuse of the automation. (H-20-7)

NTSB

Highway Accident Report 60 To Manufacturers of Portable Electronic Devices (Apple, Google, HTC, Lenovo, LG, Motorola, Nokia, Samsung, and Sony): Develop a distracted driving lock-out mechanism or application for portable electronic devices that will automatically disable any driver-distracting functions when a vehicle is in motion, but that allows the device to be used in an emergency; install the mechanism as a default setting on all new devices and apply it to existing commercially available devices during major software updates. (H-20-8) To Apple Inc.: Develop and implement a company policy that bans the nonemergency use of portable electronic devices while driving by all employees and contractors driving company vehicles, operating company-issued portable electronic devices, or using a portable electronic device to engage in work-related communications. (H-20-9) 4.2 Previously Issued Recommendations Reiterated in This Report As a result of its investigation, the National Transportation Safety Board reiterates the following two safety recommendations (already classified “Open―Unacceptable Response”) in sections 2.3.3 and 2.3.2, respectively, in this report: To the National Highway Traffic Safety Administration: Develop and apply testing protocols to assess the performance of forward collision avoidance systems in passenger vehicles at various velocities, including high speed and high velocity-differential. (H-15-4) Develop a method to verify that manufacturers of vehicles equipped with Level 2 vehicle automation systems incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. (H-17-38) 4.3 Previously Issued Recommendations Reiterated and Reclassified in This Report As a result of its investigation, the National Transportation Safety Board reiterates and reclassifies the following five safety recommendations: To the US Department of Transportation: Define the data parameters needed to understand the automated vehicle control systems involved in a crash. The parameters must reflect the vehicle’s control status and the frequency and duration of control actions to adequately characterize driver and vehicle performance before and during a crash. (H-17-37) Safety Recommendation H-17-37 is reclassified from “Open―Await Response” to “Open―Unacceptable Response” in section 2.4 of this report.

NTSB

Highway Accident Report 61 To the National Highway Traffic Safety Administration: Use the data parameters defined by the U.S. Department of Transportation in response to Safety Recommendation H-17-37 as a benchmark for new vehicles equipped with automated vehicle control systems so that they capture data that reflect the vehicle’s control status and the frequency and duration of control actions needed to adequately characterize driver and vehicle performance before and during a crash; the captured data should be readily available to, at a minimum, National Transportation Safety Board investigators and National Highway Traffic Safety Administration regulators. (H-17-39) Safety Recommendation H-17-39 is reclassified from “Open―Acceptable Response” to “Open―Unacceptable Response” in section 2.4 of this report. Define a standard format for reporting automated vehicle control systems data and require manufacturers of vehicles equipped with automated vehicle control systems to report incidents, crashes, and vehicle miles operated with such systems enabled. (H-17-40) Safety Recommendation H-17-40 is reclassified from “Open―Acceptable Response” to “Open―Unacceptable Response” in section 2.4 of this report. To Tesla Inc.: Incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. (H-17-41) Safety Recommendation H-17-41 is reclassified from “Open―Await Response” to “Open―Unacceptable Response” in section 2.3.2 of this report. Develop applications to more effectively sense the driver’s level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use. (H-17-42) Safety Recommendation H-17-42 is reclassified from “Open―Await Response” to “Open―Unacceptable Response” in section 2.3.1 of this report. 4.4 Previously Issued Recommendations Reclassified in This Report As a result of its investigation, the National Transportation Safety Board reclassifies the following two safety recommendations: To the Consumer Electronics Association (now the Consumer Technology Association): Encourage the development of technology features that disable the functions of portable electronic devices within reach of the driver when a vehicle is in motion; these technology features should include the ability to permit emergency use of the device while the vehicle is in motion and have the capability of identifying occupant

NTSB

Highway Accident Report 62 seating position so as not to interfere with use of the device by passengers. (H-11-47) Safety Recommendation H-11-47 is reclassified from “Open―Await Response” to “Closed―No Longer Applicable” in section 2.2.4.3 of this report. To the California State Transportation Agency: Develop and implement a corrective action plan that guarantees timely repair of traffic safety hardware and includes performance measures to track state agency compliance with repair timelines. (H-19-13) Safety Recommendation H-19-13 is reclassified from “Open―Initial Response Received” to “Open―Acceptable Response” in section 2.2.5.2 of this report.

NTSB

Highway Accident Report 63 BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III

JENNIFER HOMENDY Chairman

Member BRUCE LANDSBERG

THOMAS B. CHAPMAN Vice Chairman

Member

MICHAEL E. GRAHAM

Member Report Date: February 25, 2020

NTSB

Highway Accident Report 64 Board Member Statement Member Jennifer Homendy filed the following concurring statement on March 3, 2020:

The most dangerous way to travel in our country is on the road. In 2018, there were 36,560 fatalities on our nation’s roadways. Each and every one of these fatalities is tragic and that tragedy is compounded by the fact that most of these fatal crashes can be traced back to human error. The driver is the most vital part of the safe operation of a vehicle, but they can also be the most dangerous part of operating a vehicle. The appropriate use of proven technologies that support drivers in the safe operation of their vehicle has the potential to prevent crashes, reduce injuries, and save lives.

Nearly 25 years ago, based on the investigation of a multi-vehicle crash in Menifee, Arkansas, the NTSB issued a safety recommendation to the US DOT to begin testing of collision warning systems on commercial motor vehicles. This safety recommendation was “Closed―Unacceptable Action” in 1999 because the DOT failed to take action and the industry had taken the lead in testing the technology. The NTSB has continued to issue safety recommendations related to collision avoidance systems and most have been directed to NHTSA. In fact, increasing the implementation of collision avoidance systems in all new highway vehicles is on our 2019–2020 Most Wanted List of Transportation Safety Improvements. Unfortunately, like the safety recommendation to the DOT in 1995, NHTSA has continued the trend of inaction and has failed to implement many of our safety recommendations related to collision avoidance systems and other vehicle safety technology.

There is no disputing the benefits of vehicle safety technology. As technology matures and becomes more robust and integrated into vehicles across the country, many of the issues on our Most Wanted List could be addressed. Even before we see fully autonomous vehicles on our roads, the variety of technologies being discussed now could help prevent or mitigate speeding-related crashes; eliminate distraction; and recognize fatigue and driver impairment.

While there is tremendous potential for vehicle automation systems, there needs to be strong federal guidance around the testing and application of the technology. Since 2016, the NTSB has investigated four crashes that involved vehicles with varying levels of automation and our investigators are seeing many of the same issues over and over. As a result of our 2016 investigation in Williston, Florida, a safety recommendation was issued to NHTSA specific to Level 2 vehicle automation systems: Develop a method to verify that manufacturers of vehicles equipped with Level 2 vehicle automation systems incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. (H-17-38)

This safety recommendation has not been acted on and because of that inaction, NHTSA was identified in the probable cause as contributing to the 2019 crash in Delray Beach, Florida. NHTSA maintains that voluntary standards for manufacturers of vehicles with Level 3–5 automation systems is the best way forward and they completely ignore issues and concerns

NTSB

Highway Accident Report 65 CORRECTED COPY around Level 2 vehicle automation systems that are on our roads now. Instead, they are choosing to rely on their recall authority to address the safety of Level 2 systems.

The recall authority that NHTSA has is an important part of making sure vehicles in the United States are as safe as they can be, but that recall can only be utilized after a problem has been identified. This often means that lives have been lost while NHTSA is waiting for a problem to present itself. As Finding 19 of this report states, NHTSA’s “approach to the oversight of automated vehicles is misguided, because it essentially relies on waiting for problems to occur rather than addressing safety issues proactively.”

As a federal agency with the mission to “save lives, prevent injuries, and reduce economic costs due to road traffic crashes through education, research, safety standards, and enforcement activity,” the hands-off approach NHTSA is taking to collision avoidance systems and Level 2 vehicle automation systems seems counter to their mission. The latest policy on automated vehicle technologies from the DOT – Ensuring American Leadership in Automated Vehicle Technologies; Automated Vehicles 4.0 – is more focused on protecting innovation rather than promoting safety.

Our investigation of the Tempe, Arizona, automated test vehicle crash found that the lack of leadership has led states to try to fill the safety gaps that are being left by NHTSA. As vehicle technologies are developed and implemented, states have an important role in making sure their roadways are safe, but they shouldn’t be doing it alone. The Mountain View crash is an example of how NHTSA needs to first and foremost be focused on the safety of the traveling public and not on promoting innovation. The longer NHTSA decides to not be a safety leader, the longer our roadways will continue to see lives lost from the misuse of vehicle technology by drivers and manufacturers. Chairman Robert L. Sumwalt, III; Vice Chairman Bruce Landsberg; and Members Thomas B. Chapman and Michael E. Graham joined in this statement.

NTSB

Highway Accident Report 66 Appendix A: Investigation The National Transportation Safety Board was notified of this crash on March 23, 2018, and initially dispatched two investigators to the scene to examine safety issues related to the electric-powered vehicle fire. The investigation was expanded to include the human performance, vehicle automation, and highway safety issues addressed in this report. The NTSB team also included staff from the Office of Aviation Safety and the Office of Research and Engineering. Parties to the investigation were the California Department of Transportation and the California Highway Patrol. Pursuant to Title 49 CFR section 831, Tesla Inc. was designated as a party to this investigation because the automaker could provide qualified technical personnel who could actively assist in the investigation. On April 11, 2018, the NTSB revoked Tesla’s status as a party member because of the company’s failure to abide by the terms of the NTSB Party Agreement. After being removed as a party member, Tesla’s general counsel office continued to assist the NTSB and provided answers to investigators’ technical questions.

NTSB

Highway Accident Report 67 Appendix B: Tesla Carlog Data The table below depicts 14.9 seconds of data recorded immediately before the crash, retrieved from the Tesla’s Carlog.1 Table 3. Tesla Carlog data.

1 Distance measurements from the attenuator are approximate and were derived based on kinematic equations taking into account the speed recorded and individual time intervals. Lead vehicle distance was converted from meters to feet. Steering wheel angle is reported by the electronic assisted power steering system. Lateral acceleration values were converted from meters per second to g units. 2 Approximate speed at impact was not recorded in the Tesla Carlog. The speed was obtained from the Tesla EDR report, which was based on the imaging of the RCM. Time Time to Crash

Speed Distance from Attenuator Lead Vehicle Distance Steering (L or R) Lateral Acceleration 9:27:12.5 14.9 secs 69.5 mph 1437.9 feet 98.4 feet 1.6 deg. L 0.046 g’s 9:27:13.5 13.9 secs 69.6 mph 1335.9 feet 95.1 feet 0.8 deg. L 0.010 g’s 9:27:14.5 12.9 secs 69.4 mph 1234.7 feet 93.5 feet 0.4 deg. L .005 g’s 9:27:15.5 11.9 secs 68 mph 1133.9 feet 88.6 feet 0.2 deg. L 0.020 g’s 9:27:16.5 10.9 secs 66.75 mph 1035.1 feet 86.9 feet 1.4 deg. L 0.020 g’s 9:27:17.5 9.9 secs 65.65 mph 937.9 feet 83.7 feet 1.3 deg. L 0.010 g’s 9:27:18.5 8.9 secs 64.6 mph 842.3 feet 82 feet 0.8 deg. L 0.005 g’s 9:27:19.5 7.9 secs 64.3 mph 747.8 feet 83.7 feet 0.3 deg. L 0.010 g’s 9:27:20.5 6.9 secs 64.2 mph 653.6 feet 83.7 feet 1.6 deg. L 0.025 g’s 9:27:21.5 5.9 secs 64.05 mph 559.6 feet 82 feet 5.6 deg. L 0.122 g’s 9:27:22.5 4.9 secs 63.1 mph 466.3 feet 80.4 feet 0.8 deg. L .005 g’s 9:27:23.5 3.9 secs 61.9 mph 374.6 feet NA 0.3 deg. R -.005 g’s 9:27:24.5 2.9 secs 62.35 mph 283.5 feet NA 1.1 deg. R -.026 g’s 9:27:25.5 1.9 secs 65.25 mph 189.9 feet NA 1 deg. R -.031 g’s 9:27:26.5 0.9 secs 68.4 mph 91.9 feet NA 3.8 deg. L .036 g’s 9:27:27.4 0 70.84 mph2 0 NA NA NA

NTSB

Highway Accident Report 68 Appendix C: Autopilot and Collision Avoidance Limitations Limitations of Traffic-Aware Cruise Control (TACC):

The Tesla Model X Owner’s Manual states that TACC is primarily intended for driving on dry, straight roads, such as highways and freeways, and should not be used on city streets. The manual contains numerous warnings regarding the use of TACC related to the limitations of the system, including the following: • Warning: TACC is designed for your driving comfort and convenience and is not a collision warning or avoidance system. It is your responsibility to stay alert, drive safely, and be in control of the vehicle at all times. Never depend on TACC to adequately slow down Model X. Always watch the road in front of you and be prepared to take corrective action at all times. Failure to do so can result in serious injury or death. • Warning: Although TACC is capable of detecting pedestrians and cyclists, never depend on TACC to adequately slow down Model X for them. Always watch the road in front of you and be prepared to take corrective action at all times. Failures to do so can result in serious injury or death. • Warning: Do not use TACC on city streets or on roads where traffic conditions are constantly changing. • Warning: Do not use TACC on winding roads with sharp curves, on icy or slippery road surfaces, or when weather conditions (such as heavy rain, snow, fog, etc.) make it inappropriate to drive at a consistent speed. TACC does not adapt driving speed based on road and driving conditions. • Warning: Due to limitations inherent in the onboard GPS, you may experience situations in which TACC slows down the vehicle, especially near highway exits where a curve is detected and/or you are actively navigating to a destination and not following the route. • Warning: TACC cannot detect all objects and may not brake/decelerate for stationary vehicles, especially in situations when you are driving over 50 mph and a vehicle you are following moves out of your driving path and a stationary vehicle or object is in front of you instead. Always pay attention to the road ahead and stay prepared to take immediate corrective action. Depending on TACC to avoid a collision can result in serious injury or death. In addition, TACC may react to vehicles or objects that either do not exist or are not in the lane of travel, causing Model X to slow down unnecessarily or inappropriately. • Warning: TACC may be unable to provide adequate speed control because of limited braking capability and hills. It can also misjudge the distance from a vehicle ahead.

NTSB

Highway Accident Report 69 Driving downhill can increase driving speed, causing Model X to exceed your set speed. Never depend on TACC to slow down the vehicle to prevent a collision. Always keep your eyes on the road when driving and be prepared to take corrective action as needed. Depending on TACC to slow down enough to prevent a collision can result in serious injury or death. • Warning: TACC may occasionally brake Model X when not required or you are not expecting it. This can be caused by closely following a vehicle ahead, detecting vehicles or object in adjacent lanes (especially on curves), etc. • Warning: TACC can cancel unexpectedly at any time for unforeseen reasons. Always watch the road in front of you and stay prepared to take appropriate action. It is the driver’s responsibility to be in control of Model X at all times. • Limitations: TACC is particularly unlikely to operate as intended in the following types of situations: (1) the road has sharp curves; (2) visibility is poor (due to heavy rain, snow, fog, etc.); (3) bright light (oncoming headlights or direct sunlight) is interfering with the camera’s view; (4) the radar sensor is obstructed (dirty, covered, etc.); (5) the windshield area in the camera’s field of view is obstructed (fogged over, dirty, covered by a sticker, etc.). Limitations of Autosteer

The Tesla Model X Owner’s Manual lists the following warnings regarding Autosteer: • Warning: Autosteer is a hands-on feature. You must keep your hands on the steering wheel at all times. • Warning: Autosteer is intended for use only on highways and limited-access roads with a fully attentive driver. When using Autosteer, hold the steering wheel and be mindful of road conditions and surrounding traffic. Do not use Autosteer on city streets, in construction zones, or in areas where bicyclists or pedestrians may be present. Never depend on Autosteer to determine an appropriate driving path. Always be prepared to take immediate action. Failure to follow these instructions could cause serious property damage, injury or death. • Warning: Many unforeseen circumstances can impair the operation of Autosteer. Always keep this in mind and remember that as a result, Autosteer may not steer Model X appropriately. Always drive attentively and be prepared to take immediate action. • Limitations: Autosteer is particularly unlikely to operate as intended in the following situations: (1) when unable to accurately determine lane markings due to poor visibility (heavy rain, snow, fog, etc.), or an obstructed, covered or damaged camera or sensor; (2) when driving on hills; (3) when approaching a toll booth; (4) the road has sharp curves or is excessively rough; (5) bright light is interfering with the camera’s view; or (6) the sensors are affected by other electrical equipment or devices that generate ultrasonic waves.

NTSB

Highway Accident Report 70 Limitations of Forward Collision Warning (FCW) System The Tesla Model X Owner’s Manual lists the following warnings regarding the FCW system: • Warning: FCW is for guidance purposes only and is not a substitute for attentive driving and sound judgment. Keep your eyes on the road when driving and never depend on FCW to warn you of a potential collision. Several factors can reduce or impair performance, causing either unnecessary, invalid, inaccurate, or missed warnings. Depending on FCW to warn you of a potential collision can result in serious injury or death. • Warning: The cameras and sensors associated with FCW are designed to monitor an approximate area of up to 525 feet in your driving path. The area being monitored by FCW can be adversely affected by road and weather conditions. Use appropriate caution when driving. • Warning: FCW is designed to provide visual and audible alerts. It does not attempt to apply brakes or decelerate the Tesla Model X. When seeing and/or hearing a warning, it is the driver’s responsibility to take corrective action immediately. • Warning: FCW may provide a warning in situations where the likelihood of collision may not exist. Stay alert and always pay attention to the area in front of the Tesla Model X so the driver can anticipate whether any action is required. • Warning: FCW does not operate when the Tesla Model X is traveling less than 4 mph. • Warning: FCW does not provide a warning when the driver is already applying the brake. Limitations of Automatic Emergency Braking (AEB) System The Tesla Model X Owner’s Manual lists the following warnings regarding the AEB system: • Warning: AEB is not designed to prevent a collision. At best, it can minimize the impact of a frontal collision by attempting to reduce the driving speed. Depending on AEB to avoid a collision can result in serious injury or death. • Warning: It is strongly recommended that you do not disable AEB. If you disable it, Tesla Model X does not automatically apply the brakes in situations where a collision is considered likely. • Warning: Several factors can affect the performance of AEB, causing either no braking or inappropriate or untimely braking. It is the driver’s responsibility to drive safely and remain in control of the vehicle at all times. Never depend on AEB to avoid or reduce the impact of a collision.

NTSB

Highway Accident Report 71 • Warning: AEB is designed to reduce the impact of frontal collisions only and does not function when the Tesla Model X is in reverse. • Warning: AEB is not a substitute for maintaining a safe traveling distance between you and the vehicle in front of you. • Warning: The brake pedal moves downward abruptly during AEB events. Always ensure that the brake pedal can move freely. Do not place material on top of the Tesla-supplied driver’s floor mat (including an additional mat) and always ensure the driver’s floor mat is properly secured. Failure to do so can impede the ability of the brake pedal to move freely. • Limitations: Collision avoidance assist features cannot always detect vehicles, bikes, pedestrians, and you may experience unnecessary, inaccurate, invalid, or missed warning for many reasons, particularly if: (1) the road has sharp curves; (2) visibility is poor; (3) bright light is interfering with the camera’s view; (4) the radar sensor is obstructed; or (5) the windshield area in the camera’s field of view is obstructed.

NTSB

Highway Accident Report 72 Appendix D: Postcrash Changes Made to Tesla Autopilot After the Mountain View crash, Tesla made design changes to the Autopilot firmware. The changes are summarized below: • Hydranet Vision System (Firmware Update 2018.10.4, released March 2018): The firmware update includes vision system changes designed to improve the ability of the system to recognize poor and faded lane markings, slopes/banks, and higher-curvature roads. A higher fidelity “roadway estimator” was incorporated to improve lane and path prediction. The Hydranet Vision System also includes changes that impact depth detection, vision-radar association, and vehicle detection. • Autopilot Hands-Off-Wheel Alert Timing (Firmware Update 2018.23, released June 2018): The firmware changed the alert timing to include more immediate alerts when hands are not detected on the steering wheel and there is no valid lane line (plus no lead vehicle) or if an unusual lane line is detected (see figure D-1). It also includes visual alerts based upon speed-based escalation for travel speeds over 25 mph. For example, at a speed of 25 mph if the vehicle does not detect hands on wheel for 60 seconds, a visual alert would be provided. At 90 mph, the alert would be provided after 10 seconds. Tesla advised that more immediate audible warnings are also provided if the system no longer recognizes a lane while hands are not detected on the steering wheel.

Figure D-1. Autosteer hands-on alert timing for the Tesla after firmware 2018.23 was implemented in June 2018. (Changes are highlighted in green)

NTSB

Highway Accident Report 73 • Drivable Space Collision Warning (Firmware Update 2018.23): The firmware was updated with a forward collision warning and active braking when certain unknown objects are identified in the path of the vehicle. This “Drivable Space” time-to-collision provides a warning up to 2.5 seconds based on detection. Because this warning is part of the Autopilot system it cannot be disabled when the Autopilot system is operating. The warning system is determined by the camera vision system without radar fusion and establishes a boundary ahead of the vehicle. When the vehicle approaches the end of the drivable space, a chime will sound and maximum braking will be applied. Drivable space provides heavy deceleration but is primarily intended to give drivers an audible warning and reduce impact severity, not to fully prevent all crashes at highway speeds.

NTSB

Highway Accident Report 74 References AAA American Automobile Association. 2018. “AAA Level 2 Autonomous Vehicle Testing; AAA Propriety Research into the Performance of SAE Level 2 Autonomous Systems.” Banks, V. A., A. Erickson, J. O’Donoghue, and N.A. Stanton. 2018. Is Partially Automated Driving a Bad Idea? Observations from an On-Road Study. Applied Ergonomics 68: 138–145. Dingus, T. A., F. Guo, S. Lee, J. Antin, M. Perez, M. Buchanan-King, and J. Hankey. 2016. Naturalistic Driving Evaluation of Crash Risk. Proceedings of the National Academy of Sciences, March 2016, 113 (10) 2636–2641; DOI: 10.1073/PNAS.1513271113. DOT (US Department of Transportation). 2018. Preparing for the Future of Transportation: Automated Vehicle 3.0, Washington, DC: DOT. Hickman, J., R. Hanowski, and J. Bocanegra. 2010. Distraction in Commercial Trucks and Buses: Assessing Prevalence and Risk in Conjunction with Crashes and Near Crashes. FMCSA-RRR-10-049. Washington, DC: FMCSA. Hollnagel, E, and D. D. Woods. 2005. Joint Cognitive Systems Foundations of Cognitive Systems Engineering, Boca Raton, Florida: CRC Press. Lee, J. D., K. A. See. 2004. “Trust in Automation: Designing for Appropriate Reliance.” Human Factors, vol. 46, pp. 50–80. Moray, N., and T. Inagaki. 2000. “Attention and Complacency.” Theoretical Issues in Ergonomics Science 1: 354–365. Mousel, T. 2018. Hands off Detection Requirements for UN R79 Regulated Lane Keeping Assist Systems, IEE S.A. Luxembourg, paper number 17-0202. NHTSA 2015. Human Factors Evaluation of Level 2 and Level 3 Automated Driving Concepts, 2015, DOT-HS-812-182. Washington, DC: NHTSA. _____. 2017. Office of Defects Investigation Preliminary Evaluation of Automatic Vehicle Control Systems, PE 16-007. Washington, DC: NHTSA. _____. 2018. Human Factors Design Guidance for Level 2 and Level 3 Automated Driving Concepts, DOT-HS-812-555. Washington, DC: NHTSA. _____. 2019a. Distracted Driving in Fatal Crashes, 2017, DOT-HS-812-700. Washington, DC: NHTSA. _____. 2019b. Driver Electronic Device Use in 2018, DOT-HS-812-818. Washington, DC: NHTSA.

NTSB

Highway Accident Report 75 NSC (National Safety Council). 2015. Employer Liability and the Case for Comprehensive Cell Phone Policies. NTSB (National Transportation Safety Board). 2011. Multivehicle Collision, Interstate 44 Eastbound, Gray Summit, Missouri, August 5, 2010, NTSB/HAR-11/03. Washington, DC: NTSB. _____. 2015. The Use of Forward Collision Avoidance Systems to Prevent and Mitigate Rear-End Crashes, NTSB/SIR-15/01. Washington, DC: NTSB. _____. 2017a. Motorcoach Collision with Crash Attenuator in Gore Area, US Highway 101, San Jose, California, January 19, 2016, NTSB/HAR-17/01. Washington, DC: NTSB. _____. 2017b. Collision Between a Car Operating with Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. Washington, DC: NTSB. _____. 2019a. Rear-End Collision Between a Car Operating with Advanced Driver Assistance Systems and a Stationary Fire Truck, Culver City, California, January 22, 2018, NTSB/HAB-19/07. Washington, DC: NTSB. _____. 2019b. Addressing Systemic Problems Related to the Timely Repair of Traffic Safety Hardware in California, NTSB/HSR-19/01. Washington, DC: NTSB. _____. 2019c. Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, Arizona, March 18, 2018, NTSB/HAR-19/03. Washington, DC. _____. 2020. Collision Between Car Operating with Partial Driving Automation and Truck-Tractor Semitrailer, Delray Beach, Florida, March 1, 2019, NTSB/HAB-20/01. Washington, DC: NTSB. OTS (California Office of Traffic Safety). 2019. Results of Statewide Distracted Driving Awareness Campaign, May 17, 2019. _____. 2018. Observational Study of Distracted Driving Due to Electronic Device Use Among California Drivers for 2018. Parasuraman, R., and D. H. Manzey. 2010. “Complacency and Bias in Human Use of Automation: An Attentional Integration.” Human Factors 52(3): 381–410. Parasuraman, R., R. Molloy, and I. L. Singh. 1993. “Performance Consequences of Automation- Induced ‘Complacency’.” International Journal of Aviation Psychology 3: 1–23. Parasuraman, R., and V. Riley. 1997. “Humans and Automation: Use, Misuse, Disuse, and Abuse.” Human Factors 39(2): 230–253. Reagan, J., and J. Cicchino. 2018. Do Not Disturb While Driving – Use of Cellphone Blockers Among Adult Drivers. Insurance Institute of Highway Safety, December 2018.

NTSB

Highway Accident Report 76 SAE (SAE International). 2018. Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles, Recommended Practice J3016, June 2018. Strayer, D. L., J. M. Cooper, J. Turill, J. Coleman, N. Medeiros-Ward, and F. Biondi. 2013. Measuring Cognitive Distraction in the Automobile, Washington DC: AAA Foundation for Traffic Safety (www.aaafoundation.org/sites/default/files/MeasuringCognitive- Distractions.pdf). Tesla Inc. 2017. Tesla Model X Owner’s Manual.

FD07237 ｜ 2001_美国_HZB2001.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

65135

NTSB/HZB-20/01

National Transportation Safety Board Hazardous Materials Accident Brief Lithium-Ion Battery Truck Fire Following Aerial Transport Brampton, Ontario, Canada June 3, 2016 The Accident On June 3, 2016, about 4:05 p.m. local time, a FedEx W900 local delivery truck and all of its cargo were destroyed by a fire while the driver was delivering packages to a business in Brampton, Ontario, Canada; no injuries were reported.1 The fire began among a shipment of four large-format lithium-ion batteries, each of which was individually packaged in a fiberboard box.2 No other dangerous goods were on board.3 The international shipment of the four lithium-ion batteries originated from Braille Battery, Inc. (Braille), a battery manufacturer located in Sarasota, Florida, and were destined for Brampton, Ontario, Canada. The batteries were initially transported by FedEx on two separate US-registered cargo airplanes before being transferred to the delivery truck. The fire occurred about 10 hours after the batteries were offloaded from the cargo airplane at the Toronto, Canada, International Airport. Figure 1 shows both the interior and exterior damage to the FedEx truck. Estimated damages were over $71,000. The Federal Aviation Administration (FAA) notified the National Transportation Safety Board (NTSB) of the accident over concerns that the fire could also occur during air transport.4

1 Although this accident occurred in Canada, the National Transportation Safety Board (NTSB) investigated this incident because the shipment originated from an air carrier that is from the United States (US) and it involved lithium-ion batteries that were shipped in a configuration that was presumed compliant with US regulations. This was a limited investigation. 2 (a) Lithium batteries fall into two main categories: lithium-metal (primary) batteries that are nonrechargeable batteries used in devices such as watches, calculators, and cameras, and lithium-ion (secondary) batteries are rechargeable. Both types of lithium batteries may be transported via cargo aircraft but are prohibited from being transported as cargo on a passenger aircraft. (b) Some large-format batteries are made by connecting smaller battery cells into series and parallel combinations. A “large” battery is defined under the United Nations (UN) Manual of Tests and Criteria, Section 38.3 (UN 38.3), as having “a gross mass of more than 12 kg.” 3 Dangerous goods is the phrase used internationally to describe hazardous materials. 4 For more information, see the safety recommendation report associated with this investigation, Standards for Lithium-Ion Battery Shipments by Air HZMSR-20/01. Additional information about this accident investigation can be found in the public docket for this accident (NTSB DCA16SH001) by accessing the Accident Dockets link for the Docket Management System at www.ntsb.gov. For more information on our safety recommendations, see the Safety Recommendation Database at www.ntsb.gov.

Lithium-Ion Battery Truck Fire Following Aerial Transport 2

Figure 1. The fire damage to the FedEx truck and its contents. The contents of the truck were removed by firefighters following the fire. (Courtesy of FedEx.) Shipping Information In early 2016, Braille received an order for 16 custom-made, large-format, United Nations (UN) 3480 lithium-ion batteries from SpaceMaker Systems Inc. (SpaceMaker), a material handling company that manufactured devices for automating warehouses and factories. SpaceMaker requested that four of those batteries be shipped by air from Sarasota, Florida, to a warehouse in Brampton, Ontario, Canada.5 FedEx received the battery shipment and subjected the packages to its dangerous goods acceptance process before loading them onto the airplane. A checklist was used to assess the shipment’s compliance with the US Department of Transportation (DOT) Hazardous Materials Regulations (HMR), as well as the International Civil Aviation Organization (ICAO) standards.6 Once the checklist was completed, it was scanned, along with the shipper’s declaration and other associated documentation, into an electronic repository. On June 2, 2016, FedEx loaded the batteries into a unit load device, then onto a FedEx Airbus A300 cargo flight from Tampa (Florida) International Airport to Indianapolis (Indiana) International Airport. The batteries were offloaded and sorted at a FedEx station in Indianapolis, and then loaded onto a FedEx Boeing MD10-30 cargo airplane, which departed Indianapolis on

5 The other 12 batteries were shipped by ground to other US-based warehouses. 6 Title 49 Code of Federal Regulations (CFR) Parts 100-185; International Civil Aviation Organization, Technical Instructions for the Safe Transport of Dangerous Goods by Air, 2015-2016 edition. (Montreal, Quebec, Canada: 2015).

Lithium-Ion Battery Truck Fire Following Aerial Transport 3 June 3, 2016, about 4:15 a.m., and arrived at Toronto (Ontario, Canada) Pearson International Airport on June 3, 2016, about 5:36 a.m. At Toronto, FedEx personnel offloaded the four lithium-ion batteries from the airplane and again conducted the FedEx dangerous goods acceptance process, where no damage was noted. Personnel then loaded the four batteries onto a FedEx local delivery truck for transport to a storage warehouse in Brampton. About 3:30 p.m., the driver of the FedEx truck returned to the truck after completing an unrelated package delivery. He opened the bulkhead door and noticed smoke coming from the upper-right corner of the rear of the truck, where he had placed the lithium-ion battery packages. He then drove the truck away from the customer’s building to the end of an empty parking lot. The driver evacuated the truck without injury and called emergency response at 3:54 p.m., reporting that the truck was on fire and “exploding.” The fire spread rapidly, eventually destroying the truck and its contents. The Brampton Fire Department arrived on scene at 3:59 p.m., evacuated everyone within the area, and contained the fire by 4:24 p.m. Brampton firefighters opened one of the fiberboard boxes and determined that a lithium-ion battery was the origin of the fire. According to the FedEx inventory list, there were no other dangerous goods on board the truck. Braille Battery Design The batteries that were to be delivered to SpaceMaker were Braille Intensity iM3124D batteries; Braille’s specifications for each battery was 24 volts (V), 100 ampere hours (Ah).7 The design was unique to the specifications provided by SpaceMaker. Each battery consisted of two modules mounted directionally parallel inside a battery case. Each module consisted of cylindrical cells that were encased in a stainless steel case with a blue polyethylene terephthalate (PET) outer wrap.8 Braille assembled each module by electrically connecting the cells by spot welded metal tabbing in a configuration of seven cells-in- series, 10 cells-in-parallel. The edges of each module were wrapped with black polyvinylchloride electrical-isolation tape and 2-inch fiber-reinforced clear polypropylene tape. Then, yellow polyamide-imide (heat-reflective) tape was used to cover the sides of the module (edges and positive bus).9 An exemplar battery module is shown in figure 2.

7 NTSB investigators performed independent calculations that indicated that the battery was rated 25.2 V, 90 Ah, 2.3 watt hour. 8 These were 3.6 V, 4.5 Ah, 16.2 watt hour batteries, 26650 Batteries are often characterized by their diameter and length. A 26650 battery cell is about 26 millimeters in diameter and 65 millimeters long. 9 A bus is a metallic strip or bar, typically made of copper, brass, or aluminum, that conducts electricity within an electrical device.

Lithium-Ion Battery Truck Fire Following Aerial Transport 4

Figure 2. Battery module identical to the one involved in the accident. (Courtesy of FAA.) The two modules in each battery were placed inside a Battery Council International Group 31 car battery case made of polypropylene, fitted with positive and negative terminal wires connected to the battery modules.10 The modules were placed within the case with the terminal wires facing the top of the case as shown in figure 3.

10 Group 31 designates the specific dimensions and post configuations of a battery, as defined by the Battery Council International. Bus Plate Battery Cells Positive terminal wires Heat Reflective Tape (yellow) Electrical isolation tape (black), and clear reinforced PP tape Negative terminal wires

Lithium-Ion Battery Truck Fire Following Aerial Transport 5

Figure 3. Exemplar battery modules configuration inside the battery case. (Photograph courtesy of FAA.) The lid of the case was modified for its intended use. The internal terminal post was located in a premolded opening in the lid. The internal terminal consisted of a 9/16-inch diameter bolt that went through one end of a conductive crossbar with the opposite end of the crossbar connected to the external terminal post located in a modified opening in the lid. (See figures 4 and 5.) Positive terminal wires Negative terminal wires

Lithium-Ion Battery Truck Fire Following Aerial Transport 6

Figure 4. Photograph of modified terminal placement in case lid.

Figure 5. Exemplar positive and negative terminals on Braille battery lid. (Courtesy of FAA.) Postaccident Examination and Testing Following the accident, the damage to the batteries was documented and the batteries were labeled sequentially with the battery with the most damage labeled #1. (See figure 6.) The Brampton Fire Department determined battery #1 started the fire; its battery case and lid were destroyed, and the modules and associated hardware separated into individual cells and partial Pre-molded hole Conductive crossbar Modification

Lithium-Ion Battery Truck Fire Following Aerial Transport 7 strings of cells. The individual cells and string fragments that were recovered from this battery had heavy-to-moderate sooting on their surfaces and had heavy-to-moderate bulging at the top vents. One of the cell cases exhibited melting consistent with electrical contact. Electrolyte salt residue was present on the surface of several of the cells, suggesting electrolyte vented from these cells. The top vent bulging and presence of electrolyte salt residue was consistent with the cells overheating and going into thermal runaway.11

Figure 6. Four Braille batteries involved in the fire. The outer case for battery #2 separated from the rest of the battery and only the case lid and two battery modules with associated wiring were recovered from the scene. Batteries #3 and #4 were intact; however, their battery case lids exhibited charring and melting. When opened, the modules for batteries #3 and #4 were found loosely packed in the battery cases. After removing the modules from the cases, module #2 showed evidence of electrical arcing from one cell on top of the module, as seen in figure 7. Similar damage was found on the adjacent terminal bolt.

11 Thermal runaway in lithium-ion batteries is a failure mechanism where exothermic decomposition of constituents within the battery cell lead to an uncontrollable rise in temperature and catastrophic failure of the cell possibly resulting in electrolyte release and fire.

Lithium-Ion Battery Truck Fire Following Aerial Transport 8

Figure 7. Burn patterns observed on the top string showing electrical arcing on one of the modules of battery #2. Investigators noted deformed and discolored tape layers and missing material from the bus plates on the corners of the intact modules, revealing evidence of rubbing and scraping between the modules and the terminal bolts. The cells within the modules displayed visible evidence of contact between the blue PET cell wrap and the battery terminal bolt on the inside lid of the battery case. Electrolyte salt residues, consistent with electrolyte venting, were present on the top surface of several of the cells. NTSB determined from its examination and testing that the modules were not secured and could move within the case. Furthermore, the modification made to the lid for the terminal posts did not provide enough clearance between the bolts and the modules. During transport, the shifting modules rubbed against the terminal bolt causing the bolt to tear through the tape layers and the cell wrap, damaging the cell casing, eventually resulting in a localized short circuit.12 The short circuit caused the damaged cell to go into thermal runaway, producing excessive heat that caused surrounding cells to go into thermal runaway, resulting in a cascading failure of the battery.

12 A short circuit is an electrical circuit that allows current to travel along an unintended path with little or no electrical impedance. A localized short circuit of this type can occur if the exterior conductive case of one or more cells is penetrated by a foreign conductive objective and bridges the positive and negative terminals.

Lithium-Ion Battery Truck Fire Following Aerial Transport 9 Shipping Regulations Lithium-ion batteries are classified as Class 9 miscellaneous hazardous materials, one of nine hazard classes that present a hazard during transportation.13 Title 49 Code of Federal Regulations (CFR) 173.185 describes the packaging requirements that the batteries must meet for transport.14 This shipment did not have noncombustible interior packaging. The combustible packaging facilitated the spread of the fire from the box and involved other boxes in the shipment. When shipped internationally by air, US hazardous materials transportation regulations also require lithium-ion batteries to comply with ICAO standards.15 ICAO Annex 18 contains standards for transporting dangerous goods (hazardous materials) by air. One of the standards requires hazardous materials be shipped according with ICAO’s Technical Instructions for the Safe Transport of Dangerous Goods by Air (Technical Instructions).16 This standard includes provisions for the classification of dangerous goods, circumstances when dangerous goods are forbidden on passenger or cargo aircraft, and hazard communication and packing instructions (PI). Within the Technical Instructions are specific PIs, such as PI 965, which is required for UN 3480 lithium-ion batteries that meet the quantity and capacity limits under the HMR. Braille certified in the shipping declaration that it was packaged in accordance with PI 965.17 However, the packaging consisted of three foam modules made of polyurethane foam encased in a polyethylene film bag, which is a combustible material that does not comply with PI 965. PI 965 requires that before transport, lithium-ion batteries be able to pass each test stipulated in the UN Manual of Tests and Criteria, Part III, Section 38.3 (UN 38.3).18 These tests subject the battery or cell to different pressures, vibrations, temperatures, shock, external short circuiting, overcharge or forced discharge, and either impact or crushing force that would lead to internal short circuiting. If a lithium-ion cell or battery assembly fails the tests, the standards require that the battery or cell manufacturer correct the failure before the battery or cell is tested again. Braille was unable to produce records showing that the battery design was tested in accordance with UN 38.3. The short circuits observed in the batteries following the accident

13 Title 49 CFR 172.101 lists lithium-ion batteries as a Class 9 hazardous material. The hazard class of a hazardous material is indicated either by its class (or division) number. There are nine different classifications of hazardous materials that are defined in 49 CFR 173.140. 14 Title 49 CFR 173.185 (e)(1) also requires cushioning material that is noncombustible for low-production runs and prototype lithium-ion cells and batteries. 15 Title 49 CFR 171.22. 16 International Civil Aviation Organization, Technical Instructions for the Safe Transport of Dangerous Goods by Air, 2015-2016 edition. (Montreal, Quebec, Canada: 2015). 17 In accordance with 49 CFR 172.200, the FAA requires that hazardous materials shipments include a form certifying that the cargo has been packed, labeled, and declared according to international regulations. 18 UN Economic and Social Council’s Subcommittee of Experts on the Transport of Dangerous Goods, UN Manual of Tests and Criteria, Fifth revised edition. (New York and Geneva, Switzerland: United Nations, 2009). UN Manual of Tests and Criteria is a developed by the United Nations’ Economic and Social Council’s Subcommittee of Experts on the Transport of Dangerous Goods, of which ICAO is a specialized agency. At the time of the accident, the fifth edition was in effect. A sixth edition has been published and manufacturers and distributors of lithium-ion batteries and cells were required to be in compliance with the revisions by January 2020.

Lithium-Ion Battery Truck Fire Following Aerial Transport 10 suggested that had an iM3124D-100 battery been subject to the vibration or shock tests stipulated in UN 38.3 tests, it would likely have failed.19 The vibration test involved firmly securing a battery on a platform of a vibration machine and was repeated multiple times over a span of a few hours. The shock test also involved securing the battery to a test machine and subjecting the battery to a timed frequency of pulse durations through a number of cycles. These tests would likely have created the conditions that caused the battery failure in this accident. In February 2016, the ICAO Technical Instructions were amended to include a new standard that lithium-ion batteries may only be transported by cargo aircraft at a state of charge (SOC) not exceeding 30 percent of their rated design capacity unless there is an exemption approved by a competent authority.20 Lithium-ion batteries transported at a reduced SOC pose a lower fire risk, should a cell go into a thermal runaway during transport. These changes went into effect in April 2016, 2 months prior to the accident shipment. As required by ICAO, Braille tested a random sample of battery modules for all shipments prior to fabrication of the modules and reported an average SOC of 29 percent, which was within the threshold set by the new ICAO Technical Instruction standard.21 Braille did not retest the SOC of the modules after the large format batteries were fabricated. When the NTSB sent battery #2, module #1 for SOC testing following the accident, testing had to be halted because the module experienced elevated temperatures and anomalous voltage.22 Though testing results were inconclusive for the overall rated capacity of the module, the measurement of capacity from the discharge cycle found that one of the accident modules had a minimum SOC of 47.7 percent, which exceeded the ICAO threshold. Testing also revealed that the individual cells within the module distributed electrical charge in such a manner that some of the strings of cells in the module were overcharged, and others had no charge, showing an imbalance of voltage. If one cell short circuited, a cascading effect would occur where the rest of the cells in the string would accept current to maintain overall battery voltage. The healthy cells within a string would accept more current, and charge/discharge faster than the cells’ other parallel strings, causing a disparity in cell string voltages. This would lead to eventual overcharge or discharge of the whole battery, which would then overheat, resulting

19 (a) Short circuit and voltage disparities were observed during postaccident testing. Discussion on these observations can be found in the safety recommendation report associated with this investigation, Standards for Lithium-Ion Battery Shipments by Air HZMSR-20/01. 20 (a) State of charge measurement is most commonly performed by one of three methods: open circuit voltage method; electrochemical impedance spectroscopy method; and charge/discharge cycling with coulomb counting method. There are no industry-standard protocols for measuring SOC, nor are testing variations, reproducibility, and repeatability aspects established. (b) International Civil Aviation Organization, Supplement to the Technical Instructions for the Safe Transport of Dangerous Goods by Air, 2015-2016 edition. (Montreal, Quebec, Canada: 2016). (c) According to 49 CFR 107.1, a competent authority is a national agency that is responsible, under its national law, for the control or regulation of some aspect of hazardous materials (dangerous goods) transportation. (d) The competent authority can grant an exemption but did not in this case. 21 Braille’s SOC evaluation data listed a test sample of 600 Shandong Goldencell lithium-ion cells that were charged to 4.15 V (1.5A, C/3 rate) and discharged to 2.75V (1.5A, C/3 rate). 22 These tests were performed at the Carderock Division of the Navel Surface Warfare Center in Montgomery County, Maryland, at the request of the NTSB.

Lithium-Ion Battery Truck Fire Following Aerial Transport 11 in a thermal runaway event. The battery was not outfitted with a battery management system which could have prevented an imbalance in cell voltages between parallel strings. Special Provisions for Lithium-Ion Battery Shipments by Air The batteries manufactured by Braille may have qualified under a special provision in the ICAO standards that would have allowed the company to ship the batteries without UN 38.3 testing because they met the criteria as low-production and prototype batteries.23 To qualify for this special provision, a shipper must seek an approval under a competent authority of the state of origin. Braille did not apply for this approval. During this investigation, the NTSB examined the special provision to shipping standards for prototype or low-production lithium-ion batteries. This resulted in two safety recommendations being issued to the Pipeline and Hazardous Materials Safety Administration to remove special provisions.24 Postaccident Actions On December 8, 2017, the FAA proposed a $1.1 million civil penalty against Braille for the shipment of the lithium-ion batteries involved in the June 3, 2016, accident, as well as other illegal shipments of lithium-ion batteries by air.25 The company was cited for the following violations: • not meeting the testing standards under the UN Manual of Tests and Criteria Part III, Section 38.3 or the DOT’s Hazardous Materials Regulations (49 CFR 173.185(a)(1)); • not equipping its batteries with a means to prevent dangerous reverse current flow (49 CFR 173.185(a)(3)(iii)); • not packaging the batteries for shipment to prevent sparks or generate heat (49 CFR 173.21(c));26 • not providing its employees with required hazardous materials transportation training (49 CFR 172.702 (a));

23 According to ICAO Technical Instructions, A3-1-28, US Variation 3, when shipping prototype lithium batteries and cells in accordance with Special Provision A88 to the United States, the shipper must also seek approval from the appropriate US authority. 24 Safety Recommendations A-20-31 and -32. 25 (a) The penalty amount was later reduced to $235,000, which Braille is required to pay by September 2021. (b) Federal Aviation Administration, “FAA Proposes $1.1 Million Civil Penalty Against Braille Battery Inc. For Alleged HazMat Violations,” news release, December 8, 2017. https://www.faa.gov/news/press_releases/news_story.cfm?newsId=22374&omniRss=press_releasesAoc&cid=102_ P_R, accessed January 6, 2020. 26 The FAA citation refers to Braille’s failure to secure the battery to prevent it from generating sparks and heat. The module was not secure, which allowed contact between the bolt and the cell, which led to the short circuit. There is no packaging that would have stopped or slowed down this fire. For more information on this regulation, see the interpretation letter on this regulation that was issued in 2003 by the Research and Special Programs Administration, the predecessor to the Pipeline and Hazardous Materials Safety Administration.

Lithium-Ion Battery Truck Fire Following Aerial Transport 12 • not following the DOT’s Hazardous Materials Regulations or acquiring the necessary exemption under an approval or special permit (49 CFR 171.2(b)).27 In addition, the FAA prohibited Braille from shipping lithium batteries by air for 2 years, issuing an Emergency Prohibition/Restriction Order in September 2016.28 The FAA rescinded the order in July 2018 after the agency determined Braille was complying with DOT regulations. Braille posted the UN testing documentation for its lithium-ion batteries on its website. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on a FedEx delivery truck in Brampton, Ontario, Canada, on June 3, 2016, was an electrical short circuit between the battery terminal bolt and the upper cells of the lithium-ion battery module, causing a thermal runaway within the battery, igniting the battery and its packaging. Contributing to the electrical short circuit was Braille Battery, Inc.’s design that did not protect against short circuiting. Also contributing to the consequences of the accident was Braille Battery, Inc.’s use of combustible packing materials. For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident identification number DCA16SH001. BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

JENNIFER HOMENDY Chairman

Member

BRUCE LANDSBERG

MICHAEL GRAHAM Vice Chairman

Member

THOMAS B. CHAPMAN

Member

Date: May 28, 2020

27 Federal Register 81, no. 188 (September 28, 2016): 66713. 28 For more information, see the FAA announcement on the issuance of the 2016 Emergency Prohibition/Restriction Order.

Lithium-Ion Battery Truck Fire Following Aerial Transport 13

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a pipeline accident in which there is a fatality or substantial property damage, or significant injury to the environment. (49 U.S. Code, Section 1131 - General authority) The NTSB does not assign fault or blame for an accident or incident: rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties…and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S. Code, Section 1154(b).

FD07238 ｜ 2001_美国_HZM2001.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2001 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

CSX Transportation, Inc. Tank Car Release of UN1987 Denatured Ethanol Fredericksburg, Virginia November 2, 2016

Incident Report NTSB/HZM-20/01 PB2022-100361

National Transportation Safety Board

NTSB/HZM-20/01 PB2022-100361 Notation 64530 Adopted February 14, 2020

Hazardous Materials Incident Report CSX Transportation, Inc. Tank Car Release of UN1987 Denatured Ethanol Fredericksburg, Virginia November 2, 2016

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2020. CSX Transportation, Inc. Tank Car Release of UN 1987 Denatured Ethanol, Fredericksburg, Virginia, November 2, 2016. Hazardous Materials Incident Report NTSB/HZM-20/01. Washington, DC: NTSB.

Abstract: On November 2, 2016, at 3:11 p.m. local time, CSX Transportation, Inc. (CSX) reported a 68-gallon release of UN1987 denatured ethanol, a flammable Class 3 hazardous material, from cracks in the bottom of the shell of Archer Daniels Midland Company tank car ADMX 29899. The incident occurred in the CSX rail yard located in Fredericksburg, Virginia. ADMX 29899 was the sixth tank car in train D79402, consisting of a buffer car and seven tank cars fully loaded with denatured ethanol. Due to the release and emergency rail traffic, other traffic on adjacent main tracks was slowed, causing passenger train delays during peak traffic hours. The incident location was bordered by commercial businesses and residential neighborhoods. Weather at the time of the incident was sunny, and the temperature was 79℉. At 3:12 p.m., the fire department discovered ethanol leaking from the bottom of the tank car. They noted that leaking ethanol was spilling onto ballast on the right of way, but the warm weather accelerated its evaporation. By 3:45 p.m., a railroad emergency response contractor collected the leaking ethanol in an open container and moved the tank car to an adjacent track where the product could be transferred to another tank car. Crews completed the transfer by 3:15 a.m. on November 3. As a result of this investigation, the National Transportation Safety Board made four new recommendations to the Federal Railroad Administration and the Pipeline and Hazardous Materials Safety Administration.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974, to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code section 1154(b)).

For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID DCA17SH001. Recent publications are available in their entirety on the NTSB website. Other information about available publications also may be obtained from the website or by contacting— National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2022-100361. For additional assistance, contact— National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 NTIS website

NTSB Hazardous Materials Incident Report i Contents Figures ........................................................................................................................................... iii Tables ............................................................................................................................................ iv Abbreviations and Acronyms .......................................................................................................v Executive Summary ..................................................................................................................... vi Probable Cause............................................................................................................................... vi Safety Issues................................................................................................................................... vi Conclusions ................................................................................................................................... vii Recommendations ......................................................................................................................... vii 1 Factual Information .................................................................................................................1 1.1 The Shipment ...........................................................................................................................3 1.2 Tank Car ADMX 29899 ...........................................................................................................4 1.2.1 Construction Details.......................................................................................................4 1.2.2 ACF-200 Stub Sill Underframe .....................................................................................4 1.2.3 Service and Maintenance History ..................................................................................5 1.3 Stub Sill Inspection and Maintenance Guidance ......................................................................5 1.3.1 Federal Railroad Administration Safety Advisory ........................................................5 1.3.2 Association of American Railroads Maintenance Advisory ..........................................6 1.3.3 ACF Maintenance Bulletin TC-200, Revision B ...........................................................7 1.4 Postincident Tank Car Examination .........................................................................................8 1.4.1 Shell Cracks ...................................................................................................................8 1.4.2 Shell Buckling ................................................................................................................9 1.4.3 Materials Testing .........................................................................................................10 1.5 Coupling Impact Loads ..........................................................................................................10 1.5.1 Finite Element Modeling and Analysis of Draft Gear Forces .....................................10 1.5.2 Coupling Speed Regulations and Recommended Practices.........................................12 2 Analysis ...................................................................................................................................15 2.1 Excessive Coupling Impact Loads .........................................................................................15 2.2 Structural Integrity of Stub Sill Underframes ........................................................................15 2.3 Detecting Energetic Coupling Events ....................................................................................17 3 Conclusions .............................................................................................................................19 3.1 Findings ..................................................................................................................................19 3.2 Probable Cause .......................................................................................................................19 4 Recommendations ..................................................................................................................20 Appendix .......................................................................................................................................21

NTSB Hazardous Materials Incident Report ii References .....................................................................................................................................22

NTSB Hazardous Materials Incident Report iii Figures Figure 1. Aerial view of incident location. .................................................................................... 1 Figure 2. Tank car ADMX 29899 at the incident location. ........................................................... 2 Figure 3. Ethanol leaking from the cracked tank shell. ................................................................. 3 Figure 4. Generalized configuration of an ACF-200 stub sill underframe. ................................... 5 Figure 5. Diagram of a tank car stub sill underframe highlighting damage-prone critical locations where weld cracks are likely to occur. ............................................................................................ 7 Figure 6. B-end tank car section, including the inboard end of the stub sill cradle pad and two shell cracks. ............................................................................................................................................. 8 Figure 7. Plot of laser scan data showing tank shell buckling depth found at the inboard end of the cradle pad. ...................................................................................................................................... 9 Figure 8. Visual rendering of laser scan data showing tank shell buckling at the inboard end of the cradle pad. ..................................................................................................................................... 10 Figure 9. Finite element model result showing vertical displacement in inches following a quasi-static draft gear force of 3,715 kips. ................................................................................... 11 Figure 10. Finite element modeling output showing vertical displacement contours of the rotated tank bottom near the buckled region. ........................................................................................... 16

NTSB Hazardous Materials Incident Report iv Tables Table. Canadian Transport of Dangerous Goods coupling speed regulatory thresholds for structural integrity inspection. ...................................................................................................... 13

NTSB Hazardous Materials Incident Report v Abbreviations and Acronyms AAR

Association of American Railroads ACF

ACF Industries, LLC ADM

Archer Daniels Midland Company ARI

American Railcar Industries, Inc. ARL

American Railcar Leasing CFR

Code of Federal Regulations CL

critical location CSX

CSX Transportation, Inc. DOT

US Department of Transportation FR

Federal Register FRA

Federal Railroad Administration GRL

gross rail load Kip

kilopounds MA

maintenance advisory MSRP

Manual of Standards and Recommended Practices NTSB

National Transportation Safety Board PHMSA

Pipeline and Hazardous Materials Safety Administration psi

pounds per square inch RSAC

Railroad Safety Advisory Committee TC

Transport Canada TDG

Canadian Transport of Dangerous Goods TSB

Transportation Safety Board of Canada

NTSB Hazardous Materials Incident Report vi Executive Summary On November 2, 2016, at 3:11 p.m. local time, CSX Transportation, Inc. reported a 68- gallon release of UN1987 denatured ethanol, a flammable Class 3 hazardous material, from cracks in the bottom of the shell of Archer Daniels Midland Company tank car ADMX 29899. The incident occurred in the CSX Transportation, Inc. rail yard located in Fredericksburg, Virginia. ADMX 29899 was the sixth tank car in train D79402, consisting of a buffer car loaded with steel and seven tank cars fully loaded with denatured ethanol. Due to the release and the resulting emergency rail traffic, other rail traffic on adjacent main tracks was significantly slowed, causing passenger train delays during peak traffic hours. The incident location was bordered by commercial businesses and residential neighborhoods. Weather at the time of the incident was sunny, and the temperature was 79℉.1 At 3:12 p.m., the Fredericksburg Fire Department dispatched to the incident scene and discovered ethanol leaking from the bottom of the tank car. The fire department noted that leaking ethanol was spilling onto ballast on the right of way, but the unseasonably warm weather accelerated its evaporation. By 3:45 p.m., a railroad emergency response contractor arrived on site and collected the leaking ethanol in an open container and moved the tank car to an adjacent track where the product could be transferred to another tank car. Crews completed the transfer by 3:15 a.m. on November 3. Probable Cause The National Transportation Safety Board determines that the probable cause of the November 2, 2016, release of denatured ethanol from Archer Daniels Midland Company tank car ADMX 29899 was undetected cracks that resulted from overspeed high-energy coupling events, which caused tank shell deformation that led to the initiation of two fatigue cracks at the terminations of the cradle pad fillet welds. Safety Issues This report focuses on the following safety issues: • Excessive coupling impact loads and the need for maximum coupling speed and impact force thresholds. • Structural integrity of stub sill underframes and need for qualified inspection and repair following high-energy coupler impact events. • Methods to detect and report excessive coupling speed impact events.

1 For more information, see the factual information and analysis sections of this report. Additional information about this accident investigation can be found in the public docket for this accident (NTSB case number DCA17SH001) by accessing the Accident Dockets link for the Docket Management System at www.ntsb.gov. For more information on our safety recommendations, see the Safety Recommendations Database at www.ntsb.gov.

NTSB Hazardous Materials Incident Report vii Conclusions • The tank shell buckle was likely the result of coupling at a speed above the Association of American Railroads-recommended 4 mph. • The risk of a hazardous materials release following high-force coupling events could be mitigated if federal regulations provided limits in the combination of coupling speed and impacting mass to tank car coupler and underframe components. • The decision to not install the P470 head brace enhancement on tank car ADMX 29899 did not affect the formation of a shell buckle in the region where the tank shell cracks occurred. • The shell buckle inboard of the cradle pad led to premature fatigue cracking in the tank shell. • Structural integrity inspections must be performed by qualified technicians at certified tank car facilities using specialized nondestructive examination techniques with a sufficient probability of detection to ensure that critical flaws are identified in tank materials. • Without a means to detect and report excessive coupling speed events, damaged tank cars such as ADMX 29899 may continue in service and pose an unnecessary risk of hazardous materials releases. Recommendations To the Federal Railroad Administration and the Pipeline and Hazardous Materials Safety Administration: • Work together to develop maximum coupling speed thresholds and impact mass limits for hazardous materials railcars. (R-20-1) • Require that tank cars involved in high-energy coupling-force events undergo a structural integrity inspection by a qualified technician before returning to service. (R-20-2) • Develop methods to identify tank cars that have sustained overspeed and high-energy coupling force events. (R-20-3) • After the successful development of methods to identify tank cars that have sustained overspeed and high-energy coupling force events, require that rail carriers have monitoring processes in place to promptly remove damaged tank cars from hazardous materials service. (R-20-4)

NTSB Hazardous Materials Incident Report 1 1 Factual Information On November 2, 2016, at 3:11 p.m. local time, CSX Transportation, Inc. (CSX) reported a 68-gallon release of UN1987 denatured ethanol, a flammable liquid Class 3 hazardous material, from cracks in the bottom of the shell of Archer Daniels Midland Company (ADM) tank car ADMX 29899. The incident occurred in the CSX rail yard located in Fredericksburg, Virginia. (See figure 1.)

Figure 1. Aerial view of incident location. Train D79402 consisted of a buffer car loaded with steel and seven tank cars fully loaded with denatured ethanol. ADMX 29899 was the sixth tank car in the train. (See figure 2.) Other rail traffic on adjacent main tracks was significantly slowed, causing passenger train delays during peak traffic hours. The incident location was bordered by commercial businesses and residential neighborhoods. Weather at the time of the incident was sunny, and the temperature was 79℉.

NTSB Hazardous Materials Incident Report 2

Figure 2. Tank car ADMX 29899 at the incident location. At 3:12 p.m., the Fredericksburg Fire Department dispatched to the incident scene and discovered ethanol leaking at the B-end inboard side of the stub sill cradle pad near the termination of the left side longitudinal cradle pad-to-tank fillet weld.2 (See figure 3.) The fire department noted that leaking ethanol was spilling onto ballast on the right of way, but the unseasonably warm weather accelerated its evaporation. By 3:45 p.m., a railroad emergency response contractor arrived on site, collected the leaking ethanol in an open container, and moved the tank car to an adjacent track where the product could be transferred to another tank car. Crews completed the transfer by 3:15 a.m. on November 3.

2 (a) A cradle pad is a reinforcing plate welded directly to the tank to which the stub sill is attached. The pad protects the tank from damage caused by fatigue, overstress, denting, puncturing, or tearing. In tank cars with stub sills, the tank is used as the primary structural component to carry longitudinal train loads. Couplers are attached to the outer end of the stub sills at each end of the tank. (b) All orientations referenced in this report are as seen when facing the B-end of the tank car.

NTSB Hazardous Materials Incident Report 3

Figure 3. Ethanol leaking from the cracked tank shell. (Photograph courtesy of CSX.) 1.1 The Shipment According to the safety data sheet for denatured ethanol, the product was a mixture of 95 to 98 percent ethanol and 2 to 5 percent natural gasoline. For transportation as a hazardous material, the shipper classified the denatured ethanol as a Class 3 flammable liquid in Packing Group II, with a US Department of Transportation (DOT) shipping name of “Alcohols, n.o.s.” (not otherwise specified). The product was a clear, colorless liquid that had a flash point of -5℉, a Reid vapor pressure of 3.5 pounds per square inch (psi), and a specific gravity of 0.79 (the specific gravity of water is 1).3 The denatured ethanol from the incident tank car was intended to be used in blending with motor fuel. On October 21, 2016, the denatured ethanol shipment originated from ADM’s Corn Processing Division in Cedar Rapids, Iowa. Records show that before and after loading, the ADM loading rack operator inspected tank car ADMX 29899 and noted no evidence of dents, punctures, or signs of leakage. ADM loaded the tank car with 188,812 pounds, or 28,695 gallons, of denatured

3 Reid vapor pressure is most commonly used as a measure of volatility for hydrocarbon fuels and is defined as the vapor pressure of a liquid at 100℉ as determined by method ASTM D323.

NTSB Hazardous Materials Incident Report 4 ethanol. The lading did not exceed the maximum load limit by weight and did not exceed the DOT filling limit by volume.4 The destination of the shipment was ExxonMobil in care of Transflo, Fredericksburg, Virginia. According to the car location message report, ADM released ADMX 29899 to the Cedar Rapids & Iowa City Railway Company on October 21, 2016. The Indiana Harbor Belt Railroad received the tank car in Chicago, Illinois, on October 24, 2016. CSX received the tank car in Chicago, Illinois, on October 25, 2016, and retained custody of the car until it arrived at the incident location. 1.2 Tank Car ADMX 29899 1.2.1 Construction Details Tank car ADMX 29899 was a nonjacketed specification DOT-111A100W1 general service tank car that ACF Industries, LLC (ACF) manufactured in 1989 for ADM.5 The tank car had a capacity of 30,094 gallons, a load limit of 196,600 pounds, and a gross rail load (GRL) of 263,000 pounds. The tank was constructed of 7/16-inch Association of American Railroads (AAR) TC-128 grade B non-normalized steel shell, and 15/32-inch elliptical ASTM A-516 grade 70 heads.6 The tank car was equipped with two pressure relief devices with a start-to-discharge pressure of 75 psi. The tank car was constructed for use in ethanol service and for products authorized in Title 49 Code of Federal Regulations (CFR) Part 173 for which there were no special commodity requirements and nonregulated commodities that were compatible with this class of tank car. 1.2.2 ACF-200 Stub Sill Underframe ACF Industries, Inc. built the tank car in July 1987. 7 The tank car was equipped with an ACF-200 stub sill underframe design. ACF’s successor corporation, American Railcar Industries, Inc. (ARI), under its subsidiary American Railcar Leasing (ARL), issued additional instructions that detailed the inspection and defect repairs needed on nonpressure tank cars equipped with ACF-200 underframes (ARL 2006).8 The design uses cradle pads welded to the tank to transfer running loads from the stub sills through the tank. (See figure 4.) ACF used its ACF-200 stub sill

4 The maximum load limit by weight stenciled on the tank car was 196,600 pounds. Based on the coefficient of cubical expansion for ethanol, the maximum allowable filling limit at the loading temperature of 84℉ was 29,240 gallons as mandated by Title 49 Code of Federal Regulations (CFR) 173.24b. 5 American Car and Foundry (ACF), today known as ACF Industries, LLC, is a manufacturer of railroad rolling stock based in St. Charles, Missouri. 6 ASTM International, formerly known as American Society for Testing and Materials, is an international standards organization that develops and publishes voluntary consensus technical standards for a wide range of materials, products, systems, and services. 7 In 1994, American Railcar Industries, Inc. was formed from the acquisition of railcar component manufacturing and railcar maintenance assets from ACF Industries, Inc. 8 At the time the instructions were issued, ARI was the parent company and ARL was the subsidiary. ARI manufactured the car but ARL issued the guidance. However, on June 1, 2017, Sumitomo Mitsui Banking Corporation completed the acquisition of ARL.

NTSB Hazardous Materials Incident Report 5 underframe design in tank cars built between 1969 and 1996, and about 9,000 of those nonpressure tank cars are currently in service.9

Figure 4. Generalized configuration of an ACF-200 stub sill underframe. 1.2.3 Service and Maintenance History The ADM billing and repair records for ADMX 29899 from 1991 through the date of the accident did not show that the tank car had been shopped or repaired as a result of any accident-related damage.10 ADM records documented that on May 14, 2012, its Cedar Rapids, Iowa, railcar repair facility conducted a 10-year HM-201 requalification inspection, stub sill inspection, and shell thickness test on the tank car (Federal Register, 1995, 49048). At the time of this inspection the tank car had logged 276,000 miles. The HM-201 inspection included visual inspections for abrasions, corrosion, cracks, dents, distortions, and defects in welds. Both interior and exterior inspections found no exceptions. The stub sill inspection found no transverse or longitudinal weld cracks. However, ADM found and repaired four 3-inch cracks in the A-end and B-end bolster pads (two each). The shell thickness measurements were within specification. The next HM-201 tank requalification inspection and thickness test would have been scheduled to occur in 2022. 1.3 Stub Sill Inspection and Maintenance Guidance 1.3.1 Federal Railroad Administration Safety Advisory In 2006, the Federal Railroad Administration (FRA) issued Safety Advisory 2006-04, Notice No. 2, in which it noted that since 1990, the FRA and Transport Canada (TC) had documented defects on tank car underframes that in some instances led to hazardous materials incidents (FRA 2006). The notice also stated that AAR stub sill inspection data related to the ACF-200 stub sill underframes showed significant percentages of longitudinal weld cracks in the pad-to-sill area and parent metal cracks in the cradle pad. The FRA stated that these cracks

9 Source: Universal Machine Language Equipment Register. 10 The term shopped refers to taking the tank car to a facility certified by the AAR for building and repairing railroad tank cars.

NTSB Hazardous Materials Incident Report 6 presented a possible source of the loss of tank integrity, which could lead to the release of hazardous materials. Therefore, the FRA recommended that owners of tank cars equipped with the ACF-200 stub sill inspect and enhance these underframes, in accordance with ACF maintenance bulletin TC-200, including the installation of a head brace (ARL 2006).11 The FRA recommended that ACF-200 tank car owners should modify these tank cars at the earliest of any of the following events: • A tank car is due for requalification under 49 CFR 180.509; • A tank car is recalled under an AAR Maintenance Advisory (MA) requiring modification in the draft sill area; • A tank car has been in service for 150,000 miles; or • A tank car requires general repairs and the repairs consume (or are expected to consume) at least 36 hours. Although the FRA recommended tank car owners should modify tank cars with ACF-200 stub sill underframes, ACF maintenance bulletin TC-200 stated that the procedure may be used solely at the discretion of the car owner. 1.3.2 Association of American Railroads Maintenance Advisory In response to an increasing number of stub sill-related defects found on tank cars during transportation, on October 1, 2010, the AAR published maintenance advisory (MA)-0123, advising tank car owners, repair shops, and railroads to intensify inspections of these structures during maintenance or other inspection events (AAR 2010). The advisory asked railroad operating and mechanical personnel to visually inspect the critical locations that could be seen during routine inspections or maintenance events. These critical locations (CL) are indicated in figure 5. The buckled and cracked shell of the incident tank car ADMX 28988 corresponded to the critical location highlighted by the dashed red circle.

11 A head brace is a structure attached between the stub sill and tank head that manages stub sill loads into the tank body by reducing stress at critical underframe component weld locations.

NTSB Hazardous Materials Incident Report 7

Figure 5. Diagram of a tank car stub sill underframe highlighting damage-prone critical locations where weld cracks are likely to occur. The advisory stated that tank car owners must be notified if the tank has been damaged to a certain extent, including the bottom tank shell or stub sill reinforcing plate buckled 1/2 inch in depth or more. The advisory stated that when defect information is transmitted to tank car owners, the tank car owners should require the appropriate maintenance to ensure their equipment can safely operate. Since the 2012 HM-201 inspection when ADM found and repaired four 3-inch cracks in the A-end and B-end bolster pad parent metal of ADMX 28988, ADM was not notified of any subsequent tank damage or shell buckling. 1.3.3 ACF Maintenance Bulletin TC-200, Revision B On May 16, 2016, ARL published ACF Maintenance Bulletin TC-200 Revision B for ACF- 200 stub sill underframe inspection, repair, and enhancement. The bulletin stated that it was especially applicable to nonpressure tank cars exposed to harsh service environments in which the cars may experience cracks in (1) the cradle pad parent metal, and (2) the weld attachments to the tank head (ARL 2016). In addition to weld configuration and repair guidance, the bulletin described a retrofit procedure for the application of a head brace, or angle brace, known as the P470 enhancement. The bulletin noted that the procedure may only be used on ACF-200 underframes and solely at the discretion of the tank car owner. Further, the bulletin stated that prior to making any repairs or enhancements, it is critical that a thorough inspection is performed, and that each car should be individually evaluated using good judgement, based on the service environment and existing conditions. The bulletin added that if no defects are present, then no further repairs or enhancements are required.

NTSB Hazardous Materials Incident Report 8 ADM did not install the P470 enhancement on its fleet of tank cars. 1.4 Postincident Tank Car Examination 1.4.1 Shell Cracks National Transportation Safety Board (NTSB) investigators found two tank shell cracks adjacent to the B-end cradle pad about 45° angles from the end of the inboard cradle pad fillet weld terminations. For the purposes of this report, the cracks were labeled “left” and “right” as shown in figure 6. At the exterior surface of the tank, the left crack was 3.15-inches long and the right crack was 2.40 inches long.

Figure 6. B-end tank car section, including the inboard end of the stub sill cradle pad and two shell cracks. The cracks initiated at the terminations of the longitudinal fillet welds. Each crack exhibited two primary initiation sites, located at the inboard terminations of the cradle pad fillet welds. The cracks propagated away from the toes of the welds on each side of the cradle pad. Ratchet marks present on both fracture surfaces were consistent with multiple fatigue cracks that coalesced during propagation.12 The crack propagation features on both the left and right sides were consistent with a fatigue crack propagating from the outer tank surface, which, after having grown through most of the tank shell cross section, underwent reverse bending, whereby multiple smaller fatigue cracks

12 Ratchet marks are the lines or the markings on a fatigue fracture surface that result from the intersection and connection of separate fatigue cracks propagating from multiple origins. Ratchet marks are parallel to the overall direction of crack propagation and can be visible to either the unaided eye or at low magnification.

NTSB Hazardous Materials Incident Report 9 initiated on the inner surface and grew outward. The fatigue cracks merged to become shell breaching through-cracks from which the contents of the tank car escaped. As directed by applicable weld placement guidance in ACF maintenance bulletin TC-200, there was no indication of weld material present outside of acceptable weld locations, such as the transverse surface of the inboard cradle pad. NTSB investigators cross sectioned and examined both welds using optical metallography and microindentation hardness and found no indications of any weld deficiencies. The examination found no evidence of nonmetallic inclusions, voids, or pores at the fatigue crack initiation sites. The incident tank car shell did not exhibit any evidence of poor welding that might have contributed to the formation of the cracks and the release of ethanol. 1.4.2 Shell Buckling The B-end shell contained an inward buckle inboard of the cradle pad with a maximum depth of 0.75 inches. Figures 7 and 8 show several depth measurements relative to a tank car longitudinal tangent, based on a laser scan of a section from the B-end of the tank car. These figures show the section upside down, with the outer surface of the tank car on the top and the cradle pad on the right.

Figure 7. Plot of NTSB Materials Laboratory laser scan of the tank bottom showing shell buckling depth found at the inboard end of the cradle pad.

NTSB Hazardous Materials Incident Report 10

Figure 8. Visual rendering of laser scan data showing tank shell buckling at the inboard end of the cradle pad. The apex of the buckle corresponded with the location of both fatigue cracks. This buckle depth exceeded the maximum allowable depth of 0.5 inches, as published in AAR maintenance advisory MA-0123 (AAR 2010) and AAR Manual of Standards and Recommended Practices (MSRP) Section C-III, Appendix R (AAR 2014). The AAR standard requires stub sill tank cars to be home shopped and the owner to be notified when tank shell deformation as large as that found in ADMX 29899 is present.13 1.4.3 Materials Testing The tank shell thickness measured a minimum of 0.446 inches adjacent to the left crack and 0.445 inches adjacent to the right crack and was within specification. The tank shell steel microstructure was consistent with one typical for plain carbon steel. Its chemical composition was consistent with AAR TC128, Grade B.14 Testing of tensile specimens from the shell, oriented in the longitudinal direction of the shell, found the material exceeded the AAR TC128, Grade B minimum mechanical property requirements for yield strength, tensile strength, and elongation.15 1.5 Coupling Impact Loads 1.5.1 Finite Element Modeling and Analysis of Draft Gear Forces NTSB investigators used finite element modeling to explore an idealization of a real coupling impact scenario that could have caused the buckle found in the incident tank car shell. The magnitude of the draft gear load was varied to study the effect on the underframe and tank shell.16 Investigators also constructed and studied an alternative model with a head brace, similar

13 Home shop is the repair facility designated by the tank car owner in accordance with AAR Rules 1, 114, and 115. 14 AAR TC128, Grade B is a standard for steels used in tank car manufacturing, as specified in AAR M-1002, (AAR 2014). 15 The tensile specimens were tested in accordance with ASTM A370 (ASTM 2018). 16 In this document, draft gear refers to an entire system of draft gear components including, but not limited to, the coupler, follower, draft gear, yoke, lugs, and striker plate.

NTSB Hazardous Materials Incident Report 11 in concept to the ACF P470 retrofit.17 The model was constructed using data the NTSB collected from the mechanical testing data, and thus the behavior of the tank material in the model was considered realistic. However, in the finite element model, the force was applied quasi-statically (in effect, very slowly), so any dynamic effects of the impact between cars were not included in the model; the effects of inertia and the variability of draft gear shock-absorbing performance were beyond the scope of the study. The NTSB modeling showed that the draft gear force needed to create a buckle like that found on the incident tank car was about 3,715 kilopounds (kip). The depth contours of the tank bottom near the buckled region at the inboard end of the cradle pad give similar results to the damage found on the incident tank car. (See figure 9.)18

Figure 9. Finite element model result showing vertical displacement in inches following a quasi-static draft gear force of 3,715 kips. 1.5.2 Coupling Speed Research The AAR Tank Car Committee reported at its January 2011 meeting that the major cause of stub sill failures are heavy single-ended impacts, and that loaded cars coupling in hump yards at 7 mph and empty cars coupling at 12 mph exceed the maximum design dynamic impact load requirements for tank cars (AAR 2015). Additionally, in 2016 the FRA published the results of over-the-road testing on an instrumented DOT-111 tank car to better characterize the railway service environment. The FRA

17 The P470 retrofit is a modification to the ACF-200 underframe that is intended to address fatigue-related concerns by the application of an angle brace between the tank head and stub sill. This modification is described in Maintenance Bulletin TC-200. 18 The model had the force applied quasi-statically and was not a dynamic simulation that considered such effects as inertia. 1 kip = 1,000 pounds of force.

NTSB Hazardous Materials Incident Report 12 had documented a history of tank car stub sill fractures and the potential for them to develop into a variety of catastrophic failures and hazardous materials releases (FRA 2016). Over its 3,700-mile service test, the instrumented tank car experienced three longitudinal coupler force events that exceeded the AAR specification requiring tank cars to be capable of experiencing coupler forces of 1,000 kips without damage, all of which occurred in flat switching yards (AAR 2015). The study also found that of the 30 greatest longitudinal coupler force events, 19 occurred in flat switching yards, 10 occurred in hump yards, and only one occurred during normal operation. The highest force value produced during the testing was 1,790 kips, recorded when the instrumented tank car was being coupled into a standing set of cars from a speed of 9 mph.19 Continuing its research into the underlying causes of stub sill cracking and propagation, in 2018, the FRA Office of Research, Development and Technology conducted a series of more than 700 impact tests for different tank car configurations to provide better understanding of load scenarios during yard operations that could lead to structural damage (FRA 2019). The FRA researchers reported peak longitudinal coupler force data, as well as transferred momentum between cars for different draft gear types. Peak coupler force was measured and correlated to various impact speeds from 4 to 10 mph.20 Statistical analysis revealed that the peak longitudinal coupler force is mostly influenced by coupling speed and draft gear type, not configurations of hammer and anvil cars or whether the hammer car was loaded or empty.21 However, the impulse during the impact, which is a measure of the momentum transferred between cars, is strongly dependent on configurations of loaded and empty cars and not on draft gear type.22 The FRA study showed that at impact speeds above 7 mph, the largest peak forces measured increased sharply with impact speed, rising from about 500 kips at 7.5 mph to about 1,500 kips at 10 mph. 1.5.3 Coupling Speed Regulations and Recommended Practices Title 49 CFR 174.83, governing the switching of placarded railcars, states that any loaded railcar placarded for a Division 1.2 or Division 1.2 explosive, a Division 2.3 Hazard Zone A gas or a Division 6.1 PGI Hazard Zone A material, or a Class DOT 113 tank car displaying a Division 2.1 flammable gas placard, including a Class DOT 113 tank car containing only a residue of a Division 2.1 material, may not be cut off while in motion, or coupled into with more force than is necessary to complete the coupling, or struck by any car moving under its own momentum. On November 5, 2015, the FRA’s Railroad Safety Advisory Committee (RSAC) published Task Statement 15-04 to address hazardous materials issues, including 49 CFR 174.83 to consider a new requirement to identify high-impact forces during switching. RSAC also proposed a requirement for tank car owners to transmit information about high-energy coupling events into their maintenance and inspection programs. To date, this effort has not progressed to proposed rulemaking (DOT 2019).

19 A flat yard has a relatively flat vertical profile, whereas a hump yard has a raised portion of ground to control railcar movement by its gravity. Flat yards are generally more labor intensive because railcars are pushed by locomotives and hump yards are generally more automated and can classify a large volume of railcars more efficiently. 20 The peak coupler force measured by the FRA was a dynamic force. Therefore, the NTSB finite element modeling study that applied quasi-static coupler force are not necessarily direct correlations. 21 The impacting car is referred to as the hammer, while the impact absorbing cars are referred to as the anvil cars. 22 Impulse is the integral of the force measured over the duration of the impact.

NTSB Hazardous Materials Incident Report 13 In addition to the federal regulation, AAR Circular OT-55-Q provides industry guidance for coupling tank cars containing hazardous materials, which states, “Maximum reasonable efforts will be made to achieve coupling of loaded placarded tank cars at speeds not to exceed 4 mph (AAR 2018).” Furthermore, the AAR describes general requirements for switching placarded hazardous material railcars in its publication United States Hazardous Materials Instructions for Rail, which provides general guidelines to railroad employees on handling hazardous material shipments or incidents. The document states, “When rail cars are cut off in motion, the coupling speed must not exceed 4 mph (AAR 2015).” For tank cars transporting more dangerous materials (such as toxic inhalation hazard materials, anhydrous ammonia, and flammable gases), Circular OT-55-Q further recommends that loaded tank cars which are cut off in motion for coupling must be handled in not more than two-car cuts; and cars cut off in motion to be coupled directly to a loaded tank car of these hazardous materials must also be handled in not more than two-car cuts. This provision manages draft gear forces by controlling the mass of hammer and anvil cars in motion, thereby limiting the stress imparted to tank car shells and underframes during coupling operations. In contrast to the absence of United States prescriptive regulatory requirements to control tank car damage caused by coupler-load events, Transport Canada’s (TC) Transport of Dangerous Goods (TDG) regulations have required that a tank car containing dangerous goods may not be coupled to another railway vehicle at a relative coupling speed of greater than 9.6 km/h (6 mph) (TC 2019). The TDG regulations state that at temperatures above -13℉, single car cuts must not couple at speeds above 12 km/h (7.5 mph). These coupling speeds are based on tests in which the coupling force is less than the 1,000-kip AAR minimum longitudinal force specification that tank cars must sustain without damage (TSB 2004). TDG regulations also state that if a dangerous goods tank car is coupled with another railway vehicle and the three conditions in any one of the four rows in the following table apply, the underframe and coupling components of the tank car must be inspected to ensure their integrity before the tank car is moved more than 2 km from the place of coupling. These TDG regulations were implemented in 2002. Table. Canadian Transport of Dangerous Goods coupling speed regulatory thresholds for structural integrity inspection.

Item Combined Coupling Mass: Tank Car and Other Railway Vehicle, and their Contents

Ambient Temperature:

Relative Coupling Speed 1.

150,000 kg (330,700 lb)

≤ -25 ℃ (-13 ℉)

9.6 kph (6.0 mph)

150,000 kg (330,700 lb)

≤ -25 ℃ (-13 ℉)

12 kph (7.5 mph)

≤ 150,000 kg (330,700 lb) ≤ -25 ℃ (-13 ℉)

12.9 kph (8.0 mph)

≤ 150,000 kg (330,700 lb)

-25 ℃ (-13 ℉) 15.3 kph (9.5 mph)

TDG regulations further require the tank car owner be notified in writing within 10 days after such coupling and informed about any damage that compromises the integrity of the underframe assembly or draft gear discovered as a result of the inspection. The tank car owner must not use the tank car to transport dangerous goods until the tank undergoes visual and structural integrity inspections that include, among other things, the termination of stub sill reinforcement pad (cradle pad) closest to the midpoint of the tank car and associated welds

NTSB Hazardous Materials Incident Report 14 extending 30 centimeters (11.8 inches) toward the outboard end of the tank. The visual inspection must include the interior and exterior surfaces of the tank car except areas where an insulation system, safety system, or internal lining or coating precludes inspection (TC 2018). The structural integrity inspection must be performed by using one or more nondestructive evaluation methods set forth in Table T2 of the AAR Specifications for Tank Cars, and must include all locations of the tank car susceptible to damage, including the termination of longitudinal fillet welds with dimensions greater than 1/4 inch and within 48 inches of the bottom longitudinal centerline (AAR 2015).

NTSB Hazardous Materials Incident Report 15 2 Analysis 2.1 Coupling Impact Loads The FRA and TC have characterized high-speed yard coupling impacts as extreme, since they can result in sill separation, tank failure, or severe tank distortion and initiate sudden crack nucleation or propagation. They have also expressed concern about lower magnitude events associated with crack growth by fatigue that are not severe enough to produce obvious structural defects (Rader and Gagnon 1999). The finite element model indicated that a coupler force of 3,715 kips was required to cause the buckle observed in the incident tank car. In the FRA testing, the largest peak forces increased sharply with impact speed, rising from about 500 kips at 7.5 mph to about 1,500 kips at 10 mph (FRA 2019). A linear extrapolation of those data indicates that a force of 3,715 kips would require an impact speed of about 15.5 mph. The largest force measured in the field tests of an instrumented tank car was 1,790 kips, recorded when the instrumented tank car was being coupled into a standing set of cars from a speed of 9 mph (FRA 2016). Although the exact impact conditions cannot be determined, the results from the finite element model compared to the forces measured by the FRA testing show that the impact speed to cause the deformation observed in ADMX 29899 would have exceeded the AAR-recommended hazardous materials tank car coupling speed of 4 mph (AAR 2018). Therefore, the NTSB concludes that the tank shell buckle was likely the result of coupling at a speed higher than the AAR-recommended 4 mph. Large coupling forces that occur in yard operations have the potential to exceed yield limits of steels and initiate stub sill damage. While FRA research suggests that coupling speed has the greatest influence on the peak longitudinal impact force, a tank car’s weight has considerable effect on the impulse since larger mass corresponds to larger momentum and energy transfer (FRA 2019).The existing federal regulations do not provide an impact force or speed threshold, nor do they define what is meant by coupling with “more force than necessary.” Moreover, industry guidance for “reasonable efforts” to limit coupling speed is not an enforceable metric. Therefore, the NTSB concludes that the risk of a hazardous materials release following high-force coupling events could be mitigated if federal regulations provided limits in the combination of coupling speed and impacting mass to tank car coupler and underframe components. Therefore, the NTSB recommends that the FRA and the Pipeline and Hazardous Materials Safety Administration (PHMSA) work together to develop maximum coupling speed thresholds and impact mass limits for hazardous materials railcars. 2.2 Structural Integrity of Stub Sill Underframes NTSB investigators found that the addition of a head brace, such as the P470 enhancement type, would not have helped to prevent or relieve the formation of a shell buckle inboard of the cradle pad. Figure 10 compares the magnitude of shell buckling modeled on a tank car equipped with and without a head brace, showing nearly identical results. The left image shows the case without a head brace and the right image shows similar output when the tank is equipped with a head brace, such as the P470 enhancement.

NTSB Hazardous Materials Incident Report 16

Figure 10. Finite element modeling output showing vertical displacement contours (units in inches) of the rotated tank bottom near the buckled region. To further explain this modeling result, the NTSB simulated an additional case in which the head brace material was artificially made 10 times stiffer. The vertical displacement contours for this case resulted in a buckle of similar size to the original case. Therefore, the NTSB concludes that the decision to not install the P470 head brace enhancement on tank car ADMX 29899 did not affect the formation of a shell buckle in the region where the tank shell cracks occurred. The buckle in the tank car likely led to elevated local residual stress, particularly at discontinuities or stress concentrations such as the inboard weld terminations. Supporting this finding is AAR Maintenance Advisory MA-0123, which identifies bottom tank buckling in excess of 1/2-inch depth as a critical location defect that poses the potential for “significant disruption” to rail operations (AAR 2010). Additionally, FRA Safety Advisory 2006-04, Notice no. 2, described the same failure mode as occurred in this incident, with its alert that included the propensity for cracks to develop in pad-to-tank welds of ACF-200 stub sill tank cars (FRA 2006). Moreover, this is not the first occurrence in which NTSB investigators found the loss of tank integrity at the inboard termination of an ACF-200 tank car cradle pad. In the investigation of the rupture of a DOT-105 tank car in New Martinsville, West Virginia, NTSB investigators conducted finite element modeling to examine local stresses in the tank near the inboard end of the ACF-200 cradle pad and found stress concentrations where a shell crack initiated in an identical location as occurred with ADMX 29899 (NTSB 2019). Therefore, the NTSB concludes that the shell buckle inboard of the cradle pad led to premature fatigue cracking in the tank shell. The nonmandatory industry railcar coupling force guidance is not available for all hazardous materials. Some that are available include best practices for loaded tank cars containing flammable materials that may be assembled into high hazard flammable trains or tank cars that have been identified with damage-prone structures such as those equipped with ACF-200 stub sill underframes. Furthermore, the guidance for “reasonable efforts” to limit coupling speed is not an enforceable metric and lacks any requirement for structural integrity inspections following high-energy coupling events. Even AAR MA-0123, advising tank car owners, repair shops, and railroads to intensify inspections of stub sill structures during maintenance or other inspections does not specify events, such as energetic coupling, that would trigger the need for stub sill underframe inspections (AAR 2010). To limit the risk of tank car failure, examinations following overspeed coupling must not be limited to cursory visual examinations by railway personnel because shell damage or cracks in welds that are concealed by a tank car jacket and insulation may not be easily detected. The use of

NTSB Hazardous Materials Incident Report 17 advanced nondestructive examination techniques may also be required to identify cracks in critical locations that are not readily visible from exterior shell surfaces. Therefore, the NTSB concludes that structural integrity inspections must be performed by qualified technicians at certified tank car facilities using specialized nondestructive examination techniques with a sufficient probability of detection to ensure that critical flaws are identified in tank materials. The NTSB recommends that based on the outcome of Recommendation 1, the FRA and PHMSA require that tank cars involved in high-energy coupling-force events undergo a structural integrity inspection by a qualified technician before returning to service. 2.3 Detecting Energetic Coupling Events With the increased numbers of heavier 286,000-pound GRL railcars being placed in service, such as DOT-117 tank cars used in high hazard flammable trains, the magnitude of in-train and yard impact loads is likely to increase. In a joint white paper responding to concerns about increasing the authorized weight of tank cars from 263,000-pounds GRL to 286,000-pounds GRL, the FRA and TC noted many examples of severe impact events. Both the FRA and TC found that industry needed to develop a means to identify these types of events. Typical methods for measuring coupling speeds in hump yards include process control computers that account for multiple factors, such as weight, the distance the car must roll to connect to the string of standing railcars, and factors affecting rolling resistance. These systems are designed to automatically control coupling speed using retarders situated at various points to apply desired speed adjustment braking to slow cars down to a proper speed for damage-free coupling on classification tracks. Railcar coupling speeds are typically measured with radar, wheel sensors, or rail contact devices. However, following a 2003 accident in which a tank car that was damaged after exiting a hump yard retarder at more than double the target speed because of a malfunctioning air-pressure controller, the Transportation Safety Board of Canada (TSB) found that despite regular inspection and maintenance, overspeed coupling can occur if a retarder or controller fails to apply the necessary braking force (TSB 2004a). There is currently no requirement for rail carriers in the United States to report such overspeed coupling events to railcar owners when detected. There are existing methods to monitor overspeed and high-energy coupling force events, including on-board sensors that can provide access to real-time reporting of overspeed events and excessive coupler impact forces. Timely reports of such events can prompt the removal of damaged tank cars from hazardous materials service until necessary inspections and repairs have been completed. Monitoring solutions currently offered in the marketplace include but are not limited to telematic technology, which combines global positioning systems, wireless sensing sensors, and cellular communications networks. Telematic platforms equipped with acceleration sensors may alert asset owners when high-force impacts occur, whether container closures have been opened, or a tank has been emptied. Moreover, historical railcar operating environment data from these systems could be useful for establishing appropriate inspection and service intervals. The NTSB concludes that without a means to detect and report excessive coupling speed events, damaged tank cars such as ADMX 29899 may continue in service and pose an unnecessary risk of hazardous materials releases. Therefore, the NTSB recommends that the FRA and PHMSA develop methods to identify tank cars that have sustained overspeed and high-energy coupling

NTSB Hazardous Materials Incident Report 18 force events. In addition, the NTSB recommends that after the successful development of methods to identify tank cars that have sustained overspeed and high-energy coupling force events, the FRA and PHMSA require that rail carriers have monitoring processes in place to promptly remove damaged tank cars from hazardous materials service.

NTSB Hazardous Materials Incident Report 19 3 Conclusions 3.1 Findings

1. The tank shell buckle was likely the result of coupling at a speed above the Association

of American Railroads-recommended 4 mph.

1. The risk of a hazardous materials release following high-force coupling events could

be mitigated if federal regulations provided limits in the combination of coupling speed and impacting mass to tank car coupler and underframe components.

1. The decision to not install the P470 head brace enhancement on tank car ADMX 29899

did not affect the formation of a shell buckle in the region w